2 commits

Author	SHA1	Message	Date
gglucass	f54f04f5bf	feat(opencode): ship the transport plugin in pip installs (#2601) ... ## Description The OpenCode transport plugin - the piece that gives `wrap opencode` all-provider routing by tagging each request with `x-headroom-base-url` - only exists in repo checkouts today. `headroom_opencode_plugin_path()` resolves `plugins/opencode/dist/entry.opencode.js`, which pip wheels do not ship, so every pip install silently degrades to the two-provider (anthropic/openai) baseURL fallback. The function's own docstring documents the gap ("a pip-only install that does not ship `plugins/`"). Shipping the existing build output is not enough: the regular tsup build leaves `headroom-ai` and `@opencode-ai/plugin` as bare external imports, which only resolve next to the checkout's `node_modules`. Copied into site-packages, the file fails to load. This PR ships a self-contained bundle inside the wheel instead. Closes # ## Type of Change - [ ] Bug fix (non-breaking change that fixes an issue) - [x] New feature (non-breaking change that adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update - [ ] Performance improvement - [ ] Code refactoring (no functional changes) ## Changes Made - `plugins/opencode/tsup.standalone.config.ts` + `npm run build:standalone`: a second build of the loader entry with `noExternal: [/.*/]` and `splitting: false` - a single self-contained file whose only imports are node builtins. - `headroom/providers/opencode/_dist/entry.opencode.js`: the committed standalone bundle (452 KB). It sits inside the package directory, so maturin's `python-source = "."` packaging picks it up into the wheel with no build-system changes. - `headroom_opencode_plugin_path()`: falls back to the packaged bundle. Precedence otherwise unchanged: `HEADROOM_OPENCODE_PLUGIN_PATH` env override, then a repo-checkout build (fresher during development), then the packaged bundle. - CI (`opencode-plugin.yml`): rebuilds the standalone bundle and fails the run if the committed artifact drifted from source, with a one-line fix instruction; workflow path triggers extended to `headroom/providers/opencode/_dist/**`. - `tests/test_providers_opencode_plugin_path.py`: packaged bundle exists and is self-contained (no bare npm imports), env override wins, fallback resolution order. ## Testing - [x] Unit tests pass (`pytest`) - [x] Linting passes (`ruff check .`) - [x] Type checking passes (`mypy headroom`) - [x] New tests added for new functionality - [x] Manual testing performed ### Test Output ```text $ uv run --frozen --extra dev pytest tests/test_providers_opencode_plugin_path.py \ tests/test_providers_opencode_config.py tests/test_providers_opencode_install.py ============================== 49 passed in 0.31s ============================== $ uvx ruff check headroom/providers/opencode/runtime.py tests/test_providers_opencode_plugin_path.py All checks passed! $ uvx ruff format --check headroom/providers/opencode/runtime.py tests/test_providers_opencode_plugin_path.py 2 files already formatted $ uv run --frozen --extra dev mypy headroom/providers/opencode/runtime.py Success: no issues found in 1 source file $ cd plugins/opencode && npm run build:standalone ESM dist-standalone/entry.opencode.js 452.28 KB ESM Build success in 28ms ``` ## Real Behavior Proof - Environment: macOS 15 (arm64), opencode 1.18.5 (Homebrew), node 22 / npm 10, isolated `XDG_*` dirs so no real user config was touched. - Exact command / steps: 1. `npm run build:standalone` in `plugins/opencode`. 2. Started a local header-logging HTTP listener on `127.0.0.1:9977` (stands in for the proxy; logs method, path, headers, returns 401). 3. Registered the standalone bundle by absolute path in a scratch `opencode.json` (`"plugin": ["<abs>/dist-standalone/entry.opencode.js"]`) with a `google` provider entry and a fake API key. Note: the bundle's directory has **no** `node_modules` - this is exactly the site-packages situation. 4. `HEADROOM_PROXY_URL=http://127.0.0.1:9977 opencode run -m google/gemini-2.5-flash "say hi"`. - Observed result: the listener received `POST /v1beta/models/gemini-2.5-flash:streamGenerateContent?alt=sse` with `User-Agent: opencode/1.18.5 ...` - i.e. the plugin loaded standalone and rerouted a provider that the baseURL fallback cannot cover (native Gemini wire format) to the proxy URL from `HEADROOM_PROXY_URL`. - Not tested: Windows path resolution (pure `pathlib`, no platform branches); wheel-build byte-determinism of the tsup output across OSes (the CI drift check will surface it on the first divergent build). ## Review Readiness - [x] I have performed a self-review - [x] This PR is ready for human review ## Checklist - [x] My code follows the project's style guidelines - [x] I have performed a self-review of my code - [x] I have commented my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I did **not** edit `CHANGELOG.md` — it is generated by release-please from my Conventional Commit PR title (a CI guard enforces this) ## Screenshots (if applicable) Not applicable - CLI/packaging change. ## Additional Notes - Documentation checklist item: unchecked because the only doc surface I found is the `headroom_opencode_plugin_path()` docstring, which this PR rewrites to describe the three-step resolution order. Happy to add a line to `docs/content/docs/` if there is a preferred page. - A committed build artifact is not free: the CI drift check keeps it honest, and the byte-compare relies on tsup/esbuild determinism under `npm ci` (pinned lockfile). If you'd rather avoid the committed artifact entirely, the alternative is publishing `headroom-opencode` to npm (its `package.json` is publish-ready) and registering the plugin by package name - happy to rework in that direction; the wheel-bundled path has the advantage of version-locking the plugin to the backend it ships with. - Downstream motivation: Headroom Desktop manages a long-lived shared proxy (no `wrap` launcher) and wants to register this plugin from the installed wheel path so OpenCode users get all-provider routing there too. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-27 06:40:43 -07:00
Rudimar Ronsoni	b4571cc346	feat: headroom wrap opencode / unwrap opencode CLI (#1105) ... ## Summary This PR implements transparent `headroom wrap opencode` support without asking users to edit OpenCode provider URLs, choose an extra CLI flag, or maintain a static provider list. The wrapper now lives at the runtime transport boundary: OpenCode keeps its user/provider config, while Headroom intercepts outbound provider traffic in-process and routes it through the local Headroom proxy. ## What changed ### Transparent OpenCode wrapping - `headroom wrap opencode` injects the `headroom-opencode` plugin through `OPENCODE_CONFIG_CONTENT`. - Existing OpenCode provider URLs are preserved. We do not rewrite user config URLs to point at Headroom. - Existing `OPENAI_BASE_URL` and `ANTHROPIC_BASE_URL` env vars are preserved. - Local OpenCode traffic, localhost traffic, and Headroom proxy traffic bypass the shim to avoid loops. ### Runtime transport interception - Added an OpenCode plugin transport shim that wraps: - `globalThis.fetch` - `http.request` / `http.get` - `https.request` / `https.get` - External provider calls are routed to the local Headroom proxy. - The original upstream origin is passed through `x-headroom-base-url`, so the proxy can forward to the real provider without changing OpenCode config. - External `http2.connect` is blocked loudly instead of allowing direct provider traffic to leak outside Headroom. ### Live provider additions Provider coverage is no longer based on a static config scan. Because routing happens at outbound request time, providers added mid-session are routed through Headroom automatically as long as they use the covered Node transport paths. ### Subagent and child-process coverage - The parent OpenCode plugin sets a packaged Node preload shim through `NODE_OPTIONS=--import=.../hook-shim/handler.js`. - The transport shim patches `child_process.spawn`, `exec`, `execFile`, and `fork` so child Node processes receive the Headroom preload even when OpenCode passes a custom `env`. - The child-process shim fails closed if it loads without `HEADROOM_OPENCODE_TRANSPORT_PROXY_URL`. - This closes the subagent leak path where a child Node process could otherwise start without Headroom transport interception. ## Why this goes beyond PR #1089 PR #1089 improves OpenCode provider registration, but it still focuses on provider config shape. This PR moves the enforcement boundary to runtime transport interception. This PR goes further because: - No provider URL rewriting is required. - New providers added mid-session are covered automatically. - Subagents and child Node processes inherit the Headroom transport shim. - Direct external HTTP/2 paths fail loudly instead of leaking. - The wrap remains transparent to the user's OpenCode provider config. - The wrapper is fail-closed for unsupported child-process preload state. ## Additional robustness fixes While validating the change in Docker, the full Python suite exposed unrelated Linux/container robustness issues. These are fixed in this PR so the suite is green: - Binary cache handling now treats cache paths under a non-writable existing parent as unavailable, including when tests run as root in Docker. - `release_version.py` honors `MANUAL_VER` before git calls so direct script execution works outside a `.git` checkout. - Test logger isolation now resets relevant Headroom child loggers so proxy logging setup cannot poison later `caplog` tests. - The scanner missing-path test now uses a guaranteed missing `tmp_path` child instead of relying on `/nonexistent/path`. ## Validation All implementation validation was run inside Docker. - Full Python suite from a fresh Docker copy: `6605 passed, 523 skipped`. - Ruff on changed Python/OpenCode paths: passed. - OpenCode plugin typecheck: passed. - OpenCode plugin tests: `9 passed`. - OpenCode plugin build: passed. - Hook shim preload smoke test: passed. ## Notes This PR intentionally does not add a CLI option. `headroom wrap opencode` means full wrap. Either Headroom wraps OpenCode transparently, or the path fails loudly instead of silently leaking provider traffic. --------- Co-authored-by: Rudimar Ronsoni <6081613+rudironsoni@users.noreply.github.com>	2026-06-22 11:07:12 -05:00