commandmate 0.42.2 → 0.44.0

package/dist/cli/utils/reply-ledger.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * Reading an agent's reply out of the chat ledger (Issue #2376 / #2386 / #3039)
+ *
+ * `ask` reads the reply after its own turn; `reply` (Issue #3039) reads the
+ * latest reply of a turn somebody else sent — a worker told to "stop and
+ * report" by a supervisor nudge. Both mean the same thing by "the reply", so
+ * the rules live here once rather than in two commands that can drift:
+ *
+ * - only assistant rows in `GET /api/worktrees/:id/messages` are candidates,
+ *   prompt rows excluded;
+ * - CommandMate's own furniture (`relay-sys:` / `model-changed:`) is never an
+ *   answer;
+ * - a row a transcript reader wrote (`<tool>-turn:<id>`) wins over a scrape;
+ * - ANSI escapes and control bytes are dropped before the text is returned.
+ *
+ * What differs between the two callers — how long to hold out for a turn row,
+ * and whether an unmarked row may stand in for one — stays with the caller.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRANSCRIPT_READER_TOOLS = exports.REPLY_LOOKBACK_MESSAGES = void 0;
+exports.sanitizeReply = sanitizeReply;
+exports.replyCandidates = replyCandidates;
+exports.pickLatestReply = pickLatestReply;
+exports.requestRecentMessages = requestRecentMessages;
+exports.fetchRecentMessages = fetchRecentMessages;
+/**
+ * Chat rows read back per request.
+ *
+ * Bounded because only the tail matters and an unbounded read of a long-running
+ * worktree's history is a large response for one line of answer. Generous
+ * enough that a turn which wrote several assistant rows (a tool-use narration
+ * followed by the summary) still has its last one inside the window.
+ */
+exports.REPLY_LOOKBACK_MESSAGES = 30;
+/**
+ * The `request_id` namespace every transcript reader mints for a turn.
+ *
+ * `codex-turn:<turn_id>`, `claude-turn:<uuid>`, `antigravity-turn:<id>`,
+ * `command-code-turn:<id>` and opencode's `oc-turn:<msg id>` — mirrored here as
+ * a shape rather than imported: the CLI bundle keeps its own copies of API
+ * strings instead of pulling `src/types/agent-transcript.ts` and its dependents
+ * into `build:cli`. Matching the shape rather than a list of five literals is
+ * also what stops the sixth reader from silently landing outside the filter.
+ *
+ * A `:` cannot appear in any of the ids themselves, so this cannot match a row
+ * that merely CONTAINS the text.
+ */
+const TURN_REQUEST_ID_PATTERN = /-turn:/;
+/**
+ * Request-id namespaces CommandMate writes about a session, not for it.
+ *
+ * `chat_messages` has no `system` role, so "the model changed" (Issue #2357)
+ * and "reply from X" (Issue #2377) are both stored as ASSISTANT rows and told
+ * apart by their request id. Neither is anything the other session said, and
+ * delivering the relay notice back as an answer is the smallest possible loop —
+ * `findWorkerReply` steps over the same rows for the same reason.
+ */
+const SYSTEM_ROW_REQUEST_ID_PREFIXES = ['relay-sys:', 'model-changed:'];
+/**
+ * Tools whose reply CommandMate reads out of a transcript rather than a screen.
+ *
+ * For these five the ledger is authoritative and a row with no turn marker is
+ * by definition not the answer. For every other tool (copilot / gemini /
+ * vibe-local) the scraper's row is the only record there will ever be.
+ *
+ * Mirrors the five readers that live under `src/lib/hooks/sources/`.
+ */
+exports.TRANSCRIPT_READER_TOOLS = new Set([
+    'claude',
+    'codex',
+    'antigravity',
+    'command-code',
+    'opencode',
+]);
+/**
+ * ANSI escape sequences, as a pattern built from escapes rather than literals.
+ *
+ * `scripts/check-control-chars.mjs` fails the build on a raw C0 byte in `src/`
+ * (Issue #1432), and a raw ESC here would be one.
+ */
+const ANSI_ESCAPE_PATTERN = /[\u001B\u009B][[\]()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-PR-TZcf-nqry=><]/g;
+/** Remaining C0/C1 control bytes, once the sequences above are gone. */
+const CONTROL_CHAR_PATTERN = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g;
+/**
+ * A reply body fit to print, or `''` if nothing survived.
+ *
+ * Issue #2386 asked for this as a belt to the braces: the row the junk came
+ * from held RAW ANSI, and a caller that pipes a reply into a report or a commit
+ * message should never have to strip escape codes out of an agent's sentence.
+ *
+ * @param raw - Reply text as it arrived
+ */
+function sanitizeReply(raw) {
+    return raw.replace(ANSI_ESCAPE_PATTERN, '').replace(CONTROL_CHAR_PATTERN, '').trim();
+}
+/** Whether a row's `request_id` says a transcript reader wrote it. */
+function isTurnRow(requestId) {
+    return typeof requestId === 'string' && TURN_REQUEST_ID_PATTERN.test(requestId);
+}
+/** Whether a row is CommandMate's own furniture rather than the agent's words. */
+function isSystemRow(requestId) {
+    return typeof requestId === 'string'
+        && SYSTEM_ROW_REQUEST_ID_PREFIXES.some((prefix) => requestId.startsWith(prefix));
+}
+/**
+ * The rows that could be a reply written at or after `since`, oldest first.
+ *
+ * @param messages - Rows as the messages route serialized them
+ * @param since - Epoch ms; rows stamped earlier are not candidates
+ */
+function replyCandidates(messages, since) {
+    const candidates = [];
+    for (const m of messages) {
+        if (m.role !== 'assistant')
+            continue;
+        if (m.messageType === 'prompt')
+            continue;
+        if (typeof m.content !== 'string')
+            continue;
+        if (!(Date.parse(m.timestamp) >= since))
+            continue;
+        if (isSystemRow(m.requestId))
+            continue;
+        const content = sanitizeReply(m.content);
+        if (content === '')
+            continue;
+        candidates.push({
+            content,
+            fromTranscript: isTurnRow(m.requestId),
+            requestId: typeof m.requestId === 'string' ? m.requestId : null,
+            at: m.timestamp,
+        });
+    }
+    return candidates;
+}
+/**
+ * The newest reply among `candidates`, or null.
+ *
+ * Newest first among the rows a reader wrote: a turn that emitted several
+ * assistant rows (a narration then the summary) still ends on its summary.
+ * When `turnRowsOnly` is false and no reader wrote anything, the newest row of
+ * any kind is taken — the only record a tool without a transcript has.
+ *
+ * @param candidates - Output of {@link replyCandidates}
+ * @param turnRowsOnly - Whether an unmarked (scraped) row may stand in
+ */
+function pickLatestReply(candidates, turnRowsOnly) {
+    for (let i = candidates.length - 1; i >= 0; i -= 1) {
+        if (candidates[i].fromTranscript)
+            return candidates[i];
+    }
+    if (turnRowsOnly)
+        return null;
+    return candidates[candidates.length - 1] ?? null;
+}
+/**
+ * The recent chat rows for this instance. Throws what the API client throws.
+ *
+ * @param client - API client
+ * @param worktreeId - Worktree ID
+ * @param instanceId - Resolved instance ID, or undefined for every instance
+ */
+async function requestRecentMessages(client, worktreeId, instanceId) {
+    const query = new URLSearchParams({ limit: String(exports.REPLY_LOOKBACK_MESSAGES) });
+    if (instanceId)
+        query.set('instance', instanceId);
+    // PromptMessageResponse is the CLI's mirror of a serialized chat row; the
+    // `messageType: 'prompt'` filter is the caller's, not the type's, so it is
+    // the right shape for reading normal rows too.
+    const messages = await client.get(`/api/worktrees/${worktreeId}/messages?${query.toString()}`);
+    return Array.isArray(messages) ? messages : [];
+}
+/**
+ * {@link requestRecentMessages}, or null if the rows cannot be read.
+ *
+ * For a caller whose turn already completed: a daemon that cannot serve the
+ * ledger is a reason to fall back, not a reason to lose the turn.
+ */
+async function fetchRecentMessages(client, worktreeId, instanceId) {
+    try {
+        return await requestRecentMessages(client, worktreeId, instanceId);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/cli/utils/server-identity.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Launched-server identity check
+ * Issue #3087: `remote` published whatever answered on the port
+ *
+ * A TCP connect only proves that SOMETHING listens. In #3087 an orphaned server from an
+ * earlier `start --daemon` (no authentication) kept the port, the server `remote` launched
+ * died on EADDRINUSE, and `remote` put the orphan behind a public tunnel.
+ *
+ * Before anything is published, this asks the endpoint two questions over plain HTTP(S):
+ *
+ *  1. A request carrying a token nobody holds must be refused with 401. Anything else means
+ *     authentication is off (or the answer is not CommandMate's middleware), so the server
+ *     would be reachable without pairing.
+ *  2. A request carrying the session token `remote` minted moments ago must succeed. Only
+ *     the server launched with that token's hash can accept it, so this proves the listener
+ *     is the one this invocation started — no new API route or nonce is needed.
+ *
+ * Question 1 is asked first so the session token is never sent to a server already shown to
+ * be the wrong one. Every outcome that is not a clear "yes" to both is a refusal (fail-closed);
+ * only connection errors and 5xx (a server still warming up) are retried until the deadline.
+ *
+ * @module server-identity
+ */
+/** Path probed: authenticated like every API route, and it reads nothing (Issue #1925). */
+export declare const IDENTITY_PROBE_PATH = "/api/capabilities";
+export declare const DEFAULT_IDENTITY_TIMEOUT_MS = 30000;
+export declare const DEFAULT_IDENTITY_INTERVAL_MS = 300;
+export interface VerifyLaunchedServerOptions {
+    protocol: 'http' | 'https';
+    host: string;
+    port: number;
+    /** Plaintext session token whose hash the launched server was given */
+    sessionToken: string;
+    timeoutMs?: number;
+    intervalMs?: number;
+}
+export type LaunchedServerVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify that the endpoint is the authenticated server this invocation launched.
+ *
+ * @returns `{ ok: true }` only when an unknown token is refused with 401 AND the session
+ *   token is accepted; otherwise `{ ok: false, reason }`. Never throws.
+ */
+export declare function verifyLaunchedServer(options: VerifyLaunchedServerOptions): Promise<LaunchedServerVerdict>;
+//# sourceMappingURL=server-identity.d.ts.map

package/dist/cli/utils/server-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-identity.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/server-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AACjD,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAGhD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAqDjF;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA0ChC"}

package/dist/cli/utils/server-identity.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * Launched-server identity check
+ * Issue #3087: `remote` published whatever answered on the port
+ *
+ * A TCP connect only proves that SOMETHING listens. In #3087 an orphaned server from an
+ * earlier `start --daemon` (no authentication) kept the port, the server `remote` launched
+ * died on EADDRINUSE, and `remote` put the orphan behind a public tunnel.
+ *
+ * Before anything is published, this asks the endpoint two questions over plain HTTP(S):
+ *
+ *  1. A request carrying a token nobody holds must be refused with 401. Anything else means
+ *     authentication is off (or the answer is not CommandMate's middleware), so the server
+ *     would be reachable without pairing.
+ *  2. A request carrying the session token `remote` minted moments ago must succeed. Only
+ *     the server launched with that token's hash can accept it, so this proves the listener
+ *     is the one this invocation started — no new API route or nonce is needed.
+ *
+ * Question 1 is asked first so the session token is never sent to a server already shown to
+ * be the wrong one. Every outcome that is not a clear "yes" to both is a refusal (fail-closed);
+ * only connection errors and 5xx (a server still warming up) are retried until the deadline.
+ *
+ * @module server-identity
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_IDENTITY_INTERVAL_MS = exports.DEFAULT_IDENTITY_TIMEOUT_MS = exports.IDENTITY_PROBE_PATH = void 0;
+exports.verifyLaunchedServer = verifyLaunchedServer;
+const http_1 = require("http");
+const https_1 = require("https");
+const crypto_1 = require("crypto");
+/** Path probed: authenticated like every API route, and it reads nothing (Issue #1925). */
+exports.IDENTITY_PROBE_PATH = '/api/capabilities';
+exports.DEFAULT_IDENTITY_TIMEOUT_MS = 30000;
+exports.DEFAULT_IDENTITY_INTERVAL_MS = 300;
+const REQUEST_TIMEOUT_MS = 10000;
+function probe(options, bearer, timeoutMs) {
+    return new Promise((resolve) => {
+        const send = options.protocol === 'https' ? https_1.request : http_1.request;
+        let settled = false;
+        const finish = (status) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(status);
+        };
+        try {
+            const req = send({
+                host: options.host,
+                port: options.port,
+                path: exports.IDENTITY_PROBE_PATH,
+                method: 'GET',
+                headers: { Authorization: `Bearer ${bearer}` },
+                timeout: timeoutMs,
+                // Loopback only, and identity is proven by the token, not the certificate: a
+                // self-signed CM_HTTPS_CERT must not make the check impossible.
+                rejectUnauthorized: false,
+            }, (res) => {
+                res.resume();
+                finish(res.statusCode ?? null);
+            });
+            req.on('timeout', () => {
+                req.destroy();
+                finish(null);
+            });
+            req.on('error', () => finish(null));
+            req.end();
+        }
+        catch {
+            finish(null);
+        }
+    });
+}
+function isTransient(status) {
+    return status === null || status >= 500;
+}
+/**
+ * Verify that the endpoint is the authenticated server this invocation launched.
+ *
+ * @returns `{ ok: true }` only when an unknown token is refused with 401 AND the session
+ *   token is accepted; otherwise `{ ok: false, reason }`. Never throws.
+ */
+async function verifyLaunchedServer(options) {
+    const timeoutMs = options.timeoutMs ?? exports.DEFAULT_IDENTITY_TIMEOUT_MS;
+    const intervalMs = options.intervalMs ?? exports.DEFAULT_IDENTITY_INTERVAL_MS;
+    const deadline = Date.now() + timeoutMs;
+    // A token that cannot be anyone's: fresh random bytes, never hashed or stored anywhere.
+    const decoy = (0, crypto_1.randomBytes)(32).toString('hex');
+    const where = `${options.host}:${options.port}`;
+    const ask = async (bearer) => {
+        for (;;) {
+            const remaining = deadline - Date.now();
+            const status = await probe(options, bearer, Math.max(Math.min(REQUEST_TIMEOUT_MS, remaining), 1));
+            if (!isTransient(status) || deadline - Date.now() <= 0) {
+                return status;
+            }
+            await new Promise((resolve) => setTimeout(resolve, Math.min(intervalMs, Math.max(deadline - Date.now(), 1))));
+        }
+    };
+    const unauthenticated = await ask(decoy);
+    if (unauthenticated !== 401) {
+        return {
+            ok: false,
+            reason: unauthenticated === null
+                ? `nothing answered on ${where}`
+                : `the server on ${where} did not require authentication (HTTP ${unauthenticated} for an unknown token, expected 401)`,
+        };
+    }
+    const authenticated = await ask(options.sessionToken);
+    if (authenticated === null || authenticated < 200 || authenticated >= 300) {
+        return {
+            ok: false,
+            reason: authenticated === null
+                ? `nothing answered on ${where}`
+                : `the server on ${where} is not the one this command started (HTTP ${authenticated} for this session's token)`,
+        };
+    }
+    return { ok: true };
+}

package/dist/cli/utils/server-ready.d.ts

@@ -25,4 +25,17 @@ export declare const DEFAULT_INTERVAL_MS = 300;
  * @returns true if the server accepted a connection, false on timeout
  */
 export declare function waitForServer(host: string, port: number, options?: WaitForServerOptions): Promise<boolean>;
+/**
+ * Whether something is accepting TCP connections on host:port right now.
+ *
+ * Issue #3087: a single attempt, used where "the port is free" has to be proven
+ * (before `start` spawns a server, after `stop` claims to have stopped one)
+ * rather than waited for.
+ *
+ * @param host - Host to connect to
+ * @param port - Port to connect to
+ * @param timeoutMs - How long one connection attempt may take
+ * @returns true if a connection was accepted
+ */
+export declare function isPortInUse(host: string, port: number, timeoutMs?: number): Promise<boolean>;
 //# sourceMappingURL=server-ready.d.ts.map

package/dist/cli/utils/server-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-ready.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/server-ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AACxC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,OAAO,CAAC,CAmBlB"}
+{"version":3,"file":"server-ready.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/server-ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AACxC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAElG"}

package/dist/cli/utils/server-ready.js

@@ -12,6 +12,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_INTERVAL_MS = exports.DEFAULT_TIMEOUT_MS = void 0;
 exports.waitForServer = waitForServer;
+exports.isPortInUse = isPortInUse;
 const net_1 = require("net");
 exports.DEFAULT_TIMEOUT_MS = 30000;
 exports.DEFAULT_INTERVAL_MS = 300;
@@ -39,6 +40,21 @@ async function waitForServer(host, port, options = {}) {
         await delay(Math.min(intervalMs, remaining));
     }
 }
+/**
+ * Whether something is accepting TCP connections on host:port right now.
+ *
+ * Issue #3087: a single attempt, used where "the port is free" has to be proven
+ * (before `start` spawns a server, after `stop` claims to have stopped one)
+ * rather than waited for.
+ *
+ * @param host - Host to connect to
+ * @param port - Port to connect to
+ * @param timeoutMs - How long one connection attempt may take
+ * @returns true if a connection was accepted
+ */
+function isPortInUse(host, port, timeoutMs = 1000) {
+    return tryConnect(host, port, timeoutMs);
+}
 /**
  * Attempt a single TCP connection.
  *

package/dist/lib/cli-tools/copilot-executable.d.ts

@@ -67,6 +67,15 @@ export declare const COPILOT_VERSION_PROBE_TIMEOUT_MS = 5000;
  * is; what is copilot-specific is the caller below.
  */
 export declare function findExecutableOnPath(name: string): string | null;
+/**
+ * Every executable named `name` on `PATH`, in `PATH` order, up to `limit`.
+ *
+ * Issue #2939: `opencode` can name two different programs on one machine
+ * (OpenCode 1.x's installer and `@opencode/cli`, which registers `opencode`
+ * next to `opencode2`), so "the first one" is not always the one a tool wants.
+ * The same walk as {@link findExecutableOnPath}, not a second copy of it.
+ */
+export declare function findExecutablesOnPath(name: string, limit?: number): string[];
 /**
  * The copilot this machine would actually run, or null when there is none.
  *

package/dist/lib/cli-tools/copilot-executable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copilot-executable.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/copilot-executable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAQH;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,YAAY,CAAC;AAE5D,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C;AAQD,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAyBrD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAShE;AAuCD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAiBlF"}
+{"version":3,"file":"copilot-executable.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/copilot-executable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAQH;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,YAAY,CAAC;AAE5D,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C;AAQD,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAyBrD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAiB,GAAG,MAAM,EAAE,CAYtF;AAuCD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAiBlF"}

package/dist/lib/cli-tools/copilot-executable.js

@@ -39,6 +39,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COPILOT_VERSION_PROBE_TIMEOUT_MS = void 0;
 exports.findExecutableOnPath = findExecutableOnPath;
+exports.findExecutablesOnPath = findExecutablesOnPath;
 exports.resolveCopilotExecutable = resolveCopilotExecutable;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
@@ -83,17 +84,32 @@ function isExecutableFile(candidate) {
  * is; what is copilot-specific is the caller below.
  */
 function findExecutableOnPath(name) {
+    return findExecutablesOnPath(name, 1)[0] ?? null;
+}
+/**
+ * Every executable named `name` on `PATH`, in `PATH` order, up to `limit`.
+ *
+ * Issue #2939: `opencode` can name two different programs on one machine
+ * (OpenCode 1.x's installer and `@opencode/cli`, which registers `opencode`
+ * next to `opencode2`), so "the first one" is not always the one a tool wants.
+ * The same walk as {@link findExecutableOnPath}, not a second copy of it.
+ */
+function findExecutablesOnPath(name, limit = Infinity) {
     const rawPath = process.env.PATH;
-    if (!rawPath)
-        return null;
+    if (!rawPath || limit <= 0)
+        return [];
+    const found = [];
     for (const directory of rawPath.split(path_1.delimiter)) {
         if (!directory)
             continue;
         const candidate = (0, path_1.join)(directory, name);
-        if (isExecutableFile(candidate))
-            return candidate;
+        if (found.includes(candidate) || !isExecutableFile(candidate))
+            continue;
+        found.push(candidate);
+        if (found.length >= limit)
+            break;
     }
-    return null;
+    return found;
 }
 /**
  * Where `gh copilot` puts the copy it downloads.

package/dist/lib/cli-tools/opencode-executable.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Which `opencode` is OpenCode 1.x and which is OpenCode V2 (Issue #2939).
+ *
+ * ## Why the name is not enough
+ *
+ * OpenCode V2's npm package `@opencode/cli` (2.0.18) registers **both**
+ * `opencode` and `opencode2` in its `bin`. So on a machine that has it,
+ * `opencode` may be OpenCode 1.x (its own installer, `~/.opencode/bin`) or
+ * OpenCode V2 (`/opt/homebrew/bin/opencode`), decided by nothing but the order
+ * of `PATH`. Asking `which opencode` then answers "OpenCode is installed" for a
+ * V2 binary, and the v1 launch line (`opencode --port N --hostname …`) reaches
+ * a program that has neither flag.
+ *
+ * The answer here is the version each candidate prints about itself:
+ *
+ *  - OpenCode 1.x prints a bare `1.18.33`;
+ *  - OpenCode V2 prints `opencode v2.0.18`.
+ *
+ * Every `opencode` / `opencode2` on `PATH` is a candidate, not just the first,
+ * so a V2 `opencode` earlier on `PATH` no longer hides a 1.x one behind it.
+ *
+ * ## Probe and launch are one measurement
+ *
+ * The path that answered is the path the launch line runs — the rule
+ * `./copilot-executable` set for copilot (#1907). The server resolves names on
+ * its own `PATH`, the pane on its login shell's; typing a bare `opencode` would
+ * let the two disagree.
+ *
+ * ## Cost
+ *
+ * `opencode --version` takes ~0.4 s and both tools probe `opencode`, so one
+ * probe per path is shared for {@link OPENCODE_EXECUTABLE_CACHE_TTL_MS}, and a
+ * concurrent caller gets the probe already in flight.
+ *
+ * @module lib/cli-tools/opencode-executable
+ */
+/** OpenCode 1.x's executable name (tool id `opencode`). */
+export declare const OPENCODE_V1_BINARY_NAME = "opencode";
+/** OpenCode V2's own executable name (tool id `opencode-v2`). */
+export declare const OPENCODE_V2_BINARY_NAME = "opencode2";
+/** Budget for one `--version`. */
+export declare const OPENCODE_VERSION_PROBE_TIMEOUT_MS = 5000;
+/** How long one probe result is reused (same TTL as the installed-agents cache). */
+export declare const OPENCODE_EXECUTABLE_CACHE_TTL_MS = 30000;
+/** Which OpenCode a binary is. */
+export type OpencodeGeneration = 'v1' | 'v2';
+/** What `--version` said, when it said something recognisable. */
+export interface OpencodeVersionInfo {
+    readonly generation: OpencodeGeneration;
+    /** `major.minor.patch` (plus any pre-release suffix). */
+    readonly version: string;
+}
+/**
+ * Classify `opencode --version` / `opencode2 --version` output.
+ *
+ * A line has to be a version in one of the two forms and nothing else, so a
+ * different program that happens to print a number is not taken for either.
+ * The major version decides: 1 is OpenCode 1.x, 2 or later is OpenCode V2.
+ * `0.x` (the pre-1.0 `opencode`) and anything unreadable are null.
+ *
+ * @returns The generation and version, or null when the output is not OpenCode's
+ */
+export declare function parseOpencodeVersionOutput(output: string): OpencodeVersionInfo | null;
+/** One candidate and what it answered (null: no recognisable answer). */
+export interface OpencodeProbe {
+    readonly path: string;
+    readonly info: OpencodeVersionInfo | null;
+}
+/** The binary a tool will run. */
+export interface OpencodeExecutable {
+    /** Absolute path, as found on `PATH` — the launch line runs exactly this. */
+    readonly path: string;
+    readonly version: string;
+    readonly generation: OpencodeGeneration;
+}
+/** A resolution: what was chosen, and every candidate asked on the way. */
+export interface OpencodeResolution {
+    readonly executable: OpencodeExecutable | null;
+    readonly probed: readonly OpencodeProbe[];
+}
+/** Forget every cached probe (tests, and a caller that knows the install changed). */
+export declare function clearOpencodeExecutableCache(): void;
+/** `<path> --version`, classified; cached per path. Never rejects. */
+export declare function probeOpencodeExecutable(path: string): Promise<OpencodeVersionInfo | null>;
+/**
+ * OpenCode 1.x: the first `opencode` on `PATH` that prints a 1.x version.
+ * An `opencode` that answers `opencode v2.x` is skipped, never launched.
+ */
+export declare function resolveOpencodeV1Executable(): Promise<OpencodeResolution>;
+/**
+ * OpenCode V2: `opencode2` first, then an `opencode` that prints
+ * `opencode v2.x` — for an operator who has V2 only under the `opencode` name.
+ */
+export declare function resolveOpencodeV2Executable(): Promise<OpencodeResolution>;
+/**
+ * Why OpenCode 1.x counts as not installed, when there is more to say than
+ * "no `opencode` on PATH".
+ *
+ * @returns A sentence naming the `opencode` that is there and what it is, or
+ *   null when nothing called `opencode` was found at all
+ */
+export declare function describeOpencodeV1Unavailable(resolution: OpencodeResolution): string | null;
+//# sourceMappingURL=opencode-executable.d.ts.map

package/dist/lib/cli-tools/opencode-executable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-executable.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/opencode-executable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,kCAAkC;AAClC,eAAO,MAAM,iCAAiC,OAAO,CAAC;AAKtD,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAKvD,kCAAkC;AAClC,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAQD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAarF;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC3C;AAED,kCAAkC;AAClC,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AASD,sFAAsF;AACtF,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AA2BD,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAOzF;AAqBD;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAEzE;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAEzE;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAe3F"}