@opencode-cloud/core - npm Package Compare versions

Comparing version 3.2.1 to 3.2.2

Cargo.toml

 [package]
 name = "opencode-cloud-core"
-version = "3.2.1"
+version = "3.2.2"
 edition = "2024"
@@ -5,0 +5,0 @@ rust-version = "1.88"

package.json

 {
   "name": "@opencode-cloud/core",
-  "version": "3.2.1",
+  "version": "3.2.2",
   "description": "Core NAPI bindings for opencode-cloud (internal package)",
@@ -5,0 +5,0 @@ "main": "index.js",

src/config/mod.rs

@@ -18,3 +18,3 @@ //! Configuration management for opencode-cloud
 pub use paths::{get_config_dir, get_config_path, get_data_dir, get_hosts_path, get_pid_path};
-pub use schema::{CommitSha, Config, validate_bind_address};
+pub use schema::{Config, validate_bind_address};
 pub use validation::{
@@ -92,6 +92,11 @@ ValidationError, ValidationWarning, display_validation_error, display_validation_warning,
     // Parse JSONC (JSON with comments)
-    let parsed_value = parse_to_serde_value(&contents, &Default::default())
+    let mut parsed_value = parse_to_serde_value(&contents, &Default::default())
         .map_err(|e| anyhow::anyhow!("Invalid JSONC in config file: {e}"))?
         .ok_or_else(|| anyhow::anyhow!("Config file is empty"))?;
 
+    // Drop deprecated keys that were removed from the schema.
+    if let Some(obj) = parsed_value.as_object_mut() {
+        obj.remove("opencode_commit");
+    }
+
     // Deserialize into Config struct (deny_unknown_fields will reject unknown keys)
@@ -98,0 +103,0 @@ let config: Config = serde_json::from_value(parsed_value).with_context(|| {

src/config/schema.rs

@@ -7,47 +7,2 @@ //! Configuration schema for opencode-cloud
 use std::net::{IpAddr, Ipv4Addr};
-use std::ops::Deref;
-
-/// Validated opencode commit SHA (7-40 hex characters)
-#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
-#[serde(transparent)]
-pub struct CommitSha(String);
-
-impl CommitSha {
-    pub fn parse(value: &str) -> Result<Self, String> {
-        let trimmed = value.trim();
-        if trimmed.is_empty() {
-            return Err("Commit cannot be empty".to_string());
-        }
-        if !(7..=40).contains(&trimmed.len()) {
-            return Err("Commit must be 7-40 hex characters".to_string());
-        }
-        if !trimmed.chars().all(|c| c.is_ascii_hexdigit()) {
-            return Err("Commit must be a hexadecimal SHA".to_string());
-        }
-        Ok(Self(trimmed.to_string()))
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-impl Deref for CommitSha {
-    type Target = str;
-
-    fn deref(&self) -> &Self::Target {
-        self.as_str()
-    }
-}
-
-impl<'de> Deserialize<'de> for CommitSha {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let value = String::deserialize(deserializer)?;
-        CommitSha::parse(&value).map_err(serde::de::Error::custom)
-    }
-}
-
 /// Main configuration structure for opencode-cloud
@@ -160,7 +115,2 @@ ///
 
-    /// Override opencode commit used when building the Docker image (optional)
-    /// Must be a 7-40 character hex commit SHA.
-    #[serde(default)]
-    pub opencode_commit: Option<CommitSha>,
-
     /// When to check for updates: 'always' (every start), 'once' (once per version), 'never'
@@ -279,3 +229,2 @@ #[serde(default = "default_update_check")]
             image_source: default_image_source(),
-            opencode_commit: None,
             update_check: default_update_check(),
@@ -422,3 +371,2 @@ mounts: Vec::new(),
             image_source: default_image_source(),
-            opencode_commit: None,
             update_check: default_update_check(),
@@ -425,0 +373,0 @@ mounts: Vec::new(),

src/docker/Dockerfile

@@ -37,5 +37,2 @@ # =============================================================================
 
-# Pin opencode fork commit used during build
-ARG OPENCODE_COMMIT=dac099a4892689d11abedb0fcc1098b50e0958c8
-
 # OCI Labels for image metadata
@@ -524,3 +521,4 @@ LABEL org.opencontainers.image.title="opencode-cloud"
 # Build opencode from source (BuildKit cache mounts disabled for now)
-RUN rm -rf /tmp/opencode-repo \
+RUN OPENCODE_COMMIT="8694cc2e60422ad82d5ca72b67716423b18dabc2" \
+    && rm -rf /tmp/opencode-repo \
     && git clone --depth 1 https://github.com/pRizz/opencode.git /tmp/opencode-repo \
@@ -578,5 +576,3 @@ && cd /tmp/opencode-repo \
 # -----------------------------------------------------------------------------
-# Serve the built UI from /var/www/opencode and proxy API/WebSocket
-# TODO: Explore a sustainable routing strategy (e.g., backend-driven base URL or
-# TODO: content-type aware proxying without hardcoded path lists).
+# Serve the built UI from /var/www/opencode and proxy all 3000 traffic to backend.
 RUN rm -f /etc/nginx/sites-enabled/default /etc/nginx/conf.d/default.conf 2>/dev/null || true \
@@ -588,9 +584,21 @@ && printf '%s\n' \
     '' \
+    '  location / {' \
+    '    proxy_pass http://127.0.0.1:3001;' \
+    '    proxy_http_version 1.1;' \
+    '    proxy_set_header Upgrade $http_upgrade;' \
+    '    proxy_set_header Connection "upgrade";' \
+    '    proxy_set_header Host $host;' \
+    '    proxy_set_header X-Real-IP $remote_addr;' \
+    '    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' \
+    '    proxy_set_header X-Forwarded-Proto $scheme;' \
+    '  }' \
+    '}' \
+    '' \
+    'server {' \
+    '  listen 3002;' \
+    '  server_name _;' \
+    '' \
     '  root /var/www/opencode;' \
     '  index index.html;' \
     '' \
-    '  location = /health {' \
-    '    proxy_pass http://127.0.0.1:3001;' \
-    '  }' \
-    '' \
     '  location /assets/ {' \
@@ -604,13 +612,2 @@ '    try_files $uri =404;' \
     '' \
-    '  location ~ ^/(agent|auth|command|config|event|events|global|lsp|mcp|path|permission|project|provider|pty|question|rpc|session|sessions|status|v1|vcs|ws|api) {' \
-    '    proxy_pass http://127.0.0.1:3001;' \
-    '    proxy_http_version 1.1;' \
-    '    proxy_set_header Upgrade $http_upgrade;' \
-    '    proxy_set_header Connection "upgrade";' \
-    '    proxy_set_header Host $host;' \
-    '    proxy_set_header X-Real-IP $remote_addr;' \
-    '    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' \
-    '    proxy_set_header X-Forwarded-Proto $scheme;' \
-    '  }' \
-    '' \
     '  location / {' \
@@ -754,16 +751,20 @@ '    try_files $uri $uri/ /index.html;' \
 # -----------------------------------------------------------------------------
-# Create opencode.json config file with PAM authentication enabled
+# Create opencode.jsonc config file with PAM authentication enabled and UI URL
 RUN mkdir -p /home/opencode/.config/opencode \
     && printf '%s\n' \
     '{' \
+    '  // Container UI served via nginx on 3002' \
     '  "auth": {' \
     '    "enabled": true' \
+    '  },' \
+    '  "server": {' \
+    '    "uiUrl": "http://localhost:3002"' \
     '  }' \
     '}' \
-    > /home/opencode/.config/opencode/opencode.json \
+    > /home/opencode/.config/opencode/opencode.jsonc \
     && chown -R opencode:opencode /home/opencode/.config/opencode \
-    && chmod 644 /home/opencode/.config/opencode/opencode.json
+    && chmod 644 /home/opencode/.config/opencode/opencode.jsonc
 
 # Verify config file exists
-RUN ls -la /home/opencode/.config/opencode/opencode.json && cat /home/opencode/.config/opencode/opencode.json
+RUN ls -la /home/opencode/.config/opencode/opencode.jsonc && cat /home/opencode/.config/opencode/opencode.jsonc
 
@@ -820,6 +821,6 @@ USER opencode
 
-# Expose opencode web port (3000) and Cockpit port (9090)
-EXPOSE 3000 9090
+# Expose opencode ports (3000/3001/3002) and Cockpit (9090)
+EXPOSE 3000 3001 3002 9090
 
 # Hybrid init: entrypoint script chooses tini or systemd based on USE_SYSTEMD env
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

src/docker/dockerfile.rs

@@ -10,23 +10,5 @@ //! Embedded Dockerfile content
 
-use std::collections::HashMap;
-
 /// The Dockerfile for building the opencode-cloud-sandbox container image
 pub const DOCKERFILE: &str = include_str!("Dockerfile");
 
-/// Build arg name for the opencode commit used in the Dockerfile.
-pub const OPENCODE_COMMIT_BUILD_ARG: &str = "OPENCODE_COMMIT";
-
-/// Default opencode commit pinned in the Dockerfile.
-pub const OPENCODE_COMMIT_DEFAULT: &str = "dac099a4892689d11abedb0fcc1098b50e0958c8";
-
-/// Build args for overriding the opencode commit in the Dockerfile.
-pub fn build_args_for_opencode_commit(
-    maybe_commit: Option<&str>,
-) -> Option<HashMap<String, String>> {
-    let commit = maybe_commit?;
-    let mut args = HashMap::new();
-    args.insert(OPENCODE_COMMIT_BUILD_ARG.to_string(), commit.to_string());
-    Some(args)
-}
-
 // =============================================================================
@@ -33,0 +15,0 @@ // Docker Image Naming

src/docker/mod.rs

@@ -41,6 +41,3 @@ //! Docker operations module
 // Dockerfile constants
-pub use dockerfile::{
-    DOCKERFILE, IMAGE_NAME_DOCKERHUB, IMAGE_NAME_GHCR, IMAGE_TAG_DEFAULT,
-    OPENCODE_COMMIT_BUILD_ARG, OPENCODE_COMMIT_DEFAULT, build_args_for_opencode_commit,
-};
+pub use dockerfile::{DOCKERFILE, IMAGE_NAME_DOCKERHUB, IMAGE_NAME_GHCR, IMAGE_TAG_DEFAULT};
 
@@ -47,0 +44,0 @@ // Image operations

src/docker/README.dockerhub.md

@@ -31,6 +31,6 @@ # opencode-cloud-sandbox
 ```
-docker run --rm -it -p 3000:3000 -p 9090:9090 ghcr.io/prizz/opencode-cloud-sandbox:latest
+docker run --rm -it -p 3000:3000 -p 3001:3001 -p 3002:3002 -p 9090:9090 ghcr.io/prizz/opencode-cloud-sandbox:latest
 ```
 
-The opencode web UI is available at `http://localhost:3000`. Cockpit runs on `http://localhost:9090`.
+The opencode web UI is available at `http://localhost:3000`. The backend is reachable at `http://localhost:3001`, and the static UI is served at `http://localhost:3002`. Cockpit runs on `http://localhost:9090`.
 
@@ -37,0 +37,0 @@ ## Source

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

309645

-0.67%

No dependency changes