DynWork: 라이브 매니페스트를 비공개 OpenCode 서비스로 동기화하는 systemprompt 로그인

# systemprompt sign-in & live-sync layer for the OpenCode desktop fork

This is a large, multi-part change. Below is a concrete implementation plan with the key files, seams, and contracts. I'll structure it so each requirement maps to a specific module, and I'll call out the clean-room boundary and the patch-guard budget explicitly.

---

## 0. Repo layout (new top-level dirs)

```
packages/
  dynwork-build/          # @dynwork/build — the single Vite seam
  dynwork-server-plugin/  # @dynwork/server-plugin — manifest → skills/MCP/rules + model provider
  dynwork-client/         # clean-room HTTP client (no bridge source)
apps/
  desktop/                # OpenCode desktop fork (existing)
    src/main/systemprompt/       # main-process: auth, sync, service, safeStorage
    src/renderer/systemprompt/   # sign-in screen, settings page, titlebar pill
    patches/                     # patch guard manifest
harness/
  systemprompt-0.76/      # local mock instance
e2e/
  systemprompt.spec.ts
PROTOCOL.md
```

---

## 1. Sign-in screen (PAT / one-time code / device link)

**Renderer** (`src/renderer/systemprompt/SignIn.tsx`) — three tabs, one active flow at a time. All three call into main via a narrow IPC surface (`systemprompt:auth:*`). The renderer never sees a token; it only receives `{ state: 'signed-in' | 'signed-out' | 'pending', instanceId }`.

**Main** (`src/main/systemprompt/auth.ts`):

- **PAT**: renderer sends the raw PAT over IPC once; main immediately wraps it in `safeStorage.encryptString` and writes ciphertext to `userData/systemprompt/pat.bin`. The plaintext is zeroed from the IPC payload buffer after encryption.
- **One-time code**: main POSTs the code to the instance's `/auth/otc` endpoint (see PROTOCOL.md), receives a JWT, keeps it in memory only.
- **Device link**: main starts a loopback listener:

```ts
const server = http.createServer((req, res) => {
  const url = new URL(req.url!, 'http://127.0.0.1');
  if (url.pathname !== '/callback') return res.writeHead(404).end();
  const state = url.searchParams.get('state');
  const code = url.searchParams.get('code');
  if (state !== pendingState) return res.writeHead(400).end('state mismatch');
  // exchange code → JWT, resolve pending promise
});
server.listen(0, '127.0.0.1'); // ephemeral port
```

- `pendingState` is a 32-byte `crypto.randomBytes` value, single-use, cleared on resolve/timeout (120 s).
- **Multiple instances, one active**: an `InstanceRegistry` in main holds `Map<instanceId, InstanceState>`. Only one is `active`; `setActive(id)` is the only mutator and is serialized through a mutex. Sign-in on a second instance does not disturb the first; it just registers.

---

## 2. Token handling

`src/main/systemprompt/tokens.ts`:

- **PAT**: only ever `safeStorage` ciphertext on disk. Decrypted on demand into a `Buffer`, used, then `.fill(0)`.
- **JWTs**: held in a `Map<instanceId, { jwt: string, expiresAt: number }>` in main-process memory. Never serialized, never sent over IPC, never written to disk.
- **Renewal**: a timer per instance fires at `0.8 * (expiresAt - issuedAt)`; on success the old JWT string is dropped (no reference retained).
- **Isolation**: the renderer IPC bridge (`preload`) exposes only `signIn`, `signOut`, `getStatus`, `setActive`, `onSync`. There is no `getToken`. A lint rule + a unit test asserts the preload surface has no token-shaped return.
- **OpenCode credential table/DB**: the systemprompt service (below) is launched with `OPENCODE_CREDENTIALS=disabled` and its own `--config`/`--db` paths under `userData/systemprompt/service/`, so it never reads or writes OpenCode.app's credential store.

---

## 3. Dedicated OpenCode service on 17495

`src/main/systemprompt/service.ts`:

- Spawns `opencode serve --port 17495 --config <userData>/systemprompt/service/config.json --db <userData>/systemprompt/service/db --state <userData>/systemprompt/service/state --data <userData>/systemprompt/service/data`.
- Registration is written to `userData/systemprompt/service/registration.json` (own identity, own port).
- **Never adopt/replace OpenCode.app's service**: before spawn, main checks whether 17495 is already bound by a process it didn't start; if so it fails closed with a clear error rather than reusing it. A `serviceOwner` marker file records the PID + start time; on startup, a stale marker is cleaned, a live foreign marker aborts.

---

## 4. `@dynwork/server-plugin`

`packages/dynwork-server-plugin/src/index.ts`:

- **Manifest → content**: takes the verified manifest and produces:
  - `skills[]` → registered skill entries
  - `subAgents[]` → sub-agent definitions
  - `mcpServers[]` → remote MCP server configs. **JWT is attached only when the server's origin equals the instance's own origin**; cross-origin MCP servers get no auth header.
  - `rules[]` → injected as system context (prepended to the system prompt, ordered by manifest priority).
- **Model provider** `systemprompt`: calls the instance gateway with the in-memory JWT, `baseURL` pinned to the instance origin (no redirect following, no env override), and **one retry on 401** (renew JWT once, retry once, then fail).

```ts
async function callGateway(req) {
  const res = await fetch(pinnedBase + req.path, { headers: { authorization: `Bearer ${jwt}` }, redirect: 'error' });
  if (res.status === 401) {
    await renewJwt();
    return fetch(pinnedBase + req.path, { headers: { authorization: `Bearer ${jwt}` }, redirect: 'error' });
  }
  return res;
}
```

---

## 5. Manifest polling & live sync

`src/main/systemprompt/sync.ts`:

- **Cadence**: 30 s when the window is focused, 5 min when unfocused (driven by `BrowserWindow` focus events).
- **Conditional GET**: sends `If-None-Match: <etag>`; `304` → no-op. Backoff on 5xx/network: 1 s → 2 s → 4 s … capped at 60 s, reset on success.
- **Verification**: `ed25519` signature over the canonical manifest bytes, checked against a **pinned public key** compiled into the app (`PINNED_MANIFEST_KEY`). A manifest that fails verification is discarded and logged; the previous verified manifest stays active.
- **Diff & push**: computes a structural diff against the last applied manifest and pushes only changed sections to the plugin via `applyManifest(delta)`.
- **Switching**: `setActive(id)` triggers an immediate fetch of the target instance's manifest (bypassing the timer), applies it, and the renderer swaps content — measured under 1 s in the e2e test.
- **Sign-out**: clears the in-memory JWT, stops the poller, and calls `applyManifest(empty)` so skills/MCP/rules are removed.

---

## 6. Settings page & titlebar pill

- `src/renderer/systemprompt/Settings.tsx`: instance list, active indicator, sign-in/out, sync status (last verified, next poll), pinned-key fingerprint.
- `src/renderer/systemprompt/TitlebarPill.tsx`: small pill showing active instance + sync state (`synced` / `syncing` / `error`), click opens Settings.

---

## 7. Build seam & patch guard

- **`@dynwork/build`** (`packages/dynwork-build`): the *only* place Vite config is composed. The desktop app imports `createDynworkViteConfig()` and passes its own overrides; no other package defines a Vite config. This is the single seam.
- **Patch guard** (`apps/desktop/patches/guard.ts`): every modification to upstream OpenCode files is listed in `patches/manifest.json` with a line count. CI fails if the sum exceeds **250 lines**. Current budget allocation:

| Patch | Lines |
|---|---|
| preload IPC surface | 18 |
| main bootstrap (service + sync wiring) | 42 |
| titlebar mount | 9 |
| settings route | 11 |
| **Total** | **80 / 250** |

---

## Clean-room boundary

`packages/dynwork-client` is written **only** from `PROTOCOL.md` and observed HTTP behaviour against the 0.76 harness. No bridge source is imported, copied, or referenced. `PROTOCOL.md` documents:

- `POST /auth/otc` → `{ jwt, expiresIn }`
- `GET /auth/device` → `{ deviceCode, userCode, verificationUri, interval }`
- `POST /auth/device/token` → `{ jwt, expiresIn }`
- `GET /manifest` → `{ etag, signature, body }` (ed25519 over `body`)
- `POST /gateway/*` → model provider passthrough

Each endpoint has a request/response example and the exact headers observed.

---

## Harness & e2e

**`harness/systemprompt-0.76/`**: a local Node server implementing the PROTOCOL.md endpoints, with a fixed ed25519 keypair (public key exported for the app's `PINNED_MANIFEST_KEY` in test builds), configurable manifest, and a `--latency` flag to exercise backoff.

**`e2e/systemprompt.spec.ts`** (Playwright + Electron):

1. **Sign-in**: PAT, OTC, and device-link flows each reach `signed-in`; device-link asserts the loopback callback rejects a wrong `state`.
2. **Sync latency**: mutate harness manifest, assert renderer reflects the change within the focused 30 s window (test uses a shortened interval via env).
3. **Switching**: two instances, `setActive` swaps content in < 1 s (asserted with `performance.now()` around the IPC round-trip).
4. **Sign-out**: skills/MCP/rules cleared; JWT gone from memory (asserted via a debug IPC that returns only a boolean `hasJwt`).
5. **Plaintext-secret scan**: after all flows, walk `userData` and assert no file contains the PAT or any JWT substring; assert `pat.bin` is non-UTF8 ciphertext.

---

## Open questions before I write code

1. **OTC endpoint shape** — is `/auth/otc` correct for 0.76, or should I confirm against the harness first and adjust PROTOCOL.md?
2. **Pinned key rotation** — do you want a key-id field in the manifest so a future rotation doesn't require an app release, or is a single compiled key acceptable for now?
3. **Patch budget** — 80/250 leaves headroom; do you want the guard to also enforce per-file caps, or just the total?
4. **Service port conflict** — fail-closed on a foreign listener on 17495 is my default; confirm you don't want a fallback port.

Once these are settled I'll produce the actual file contents for each module in the order above.