feat(service-runner): unarmed engine spawn mode for the hub cutover (#955)

[aarontrowbridge]

What

Adds the unarmed engine spawn mode the hub cutover needs: the runner can spawn the vendored engine WITHOUT OPENCODE_SERVER_PASSWORD — the fork's exact deployed posture (the 2026-08-07 incident record: "canonical serves anonymous 200"; the SSH mesh is the boundary). The app-proxy forwards client requests verbatim, so an armed engine would 401 the fleet panel's anonymous calls.

Ref #955. Builds on #958 (the runner) + #959 (the service's auth mode) — the pair AMICODE_ENGINE_UNARMED=1 + AMICODE_SERVICE_AUTH=open is the hub posture.

The change

• AmicodeServiceRunnerOptions.engineUnarmed?: boolean (CLI env AMICODE_ENGINE_UNARMED=1 in amicode_service_runner_cli.ts):
  • the child env OMITS OPENCODE_SERVER_PASSWORD entirely (never empty — the fork's route auth engages on presence),
  • no credential is minted; the service receives enginePassword: undefined (its authMode still resolves independently via its own env passthrough),
  • the health probe goes anonymous in the posture,
  • the boot line names it: [service-runner] spawning engine … UNARMED (the hub's anonymous boundary posture),
  • boot.enginePassword is string | undefined (undefined in the posture).
• engineUnarmed wins over an explicit enginePassword — the posture is never silently half-armed.
• The armed default is byte-identical for every existing caller.

Tests (test/amicode_service_runner.test.ts)

• Headless, always-on (a shebang-node fake engine that answers the health probe and dumps whether the key was in its spawn env — asserted as seen BY THE CHILD):
  • unarmed spawn: no OPENCODE_SERVER_PASSWORD in the child env, boot.enginePassword === undefined, the UNARMED boot line, the service still boots and answers with its own mint,
  • unarmed wins over an explicit enginePassword,
  • the default (armed) path unchanged: the child env carries the key, the mint is surfaced.
• Live-gated per the The production service runner: one headless process for engine + service (#955) #958 convention (real vendored engine + built dist; honest skip otherwise): unarmed boot on a throwaway OPENCODE_DB + AMICODE_SERVICE_AUTH=open → an anonymous proxied GET /session answers 200.

Verification

• pnpm run typecheck green (all workspace packages).
• test/amicode_service_runner.test.ts: 9/9 green with the vendored engine + built app dist in the worktree (live rehearsal included).
• Full extension vitest suite: pre-existing failure set named against a clean-main baseline (identical on both): cli_gate ×1 (freshly-staged-bins, environment), editable_diffs_wiring ×2 (filename gradient CSS), terminal ×2 (OPENCODE_DB/CONFIG_DIR env injection). Everything else 3126+ passed. (A first pass also flagged packaging/yellow_chunks — reproduced as build-dirt artifacts, HAZARD chore(test): overlay-sync test applies to the local fork checkout's committed tree — point it at a temp tree #842: they pass on a clean tree with this change.)

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}