Merge: orphan-fix + isHealthy 401 + Makefile install targets

Three atomic commits delivering production fixes the user found
after PR #2 merged:

- fix(opencode) a29de6d: prevent orphan opencode-serve CPU spin on
  IDE quit. Removes '--print-logs' (which fueled an EPIPE storm in
  bun's logger callback when parent stdio pipes broke) and adds
  killStaleServer() pre-spawn guard that lsof/netstat-discovers and
  SIGKILLs any orphan holding port 5888 from a prior IDE run.
  Mirrors the well-behaved opencode-web-for-vscode ProcessManager.

- build 5594814: add make build/install/uninstall targets so the
  workflow 'make install' replaces the long manual gulp + cp dance.

- fix(opencode) b957102: isHealthy() must reject 401. Previously
  'response.statusCode === 401 || isHealthResponse(body)' allowed
  the manager to falsely adopt an orphan opencode-serve from a
  prior IDE session whose password no longer matched the new
  manager's password, causing the SPA to load with 'Error:
  Unauthorized'. Strict 200-only health check makes doStart() fall
  through to killStaleServer() in this case.

Local: 31/31 unit tests pass; user verified 'quit + restart' no
longer leaves orphans or 401s.

Author: cpkt9762

Makefile

@@ -6,6 +6,10 @@ REPO := $(abspath $(ROOT)/..)
 SPA_SRC := $(REPO)/packages/app
 SPA_DIST := $(SPA_SRC)/dist
 SPA_DST := $(ROOT)/src/vs/workbench/contrib/opencode/media/spa
+APP_NAME    := OpenCode IDE
+APP_BUNDLE  := $(APP_NAME).app
+BUILD_OUT   := $(REPO)/VSCode-darwin-arm64/$(APP_BUNDLE)
+INSTALL_DST := /Applications/$(APP_BUNDLE)
 NVM_SETUP := source $$HOME/.nvm/nvm.sh && nvm use 22
 
 .PHONY: help
@@ -25,6 +29,11 @@ help:
 	@echo "  Run:"
 	@echo "    make run           launch dev build via scripts/code.sh"
 	@echo ""
+	@echo "  Install:"
+	@echo "    make build         build .app via gulp vscode-darwin-arm64"
+	@echo "    make install       compile + build + cp .app to /Applications (with backup)"
+	@echo "    make uninstall     restore the most recent /Applications/<app>.bak.*"
+	@echo ""
 	@echo "  Test:"
 	@echo "    make smoke         run full smoke suite"
 	@echo "    make smoke-opencode smoke filtered to OpenCode tests"
@@ -82,3 +91,33 @@ typecheck:
 clean:
 	rm -rf out/ node_modules/*cache
 	@echo ">> Removed out/ and node_modules/*cache"
+
+.PHONY: build
+build:
+	@echo ">> gulp vscode-darwin-arm64..."
+	bash -lc '$(NVM_SETUP) && NODE_OPTIONS=--max-old-space-size=8192 npx gulp vscode-darwin-arm64'
+	@test -d "$(BUILD_OUT)" || { echo "ERROR: $(BUILD_OUT) not produced"; exit 1; }
+	@echo ">> Built: $(BUILD_OUT)"
+
+.PHONY: install
+install: compile build
+	@if [ -d "$(INSTALL_DST)" ]; then \
+		BACKUP="$(INSTALL_DST).bak.$$(date +%Y%m%d-%H%M%S)"; \
+		echo ">> Backing up $(INSTALL_DST) → $$BACKUP"; \
+		mv "$(INSTALL_DST)" "$$BACKUP"; \
+	fi
+	@echo ">> Installing $(BUILD_OUT) → $(INSTALL_DST)"
+	cp -R "$(BUILD_OUT)" "$(INSTALL_DST)"
+	@stat -f ">> Installed at: %Sm" "$(INSTALL_DST)/Contents/Info.plist"
+	@/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$(INSTALL_DST)/Contents/Info.plist" | xargs -I{} echo ">> Version: {}"
+
+.PHONY: uninstall
+uninstall:
+	@LATEST=$$(ls -1dt "$(INSTALL_DST).bak."* 2>/dev/null | head -1); \
+	if [ -z "$$LATEST" ]; then \
+		echo "ERROR: No backup found matching $(INSTALL_DST).bak.*"; exit 1; \
+	fi; \
+	echo ">> Restoring backup: $$LATEST"; \
+	rm -rf "$(INSTALL_DST)"; \
+	mv "$$LATEST" "$(INSTALL_DST)"; \
+	echo ">> Restored: $(INSTALL_DST)"

src/vs/workbench/contrib/opencode/electron-main/opencodeServeManager.ts

@@ -182,6 +182,7 @@ export class OpencodeServeManager
 			this.password ??
 			randomBytes(16).toString("hex");
 
+		const port = this.getPort();
 		const backendUrl = this.getConfiguredBackendUrl();
 		if (await this.isHealthy(backendUrl, this.password)) {
 			this.state = "running";
@@ -194,14 +195,15 @@ export class OpencodeServeManager
 			return backendUrl;
 		}
 
+		await this.killStaleServer(port);
+
 		const binaryPath = this.findBinaryPath();
 		if (!binaryPath) {
 			throw new Error(
 				"Failed to find an opencode binary. Configure opencode.binaryPath or add opencode to PATH.",
 			);
 		}
 
-		const port = this.getPort();
 		const deadline = Date.now() + STARTUP_TIMEOUT;
 		const env = { ...process.env };
 		delete env.OPENCODE_SERVER_PASSWORD;
@@ -214,7 +216,6 @@ export class OpencodeServeManager
 				"127.0.0.1",
 				"--port",
 				String(port),
-				"--print-logs",
 			],
 			{
 				env,
@@ -393,7 +394,7 @@ export class OpencodeServeManager
 	): Promise<boolean> {
 		try {
 			const response = await this.readHealth(url, password);
-			return response.statusCode === 401 || isHealthResponse(response.body);
+			return isHealthResponse(response.body);
 		} catch {
 			return false;
 		}
@@ -494,6 +495,73 @@ export class OpencodeServeManager
 		return undefined;
 	}
 
+	protected async killStaleServer(port: number): Promise<void> {
+		const url = `http://127.0.0.1:${port}/`;
+
+		try {
+			if (await this.isHealthy(url, this.password)) {
+				return;
+			}
+		} catch {
+			// Treat any error as not healthy.
+		}
+
+		const pid = await this.findProcessOnPort(port);
+		if (pid === undefined) {
+			return;
+		}
+
+		this.logService.warn("[opencode] killing stale process holding port", {
+			pid,
+			port,
+		});
+		try {
+			process.kill(pid, "SIGKILL");
+		} catch (error) {
+			this.logService.warn("[opencode] failed to kill stale process", {
+				pid,
+				error,
+			});
+			return;
+		}
+
+		await this.sleep(500);
+	}
+
+	protected async findProcessOnPort(port: number): Promise<number | undefined> {
+		if (platform() === "win32") {
+			try {
+				const output = execSync("netstat -ano -p tcp", { encoding: "utf8" });
+				const re = new RegExp(
+					`\\s127\\.0\\.0\\.1:${port}\\s+\\S+\\s+LISTENING\\s+(\\d+)$`,
+				);
+				for (const line of output.split(/\r?\n/)) {
+					const match = re.exec(line);
+					if (match) {
+						return Number(match[1]);
+					}
+				}
+				return undefined;
+			} catch {
+				return undefined;
+			}
+		}
+
+		try {
+			const output = execSync(`lsof -t -iTCP:${port} -sTCP:LISTEN`, {
+				encoding: "utf8",
+			}).trim();
+			if (!output) {
+				return undefined;
+			}
+
+			const pid = Number(output.split(/\r?\n/)[0]);
+			return Number.isFinite(pid) ? pid : undefined;
+		} catch {
+			return undefined;
+		}
+	}
+
 	private resolveConfiguredBinaryPath(
 		configuredPath: string,
 	): string | undefined {

src/vs/workbench/contrib/opencode/test/electron-main/opencodeServeManager.test.ts

@@ -148,6 +148,12 @@ class TestableOpencodeServeManager extends OpencodeServeManager {
 
 		return this.nextProcess as unknown as ChildProcess;
 	}
+	protected override async killStaleServer(_port: number): Promise<void> {
+		// No-op in tests: real lsof/netstat lookup would find the mock HTTP backend in this process.
+	}
+	protected override async findProcessOnPort(_port: number): Promise<number | undefined> {
+		return undefined;
+	}
 	get testState() { return this._testState; }
 	get testWeStarted() { return this._testWeStarted; }
 }
@@ -263,7 +269,7 @@ suite('OpencodeServeManager / lifecycle', () => {
 
 		assert.strictEqual(url, `http://127.0.0.1:${backend.port}`);
 		assert.strictEqual(manager.spawnCalls.length, 1);
-		assert.deepStrictEqual(manager.spawnCalls[0].args, ['serve', '--hostname', '127.0.0.1', '--port', String(backend.port), '--print-logs']);
+		assert.deepStrictEqual(manager.spawnCalls[0].args, ['serve', '--hostname', '127.0.0.1', '--port', String(backend.port)]);
 		assert.strictEqual(manager.spawnCalls[0].options.env?.OPENCODE_SERVER_PASSWORD, manager.getPassword());
 		assert.deepStrictEqual(manager.spawnCalls[0].options.stdio, ['ignore', 'pipe', 'pipe']);
 		assert.strictEqual(spawn.calls.length, 0);
@@ -415,11 +421,11 @@ suite('OpencodeServeManager / health checks', () => {
 		assert.strictEqual(await internals(manager).isHealthy(`http://127.0.0.1:${backend.port}`, undefined), true);
 	});
 
-	test('isHealthy returns true on HTTP 401 (auth required = server alive)', async () => {
+	test('isHealthy returns false on HTTP 401 (auth required but wrong credentials)', async () => {
 		backend = await mockBackend({ status: 401 });
 		manager = new TestableOpencodeServeManager(configuration(), new NullLogService());
 
-		assert.strictEqual(await internals(manager).isHealthy(`http://127.0.0.1:${backend.port}`, undefined), true);
+		assert.strictEqual(await internals(manager).isHealthy(`http://127.0.0.1:${backend.port}`, undefined), false);
 	});
 
 	test('isHealthy returns false on HTTP 500', async () => {