optio-opencode 0.3.1__tar.gz → 0.4.0__tar.gz

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-opencode
-Version: 0.3.1
+Version: 0.4.0
 Summary: Run opencode web as an optio task; local subprocess or remote via SSH.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -22,7 +22,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: optio-core<0.4,>=0.3
 Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.5,>=0.4
+Requires-Dist: optio-agents<0.6,>=0.5
 Requires-Dist: asyncssh>=2.14
 Requires-Dist: aiohttp>=3.9
 Provides-Extra: dev

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "optio-opencode"
-version = "0.3.1"
+version = "0.4.0"
 description = "Run opencode web as an optio task; local subprocess or remote via SSH."
 readme = "README.md"
 license = "Apache-2.0"
@@ -30,7 +30,7 @@ dependencies = [
     # 0.1.1 introduces the bind_addr kwarg on Host.establish_tunnel —
     # required for OPTIO_WIDGET_TUNNEL_BIND to work.
     "optio-host>=0.2,<0.3",
-    "optio-agents>=0.4,<0.5",
+    "optio-agents>=0.5,<0.6",
     "asyncssh>=2.14",
     "aiohttp>=3.9",
 ]

optio_opencode-0.4.0/src/optio_opencode/fs_allowlist.py

@@ -0,0 +1,49 @@
+"""Build the claustrum filesystem-allowlist flags for an ``opencode web`` launch.
+
+Thin delegator over the shared ``optio_agents.fs_grants`` builder (the system
+baseline + workdir + engine-cache + caller-extras logic lives there, one SSOT
+across every wrapper). opencode contributes ONE engine-specific grant on top:
+
+  * opencode's home/config/data/cache all live under ``<workdir>/home`` — already
+    covered by ``--rwx <workdir>``.
+  * BUT ``OPENCODE_DB`` = ``<taskdir>/opencode.db`` sits ONE LEVEL ABOVE the
+    workdir (the ``taskdir/workdir`` layout). Under-granting there breaks
+    opencode's live DB, so the whole taskdir is granted rwx via ``extra_baseline``.
+  * the opencode binary cache (``_resolve_install_dir``, outside every workdir)
+    is granted read+exec as the engine cache.
+
+Non-existent paths are harmless: claustrum ignores missing paths.
+"""
+
+from __future__ import annotations
+
+from optio_agents import fs_grants
+
+# Re-exported so tests / callers can build extra grants without reaching into
+# optio_agents directly (mirrors the other wrappers' fs_allowlist surface).
+from .types import AllowedDir  # noqa: F401
+
+
+def build_grant_flags(
+    *,
+    workdir: str,
+    taskdir: str,
+    opencode_cache_dir: str,
+    extra_allowed_dirs: "list[AllowedDir] | None",
+    host_home: str | None = None,
+) -> list[str]:
+    """Return the ordered claustrum grant flags for an opencode launch.
+
+    ``workdir`` (the per-task tree incl. the isolated ``home``) is granted rwx.
+    ``taskdir`` (the workdir's parent, holding the live ``opencode.db``) is
+    granted rwx as an engine ``extra_baseline`` so the server can write its DB.
+    ``opencode_cache_dir`` (where the real opencode binary lives, outside every
+    workdir) is granted read+exec. ``~``/``~/`` caller extras expand against
+    ``host_home`` (the REAL host home)."""
+    return fs_grants.build_grant_flags(
+        workdir=workdir,
+        engine_cache_dir=opencode_cache_dir,
+        extra_allowed_dirs=extra_allowed_dirs,
+        host_home=host_home,
+        extra_baseline=[("--rwx", taskdir.rstrip("/"))],
+    )

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/src/optio_opencode/host_actions.py

@@ -28,6 +28,8 @@ from typing import TYPE_CHECKING, Callable
 
 from optio_host.host import ProcessHandle
 
+from optio_agents import claustrum
+
 from optio_opencode.info import AGENT_INFO
 
 if TYPE_CHECKING:
@@ -71,6 +73,72 @@ async def _resolve_install_dir(host: "Host", install_dir: str | None) -> str:
     return path.rstrip("/")
 
 
+# --- claustrum provisioning -------------------------------------------------
+#
+# opencode is wrapped in claustrum (Landlock, fail-closed) so the whole
+# ``opencode web`` server tree — the server and every tool subprocess it spawns
+# — is confined to an explicit filesystem allowlist. The provisioning logic
+# (engine cross-compile, ELF-guarded build cache, functional wrap+exec
+# validation, fail-closed placement) is the shared ``optio_agents.claustrum``
+# module; this wrapper contributes only the opencode-owned cache-dir resolution
+# and, in session.py, the grant set (``fs_allowlist.build_grant_flags``).
+
+
+async def ensure_claustrum_installed(
+    hook_ctx,
+    *,
+    install_dir: str | None = None,
+) -> str:
+    """Ensure a functioning claustrum binary is on the host; return its path.
+
+    Thin wrapper over :func:`optio_agents.claustrum.ensure_claustrum_installed`:
+    resolves the opencode-owned target cache dir (on the worker, beside the
+    opencode binary cache), pins the engine build cache to
+    ``~/.cache/optio-opencode``, and forwards the UI progress callback. All the
+    real work (cross-compile, ELF-guarded engine cache, functional wrap+exec
+    validation) lives in the shared module. Fail-closed — any failure RAISES, so
+    the caller never proceeds to an unconfined launch.
+    """
+    host = hook_ctx._host
+    cache_dir = await _resolve_install_dir(host, install_dir)
+    return await claustrum.ensure_claustrum_installed(
+        host,
+        cache_dir=cache_dir,
+        engine_cache_dir=os.path.expanduser("~/.cache/optio-opencode"),
+        report_progress=hook_ctx.report_progress,
+    )
+
+
+async def claustrum_newer_tag() -> str | None:
+    """Return the newest claustrum tag if it is newer than the pinned one, else None.
+
+    Engine-side egress only. Best-effort: network failure returns None (no notice).
+    """
+    try:
+        p = await asyncio.create_subprocess_exec(
+            "git", "ls-remote", "--tags", "--refs", claustrum.CLAUSTRUM_REPO,
+            stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.DEVNULL,
+        )
+        out, _ = await p.communicate()
+        if p.returncode != 0:
+            return None
+    except Exception:  # noqa: BLE001
+        return None
+    tags = []
+    for line in out.decode().splitlines():
+        ref = line.rsplit("/", 1)[-1].strip()
+        if ref.startswith("v"):
+            tags.append(ref)
+
+    def key(t: str) -> tuple:
+        return tuple(int(x) for x in t.lstrip("v").split(".") if x.isdigit())
+
+    if not tags:
+        return None
+    newest = max(tags, key=key)
+    return newest if key(newest) > key(claustrum.CLAUSTRUM_PINNED_TAG) else None
+
+
 def _isolation_env(host: "Host") -> dict[str, str]:
     """Per-task HOME/XDG isolation env, derived from ``host.workdir``.
 
@@ -437,6 +505,7 @@ async def launch_opencode(
     hostname: str = "127.0.0.1",
     extra_env: dict[str, str] | None = None,
     env_remove: list[str] | None = None,
+    claustrum_wrap: list[str] | None = None,
 ) -> tuple[ProcessHandle, int]:
     """Launch ``opencode web`` on ``host``; wait for the listening URL.
 
@@ -475,10 +544,18 @@ async def launch_opencode(
     # opencode succeeds at opening a real browser window. opencode_executable
     # is an absolute path (resolved by ensure_opencode_installed), so
     # login-shell PATH lookup is not needed to find the binary.
+    #
+    # claustrum_wrap (fs isolation) is spliced BETWEEN the ``env …`` password
+    # assignment and the opencode executable: ``exec env VAR=… claustrum … --
+    # opencode web``. The ``$(cat …)`` runs in the outer shell (before exec), so
+    # the password read happens outside the Landlock confinement; ``env`` then
+    # execs claustrum, which Landlock-confines itself and execs opencode, so the
+    # server and every tool subprocess inherit the allowlist. None → no wrap.
+    wrap_prefix = f"{shlex.join(claustrum_wrap)} " if claustrum_wrap else ""
     cmd = (
         f"exec env "
         f"OPENCODE_SERVER_PASSWORD=\"$(cat {shlex.quote(host.workdir + '/' + pw_file)})\" "
-        f"{opencode_executable} web --port=0 --hostname={shlex.quote(hostname)}"
+        f"{wrap_prefix}{opencode_executable} web --port=0 --hostname={shlex.quote(hostname)}"
     )
 
     # OPENCODE_DB must point at the same per-task db file used by the
@@ -507,19 +584,40 @@ async def launch_opencode(
         cmd, env=env, cwd=host.workdir, env_remove=env_remove,
     )
 
+    # Retain the tail of the launch stream so a failed start surfaces its REASON.
+    # `opencode web` is a plain server (not a TUI), so its startup diagnostics —
+    # a bind error, an auth/config crash, a claustrum "operation not permitted"
+    # denial — arrive as ordinary lines on the merged stdout+stderr the loop
+    # below already consumes. Without retaining them, they are scanned by
+    # _READY_RE, discarded, and the operator sees only "exited before printing a
+    # URL". A bounded deque keeps memory flat on a chatty-but-successful start.
+    # No ANSI strip (unlike the tmux engines' pipe-pane mirror): server logs are
+    # plain text, not PTY-painted TUI frames.
+    from collections import deque
+
+    tail: "deque[str]" = deque(maxlen=40)
+
+    def _reason_suffix() -> str:
+        recent = "\n".join(tail).strip()
+        return f"; last output:\n{recent}" if recent else ""
+
     async def _read_url() -> int:
         async for raw in handle.stdout:
             if isinstance(raw, bytes):
                 line = raw.decode("utf-8", errors="replace").rstrip()
             else:
                 line = str(raw).rstrip()
+            if line:
+                tail.append(line)
             m = _READY_RE.search(line)
             if m:
                 m2 = re.search(r":(\d+)", m.group(1))
                 if not m2:
                     raise RuntimeError(f"could not find port in URL: {line}")
                 return int(m2.group(1))
-        raise RuntimeError("opencode exited before printing a URL")
+        raise RuntimeError(
+            f"opencode exited before printing a URL{_reason_suffix()}"
+        )
 
     try:
         port = await asyncio.wait_for(_read_url(), timeout=ready_timeout_s)
@@ -527,6 +625,7 @@ async def launch_opencode(
         await host.terminate_subprocess(handle, aggressive=True)
         raise TimeoutError(
             f"opencode did not print a listening URL within {ready_timeout_s}s"
+            f"{_reason_suffix()}"
         )
     except BaseException:
         await host.terminate_subprocess(handle, aggressive=True)

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/src/optio_opencode/session.py

@@ -106,16 +106,33 @@ def _fold_tool_permissions(
     return cfg
 
 
-def _warn_if_fs_isolation_unenforced(config: "OpencodeTaskConfig") -> None:
-    """Emit a runtime warning on the worker console when ``fs_isolation`` is
-    requested. opencode has no claustrum sandbox wired yet, so the flag is
-    INERT (see OpencodeTaskConfig.fs_isolation): honour the operator's signal
-    by making the no-op loud rather than silent."""
-    if config.fs_isolation:
-        _LOG.warning(
-            "opencode fs_isolation requested but not yet enforced "
-            "(claustrum pending); the agent is NOT filesystem-confined."
-        )
+async def _build_claustrum_wrap(
+    host: Host, config: OpencodeTaskConfig, claustrum_path: str | None,
+) -> list[str] | None:
+    """claustrum argv prefix that Landlock-confines the ``opencode web`` server
+    tree, or None when fs_isolation is off.
+
+    Grants: the workdir (rwx; opencode's isolated HOME/XDG live under it), the
+    taskdir (rwx; the live ``opencode.db`` is a sibling of the workdir), the
+    opencode binary cache (rox), the system baseline, and caller extras. ``~/``
+    extras expand against the REAL host home (opencode runs under an isolated
+    $HOME; grants reach claustrum verbatim)."""
+    if not config.fs_isolation:
+        return None
+    from optio_opencode import fs_allowlist
+
+    cache_dir = await host_actions._resolve_install_dir(host, config.install_dir)
+    host_home = (
+        await host.resolve_host_home() if config.extra_allowed_dirs else None
+    )
+    grants = fs_allowlist.build_grant_flags(
+        workdir=host.workdir,
+        taskdir=host.taskdir,
+        opencode_cache_dir=cache_dir,
+        extra_allowed_dirs=config.extra_allowed_dirs,
+        host_home=host_home,
+    )
+    return host_actions.claustrum.build_claustrum_wrap(claustrum_path, grants)
 
 
 def conversation_widget_data(config: "OpencodeTaskConfig", *, session_id: str, directory: str) -> dict:
@@ -182,6 +199,12 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
     cred_watch_task: "asyncio.Task | None" = None
     resolved_seed_id: str | None = None
     lease_holder: str | None = None
+    # Path to the claustrum Landlock binary on the (possibly remote) host, set by
+    # _prepare when fs_isolation is on; read by the body to wrap the opencode
+    # launch. ``claustrum_newer`` carries a newer-than-pinned tag (if any) so the
+    # body can route the update notice. Both stay None when fs_isolation is off.
+    claustrum_path: str | None = None
+    claustrum_newer: str | None = None
 
     await host.connect()
 
@@ -196,6 +219,7 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
         before the tail can re-emit its stale DELIVERABLE/DONE/ERROR lines.
         """
         nonlocal opencode_exec, resuming, preserved_session_id
+        nonlocal claustrum_path, claustrum_newer
         opencode_exec = await host_actions.ensure_opencode_installed(
             hook_ctx._host,
             download=hook_ctx.download_file,
@@ -204,6 +228,16 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
             install_dir=config.install_dir,
         )
 
+        # Filesystem isolation: provision the claustrum Landlock binary BEFORE
+        # launch. Any failure raises here — fail-closed: the task never proceeds
+        # to an unconfined launch. Skipped when fs_isolation is off. Placed onto
+        # the same optio-opencode cache tree as the opencode binary.
+        if config.fs_isolation:
+            claustrum_path = await host_actions.ensure_claustrum_installed(
+                hook_ctx, install_dir=config.install_dir,
+            )
+            claustrum_newer = await host_actions.claustrum_newer_tag()
+
         resume_requested = bool(getattr(ctx, "resume", False))
         snapshot: dict | None = None
         if resume_requested:
@@ -392,7 +426,19 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
         # loopback; the SSH tunnel on the engine side handles exposure.
         opencode_hostname = bind_addr if isinstance(host, LocalHost) else "127.0.0.1"
 
-        _warn_if_fs_isolation_unenforced(config)
+        # Filesystem isolation: route the "newer claustrum available" security
+        # notice (if any) through on_deliverable BEFORE launch, then build the
+        # Landlock wrap that confines the opencode server tree.
+        if config.fs_isolation and claustrum_newer:
+            await host_actions.claustrum.emit_claustrum_update_notice(
+                host, hook_ctx,
+                delivery_type=config.delivery_type,
+                on_deliverable=config.on_deliverable,
+                newer=claustrum_newer,
+                pinned=host_actions.claustrum.CLAUSTRUM_PINNED_TAG,
+            )
+        claustrum_wrap = await _build_claustrum_wrap(host, config, claustrum_path)
+
         ctx.report_progress(None, f"Launching {AGENT_INFO.name}{version_suffix}…")
         handle, opencode_port = await host_actions.launch_opencode(
             host, password,
@@ -401,6 +447,7 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
             hostname=opencode_hostname,
             extra_env={**(config.env or {}), **hook_ctx.browser_launch_env},
             env_remove=config.scrub_env,
+            claustrum_wrap=claustrum_wrap,
         )
         launched_handle = handle
 

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/src/optio_opencode/types.py

@@ -17,6 +17,7 @@ from optio_agents import (
     ThinkingVerbosity,
     ToolVerbosity,
 )
+from optio_agents.config_types import ClaustrumConfigMixin
 from optio_agents.protocol.session import (
     CallerMessageCallback,
     DeliverableCallback,
@@ -70,9 +71,16 @@ def _identity_resume_refresh(config: "OpencodeTaskConfig") -> "OpencodeTaskConfi
     return config
 
 
-@dataclass
-class OpencodeTaskConfig:
-    """Configuration for one optio-opencode task instance."""
+@dataclass(frozen=True, kw_only=True)
+class OpencodeTaskConfig(ClaustrumConfigMixin):
+    """Configuration for one optio-opencode task instance.
+
+    Inherits the claustrum filesystem-isolation triad (``fs_isolation`` /
+    ``extra_allowed_dirs`` / ``delivery_type``) from ``ClaustrumConfigMixin``;
+    those fields stay top-level here (callers write ``fs_isolation=`` /
+    ``delivery_type=`` verbatim). Frozen because the mixin is frozen; ``kw_only``
+    so the required ``consumer_instructions`` can follow the mixin's defaulted
+    triad without a field-ordering conflict (all callers pass by keyword)."""
     consumer_instructions: str
     agent_type: Literal["opencode"] = "opencode"
     opencode_config: dict[str, Any] = field(default_factory=dict)
@@ -194,18 +202,17 @@ class OpencodeTaskConfig:
     file_download: bool = False
     max_download_bytes: int = 10_000_000
 
-    # --- filesystem isolation (INERT — claustrum port pending) ---
-    # NOT YET ENFORCED. opencode has no claustrum sandbox wired yet, so these
-    # two fields are a known no-op today: they ship now for cross-engine
-    # config parity (and so consumers can pin the intended policy), but the
-    # launch path only emits a runtime warning when fs_isolation is True — it
-    # does NOT restrict the filesystem. When claustrum lands for opencode,
-    # fs_isolation will confine the agent to the workdir and extra_allowed_dirs
-    # will widen that grant. Until then, treat both as advisory.
-    fs_isolation: bool = True
-    # Extra filesystem grants beyond the workdir (shared AllowedDir; ro/rw/
-    # rox/rwx). INERT until claustrum lands (see fs_isolation above).
-    extra_allowed_dirs: list[AllowedDir] | None = None
+    # --- filesystem isolation (claustrum) -------------------------------
+    # fs_isolation / extra_allowed_dirs / delivery_type are inherited from
+    # ClaustrumConfigMixin. When fs_isolation is True (default), the whole
+    # ``opencode web`` server tree runs confined to an explicit filesystem
+    # allowlist (task workdir + taskdir-local opencode.db + opencode binary
+    # cache + explicit grants), kernel-enforced via the claustrum Landlock
+    # sandbox. Fail-closed: if claustrum cannot be provisioned or the kernel
+    # lacks Landlock, the task refuses to launch rather than run unconfined.
+    # ``delivery_type`` is MANDATORY when fs_isolation is on (routes the
+    # "newer claustrum release available" security notice via on_deliverable);
+    # validated by _validate_claustrum(). Set fs_isolation=False to opt out.
 
     # --- tool allow/deny (folded into opencode.json's ``permission`` map) ---
     # Convenience fields that fold into opencode.json's per-tool ``permission``
@@ -219,6 +226,9 @@ class OpencodeTaskConfig:
     disallowed_tools: list[str] | None = None
 
     def __post_init__(self) -> None:
+        # Claustrum triad first: a missing delivery_type (fs_isolation on)
+        # fails fast before the opencode-specific checks below.
+        self._validate_claustrum()
         e = self.session_blob_encrypt is not None
         d = self.session_blob_decrypt is not None
         if e != d:

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/src/optio_opencode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-opencode
-Version: 0.3.1
+Version: 0.4.0
 Summary: Run opencode web as an optio task; local subprocess or remote via SSH.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -22,7 +22,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: optio-core<0.4,>=0.3
 Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.5,>=0.4
+Requires-Dist: optio-agents<0.6,>=0.5
 Requires-Dist: asyncssh>=2.14
 Requires-Dist: aiohttp>=3.9
 Provides-Extra: dev

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/src/optio_opencode.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ pyproject.toml
 src/optio_opencode/__init__.py
 src/optio_opencode/conversation.py
 src/optio_opencode/cred_watcher.py
+src/optio_opencode/fs_allowlist.py
 src/optio_opencode/host_actions.py
 src/optio_opencode/info.py
 src/optio_opencode/model_probe.py
@@ -19,6 +20,7 @@ src/optio_opencode.egg-info/requires.txt
 src/optio_opencode.egg-info/top_level.txt
 tests/test_agent_info.py
 tests/test_agent_sender_opencode.py
+tests/test_claustrum.py
 tests/test_config_harmonization.py
 tests/test_conversation_config.py
 tests/test_conversation_driver.py

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/src/optio_opencode.egg-info/requires.txt

@@ -1,6 +1,6 @@
 optio-core<0.4,>=0.3
 optio-host<0.3,>=0.2
-optio-agents<0.5,>=0.4
+optio-agents<0.6,>=0.5
 asyncssh>=2.14
 aiohttp>=3.9
 

optio_opencode-0.4.0/tests/test_claustrum.py

@@ -0,0 +1,149 @@
+"""Claustrum filesystem-isolation wiring for opencode (Task 10).
+
+opencode is wrapped in claustrum for the first time: the ``opencode web`` server
+tree is Landlock-confined. These tests cover the config triad rule, the grant-set
+shape (including the taskdir grant that the live opencode.db needs), and the
+argv splice inside ``launch_opencode``.
+"""
+
+from __future__ import annotations
+
+import shlex
+
+import pytest
+
+from optio_host.host import ProcessHandle, RunResult
+
+from optio_opencode import fs_allowlist, host_actions
+from optio_opencode.types import OpencodeTaskConfig
+
+
+# ---------------------------------------------------------------------------
+# (a) fs_isolation on (default) requires delivery_type — inherited from the
+#     shared ClaustrumConfigMixin.
+# ---------------------------------------------------------------------------
+
+
+def test_fs_isolation_on_requires_delivery_type():
+    with pytest.raises(ValueError, match="delivery_type"):
+        OpencodeTaskConfig(consumer_instructions="x", fs_isolation=True)
+
+
+def test_delivery_type_satisfies_the_rule():
+    cfg = OpencodeTaskConfig(
+        consumer_instructions="x", fs_isolation=True, delivery_type="audit",
+    )
+    assert cfg.delivery_type == "audit"
+
+
+def test_fs_isolation_off_allows_missing_delivery_type():
+    cfg = OpencodeTaskConfig(consumer_instructions="x", fs_isolation=False)
+    assert cfg.fs_isolation is False
+    assert cfg.delivery_type is None
+
+
+# ---------------------------------------------------------------------------
+# (b) grant set: --rwx <taskdir> (the live opencode.db is a sibling of the
+#     workdir) AND --rox <opencode cache> AND --rwx <workdir>.
+# ---------------------------------------------------------------------------
+
+
+def test_grant_flags_cover_taskdir_workdir_and_cache():
+    flags = fs_allowlist.build_grant_flags(
+        workdir="/td/workdir",
+        taskdir="/td",
+        opencode_cache_dir="/cache/optio-opencode/bin",
+        extra_allowed_dirs=None,
+    )
+    # system baseline present
+    assert "/usr" in flags
+    # taskdir rwx (OPENCODE_DB = <taskdir>/opencode.db lives one level above workdir)
+    assert ["--rwx", "/td"] == _pair_before(flags, "/td")
+    # workdir rwx
+    assert ["--rwx", "/td/workdir"] == _pair_before(flags, "/td/workdir")
+    # opencode binary cache rox
+    assert ["--rox", "/cache/optio-opencode/bin"] == _pair_before(
+        flags, "/cache/optio-opencode/bin"
+    )
+
+
+def test_grant_flags_expand_extra_home_tilde():
+    flags = fs_allowlist.build_grant_flags(
+        workdir="/td/workdir",
+        taskdir="/td",
+        opencode_cache_dir="/cache",
+        extra_allowed_dirs=[fs_allowlist.AllowedDir("~/data", "ro")],
+        host_home="/home/u",
+    )
+    assert flags[-2:] == ["--ro", "/home/u/data"]
+
+
+def _pair_before(flags: list[str], path: str) -> list[str]:
+    i = flags.index(path)
+    return [flags[i - 1], flags[i]]
+
+
+# ---------------------------------------------------------------------------
+# (c) launch_opencode splices the claustrum wrap immediately before the
+#     opencode executable and AFTER the env/password assignment.
+# ---------------------------------------------------------------------------
+
+
+class _RecordingLaunchHost:
+    def __init__(self, *, workdir: str = "/wd", taskdir: str = "/td") -> None:
+        self.workdir = workdir
+        self.taskdir = taskdir
+        self.launch_cmd: str | None = None
+        self.launch_env: dict[str, str] | None = None
+
+    async def write_text(self, relpath: str, content: str) -> None:
+        pass
+
+    async def run_command(self, cmd: str, *, cwd=None, env=None) -> RunResult:
+        return RunResult(stdout="", stderr="", exit_code=0)
+
+    async def launch_subprocess(
+        self, command, *, env=None, cwd=None, merge_stderr=True, stdin=False,
+        env_remove=None,
+    ) -> ProcessHandle:
+        self.launch_cmd = command
+        self.launch_env = env
+
+        async def _stdout():
+            yield b"server listening on http://127.0.0.1:54321\n"
+
+        return ProcessHandle(pid_like=object(), stdout=_stdout())
+
+    async def terminate_subprocess(self, handle, *, aggressive=False) -> None:
+        pass
+
+
+async def test_launch_opencode_splices_claustrum_wrap_before_executable():
+    host = _RecordingLaunchHost(workdir="/wd", taskdir="/td")
+    wrap = [
+        "/c/claustrum", "--best-effort", "--abi-min", "1",
+        "--rwx", "/td/workdir", "--",
+    ]
+    handle, port = await host_actions.launch_opencode(
+        host, "pw", claustrum_wrap=wrap,
+    )
+    assert port == 54321
+    cmd = host.launch_cmd
+    assert cmd is not None
+    joined = shlex.join(wrap)
+    # The wrap appears immediately before the opencode executable.
+    assert f"{joined} opencode web" in cmd
+    # And AFTER the password assignment (localhost bind + URL scrape survive).
+    assert "OPENCODE_SERVER_PASSWORD" in cmd
+    assert cmd.index("OPENCODE_SERVER_PASSWORD") < cmd.index("/c/claustrum")
+
+
+async def test_launch_opencode_without_wrap_is_unchanged():
+    host = _RecordingLaunchHost(workdir="/wd", taskdir="/td")
+    await host_actions.launch_opencode(host, "pw")
+    cmd = host.launch_cmd
+    assert cmd is not None
+    assert "claustrum" not in cmd
+    # opencode executable still launched right after the password assignment.
+    assert "OPENCODE_SERVER_PASSWORD" in cmd
+    assert "opencode web" in cmd

{optio_opencode-0.3.1 → optio_opencode-0.4.0}/tests/test_config_harmonization.py

@@ -1,37 +1,15 @@
 """Session-level tests for the config-harmonization additions:
 
-- the inert ``fs_isolation`` runtime warning (change 6: NOT-YET-ENFORCED), and
 - the ``allowed_tools``/``disallowed_tools`` fold into opencode.json's
   ``permission`` map (T2: REACHABLE → wired).
 
+(The former ``fs_isolation`` inert-warning tests were removed when claustrum
+was wired for opencode; the fs-isolation triad is covered by test_claustrum.py.)
+
 Pure/unit — no subprocess, no host, xdist-safe.
 """
 
-import logging
-
-from optio_opencode.session import (
-    _fold_tool_permissions,
-    _warn_if_fs_isolation_unenforced,
-)
-from optio_opencode.types import OpencodeTaskConfig
-
-
-# --- fs_isolation inert warning ----------------------------------------------
-
-
-def test_fs_isolation_true_emits_not_enforced_warning(caplog):
-    cfg = OpencodeTaskConfig(consumer_instructions="x", fs_isolation=True)
-    with caplog.at_level(logging.WARNING, logger="optio_opencode.session"):
-        _warn_if_fs_isolation_unenforced(cfg)
-    msgs = [r.getMessage() for r in caplog.records if r.levelno == logging.WARNING]
-    assert any("fs_isolation" in m and "not yet enforced" in m for m in msgs), msgs
-
-
-def test_fs_isolation_false_is_silent(caplog):
-    cfg = OpencodeTaskConfig(consumer_instructions="x", fs_isolation=False)
-    with caplog.at_level(logging.WARNING, logger="optio_opencode.session"):
-        _warn_if_fs_isolation_unenforced(cfg)
-    assert [r for r in caplog.records if r.levelno == logging.WARNING] == []
+from optio_opencode.session import _fold_tool_permissions
 
 
 # --- allowed_tools / disallowed_tools fold -----------------------------------