harden: pre-release audit fixes (serve no-store, CLI binary threading, Rust env fallback)

Three SHOULD-FIX gaps from the pre-release audit (no blockers found):

1. serve /api responses now carry Cache-Control: no-store. The shared security
   middleware set CSP/Referrer/nosniff but not no-store, so /api/invoke results
   (transcripts, config, mutation results) were cacheable. Added an /api-scoped
   no-store layer (static hashed assets stay cacheable). +test asserting no-store
   on both a 200 result and an error response.

2. CLI model/version discovery now uses the resolved binary path. detectOpenCode
   can return an absolute binary not on PATH (stock ~/.opencode/bin, a shim), but
   getOpenCodeVersion/getAvailableModels shelled out to bare opencode, so such
   installs fell back to manual entry. Threaded detection.binary through via
   execFile. +test with a real executable stub.

3. Rust Desktop detection no longer misreports a Desktop user as none when env
   vars are unset. from_process now falls back home, USERPROFILE, dirs::home_dir
   and derives Windows AppData/Local from home when the env vars are absent,
   matching the TS fallbacks. Extracted OpencodeDesktopEnv::resolve for a test.

Audit confirmed clean (no change needed): serve auth/Host/Origin/body-limit,
guard preservation, command parity, doctor plugin-cache, TUI badge color.

Gate: dashboard Rust 225/0, CLI 226/0, tsc + biome clean across both.

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: ualtinok

packages/cli/src/commands/setup-opencode.ts

@@ -269,7 +269,7 @@ export async function runSetup(dryRun = false): Promise<number> {
             "Model auto-discovery needs the OpenCode CLI; you will enter models manually. Install the CLI to auto-populate: https://opencode.ai",
         );
     } else {
-        const version = getOpenCodeVersion();
+        const version = getOpenCodeVersion(detection.binary);
         s.stop(`OpenCode ${version ?? ""} detected`);
     }
 
@@ -278,8 +278,9 @@ export async function runSetup(dryRun = false): Promise<number> {
 
     // Only the CLI can enumerate the authed/resolved model list; Desktop-only
     // installs have no on-disk equivalent, so models stay empty and the model
-    // prompts fall back to free-text entry.
-    const allModels = detection.kind === "cli" ? getAvailableModels() : [];
+    // prompts fall back to free-text entry. Use the resolved binary path so a
+    // stock CLI that is not on PATH still enumerates.
+    const allModels = detection.kind === "cli" ? getAvailableModels(detection.binary) : [];
     if (allModels.length > 0) {
         s.stop(`Found ${allModels.length} models`);
     } else {

packages/cli/src/lib/diagnostics-opencode.ts

@@ -726,7 +726,9 @@ export async function collectDiagnostics(): Promise<DiagnosticReport> {
 
     const conflictResult = detectConflicts(process.cwd());
     const recentSessions = await collectRecentSessions();
-    const openCodeInstallKind = detectOpenCode().kind;
+    const openCodeDetection = detectOpenCode();
+    const openCodeInstallKind = openCodeDetection.kind;
+    const openCodeBinary = openCodeDetection.kind === "cli" ? openCodeDetection.binary : null;
 
     return {
         timestamp: new Date().toISOString(),
@@ -736,7 +738,7 @@ export async function collectDiagnostics(): Promise<DiagnosticReport> {
         pluginVersion,
         opencodeInstalled: openCodeInstallKind !== "none",
         opencodeInstallKind: openCodeInstallKind,
-        opencodeVersion: getOpenCodeVersion(),
+        opencodeVersion: getOpenCodeVersion(openCodeBinary),
         configPaths,
         opencodeConfigHasPlugin: configHasPluginEntry(opencodeConfig.value),
         tuiConfigHasPlugin: configHasPluginEntry(tuiConfig.value),

packages/cli/src/lib/opencode-helpers.test.ts

@@ -0,0 +1,44 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getAvailableModels, getOpenCodeVersion } from "./opencode-helpers";
+
+// These assert that a RESOLVED absolute binary path is actually invoked (the
+// #196 follow-up: a stock CLI not on PATH must still enumerate). POSIX-only:
+// the test writes an executable shell stub, which CI runs on Linux/macOS.
+const isPosix = process.platform !== "win32";
+const tempDirs: string[] = [];
+
+afterEach(() => {
+    for (const dir of tempDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+function fakeOpencode(body: string): string {
+    const dir = mkdtempSync(join(tmpdir(), "mc-oc-bin-"));
+    tempDirs.push(dir);
+    const bin = join(dir, "opencode");
+    writeFileSync(bin, `#!/bin/sh\n${body}\n`);
+    chmodSync(bin, 0o755);
+    return bin;
+}
+
+describe.if(isPosix)("opencode helpers with a resolved binary path", () => {
+    it("getAvailableModels invokes the given absolute binary", () => {
+        const bin = fakeOpencode(
+            'if [ "$1" = "models" ]; then printf "anthropic/claude-opus-4-8\\nopenai/gpt-5.5\\n"; fi',
+        );
+        expect(getAvailableModels(bin)).toEqual(["anthropic/claude-opus-4-8", "openai/gpt-5.5"]);
+    });
+
+    it("getOpenCodeVersion invokes the given absolute binary", () => {
+        const bin = fakeOpencode('if [ "$1" = "--version" ]; then echo "1.2.3"; fi');
+        expect(getOpenCodeVersion(bin)).toBe("1.2.3");
+    });
+
+    it("returns empty / null when the binary path does not exist", () => {
+        const missing = join(tmpdir(), "definitely-not-a-real-opencode-binary-xyz");
+        expect(getAvailableModels(missing)).toEqual([]);
+        expect(getOpenCodeVersion(missing)).toBeNull();
+    });
+});

packages/cli/src/lib/opencode-helpers.ts

@@ -1,21 +1,33 @@
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 
-export function getOpenCodeVersion(): string | null {
+/**
+ * Run `opencode <args>`. If a `binary` path is given (an absolute path resolved
+ * for a stock `~/.opencode/bin` install or a version-manager shim that is not on
+ * PATH), call that exact path via execFile; otherwise fall back to a bare
+ * `opencode` on PATH.
+ */
+function runOpenCode(args: string[], binary?: string | null): string | null {
     try {
-        return execSync("opencode --version", { stdio: "pipe" }).toString().trim();
+        if (binary) {
+            return execFileSync(binary, args, { stdio: "pipe" }).toString().trim();
+        }
+        return execSync(`opencode ${args.join(" ")}`, { stdio: "pipe" })
+            .toString()
+            .trim();
     } catch {
         return null;
     }
 }
 
-export function getAvailableModels(): string[] {
-    try {
-        const output = execSync("opencode models", { stdio: "pipe" }).toString().trim();
-        return output
-            .split("\n")
-            .map((l) => l.trim())
-            .filter(Boolean);
-    } catch {
-        return [];
-    }
+export function getOpenCodeVersion(binary?: string | null): string | null {
+    return runOpenCode(["--version"], binary);
+}
+
+export function getAvailableModels(binary?: string | null): string[] {
+    const output = runOpenCode(["models"], binary);
+    if (output === null) return [];
+    return output
+        .split("\n")
+        .map((l) => l.trim())
+        .filter(Boolean);
 }

packages/dashboard/src-tauri/src/commands.rs

@@ -584,12 +584,39 @@ struct OpencodeDesktopEnv {
 
 impl OpencodeDesktopEnv {
     fn from_process() -> Self {
+        let home = env_path("HOME")
+            .or_else(|| env_path("USERPROFILE"))
+            .or_else(dirs::home_dir);
+        Self::resolve(
+            home,
+            env_path("APPDATA"),
+            env_path("LOCALAPPDATA"),
+            env_path("XDG_CONFIG_HOME"),
+            env_path("XDG_DATA_HOME"),
+        )
+    }
+
+    /// Derive the env from already-resolved roots. Falls back to home-derived
+    /// Windows AppData roots when those env vars are unset, so a Desktop user is
+    /// never misreported as having no OpenCode install just because %APPDATA% /
+    /// %LOCALAPPDATA% are absent in this process environment. Kept in lockstep
+    /// with the CLI's opencode-detect.ts fallbacks.
+    fn resolve(
+        home: Option<PathBuf>,
+        appdata: Option<PathBuf>,
+        localappdata: Option<PathBuf>,
+        xdg_config_home: Option<PathBuf>,
+        xdg_data_home: Option<PathBuf>,
+    ) -> Self {
+        let appdata = appdata.or_else(|| home.as_ref().map(|h| h.join("AppData").join("Roaming")));
+        let localappdata =
+            localappdata.or_else(|| home.as_ref().map(|h| h.join("AppData").join("Local")));
         Self {
-            home: env_path("HOME"),
-            appdata: env_path("APPDATA"),
-            localappdata: env_path("LOCALAPPDATA"),
-            xdg_config_home: env_path("XDG_CONFIG_HOME"),
-            xdg_data_home: env_path("XDG_DATA_HOME"),
+            home,
+            appdata,
+            localappdata,
+            xdg_config_home,
+            xdg_data_home,
             mac_system_applications: PathBuf::from("/Applications"),
         }
     }
@@ -1287,6 +1314,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn windows_desktop_marker_detected_when_appdata_env_unset() {
+        // With %APPDATA% unset but home known, the Windows userData marker must
+        // still resolve from the home-derived AppData/Roaming fallback.
+        let dir = tempfile::tempdir().expect("tempdir");
+        let home = dir.path().join("home");
+        let env = OpencodeDesktopEnv::resolve(Some(home.clone()), None, None, None, None);
+        write_file(
+            home.join("AppData")
+                .join("Roaming")
+                .join(OPENCODE_DESKTOP_APP_IDS[0])
+                .join("opencode.settings"),
+        );
+        assert!(opencode_desktop_detected_for_env(
+            DesktopPlatform::Windows,
+            &env
+        ));
+    }
+
     #[test]
     fn opencode_desktop_settings_marker_detects_each_channel() {
         for app_id in OPENCODE_DESKTOP_APP_IDS {

packages/dashboard/src-tauri/src/serve/mod.rs

@@ -149,6 +149,10 @@ pub fn build_router(app_state: Arc<AppState>, options: &ServeOptions, token: Str
         .route("/invoke", post(invoke_handler))
         .route("/*path", any(api_not_found))
         .route_layer(middleware::from_fn_with_state(state.clone(), api_guard))
+        // /api responses carry transcripts, config, and mutation results: never
+        // let a browser (or intermediary) cache them. Static hashed assets stay
+        // cacheable; only this sub-tree is marked no-store.
+        .layer(middleware::from_fn(add_no_store_header))
         .layer(DefaultBodyLimit::max(MAX_JSON_BODY_BYTES));
 
     Router::new()
@@ -264,6 +268,15 @@ async fn add_security_headers(request: Request, next: Next) -> Response {
     response
 }
 
+async fn add_no_store_header(request: Request, next: Next) -> Response {
+    let mut response = next.run(request).await;
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        header::HeaderValue::from_static("no-store"),
+    );
+    response
+}
+
 async fn index_handler() -> Response {
     index_response()
 }
@@ -746,6 +759,29 @@ mod tests {
         assert_eq!(body["error"], "Unknown command");
     }
 
+    #[tokio::test]
+    async fn api_responses_are_marked_no_store() {
+        let server = spawn_test_server().await;
+
+        // A successful command response carries data and must not be cached.
+        let ok = invoke(&server, json!({ "cmd": "get_db_health", "args": {} })).await;
+        assert_eq!(
+            ok.headers()
+                .get(reqwest::header::CACHE_CONTROL)
+                .map(|v| v.to_str().unwrap().to_string()),
+            Some("no-store".to_string()),
+        );
+
+        // Error responses are no-store too (they can echo arguments back).
+        let err = invoke(&server, json!({ "cmd": "missing_command", "args": {} })).await;
+        assert_eq!(
+            err.headers()
+                .get(reqwest::header::CACHE_CONTROL)
+                .map(|v| v.to_str().unwrap().to_string()),
+            Some("no-store".to_string()),
+        );
+    }
+
     #[tokio::test]
     async fn route_read_command_returns_json_200() {
         let server = spawn_test_server().await;