fix(server): port upstream PTY connect route authorization (anomalyco/opencode#58258)

DE
17d ago
+84-51

Issue for this PR

Closes #1614

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

With server auth enabled, a ticketed PTY WebSocket connect skips Basic/token auth so the handler can validate the ticket. That bypass was decided by hasPtyConnectTicketURL(url), a regex over the raw request URL, not by the route Effect actually dispatched, so authorization and routing could disagree about the path. The connect handler also looked the PTY up before checking origin and ticket, so an unauthenticated caller with a junk ticket or foreign Origin got 404 vs 403 and could probe which PTY IDs exist.

Ported from upstream:

  • anomalyco/opencode#58258: both authorization layers (packages/opencode instance HttpApi and packages/server) read HttpRouter.RouteContext and only bypass when route.route.path === PTY_CONNECT_PATH and a ticket query is present. The regex helpers are replaced by a shared PTY_CONNECT_PATH route constant used by the endpoint definitions.
  • anomalyco/opencode@7b39a338a0: both connect handlers check origin and consume the ticket before the PTY existence check.

All changes wrapped in altimate_change markers tagged upstream_fix:.

How did you verify your code works?

  • New test in test/server/httpapi-pty.test.ts: a junk ticket and a cross-origin connect to a missing PTY both return 403. It fails on main (404) and passes here.
  • test/upstream/adversarial/upi-server.test.ts updated for the route constant; httpapi-pty, upi-server and httpapi-listen tests pass (22 pass, 8 existing todo).
  • bun run typecheck clean in packages/opencode and packages/server; bun run script/upstream/analyze.ts --markers --base origin/main --strict clean.

Cost side effects

None. No model calls, queries or resources added.

Screenshots / recordings

N/A, no UI change.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR
  • I checked for cost side effects (model calls, queries or cloud resources that grow with user data) and described them, or wrote "none"

Written by Devin

Summary by cubic

Fixes PTY WebSocket connect authorization so the ticket bypass is keyed to the matched route rather than a raw-URL regex, and bad-origin or bad-ticket requests now return 403 before revealing whether a PTY exists.

Bug Fixes

  • Both authorization layers (packages/opencode and packages/server) now read HttpRouter.RouteContext and only bypass credential checks when the matched route is the PTY connect path with a ticket query, so authorization cannot disagree with dispatch.
  • The connect handlers now validate origin and consume the ticket before the PTY existence check, so junk tickets and cross-origin requests to missing PTYs get 403 instead of 404.
  • Replaced the regex path helpers with a shared PTY_CONNECT_PATH route constant used by both endpoint definitions.