Create-session runs EnsureProjectOpencode before platform validation #533

New issue

Closed

opened 2026-08-20 02:55:18 +02:00 by dries · 1 comment

dries commented

2026-08-20 02:55:18 +02:00

Owner

Found during review of PR #523 (fix: relaunch a killed opencode on local create). Shape is pre-existing on the remote path; the PR extended it to local.

In the create-session handler (internal/server/handlers.go), the ensure step runs before the platform id is validated. A request naming an unknown/unregistered platform still triggers EnsureProjectOpencode — launching a managed opencode instance (tmux pane, port allocation, managed_opencode row) for a request that is then rejected.

Fix: validate the platform (and any other cheap request validation) before the ensure side effect, on both local and remote paths. Cheap reorder; add a handler test asserting an invalid-platform create performs no ensure call (the shared fakePlatform harness in internal/server should cover this).

Found during review of PR #523 (fix: relaunch a killed opencode on local create). Shape is pre-existing on the remote path; the PR extended it to local. In the create-session handler (`internal/server/handlers.go`), the ensure step runs **before** the platform id is validated. A request naming an unknown/unregistered platform still triggers `EnsureProjectOpencode` — launching a managed opencode instance (tmux pane, port allocation, `managed_opencode` row) for a request that is then rejected. Fix: validate the platform (and any other cheap request validation) before the ensure side effect, on both local and remote paths. Cheap reorder; add a handler test asserting an invalid-platform create performs no ensure call (the shared `fakePlatform` harness in `internal/server` should cover this).

dries added the

labels

2026-08-20 02:57:41 +02:00

dries commented

2026-08-20 09:23:15 +02:00

Author

Owner

Validated against main @ 2d661364: remote path only. On main there is no local pre-ensure at all (handlers.go:474-479: local Create discovers/launches its own port); PR #523 is unmerged, so the local half doesn't apply yet. The remote half is real today: host.EnsureProjectOpencode (handlers.go:487) runs before sessions.Create validates the platform (sessionsvc/service.go:316-318), and resolveOwner only validates the remote id — so r-:bogus launches a managed opencode on the remote before rejection. Fix the remote ordering now; re-check the local path in PR #523's review.

Validated against main @ 2d661364: **remote path only**. On main there is no local pre-ensure at all (handlers.go:474-479: local Create discovers/launches its own port); PR #523 is unmerged, so the local half doesn't apply yet. The remote half is real today: host.EnsureProjectOpencode (handlers.go:487) runs before sessions.Create validates the platform (sessionsvc/service.go:316-318), and resolveOwner only validates the remote id — so r-<remote>:bogus launches a managed opencode on the remote before rejection. Fix the remote ordering now; re-check the local path in PR #523's review.

dries referenced this issue from a commit

2026-08-20 18:37:38 +02:00

fix: validate the platform before the remote ensure side effect (#533)

dries referenced this issue from a pull request that will close it,

2026-08-20 18:38:05 +02:00

fix: validated ticket sweep — tier 1 + tier 2 bugs #538

dries referenced this issue from a commit

2026-08-20 20:57:54 +02:00

fix: validate the platform before the remote ensure side effect (#533)

dries referenced this issue

2026-08-20 20:58:21 +02:00

fix: validated ticket sweep — tier 1 + tier 2 bugs #538