add experimental permission HttpApi slice (#22385)

packages/opencode/src/server/instance/experimental.ts

@@ -18,7 +18,6 @@ import { lazy } from "../../util/lazy"
 import { Effect, Option } from "effect"
 import { WorkspaceRoutes } from "./workspace"
 import { Agent } from "@/agent/agent"
-import { HttpApiRoutes } from "./httpapi"
 
 const ConsoleOrgOption = z.object({
   accountID: z.string(),
@@ -40,7 +39,6 @@ const ConsoleSwitchBody = z.object({
 
 export const ExperimentalRoutes = lazy(() =>
   new Hono()
-    .route("/httpapi", HttpApiRoutes())
     .get(
       "/console",
       describeRoute({

packages/opencode/src/server/instance/httpapi/index.ts

@@ -1,7 +0,0 @@
-import { lazy } from "@/util/lazy"
-import { Hono } from "hono"
-import { QuestionHttpApiHandler } from "./question"
-
-export const HttpApiRoutes = lazy(() =>
-  new Hono().all("/question", QuestionHttpApiHandler).all("/question/*", QuestionHttpApiHandler),
-)

packages/opencode/src/server/instance/httpapi/permission.ts

@@ -0,0 +1,72 @@
+import { Permission } from "@/permission"
+import { PermissionID } from "@/permission/schema"
+import { Effect, Layer, Schema } from "effect"
+import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+
+const root = "/experimental/httpapi/permission"
+
+export const PermissionApi = HttpApi.make("permission")
+  .add(
+    HttpApiGroup.make("permission")
+      .add(
+        HttpApiEndpoint.get("list", root, {
+          success: Schema.Array(Permission.Request),
+        }).annotateMerge(
+          OpenApi.annotations({
+            identifier: "permission.list",
+            summary: "List pending permissions",
+            description: "Get all pending permission requests across all sessions.",
+          }),
+        ),
+        HttpApiEndpoint.post("reply", `${root}/:requestID/reply`, {
+          params: { requestID: PermissionID },
+          payload: Permission.ReplyBody,
+          success: Schema.Boolean,
+        }).annotateMerge(
+          OpenApi.annotations({
+            identifier: "permission.reply",
+            summary: "Respond to permission request",
+            description: "Approve or deny a permission request from the AI assistant.",
+          }),
+        ),
+      )
+      .annotateMerge(
+        OpenApi.annotations({
+          title: "permission",
+          description: "Experimental HttpApi permission routes.",
+        }),
+      ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "opencode experimental HttpApi",
+      version: "0.0.1",
+      description: "Experimental HttpApi surface for selected instance routes.",
+    }),
+  )
+
+export const PermissionLive = Layer.unwrap(
+  Effect.gen(function* () {
+    const svc = yield* Permission.Service
+
+    const list = Effect.fn("PermissionHttpApi.list")(function* () {
+      return yield* svc.list()
+    })
+
+    const reply = Effect.fn("PermissionHttpApi.reply")(function* (ctx: {
+      params: { requestID: PermissionID }
+      payload: Permission.ReplyBody
+    }) {
+      yield* svc.reply({
+        requestID: ctx.params.requestID,
+        reply: ctx.payload.reply,
+        message: ctx.payload.message,
+      })
+      return true
+    })
+
+    return HttpApiBuilder.group(PermissionApi, "permission", (handlers) =>
+      handlers.handle("list", list).handle("reply", reply),
+    )
+  }),
+).pipe(Layer.provide(Permission.defaultLayer))

packages/opencode/src/server/instance/httpapi/question.ts

@@ -1,44 +1,71 @@
-import { AppLayer } from "@/effect/app-runtime"
-import { memoMap } from "@/effect/run-service"
 import { Question } from "@/question"
 import { QuestionID } from "@/question/schema"
-import { lazy } from "@/util/lazy"
-import { makeQuestionHandler, questionApi } from "@opencode-ai/server"
-import { Effect, Layer } from "effect"
-import { HttpRouter, HttpServer } from "effect/unstable/http"
-import { HttpApiBuilder } from "effect/unstable/httpapi"
-import type { Handler } from "hono"
+import { Effect, Layer, Schema } from "effect"
+import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
 
 const root = "/experimental/httpapi/question"
 
-const QuestionLive = makeQuestionHandler({
-  list: Effect.fn("QuestionHttpApi.host.list")(function* () {
-    const svc = yield* Question.Service
-    return yield* svc.list()
-  }),
-  reply: Effect.fn("QuestionHttpApi.host.reply")(function* (input) {
-    const svc = yield* Question.Service
-    yield* svc.reply({
-      requestID: QuestionID.make(input.requestID),
-      answers: input.answers,
-    })
-  }),
-}).pipe(Layer.provide(Question.defaultLayer))
-
-const web = lazy(() =>
-  HttpRouter.toWebHandler(
-    Layer.mergeAll(
-      AppLayer,
-      HttpApiBuilder.layer(questionApi, { openapiPath: `${root}/doc` }).pipe(
-        Layer.provide(QuestionLive),
-        Layer.provide(HttpServer.layerServices),
+export const QuestionApi = HttpApi.make("question")
+  .add(
+    HttpApiGroup.make("question")
+      .add(
+        HttpApiEndpoint.get("list", root, {
+          success: Schema.Array(Question.Request),
+        }).annotateMerge(
+          OpenApi.annotations({
+            identifier: "question.list",
+            summary: "List pending questions",
+            description: "Get all pending question requests across all sessions.",
+          }),
+        ),
+        HttpApiEndpoint.post("reply", `${root}/:requestID/reply`, {
+          params: { requestID: QuestionID },
+          payload: Question.Reply,
+          success: Schema.Boolean,
+        }).annotateMerge(
+          OpenApi.annotations({
+            identifier: "question.reply",
+            summary: "Reply to question request",
+            description: "Provide answers to a question request from the AI assistant.",
+          }),
+        ),
+      )
+      .annotateMerge(
+        OpenApi.annotations({
+          title: "question",
+          description: "Experimental HttpApi question routes.",
+        }),
       ),
-    ),
-    {
-      disableLogger: true,
-      memoMap,
-    },
-  ),
-)
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "opencode experimental HttpApi",
+      version: "0.0.1",
+      description: "Experimental HttpApi surface for selected instance routes.",
+    }),
+  )
 
-export const QuestionHttpApiHandler: Handler = (c, _next) => web().handler(c.req.raw)
+export const QuestionLive = Layer.unwrap(
+  Effect.gen(function* () {
+    const svc = yield* Question.Service
+
+    const list = Effect.fn("QuestionHttpApi.list")(function* () {
+      return yield* svc.list()
+    })
+
+    const reply = Effect.fn("QuestionHttpApi.reply")(function* (ctx: {
+      params: { requestID: QuestionID }
+      payload: Question.Reply
+    }) {
+      yield* svc.reply({
+        requestID: ctx.params.requestID,
+        answers: ctx.payload.answers,
+      })
+      return true
+    })
+
+    return HttpApiBuilder.group(QuestionApi, "question", (handlers) =>
+      handlers.handle("list", list).handle("reply", reply),
+    )
+  }),
+).pipe(Layer.provide(Question.defaultLayer))

packages/opencode/src/server/instance/httpapi/server.ts

@@ -0,0 +1,135 @@
+import { NodeHttpServer } from "@effect/platform-node"
+import { Effect, Layer, Redacted, Schema } from "effect"
+import { HttpApiBuilder, HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi"
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { createServer } from "node:http"
+import { AppRuntime } from "@/effect/app-runtime"
+import { InstanceRef, WorkspaceRef } from "@/effect/instance-ref"
+import { Flag } from "@/flag/flag"
+import { InstanceBootstrap } from "@/project/bootstrap"
+import { Instance } from "@/project/instance"
+import { Filesystem } from "@/util/filesystem"
+import { Permission } from "@/permission"
+import { Question } from "@/question"
+import { PermissionApi, PermissionLive } from "./permission"
+import { QuestionApi, QuestionLive } from "./question"
+
+const Query = Schema.Struct({
+  directory: Schema.optional(Schema.String),
+  workspace: Schema.optional(Schema.String),
+  auth_token: Schema.optional(Schema.String),
+})
+
+const Headers = Schema.Struct({
+  authorization: Schema.optional(Schema.String),
+  "x-opencode-directory": Schema.optional(Schema.String),
+})
+
+export namespace ExperimentalHttpApiServer {
+  function text(input: string, status: number, headers?: Record<string, string>) {
+    return HttpServerResponse.text(input, { status, headers })
+  }
+
+  function decode(input: string) {
+    try {
+      return decodeURIComponent(input)
+    } catch {
+      return input
+    }
+  }
+
+  class Unauthorized extends Schema.TaggedErrorClass<Unauthorized>()(
+    "Unauthorized",
+    { message: Schema.String },
+    { httpApiStatus: 401 },
+  ) {}
+
+  class Authorization extends HttpApiMiddleware.Service<Authorization>()("@opencode/ExperimentalHttpApiAuthorization", {
+    error: Unauthorized,
+    security: {
+      basic: HttpApiSecurity.basic,
+    },
+  }) {}
+
+  const normalize = HttpRouter.middleware()(
+    Effect.gen(function* () {
+      return (effect) =>
+        Effect.gen(function* () {
+          const query = yield* HttpServerRequest.schemaSearchParams(Query)
+          if (!query.auth_token) return yield* effect
+          const req = yield* HttpServerRequest.HttpServerRequest
+          const next = req.modify({
+            headers: {
+              ...req.headers,
+              authorization: `Basic ${query.auth_token}`,
+            },
+          })
+          return yield* effect.pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, next))
+        })
+    }),
+  ).layer
+
+  const auth = Layer.succeed(
+    Authorization,
+    Authorization.of({
+      basic: (effect, { credential }) =>
+        Effect.gen(function* () {
+          if (!Flag.OPENCODE_SERVER_PASSWORD) return yield* effect
+
+          const user = Flag.OPENCODE_SERVER_USERNAME ?? "opencode"
+          if (credential.username !== user) {
+            return yield* new Unauthorized({ message: "Unauthorized" })
+          }
+          if (Redacted.value(credential.password) !== Flag.OPENCODE_SERVER_PASSWORD) {
+            return yield* new Unauthorized({ message: "Unauthorized" })
+          }
+          return yield* effect
+        }),
+    }),
+  )
+
+  const instance = HttpRouter.middleware()(
+    Effect.gen(function* () {
+      return (effect) =>
+        Effect.gen(function* () {
+          const query = yield* HttpServerRequest.schemaSearchParams(Query)
+          const headers = yield* HttpServerRequest.schemaHeaders(Headers)
+          const raw = query.directory || headers["x-opencode-directory"] || process.cwd()
+          const workspace = query.workspace || undefined
+          const ctx = yield* Effect.promise(() =>
+            Instance.provide({
+              directory: Filesystem.resolve(decode(raw)),
+              init: () => AppRuntime.runPromise(InstanceBootstrap),
+              fn: () => Instance.current,
+            }),
+          )
+
+          const next = workspace ? effect.pipe(Effect.provideService(WorkspaceRef, workspace)) : effect
+          return yield* next.pipe(Effect.provideService(InstanceRef, ctx))
+        })
+    }),
+  ).layer
+
+  const QuestionSecured = QuestionApi.middleware(Authorization)
+  const PermissionSecured = PermissionApi.middleware(Authorization)
+
+  export const routes = Layer.mergeAll(
+    HttpApiBuilder.layer(QuestionSecured, { openapiPath: "/experimental/httpapi/question/doc" }).pipe(
+      Layer.provide(QuestionLive),
+    ),
+    HttpApiBuilder.layer(PermissionSecured, { openapiPath: "/experimental/httpapi/permission/doc" }).pipe(
+      Layer.provide(PermissionLive),
+    ),
+  ).pipe(Layer.provide(auth), Layer.provide(normalize), Layer.provide(instance))
+
+  export const layer = (opts: { hostname: string; port: number }) =>
+    HttpRouter.serve(routes, { disableListenLog: true, disableLogger: true }).pipe(
+      Layer.provideMerge(NodeHttpServer.layer(createServer, { port: opts.port, host: opts.hostname })),
+    )
+
+  export const layerTest = HttpRouter.serve(routes, { disableListenLog: true, disableLogger: true }).pipe(
+    Layer.provideMerge(NodeHttpServer.layerTest),
+    Layer.provideMerge(Question.defaultLayer),
+    Layer.provideMerge(Permission.defaultLayer),
+  )
+}

packages/opencode/src/server/instance/permission.ts

@@ -33,7 +33,7 @@ export const PermissionRoutes = lazy(() =>
           requestID: PermissionID.zod,
         }),
       ),
-      validator("json", z.object({ reply: Permission.Reply, message: z.string().optional() })),
+      validator("json", z.object({ reply: Permission.Reply.zod, message: z.string().optional() })),
       async (c) => {
         const params = c.req.valid("param")
         const json = c.req.valid("json")
@@ -60,7 +60,7 @@ export const PermissionRoutes = lazy(() =>
             description: "List of pending permissions",
             content: {
               "application/json": {
-                schema: resolver(Permission.Request.array()),
+                schema: resolver(Permission.Request.zod.array()),
               },
             },
           },

packages/opencode/src/server/instance/session.ts

@@ -274,7 +274,7 @@ export const SessionRoutes = lazy(() =>
         "json",
         z.object({
           title: z.string().optional(),
-          permission: Permission.Ruleset.optional(),
+          permission: Permission.Ruleset.zod.optional(),
           time: z
             .object({
               archived: z.number().optional(),
@@ -1093,7 +1093,7 @@ export const SessionRoutes = lazy(() =>
           permissionID: PermissionID.zod,
         }),
       ),
-      validator("json", z.object({ response: Permission.Reply })),
+      validator("json", z.object({ response: Permission.Reply.zod })),
       async (c) => {
         const params = c.req.valid("param")
         await AppRuntime.runPromise(