Add @loreai/opencode plugin; drop basic-auth in favor of Cloudflare Access - #2
Merged
Conversation
Adds Lore (https://github.com/BYK/loreai), a memory plugin for OpenCode that replaces compaction with incremental distillation, preserving operational details (file paths, errors, decisions) across long sessions and persisting curated knowledge to a local SQLite store.
Removes OPENCODE_SERVER_PASSWORD and OPENCODE_SERVER_USERNAME from the template and the README env-vars table. HTTP basic auth re-prompts constantly on mobile browsers (especially iOS Safari) because the credential is only cached in browser memory and there is no persistent session cookie. Replace it with guidance to front the public hostname with Cloudflare Access, which issues a long-lived CF_Authorization cookie that mobile keeps across app kills and reboots.
MathurAditya724
changed the title
The README's Auth section already covers this; no need for a duplicated comment in the env template.
MathurAditya724
added a commit
that referenced
this pull request
May 1, 2026
- opencode-webhooks README: replace stale `x-email-from` header reference with JSON `from` field (finding #1). - http.ts: rewrite MAX_BODY_BYTES comment (no longer about RFC822); add MAX_EMAIL_BODY_BYTES = 64 KB and an optional maxBytes arg to readBodyBytes; email handler now uses the tighter cap (finding #2). - cloudflare-email-worker README: note that a malformed regex literal in ALLOWED_SENDERS will throw at module init and the worker won't start (finding #3). - email handler: parseEmailEvent's `str` now throws on non-string for required fields (from/to/subject/message_id) so the 400 detail names the offending field instead of misleading 'missing' messages (finding #4). - Test gap for email identity fallback chain tracked in #14; no tests added in this commit (finding #5).
MathurAditya724
added a commit
that referenced
this pull request
May 1, 2026
… SIDECAR_URL → WEBHOOK_URL (#13) * refactor(email-worker): wrangler.json, inline ALLOWED_SENDERS, rename SIDECAR_URL → WEBHOOK_URL - Replace wrangler.toml with wrangler.json (with $schema reference for editor validation). TOML and JSON are both first-class wrangler config formats; JSON keeps the worker package consistent with the rest of the repo's config files (package.json, tsconfig.json, webhooks.json). - Move ALLOWED_SENDERS out of wrangler vars and into a top-level TypeScript const at the head of src/index.ts. The allowlist is PR-reviewed code now (typed as readonly string[]), compiled once at module load (zero per-request parse overhead), and a malformed regex fails the deploy instead of silently dropping at runtime. The Env shape no longer needs an ALLOWED_SENDERS field. - Rename SIDECAR_URL → WEBHOOK_URL in wrangler.json vars, the Env interface, and the fetch call. 'Sidecar' was misleading anyway — the plugin is in-process with opencode, not a sidecar process. WEBHOOK_URL clearly names what it points at: the plugin's /webhooks/email endpoint. * feat(email): worker becomes dumb pipe — unconditional forward + JSON event The Cloudflare Email Worker now does two things per inbound email: 1. message.forward(env.FORWARD_TO) unconditionally (if set), so every email reaches the operator's real inbox preserving DKIM. Wrapped in try/catch so a misconfigured FORWARD_TO doesn't block webhook dispatch — failure is logged loudly and we continue. 2. If the From address is in ALLOWED_SENDERS, build a small JSON event from the headers we route on (from, to, subject, message_id, in_reply_to, references, list_id, x_github_reason, x_github_sender), HMAC-sign it, and POST as application/json to WEBHOOK_URL. The worker no longer parses RFC822 in the plugin path — it just hands Cloudflare's already-parsed headers to the plugin verbatim. The body is never sent at all (it never was used; canonical state comes from the GitHub API). Plugin side: - handlers/email.ts: reads req.json() instead of parsing RFC822; validates the event shape; everything downstream (identity, synth, dispatch) is unchanged. - email/identity.ts: accepts the EmailEvent JSON shape instead of an EmailHeaders object. Same regex matchers; same in-reply-to / references fallback chain. - email/synthesize.ts: reads metadata directly from the event object. - email/parse.ts: deleted (no more RFC822 parsing). Other changes: - wrangler.json: added FORWARD_TO var (optional) and observability.logs.enabled = true so 'wrangler tail' and the Cloudflare dashboard show structured logs. - READMEs: updated wire format, architecture diagrams, failure-mode table on the worker side. Verified: bun run typecheck passes for both packages; wrangler deploy --dry-run accepts the new config with both vars bound. * fix: review findings on PR #13 (dumb-pipe + wrangler.json) - opencode-webhooks README: replace stale `x-email-from` header reference with JSON `from` field (finding #1). - http.ts: rewrite MAX_BODY_BYTES comment (no longer about RFC822); add MAX_EMAIL_BODY_BYTES = 64 KB and an optional maxBytes arg to readBodyBytes; email handler now uses the tighter cap (finding #2). - cloudflare-email-worker README: note that a malformed regex literal in ALLOWED_SENDERS will throw at module init and the worker won't start (finding #3). - email handler: parseEmailEvent's `str` now throws on non-string for required fields (from/to/subject/message_id) so the 400 detail names the offending field instead of misleading 'missing' messages (finding #4). - Test gap for email identity fallback chain tracked in #14; no tests added in this commit (finding #5).
MathurAditya724
added a commit
that referenced
this pull request
Aug 7, 2026
…op (#138) The Agent runs table followed the API's `updatedAt desc` order, so the list reshuffled on every refresh and working runs could sit anywhere. Sort the rendered rows client-side: working/busy runs float to the top, everything else falls back to a natural, name-based order (numeric so #2 precedes #10), giving a stable table where the runs you care about are always up front. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related changes bundled together:
1. Add
@loreai/opencodeplugin to user configAdds Lore to
opencode-user-config.jsonso it loads by default. Lore replaces compaction with incremental distillation, giving steadier context use and better recall across long sessions (claimed +35pp accuracy and ~7x cheaper per correct answer on Sonnet 4 in the project's own benchmarks).2. Remove basic-auth env vars; document Cloudflare Access
HTTP Basic Auth is fundamentally broken on mobile: iOS Safari and Chrome on Android evict the credential cache aggressively (tab backgrounding, OS killing the browser, idle timeout), forcing a re-prompt every time you come back to the tab. There's no persistent cookie because basic auth doesn't issue one.
Drop
OPENCODE_SERVER_PASSWORDandOPENCODE_SERVER_USERNAMEfrom.env.exampleand the README env-vars table, and add a short## Authsection pointing at Cloudflare Access as the recommended way to front the public hostname. Access issues a long-livedCF_Authorizationcookie that mobile browsers keep across app kills and reboots.No Dockerfile or entrypoint changes required —
opencode webruns fine without the password env var.After deploying this version, the raw Railway domain becomes unauthenticated. Configure Cloudflare Access (or another auth proxy) in front of the public domain before exposing it.