commandmate 0.42.1 → 0.43.0

package/dist/server/src/lib/hooks/sources/opencode-v2/reattach.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * CommandMate startup sweep for OpenCode V2 instances (Issue #2934).
+ *
+ * The role v1's `../opencode/reattach` plays, plus the password files:
+ *
+ *  - an instance whose tmux session is still alive gets its subscription back,
+ *    from the persisted port and the password file on disk (D5, last row);
+ *  - an instance whose session is gone has its password file deleted and its
+ *    port assignment dropped (D3). Nothing can use them any more — the server
+ *    they belonged to died with the pane, because `launch.sh` stops it on every
+ *    way out.
+ *
+ * Candidates are the union of the password files and the persisted ports, so
+ * a password left behind by a crash is swept even when its port entry is not.
+ *
+ * Fail-open and never rejects.
+ *
+ * @module lib/hooks/sources/opencode-v2/reattach
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.opencodeV2TargetOfKey = opencodeV2TargetOfKey;
+exports.reattachOpencodeV2EventStreams = reattachOpencodeV2EventStreams;
+const auto_yes_state_1 = require("../../../../lib/auto-yes-state");
+const logger_1 = require("../../../../lib/logger");
+const ports_1 = require("./ports");
+const runtime_1 = require("./runtime");
+const secrets_1 = require("./secrets");
+const tool_id_1 = require("./tool-id");
+const logger = (0, logger_1.createLogger)('lib/hooks/sources/opencode-v2/reattach');
+/** The instance a composite key names, when it is an OpenCode V2 key. */
+function opencodeV2TargetOfKey(key) {
+    if ((0, auto_yes_state_1.extractCliToolId)(key) !== tool_id_1.OPENCODE_V2_CLI_TOOL_ID)
+        return null;
+    const worktreeId = (0, auto_yes_state_1.extractWorktreeId)(key);
+    const instanceId = (0, auto_yes_state_1.extractInstanceId)(key);
+    if (worktreeId.length === 0 || instanceId === null || instanceId.length === 0)
+        return null;
+    return { worktreeId, cliToolId: tool_id_1.OPENCODE_V2_CLI_TOOL_ID, instanceId };
+}
+async function defaultDeps() {
+    const { CLIToolManager } = await Promise.resolve().then(() => __importStar(require('../../../../lib/cli-tools/manager')));
+    const tool = CLIToolManager.getInstance().getTool(tool_id_1.OPENCODE_V2_CLI_TOOL_ID);
+    let resolveWorktreePath = () => null;
+    try {
+        const [{ getDbInstance }, { getWorktreeById }] = await Promise.all([
+            Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
+            Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
+        ]);
+        const db = getDbInstance();
+        resolveWorktreePath = (worktreeId) => getWorktreeById(db, worktreeId)?.path ?? null;
+    }
+    catch (error) {
+        logger.warn('opencode-v2-reattach-worktree-lookup-unavailable', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return {
+        isPaneRunning: (target) => tool.isRunning(target.worktreeId, target.instanceId),
+        resolveWorktreePath,
+        resume: runtime_1.resumeOpencodeV2EventStream,
+    };
+}
+/**
+ * Re-subscribe live instances and sweep dead ones.
+ *
+ * @param deps - Collaborators; production passes none
+ */
+async function reattachOpencodeV2EventStreams(deps) {
+    const report = { known: 0, candidates: 0, reattached: 0, swept: 0 };
+    try {
+        const keys = new Set([
+            ...(0, secrets_1.listOpencodeV2PasswordKeys)(),
+            ...Object.keys((0, ports_1.readPersistedOpencodeV2Ports)()),
+        ]);
+        const entries = [];
+        for (const key of keys) {
+            const target = opencodeV2TargetOfKey(key);
+            if (target !== null)
+                entries.push({ key, target });
+        }
+        report.known = entries.length;
+        if (entries.length === 0)
+            return report;
+        const resolved = deps ?? (await defaultDeps());
+        await Promise.all(entries.map(async ({ key, target }) => {
+            let running = false;
+            try {
+                running = await resolved.isPaneRunning(target);
+            }
+            catch {
+                running = false;
+            }
+            if (!running) {
+                (0, secrets_1.removeOpencodeV2PasswordByKey)(key);
+                (0, ports_1.forgetOpencodeV2PortByKey)(key);
+                report.swept += 1;
+                return;
+            }
+            report.candidates += 1;
+            const worktreePath = resolved.resolveWorktreePath(target.worktreeId);
+            if (worktreePath === null)
+                return;
+            if (await resolved.resume(target, worktreePath))
+                report.reattached += 1;
+        }));
+        logger.info('opencode-v2-reattach-complete', { ...report });
+        return report;
+    }
+    catch (error) {
+        logger.warn('opencode-v2-reattach-failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return report;
+    }
+}

package/dist/server/src/lib/hooks/sources/opencode-v2/runtime.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * The calls `cli-tools/opencode-v2.ts` makes around a pane's life
+ * (Issue #2934).
+ *
+ *  - {@link reserveOpencodeV2Server} before the launch line is built: a port
+ *    and a fresh password file, which `prepareOpencodeV2Launch` turns into the
+ *    wrapper's arguments;
+ *  - {@link attachOpencodeV2EventStream} once the TUI is up;
+ *  - {@link resumeOpencodeV2EventStream} for a pane that outlived a CommandMate
+ *    restart;
+ *  - {@link releaseOpencodeV2Server} when the pane is killed: subscription,
+ *    port assignment and password file, all three.
+ *
+ * Every one of them is fail-open. A pane that runs without structured events is
+ * still driven by the screen scraper.
+ *
+ * @module lib/hooks/sources/opencode-v2/runtime
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPENCODE_V2_ATTACH_PROBE_DELAYS_MS = void 0;
+exports.opencodeV2Target = opencodeV2Target;
+exports.reserveOpencodeV2Server = reserveOpencodeV2Server;
+exports.isOpencodeV2ServerOurs = isOpencodeV2ServerOurs;
+exports.attachOpencodeV2EventStream = attachOpencodeV2EventStream;
+exports.resumeOpencodeV2EventStream = resumeOpencodeV2EventStream;
+exports.releaseOpencodeV2Server = releaseOpencodeV2Server;
+const logger_1 = require("../../../../lib/logger");
+const client_1 = require("./client");
+const ingest_1 = require("./ingest");
+const ports_1 = require("./ports");
+const secrets_1 = require("./secrets");
+const source_1 = require("./source");
+const subscription_1 = require("./subscription");
+const tool_id_1 = require("./tool-id");
+const logger = (0, logger_1.createLogger)('lib/hooks/sources/opencode-v2/runtime');
+/** Waits before each health probe of a freshly started server. */
+exports.OPENCODE_V2_ATTACH_PROBE_DELAYS_MS = [0, 500, 1_000, 2_000];
+/** The instance reference every OpenCode V2 call keys off. */
+function opencodeV2Target(worktreeId, instanceId) {
+    return { worktreeId, cliToolId: tool_id_1.OPENCODE_V2_CLI_TOOL_ID, instanceId };
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Reserve a port and write a fresh password file for one launch.
+ *
+ * @returns The port, or null when either could not be had — the launch line
+ *   then degrades to `--standalone` (see `prepareOpencodeV2Launch`)
+ */
+async function reserveOpencodeV2Server(target, worktreePath) {
+    try {
+        const port = await (0, ports_1.allocateOpencodeV2Port)(target, worktreePath);
+        if (port === null)
+            return null;
+        (0, secrets_1.writeOpencodeV2Password)(target);
+        return port;
+    }
+    catch (error) {
+        logger.warn('opencode-v2-server-reserve-failed', {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId ?? target.cliToolId,
+            error: errorMessage(error),
+        });
+        return null;
+    }
+}
+/** Whether the server on `port` accepts the instance's current password. */
+async function isOpencodeV2ServerOurs(target, port) {
+    const password = (0, secrets_1.readOpencodeV2Password)(target);
+    if (password === null)
+        return false;
+    return (await (0, client_1.probeOpencodeV2Server)(port, password)).kind === 'healthy';
+}
+/**
+ * Subscribe to the instance's server.
+ *
+ * @returns Whether a subscription is open afterwards
+ */
+async function attachOpencodeV2EventStream(target) {
+    try {
+        const port = (0, ports_1.getAssignedOpencodeV2Port)(target);
+        if (port === null)
+            return false;
+        if ((0, subscription_1.isOpencodeV2Subscribed)(target))
+            return true;
+        let healthy = false;
+        for (const waitMs of exports.OPENCODE_V2_ATTACH_PROBE_DELAYS_MS) {
+            if (waitMs > 0)
+                await new Promise((resolve) => setTimeout(resolve, waitMs));
+            if (await isOpencodeV2ServerOurs(target, port)) {
+                healthy = true;
+                break;
+            }
+        }
+        if (!healthy) {
+            logger.info('opencode-v2-server-not-reachable', {
+                worktreeId: target.worktreeId,
+                instanceId: target.instanceId ?? target.cliToolId,
+                port,
+            });
+            return false;
+        }
+        await source_1.opencodeV2AgentEventSource.subscribe(target, (event) => {
+            void (0, ingest_1.ingestOpencodeV2Event)(target, event);
+        });
+        logger.info('opencode-v2-event-stream-attached', {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId ?? target.cliToolId,
+            port,
+        });
+        return true;
+    }
+    catch (error) {
+        logger.warn('opencode-v2-event-stream-attach-failed', {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId ?? target.cliToolId,
+            error: errorMessage(error),
+        });
+        return false;
+    }
+}
+/**
+ * Re-subscribe to a server that outlived a CommandMate restart, from the
+ * persisted port and the password file on disk.
+ *
+ * @returns Whether a subscription is open afterwards
+ */
+async function resumeOpencodeV2EventStream(target, worktreePath) {
+    try {
+        if ((0, subscription_1.isOpencodeV2Subscribed)(target))
+            return true;
+        const port = await (0, ports_1.recoverOpencodeV2Port)(target, worktreePath, (candidate) => isOpencodeV2ServerOurs(target, candidate));
+        if (port === null)
+            return false;
+        return await attachOpencodeV2EventStream(target);
+    }
+    catch (error) {
+        logger.warn('opencode-v2-event-stream-resume-failed', {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId ?? target.cliToolId,
+            error: errorMessage(error),
+        });
+        return false;
+    }
+}
+/**
+ * Let go of everything the instance held: the subscription, the port
+ * assignment and the password file.
+ */
+async function releaseOpencodeV2Server(target) {
+    try {
+        await (0, subscription_1.closeOpencodeV2Subscription)(target);
+    }
+    catch (error) {
+        logger.warn('opencode-v2-subscription-close-failed', {
+            worktreeId: target.worktreeId,
+            error: errorMessage(error),
+        });
+    }
+    try {
+        (0, ports_1.forgetOpencodeV2Port)(target);
+    }
+    catch (error) {
+        logger.warn('opencode-v2-port-forget-failed', {
+            worktreeId: target.worktreeId,
+            error: errorMessage(error),
+        });
+    }
+    try {
+        (0, secrets_1.removeOpencodeV2Password)(target);
+    }
+    catch (error) {
+        logger.warn('opencode-v2-password-remove-failed', {
+            worktreeId: target.worktreeId,
+            error: errorMessage(error),
+        });
+    }
+}

package/dist/server/src/lib/hooks/sources/opencode-v2/secrets.js

@@ -0,0 +1,182 @@
+"use strict";
+/**
+ * The per-instance server password of OpenCode V2 (Issue #2934, decision D3).
+ *
+ * `opencode2 serve` authenticates every request by default (Basic, user
+ * `opencode`). Started without `OPENCODE_SERVER_PASSWORD` it invents a password
+ * and PRINTS it on stdout, which in a tmux pane means onto the screen
+ * CommandMate renders; started with the variable, it uses that value and prints
+ * nothing (measured on 2.0.18, #2370 Phase 0 (a)). So CommandMate generates a
+ * fresh value per launch and hands it over through a file:
+ *
+ *  - `~/.commandmate/opencode-v2/<composite key>.pw`, the file 0600 and the
+ *    directory 0700, so only the same OS user can read it;
+ *  - `scripts/opencode-v2/launch.sh` reads it and exports it to the serve and
+ *    TUI processes as `OPENCODE_SERVER_PASSWORD` and nowhere else;
+ *  - the SSE subscription (`./client`) reads it for its `Authorization` header.
+ *
+ * What is deliberately NOT a carrier: `AgentLaunchPlan.env` and `command` (the
+ * line typed into the pane, readable by `ps` and echoed on the terminal — pinned
+ * by `tests/unit/lib/agent-launch-plan-secrets-1933.test.ts`), the tmux screen,
+ * and every log line this module and its callers write (they name the PATH at
+ * most, never the value).
+ *
+ * Accepted, and written down so nobody has to rediscover it: the serve and TUI
+ * processes hold the password in their environment, and so does every shell
+ * tool the agent runs, because those inherit the TUI's environment. The server
+ * listens on 127.0.0.1 only, so what the password guards never leaves the
+ * machine, and anyone who can read another process's environment is already the
+ * same OS user.
+ *
+ * The file is deleted by `killSession` and, at CommandMate startup, for every
+ * instance whose tmux session is gone (`./reattach`).
+ *
+ * @module lib/hooks/sources/opencode-v2/secrets
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPENCODE_V2_PASSWORD_SUFFIX = exports.OPENCODE_V2_PASSWORD_BYTES = exports.OPENCODE_V2_DIR_ENV = void 0;
+exports.getOpencodeV2StateDir = getOpencodeV2StateDir;
+exports.ensureOpencodeV2StateDir = ensureOpencodeV2StateDir;
+exports.opencodeV2KeyOf = opencodeV2KeyOf;
+exports.opencodeV2FileStem = opencodeV2FileStem;
+exports.opencodeV2KeyOfFileStem = opencodeV2KeyOfFileStem;
+exports.getOpencodeV2PasswordFilePath = getOpencodeV2PasswordFilePath;
+exports.generateOpencodeV2Password = generateOpencodeV2Password;
+exports.writeOpencodeV2Password = writeOpencodeV2Password;
+exports.readOpencodeV2Password = readOpencodeV2Password;
+exports.readOpencodeV2PasswordByKey = readOpencodeV2PasswordByKey;
+exports.removeOpencodeV2Password = removeOpencodeV2Password;
+exports.removeOpencodeV2PasswordByKey = removeOpencodeV2PasswordByKey;
+exports.listOpencodeV2PasswordKeys = listOpencodeV2PasswordKeys;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const safe_directory_1 = require("../../../../config/safe-directory");
+const auto_yes_state_1 = require("../../../../lib/auto-yes-state");
+/** Environment variable that relocates the whole OpenCode V2 state directory. */
+exports.OPENCODE_V2_DIR_ENV = 'CM_OPENCODE_V2_DIR';
+/** Bytes of entropy per password. D3 asks for at least 32. */
+exports.OPENCODE_V2_PASSWORD_BYTES = 32;
+/** Suffix of a password file. */
+exports.OPENCODE_V2_PASSWORD_SUFFIX = '.pw';
+/**
+ * Where OpenCode V2's per-instance state (passwords, port assignments) lives.
+ *
+ * `~/.commandmate/opencode-v2`, or `$CM_OPENCODE_V2_DIR`. Resolved on every call
+ * so a test that points `HOME` or the variable somewhere else is honoured.
+ */
+function getOpencodeV2StateDir() {
+    const fallback = (0, path_1.join)((0, os_1.homedir)(), '.commandmate', 'opencode-v2');
+    return (0, safe_directory_1.resolveSafeDirectory)(process.env[exports.OPENCODE_V2_DIR_ENV], fallback, exports.OPENCODE_V2_DIR_ENV);
+}
+/**
+ * Create the state directory with owner-only access.
+ *
+ * `mkdirSync`'s `mode` is filtered by the umask and ignored for a directory that
+ * already exists, so the permission is set explicitly afterwards.
+ */
+function ensureOpencodeV2StateDir() {
+    const dir = getOpencodeV2StateDir();
+    (0, fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    (0, fs_1.chmodSync)(dir, 0o700);
+    return dir;
+}
+/** The composite key of an instance, as the rest of CommandMate spells it. */
+function opencodeV2KeyOf(target) {
+    return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
+}
+/**
+ * The file name a composite key is stored under.
+ *
+ * The key's `:` separators are kept (they are legal in a POSIX file name and the
+ * file then reads as the key it belongs to); anything that could leave the
+ * directory — a `/`, a `..` — is percent-encoded.
+ */
+function opencodeV2FileStem(key) {
+    return encodeURIComponent(key).replace(/%3A/gi, ':').replace(/\./g, '%2E');
+}
+/** The inverse of {@link opencodeV2FileStem}, or null for a name it never wrote. */
+function opencodeV2KeyOfFileStem(stem) {
+    try {
+        return decodeURIComponent(stem);
+    }
+    catch {
+        return null;
+    }
+}
+/** Absolute path of an instance's password file. */
+function getOpencodeV2PasswordFilePath(target) {
+    return (0, path_1.join)(getOpencodeV2StateDir(), `${opencodeV2FileStem(opencodeV2KeyOf(target))}${exports.OPENCODE_V2_PASSWORD_SUFFIX}`);
+}
+/** A new password: {@link OPENCODE_V2_PASSWORD_BYTES} random bytes, URL-safe base64. */
+function generateOpencodeV2Password() {
+    return (0, crypto_1.randomBytes)(exports.OPENCODE_V2_PASSWORD_BYTES).toString('base64url');
+}
+/**
+ * Generate a fresh password for one launch and write it to the instance's file.
+ *
+ * Always a new value: a relaunch must not reuse the previous server's password,
+ * and an old file left behind by a crash is overwritten rather than trusted.
+ *
+ * @returns The file's path. The value itself is not returned on purpose — the
+ *   launch path has no business holding it.
+ */
+function writeOpencodeV2Password(target) {
+    ensureOpencodeV2StateDir();
+    const path = getOpencodeV2PasswordFilePath(target);
+    // Removed first so `mode` applies: `writeFileSync` only honours it when it
+    // creates the file.
+    (0, fs_1.rmSync)(path, { force: true });
+    (0, fs_1.writeFileSync)(path, `${generateOpencodeV2Password()}\n`, { mode: 0o600, flag: 'wx' });
+    (0, fs_1.chmodSync)(path, 0o600);
+    return path;
+}
+/** The instance's password, or null when it has no (readable, non-empty) file. */
+function readOpencodeV2Password(target) {
+    return readPasswordFile(getOpencodeV2PasswordFilePath(target));
+}
+/**
+ * {@link readOpencodeV2Password} by composite key — the form the persisted port
+ * assignments are keyed by (Issue #2944: the slash palette knows a worktree,
+ * not an instance, so it walks `ports.json` and needs each entry's password).
+ */
+function readOpencodeV2PasswordByKey(key) {
+    return readPasswordFile((0, path_1.join)(getOpencodeV2StateDir(), `${opencodeV2FileStem(key)}${exports.OPENCODE_V2_PASSWORD_SUFFIX}`));
+}
+function readPasswordFile(path) {
+    try {
+        const value = (0, fs_1.readFileSync)(path, 'utf8').split('\n')[0];
+        return value !== undefined && value.length > 0 ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Delete the instance's password file. A missing file is not an error. */
+function removeOpencodeV2Password(target) {
+    (0, fs_1.rmSync)(getOpencodeV2PasswordFilePath(target), { force: true });
+}
+/** Delete a password file by its composite key (the startup sweep's form). */
+function removeOpencodeV2PasswordByKey(key) {
+    (0, fs_1.rmSync)((0, path_1.join)(getOpencodeV2StateDir(), `${opencodeV2FileStem(key)}${exports.OPENCODE_V2_PASSWORD_SUFFIX}`), { force: true });
+}
+/** The composite keys that currently have a password file. */
+function listOpencodeV2PasswordKeys() {
+    let names;
+    try {
+        names = (0, fs_1.readdirSync)(getOpencodeV2StateDir());
+    }
+    catch {
+        return [];
+    }
+    const keys = [];
+    for (const name of names) {
+        if (!name.endsWith(exports.OPENCODE_V2_PASSWORD_SUFFIX))
+            continue;
+        const key = opencodeV2KeyOfFileStem(name.slice(0, -exports.OPENCODE_V2_PASSWORD_SUFFIX.length));
+        if (key !== null && key.length > 0)
+            keys.push(key);
+    }
+    return keys;
+}