forked from farhoodlabs/paperclip
028c5aa00a
## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - The OpenCode adapter runs against local, SSH, and sandbox execution targets > - The Test path's hello probe spreads the Paperclip host's `process.env` into the remote process env, which over SSH gets exported on the remote shell > - On a Linux SSH target, `HOME=/Users/...` and a host XDG_CONFIG_HOME pointing at a macOS `/var/folders/...` temp dir cause OpenCode to walk a host-only path and fail with `EACCES: permission denied, mkdir '/Users'` > - This pull request stops the leak by passing only user-configured adapter env to the probe when the target is remote, matching the pattern already used by claude-local, codex-local, and gemini-local > - The benefit is the OpenCode hello probe now passes end-to-end against an SSH target without spurious filesystem errors ## What Changed - `prepareOpenCodeRuntimeConfig` short-circuits when the target is remote — the host-fs temp config dir is meaningless and harmful for a remote target - `test.ts` passes only the user-configured adapter env (no host `process.env` spread) to `runAdapterExecutionTargetProcess` when `targetIsRemote` - Local probes still get the full `runtimeEnv` so headless permission injection keeps working ## Verification - `pnpm vitest run --no-coverage --project @paperclipai/adapter-opencode-local` - `pnpm typecheck` clean - Manual: SSH OpenCode hello probe goes from `EACCES … mkdir '/Users'` to `opencode_hello_probe_passed` ## Risks Low risk — local probe behavior is unchanged; the change only narrows the env passed to remote targets, matching the pattern already shipped in sibling adapters. ## Model Used Claude Opus 4.7 (1M context) ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable — pattern mirrors existing sibling tests - [x] If this change affects the UI, I have included before/after screenshots — N/A (no UI) - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge
378 lines
14 KiB
TypeScript
378 lines
14 KiB
TypeScript
import type {
|
||
AdapterEnvironmentCheck,
|
||
AdapterEnvironmentTestContext,
|
||
AdapterEnvironmentTestResult,
|
||
} from "@paperclipai/adapter-utils";
|
||
import {
|
||
asBoolean,
|
||
asString,
|
||
asStringArray,
|
||
parseObject,
|
||
ensurePathInEnv,
|
||
} from "@paperclipai/adapter-utils/server-utils";
|
||
import {
|
||
ensureAdapterExecutionTargetCommandResolvable,
|
||
ensureAdapterExecutionTargetDirectory,
|
||
runAdapterExecutionTargetProcess,
|
||
describeAdapterExecutionTarget,
|
||
resolveAdapterExecutionTargetCwd,
|
||
} from "@paperclipai/adapter-utils/execution-target";
|
||
import { discoverOpenCodeModels, ensureOpenCodeModelConfiguredAndAvailable } from "./models.js";
|
||
import { parseOpenCodeJsonl } from "./parse.js";
|
||
import { prepareOpenCodeRuntimeConfig } from "./runtime-config.js";
|
||
|
||
function summarizeStatus(checks: AdapterEnvironmentCheck[]): AdapterEnvironmentTestResult["status"] {
|
||
if (checks.some((check) => check.level === "error")) return "fail";
|
||
if (checks.some((check) => check.level === "warn")) return "warn";
|
||
return "pass";
|
||
}
|
||
|
||
function firstNonEmptyLine(text: string): string {
|
||
return (
|
||
text
|
||
.split(/\r?\n/)
|
||
.map((line) => line.trim())
|
||
.find(Boolean) ?? ""
|
||
);
|
||
}
|
||
|
||
function summarizeProbeDetail(stdout: string, stderr: string, parsedError: string | null): string | null {
|
||
const raw = parsedError?.trim() || firstNonEmptyLine(stderr) || firstNonEmptyLine(stdout);
|
||
if (!raw) return null;
|
||
const clean = raw.replace(/\s+/g, " ").trim();
|
||
const max = 240;
|
||
return clean.length > max ? `${clean.slice(0, max - 1)}...` : clean;
|
||
}
|
||
|
||
function normalizeEnv(input: unknown): Record<string, string> {
|
||
if (typeof input !== "object" || input === null || Array.isArray(input)) return {};
|
||
const env: Record<string, string> = {};
|
||
for (const [key, value] of Object.entries(input as Record<string, unknown>)) {
|
||
if (typeof value === "string") env[key] = value;
|
||
}
|
||
return env;
|
||
}
|
||
|
||
const OPENCODE_AUTH_REQUIRED_RE =
|
||
/(?:auth(?:entication)?\s+required|api\s*key|invalid\s*api\s*key|not\s+logged\s+in|opencode\s+auth\s+login|free\s+usage\s+exceeded)/i;
|
||
|
||
export async function testEnvironment(
|
||
ctx: AdapterEnvironmentTestContext,
|
||
): Promise<AdapterEnvironmentTestResult> {
|
||
const checks: AdapterEnvironmentCheck[] = [];
|
||
const config = parseObject(ctx.config);
|
||
const command = asString(config.command, "opencode");
|
||
const target = ctx.executionTarget ?? null;
|
||
const targetIsRemote = target?.kind === "remote";
|
||
const cwd = resolveAdapterExecutionTargetCwd(target, asString(config.cwd, ""), process.cwd());
|
||
const targetLabel = targetIsRemote
|
||
? ctx.environmentName ?? describeAdapterExecutionTarget(target)
|
||
: null;
|
||
const runId = `opencode-envtest-${Date.now()}-${Math.random().toString(16).slice(2)}`;
|
||
|
||
if (targetLabel) {
|
||
checks.push({
|
||
code: "opencode_environment_target",
|
||
level: "info",
|
||
message: `Probing inside environment: ${targetLabel}`,
|
||
});
|
||
}
|
||
|
||
try {
|
||
await ensureAdapterExecutionTargetDirectory(runId, target, cwd, {
|
||
cwd,
|
||
env: {},
|
||
createIfMissing: false,
|
||
});
|
||
checks.push({
|
||
code: "opencode_cwd_valid",
|
||
level: "info",
|
||
message: `Working directory is valid: ${cwd}`,
|
||
});
|
||
} catch (err) {
|
||
checks.push({
|
||
code: "opencode_cwd_invalid",
|
||
level: "error",
|
||
message: err instanceof Error ? err.message : "Invalid working directory",
|
||
detail: cwd,
|
||
});
|
||
}
|
||
|
||
const envConfig = parseObject(config.env);
|
||
const env: Record<string, string> = {};
|
||
for (const [key, value] of Object.entries(envConfig)) {
|
||
if (typeof value === "string") env[key] = value;
|
||
}
|
||
|
||
const openaiKeyOverride = "OPENAI_API_KEY" in envConfig ? asString(envConfig.OPENAI_API_KEY, "") : null;
|
||
if (openaiKeyOverride !== null && openaiKeyOverride.trim() === "") {
|
||
checks.push({
|
||
code: "opencode_openai_api_key_missing",
|
||
level: "warn",
|
||
message: "OPENAI_API_KEY override is empty.",
|
||
hint: "The OPENAI_API_KEY override is empty. Set a valid key or remove the override.",
|
||
});
|
||
}
|
||
|
||
// Prevent OpenCode from writing an opencode.json into the working directory.
|
||
env.OPENCODE_DISABLE_PROJECT_CONFIG = "true";
|
||
const preparedRuntimeConfig = await prepareOpenCodeRuntimeConfig({ env, config, targetIsRemote });
|
||
if (asBoolean(config.dangerouslySkipPermissions, true)) {
|
||
checks.push({
|
||
code: "opencode_headless_permissions_enabled",
|
||
level: "info",
|
||
message: "Headless OpenCode external-directory permissions are auto-approved for unattended runs.",
|
||
});
|
||
}
|
||
try {
|
||
const runtimeEnv = normalizeEnv(ensurePathInEnv({ ...process.env, ...preparedRuntimeConfig.env }));
|
||
|
||
const cwdInvalid = checks.some((check) => check.code === "opencode_cwd_invalid");
|
||
if (cwdInvalid) {
|
||
checks.push({
|
||
code: "opencode_command_skipped",
|
||
level: "warn",
|
||
message: "Skipped command check because working directory validation failed.",
|
||
detail: command,
|
||
});
|
||
} else {
|
||
try {
|
||
await ensureAdapterExecutionTargetCommandResolvable(command, target, cwd, runtimeEnv);
|
||
checks.push({
|
||
code: "opencode_command_resolvable",
|
||
level: "info",
|
||
message: `Command is executable: ${command}`,
|
||
});
|
||
} catch (err) {
|
||
checks.push({
|
||
code: "opencode_command_unresolvable",
|
||
level: "error",
|
||
message: err instanceof Error ? err.message : "Command is not executable",
|
||
detail: command,
|
||
});
|
||
}
|
||
}
|
||
|
||
const canRunProbe =
|
||
checks.every((check) => check.code !== "opencode_cwd_invalid" && check.code !== "opencode_command_unresolvable");
|
||
|
||
let modelValidationPassed = false;
|
||
const configuredModel = asString(config.model, "").trim();
|
||
|
||
// Model discovery and validation use local child processes against
|
||
// OpenCode's `models` subcommand and JSON config; these are not yet
|
||
// wired through the execution target. When probing a remote env, skip
|
||
// discovery/validation and rely on the remote hello probe to surface
|
||
// model/auth issues directly.
|
||
if (targetIsRemote && configuredModel) {
|
||
checks.push({
|
||
code: "opencode_model_validation_skipped_remote",
|
||
level: "info",
|
||
message: `Skipped local model validation; will be validated by the hello probe inside ${targetLabel}.`,
|
||
});
|
||
modelValidationPassed = true;
|
||
} else if (canRunProbe && configuredModel) {
|
||
try {
|
||
const discovered = await discoverOpenCodeModels({ command, cwd, env: runtimeEnv });
|
||
if (discovered.length > 0) {
|
||
checks.push({
|
||
code: "opencode_models_discovered",
|
||
level: "info",
|
||
message: `Discovered ${discovered.length} model(s) from OpenCode providers.`,
|
||
});
|
||
} else {
|
||
checks.push({
|
||
code: "opencode_models_empty",
|
||
level: "error",
|
||
message: "OpenCode returned no models.",
|
||
hint: "Run `opencode models` and verify provider authentication.",
|
||
});
|
||
}
|
||
} catch (err) {
|
||
const errMsg = err instanceof Error ? err.message : String(err);
|
||
if (/ProviderModelNotFoundError/i.test(errMsg)) {
|
||
checks.push({
|
||
code: "opencode_hello_probe_model_unavailable",
|
||
level: "warn",
|
||
message: "The configured model was not found by the provider.",
|
||
detail: errMsg,
|
||
hint: "Run `opencode models` and choose an available provider/model ID.",
|
||
});
|
||
} else {
|
||
checks.push({
|
||
code: "opencode_models_discovery_failed",
|
||
level: "error",
|
||
message: errMsg || "OpenCode model discovery failed.",
|
||
hint: "Run `opencode models` manually to verify provider auth and config.",
|
||
});
|
||
}
|
||
}
|
||
} else if (!targetIsRemote && canRunProbe && !configuredModel) {
|
||
try {
|
||
const discovered = await discoverOpenCodeModels({ command, cwd, env: runtimeEnv });
|
||
if (discovered.length > 0) {
|
||
checks.push({
|
||
code: "opencode_models_discovered",
|
||
level: "info",
|
||
message: `Discovered ${discovered.length} model(s) from OpenCode providers.`,
|
||
});
|
||
}
|
||
} catch (err) {
|
||
const errMsg = err instanceof Error ? err.message : String(err);
|
||
if (/ProviderModelNotFoundError/i.test(errMsg)) {
|
||
checks.push({
|
||
code: "opencode_hello_probe_model_unavailable",
|
||
level: "warn",
|
||
message: "The configured model was not found by the provider.",
|
||
detail: errMsg,
|
||
hint: "Run `opencode models` and choose an available provider/model ID.",
|
||
});
|
||
} else {
|
||
checks.push({
|
||
code: "opencode_models_discovery_failed",
|
||
level: "warn",
|
||
message: errMsg || "OpenCode model discovery failed (best-effort, no model configured).",
|
||
hint: "Run `opencode models` manually to verify provider auth and config.",
|
||
});
|
||
}
|
||
}
|
||
}
|
||
|
||
const modelUnavailable = checks.some((check) => check.code === "opencode_hello_probe_model_unavailable");
|
||
if (!configuredModel && !modelUnavailable) {
|
||
// No model configured – skip model requirement if no model-related checks exist
|
||
} else if (!targetIsRemote && configuredModel && canRunProbe) {
|
||
try {
|
||
await ensureOpenCodeModelConfiguredAndAvailable({
|
||
model: configuredModel,
|
||
command,
|
||
cwd,
|
||
env: runtimeEnv,
|
||
});
|
||
checks.push({
|
||
code: "opencode_model_configured",
|
||
level: "info",
|
||
message: `Configured model: ${configuredModel}`,
|
||
});
|
||
modelValidationPassed = true;
|
||
} catch (err) {
|
||
checks.push({
|
||
code: "opencode_model_invalid",
|
||
level: "error",
|
||
message: err instanceof Error ? err.message : "Configured model is unavailable.",
|
||
hint: "Run `opencode models` and choose a currently available provider/model ID.",
|
||
});
|
||
}
|
||
}
|
||
|
||
if (canRunProbe && modelValidationPassed) {
|
||
const extraArgs = (() => {
|
||
const fromExtraArgs = asStringArray(config.extraArgs);
|
||
if (fromExtraArgs.length > 0) return fromExtraArgs;
|
||
return asStringArray(config.args);
|
||
})();
|
||
const variant = asString(config.variant, "").trim();
|
||
const probeModel = configuredModel;
|
||
|
||
const args = ["run", "--format", "json"];
|
||
args.push("--model", probeModel);
|
||
if (variant) args.push("--variant", variant);
|
||
if (extraArgs.length > 0) args.push(...extraArgs);
|
||
|
||
// For remote targets, do NOT spread the host process.env into the
|
||
// probe env: it leaks macOS-only paths (HOME=/Users/..., host
|
||
// XDG_CONFIG_HOME, TMPDIR, etc.) into the remote shell, which causes
|
||
// opencode on the remote box to try to mkdir host paths like /Users.
|
||
// Match the pattern used by claude_local / codex_local / gemini_local
|
||
// probes: send only the user-configured adapter env across SSH.
|
||
const probeEnv = targetIsRemote ? preparedRuntimeConfig.env : runtimeEnv;
|
||
try {
|
||
const probe = await runAdapterExecutionTargetProcess(
|
||
runId,
|
||
target,
|
||
command,
|
||
args,
|
||
{
|
||
cwd,
|
||
env: probeEnv,
|
||
timeoutSec: 60,
|
||
graceSec: 5,
|
||
stdin: "Respond with hello.",
|
||
onLog: async () => {},
|
||
},
|
||
);
|
||
|
||
const parsed = parseOpenCodeJsonl(probe.stdout);
|
||
const detail = summarizeProbeDetail(probe.stdout, probe.stderr, parsed.errorMessage);
|
||
const authEvidence = `${parsed.errorMessage ?? ""}\n${probe.stdout}\n${probe.stderr}`.trim();
|
||
|
||
if (probe.timedOut) {
|
||
checks.push({
|
||
code: "opencode_hello_probe_timed_out",
|
||
level: "warn",
|
||
message: "OpenCode hello probe timed out.",
|
||
hint: "Retry the probe. If this persists, run OpenCode manually in this working directory.",
|
||
});
|
||
} else if ((probe.exitCode ?? 1) === 0 && !parsed.errorMessage) {
|
||
const summary = parsed.summary.trim();
|
||
const hasHello = /\bhello\b/i.test(summary);
|
||
checks.push({
|
||
code: hasHello ? "opencode_hello_probe_passed" : "opencode_hello_probe_unexpected_output",
|
||
level: hasHello ? "info" : "warn",
|
||
message: hasHello
|
||
? "OpenCode hello probe succeeded."
|
||
: "OpenCode probe ran but did not return `hello` as expected.",
|
||
...(summary ? { detail: summary.replace(/\s+/g, " ").trim().slice(0, 240) } : {}),
|
||
...(hasHello
|
||
? {}
|
||
: {
|
||
hint: "Run `opencode run --format json` manually and prompt `Respond with hello` to inspect output.",
|
||
}),
|
||
});
|
||
} else if (/ProviderModelNotFoundError/i.test(authEvidence)) {
|
||
checks.push({
|
||
code: "opencode_hello_probe_model_unavailable",
|
||
level: "warn",
|
||
message: "The configured model was not found by the provider.",
|
||
...(detail ? { detail } : {}),
|
||
hint: "Run `opencode models` and choose an available provider/model ID.",
|
||
});
|
||
} else if (OPENCODE_AUTH_REQUIRED_RE.test(authEvidence)) {
|
||
checks.push({
|
||
code: "opencode_hello_probe_auth_required",
|
||
level: "warn",
|
||
message: "OpenCode is installed, but provider authentication is not ready.",
|
||
...(detail ? { detail } : {}),
|
||
hint: "Run `opencode auth login` or set provider credentials, then retry the probe.",
|
||
});
|
||
} else {
|
||
checks.push({
|
||
code: "opencode_hello_probe_failed",
|
||
level: "error",
|
||
message: "OpenCode hello probe failed.",
|
||
...(detail ? { detail } : {}),
|
||
hint: "Run `opencode run --format json` manually in this working directory to debug.",
|
||
});
|
||
}
|
||
} catch (err) {
|
||
checks.push({
|
||
code: "opencode_hello_probe_failed",
|
||
level: "error",
|
||
message: "OpenCode hello probe failed.",
|
||
detail: err instanceof Error ? err.message : String(err),
|
||
hint: "Run `opencode run --format json` manually in this working directory to debug.",
|
||
});
|
||
}
|
||
}
|
||
} finally {
|
||
await preparedRuntimeConfig.cleanup();
|
||
}
|
||
|
||
return {
|
||
adapterType: ctx.adapterType,
|
||
status: summarizeStatus(checks),
|
||
checks,
|
||
testedAt: new Date().toISOString(),
|
||
};
|
||
}
|