release: 0.0.22 — root-equivalent audit (#37), headless ecosystem mode (#42), review fixes - #43
Merged
Merged
Conversation
…wsl desktop sockets, groups, interop) — issue #37 Report-only section in status.sh: danger-group check for the agent user (root-equivalent tier + credential-adjacent tier), socket scan over fixed paths plus the /mnt/wsl Docker Desktop / Rancher Desktop integration sockets, Windows-interop exec probe, and a sudo-rules probe when run as root. Pure stat math, no prompts, ROOT_EQUIV_SOCKS override. Unit tests for both helpers; security-model.md documents the surface table and the deliberate non-findings (snapd peer-cred gate, setuid uidmap).
…commands) — issue #42 Generalizes the 0.0.16 serve fix: orchestrators (cezar, Vibe Kanban, eval harnesses, CI runners) spawn `opencode run` and parse stdout (--format json), IDE agents use `opencode acp` (JSON-RPC over stdio), and tools like cezar cache `opencode models` output. The wrapper previously bannered on stdout (breaking those parsers) and refused non-project CWDs (breaking worktree/temp-checkout invocations). HEADLESS now covers serve, acp, run (message arg or piped stdin), and the query subcommands: stdout stays machine-clean (diagnostics on stderr), the project-dir check is skipped, and container tools resolve silently (serve always; run/queries via project opt-in). The soft permission layer applies to every session as before. Interactive TUI starts keep banner and check. OpenHarness researched too — not an opencode client (own harness/auth), no interaction with the kit.
New reference page listing tools that spawn opencode (UIs, orchestrators, editor frontends, bots, plugins) with their invocation pattern and verified status against the kit's wrapper, including the headless-contract link, absolute-path and sudo-spawn caveats, and a last-verified stamp. wrapper.md's inline tool listing now points at the matrix (single source of truth).
…t -u (review 0.0.22) The helper units covered the stat math, but the section body itself never ran in CI — the e2e status.sh grep hits an earlier line and would pass even if the section crashed. Extract-and-eval the whole section against a real fake unix socket: world-writable (666) must flag AGENT-REACHABLE red, group-writable with a foreign group must stay green. || true on the captures (set -u deaths must not kill the runner, same pattern as run_case).
… the agent home (review 0.0.22) The issue #19 migration copied ~/.claude WHOLE, so move (the --yes default) transported Claude Code's .credentials.json (OAuth tokens) and account state into /home/opencode — group-readable, while the security model kept promising no developer credentials are reachable. Scope now: ~/.agents migrates whole (opencode's own namespace), ~/.claude/skills skills-only (the only part opencode loads); nothing else crosses, no exclude list needed. Sub-path parents get the sharing baseline; the guard never touches /home/opencode's mode 2750. e2e pins: credentials stay with the developer, whole .agents moves, .claude parent survives. Docs: getting-started, cli.md, security-model guarantee note.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's in here
Release branch for 0.0.22 — two features from open issues, plus fixes and
test hardening from the project review (#36, extended to the full 0.0.15→0.0.22
delta).
Root-equivalent access audit (#37)
status.shgains a report-only "Root-equivalent access" section: danger-groupcheck for the agent user (root-equivalent + credential-adjacent tiers), socket
scan over fixed paths plus the
/mnt/wslDocker Desktop / Rancher Desktopintegration sockets, Windows-interop exec probe, and a sudo-rules probe when
run as root. Pure stat math — no privileged probes, no prompts, no fixes
(removing access is an admin decision).
ROOT_EQUIV_SOCKSoverride mirrorsLEAK_SCAN_DIRS. Documented indocs/concepts/security-model.mdincludingthe deliberate non-findings (snapd peer-cred gate, setuid uidmap).
Headless mode for ecosystem tools (#42)
Research across the opencode ecosystem (official docs, awesome-opencode,
issue's two named tools) found two wrapper bugs beyond the 0.0.16 serve fix:
opencode run/acp/ query subcommands printed the banner on stdout,breaking
--format json/ stream-json / JSON-RPC parsers (cezar, VibeKanban, eval-harness, CI runners, IDE agents)
temp checkouts
SERVE_MODE is generalized to HEADLESS covering
serve,acp,run(messagearg or piped stdin), and query subcommands (
models,agent,providers,export, …): stdout stays machine-clean, diagnostics go to stderr, the CWDcheck is skipped, container tools resolve silently. Interactive TUI starts
keep banner and check. The soft permission layer applies to every session as
before. Verified compatibility matrix shipped as
docs/reference/compatibility.md. OpenHarness researched too — not anopencode client, no interaction with the kit.
Review 0.0.22 findings (issue #36)
~/.claudeWHOLE — move (the--yesdefault) transported Claude Code's.credentials.jsoninto theagent's group-readable home. Scope now:
~/.agentswhole (opencode's ownnamespace),
~/.claude/skillsskills-only. e2e pins that credentials staywith the developer; security-model.md states the guarantee.
tested, wiring only grep-tested) —
test-status.shnow runs the wholesection under
set -uagainst a real fake socket, red and green cases.(banner-only impact); documented.
Version
VERSION→ 0.0.22.Testing
make lint,make check-version, full unit suite greenmake e2e(236 checks, incl. new headless-run andmigration-scope pins) and
make e2e-rootless(42 checks)Closes #37
Closes #42
Closes #36 (review)