Keep service passwords out of repr and search only PATH for the command

BasicAuth and the registration record hide their password from repr, so
endpoints can be logged safely. The service command is resolved from PATH
entries only: shutil.which on Windows also tries the current directory,
which Node's spawn does not.

Author: shrijayan

src/opencode/_service.py

@@ -78,8 +78,8 @@ class BasicAuth:
 
     username: str
     """Basic auth user name, always ``opencode``."""
-    password: str
-    """The service's private password."""
+    password: str = field(repr=False)
+    """The service's private password. Hidden from ``repr`` so it stays out of logs."""
 
 
 @dataclass(frozen=True)
@@ -101,7 +101,7 @@ class _Info:
     pid: int
     id: str | None = None
     version: str | None = None
-    password: str | None = None
+    password: str | None = field(default=None, repr=False)
 
 
 @dataclass(frozen=True)
@@ -540,7 +540,7 @@ class _Contender:
     def __init__(self, command: Sequence[str], env: Mapping[str, str | None]) -> None:
         merged = {**os.environ, **env}
         environment = {key: value for key, value in merged.items() if value is not None}
-        executable = shutil.which(command[0]) or command[0]
+        executable = _resolve(command[0])
         if sys.platform == "win32":  # pragma: no cover - Windows only
             self.process = subprocess.Popen(
                 [executable, *command[1:]],
@@ -604,6 +604,20 @@ def failure(self) -> ServiceError | None:
         return _startup_error(f"Server process terminated by {name}", self.stderr())
 
 
+def _resolve(command: str) -> str:
+    """Find ``command`` on ``PATH`` only.
+
+    ``shutil.which`` on Windows also searches the current directory first, which Node's spawn in the TypeScript
+    client does not, so a planted ``opencode.exe`` there could run. A command with a directory part is used as is.
+    """
+    if os.path.dirname(command):
+        return command
+    for directory in os.environ.get("PATH", os.defpath).split(os.pathsep):
+        if directory and (found := shutil.which(os.path.join(directory, command))) is not None:
+            return found
+    return command
+
+
 def _startup_error(message: str, stderr: str) -> ServiceError:
     return ServiceError(f"{message}\n{stderr}" if stderr else message)
 

tests/test_service.py

@@ -271,3 +271,19 @@ def test_probe_timeout_is_reported(file: Path) -> None:
         registration = impl._registered(file, 0.1)
     assert registration.timed_out
     assert registration.service is None
+
+
+def test_resolve_searches_path_only(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    bin_dir, cwd = tmp_path / "bin", tmp_path / "cwd"
+    bin_dir.mkdir()
+    cwd.mkdir()
+    name = "tool.exe" if sys.platform == "win32" else "tool"
+    for folder in (bin_dir, cwd):
+        (folder / name).write_text("")
+        (folder / name).chmod(0o755)
+    monkeypatch.chdir(cwd)
+    monkeypatch.setenv("PATH", str(bin_dir))
+    assert Path(impl._resolve("tool")).parent == bin_dir
+    monkeypatch.setenv("PATH", "")
+    assert impl._resolve("tool") == "tool"
+    assert impl._resolve(str(cwd / name)) == str(cwd / name)