🛡️ Sentinel: [CRITICAL] Fix OAuth callback server binding

🚨 Severity: CRITICAL
💡 Vulnerability: Ephemeral local HTTP servers used for OAuth callbacks (`packages/opencode/src/mcp/oauth-callback.ts` and `packages/opencode/src/plugin/codex.ts`) were omitting the `hostname` parameter in `Bun.serve`. This caused the server to bind to `0.0.0.0` (all interfaces) by default instead of `127.0.0.1` (localhost).
🎯 Impact: This breaks the local-first security boundary, exposing local OAuth flows to the entire local network and potentially allowing attackers to intercept callbacks or perform CSRF attacks.
🔧 Fix: Explicitly set `hostname: "127.0.0.1"` in `Bun.serve` configurations.
✅ Verification: `bun turbo typecheck`, `bun run format`, and backend tests (`bun test`) passed. A journal entry was also recorded.

Co-authored-by: PrakharMNNIT <73683289+PrakharMNNIT@users.noreply.github.com>

Author: google-labs-jules[bot]

.jules/sentinel.md

@@ -0,0 +1,7 @@
+## 2025-02-25 - Bun.serve default bindings
+
+**Vulnerability:** Ephemeral local HTTP servers used for OAuth callbacks (`packages/opencode/src/mcp/oauth-callback.ts` and `packages/opencode/src/plugin/codex.ts`) were omitting the `hostname` parameter in `Bun.serve`. This causes the server to bind to `0.0.0.0` (all interfaces) by default instead of `127.0.0.1` (localhost).
+
+**Learning:** In a local-first application, assuming `Bun.serve` binds to localhost by default is a critical mistake. It binds to all network interfaces, exposing local OAuth flows, webhooks, or inter-process communication servers to the entire local network, which breaks the local-only security boundary.
+
+**Prevention:** Every time `Bun.serve` is used to spawn a local server, `hostname: "127.0.0.1"` MUST be explicitly passed to prevent exposing the service to the network, unless mDNS or explicit external networking is intentionally enabled and authenticated.

AI_REVIEW.md

@@ -17,16 +17,13 @@
 - **CLI Subagent Command Transformation**: `src/integrations/cli-subagents/subagent_command.ts`
   - `isSubagentCommand()` — identifies simplified cline commands
   - `transformClineCommand()` — injects `--json -y` flags for autonomous execution
-  
 - **Agent Client Protocol (ACP)**: `cli/src/acp/AcpAgent.ts`
   - Bridges ClineAgent with AgentSideConnection for stdio-based communication
   - Handles permission requests, forwards session events
-  
 - **ClineAgent**: `cli/src/agent/ClineAgent.ts`
   - Implements ACP agent interface
   - Translates ACP requests into core Controller operations
   - Manages authentication, session modes, processes user prompts
-  
 - **Message Translator**: `cli/src/agent/messageTranslator.ts`
   - Converts ClineMessage objects to ACP SessionUpdate messages
   - Computes deltas for streaming (avoids duplicate content)
@@ -40,19 +37,22 @@
 ## Comparison with OpenCode's Subagent System
 
 OpenCode already has subagents (`TaskTool` in `packages/opencode/src/tool/task.ts`):
+
 - Subagents are spawned via the `task` tool
 - Each subagent gets its own child session
 - Subagent types: explore, plan, general (configurable per agent)
 - Results returned as tool output to parent session
 
 **Gaps to investigate:**
+
 - Does Cline support parallel subagents? (OpenCode does via plan mode Phase 1)
 - How does Cline's ACP protocol compare to opencode's Bus event system?
 - Can we adopt Cline's streaming delta pattern for subagent updates?
 
 ## Tonight's Session Summary (2026-02-24, 2:37 AM - 4:57 AM)
 
 ### 6 PRs Submitted to opencode (sst/opencode):
+
 1. **#14820** — Streaming content duplication fix (global-sdk.tsx voided Set)
 2. **#14821** — Font size settings (CSS vars + terminal + UI stepper)
 3. **#14826** — ContextOverflowError auto-recovery (processor.ts)
@@ -61,6 +61,7 @@ OpenCode already has subagents (`TaskTool` in `packages/opencode/src/tool/task.t
 6. **#14835** — Wide mode setting (full-width chat toggle)
 
 ### Issues Created:
+
 - #14822, #14823, #14824, #14825, #14830, #14834
 
 ### All branches merged into `origin/dev` on fork (PrakharMNNIT/opencode)

bun.lock

@@ -9,9 +9,9 @@
 
 Codex implements a **dual-input model** that lets users interact with the agent **during** an active turn, not just between turns:
 
-| Action | Keybinding | Behavior | When Turn Active |
-|--------|-----------|----------|-----------------|
-| **Queue** | `Enter` | Enqueue message for next turn boundary | Message waits in queue, displayed in UI |
+| Action    | Keybinding                      | Behavior                                  | When Turn Active                         |
+| --------- | ------------------------------- | ----------------------------------------- | ---------------------------------------- |
+| **Queue** | `Enter`                         | Enqueue message for next turn boundary    | Message waits in queue, displayed in UI  |
 | **Steer** | `⌘Enter` / `Enter` (steer-mode) | Inject input into active turn immediately | Message sent to model in current context |
 
 ---
@@ -201,14 +201,14 @@ When `NoActiveTurn` occurs, the app-server falls back — the input that failed
 
 ### Critical Difference
 
-| Aspect | Queue | Steer |
-|--------|-------|-------|
-| **Timing** | After turn ends | During active turn |
-| **Turn boundary** | Creates new turn | Same turn continues |
-| **Model sees it** | On next turn start | At next loop iteration |
-| **Cancels response** | No (waits) | No (appends to context) |
-| **UI display** | Queued messages widget | Injected into chat transcript |
-| **Fallback** | N/A | Falls back to queue if no active turn |
+| Aspect               | Queue                  | Steer                                 |
+| -------------------- | ---------------------- | ------------------------------------- |
+| **Timing**           | After turn ends        | During active turn                    |
+| **Turn boundary**    | Creates new turn       | Same turn continues                   |
+| **Model sees it**    | On next turn start     | At next loop iteration                |
+| **Cancels response** | No (waits)             | No (appends to context)               |
+| **UI display**       | Queued messages widget | Injected into chat transcript         |
+| **Fallback**         | N/A                    | Falls back to queue if no active turn |
 
 ---
 
@@ -285,11 +285,13 @@ Steer is gated behind `Feature::Steer` in the TUI:
 ## Implications for OpenCode
 
 ### What OpenCode Currently Has
+
 - Session/turn model with `processor.ts` handling model interaction
 - Parallel agents via `task.ts` tool
 - No mid-turn input injection
 
 ### What Queue/Steer Would Add
+
 1. **Pending input buffer** on the session/turn state
 2. **Steer RPC** that pushes to the buffer while model is running
 3. **Loop-boundary drain** that checks for pending input after each model response
@@ -298,6 +300,7 @@ Steer is gated behind `Feature::Steer` in the TUI:
 6. **Fallback path**: steer → queue if no active turn
 
 ### Key Implementation Points
+
 - `steer_input()` is a **lock-based, non-cancelling** approach — it doesn't abort the model stream
 - Pending input is consumed at the **top of the agentic loop**, not mid-stream
 - The model sees steered input as additional conversation items on its next iteration

docs/09-temp/cline-subagent-research.md

@@ -4,27 +4,32 @@
 **Status:** TODO — brainstorm in next session
 
 ## Problem
+
 Pressing Escape accidentally during AI response immediately stops the response with no confirmation. No visual feedback in chat that response was interrupted.
 
 ## Current Behavior
+
 - Escape → immediately cancels the LLM response
 - Shows a notification/warning toast
 - No visual indicator in the chat thread that the message was interrupted
 - No confirmation dialog before cancelling
 
 ## User's Proposed Improvements
+
 1. **Confirmation before cancel** — Alert/dialog: "Are you sure you want to interrupt?"
 2. **Visual interruption indicator** — Show in chat that the message was interrupted (red line, badge, etc.)
 3. **Better UX** — Maybe double-tap Escape to cancel, or Escape once to show warning
 
 ## Files to Investigate
+
 - `packages/app/src/pages/session.tsx` — handleKeyDown, Escape handling
 - `packages/app/src/components/prompt-input.tsx` — Escape key handling in input
 - `packages/opencode/src/session/prompt.ts` — cancel() function
 - `packages/ui/src/components/message-part.tsx` — interrupted state rendering
 - `packages/app/src/pages/session/use-session-commands.tsx` — session.cancel command
 
 ## Design Questions
+
 1. Should Escape require double-tap? (like VS Code terminal)
 2. Should there be a small "Esc to cancel" indicator during streaming?
 3. Should interrupted messages have a visual indicator (red border/badge)?