fix(bcode-serve): close web-UI import hole; harden installer and build

Reworked the variant from scratch and had the result adversarially reviewed.
The headline is a real vulnerability in what this branch already shipped.

Dropping the embedded web UI did not fail closed. Bun leaves the bare
`import("opencode-web-ui.gen.ts")` in server/shared/ui.ts live in the binary and
resolves it at runtime against the server's cwd, so a file planted at
./node_modules/opencode-web-ui.gen.ts executed in-process, and its default
export was used as a path map that serveUIEffect read and returned over HTTP.
PUBLIC_UI_PATHS lets /site.webmanifest and the manifest icons skip auth, so this
was reachable unauthenticated. Reproduced end to end: GET /site.webmanifest
returned /etc/hosts with HTTP 200 while OPENCODE_SERVER_PASSWORD was set. Fixed
by embedding an empty stub, which resolves the specifier hermetically; the same
request now 404s and the planted module never loads. The standard binary was
never affected — it embeds the real bundle.

Installer, all reproduced before fixing:
  - a bare VERSION env var was honoured, so a common Dockerfile ARG could
    silently install a different build; only BCODE_VERSION is read now
  - musl detection could not fire under pipefail, so non-Alpine musl hosts
    silently took the glibc asset
  - the binary's own stderr was discarded, so a libc mismatch reported "noexec"
    as the likely cause instead of the missing loader
  - unset HOME aborted with a raw unbound-variable error
  - EXIT-only trap leaked a staged file and temp dir on INT/TERM/HUP under
    ash/dash; TERM is what docker build cancellation sends
  - the AVX2 guard tripped on cpuinfo with no flags line (qemu-emulated amd64
    on an arm64 host), contradicting its own "unknown is not absent" intent
  - installing over a directory named bcode reported success and exit 0
  - empty and flag-shaped option values were accepted
  - the curl/tar preflight was missing, so a missing tar exited 127
Also rewritten as POSIX sh: Alpine is a supported target and ships no bash.

Build script:
  - the smoke test's timeout was not a deadline. It killed the child, which does
    not end the read loop if a descendant holds stdout, so a failing smoke test
    could hang the build; it now races a rejecting timer and SIGKILLs
  - musl detection missed Bun's `-musl-baseline` spelling
  - assert the version define landed: every define is typeof-guarded upstream,
    so a dropped one degrades silently and the banner alone would not notice
  - dropped three defines proven inert for this graph (OTUI_TREE_SITTER_WORKER_PATH,
    OPENCODE_WORKER_PATH, OPENTUI_LIBC) after byte-identical-output checks
  - targets are plain strings now instead of an object matrix

Left alone deliberately: the entrypoint's global options and lifecycle wiring.
Trimming them looked attractive but every candidate failed review — --pure and
the AGENT/OPENCODE env vars have out-of-repo consumers, and Heap.start() is the
only eager path that initialises Global, so removing it would change init
ordering rather than just dropping a diagnostic.

Author: sauravpanda

.github/workflows/release.yml

@@ -147,21 +147,17 @@ jobs:
           ./packages/opencode/script/build.ts
 
       - name: Build serve-only variant and upload to release
-        # Additive: produces `bcode-linux-{arm64,x64}-serve.tar.gz` alongside the
-        # standard assets, for headless containers. Built from its own package so
-        # `packages/opencode` — forked from upstream — stays untouched, and the
-        # canonical build step above is unmodified.
+        # Additive: publishes `bcode-linux-{arm64,x64}[-musl]-serve.tar.gz` for
+        # headless containers, from its own package so the upstream-forked
+        # `packages/opencode` and the canonical step above stay untouched.
         #
-        # Runs after that step and is `continue-on-error` on purpose: this variant
-        # must never block or alter a normal release. Different asset names, so
-        # `--clobber` cannot overwrite the standard archives.
+        # `continue-on-error` so this variant can never block a normal release;
+        # its asset names differ, so `--clobber` cannot touch the standard ones.
+        # Invoked via `bun` so a lost executable bit cannot silently disable it.
         #
-        # Linux only — the only consumer is the container image. glibc + musl,
-        # matching what install-bytecode.sh can select; no baseline (non-AVX2
-        # x64), which the installer rejects with a pointer to /install.
-        #
-        # Invoked through `bun` rather than as `./...` so a lost executable bit
-        # cannot silently disable the whole step under continue-on-error.
+        # No baseline (non-AVX2 x64) target — install-bytecode.sh rejects that
+        # case with a pointer to /install rather than shipping a binary that
+        # SIGILLs.
         continue-on-error: true
         env:
           OPENCODE_VERSION: ${{ steps.ver.outputs.version }}
@@ -173,13 +169,10 @@ jobs:
           BCODE_DEFAULT_LMNR_KEY: ${{ secrets.LMNR_PROJECT_API_KEY_OSS }}
         run: |
           # Checkout has no `ref:`, so on `workflow_dispatch` the tree is the
-          # dispatch ref (usually main), not the selected tag — while the upload
-          # still targets that tag. Publishing then would put main's code inside
-          # the tag's assets. Build only when the tree really is the tag.
-          #
-          # The canonical build step above has the same exposure; fixing that
-          # means changing `Checkout` for the whole job, which is out of scope
-          # here. Tracked separately.
+          # dispatch ref, not the selected tag, while the upload still targets
+          # that tag. Only build when the tree really is the tag. (The canonical
+          # step has the same exposure; fixing it means changing `Checkout` for
+          # the whole job, which is out of scope here.)
           TAG_SHA=$(git rev-parse -q --verify "refs/tags/${TAG}^{commit}" || true)
           HEAD_SHA=$(git rev-parse HEAD)
           if [ "$HEAD_SHA" != "$TAG_SHA" ]; then

install-bytecode.sh

@@ -1,209 +1,169 @@
-#!/usr/bin/env bash
+#!/bin/sh
 #
-# BrowserCode installer — bytecode / serve-only build.
+# BrowserCode installer — serve-only build. Hosted at https://bcode.sh/bytecode,
+# alongside (not replacing) https://bcode.sh/install, which stays the path for
+# the full CLI.
 #
-# Hosted at https://bcode.sh/bytecode, alongside (not replacing)
-# https://bcode.sh/install:
+#   curl -fsSL https://bcode.sh/bytecode | sh -s -- --no-modify-path --version 0.1.19
 #
-#   curl -fsSL https://bcode.sh/bytecode | bash -s -- --no-modify-path --version 0.0.3
+# Installs `bcode-linux-<arch>[-musl]-serve`, which provides ONLY `bcode serve`;
+# run, tui, web, github and the rest are absent and exit 1. It exists for headless
+# containers.
 #
-# Installs the `bcode-linux-<arch>-serve` asset, which provides ONLY
-# `bcode serve` — `run`, `tui`, `web`, `github` and the rest are absent and
-# exit 1. It exists for headless containers; anyone installing bcode on a
-# laptop wants https://bcode.sh/install.
-#
-# `install.sh` is the published path docs point at and stays untouched. This is
-# additive: a second script, a second URL, a second release asset.
-#
-# Linux only. Deliberately much shorter than install.sh: one build per arch (no
-# baseline/AVX2 detection), no shell-rc editing (containers set PATH in the
-# Dockerfile), no uv hint. Takes install.sh's flags so switching is a one-word
-# change to the URL in a Dockerfile.
-set -euo pipefail
-
-APP=bcode
-VARIANT=serve
-REPO=browser-use/browsercode
+# POSIX sh, not bash: Alpine is a supported target here and ships no bash.
+set -eu
 
-MUTED='\033[0;2m'
+REPO=browser-use/browsercode
+DIM='\033[0;2m'
 RED='\033[0;31m'
-ORANGE='\033[38;5;214m'
-NC='\033[0m'
-
-usage() {
-    cat <<EOF
-BrowserCode Installer (bytecode / serve-only build)
+OFF='\033[0m'
+
+say() { printf "${DIM}%s${OFF}\n" "$1" >&2; }
+die() {
+  printf "${RED}%s${OFF}\n" "$1" >&2
+  shift
+  for line in "$@"; do [ -n "$line" ] && printf "${DIM}%s${OFF}\n" "$line" >&2; done
+  exit 1
+}
 
-Usage: install-bytecode.sh [options]
+# Reject empty and flag-shaped values: `--version "$UNSET"` would otherwise
+# silently install latest, which is exactly what pinning exists to prevent.
+need() {
+  case $2 in
+    "" | -*) die "$1 needs a value (got: ${2:-<missing>})" ;;
+  esac
+}
 
-Installs a bcode binary that provides ONLY 'bcode serve'. For the full CLI use
-https://bcode.sh/install instead.
+usage() {
+  cat >&2 <<EOF
+BrowserCode installer (serve-only build)
 
-Options:
-    -h, --help              Display this help message
-    -v, --version <version> Install a specific version (e.g. 0.0.3)
-        --install-dir <dir> Install to <dir> (default: \$HOME/.bcode/bin)
-        --no-modify-path    Accepted for parity with install.sh; this script
-                            never edits shell config files.
+  -v, --version <ver>    version to install (default: latest release)
+      --install-dir <d>  where to install (default: \$HOME/.bcode/bin)
+      --no-modify-path   accepted for install.sh parity; this script never edits
+                         shell config files
+  -h, --help             show this help
 
-Examples:
-    curl -fsSL https://bcode.sh/bytecode | bash
-    curl -fsSL https://bcode.sh/bytecode | bash -s -- --no-modify-path --version 0.0.3
+Installs a bcode that provides ONLY 'bcode serve'.
+For the full CLI: curl -fsSL https://bcode.sh/install | bash
 EOF
 }
 
-requested_version=${VERSION:-}
-install_dir=${BCODE_INSTALL_DIR:-$HOME/.bcode/bin}
-
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        -h|--help)
-            usage
-            exit 0
-            ;;
-        -v|--version)
-            if [[ -n "${2:-}" ]]; then
-                requested_version="$2"
-                shift 2
-            else
-                echo -e "${RED}Error: --version requires a version argument${NC}" >&2
-                exit 1
-            fi
-            ;;
-        --install-dir)
-            if [[ -n "${2:-}" ]]; then
-                install_dir="$2"
-                shift 2
-            else
-                echo -e "${RED}Error: --install-dir requires a path argument${NC}" >&2
-                exit 1
-            fi
-            ;;
-        --no-modify-path)
-            # No-op: this script never touches shell config. Accepted so an
-            # existing install.sh invocation works verbatim against this URL.
-            shift
-            ;;
-        *)
-            echo -e "${ORANGE}Warning: Unknown option '$1'${NC}" >&2
-            shift
-            ;;
-    esac
+# Namespaced on purpose: a bare VERSION is a common Dockerfile ARG, and picking
+# it up here would silently install the wrong build.
+version=${BCODE_VERSION:-}
+# HOME is routinely unset under `--user`/runAsUser with no passwd entry.
+install_dir=${BCODE_INSTALL_DIR:-${HOME:-/root}/.bcode/bin}
+
+while [ $# -gt 0 ]; do
+  case $1 in
+    -v | --version) need "--version" "${2:-}"; version=$2; shift 2 ;;
+    --install-dir) need "--install-dir" "${2:-}"; install_dir=$2; shift 2 ;;
+    --no-modify-path) shift ;;
+    # Tolerated: wrappers relaying args often forward an extra one.
+    --) shift ;;
+    -h | --help) usage; exit 0 ;;
+    # Fail rather than warn: a typo'd flag would otherwise quietly install
+    # "latest" into a build that meant to pin a version.
+    *) die "Unknown option: $1" "Run with --help for usage." ;;
+  esac
 done
 
-raw_os=$(uname -s)
-case "$raw_os" in
-  Linux*) os="linux" ;;
-  *)
-    echo -e "${RED}Error: the ${VARIANT} build is published for linux only (detected: ${raw_os}).${NC}" >&2
-    echo -e "${MUTED}Use https://bcode.sh/install for the standard cross-platform binary.${NC}" >&2
-    exit 1
-    ;;
-esac
-
-arch=$(uname -m)
-case "$arch" in
-  aarch64|arm64) arch="arm64" ;;
-  x86_64|amd64)  arch="x64" ;;
-  *)
-    echo -e "${RED}Error: unsupported architecture '${arch}'. Supported: arm64, x64.${NC}" >&2
-    exit 1
-    ;;
-esac
-
 for tool in curl tar; do
-    if ! command -v "$tool" >/dev/null 2>&1; then
-        echo -e "${RED}Error: '${tool}' is required but not installed.${NC}" >&2
-        exit 1
-    fi
+  command -v "$tool" >/dev/null 2>&1 || die "'$tool' is required but not installed."
 done
 
-# A glibc binary will not start on musl, so pick the matching build rather than
-# installing something that dies at exec.
-is_musl=false
-if [ -f /etc/alpine-release ]; then
-    is_musl=true
-elif command -v ldd >/dev/null 2>&1 && ldd --version 2>&1 | grep -qi musl; then
-    is_musl=true
+[ "$(uname -s)" = Linux ] || die \
+  "The serve build is published for linux only (got $(uname -s))." \
+  "Use https://bcode.sh/install for the standard cross-platform binary."
+
+case $(uname -m) in
+  aarch64 | arm64) arch=arm64 ;;
+  x86_64 | amd64) arch=x64 ;;
+  *) die "Unsupported architecture: $(uname -m)." "Supported: arm64, x64." ;;
+esac
+
+# Non-baseline x64 builds need AVX2 and no baseline serve asset is published.
+# Only decide when /proc/cpuinfo actually carries a flags line: emulated or
+# redacted cpuinfo (qemu `--platform linux/amd64` on arm64, lxcfs, some
+# hypervisors) has none, and unknown is not the same as absent.
+if [ "$arch" = x64 ] && grep -qi '^flags' /proc/cpuinfo 2>/dev/null && ! grep -qwi avx2 /proc/cpuinfo; then
+  die "This CPU has no AVX2 and no baseline serve build is published." \
+    "Use https://bcode.sh/install, which ships a baseline binary."
 fi
 
-# Non-baseline x64 builds require AVX2. This variant publishes no baseline
-# asset, so say that rather than installing a binary that SIGILLs on first run.
-# (Adding it is one entry in packages/bcode-serve/script/build.ts if ever needed.)
-# Only trip when /proc/cpuinfo is actually readable — unknown is not "absent".
-if [ "$arch" = "x64" ] && [ -r /proc/cpuinfo ] && ! grep -qwi avx2 /proc/cpuinfo; then
-    echo -e "${RED}Error: this CPU lacks AVX2, and no baseline ${VARIANT} build is published.${NC}" >&2
-    echo -e "${MUTED}Use https://bcode.sh/install, which ships a baseline binary.${NC}" >&2
-    exit 1
+# A glibc binary cannot exec on musl. musl's ldd prints its banner and then exits
+# non-zero, so match its output — the pipeline's status is grep's, not ldd's.
+target=linux-$arch
+if [ -f /etc/alpine-release ] || ldd --version 2>&1 | grep -qi musl; then
+  target=$target-musl
 fi
+asset=bcode-$target-serve.tar.gz
 
-target="${os}-${arch}"
-[ "$is_musl" = true ] && target="${target}-musl"
-filename="${APP}-${target}-${VARIANT}.tar.gz"
-
-if [ -z "$requested_version" ]; then
-    url="https://github.com/${REPO}/releases/latest/download/${filename}"
-    specific_version=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" 2>/dev/null \
-        | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p' || true)
-    if [ -z "$specific_version" ]; then
-        echo -e "${RED}Failed to resolve the latest version.${NC}" >&2
-        echo -e "${MUTED}If the repo is private, pin a version: --version <ver>${NC}" >&2
-        exit 1
-    fi
+if [ -n "$version" ]; then
+  version=${version#v}
 else
-    specific_version="${requested_version#v}"
-    url="https://github.com/${REPO}/releases/download/v${specific_version}/${filename}"
+  version=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null |
+    sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')
+  [ -n "$version" ] || die "Could not resolve the latest version." "Pin one with --version <ver>."
 fi
+url=https://github.com/$REPO/releases/download/v$version/$asset
 
-echo -e "${MUTED}Installing ${NC}${APP} ${MUTED}(${VARIANT} build) version: ${NC}${specific_version}"
+say "Installing bcode $version ($target, serve build)"
 
-tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/bcode_bytecode_install.XXXXXX")
-staged=""
+tmp=$(mktemp -d)
+staged=
+# `return 0` is load-bearing: the `&&` above it returns 1 whenever staged is
+# empty, which under `set -e` would turn a clean run into a non-zero exit.
 cleanup() {
-    rm -rf "$tmp_dir"
-    [ -n "${staged:-}" ] && rm -f "$staged"
-    return 0
+  rm -rf "$tmp"
+  [ -n "$staged" ] && rm -f "$staged"
+  return 0
 }
 trap cleanup EXIT
-
-# Fail loudly rather than unpacking a 404 body. Releases predating this variant
-# legitimately lack the asset, so say that instead of erroring out of tar.
-if ! curl -fsSL -o "${tmp_dir}/${filename}" "$url"; then
-    echo -e "${RED}Error: could not download ${filename} for v${specific_version}.${NC}" >&2
-    echo -e "${MUTED}URL: ${url}${NC}" >&2
-    echo -e "${MUTED}Releases predating the ${VARIANT} variant do not publish this asset.${NC}" >&2
-    echo -e "${MUTED}Check https://github.com/${REPO}/releases for one that does, or use https://bcode.sh/install.${NC}" >&2
-    exit 1
-fi
-
-tar -xzf "${tmp_dir}/${filename}" -C "$tmp_dir"
-
-if [ ! -f "${tmp_dir}/${APP}" ]; then
-    echo -e "${RED}Error: archive did not contain a '${APP}' binary.${NC}" >&2
-    exit 1
+# ash/dash do not run the EXIT trap on a signal; `docker build` cancellation
+# sends TERM. Exiting from the handler routes through the EXIT trap above.
+trap 'exit 130' INT
+trap 'exit 143' TERM
+trap 'exit 129' HUP
+
+curl -fsSL -o "$tmp/$asset" "$url" || die \
+  "Could not download $asset for v$version." \
+  "URL: $url" \
+  "Releases published before this variant existed do not carry the asset."
+
+tar -xzf "$tmp/$asset" -C "$tmp"
+[ -f "$tmp/bcode" ] || die "Archive did not contain a bcode binary."
+
+# Stage inside the install dir, validate, then swap. Validating first means a bad
+# download never replaces a working bcode; staging here rather than in /tmp avoids
+# requiring an exec-capable /tmp (noexec there is common hardening) and makes the
+# final step a same-filesystem rename, so the swap is atomic.
+case $install_dir in
+  "") die "Install directory cannot be empty." ;;
+  -*) die "Install directory must not start with '-' (got: $install_dir)." ;;
+esac
+mkdir -p -- "$install_dir"
+if [ -d "$install_dir/bcode" ]; then
+  die "$install_dir/bcode is a directory; refusing to install over it."
 fi
-
-# Stage inside the install dir, validate, then swap into place.
-#
-# Validating before the swap keeps a corrupt or wrong-libc download from
-# replacing a working bcode. Staging in the install dir rather than the temp dir
-# keeps that safety without requiring an exec-capable /tmp — `noexec` there is
-# common hardening, and the install dir has to allow exec regardless. It also
-# makes the final step a same-filesystem `mv`, so the swap is atomic and no
-# reader can observe a half-written binary.
-mkdir -p "$install_dir"
-staged=$(mktemp "${install_dir}/.${APP}.XXXXXX")
-mv "${tmp_dir}/${APP}" "$staged"
+staged=$(mktemp "$install_dir/.bcode.XXXXXX")
+mv "$tmp/bcode" "$staged"
 chmod 755 "$staged"
 
-if ! installed_version=$("$staged" --version 2>/dev/null); then
-    echo -e "${RED}Error: downloaded binary failed to run; leaving any existing install untouched.${NC}" >&2
-    echo -e "${MUTED}If ${install_dir} is mounted noexec, install elsewhere with --install-dir.${NC}" >&2
-    exit 1
+# Keep the binary's own stderr: on a libc mismatch it names the missing loader,
+# which is the actual diagnosis.
+if ! installed=$("$staged" --version 2>"$tmp/err"); then
+  die "Downloaded binary failed to run; existing install left untouched." \
+    "$(cat "$tmp/err" 2>/dev/null)" \
+    "If $install_dir is mounted noexec, pass --install-dir."
 fi
 
-mv "$staged" "${install_dir}/${APP}"
-staged=""
+mv "$staged" "$install_dir/bcode"
+staged=
 
-echo -e "${MUTED}Installed ${NC}${install_dir}/${APP}${MUTED} (${installed_version})${NC}"
-echo -e "${MUTED}This build provides '${APP} serve' only.${NC}"
+say "Installed $install_dir/bcode ($installed) — provides 'bcode serve' only"
+case ":$PATH:" in
+  *":$install_dir:"*) ;;
+  *) say "Not on PATH. Add it with: export PATH=\"$install_dir:\$PATH\"" ;;
+esac