import { Log } from "../util/log" import { describeRoute, generateSpecs, validator, resolver, openAPIRouteHandler } from "hono-openapi" import { Hono } from "hono" import { compress } from "hono/compress" import { cors } from "hono/cors" import { basicAuth } from "hono/basic-auth" import z from "zod" import { Auth } from "../auth" import { Flag } from "../flag/flag" import { ProviderID } from "../provider/schema" import { WorkspaceRouterMiddleware } from "./router" import { websocket } from "hono/bun" import { errors } from "./error" import { GlobalRoutes } from "./routes/global" import { MDNS } from "./mdns" import { lazy } from "@/util/lazy" import { errorHandler } from "./middleware" import { InstanceRoutes } from "./instance" import { initProjectors } from "./projectors" // @ts-ignore This global is needed to prevent ai-sdk from logging warnings to stdout https://github.com/vercel/ai/blob/2dc67e0ef538307f21368db32d5a12345d98831b/packages/ai/src/logger/log-warnings.ts#L85 globalThis.AI_SDK_LOG_WARNINGS = false initProjectors() export namespace Server { const log = Log.create({ service: "server" }) const zipped = compress() const skipCompress = (path: string, method: string) => { if (path === "/event" || path === "/global/event" || path === "/global/sync-event") return true if (method === "POST" && /\/session\/[^/]+\/(message|prompt_async)$/.test(path)) return true return false } export const Default = lazy(() => ControlPlaneRoutes()) export const ControlPlaneRoutes = (opts?: { cors?: string[] }): Hono => { const app = new Hono() return app .onError(errorHandler(log)) .use((c, next) => { // Allow CORS preflight requests to succeed without auth. // Browser clients sending Authorization headers will preflight with OPTIONS. if (c.req.method === "OPTIONS") return next() const password = Flag.OPENCODE_SERVER_PASSWORD if (!password) return next() const username = Flag.OPENCODE_SERVER_USERNAME ?? "opencode" return basicAuth({ username, password })(c, next) }) .use(async (c, next) => { const skip = c.req.path === "/log" if (!skip) { log.info("request", { method: c.req.method, path: c.req.path, }) } const timer = log.time("request", { method: c.req.method, path: c.req.path, }) await next() if (!skip) { timer.stop() } }) .use( cors({ maxAge: 86_400, origin(input) { if (!input) return if (input.startsWith("http://localhost:")) return input if (input.startsWith("http://127.0.0.1:")) return input if ( input === "tauri://localhost" || input === "http://tauri.localhost" || input === "https://tauri.localhost" ) return input // *.opencode.ai (https only, adjust if needed) if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(input)) { return input } if (opts?.cors?.includes(input)) { return input } return }, }), ) .use((c, next) => { if (skipCompress(c.req.path, c.req.method)) return next() return zipped(c, next) }) .route("/global", GlobalRoutes()) .put( "/auth/:providerID", describeRoute({ summary: "Set auth credentials", description: "Set authentication credentials", operationId: "auth.set", responses: { 200: { description: "Successfully set authentication credentials", content: { "application/json": { schema: resolver(z.boolean()), }, }, }, ...errors(400), }, }), validator( "param", z.object({ providerID: ProviderID.zod, }), ), validator("json", Auth.Info.zod), async (c) => { const providerID = c.req.valid("param").providerID const info = c.req.valid("json") await Auth.set(providerID, info) return c.json(true) }, ) .delete( "/auth/:providerID", describeRoute({ summary: "Remove auth credentials", description: "Remove authentication credentials", operationId: "auth.remove", responses: { 200: { description: "Successfully removed authentication credentials", content: { "application/json": { schema: resolver(z.boolean()), }, }, }, ...errors(400), }, }), validator( "param", z.object({ providerID: ProviderID.zod, }), ), async (c) => { const providerID = c.req.valid("param").providerID await Auth.remove(providerID) return c.json(true) }, ) .get( "/doc", openAPIRouteHandler(app, { documentation: { info: { title: "opencode", version: "0.0.3", description: "opencode api", }, openapi: "3.1.1", }, }), ) .use( validator( "query", z.object({ directory: z.string().optional(), workspace: z.string().optional(), }), ), ) .post( "/log", describeRoute({ summary: "Write log", description: "Write a log entry to the server logs with specified level and metadata.", operationId: "app.log", responses: { 200: { description: "Log entry written successfully", content: { "application/json": { schema: resolver(z.boolean()), }, }, }, ...errors(400), }, }), validator( "json", z.object({ service: z.string().meta({ description: "Service name for the log entry" }), level: z.enum(["debug", "info", "error", "warn"]).meta({ description: "Log level" }), message: z.string().meta({ description: "Log message" }), extra: z .record(z.string(), z.any()) .optional() .meta({ description: "Additional metadata for the log entry" }), }), ), async (c) => { const { service, level, message, extra } = c.req.valid("json") const logger = Log.create({ service }) switch (level) { case "debug": logger.debug(message, extra) break case "info": logger.info(message, extra) break case "error": logger.error(message, extra) break case "warn": logger.warn(message, extra) break } return c.json(true) }, ) .use(WorkspaceRouterMiddleware) } export function createApp(opts: { cors?: string[] }) { return ControlPlaneRoutes(opts) } export async function openapi() { // Build a fresh app with all routes registered directly so // hono-openapi can see describeRoute metadata (`.route()` wraps // handlers when the sub-app has a custom errorHandler, which // strips the metadata symbol). const app = ControlPlaneRoutes() InstanceRoutes(app) const result = await generateSpecs(app, { documentation: { info: { title: "opencode", version: "1.0.0", description: "opencode api", }, openapi: "3.1.1", }, }) return result } /** @deprecated do not use this dumb shit */ export let url: URL export function listen(opts: { port: number hostname: string mdns?: boolean mdnsDomain?: string cors?: string[] }) { url = new URL(`http://${opts.hostname}:${opts.port}`) const app = ControlPlaneRoutes({ cors: opts.cors }) const args = { hostname: opts.hostname, idleTimeout: 0, fetch: app.fetch, websocket: websocket, } as const const tryServe = (port: number) => { try { return Bun.serve({ ...args, port }) } catch { return undefined } } const server = opts.port === 0 ? (tryServe(4096) ?? tryServe(0)) : tryServe(opts.port) if (!server) throw new Error(`Failed to start server on port ${opts.port}`) const shouldPublishMDNS = opts.mdns && server.port && opts.hostname !== "127.0.0.1" && opts.hostname !== "localhost" && opts.hostname !== "::1" if (shouldPublishMDNS) { MDNS.publish(server.port!, opts.mdnsDomain) } else if (opts.mdns) { log.warn("mDNS enabled but hostname is loopback; skipping mDNS publish") } const originalStop = server.stop.bind(server) server.stop = async (closeActiveConnections?: boolean) => { if (shouldPublishMDNS) MDNS.unpublish() return originalStop(closeActiveConnections) } return server } }