[nwparker]

	Files	Added	Deleted	Net
Test	18	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​2107	$\color{#cf222e}{\Huge{\mathbf{−}}}$​39	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​2068
Prod	35	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1299	$\color{#cf222e}{\Huge{\mathbf{−}}}$​213	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1086

ELI5

A startup brief could disappear after an interrupted authorization exchange, or lose status reporting under a separate configuration directory. A fresh terminal now keeps its real status plugin and receives an authorized brief once. Interrupted claim bodies receive a retryable response.

What Changed

Bind startup authorization to the terminal incarnation, launch token and absence of user input. A stable request ID retries transient delivery and can replay the same valid grant. Preserve selected XDG and OpenCode configuration directories through sparse launch overlays. Later launches reuse the original user configuration and add the prompt plugin to the verified status overlay. Flush pending terminal-status writes at shutdown while retaining atomic writes and permission recovery.

The claim handler now attempts 503 when the authenticated body is truncated by transport loss. Malformed JSON and requests stopped by Orca's own slowloris limit retain 200 {allowed:false}. The existing plugin already retries 503 with the same request ID.

Why

Execution-owner facts protect user input and reattachments. Retrying a bounded grant handles interrupted delivery without a second insertion. Reusing the original configuration, existing overlay and dirty-write timer preserves status and avoids another store.

Linked Issue

Part of #22829. The host-capability prerequisite #24662 is merged; this PR targets main.

Visual Proof

Installed-CLI lost-response before/after evidence and the hidden fresh/nested completions are retained. Screenshots and actual evidence are pinned to their executed source.

Testing

• Installed OpenCode exercised in retained before/after runs.
• Automated tests cover the reproduced boundaries.

Current 81354ff9 passes 99 tests across five files, all three desktop typechecks, full changed-file lint/format and the six changed-code gates. A real authenticated loopback reset reproduces the handler's attempted 200 before and 503 afterward without consuming a claim. The reset peer cannot receive that response; this control establishes classification, without an observed lost brief. Existing generated-plugin tests cover retryable responses, lost grants and stable request IDs. Malformed payload and self-imposed timeout denial controls pass.

The parent 1f27c138 includes merged #24662 and named main 5a2aa87f, with three typechecks and 284 tests across 12 files. Earlier d9285ae0 full-scope checks, build and 359 tests across 29 files remain pinned to that source; counts overlap.

Installed OpenCode 2.0.16 reproduced lost startup authorization and incorrect inherited configuration. Earlier combined 7c765fde retained an additional native failure whose complete cause was not captured. Repaired combined c8fdfdbe then completed fresh and nested Unicode turns, used one status/prompt overlay, claimed each brief once, preserved user configuration and reported canonical working → done. Its genuine worker selected the private CLI and completed worker_done once. All 319 recorded process incarnations and four private ports closed. Those runs are on main 2b1acd0d; current-source validation is separate, without a current-commit app-runtime claim.

Review

Current source 81354ff9ae4838b6bd9ce581ac08ded23eda0e31 retains the complete cumulative contribution across 120 files. The direct correction preserves 118 prior owned contents, changes the claim handler and adds the existing transport test to the scope. Every other file matches qualified parent 1f27c138. Independent reviews checked the complete source, raw checks and 24 closed qualification process observations. Named main through ffd23fe2 has no further changed files in this scope; fresh public CI will test the combined merge. Contributor ancestry and the six previously reviewed overlap resolutions remain retained.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer material is copied.

Notes

Credit Ahmed Nagy's atomic-write and permission work and Adnan Khan (@akhan157)'s accepted manifest reader from #13287/#24763. Authorization has a 20-second reservation followed by one 20-second reset at admission after spawn commit. The plugin has its own deadline; the earlier deadline wins. A composer that becomes ready after expiration is outside that recovery window.

Checklist

• Scope retained and focused on this layer.
• User-facing change, mechanism and approach explained.
• Visual evidence linked above.
• Self-reviewed and independently reviewed.
• Cross-platform, folder workspace and SSH execution boundaries considered.
• Appropriate tests, typechecks, formatting and changed-line checks pass.
• Fresh public CI passes before merge.

[pullfrog]

Important

Two issues worth addressing before merge: the strip of --prompt is irreversible while delivery can still fail, so a slow start or one transient loopback error loses the startup brief that this PR exists to submit; and a Windows permission-recovery path is dropped for the legacy shared plugin write.

Reviewed changes

• Native startup-prompt intent — shared/tui-agent-startup.ts and shared/opencode-startup-prompt.ts add the ORCA_OPENCODE_STARTUP_PROMPT_{SHA256,BODY,SHELL} env, and happy/main/opencode/opencode-pty-launch.ts gates on a 2.0.16 prefill probe, strips the trailing --prompt <body>, and reserves a one-use claim.
• Claim authorization — new opencode-startup-prompt-claims.ts plus commitPtyWithOpenCodePromptIntent/bindOpenCodeStartupPromptOwner; TerminalRunFactsRegister.reserveSpawnCommit captures pre-commit driving input, and OrcaRuntimeWithRuntimeId.readOpenCodeStartupPromptOwner supplies owner facts.
• TUI plugin — generated opencode-startup-prompt-source.ts polls the composer, claims over loopback, inserts the exact draft, and dispatches prompt.submit; opencode-startup-prompt-installer.ts installs it in an owned overlay independent of status plugins.
• Hook server lifecycle — the loopback listener now starts even with status hooks disabled, setStatusHooksEnabled toggles the status owner/binder/retries/polls, and /opencode/startup-prompt/claim is served on the existing authenticated listener.
• Plugin install + atomic write — new opencode-plugin-atomic-write.ts and extracted windows-retry-file-operations.ts; overlay vs canonical symlink/mode handling; relay/WSL prompt-install plumbing.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[nwparker]

Installed OpenCode 2.0.16, genuine nested-launch before/after evidence. Both screenshots come from hidden, unfocused Orca renderers with a private loopback provider.

Before (df6484a9), inheriting the first launch's actual CLI environment made the later launch identify an Orca prompt overlay as the original config source. Actual process environment and loaded user-plugin receipts record the wrong source and two overlays. The Unicode task still completed; this screenshot confirms the real task, while the source error is established by those receipts.

After (e6b156b2), both actual CLI processes and the loaded user plugin retain the original private user config source. The final owned overlay contains both status and prompt plugins. The original user bytes are unchanged, the Unicode task completes once, and canonical status reports its own answer.

All 39 before and 48 after recorded processes exited and six ports closed in each run. The published stack ending at b78c1aa0 preserves all 123 reviewed launch postimages exactly; its current-main join has no extra live-run claim. The sealed proof contains the actual environment, plugin, provider-request, canonical-status and cleanup receipts. Windows, SSH and physical IME are outside these recordings.

[pullfrog]

Important

The restacked head no longer passes tc:node: opencode-pty-launch.ts calls isOpenCodeRunCommand with an argument the helper does not accept (inline). The source-provenance fix itself reads correctly and its focused tests pass.

Reviewed changes

• Real source provenance — installOpenCodeStartupPromptForLaunch resolves the user's config through resolveOpenCodeSourceConfigDir and records ORCA_OPENCODE_SOURCE_CONFIG_DIR, so the second phase no longer treats the first prompt overlay as the user's source.
• Compose into the existing status overlay — when OPENCODE_CONFIG_DIR already equals ORCA_OPENCODE_CONFIG_DIR, the new OpenCodeHookService.installIntoSourceOverlay verifies the directory is the expected source: overlay, refuses a symlinked/replaced overlay, and writes the prompt plugin beside the status plugin instead of building a second overlay.
• Retain provenance through the provider deletion pass — prepareOpenCodePtyLaunch removes OPENCODE_CONFIG_DIR/ORCA_OPENCODE_CONFIG_DIR/ORCA_OPENCODE_SOURCE_CONFIG_DIR from envToDelete after a successful install.
• Tests — added replaced-overlay refusal and opencode/opencode2 single-overlay composition cases, a source-proof deletion-pass test, and a lost-response wait in the source suite.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

• Extracted the OpenCode plugin-config writer — hook-service.ts now delegates writePluginIntoOverlay/writePluginToConfigDir to the new opencode-plugin-config-writer.ts (writeOpenCodePluginConfig). The extraction is behavior-preserving: the tuiOnlyDirectory early return, the installsTuiPlugin guard, the current-check selection, and the ownership-specific atomic write all match the two inline bodies it replaces.
• Rewrote run-command detection — opencode-headless-command.ts gains an optional shell parameter and a findOpenCodeRunCommand that resolves the executable position behind POSIX env assignments and env prefixes (including -u/--unset/-C/--chdir/-P/-i/--), plus the PowerShell & call operator. This also fixes a latent miss where env-prefixed opencode run was not recognized as a run command. The shell parameter is optional, so the existing one-argument caller in opencode-startup-prompt.ts:24 is unaffected.
• Added focused tests — opencode-headless-command.test.ts (29 cases) covers env-option argument position, the PowerShell call operator, and negative cases; they fail under the old implementation.
• Resolved the prior tc:node failure — isOpenCodeRunCommand(parsed.tokens, shell) at opencode-pty-launch.ts:94 now typechecks against the two-argument helper. Verified locally: pnpm tc:node passes and the focused suite is 29/29.

All prior Pullfrog review threads (5393676719, 5401852342, 5402240688) are resolved and unchanged by this delta.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run re-reviews the single commit pushed since the prior pullfrog review at b43c77d7f. The delta is confined to the generated native startup-prompt TUI plugin and its test.

• Wait for authoritative location hydration before claiming or submitting — the generated plugin in opencode-startup-prompt-source.ts now calls ctx.data.location.sync(ctx.location) once at setup and only sets locationReady when that promise resolves; the claim/insert/prompt.submit path returns early until it does. That keeps OpenCode from selecting its first-catalog-entry (unavailable) model fallback while configuration is still hydrating. A missing sync makes setup a noop and a rejected sync routes through the existing settle(), so both fail closed.
• Coverage for the new gate — opencode-startup-prompt-source.test.ts adds a sync fixture, an ordering test that asserts the dispatch observes the configured model (it fails under the pre-gate implementation), an eight-reason cancellation matrix for delayed hydration, and missing/rejected-sync fail-closed cases.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run re-reviews the single commit pushed since the prior pullfrog review at 85efe85e. The delta is confined to the generated native startup-prompt TUI plugin and its test.

• Bind readiness to the live location — the generated plugin in opencode-startup-prompt-source.ts replaces the one-shot setup ctx.data.location.sync(ctx.location)/locationReady flag with a live locationKey (JSON.stringify([directory, workspaceID])). Each 100ms poll re-hydrates { directory, workspaceID } whenever the key changes, sets readyLocation only when the sync resolves and ctx.location still matches, and re-checks the key on the claim, insert and prompt.submit paths. This keeps a home-location change after setup (startup directory → home directory) from submitting with the wrong location's config, and refuses a grant that arrives after the location moved.
• Coverage for the new gate — opencode-startup-prompt-source.test.ts adds four tests: startup-directory → home-directory re-sync asserting the configured model at dispatch (fails under the old one-shot sync), waiting for a concrete location before any sync, workspace-ID-scoped readiness, and refusing a granted claim after the composer location changes.

The OpenCode contract this relies on is confirmed against v2.0.16: Location.Ref is { directory: string; workspaceID?: string }, data.location.sync(location?: LocationRef) accepts exactly that partial ref, and the TUI wrapper awaits syncInfo + location.sync + config.sync, so the gate does cover model/config hydration.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3d7206e6-121a-4d1a-8490-6c85135a84a1

📥 Commits

Reviewing files that changed from the base of the PR and between 1f27c13 and 81354ff.

📒 Files selected for processing (2)

• src/main/agent-hooks/server-transport-interference.test.ts
• src/main/agent-hooks/server/server-lifecycle.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/main/agent-hooks/server/server-lifecycle.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds startup-prompt intent and delivery for OpenCode, including plugin installation, PTY launch preparation, runtime ownership checks, and claim handling. It also adds runtime status-hook controls and updates host and relay paths to install and report the startup-prompt plugin.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 81354

No current merge-blocking issue is established for these changes; normal checks remain appropriate.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 81354

Automatic startup submission is guarded by launch identity and checks that the terminal remains untouched. No authorization bypass was established. Incomplete baseline and downstream-permission coverage prevent a minimal-risk assessment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A valid grant is scoped to one fresh local PTY launch and its registered startup text. The sensitive outcome is native prompt submission in that agent, not direct execution of a command supplied to the claim endpoint. Downstream agent and tool permissions were not established by this review.

Trust Boundaries and Controls

• observed — Authentication precedes untrusted-body parsing. Possession of the listener token alone is insufficient: authorization also requires a registered nonce, matching digest, valid operation identity, and current fresh-owner facts with no recorded user input.
• observed — Delivery rechecks expiry, route, location, focused editor identity, and an empty composer after the authorization response. It marks the operation settled before insertion and dispatches submission only if the inserted text still matches the registered digest and cancellation checks still pass.

Resilience and Maintainability Implications

• observed — Lost authorization responses can be retried only with the same operation ID while ownership remains valid. The plugin serializes in-flight claims and uses settled state to prevent repeated submission. Inspected tests exercise interrupted requests, lost responses, alternate-ID replay, and ownership invalidation; tests were not executed during this review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.42% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 38 functions across 51 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: safely submitting admitted OpenCode startup briefs without overwriting user input.
Description check	✅ Passed	The description covers the required sections, explains the change and rationale, links issue #22829, and reports testing and evidence. It also clearly notes that fresh public CI is still pending.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 670299f6-be63-4bec-90fd-f4a0640701df

📥 Commits

Reviewing files that changed from the base of the PR and between ce07786 and 1f27c13.

📒 Files selected for processing (52)

• src/main/agent-hooks/server-startup-prompt-control.test.ts
• src/main/agent-hooks/server/server-lifecycle.ts
• src/main/agent-hooks/server/server-listeners.ts
• src/main/agent-hooks/server/server-runtime-env.ts
• src/main/agent-hooks/server/server-state.ts
• src/main/agent-hooks/server/server-status-hook-lifecycle.ts
• src/main/global-fetch-call-site-audit.test.ts
• src/main/ipc/pty-controller-process-inventory.test.ts
• src/main/ipc/pty-ipc-mock-registry.ts
• src/main/ipc/pty/host-env/assembly.ts
• src/main/ipc/pty/host-env/opencode-config.ts
• src/main/ipc/pty/host-env/opencode-hook-installation.test.ts
• src/main/ipc/pty/ipc/spawn-commit.ts
• src/main/ipc/pty/ipc/spawn-options.ts
• src/main/ipc/pty/runtime/spawn-commit.ts
• src/main/ipc/pty/runtime/spawn-options.ts
• src/main/opencode/hook-service.ts
• src/main/opencode/opencode-overlay-manifest.ts
• src/main/opencode/opencode-plugin-config-writer.ts
• src/main/opencode/opencode-pty-launch.test.ts
• src/main/opencode/opencode-pty-launch.ts
• src/main/opencode/opencode-startup-prompt-claims.test.ts
• src/main/opencode/opencode-startup-prompt-claims.ts
• src/main/opencode/opencode-startup-prompt-installer.test.ts
• src/main/opencode/opencode-startup-prompt-installer.ts
• src/main/opencode/opencode-startup-prompt-owner.test.ts
• src/main/opencode/opencode-startup-prompt-owner.ts
• src/main/opencode/opencode-startup-prompt-runtime-identity.test.ts
• src/main/opencode/opencode-startup-prompt-source.test.ts
• src/main/opencode/opencode-startup-prompt-source.ts
• src/main/orcad/orcad-entry.ts
• src/main/orcad/orcad-push-startup.test.ts
• src/main/providers/provider-dispatch.test.ts
• src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts
• src/main/runtime/terminal-run-facts.test.ts
• src/main/runtime/terminal-run-facts.ts
• src/main/startup/headless-pty-hydration-ordering.test.ts
• src/main/startup/main-process-pty-startup.ts
• src/main/startup/main-process-ready-foundation.ts
• src/relay/opencode-overlay-mirror.ts
• src/relay/opencode-startup-prompt-install.test.ts
• src/relay/plugin-overlay.ts
• src/relay/pty-handler.ts
• src/relay/relay-agent-hook-runtime.ts
• src/relay/wsl-install-plugins-handler.ts
• src/shared/opencode-headless-command.test.ts
• src/shared/opencode-headless-command.ts
• src/shared/opencode-startup-prompt-install.ts
• src/shared/opencode-startup-prompt.test.ts
• src/shared/opencode-startup-prompt.ts
• src/shared/opencode-tui-plugin-install.ts
• src/shared/tui-agent-startup.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

[pullfrog]

✅ No new issues found.

Reviewed changes

This run re-reviews the single commit pushed since the prior pullfrog review at 1dc953cf (the 1f27c138 merge was already covered). The delta is confined to the claim handler's error path and its test.

• Retryable classification for an interrupted claim — in server-lifecycle.ts, a claim request whose authenticated body is truncated by transport loss (isHookRequestTruncatedError) and was not ended by Orca's own slowloris cap now answers 503 instead of 200 {"allowed":false}. Because the throw happens while reading the body, onStartupPromptClaim is never invoked, so the claim is not consumed; the generated plugin maps >=500 to "pending" and retries with the same requestId. Malformed JSON, oversized payloads, and slowloris-capped requests keep the 200 denial.
• Coverage for the new branch — server-transport-interference.test.ts parameterizes postStalledHook with a pathname, then asserts the truncated claim produces [[503]] with the claim listener uncalled and no interference report, while the slowloris-capped claim still produces the 200 denial. The truncated case fails against the pre-change handler, which wrote 200.

All prior Pullfrog review threads are resolved and unchanged by this delta. The change directly answers CodeRabbit review 5404664153, which marked the thread addressed.

Verified locally: focused suite server-transport-interference.test.ts 6/6 passes and pnpm tc:node passes.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}