fix(collab): iframe auth via base64 path + SPA bootstrap allowlist + git safe.directory + preview-port wildcard filter

Four issues collected from the /collab/<id> HAR + 'Open Pull Request' error
+ phantom preview chips screenshot.  Single deploy cycle.

  P1 — iframe URL was 401'ing → 302 to OAuth → ERR_BLOCKED_BY_CSP.
       Iframe URL is /<base64(workspaceDirectory)>/session/<sid>?cs=<csid>
       — directory is in the path, not in ?directory= or x-opencode-directory.
       cookie-auth's workspaceParamFrom() now decodes the first path segment
       as URL-safe base64 (matching packages/app/src/utils/base64.ts) and
       falls back to that as the workspace addressing.

  P2 — SPA's GlobalSyncProvider hits /global/event, /global/config, /path,
       /project, /provider on every route (including /collab/*).  None are
       workspace-scoped; in collab mode they got 'deny' on fallthrough →
       401 thrash.  Added them to cookieAllowedWithoutScope as a small
       explicit set (not a prefix — guards against accidentally inheriting
       the unscoped pass on future per-workspace API groups).

  P3 — 'fatal: detected dubious ownership' on git push from the workspace.
       EFS access points are configured with posix_user uid=0 (efs.tf)
       while the container runs as uid 10001 (ADR-0003).  Git 2.35+ refuses
       operations on a repo whose .git dir isn't owned by the current uid.
       Workaround: 'git config --global --add safe.directory *' in
       entrypoint.sh.  Single-tenant container, no other repos to worry
       about.  Proper fix is to align EFS access point uid with the
       container uid — tracked as future TF change.

  P4 — Phantom preview chips (e.g. :20681, :20959) in the SPA's Repos
       column.  Those are Bun internals / SSM agent loopback listeners,
       not user-facing dev servers.  readListeningPorts() in router.ts
       now filters to wildcard-bind only (0.0.0.0 / ::), dropping
       loopback and per-interface listeners that aren't reachable from
       the browser anyway.

Author: sqeeswy

packages/opencode/src/collab/cookie-auth.ts

@@ -20,6 +20,7 @@
 
 import { Database } from "@/storage/db"
 import { eq, and, isNull } from "drizzle-orm"
+import { base64Decode } from "@opencode-ai/core/util/encode"
 import {
   CollabAuthSessionTable,
   CollabSessionTable,
@@ -174,16 +175,42 @@ function participantOfNativeSession(nativeSessionId: string, githubId: number):
   })
 }
 
-/** Extract a workspace-addressing parameter from a Request. */
+/** Extract a workspace-addressing parameter from a Request.
+ *
+ *  The iframe URL shape is `/<base64(workspaceDirectory)>/session/<sid>?cs=<csid>`
+ *  — the directory is encoded in the first path segment, not in
+ *  `?directory=` or `x-opencode-directory`.  Without this third lookup,
+ *  cookie-auth's rule (b) misses the iframe entirely → fallthrough → 302
+ *  to OAuth → CSP-blocked because iframes can't navigate to github.com.
+ *
+ *  base64Decode here mirrors packages/app/src/utils/base64.ts which is
+ *  what the SPA uses to construct the URL — URL-safe base64 (`-`/`_` in
+ *  place of `+`/`/`, no padding).
+ */
 function workspaceParamFrom(req: Request): string | null {
   const dirHeader = req.headers.get("x-opencode-directory")
   if (dirHeader) return dirHeader
   const url = new URL(req.url, "http://localhost")
-  return (
-    url.searchParams.get("directory") ||
-    url.searchParams.get("location[directory]") ||
-    null
-  )
+  const queryDir = url.searchParams.get("directory") || url.searchParams.get("location[directory]")
+  if (queryDir) return queryDir
+  return directoryFromBase64Path(url.pathname)
+}
+
+function directoryFromBase64Path(pathname: string): string | null {
+  // First path segment, e.g. /<base64>/session/... → "<base64>".
+  const first = pathname.split("/", 2)[1]
+  if (!first) return null
+  // URL-safe base64 alphabet: [A-Za-z0-9_-].  Anything else (digits-only,
+  // dotted, etc.) is not a directory-encoded path.
+  if (!/^[A-Za-z0-9_-]+$/.test(first)) return null
+  try {
+    const decoded = base64Decode(first)
+    // Decoded value must look like an absolute filesystem path.
+    if (decoded.startsWith("/")) return decoded
+  } catch {
+    // Not base64 — fall through.
+  }
+  return null
 }
 
 /**
@@ -203,7 +230,28 @@ function cookieAllowedWithoutScope(pathname: string): boolean {
   // /preview/<port>/* — see ADR-0001 + the inline note in preview-router.ts:
   // participants already have shell-level trust via the iframe terminal, so
   // strict port↔session binding is deferred to v2.
-  return pathname.startsWith("/preview/")
+  if (pathname.startsWith("/preview/")) return true
+
+  // SPA bootstrap endpoints used by GlobalSyncProvider on every route
+  // (including /collab/*).  None of them are workspace-scoped — they
+  // describe the running opencode binary or the user's global config.
+  // Any authenticated unleashlive org member may read them.  Without this
+  // they fail cookie-auth's scope check, fall through to "deny" in collab
+  // mode, and the SPA's GlobalSyncProvider thrashes with 401s.
+  //
+  // Explicitly listed (not a prefix) so future per-workspace HttpApi groups
+  // mounted under e.g. /provider/<id>/... wouldn't accidentally inherit the
+  // unscoped pass.
+  const UNSCOPED_SPA_BOOTSTRAP = new Set([
+    "/global/event",
+    "/global/config",
+    "/path",
+    "/project",
+    "/provider",
+  ])
+  if (UNSCOPED_SPA_BOOTSTRAP.has(pathname)) return true
+
+  return false
 }
 
 export type CookieAuthDecision = "allow" | "deny" | "fallthrough"

packages/opencode/src/collab/router.ts

@@ -61,6 +61,9 @@ const PROMPT_BODY_MAX_BYTES = 32 * 1024
  * Read TCP ports the container is currently LISTENING on, by parsing
  * /proc/net/tcp + /proc/net/tcp6.  Filters out:
  *   - non-LISTEN states (only state 0A = LISTEN)
+ *   - listeners NOT bound to a wildcard address (0.0.0.0 / ::) — loopback-
+ *     only and per-iface listeners are Bun internals, SSM agent connections,
+ *     etc., not user-facing dev servers
  *   - opencode's own port (4096)
  *   - ports under 1024 (system services)
  *   - well-known DB ports we definitely don't want to expose (5432, 6379, etc.)
@@ -81,7 +84,18 @@ async function readListeningPorts(): Promise<number[]> {
         const local = parts[1]
         const state = parts[3]
         if (state !== "0A") continue // LISTEN only
-        const portHex = local!.split(":").pop()!
+        const [addrHex, portHex] = local!.split(":")
+        if (!addrHex || !portHex) continue
+        // Wildcard-bind only.  /proc/net/tcp uses little-endian hex for
+        // IPv4 addresses; 0.0.0.0 is "00000000".  /proc/net/tcp6 stores
+        // the address as four 32-bit big-endian-pair words concatenated;
+        // both :: (all zeros) and the v4-mapped 0.0.0.0 ("0000000000000000FFFF000000000000")
+        // are wildcards.  Anything else is a per-iface or loopback listener
+        // (likely internal — Bun, SSM, side channels) and not a dev server.
+        const isV4Wildcard = addrHex === "00000000"
+        const isV6Wildcard = addrHex === "00000000000000000000000000000000"
+        const isV4MappedWildcard = addrHex === "0000000000000000FFFF000000000000"
+        if (!isV4Wildcard && !isV6Wildcard && !isV4MappedWildcard) continue
         const port = parseInt(portHex, 16)
         if (!Number.isInteger(port)) continue
         if (port < 1024 || port > 65535) continue

scripts/entrypoint.sh

@@ -30,6 +30,17 @@ if [ -n "${CLAUDE_CREDENTIALS_JSON:-}" ]; then
   chmod 0600 "$HOME_DIR/.claude/.credentials.json"
 fi
 
+# Git "dubious ownership" workaround.  EFS access points (terraform/opencode-
+# collab/efs.tf) currently mount with uid=0/gid=0, while the container runs
+# as uid 10001 (ADR-0003).  Git 2.35+ refuses operations on a repo whose
+# .git directory isn't owned by the current uid — clone works because git
+# creates the .git dir itself, but subsequent push/log/diff calls fail with
+# "fatal: detected dubious ownership".  Wildcard '*' tells git to trust any
+# directory; safe enough on this single-tenant container.
+# Proper fix is to align the EFS access point posix_user.uid with the
+# container uid; tracked separately.
+git config --global --add safe.directory '*'
+
 # Hand off to the real server.  $@ propagates whatever args ECS / CMD passed.
 exec bun run --cwd packages/opencode src/index.ts serve \
   --port 4096 --hostname 0.0.0.0 --print-logs "$@"