Repository navigation
fix(paseo): launch real opencode outside PID 1 - #559
Merged
Merged
Conversation
Keep the Paseo entrypoint shim only when the wrapper is PID 1. Bare opencode in an MSB shell or exec session opens the real terminal TUI without repinning the global Paseo worktree root. Update the verify contract and offline wrapper tests. Co-authored-by: OpenCode <[email protected]> Refs: #548
Resolve executable symlinks before choosing the real OpenCode binary. Keep non-PID-1 wrapper checks from claiming a TUI opened based on a non-TTY exit, and document direct-shim and startup-root limits accurately. Co-authored-by: OpenCode <[email protected]> Refs: #548
Do not claim a non-TTY exit proves the real TUI launched or a source-level check proves the live PID-1 hold. Fail on a root unrelated to the primary guest workspace and describe the live observation still needed. Co-authored-by: OpenCode <[email protected]> Refs: #548
Reject a stale worktrees.root even if another JSON object contains a matching root. Label PID-1 source checks as structural rather than live evidence, and clarify direct shim invocation. Co-authored-by: OpenCode <[email protected]> Refs: #548
Treat PID-1 source checks as structural evidence and leave live behavior explicitly unverified. Assert the verdict for the exact nested worktrees.root field, including an unrelated matching-key negative fixture. Co-authored-by: OpenCode <[email protected]> Refs: #548
Document conditional worktree-root initialization and state the detached verifier checks source structure, not a live PID-1 handoff. Co-authored-by: OpenCode <[email protected]> Refs: #548
Mark the PID-1 hold and real TUI as unmeasured in the detached verifier. Distinguish unavailable startup seeding from an incorrect seeded root, with positive and negative verdict fixtures. Co-authored-by: OpenCode <[email protected]> Refs: #548
Do not infer startup seeding solely from a usable workspace. Distinguish a preserved or unverified root from a measured mismatch, and qualify offline results when required validators were skipped. Co-authored-by: OpenCode <[email protected]> Refs: #548
Separate valid, missing, and invalid config results in the detached verifier. Report preserved roots as unverified, fail invalid data, and give skipped checks a distinct exit status instead of a verified pass. Co-authored-by: OpenCode <[email protected]> Refs: #548
Classify transport failure as unverified, reject malformed or relative worktree roots, and document the detached verifier exit-3 contract. Cover the typed outcomes with offline fixtures. Co-authored-by: OpenCode <[email protected]> Refs: #548
Accept usable absolute workspace paths with internal spaces and reject JSON control characters before shell transport can discard them. Correct detached lifecycle and backend-dependent host-port guidance. Co-authored-by: OpenCode <[email protected]> Refs: #548
Keep space-containing paths intact in the verifier, align host-port guidance with backend allocation, and document Paseo’s separate incomplete-coverage exit status. Co-authored-by: OpenCode <[email protected]> Refs: #548
Do not require readlink or the real OpenCode binary on the PID-1 entrypoint path. Clarify detached sandbox behavior and cover branch ordering with a regression test. Co-authored-by: OpenCode <[email protected]> Refs: #548
Reject a second PATH name for the wrapper inode and compare registered projects using physical paths resolved in the guest. Keep configured root equality distinct from physical containment evidence. Co-authored-by: OpenCode <[email protected]> Refs: #548
Match either the guest-visible mount path or its physical guest spelling when checking fixture projects; require the fixture to resolve before accepting a registration. Co-authored-by: OpenCode <[email protected]> Refs: #548
Apply the literal-or-physical guest path comparison to the complete project set and execute the aggregate loop against alias and unrelated path fixtures. Co-authored-by: OpenCode <[email protected]> Refs: #548
Canonicalize host-owned verification fixtures before resolving their guest paths so a host /var alias does not falsely fail when the guest mounts /private/var. Co-authored-by: OpenCode <[email protected]> Refs: #548
Validate the guest port override before command construction, return unverified for absent live tooling or incomplete bundle and ownership probes, and exercise the verdict branches offline. Co-authored-by: OpenCode <[email protected]> Refs: #548
Record an absent cache as unverified and only credit host bundle delivery when it matches an in-guest baseline. Co-authored-by: OpenCode <[email protected]> Refs: #548
Reject port overrides inconsistent with the kit, require successful guest curl completion for a bundle baseline, and fail closed on cache traversal diagnostics. Co-authored-by: OpenCode <[email protected]> Refs: #548
basiliskus
requested changes
Oct 30, 2026
basiliskus
left a comment
basiliskus
left a comment
Contributor
There was a problem hiding this comment.
Verdict: request changes — 35efa98b74caa55a0161ea6505bcaebec33c4596
Must fix before merge: Fix the cache probe's newline handling and cover its actual output.
- major —
integrations/isolation/acq-kits/paseo/scripts/verify:638–643: A healthy agent-owned cache is reported as a failure. Whenfindreturns no foreign-owned file,printf "%s\n" "$result"still emits a newline beforeCACHE_PROBE_DONE. Removing only the marker leaves that newline, so[ -n "$bad_cache_owner" ]is true and the live verifier records a failure (exit 1). Confirmed by executing the actual guest probe against an empty, current-user-owned.npm; the same fixture passes at the base revision. Emit the separator only for a nonempty result, or remove the exact separator along with the marker. Add a regression test that executes the real probe: the existing fixture suppliesCACHE_PROBE_DONEwithout the newline and misses this case.
Assisted-by: OpenCode [GPT 6.1 Sol Latest Guardrails Defaultv2] skill:change-review
Emit a cache-owner path separator only when find returns a foreign-owned entry. Run the actual probe for an absent cache and for empty and populated agent-owned caches. Co-authored-by: OpenCode <[email protected]> Refs: #559
basiliskus
approved these changes
Oct 30, 2026
basiliskus
left a comment
basiliskus
left a comment
Contributor
There was a problem hiding this comment.
Verdict: approve — 475aa0a5244c62df268e3b3de24f17a02a8ad2dd
Must fix before merge: none.
The prior cache-probe finding is resolved in 475aa0a5: empty results no longer leave a separator, and the real-probe regression reproduces the old failure and passes with the fix. No new findings.
Live PID-1 hold, real TUI routing, mount transport, and same-daemon identity remain unverified; this review does not replace that acceptance work.
Assisted-by: OpenCode [GPT 6.1 Sol Latest Guardrails Defaultv2] skill:change-review
mogul
pushed a commit
that referenced
this pull request
Nov 5, 2026
🤖 I have created a release *beep* *boop* --- ## [1.19.0](v1.18.0...v1.19.0) (2026-11-05) ### Features * **oci-engine:** qualify bounded rootless resource controls ([#562](#562)) ([cf6d7a5](cf6d7a5)) * **opencode:** add live image-capability verification script (not yet run) ([#572](#572)) ([f0a951f](f0a951f)) * **paseo:** bump pinned Paseo CLI to 0.15.0 ([#560](#560)) ([0c4e1a8](0c4e1a8)) * **usai-catalog:** carry verified capability metadata through a catalog refresh ([#578](#578)) ([fcd94e5](fcd94e5)) * **usai-catalog:** publish verified image input modality for 12 USAi models ([#575](#575)) ([907d486](907d486)) * **usai-catalog:** single refresh entrypoint for the catalog and neutral artifacts ([#573](#573)) ([0c1b145](0c1b145)) ### Bug Fixes * **ci:** validate pending release comparisons against their commit ([#570](#570)) ([0961019](0961019)) * **deps:** update Ruff package and hook together to 0.17.3 ([#568](#568)) ([a6266dd](a6266dd)) * **opencode:** prepare agent-owned sandbox scratch directory ([#561](#561)) ([89a66b2](89a66b2)) * **paseo:** launch real opencode outside PID 1 ([#559](#559)) ([ce4aa08](ce4aa08)) * **paseo:** verify runtime identity without false orphan verdicts ([#567](#567)) ([1062244](1062244)) * **usai-catalog:** allow summary and title roles in catalog recommendations schema ([#551](#551)) ([ad2aadd](ad2aadd)) * **usai:** retire stale references to the removed model sync script ([#552](#552)) ([95be9b9](95be9b9)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
opencodeinvoked outside PID 1 to the real OpenCode binary; keep the PID-1 shim entrypoint and argument passthrough.Eligibility & Accountability
AI Assistance Disclosure
Type of Change
integrations/) updateMotivation
In #548, MSB runs the wrapper outside PID 1; the old no-argument route printed Paseo connect instructions and returned instead of opening the OpenCode TUI. A shell invocation should not repin the daemon worktree root.
Testing and validation
make validatepassed in an isolated managed Ubuntu VM on exact treeff9ce4d111d5d92f397feec40e7a43d2ccd64e80(47/47 pattern files; existing advisory warnings).35efa98b74caa55a0161ea6505bcaebec33c4596.Safety checklist
Reviewer notes
Review the wrapper PID-1/no-argument split and the verifier’s skip/transport classifications at this head. Independent agent reviews are supporting evidence, not a GitHub CODEOWNER approval. The pre-existing shim readiness fallback, mount registrar symlink boundary, and host-daemon identity check are separate concerns and are not claimed fixed here.
Related issues
Relates to #548. Human/live acceptance is pending before closure.