opencode-worker 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,92 @@
-# Temporary Holding Version
+# opencode-worker
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Run the official OpenCode CLI as an isolated, time-boxed worker. One package, two entry points:
+
+- `opencode-worker run` — CLI, prints one JSON result
+- `opencode-worker mcp` — MCP stdio server (async jobs)
+
+No dependencies. Node ≥ 20. OpenCode is **not** bundled: pass `--opencode-bin`, set `OPENCODE_WORKER_BIN`, or have `opencode` on `PATH`.
+
+## Safety defaults
+
+- Child env is rebuilt from scratch: only `PATH`, `LANG`, `LC_ALL`, `TMPDIR` pass through. No API keys or credentials.
+- `HOME` and `XDG_{CONFIG,DATA,CACHE,STATE}_HOME` point into `<dir>/.opencode-worker/`.
+- Generated config: `model` = `small_model` = requested model, `enabled_providers: ["opencode"]`, `permission.external_directory: "deny"`.
+- Models outside the `opencode` provider are rejected (`PROVIDER_NOT_ALLOWED`); there is no fallback.
+- Timeout (default 180 s): SIGTERM, then SIGKILL after 5 s.
+- Fixed flags: `run --pure --auto --format json --agent <agent> --model <model> --variant <variant>`.
+
+Defaults: model `opencode/deepseek-v4.1-flash-free`, variant `low`, agent `build`.
+
+## CLI
+
+```sh
+opencode-worker run --dir ./task --timeout 180 "Fix add() in calculator.py and run the tests"
+opencode-worker run --dir ./task -f prompt.md --variant high
+```
+
+Exit codes: `0` ok, `1` worker failed (timeout, nonzero exit, error event, model mismatch), `2` usage/setup error.
+
+## Result (schemaVersion 1)
+
+| field | meaning |
+|---|---|
+| `ok` | exit 0 and no errors |
+| `exit`, `signal`, `durationSec` | process outcome |
+| `opencode` | `{bin, version}` |
+| `requested` | `{model, variant, agent, timeoutSec}` |
+| `actual` | provider/model/variant recorded in the isolated session DB (needs `sqlite3`; `null` if unavailable) |
+| `text` | worker's final text |
+| `tools[]` | `{tool, status, input, exit, output, error}` per tool call; `exit` is the bash exit code (else `null`), `output` capped at 4000 chars |
+| `cost`, `tokens` | summed from `step_finish` events |
+| `diff` | `diff -ruN` of `<dir>` before vs after (excludes `.opencode-worker/`) |
+| `errors[]` | `timeout`, `cancelled`, `nonzero_exit`, `event_error`, `model_mismatch`, `diff_failed`, `unparsed_line` |
+| `artifacts` | raw `events.jsonl` and `stderr.txt` under `<dir>/.opencode-worker/runs/<id>/` |
+
+The worker's report is not proof: verify `diff` and rerun your own checks.
+
+## MCP
+
+Tools: `worker_start` (returns `jobId` immediately), `worker_status`, `worker_result`, `worker_cancel`.
+Async by design so long runs never hit client request timeouts.
+
+```json
+{
+  "mcpServers": {
+    "opencode-worker": {
+      "command": "npx",
+      "args": ["-y", "opencode-worker", "mcp"],
+      "env": { "OPENCODE_WORKER_BIN": "/path/to/opencode" }
+    }
+  }
+}
+```
+
+### Client setup
+
+Claude Code (tools must be allowed in `-p` mode; put the prompt right after `-p`, because `--allowedTools` and `--mcp-config` are variadic and swallow trailing arguments):
+
+```sh
+claude mcp add opencode-worker -e OPENCODE_WORKER_BIN=/path/to/opencode -- npx -y opencode-worker mcp
+claude -p "…" --allowedTools "mcp__opencode-worker__worker_start,mcp__opencode-worker__worker_status,mcp__opencode-worker__worker_result"
+```
+
+Codex (`~/.codex/config.toml`); without the approval mode, `codex exec` rejects MCP calls under `approval: never`:
+
+```toml
+[mcp_servers.opencode-worker]
+command = "npx"
+args = ["-y", "opencode-worker", "mcp"]
+env = { OPENCODE_WORKER_BIN = "/path/to/opencode" }
+default_tools_approval_mode = "approve"
+```
+
+OMP (`.omp/mcp.json` or `~/.omp/agent/mcp.json`): the JSON above with `"type": "stdio"`. Non-interactive: `omp -p --auto-approve "…"`.
+
+Job records are written to `$OPENCODE_WORKER_STATE_DIR` (default `$XDG_STATE_HOME/opencode-worker/jobs`, else `~/.local/state/opencode-worker/jobs`), so `worker_status`/`worker_result` work after a server or client restart.
+Closing stdin or SIGINT/SIGTERM/SIGHUP cancels running jobs and records them as `cancelled`. If the server is killed outright, its unfinished jobs report `lost`; raw logs remain in `<dir>/.opencode-worker/runs/`.
+
+## Notes
+
+- `<dir>/.opencode-worker/` holds state, snapshots and logs per run; delete it when done.
+- The before-snapshot copies the whole directory: use small, task-scoped directories.

package/bin/opencode-worker.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import fs from "node:fs";
+import { runWorker, WorkerError, DEFAULTS } from "../lib/worker.mjs";
+import { serveMcp } from "../lib/mcp.mjs";
+
+const USAGE = `Usage:
+  opencode-worker run --dir <dir> [options] <prompt | -f file>
+  opencode-worker mcp [--opencode-bin <path>]
+
+Options (run):
+  --dir <dir>            Working directory; the worker is confined to it (required)
+  --model <id>           default ${DEFAULTS.model} (provider must be one of ${DEFAULTS.providers.join(",")})
+  --variant <v>          default ${DEFAULTS.variant}
+  --agent <name>         default ${DEFAULTS.agent}
+  --timeout <sec>        default ${DEFAULTS.timeoutSec}
+  --opencode-bin <path>  default $OPENCODE_WORKER_BIN, then PATH
+  -f, --prompt-file <f>  Read prompt from file
+
+Prints one JSON result object. Exit: 0 ok, 1 worker failed, 2 usage/setup error.`;
+
+const [cmd, ...rest] = process.argv.slice(2);
+try {
+  if (cmd === "run") {
+    const { values, positionals } = parseArgs({
+      args: rest,
+      allowPositionals: true,
+      options: {
+        dir: { type: "string" }, model: { type: "string" }, variant: { type: "string" },
+        agent: { type: "string" }, timeout: { type: "string" }, "opencode-bin": { type: "string" },
+        "prompt-file": { type: "string", short: "f" },
+      },
+    });
+    const prompt = values["prompt-file"] ? fs.readFileSync(values["prompt-file"], "utf8") : positionals.join(" ");
+    if (!values.dir || !prompt.trim()) throw new WorkerError("BAD_ARGS", "--dir and a prompt are required\n\n" + USAGE);
+    const timeoutSec = values.timeout === undefined ? undefined : Number(values.timeout);
+    if (timeoutSec !== undefined && !(timeoutSec > 0)) throw new WorkerError("BAD_ARGS", "--timeout must be a positive number");
+    const result = await runWorker({
+      dir: values.dir, prompt, model: values.model, variant: values.variant, agent: values.agent,
+      timeoutSec, opencodeBin: values["opencode-bin"],
+    });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    process.exit(result.ok ? 0 : 1);
+  } else if (cmd === "mcp") {
+    const { values } = parseArgs({ args: rest, options: { "opencode-bin": { type: "string" } } });
+    serveMcp({ opencodeBin: values["opencode-bin"] });
+  } else {
+    process.stderr.write(USAGE + "\n");
+    process.exit(cmd === "-h" || cmd === "--help" ? 0 : 2);
+  }
+} catch (e) {
+  process.stdout.write(JSON.stringify({ ok: false, errors: [{ type: e.code ?? "SETUP_ERROR", detail: e.message }] }, null, 2) + "\n");
+  process.exit(2);
+}

package/lib/mcp.mjs

@@ -0,0 +1,131 @@
+// Minimal MCP stdio server (newline-delimited JSON-RPC 2.0), no dependencies.
+// Async job model so long worker runs never hit client request timeouts.
+import readline from "node:readline";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { runWorker, DEFAULTS } from "./worker.mjs";
+
+const PROTOCOL = "2025-06-18";
+const jobs = new Map(); // live jobs of this server: id -> { record, controller, done }
+const JOBS_DIR = process.env.OPENCODE_WORKER_STATE_DIR
+  ?? path.join(process.env.XDG_STATE_HOME || path.join(os.homedir(), ".local/state"), "opencode-worker", "jobs");
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const VERSION = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+
+// Job records are persisted so results survive server/client restarts.
+function save(record) {
+  fs.mkdirSync(JOBS_DIR, { recursive: true });
+  const file = path.join(JOBS_DIR, `${record.jobId}.json`);
+  fs.writeFileSync(file + ".tmp", JSON.stringify(record, null, 2));
+  fs.renameSync(file + ".tmp", file);
+}
+
+function alive(pid) {
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
+}
+
+function load(jobId) {
+  if (!UUID.test(jobId ?? "")) return null;
+  const live = jobs.get(jobId);
+  if (live) return live.record;
+  let record;
+  try { record = JSON.parse(fs.readFileSync(path.join(JOBS_DIR, `${jobId}.json`), "utf8")); } catch { return null; }
+  // Owned by a server that died mid-run: the outcome is unknown.
+  if (record.status === "running" && !alive(record.serverPid)) record.status = "lost";
+  return record;
+}
+
+const runSchema = {
+  type: "object",
+  properties: {
+    dir: { type: "string", description: "Absolute working directory; the worker is confined to it" },
+    prompt: { type: "string", description: "Task for the OpenCode worker" },
+    model: { type: "string", description: `default ${DEFAULTS.model}` },
+    variant: { type: "string", description: `default ${DEFAULTS.variant}` },
+    agent: { type: "string", description: `default ${DEFAULTS.agent}` },
+    timeoutSec: { type: "number", description: `default ${DEFAULTS.timeoutSec}` },
+  },
+  required: ["dir", "prompt"],
+};
+const idSchema = { type: "object", properties: { jobId: { type: "string" } }, required: ["jobId"] };
+
+const TOOLS = [
+  { name: "worker_start", description: "Start an isolated OpenCode worker job (free model by default). Returns jobId immediately.", inputSchema: runSchema },
+  { name: "worker_status", description: "Get job status: running | done | failed | cancelled | lost (server died mid-run). Works across server restarts.", inputSchema: idSchema },
+  { name: "worker_result", description: "Get the JSON result (diff, tests text, cost, tokens, actual model) of a finished job. Works across server restarts.", inputSchema: idSchema },
+  { name: "worker_cancel", description: "Cancel a running job owned by this server (SIGTERM, then SIGKILL).", inputSchema: idSchema },
+];
+
+function textResult(obj, isError = false) {
+  return { content: [{ type: "text", text: JSON.stringify(obj, null, 2) }], isError };
+}
+
+function callTool(name, args, opts) {
+  if (name === "worker_start") {
+    const record = {
+      jobId: randomUUID(), status: "running", serverPid: process.pid,
+      dir: args.dir, startedAt: new Date().toISOString(), finishedAt: null, result: null, error: null,
+    };
+    const controller = new AbortController();
+    save(record);
+    const done = runWorker({ ...args, opencodeBin: opts.opencodeBin, signal: controller.signal }).then(
+      (r) => { record.result = r; record.status = r.errors.some((e) => e.type === "cancelled") ? "cancelled" : r.ok ? "done" : "failed"; },
+      (e) => { record.error = { type: e.code ?? "SETUP_ERROR", detail: e.message }; record.status = "failed"; },
+    ).then(() => {
+      record.finishedAt = new Date().toISOString();
+      save(record);
+      jobs.delete(record.jobId);
+    });
+    jobs.set(record.jobId, { record, controller, done });
+    return textResult({ jobId: record.jobId, status: "running" });
+  }
+  const job = load(args?.jobId);
+  if (!job) return textResult({ error: "unknown jobId" }, true);
+  const { jobId, status, startedAt, finishedAt, dir } = job;
+  if (name === "worker_status") return textResult({ jobId, status, startedAt, finishedAt, dir });
+  if (name === "worker_result") {
+    if (status === "running") return textResult({ jobId, status }, true);
+    if (status === "lost") return textResult({ ok: false, errors: [{ type: "lost", detail: "server exited before the job finished; inspect <dir>/.opencode-worker/runs" }] }, true);
+    return textResult(job.result ?? { ok: false, errors: [job.error] }, !job.result?.ok);
+  }
+  if (name === "worker_cancel") {
+    const live = jobs.get(jobId);
+    live?.controller.abort();
+    return textResult({ jobId, cancelRequested: Boolean(live), status });
+  }
+  return null;
+}
+
+async function shutdown(code) {
+  const live = [...jobs.values()];
+  for (const j of live) j.controller.abort();
+  await Promise.allSettled(live.map((j) => j.done));
+  process.exit(code);
+}
+
+export function serveMcp(opts = {}) {
+  const send = (msg) => process.stdout.write(JSON.stringify(msg) + "\n");
+  const rl = readline.createInterface({ input: process.stdin });
+  rl.on("line", (line) => {
+    if (!line.trim()) return;
+    let msg;
+    try { msg = JSON.parse(line); } catch { return send({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } }); }
+    const { id, method, params } = msg;
+    if (id === undefined) return; // notification
+    const reply = (result) => send({ jsonrpc: "2.0", id, result });
+    const fail = (code, message) => send({ jsonrpc: "2.0", id, error: { code, message } });
+    if (method === "initialize")
+      return reply({ protocolVersion: params?.protocolVersion ?? PROTOCOL, capabilities: { tools: {} }, serverInfo: { name: "opencode-worker", version: VERSION } });
+    if (method === "ping") return reply({});
+    if (method === "tools/list") return reply({ tools: TOOLS });
+    if (method === "tools/call") {
+      const r = callTool(params?.name, params?.arguments ?? {}, opts);
+      return r ? reply(r) : fail(-32602, `unknown tool: ${params?.name}`);
+    }
+    fail(-32601, `method not found: ${method}`);
+  });
+  rl.on("close", () => shutdown(0));
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(sig, () => shutdown(0));
+}

package/lib/worker.mjs

@@ -0,0 +1,217 @@
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+export const SCHEMA_VERSION = 1;
+export const DEFAULTS = {
+  model: "opencode/deepseek-v4.1-flash-free",
+  variant: "low",
+  agent: "build",
+  timeoutSec: 180,
+  providers: ["opencode"],
+};
+const STATE_DIR = ".opencode-worker";
+const HARD_DEADLINE_WRAPPER = ["/usr/bin/perl", "/bin/perl"].find((p) => fs.existsSync(p)) ?? null;
+const TOOL_OUTPUT_MAX = 4000;
+
+export class WorkerError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+
+export function resolveOpencodeBin(explicit) {
+  const candidates = [explicit, process.env.OPENCODE_WORKER_BIN].filter(Boolean);
+  for (const c of candidates) {
+    if (fs.existsSync(c)) return path.resolve(c);
+    throw new WorkerError("BIN_NOT_FOUND", `opencode binary not found: ${c}`);
+  }
+  const which = spawnSync("/usr/bin/env", ["which", "opencode"], { encoding: "utf8" });
+  if (which.status === 0 && which.stdout.trim()) return which.stdout.trim();
+  throw new WorkerError("BIN_NOT_FOUND", "opencode not found (use --opencode-bin or OPENCODE_WORKER_BIN)");
+}
+
+function opencodeVersion(bin) {
+  const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 15000, env: { PATH: process.env.PATH } });
+  if (r.status !== 0) throw new WorkerError("BIN_BROKEN", `opencode --version failed: ${r.stderr || r.error}`);
+  return r.stdout.trim();
+}
+
+/** Isolated environment: nothing from the parent except PATH and locale. No credentials or API keys. */
+function isolatedEnv(stateRoot, configPath) {
+  const env = {
+    PATH: process.env.PATH || "/usr/bin:/bin:/usr/sbin:/sbin",
+    HOME: path.join(stateRoot, "home"),
+    XDG_CONFIG_HOME: path.join(stateRoot, "xdg/config"),
+    XDG_DATA_HOME: path.join(stateRoot, "xdg/data"),
+    XDG_CACHE_HOME: path.join(stateRoot, "xdg/cache"),
+    XDG_STATE_HOME: path.join(stateRoot, "xdg/state"),
+    OPENCODE_CONFIG: configPath,
+    TERM: "dumb",
+  };
+  for (const k of ["LANG", "LC_ALL", "TMPDIR"]) if (process.env[k]) env[k] = process.env[k];
+  for (const k of ["HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME"])
+    fs.mkdirSync(env[k], { recursive: true });
+  return env;
+}
+
+function snapshot(dir, dest) {
+  fs.mkdirSync(dest, { recursive: true });
+  for (const name of fs.readdirSync(dir)) {
+    if (name === STATE_DIR) continue;
+    fs.cpSync(path.join(dir, name), path.join(dest, name), { recursive: true, verbatimSymlinks: true });
+  }
+}
+
+function unifiedDiff(before, dir) {
+  const r = spawnSync("diff", ["-ruN", `--exclude=${STATE_DIR}`, "before", dir], {
+    cwd: path.dirname(before),
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+  });
+  // diff exit: 0 same, 1 different, 2 trouble
+  if (r.status === 2) return { diff: null, error: r.stderr.trim() };
+  return { diff: r.stdout.replaceAll(dir + "/", "after/"), error: null };
+}
+
+function parseEvents(stdout) {
+  const out = { text: "", tools: [], cost: 0, tokens: { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0 }, errors: [], sessionID: null };
+  for (const line of stdout.split("\n")) {
+    if (!line.trim()) continue;
+    let ev;
+    try { ev = JSON.parse(line); } catch { out.errors.push({ type: "unparsed_line", detail: line.slice(0, 300) }); continue; }
+    out.sessionID ??= ev.sessionID ?? null;
+    const p = ev.part ?? {};
+    if (ev.type === "text") out.text += p.text ?? "";
+    else if (ev.type === "tool_use") {
+      const s = p.state ?? {};
+      const output = typeof s.output === "string" ? s.output : s.output == null ? null : JSON.stringify(s.output);
+      out.tools.push({
+        tool: p.tool,
+        status: s.status,
+        input: s.input,
+        exit: s.metadata?.exit ?? null,
+        output: output && output.length > TOOL_OUTPUT_MAX ? output.slice(0, TOOL_OUTPUT_MAX) + `…[truncated ${output.length - TOOL_OUTPUT_MAX} chars]` : output,
+        error: s.error ?? null,
+      });
+    }
+    else if (ev.type === "step_finish") {
+      out.cost += p.cost ?? 0;
+      const t = p.tokens ?? {};
+      out.tokens.input += t.input ?? 0;
+      out.tokens.output += t.output ?? 0;
+      out.tokens.reasoning += t.reasoning ?? 0;
+      out.tokens.cacheRead += t.cache?.read ?? 0;
+      out.tokens.cacheWrite += t.cache?.write ?? 0;
+    } else if (ev.type === "error") out.errors.push({ type: "event_error", detail: ev.error ?? p });
+  }
+  return out;
+}
+
+/** Actual model/variant recorded by OpenCode, read from the isolated session DB. */
+function actualModels(stateRoot, sessionID) {
+  const db = path.join(stateRoot, "xdg/data/opencode/opencode.db");
+  if (!fs.existsSync(db) || !sessionID || !/^[\w-]+$/.test(sessionID)) return null;
+  const q = `select distinct json_extract(data,'$.providerID'), json_extract(data,'$.modelID'), json_extract(data,'$.variant') from message where session_id='${sessionID}' and json_extract(data,'$.role')='assistant';`;
+  const r = spawnSync("sqlite3", ["-separator", "\t", db, q], { encoding: "utf8" });
+  if (r.status !== 0) {
+    const r2 = spawnSync("sqlite3", ["-separator", "\t", db, q.replace(` session_id='${sessionID}' and`, "")], { encoding: "utf8" });
+    if (r2.status !== 0) return null;
+    r.stdout = r2.stdout;
+  }
+  return r.stdout.trim().split("\n").filter(Boolean).map((l) => {
+    const [provider, model, variant] = l.split("\t");
+    return { provider, model, variant: variant || null };
+  });
+}
+
+/**
+ * Run one OpenCode worker task.
+ * @param {{dir:string,prompt:string,model?:string,variant?:string,agent?:string,timeoutSec?:number,opencodeBin?:string,signal?:AbortSignal}} o
+ */
+export async function runWorker(o) {
+  if (!o.dir || !o.prompt) throw new WorkerError("BAD_ARGS", "dir and prompt are required");
+  const dir = fs.realpathSync(path.resolve(o.dir));
+  if (!fs.statSync(dir).isDirectory()) throw new WorkerError("BAD_ARGS", `not a directory: ${dir}`);
+  const model = o.model ?? DEFAULTS.model;
+  const variant = o.variant ?? DEFAULTS.variant;
+  const agent = o.agent ?? DEFAULTS.agent;
+  const timeoutSec = o.timeoutSec ?? DEFAULTS.timeoutSec;
+  const provider = model.split("/")[0];
+  if (!DEFAULTS.providers.includes(provider))
+    throw new WorkerError("PROVIDER_NOT_ALLOWED", `provider '${provider}' not in ${JSON.stringify(DEFAULTS.providers)}`);
+
+  const bin = resolveOpencodeBin(o.opencodeBin);
+  const version = opencodeVersion(bin);
+
+  const runId = new Date().toISOString().replace(/[:.]/g, "-");
+  const stateRoot = path.join(dir, STATE_DIR);
+  const runDir = path.join(stateRoot, "runs", runId);
+  fs.mkdirSync(runDir, { recursive: true });
+  const configPath = path.join(stateRoot, "opencode.json");
+  fs.writeFileSync(configPath, JSON.stringify({
+    $schema: "https://opencode.ai/config.json",
+    model,
+    small_model: model,
+    enabled_providers: DEFAULTS.providers,
+    permission: { external_directory: "deny" },
+  }, null, 2));
+  const env = isolatedEnv(stateRoot, configPath);
+  const before = path.join(runDir, "before");
+  snapshot(dir, before);
+
+  const args = ["run", "--pure", "--auto", "--format", "json", "--agent", agent, "--model", model, "--variant", variant, o.prompt];
+  const started = Date.now();
+  const { exit, signal, timedOut, cancelled, stdout, stderr } = await new Promise((resolve) => {
+    // Hard deadline that survives our own death: alarm() is inherited across exec,
+    // so the worker gets SIGALRM even if this process is SIGKILLed.
+    const hard = HARD_DEADLINE_WRAPPER
+      ? spawn(HARD_DEADLINE_WRAPPER, ["-e", "alarm shift; exec { $ARGV[0] } @ARGV or die $!", String(Math.ceil(timeoutSec) + 10), bin, ...args], { cwd: dir, env, stdio: ["ignore", "pipe", "pipe"] })
+      : null;
+    const child = hard ?? spawn(bin, args, { cwd: dir, env, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", timedOut = false, cancelled = false;
+    child.stdout.on("data", (d) => (stdout += d));
+    child.stderr.on("data", (d) => (stderr += d));
+    const kill = () => {
+      child.kill("SIGTERM");
+      setTimeout(() => child.exitCode === null && child.kill("SIGKILL"), 5000).unref();
+    };
+    const timer = setTimeout(() => { timedOut = true; kill(); }, timeoutSec * 1000);
+    o.signal?.addEventListener("abort", () => { cancelled = true; kill(); }, { once: true });
+    child.on("error", (e) => { stderr += String(e); });
+    child.on("close", (exit, signal) => { clearTimeout(timer); resolve({ exit, signal, timedOut, cancelled, stdout, stderr }); });
+  });
+  const durationSec = (Date.now() - started) / 1000;
+  fs.writeFileSync(path.join(runDir, "events.jsonl"), stdout);
+  fs.writeFileSync(path.join(runDir, "stderr.txt"), stderr);
+
+  const ev = parseEvents(stdout);
+  const { diff, error: diffError } = unifiedDiff(before, dir);
+  const actual = actualModels(stateRoot, ev.sessionID);
+  const errors = [...ev.errors];
+  if (timedOut) errors.push({ type: "timeout", detail: `exceeded ${timeoutSec}s` });
+  if (cancelled) errors.push({ type: "cancelled" });
+  if (exit !== 0 && !timedOut && !cancelled) errors.push({ type: "nonzero_exit", detail: stderr.trim().slice(-2000) || `exit ${exit} signal ${signal}` });
+  if (diffError) errors.push({ type: "diff_failed", detail: diffError });
+  const modelId = model.split("/").slice(1).join("/");
+  if (actual && actual.some((a) => a.provider !== provider || a.model !== modelId))
+    errors.push({ type: "model_mismatch", detail: actual });
+
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    ok: exit === 0 && errors.length === 0,
+    exit, signal, durationSec,
+    opencode: { bin, version },
+    requested: { model, variant, agent, timeoutSec },
+    actual,
+    sessionID: ev.sessionID,
+    text: ev.text,
+    tools: ev.tools,
+    cost: ev.cost,
+    tokens: ev.tokens,
+    diff,
+    errors,
+    artifacts: { runDir, events: path.join(runDir, "events.jsonl"), stderr: path.join(runDir, "stderr.txt") },
+  };
+}

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "opencode-worker",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Run the official OpenCode CLI as an isolated, time-boxed worker. CLI + MCP stdio server.",
+  "type": "module",
+  "bin": { "opencode-worker": "bin/opencode-worker.mjs" },
+  "files": ["bin", "lib", "README.md"],
+  "engines": { "node": ">=20" },
+  "license": "MIT"
+}