Skip to content

feat: migrate opencode storage from JSON files to SQLite #724

feat: migrate opencode storage from JSON files to SQLite

feat: migrate opencode storage from JSON files to SQLite #724

Triggered via pull request February 14, 2026 17:26
Status Failure
Total duration 5m 48s
Artifacts 5

test.yml

on: pull_request
Matrix: test
Fit to window
Zoom out
Zoom in

Annotations

5 errors and 3 warnings
test (4)
Process completed with exit code 1.
test/worker/server.test.ts > Worker Server Integration > discovers OpenCode sessions with message counts: test/worker/server.test.ts#L124
AssertionError: expected undefined to be defined ❯ test/worker/server.test.ts:124:29
Command injection in searchHostSessions query parameter: src/agent/router.ts#L1289
The safeQuery sanitization at line 1289 only escapes quotes and backslashes but misses shell metacharacters like backticks, $(), |, &, ;. An attacker could inject commands via the search query.
OpenCode sessions no longer searchable after SQLite migration: src/agent/router.ts#L1335
The search functionality for OpenCode sessions was removed when migrating from JSON files to SQLite. The `searchHostSessions` function no longer includes the opencode path, and no SQLite-based search was added to replace it. Users cannot search OpenCode session content.
Parser still uses old JSON file storage for OpenCode: src/worker/session-index.ts#L456
listOpenCodeSessions/getOpenCodeSessionDetail read from .local/share/opencode/storage/* (old path) instead of SQLite. Called by listAllSessions used in mobile app. Will return empty/stale data.
e2e
No files were found with the provided path: playwright-report/. No artifacts will be uploaded.
OpenCode sessions no longer searchable after SQLite migration: src/agent/router.ts#L1290
Removed OpenCode storage path from searchPaths but didn't add SQL-based search. OpenCode is still a valid agentType in return signature but cannot be found by search.
Potential orphaned database records on session deletion: src/worker/session-index.ts#L135
DELETE only removes session record, not related message/part records. May leak data unless schema has CASCADE DELETE.

Artifacts

Produced during runtime
Name Size Digest
dist Expired
39.4 MB
sha256:3d546b73fdc11726074864ad035ca1d7837b5523e1c7ee09ab5619f0d659c06e
docker-image Expired
1.09 GB
sha256:1b0cbb98dced364e25ff8c1adfbed296a88861be7e12e5590d86754aea4942d1
gricha~perry~5Y3MIM.dockerbuild
72.2 KB
sha256:80889af464f89952740035c72b96793f6897c53123a0b3d5173d0b1b663a760c
gricha~perry~YLF214.dockerbuild
41.6 KB
sha256:c1bb6dda9622d6a4cbb82249e657c067397e453804cf8e017aa039094708397a
playwright-report Expired
196 KB
sha256:e5a97f533098cbfe8bdb1cf80459fc659db2793e5cfaa74d11e3b4a469abc852