@aitne/daemon 0.1.7 → 0.1.8

package/dist/core/backends/opencode-config-builder.d.ts

@@ -0,0 +1,86 @@
+/**
+ * docs/design/appendices/opencode-backend.md §5.1 / §5.8 / Phase 3 — assemble the
+ * complete `OpencodeRuntimeConfig` envelope a session needs.
+ *
+ * Inputs (already normalised by caller):
+ *   - `modelId`: provider/model composite from the BackendRouter.
+ *   - `executionMode`: per-backend Safe/Allow posture.
+ *   - `disallowedTools`: per-session denylist (Claude-shaped).
+ *   - `allowedToolsOverride`: dashboard widen list (Claude-shaped) or null.
+ *   - `mcpRender`: result of `renderOpencodeMcp` — the per-session `mcp`
+ *     map plus warnings the dashboard surfaces.
+ *
+ * Outputs:
+ *   - `config`: the envelope to pass through to `serverManager.ensureConfig()`
+ *     (which hashes it and bounces the server if it differs from the
+ *     running hash). Per §5.1 the daemon ALWAYS emits a full self-contained
+ *     JSON — no field is left to the merge layer.
+ *   - `warnings`: collected from both translators so the dashboard can
+ *     show the operator which entries opencode can't express verbatim.
+ *
+ * Self-contained invariant: every field on `OpencodeRuntimeConfig` is
+ * explicit (or deliberately omitted) so the daemon's behaviour does not
+ * depend on the merge-vs-replace semantics of `OPENCODE_CONFIG_CONTENT`
+ * (§10 D1, deferred). This means a same-envelope second turn produces a
+ * bit-identical config and skips the bounce (§5.1 cost model).
+ *
+ * Pure function — no I/O, no DB reads. Wired into `OpencodeCore.execute()`
+ * after `materializeMcpForSession` resolves the per-backend MCP list.
+ */
+import { type ExecutionPermissionMode, type OpencodeMcpServerConfig, type OpencodeRuntimeConfig } from "@aitne/shared";
+export interface OpencodeConfigBuilderInput {
+    modelId: string;
+    executionMode: ExecutionPermissionMode;
+    disallowedTools: readonly string[];
+    allowedToolsOverride: readonly string[] | null;
+    mcpDisallowed: readonly string[];
+    /**
+     * Per-session MCP map (already filtered to enabled + opencode-targeted
+     * + name-linted by `renderOpencodeMcp`). Empty when no MCP targets the
+     * session.
+     */
+    mcp: Record<string, OpencodeMcpServerConfig>;
+    /**
+     * V1+V2 — `AGENTS.md` and `.claude/skills/<name>/SKILL.md` are
+     * auto-discovered from the session cwd. The default is therefore an
+     * EMPTY instructions array; the daemon explicitly omits the field.
+     * Operators set `PA_OPENCODE_DEFENSIVE_INSTRUCTIONS=1` to force-emit
+     * the defensive glob list.
+     */
+    defensiveInstructions?: boolean;
+    /**
+     * Extra hard-disable tool entries (e.g. `read: false` when a session
+     * must have zero read capability). Composed with the V8 subagent
+     * suppression (`task: false`) the builder always emits.
+     */
+    extraHardDisable?: Record<string, boolean>;
+}
+export interface OpencodeConfigBuilderResult {
+    config: OpencodeRuntimeConfig;
+    /**
+     * Operator-facing notices from the permission translator and the MCP
+     * renderer. Dashboard surfaces these inline on the runtime-config
+     * preview tile.
+     */
+    warnings: string[];
+}
+/**
+ * Build the complete `OpencodeRuntimeConfig` for a session.
+ *
+ * Ordering invariants (locked by `opencode-config-builder.test.ts`):
+ *   1. The per-session translator's output is built FIRST (so warnings
+ *      reflect what the operator configured).
+ *   2. The absolute-block layer is merged on top — its denies always win
+ *      over any per-session allow.
+ *   3. `tools` is composed as `{ task: false, …caller-extras, …read-hard-
+ *      disable }` — the order matches the JSON serialisation order and
+ *      keeps the hash stable across same-envelope turns.
+ */
+export declare function buildOpencodeRuntimeConfig(input: OpencodeConfigBuilderInput): OpencodeConfigBuilderResult;
+/**
+ * `PA_OPENCODE_DEFENSIVE_INSTRUCTIONS=1` opts in to the defensive
+ * `instructions` glob list. Centralised here so callers don't repeat
+ * the env-var-name string.
+ */
+export declare function defensiveInstructionsFromEnv(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=opencode-config-builder.d.ts.map

package/dist/core/backends/opencode-config-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-config-builder.d.ts","sourceRoot":"","sources":["../../../src/core/backends/opencode-config-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAE5B,KAAK,uBAAuB,EAG5B,KAAK,qBAAqB,EAC3B,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,uBAAuB,CAAC;IACvC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/C,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,qBAAqB,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwFD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,0BAA0B,GAChC,2BAA2B,CAoD7B;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET"}

package/dist/core/backends/opencode-config-builder.js

@@ -0,0 +1,172 @@
+/**
+ * docs/design/appendices/opencode-backend.md §5.1 / §5.8 / Phase 3 — assemble the
+ * complete `OpencodeRuntimeConfig` envelope a session needs.
+ *
+ * Inputs (already normalised by caller):
+ *   - `modelId`: provider/model composite from the BackendRouter.
+ *   - `executionMode`: per-backend Safe/Allow posture.
+ *   - `disallowedTools`: per-session denylist (Claude-shaped).
+ *   - `allowedToolsOverride`: dashboard widen list (Claude-shaped) or null.
+ *   - `mcpRender`: result of `renderOpencodeMcp` — the per-session `mcp`
+ *     map plus warnings the dashboard surfaces.
+ *
+ * Outputs:
+ *   - `config`: the envelope to pass through to `serverManager.ensureConfig()`
+ *     (which hashes it and bounces the server if it differs from the
+ *     running hash). Per §5.1 the daemon ALWAYS emits a full self-contained
+ *     JSON — no field is left to the merge layer.
+ *   - `warnings`: collected from both translators so the dashboard can
+ *     show the operator which entries opencode can't express verbatim.
+ *
+ * Self-contained invariant: every field on `OpencodeRuntimeConfig` is
+ * explicit (or deliberately omitted) so the daemon's behaviour does not
+ * depend on the merge-vs-replace semantics of `OPENCODE_CONFIG_CONTENT`
+ * (§10 D1, deferred). This means a same-envelope second turn produces a
+ * bit-identical config and skips the bounce (§5.1 cost model).
+ *
+ * Pure function — no I/O, no DB reads. Wired into `OpencodeCore.execute()`
+ * after `materializeMcpForSession` resolves the per-backend MCP list.
+ */
+import { buildOpencodePermission, } from "@aitne/shared";
+import { buildOpencodeAbsoluteBlockPermission } from "../../safety/always-disallowed.js";
+/**
+ * Defensive `instructions` glob list (V12 — only useful when the
+ * session cwd is symlinked or chrooted in a way that defeats
+ * auto-discovery). Skills are intentionally NOT listed here — including
+ * `.claude/skills/**\/SKILL.md` would inflate the system prompt with
+ * every skill body. Skills auto-discover separately via opencode's
+ * `skill` tool (§5.5).
+ */
+const DEFENSIVE_INSTRUCTIONS = [
+    "AGENTS.md",
+    ".opencode/agent/*.md",
+];
+/**
+ * Merge two `OpencodePermissionConfig` blocks. The second argument
+ * **wins** for whole-key collisions — absolute-block entries override
+ * any user-configured allow/deny. For the `bash` pattern-map, the merge
+ * is per-pattern with `b` winning.
+ *
+ * Why per-pattern merge: a Phase-3 acceptance gate requires that an
+ * operator who explicitly allows `Bash(npm *)` does not have their
+ * allow erased by the absolute-block layer (which has no `npm *` deny).
+ * Same-pattern collisions deny-wins because the absolute-block layer
+ * is non-negotiable.
+ */
+function mergePermissions(base, override) {
+    const out = { ...base };
+    // bash — pattern-map vs triple merge
+    if (override.bash !== undefined) {
+        out.bash = mergeBash(base.bash, override.bash);
+    }
+    // triple-only keys — override wins (absolute-block layer never emits
+    // these today, but kept future-proof).
+    if (override.edit !== undefined)
+        out.edit = override.edit;
+    if (override.webfetch !== undefined)
+        out.webfetch = override.webfetch;
+    if (override.doom_loop !== undefined)
+        out.doom_loop = override.doom_loop;
+    if (override.external_directory !== undefined) {
+        out.external_directory = override.external_directory;
+    }
+    return out;
+}
+function mergeBash(base, override) {
+    // Override is a triple: it is by definition the strongest expression on
+    // this key, so it wins wholesale.
+    if (typeof override === "string")
+        return override;
+    if (base === undefined) {
+        return { ...override };
+    }
+    if (typeof base === "string") {
+        // Base is a wholesale triple ("deny" / "ask" / "allow" — only "deny"
+        // is reachable today via bare `Bash` in disallowedTools, but the
+        // future-proof branches stay so a per-session translator gaining
+        // bash:"ask"/"allow" emission later does not silently regress).
+        //
+        // The override is a pattern map of absolute-block denies. We MUST
+        // preserve base's wholesale semantic, otherwise a user who said
+        // "deny all bash" (bare `Bash`) would see their policy silently
+        // widened to "deny only the absolute-block patterns" once those
+        // patterns merge in. Encode the wholesale semantic as a `"*"`
+        // catch-all on the merged pattern map — opencode's pattern matcher
+        // prefers specific patterns over `*`, so the absolute-block entries
+        // remain enforceable AND the catch-all carries the base value for
+        // every unlisted command.
+        const merged = { ...override };
+        if (merged["*"] === undefined) {
+            merged["*"] = base;
+        }
+        return merged;
+    }
+    // Both are pattern-maps. Merge — override wins per-key.
+    const merged = { ...base };
+    for (const [pat, value] of Object.entries(override)) {
+        merged[pat] = value;
+    }
+    return merged;
+}
+/**
+ * Build the complete `OpencodeRuntimeConfig` for a session.
+ *
+ * Ordering invariants (locked by `opencode-config-builder.test.ts`):
+ *   1. The per-session translator's output is built FIRST (so warnings
+ *      reflect what the operator configured).
+ *   2. The absolute-block layer is merged on top — its denies always win
+ *      over any per-session allow.
+ *   3. `tools` is composed as `{ task: false, …caller-extras, …read-hard-
+ *      disable }` — the order matches the JSON serialisation order and
+ *      keeps the hash stable across same-envelope turns.
+ */
+export function buildOpencodeRuntimeConfig(input) {
+    const warnings = [];
+    const perSession = buildOpencodePermission({
+        disallowedTools: input.disallowedTools,
+        allowedToolsOverride: input.allowedToolsOverride ?? null,
+        mcpDisallowed: input.mcpDisallowed,
+        mode: input.executionMode,
+    });
+    warnings.push(...perSession.warnings);
+    const absolute = buildOpencodeAbsoluteBlockPermission();
+    warnings.push(...absolute.warnings);
+    // mergePermissions: per-session is the base, absolute-block is the
+    // override. This produces "absolute wins" semantics for any same-key
+    // collision in the bash pattern map.
+    const permission = mergePermissions(perSession.permission, absolute.permission);
+    const tools = {
+        // V8 — subagent suppression. opencode's `task` tool spawns subagents
+        // outside the daemon's audit/stream surface; we always disable it.
+        task: false,
+        ...(input.extraHardDisable ?? {}),
+        ...perSession.toolsHardDisable,
+    };
+    const config = {
+        tools,
+        permission,
+    };
+    // Only emit `model` when the composite parses as provider/model. The
+    // server falls back to its own configured default when the field is
+    // omitted; this keeps the bounce-hash stable when callers (tests)
+    // pass an ad-hoc model id.
+    if (input.modelId.includes("/")) {
+        config.model = input.modelId;
+    }
+    if (Object.keys(input.mcp).length > 0) {
+        config.mcp = input.mcp;
+    }
+    if (input.defensiveInstructions) {
+        config.instructions = [...DEFENSIVE_INSTRUCTIONS];
+    }
+    return { config, warnings };
+}
+/**
+ * `PA_OPENCODE_DEFENSIVE_INSTRUCTIONS=1` opts in to the defensive
+ * `instructions` glob list. Centralised here so callers don't repeat
+ * the env-var-name string.
+ */
+export function defensiveInstructionsFromEnv(env = process.env) {
+    return env.PA_OPENCODE_DEFENSIVE_INSTRUCTIONS === "1";
+}
+//# sourceMappingURL=opencode-config-builder.js.map

package/dist/core/backends/opencode-config-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-config-builder.js","sourceRoot":"","sources":["../../../src/core/backends/opencode-config-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,uBAAuB,GAOxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oCAAoC,EAAE,MAAM,mCAAmC,CAAC;AAwCzF;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG;IAC7B,WAAW;IACX,sBAAsB;CACd,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,IAA8B,EAC9B,QAAkC;IAElC,MAAM,GAAG,GAA6B,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,qCAAqC;IACrC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,qEAAqE;IACrE,uCAAuC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC1D,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACtE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACzE,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC9C,GAAG,CAAC,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IACvD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAChB,IAAwC,EACxC,QAAgC;IAEhC,wEAAwE;IACxE,kCAAkC;IAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,qEAAqE;QACrE,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,EAAE;QACF,kEAAkE;QAClE,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,mEAAmE;QACnE,oEAAoE;QACpE,kEAAkE;QAClE,0BAA0B;QAC1B,MAAM,MAAM,GAA4C,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,wDAAwD;IACxD,MAAM,MAAM,GAA4C,EAAE,GAAG,IAAI,EAAE,CAAC;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiC;IAEjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,uBAAuB,CAAC;QACzC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;QACxD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,IAAI,EAAE,KAAK,CAAC,aAAa;KAC1B,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,oCAAoC,EAAE,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpC,mEAAmE;IACnE,qEAAqE;IACrE,qCAAqC;IACrC,MAAM,UAAU,GAAG,gBAAgB,CACjC,UAAU,CAAC,UAAU,EACrB,QAAQ,CAAC,UAAsC,CAChD,CAAC;IAEF,MAAM,KAAK,GAA4B;QACrC,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,EAAE,KAAK;QACX,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjC,GAAG,UAAU,CAAC,gBAAgB;KAC/B,CAAC;IAEF,MAAM,MAAM,GAA0B;QACpC,KAAK;QACL,UAAU;KACX,CAAC;IAEF,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,2BAA2B;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACzB,CAAC;IAED,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,GAAG,CAAC,GAAG,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,kCAAkC,KAAK,GAAG,CAAC;AACxD,CAAC"}

package/dist/core/backends/opencode-core.d.ts

@@ -0,0 +1,316 @@
+/**
+ * docs/design/appendices/opencode-backend.md §6.2 — `IAgentCore` implementation backed by
+ * the `@opencode-ai/sdk` HTTP server.
+ *
+ * Surface:
+ *   - `execute()` end-to-end against the managed server (loopback)
+ *   - `executeResume()` reuses an existing opencode session id so the
+ *     dispatcher's multi-turn DM / dashboard-chat / docs-QA path can
+ *     own opencode as main backend (see
+ *     `docs/design/appendices/opencode-execute-resume.md`)
+ *   - Streaming text deltas relayed through the StreamCallbacks
+ *   - Cost / token telemetry from `client.session.get(...).data`,
+ *     scoped to a per-turn delta when resuming (pre-turn snapshot
+ *     subtracted from post-turn cumulative)
+ *   - `summarize()` V11 round-trip
+ *   - `runDelegatedTask()` via spawnEphemeral (Path A)
+ *   - Stub for `runDelegatedTool` (by design — opencode delegation
+ *     routes through `runDelegatedTask`)
+ *   - Per-execute wall-clock abort via `AbortController` →
+ *     `client.session.abort()`
+ */
+import { type AgentResult, type BackendModel } from "@aitne/shared";
+import type { AgentConfig } from "../../config.js";
+import type { AgentWriteTracker } from "../../safety/agent-write-tracker.js";
+import type { AgentExecuteParams, AgentResumeParams, AuthCheckResult, DelegatedTaskInvokeParams, DelegatedTaskResultRaw, DelegatedToolInvokeParams, DelegatedToolResult, IAgentCore, McpSessionContext, ReadSensitiveTokenManager, StreamCallbacks } from "../agent-core.js";
+import { PriceFetcher } from "./price-fetcher.js";
+import { extractToolUsesFromParts } from "./opencode-event-mapper.js";
+import type { OpencodeServerManager } from "./opencode-server-manager.js";
+/**
+ * Provider/model parse for the SDK's `body.model = { providerID, modelID }`
+ * shape. opencode encodes the composite as `providerID/modelID` — note
+ * the model id itself may contain slashes (e.g. `openai/gpt-oss-20b:free`
+ * on OpenRouter), so we only split on the FIRST `/`.
+ */
+export declare function parseModelComposite(composite: string): {
+    providerID: string;
+    modelID: string;
+} | null;
+export interface LiveOpencodeModel {
+    /** Composite the daemon stores in `process_backend_config.main_model`. */
+    modelId: string;
+    /** Model id without the provider prefix, for display. */
+    shortId: string;
+    name: string;
+    family: string;
+    tier: "lite" | "medium" | "high";
+    supportsToolUse: boolean;
+    supportsAttachment: boolean;
+    supportsReasoning: boolean;
+    maxInputTokens: number | null;
+    maxOutputTokens: number | null;
+    usdPer1kIn: number | null;
+    usdPer1kOut: number | null;
+    isFree: boolean;
+    status: string;
+}
+export interface LiveOpencodeProviderGroup {
+    id: string;
+    name: string;
+    source: string;
+    models: LiveOpencodeModel[];
+}
+export interface LiveOpencodeModelsResponse {
+    providers: LiveOpencodeProviderGroup[];
+    fetchedAt: string;
+    cached: boolean;
+}
+export declare class OpencodeCore implements IAgentCore {
+    private readonly config;
+    private readonly writeTracker;
+    private readonly serverManager;
+    private readonly priceFetcher;
+    readonly backendId: "opencode";
+    private liveModelsCache;
+    /** Coalesce parallel `listLiveModels()` calls onto a single SDK round-trip.
+     *  Mirrors the inflight pattern in `ManagedOpencodeServerManager.spawn()`
+     *  so a dashboard burst (picker open + RQ background refresh) doesn't
+     *  multiply `client.config.providers()` calls. */
+    private liveModelsInflight;
+    private readToken;
+    private readTokenManager;
+    private mcpContext;
+    constructor(config: AgentConfig, writeTracker: AgentWriteTracker, serverManager: OpencodeServerManager, priceFetcher?: PriceFetcher);
+    setReadToken(token: string): void;
+    setReadTokenManager(manager: ReadSensitiveTokenManager): void;
+    setMcpContext(context: McpSessionContext): void;
+    /**
+     * Materialises a session workdir, ensures the server is running with
+     * the desired runtime config, opens a fresh session via the SDK, then
+     * runs prompt + event-stream consumption in parallel. Per-execute
+     * timeout cancels the inflight prompt via `client.session.abort()`.
+     */
+    execute(params: AgentExecuteParams, streamCallbacks?: StreamCallbacks): Promise<AgentResult>;
+    /**
+     * Resume a prior turn against an existing opencode session id. The
+     * dispatcher reaches this when `conversation_sessions.backend_session_id`
+     * was previously written by `execute()`. opencode persists sessions on
+     * disk, so the same id stays addressable across server restarts; we
+     * skip `session.create` and re-enter via `session.prompt({ path: { id } })`.
+     *
+     * Design: `docs/design/appendices/opencode-execute-resume.md`.
+     */
+    executeResume(params: AgentResumeParams, streamCallbacks?: StreamCallbacks): Promise<AgentResult>;
+    /**
+     * docs/design/appendices/opencode-backend.md §6.2 / §10 D5 / V11 — opencode-side
+     * summarisation flow.
+     *
+     *   1. Open a transient session so the server has a conversation it
+     *      can summarise (opencode requires non-empty message history
+     *      before `session.summarize` will produce a body).
+     *   2. Prompt with the conversation text under the lite-tier model
+     *      (`DEFAULT_OPENCODE_LITE_MODEL`) — small_model isn't honoured
+     *      here because Aitne disables `task` (V8) so opencode's own
+     *      subagent path never picks small_model up. Cheap & quick on the
+     *      same provider as the active turn.
+     *   3. Call `client.session.summarize({ path: { id }, body: { providerID, modelID } })`
+     *      — body is FLAT, NOT nested in a `model` wrapper (V11 contract).
+     *      Returns `{ data: true }` on HTTP 200; the actual summary lands
+     *      as a new assistant message with `info.summary === true`.
+     *   4. Read `client.session.messages({ path: { id } })` and pick the
+     *      LAST assistant message with `info.summary === true`. Join its
+     *      text parts as the markdown summary. (Do NOT read
+     *      `session.get(...).data.summary` — V11 fixture confirms that
+     *      field is the diff stat block `{ additions, deletions, files }`,
+     *      not text.)
+     *   5. Best-effort `session.delete()` in a `finally` so the transient
+     *      session row doesn't accumulate on disk.
+     *
+     * Falls back to a truncated slice on any failure so a caller flowing
+     * through a fallback chain still gets *something* — matching the
+     * Codex/Gemini summarize contract (return string, never throw).
+     */
+    summarize(text: string): Promise<string>;
+    /**
+     * Lightweight auth presence check. Mirrors Codex's pattern: prefer a
+     * keychain-mirrored env var (`OPENCODE_SERVER_PASSWORD` for remote);
+     * for the managed loopback server, the daemon owns the credentials so
+     * "configured" is sufficient. The deeper "is the provider key
+     * accepted?" check is exercised by `checkAuthDetailed`.
+     */
+    checkAuth(): Promise<{
+        ok: true;
+        method: "cli_login" | "api_key" | "oauth" | "vertex";
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    checkAuthDetailed(): Promise<AuthCheckResult>;
+    /**
+     * Phase 5 §4.11 — opencode does NOT expose namespaced `mcp__*` tool
+     * names through `client.tool.ids()` in 1.14.50 (V7 fixture confirms).
+     * Live probe is therefore unsupported on this backend in v1; the
+     * route surfaces this as a 501 with a targeted message. Phase 5+ may
+     * unlock once `mcp.status()`/`tool.list()` surfaces MCP tools.
+     */
+    probeTools(): Promise<string[]>;
+    /**
+     * Static-registry first; Phase 6 (§6.6.2 wizard probe) extends this
+     * via `serverManager.listModels()` once the live-server enumeration
+     * lands. Today the registry seed is sufficient for `BackendRouter`
+     * bindings.
+     */
+    listModels(): ReadonlyArray<BackendModel>;
+    /**
+     * Live model enumeration over `client.config.providers()`. Returns the
+     * full catalogue an operator can pick from — every provider the live
+     * opencode server has credentials for, with capability + cost metadata.
+     * Cached in-memory for 5 minutes so the picker doesn't re-bounce the
+     * server on every keystroke.
+     *
+     * Security: the raw `client.config.providers()` response includes
+     * `provider.key` (plaintext API key). This method NEVER returns that
+     * field — the caller surfaces what's projected here, not the raw SDK
+     * response.
+     */
+    listLiveModels(options?: {
+        forceRefresh?: boolean;
+    }): Promise<LiveOpencodeModelsResponse>;
+    private fetchLiveModels;
+    runDelegatedTool(_params: DelegatedToolInvokeParams): Promise<DelegatedToolResult>;
+    runDelegatedTask(params: DelegatedTaskInvokeParams): Promise<DelegatedTaskResultRaw>;
+    private runTurn;
+    /**
+     * docs/design/appendices/opencode-backend.md §5.9 / Phase 4 — opencode delegated-task
+     * execution.
+     *
+     * Implementation choice (v1): spawn an isolated ephemeral server
+     * with tight permission JSON for each delegated call. The design's
+     * preferred default is Path B (long-lived primary + per-agent
+     * permission frontmatter written mid-session), but Phase 0's V5
+     * fixture left the agent-file hot-reload behaviour an open question
+     * (§5.9 "Open item" — agent file was pre-created in V5). spawnEphemeral
+     * sidesteps the hot-reload concern entirely with a deterministic
+     * ~900 ms p50 spawn cost (V6 measurement); volume on delegated paths
+     * is low enough that the cost-isolation trade-off favours
+     * predictability. The router's `params.isolation === "ephemeral"`
+     * intent is the same as our default here, so callers that explicitly
+     * request ephemeral isolation get exactly what they asked for.
+     *
+     * Path B (long-lived primary + per-agent file reuse) can land
+     * incrementally once V5's open question is resolved against a real
+     * opencode server — see §5.9 Phase 3-blocked checklist row.
+     *
+     * Per-call envelope:
+     *   - Tight `permission` JSON: every triple-keyed write tool
+     *     (`edit`, `bash`, `webfetch`, `doom_loop`, `external_directory`)
+     *     defaults to `deny`. The absolute-block layer's bash
+     *     pattern-map merges on top so destructive shapes stay denied.
+     *   - `tools.task: false` (V8 — kill subagent spawning) plus
+     *     `tools.read: false` and `tools.write: false` for the
+     *     non-MCP read/write tools (no permission triple exists for
+     *     `read`; hard-disable is the only opencode 1.14.50 surface).
+     *   - MCP map carries only the integration's connectors per
+     *     `setMcpContext`; per-tool MCP deny is server-level only in v1
+     *     (§5.6 v1 strategy) — disallowed connectors are simply not
+     *     materialised.
+     *   - `model` set to `params.modelId`.
+     *
+     * Stream pre-emption: opencode 1.14.50 does NOT emit
+     * `message.part.updated` events during a turn (V9 — see §5.3), so
+     * tool-call data is only available from the FINAL `session.prompt`
+     * response. The pre-emption check therefore happens AFTER the turn
+     * completes — `policy_violation` / `loop_aborted` classifications
+     * still surface, but the subprocess has already executed any
+     * out-of-envelope MCP call by the time we see it. Mitigation:
+     *   1. Server-level permission denies non-MCP write tools at
+     *      enforcement time (the model receives a tool error and stops).
+     *   2. The MCP map only carries the integration's allowed
+     *      connectors, so non-allowed MCP tools are unreachable.
+     *   3. The post-turn pre-emption check is the audit layer — it
+     *      classifies whether the turn violated policy for telemetry.
+     * If opencode begins emitting streamed tool-call events, this method
+     * migrates to the live pre-emption pattern Codex uses; the post-
+     * extraction check stays as the back-stop.
+     */
+    private runDelegatedTaskAgainstEphemeral;
+    /**
+     * OPENCODE_BACKEND_DESIGN §5.1 / §5.8 — assemble the full per-session
+     * `OpencodeRuntimeConfig` envelope. Async because MCP materialization
+     * resolves secrets via the encrypted blob store.
+     *
+     * Self-contained: every field is set explicitly (or deliberately
+     * omitted), so the server-manager's bounce hash is stable across
+     * same-envelope turns. The §5.1 invariant.
+     */
+    private buildRuntimeConfig;
+    /**
+     * Per-session MCP materialization. Unlike Claude / Codex / Gemini —
+     * which write a backend-specific file under `<sessionDir>/.mcp.json`
+     * or `.codex/config.toml` — OpenCode receives MCP servers inline via
+     * `OPENCODE_CONFIG_CONTENT` (§5.1). The daemon therefore renders
+     * directly into a `Record<string, McpLocalConfig | McpRemoteConfig>`
+     * map and feeds it into `buildOpencodeRuntimeConfig`.
+     *
+     * Returns the rendered map + the autonomous-strip disallowedTools so
+     * the config builder can surface those as MCP-server warnings
+     * (per-tool MCP deny isn't expressible in opencode 1.14.50 — §5.6).
+     */
+    private materializeMcp;
+    private consumeEventStream;
+    private assertPromptWithinMaxBudget;
+    private assertWithinMaxBudget;
+}
+/**
+ * docs/design/appendices/opencode-backend.md §5.8 synthetic absolute-block audit. For
+ * every tool call extracted from the final `session.prompt` response,
+ * route through the shared `auditStreamObservation` chokepoint so a
+ * `blocked_absolute` row with `result='partial'` is written on a match.
+ *
+ * Two-step pipeline keeps the classifier centralised:
+ *   1. `extractOpencodeToolUseTarget` — opencode-specific tool/arg
+ *      normalisation (`bash` / `read` / `write` / `edit` / `apply_patch`).
+ *   2. `auditStreamObservation` — runs `classifyAbsoluteBlock` against
+ *      the normalised target and writes the audit row when matched.
+ *
+ * Why the `partial` result code: opencode enforces the deny inside the
+ * permission JSON at server side, which the daemon does not directly
+ * observe. The audit row records *that the agent attempted* a pattern
+ * the absolute-block layer covers — useful even if the underlying
+ * enforcement happened correctly server-side, and *critical* if a future
+ * permission-JSON regression silently let the call through.
+ *
+ * Exported for `opencode-core.test.ts` so the synthetic audit can be
+ * exercised without spinning up a full server.
+ */
+export declare function auditOpencodeTools(tools: ReturnType<typeof extractToolUsesFromParts>, deps: {
+    db: import("better-sqlite3").Database | undefined;
+    mode: import("@aitne/shared").ExecutionPermissionMode;
+    sessionId: number | null;
+}): void;
+/**
+ * docs/design/appendices/opencode-backend.md Phase 4 — Stage 2 hourly-check triage
+ * schema. Mirrors the `parseStage2Verdict` text contract
+ * (`dispatcher-types.ts`): the agent must return exactly
+ * `{ "action": "log_only" | "escalate", "reason": string }`. Opencode
+ * validates against this schema with `retryCount: 2` server-side, then
+ * surfaces the parsed object at `info.structured`.
+ *
+ * Exported for the regression test that exercises the json_schema
+ * round-trip without spinning up a real opencode server.
+ */
+export declare const STAGE2_TRIAGE_JSON_SCHEMA: {
+    readonly type: "object";
+    readonly properties: {
+        readonly action: {
+            readonly type: "string";
+            readonly enum: readonly ["log_only", "escalate"];
+        };
+        readonly reason: {
+            readonly type: "string";
+        };
+    };
+    readonly required: readonly ["action", "reason"];
+    readonly additionalProperties: false;
+};
+//# sourceMappingURL=opencode-core.d.ts.map

package/dist/core/backends/opencode-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-core.d.ts","sourceRoot":"","sources":["../../../src/core/backends/opencode-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAIL,KAAK,WAAW,EAEhB,KAAK,YAAY,EAIlB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAMnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAK7E,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EAEtB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAEL,wBAAwB,EAKzB,MAAM,4BAA4B,CAAC;AAMpC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAwC1E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,GAChB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAShD;AAoBD,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACjC,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,yBAAyB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAqCD,qBAAa,YAAa,YAAW,UAAU;IAgB3C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAlB/B,QAAQ,CAAC,SAAS,EAAG,UAAU,CAAU;IAEzC,OAAO,CAAC,eAAe,CAEP;IAChB;;;sDAGkD;IAClD,OAAO,CAAC,kBAAkB,CAAoD;IAC9E,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,gBAAgB,CAAwC;IAChE,OAAO,CAAC,UAAU,CAAgC;gBAG/B,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,iBAAiB,EAC/B,aAAa,EAAE,qBAAqB,EACpC,YAAY,eAAmC;IAGlE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjC,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI;IAI7D,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAI/C;;;;;OAKG;IACG,OAAO,CACX,MAAM,EAAE,kBAAkB,EAC1B,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,WAAW,CAAC;IAIvB;;;;;;;;OAQG;IACG,aAAa,CACjB,MAAM,EAAE,iBAAiB,EACzB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,WAAW,CAAC;IAuCvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8G9C;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CACtB;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAChC;IA0BK,iBAAiB,IAAI,OAAO,CAAC,eAAe,CAAC;IAgBnD;;;;;;OAMG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAOrC;;;;;OAKG;IACH,UAAU,IAAI,aAAa,CAAC,YAAY,CAAC;IAIzC;;;;;;;;;;;OAWG;IACG,cAAc,CAClB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC,0BAA0B,CAAC;YAwBxB,eAAe;IAkDvB,gBAAgB,CACpB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC;IAOzB,gBAAgB,CACpB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,sBAAsB,CAAC;YAcpB,OAAO;IAifrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;YACW,gCAAgC;IAiX9C;;;;;;;;OAQG;YACW,kBAAkB;IA0BhC;;;;;;;;;;;OAWG;YACW,cAAc;YAsDd,kBAAkB;IAuDhC,OAAO,CAAC,2BAA2B;IAuBnC,OAAO,CAAC,qBAAqB;CAgB9B;AAyED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,EAClD,IAAI,EAAE;IACJ,EAAE,EAAE,OAAO,gBAAgB,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClD,IAAI,EAAE,OAAO,eAAe,EAAE,uBAAuB,CAAC;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACA,IAAI,CAmBN;AAuDD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;CAa5B,CAAC"}