feat(router): stable hash session without repo

.beads/issues.jsonl

@@ -52,6 +52,18 @@
 {"id":"opencode-10.3.4","title":"Expose attach port 4096 on router Service and pass env vars in homelab/src/index.ts","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-12T21:33:10.562572+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-12T21:37:25.337583+02:00","closed_at":"2026-05-12T21:37:25.337583+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-10.3.4","depends_on_id":"opencode-10.3","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
 {"id":"opencode-10.3.5","title":"Update operator tests for attach route provisioning","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-12T21:33:10.811076+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-12T21:37:25.495618+02:00","closed_at":"2026-05-12T21:37:25.495618+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-10.3.5","depends_on_id":"opencode-10.3","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
 {"id":"opencode-10.4","title":"Commit","description":"Ensure code quality and documentation accuracy through systematic cleanup and review. **STEP 1: Code Cleanup** Systematically clean up development artifacts: 1. **Remove Debug Output**: Search for and remove all temporary debug output statements used during development. Look for language-specific debug output methods (console logging, print statements, debug output functions). Remove any debugging statements that were added for development purposes. 2. **Review TODO/FIXME Comments**: - Address each TODO/FIXME comment by either implementing the solution or documenting why it's deferred - Remove completed TODOs - Convert remaining TODOs to proper issue tracking if needed 3. **Remove Debugging Code Blocks**: - Remove temporary debugging code, test code blocks, and commented-out code - Clean up any experimental code that's no longer needed - Ensure proper error handling replaces temporary debug logging **STEP 2: Documentation Review** Review and update documentation to reflect final implementation: 1. **Update Long-Term Memory Documents**: Based on what was actually implemented: - If exists: Update it if requirements changed during development - If exists: Update it if architectural impacts were identified - If exists: Update it if design details were refined or changed - Otherwise: Document any changes in the plan file 2. **Compare Against Implementation**: Review documentation against actual implemented functionality 3. **Update Changed Sections**: Only modify documentation sections that have functional changes 4. **Remove Development Progress**: Remove references to development iterations, progress notes, and temporary decisions 5. **Focus on Final State**: Ensure documentation describes the final implemented state, not the development process 6. **Ask User to Review Document Updates** **STEP 3: Final Validation** - Run existing tests to ensure cleanup didn't break functionality - Verify documentation accuracy with a final review - Ensure code is ready for production/delivery Update task progress and mark completed work as you finalize the feature.","status":"open","priority":3,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-12T21:04:59.040599+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-12T21:04:59.040599+02:00","dependencies":[{"issue_id":"opencode-10.4","depends_on_id":"opencode-10","type":"parent-child","created_at":"0001-01-01T00:00:00Z"},{"issue_id":"opencode-10.4","depends_on_id":"opencode-10.3","type":"blocks","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11","title":"opencode: bugfix (development-plan-fix-stable-hash-session-without-repo.md)","description":"Responsible vibe engineering session using bugfix workflow for opencode","status":"open","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:11:44.590065+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:11:44.590065+02:00"}
+{"id":"opencode-11.1","title":"Reproduce","description":"Gather specific information to reliably reproduce the reported bug: - What are the exact OS, browser/runtime versions, and hardware specs? - What is the precise sequence of actions that trigger the bug? - What error messages, logs, or stack traces are available? - Does this happen every time or intermittently? - How many users are affected and what is the business impact? Create test cases that demonstrate the problem. Document your findings and create tasks as needed.","status":"open","priority":3,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:11:44.837357+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:11:44.837357+02:00","dependencies":[{"issue_id":"opencode-11.1","depends_on_id":"opencode-11","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.1.1","title":"Confirm: getSessionHash called 3x independently in no-repo path → 3 different hashes","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:17:39.464197+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:17:42.532162+02:00","closed_at":"2026-05-13T10:17:42.532162+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-11.1.1","depends_on_id":"opencode-11.1","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.2","title":"Analyze","description":"Examine the code paths involved in the bug, identify the root cause, and understand why the issue occurs. Use debugging tools, add logging, and trace through the problematic code. Document your analysis and create tasks as needed.","status":"open","priority":3,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:11:45.084848+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:11:45.084848+02:00","dependencies":[{"issue_id":"opencode-11.2","depends_on_id":"opencode-11","type":"parent-child","created_at":"0001-01-01T00:00:00Z"},{"issue_id":"opencode-11.2","depends_on_id":"opencode-11.1","type":"blocks","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.3","title":"Fix","description":"Implement the solution based on your analysis: - If exists: Follow the design from it - Otherwise: Elaborate design options and present them to the user Before implementing, assess the approach: - How critical is this system? What is the blast radius if the fix causes issues? - Should this be a minimal fix or a more comprehensive solution? Make targeted changes that address the root cause without introducing new issues. Be careful to maintain existing functionality while fixing the bug.","status":"open","priority":3,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:11:45.285088+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:11:45.285088+02:00","dependencies":[{"issue_id":"opencode-11.3","depends_on_id":"opencode-11","type":"parent-child","created_at":"0001-01-01T00:00:00Z"},{"issue_id":"opencode-11.3","depends_on_id":"opencode-11.2","type":"blocks","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.3.1","title":"Write failing regression test: PVC and Pod share same hash for no-repo session","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:23:58.664455+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:24:22.804951+02:00","closed_at":"2026-05-13T10:24:22.804951+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-11.3.1","depends_on_id":"opencode-11.3","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.3.2","title":"Refactor ensurePVC and ensurePod to accept optional pre-computed hash","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:23:59.019326+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:24:57.659367+02:00","closed_at":"2026-05-13T10:24:57.659367+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-11.3.2","depends_on_id":"opencode-11.3","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.3.3","title":"Expose startSession in pod-manager.ts that calls getSessionHash once","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:23:59.233689+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:24:57.966257+02:00","closed_at":"2026-05-13T10:24:57.966257+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-11.3.3","depends_on_id":"opencode-11.3","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.3.4","title":"Update api.ts to call startSession instead of 3 separate calls","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:23:59.451493+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:25:22.199495+02:00","closed_at":"2026-05-13T10:25:22.199495+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-11.3.4","depends_on_id":"opencode-11.3","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.3.5","title":"Run tests and type check","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:23:59.703254+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:26:01.48793+02:00","closed_at":"2026-05-13T10:26:01.48793+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-11.3.5","depends_on_id":"opencode-11.3","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.4","title":"Verify","description":"Test the fix thoroughly to ensure the original bug is resolved and no new issues were introduced. Run existing tests, create new ones if needed, and verify the solution is robust.","status":"open","priority":3,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:11:45.498051+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:11:45.498051+02:00","dependencies":[{"issue_id":"opencode-11.4","depends_on_id":"opencode-11","type":"parent-child","created_at":"0001-01-01T00:00:00Z"},{"issue_id":"opencode-11.4","depends_on_id":"opencode-11.3","type":"blocks","created_at":"0001-01-01T00:00:00Z"}]}
+{"id":"opencode-11.5","title":"Finalize","description":"Ensure code quality and documentation accuracy through systematic cleanup and review. **STEP 1: Code Cleanup** Systematically clean up development artifacts: - Remove all temporary debug output statements used during bug investigation (console logging, print statements, debug output functions) - Address each TODO/FIXME comment by either implementing the solution or documenting why it's deferred - Remove completed TODOs and convert remaining ones to proper issue tracking if needed - Remove temporary debugging code, test code blocks, and commented-out code - Ensure proper error handling replaces temporary debug logging **STEP 2: Documentation Review** Review and update documentation to reflect the bug fix: - If exists, update it if design details were refined or changed during the fix - Compare documentation against the actual bug fix implementation - Update only the documentation sections that have functional changes - Remove references to investigation iterations, progress notes, and temporary decisions - Ensure documentation describes the final fixed state, not the debugging process - Ask the user to review document updates **STEP 3: Final Validation** - Run existing tests to ensure cleanup didn't break functionality - Verify documentation accuracy with a final review - Ensure bug fix is ready for production - Update task progress and mark completed work as you finalize the bug fix","status":"open","priority":3,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-05-13T10:11:45.767326+02:00","created_by":"Oliver Jägle","updated_at":"2026-05-13T10:11:45.767326+02:00","dependencies":[{"issue_id":"opencode-11.5","depends_on_id":"opencode-11","type":"parent-child","created_at":"0001-01-01T00:00:00Z"},{"issue_id":"opencode-11.5","depends_on_id":"opencode-11.4","type":"blocks","created_at":"0001-01-01T00:00:00Z"}]}
 {"id":"opencode-2","title":"opencode: epcc (development-plan-preconfigure-opencode.md)","description":"Responsible vibe engineering session using epcc workflow for opencode","status":"open","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-04-13T10:20:50.855581+02:00","created_by":"Oliver Jägle","updated_at":"2026-04-13T10:20:50.855581+02:00"}
 {"id":"opencode-2.1","title":"Explore","description":"Research the codebase to understand existing patterns and gather context about the problem space. - If uncertain about conventions or rules, ask the user about them - Read relevant files and documentation - If exists: Understand and document requirements there - Otherwise: Document requirements in your task management system Focus on understanding without writing code yet. Document your findings and create tasks as needed.","status":"closed","priority":3,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-04-13T10:20:51.02768+02:00","created_by":"Oliver Jägle","updated_at":"2026-04-13T10:50:31.197605+02:00","closed_at":"2026-04-13T10:50:31.197605+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-2.1","depends_on_id":"opencode-2","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}
 {"id":"opencode-2.1.1","title":"Understand opencode config loading mechanism","status":"closed","priority":2,"issue_type":"task","owner":"github@beimir.net","created_at":"2026-04-13T10:29:16.880116+02:00","created_by":"Oliver Jägle","updated_at":"2026-04-13T10:34:54.667743+02:00","closed_at":"2026-04-13T10:34:54.667743+02:00","close_reason":"Closed","dependencies":[{"issue_id":"opencode-2.1.1","depends_on_id":"opencode-2.1","type":"parent-child","created_at":"0001-01-01T00:00:00Z"}]}

.beads/last-touched

@@ -1 +1 @@
-opencode-10.3.5
+opencode-11.3.5

.vibe/beads-state-opencode-fix-stable-hash-session-without-repo-250zb6.json

@@ -0,0 +1,34 @@
+{
+ "conversationId": "opencode-fix-stable-hash-session-without-repo-250zb6",
+ "projectPath": "/Users/oliverjaegle/projects/open-source/opencode",
+ "epicId": "opencode-11",
+ "phaseTasks": [
+ {
+ "phaseId": "reproduce",
+ "phaseName": "Reproduce",
+ "taskId": "opencode-11.1"
+ },
+ {
+ "phaseId": "analyze",
+ "phaseName": "Analyze",
+ "taskId": "opencode-11.2"
+ },
+ {
+ "phaseId": "fix",
+ "phaseName": "Fix",
+ "taskId": "opencode-11.3"
+ },
+ {
+ "phaseId": "verify",
+ "phaseName": "Verify",
+ "taskId": "opencode-11.4"
+ },
+ {
+ "phaseId": "finalize",
+ "phaseName": "Finalize",
+ "taskId": "opencode-11.5"
+ }
+ ],
+ "createdAt": "2026-05-13T08:11:46.643Z",
+ "updatedAt": "2026-05-13T08:11:46.643Z"
+}

.vibe/development-plan-fix-stable-hash-session-without-repo.md

@@ -0,0 +1,88 @@
+# Development Plan: opencode (fix/stable-hash-session-without-repo branch)
+
+*Generated on 2026-05-13 by Vibe Feature MCP*
+*Workflow: [bugfix](https://codemcp.github.io/workflows/workflows/bugfix)*
+
+## Goal
+Fix: when creating a new session without a repo, the session hash must be stable — the same hash must be used for the PVC, the Pod, and returned to the client. Currently `getSessionHash` uses `crypto.randomUUID()` for no-repo sessions, so each call produces a different hash, causing the Pod to reference a PVC that doesn't exist.
+
+## Key Decisions
+
+### Decision 1: Hash must be purely internal to pod-manager.ts
+Exposing the hash on `SessionKey` was rejected because a malicious consumer could pass an arbitrary hash and target another user's PVC. The hash must be computed and frozen **inside** `pod-manager.ts`, never on the public `SessionKey` interface.
+
+### Decision 2: Introduce an internal `startSession` function in pod-manager.ts
+Rather than changing `ensurePVC`/`ensurePod` signatures, expose a single `startSession(session, githubToken?)` function that:
+1. Calls `getSessionHash` exactly **once**
+2. Passes the frozen hash internally to both `ensurePVC` and `ensurePod` (via a private helper overload or by refactoring to accept a hash internally)
+3. Returns the hash to the caller
+
+`api.ts` calls `startSession` instead of calling `ensurePVC` + `ensurePod` + `getSessionHash` separately.
+
+### Decision 3: Make hash the first required parameter of `ensurePVC` and `ensurePod`
+The hash is now the primary identity input — `ensurePVC(hash, session)` and `ensurePod(hash, session, githubToken?, image?)`. Callers always compute the hash before calling, which makes it impossible to silently get a mismatched hash. The `_hash?: string` optional hack was rejected in favour of this cleaner contract. All callers (both in `pod-manager.ts` and `api.ts`) and all tests were updated accordingly.
+
+### Decision 5: `SessionKey` stays as the data parameter — repo info IS needed
+`ensurePVC` uses `repoUrl`/`branch`/`sourceBranch`/`initialMessage` purely for PVC annotations (so `resumeSession` can reconstruct the session later). `ensurePod` uses `repoUrl`/`branch`/`sourceBranch` functionally to build the correct init script (`git clone` vs `git init`). Removing them from these functions would either require a separate annotation-writing step or duplicate the git-decision logic elsewhere. The `SessionKey` struct is the correct abstraction: **hash = identity, SessionKey = data**. No further simplification needed.
+
+### Decision 4: `api.ts` git-repo and no-repo paths updated consistently
+- **Git-repo path**: still calls `getSessionHash` → `ensurePVC(hash, session)` → `ensurePod(hash, session, githubToken)` directly, since the hash is deterministic.
+- **No-repo path**: calls `startSession(session, githubToken)` which freezes the random hash once internally and passes it to both `ensurePVC` and `ensurePod`.
+- Both paths now make the hash explicit at the call site, which is the root-cause fix.
+
+## Notes
+*Additional context and observations*
+
+### Root Cause (confirmed)
+- File: `packages/opencode-router/src/pod-manager.ts`, function `getSessionHash` (line ~335)
+- For no-repo sessions: `crypto.randomUUID()` is called each time → different hash per call
+- In `api.ts` (lines 179–182), `getSessionHash` is called 3 times independently:
+ - Line 179: `const hash = getSessionHash(email)` → H1 (returned to client)
+ - Inside `ensurePVC`: `getSessionHash(session.email, ...)` → H2 (used for PVC name)
+ - Inside `ensurePod`: `getSessionHash(session.email, ...)` → H3 (used for Pod name + PVC claim)
+- H1 ≠ H2 ≠ H3 → Pod mounts wrong PVC, client polls wrong hash
+
+### Why git-repo path is unaffected
+- Deterministic hash: `sha256(email:repoUrl:branch)` — same inputs always yield same hash
+- Multiple calls produce identical results
+
+## Reproduce
+<!-- beads-phase-id: opencode-11.1 -->
+### Tasks
+<!-- beads-synced: 2026-05-13 -->
+*Auto-synced — do not edit here, use `bd` CLI instead.*
+
+- [x] `opencode-11.1.1` Confirm: getSessionHash called 3x independently in no-repo path → 3 different hashes
+
+## Analyze
+<!-- beads-phase-id: opencode-11.2 -->
+### Tasks
+<!-- beads-synced: 2026-05-13 -->
+*Auto-synced — do not edit here, use `bd` CLI instead.*
+
+
+## Fix
+<!-- beads-phase-id: opencode-11.3 -->
+### Tasks
+<!-- beads-synced: 2026-05-13 -->
+*Auto-synced — do not edit here, use `bd` CLI instead.*
+
+- [x] `opencode-11.3.1` Write failing regression test: PVC and Pod share same hash for no-repo session
+- [x] `opencode-11.3.2` Refactor ensurePVC and ensurePod to accept optional pre-computed hash
+- [x] `opencode-11.3.3` Expose startSession in pod-manager.ts that calls getSessionHash once
+- [x] `opencode-11.3.4` Update api.ts to call startSession instead of 3 separate calls
+- [x] `opencode-11.3.5` Run tests and type check
+
+## Verify
+<!-- beads-phase-id: opencode-11.4 -->
+### Tasks
+<!-- beads-synced: 2026-05-13 -->
+*Auto-synced — do not edit here, use `bd` CLI instead.*
+
+
+## Finalize
+<!-- beads-phase-id: opencode-11.5 -->
+### Tasks
+<!-- beads-synced: 2026-05-13 -->
+*Auto-synced — do not edit here, use `bd` CLI instead.*
+