opencode-pilot 0.24.2 → 0.24.4

package/.releaserc.cjs

@@ -22,7 +22,15 @@ module.exports = {
     // Publish to npm with provenance
     ['@semantic-release/npm', { provenance: true }],
     
-    // Create GitHub release (creates the tag/tarball)
+    // Commit version bump to package.json + package-lock.json back to repo
+    // Runs in 'prepare' phase AFTER npm bumps package.json, BEFORE GitHub creates the tag
+    // This ensures the GitHub tarball includes the correct version
+    ['@semantic-release/git', {
+      assets: ['package.json', 'package-lock.json'],
+      message: 'chore(release): ${nextRelease.version} [skip ci]'
+    }],
+    
+    // Create GitHub release (creates the tag/tarball from the version-bumped commit)
     '@semantic-release/github',
     
     // Update Homebrew formula with new version and SHA (runs after release is created)

package/CONTRIBUTING.md

@@ -87,5 +87,6 @@ Releases are automated via [semantic-release](https://github.com/semantic-releas
 1. Run tests
 2. Determine the next version from commit messages
 3. Publish to npm
-4. Create a GitHub release
-5. Update the Homebrew formula
+4. Commit version bump (`package.json`, `package-lock.json`) back to the repo
+5. Create a GitHub release
+6. Update the Homebrew formula

package/Formula/opencode-pilot.rb

@@ -1,8 +1,8 @@
 class OpencodePilot < Formula
   desc "Automation daemon for OpenCode - polls GitHub/Linear issues and spawns sessions"
   homepage "https://github.com/athal7/opencode-pilot"
-  url "https://github.com/athal7/opencode-pilot/archive/refs/tags/v0.24.1.tar.gz"
-  sha256 "ea5cb01e8893bdebc24b7868659355c1762e6672bfc50b2cec775f0431381adb"
+  url "https://github.com/athal7/opencode-pilot/archive/refs/tags/v0.24.3.tar.gz"
+  sha256 "39b5b418b5af1c3731de56f549303b0af55591b5730522802d95267724889f6f"
   license "MIT"
 
   depends_on "node"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-pilot",
-  "version": "0.24.2",
+  "version": "0.24.4",
   "type": "module",
   "main": "plugin/index.js",
   "description": "Automation daemon for OpenCode - polls for work and spawns sessions",
@@ -31,6 +31,7 @@
   },
   "devDependencies": {
     "@semantic-release/exec": "^7.1.0",
+    "@semantic-release/git": "^10.0.1",
     "@semantic-release/github": "^9.2.6",
     "@semantic-release/npm": "^13.1.0",
     "semantic-release": "^25.0.2"

package/service/actions.js

@@ -14,6 +14,12 @@ import { resolveWorktreeDirectory, getProjectInfo, getProjectInfoForDirectory }
 import path from "path";
 import os from "os";
 
+// Safety timeout for the server to return HTTP response headers.
+// The /command endpoint can take 30-45s to return headers because it does
+// work before responding. The /message endpoint returns headers in ~1ms.
+// These are generous upper bounds — if exceeded, the server is genuinely stuck.
+export const HEADER_TIMEOUT_MS = 60_000;
+
 /**
  * Parse a slash command from the beginning of a prompt
  * Returns null if the prompt doesn't start with a slash command
@@ -519,6 +525,7 @@ export function selectBestSession(sessions, statuses) {
  */
 export async function sendMessageToSession(serverUrl, sessionId, directory, prompt, options = {}) {
   const fetchFn = options.fetch || fetch;
+  const headerTimeout = options.headerTimeout || HEADER_TIMEOUT_MS;
   
   try {
     // Step 1: Update session title if provided
@@ -536,9 +543,16 @@ export async function sendMessageToSession(serverUrl, sessionId, directory, prom
     // Step 2: Check if the prompt starts with a slash command
     const parsedCommand = parseSlashCommand(prompt);
     
-    // Use AbortController with timeout (same pattern as createSessionViaApi)
+    // Wait for response headers (confirming server accepted the request),
+    // then abort the body stream. Safety timeout catches stuck requests.
     const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), 10000);
+    let headersReceived = false;
+    const timeoutId = setTimeout(() => {
+      if (!headersReceived) {
+        debug(`sendMessageToSession: safety timeout - server did not return headers within ${headerTimeout}ms for session ${sessionId}`);
+        controller.abort();
+      }
+    }, headerTimeout);
     
     try {
       let response;
@@ -580,6 +594,8 @@ export async function sendMessageToSession(serverUrl, sessionId, directory, prom
         });
       }
       
+      // Headers received — cancel the safety timeout
+      headersReceived = true;
       clearTimeout(timeoutId);
       
       if (!response.ok) {
@@ -587,14 +603,17 @@ export async function sendMessageToSession(serverUrl, sessionId, directory, prom
         throw new Error(`Failed to send ${parsedCommand ? 'command' : 'message'}: ${response.status} ${errorText}`);
       }
       
-      debug(`sendMessageToSession: sent ${parsedCommand ? 'command' : 'message'} to session ${sessionId}`);
+      debug(`sendMessageToSession: ${parsedCommand ? 'command' : 'message'} accepted by server for session ${sessionId}`);
     } catch (abortErr) {
       clearTimeout(timeoutId);
-      if (abortErr.name === 'AbortError') {
-        debug(`sendMessageToSession: request started for session ${sessionId} (response aborted as expected)`);
-      } else {
-        throw abortErr;
+      if (abortErr.name === 'AbortError' && !headersReceived) {
+        throw new Error(`Server did not confirm acceptance within ${headerTimeout / 1000}s for session ${sessionId}`);
       }
+      throw abortErr;
+    } finally {
+      // Abort the body stream — we don't need the streaming response content.
+      // Done in finally to ensure cleanup regardless of success/error path.
+      controller.abort();
     }
     
     return {
@@ -670,6 +689,7 @@ export async function findReusableSession(serverUrl, directory, options = {}) {
  */
 export async function createSessionViaApi(serverUrl, directory, prompt, options = {}) {
   const fetchFn = options.fetch || fetch;
+  const headerTimeout = options.headerTimeout || HEADER_TIMEOUT_MS;
   
   let session = null;
   
@@ -706,11 +726,18 @@ export async function createSessionViaApi(serverUrl, directory, prompt, options
     // Step 3: Check if the prompt starts with a slash command
     const parsedCommand = parseSlashCommand(prompt);
     
-    // Use AbortController with timeout for the request
-    // The endpoints return a chunked/streaming response that stays open until
-    // the agent completes. We only need to verify the request was accepted.
+    // Wait for the server to return response headers (confirming it accepted the
+    // request), then abort the body stream. The /command endpoint can take 30-45s
+    // to return headers — we must NOT abort before that or we can't tell if the
+    // server actually accepted. A generous safety timeout catches truly stuck requests.
     const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), 10000); // 10 second timeout
+    let headersReceived = false;
+    const timeoutId = setTimeout(() => {
+      if (!headersReceived) {
+        debug(`createSessionViaApi: safety timeout - server did not return headers within ${headerTimeout}ms for session ${session.id}`);
+        controller.abort();
+      }
+    }, headerTimeout);
     
     try {
       let response;
@@ -755,6 +782,8 @@ export async function createSessionViaApi(serverUrl, directory, prompt, options
         });
       }
       
+      // Headers received — cancel the safety timeout
+      headersReceived = true;
       clearTimeout(timeoutId);
       
       if (!response.ok) {
@@ -762,16 +791,19 @@ export async function createSessionViaApi(serverUrl, directory, prompt, options
         throw new Error(`Failed to send ${parsedCommand ? 'command' : 'message'}: ${response.status} ${errorText}`);
       }
       
-      debug(`createSessionViaApi: sent ${parsedCommand ? 'command' : 'message'} to session ${session.id}`);
+      debug(`createSessionViaApi: ${parsedCommand ? 'command' : 'message'} accepted by server for session ${session.id}`);
     } catch (abortErr) {
       clearTimeout(timeoutId);
-      // AbortError is expected - we intentionally abort after verifying the request started
-      // The server accepted our request, we just don't need to wait for the response
-      if (abortErr.name === 'AbortError') {
-        debug(`createSessionViaApi: request started for session ${session.id} (response aborted as expected)`);
-      } else {
-        throw abortErr;
+      if (abortErr.name === 'AbortError' && !headersReceived) {
+        // Safety timeout fired before headers arrived.
+        // The server may or may not have accepted the request — we don't know.
+        throw new Error(`Server did not confirm acceptance within ${headerTimeout / 1000}s for session ${session.id}`);
       }
+      throw abortErr;
+    } finally {
+      // Abort the body stream — we don't need the streaming response content.
+      // Done in finally to ensure cleanup regardless of success/error path.
+      controller.abort();
     }
     
     return {
@@ -903,6 +935,7 @@ async function executeInDirectory(serverUrl, cwd, item, config, options = {}) {
     sessionId: result.sessionId,
     directory: cwd,
     error: result.error,
+    warning: result.warning,
   };
 }
 

package/test/unit/actions.test.js

@@ -1263,6 +1263,103 @@ Check for bugs and security issues.`;
     });
   });
 
+  describe('createSessionViaApi timeout handling', () => {
+    test('treats safety timeout as error with warning (not silent success)', async () => {
+      const { createSessionViaApi } = await import('../../service/actions.js');
+      
+      const mockSessionId = 'ses_timeout123';
+      
+      const mockFetch = async (url, opts) => {
+        const urlObj = new URL(url);
+        
+        // Session creation succeeds
+        if (urlObj.pathname === '/session' && opts?.method === 'POST') {
+          return {
+            ok: true,
+            json: async () => ({ id: mockSessionId }),
+          };
+        }
+        
+        // Title update succeeds
+        if (opts?.method === 'PATCH') {
+          return { ok: true, json: async () => ({}) };
+        }
+        
+        // Message endpoint: simulate server never returning headers
+        // by waiting until the AbortSignal fires
+        if (urlObj.pathname.includes('/message') && opts?.method === 'POST') {
+          return new Promise((resolve, reject) => {
+            if (opts.signal) {
+              opts.signal.addEventListener('abort', () => {
+                reject(new DOMException('The operation was aborted.', 'AbortError'));
+              });
+            }
+          });
+        }
+        
+        return { ok: false, text: async () => 'Not found' };
+      };
+      
+      const result = await createSessionViaApi(
+        'http://localhost:4096',
+        '/path/to/project',
+        'Fix the bug',
+        { fetch: mockFetch, title: 'Test Session', headerTimeout: 100 }
+      );
+      
+      // Should return success (session was created) but WITH a warning
+      assert.ok(result.success, 'Should return success because session was created');
+      assert.strictEqual(result.sessionId, mockSessionId, 'Should return session ID');
+      assert.ok(result.warning, 'Should include warning about timeout');
+      assert.ok(result.warning.includes('did not confirm acceptance'), 'Warning should mention acceptance timeout');
+    });
+
+    test('aborts body stream after receiving 200 headers', async () => {
+      const { createSessionViaApi } = await import('../../service/actions.js');
+      
+      const mockSessionId = 'ses_headers123';
+      let bodyAborted = false;
+      
+      const mockFetch = async (url, opts) => {
+        const urlObj = new URL(url);
+        
+        if (urlObj.pathname === '/session' && opts?.method === 'POST') {
+          return {
+            ok: true,
+            json: async () => ({ id: mockSessionId }),
+          };
+        }
+        
+        if (urlObj.pathname.includes('/message') && opts?.method === 'POST') {
+          // Track when the signal aborts (should happen after we return 200)
+          if (opts.signal) {
+            opts.signal.addEventListener('abort', () => {
+              bodyAborted = true;
+            });
+          }
+          // Return 200 immediately (simulating headers received)
+          return {
+            ok: true,
+            json: async () => ({ success: true }),
+          };
+        }
+        
+        return { ok: false, text: async () => 'Not found' };
+      };
+      
+      const result = await createSessionViaApi(
+        'http://localhost:4096',
+        '/path/to/project',
+        'Fix the bug',
+        { fetch: mockFetch }
+      );
+      
+      assert.ok(result.success, 'Should succeed');
+      assert.ok(!result.warning, 'Should NOT have a warning');
+      assert.ok(bodyAborted, 'Should have aborted the body stream after receiving headers');
+    });
+  });
+
   describe('sendMessageToSession slash command routing', () => {
     test('uses /command endpoint for slash commands', async () => {
       const { sendMessageToSession } = await import('../../service/actions.js');