@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/backends/native-skill-discovery-probe.js

@@ -0,0 +1,172 @@
+/**
+ * docs/design/appendices/skills-unification.md Phase 1 item 13 — forward-compat probe.
+ *
+ * Codex and Gemini did not ship native skill auto-discovery when Phase 1
+ * landed (which is why the instruction file carries a `<skill-index>`
+ * block + on-demand `Read` protocol). When their CLIs grow a built-in
+ * `skill` / `Skill` surface — analogous to the Claude Agent SDK's
+ * loader — we want a loud one-line signal so a follow-up PR can drop
+ * the `<skill-index>` block for that backend.
+ *
+ * Two detection strategies are wired here. They are complementary
+ * because the surface a future CLI exposes is not knowable in advance.
+ *
+ *  1. {@link noteNativeSkillToolIfPresent} — pure name-pattern scan
+ *     against a tool-name list. Cheap defense-in-depth. The caller
+ *     supplies whatever inventory it already has. Today's wiring (Codex
+ *     `mcp__`-filtered probe, Gemini synthetic capability list) means
+ *     this path will not actually fire on a future native surface
+ *     because that surface won't be MCP-namespaced — but the function
+ *     stays in case a richer inventory source lands later.
+ *
+ *  2. {@link probeCliNativeSkillSubcommand} — runs `<cli> --help` once
+ *     and scans the output for a top-level `skill` / `skills`
+ *     subcommand. This is the ground-truth signal. Verified:
+ *       - `gemini --help` already lists `gemini skills <command>`
+ *         (aliased `skill`). When this probe is wired, Gemini will be
+ *         the first backend to trip the alarm.
+ *       - `codex --help` does NOT yet ship a skill subcommand. Its
+ *         `codex features list` carries `skill_mcp_dependency_install`
+ *         (stable, true) and `skill_env_var_dependency_prompt` (under
+ *         development) — both gate MCP dependency wiring, not skill
+ *         discovery, so they are NOT load-bearing signals.
+ *
+ * Both probes are idempotent per process (`reportedKeys` /
+ * `subcommandReportedKeys`). Re-fires across daemon restarts, which is
+ * fine — the signal is meant to be noticed in logs during the rollout
+ * window, not deduplicated across boots.
+ *
+ * No-op for Claude (`materializeClaudeSession` already trusts the SDK
+ * loader) and for OpenCode (cwd auto-discovery is the source of truth;
+ * Phase 1 §R3 pins zero `<skill-index>` for that backend).
+ */
+import { tmpdir } from "node:os";
+import { createLogger } from "../../logging.js";
+import { runLineCommand } from "./cli-utils.js";
+const logger = createLogger("native-skill-discovery-probe");
+/**
+ * Heuristic tool-name patterns that would suggest the CLI gained a skill
+ * loader. Matched case-insensitively against the FULL tool name (including
+ * any `mcp__<server>__` prefix). Conservative — false positives only
+ * trigger one extra log line, false negatives delay detection until a
+ * future PR tightens the heuristic.
+ */
+const SKILL_LIKE_TOOL_PATTERNS = [
+    /^skill$/i,
+    /(^|_)skills?(_|$)/i, // matches `skill`, `Skill`, `skills`, `skill_load`, etc.
+    /skill_discover/i,
+    /load_skill/i,
+];
+const reportedKeys = new Set();
+export function noteNativeSkillToolIfPresent(backendId, toolNames) {
+    if (backendId === "opencode")
+        return; // R3 — auto-discovery is the source of truth
+    const matches = toolNames.filter((name) => SKILL_LIKE_TOOL_PATTERNS.some((re) => re.test(name)));
+    if (matches.length === 0)
+        return;
+    const key = `${backendId}:${matches.sort().join(",")}`;
+    if (reportedKeys.has(key))
+        return;
+    reportedKeys.add(key);
+    logger.warn({
+        backendId,
+        matches,
+        hint: "Native skill-discovery surface detected. Consider dropping the "
+            + "<skill-index> block from the instruction file for this backend "
+            + "in a follow-up PR (docs/design/appendices/skills-unification.md §Risks).",
+    }, "native_skill_discovery.candidate_tool_detected");
+}
+/**
+ * Per-backend dedupe set for the `<cli> --help` subcommand probe. Held
+ * separately from {@link reportedKeys} so the two probes don't suppress
+ * each other.
+ */
+const subcommandReportedKeys = new Set();
+/** Hard upper bound for the `--help` invocation; we only need its
+ *  top-level command listing, which every CLI prints synchronously
+ *  on stdout in well under 1 s. 5 s leaves room for cold-start. */
+const HELP_PROBE_TIMEOUT_MS = 5_000;
+/**
+ * Top-level command-line detector. Two anchors:
+ *   - `<cli> skill[s]` literal — every CLI we care about renders its
+ *     usage lines that way (e.g. `gemini skills <command>`; codex's
+ *     hypothetical future form would be `codex skill <command>`).
+ *   - Indented command-list entry `<indent>skill[s]<space>` — the
+ *     "Commands:" block shape both yargs (Gemini) and clap (Codex)
+ *     render.
+ *
+ * Case-insensitive so a `Skill` or `Skills` heading is not missed.
+ * Word-boundary terminator `\b` prevents false hits on `skill_search`
+ * or `skill_install`-style sub-tokens that are not load-bearing
+ * subcommand names.
+ */
+function helpTextLooksLikeSkillSubcommand(helpText, backendId) {
+    const usageLine = new RegExp(`(^|\\n)\\s*${backendId}\\s+skills?\\b`, "i");
+    const commandsListEntry = /(^|\n)\s+skills?\b/i;
+    return usageLine.test(helpText) || commandsListEntry.test(helpText);
+}
+/**
+ * Probe the backend CLI's `--help` output for a top-level skill
+ * subcommand. Idempotent per process — once a backend has been
+ * reported, subsequent calls short-circuit.
+ *
+ * Designed to be called from `probeTools()` (which runs at integration
+ * mode-flip probe time). Failure modes are silent (missing CLI,
+ * non-zero exit, parse-fail, timeout) so the daemon's main flow is not
+ * blocked on a forward-compat heuristic.
+ */
+export async function probeCliNativeSkillSubcommand(cliPath, backendId) {
+    if (subcommandReportedKeys.has(backendId))
+        return;
+    if (!cliPath)
+        return;
+    let stdoutLines;
+    let stderrLines;
+    let exitCode;
+    let timedOut;
+    try {
+        const result = await runLineCommand({
+            command: cliPath,
+            args: ["--help"],
+            cwd: tmpdir(),
+            timeoutMs: HELP_PROBE_TIMEOUT_MS,
+        });
+        stdoutLines = result.stdoutLines;
+        stderrLines = result.stderrLines;
+        exitCode = result.exitCode;
+        timedOut = result.timedOut;
+    }
+    catch (err) {
+        logger.debug({ backendId, err: err instanceof Error ? err.message : String(err) }, "native_skill_discovery.help_probe.spawn_failed");
+        return;
+    }
+    if (timedOut) {
+        logger.debug({ backendId }, "native_skill_discovery.help_probe.timed_out");
+        return;
+    }
+    // Some CLIs (gemini) print `--help` to stdout with exit 0; some flavours
+    // emit to stderr with exit 1. Accept either as long as we got output.
+    if (exitCode !== 0 && exitCode !== null && stdoutLines.length === 0) {
+        return;
+    }
+    const helpText = [...stdoutLines, ...stderrLines].join("\n");
+    if (!helpTextLooksLikeSkillSubcommand(helpText, backendId))
+        return;
+    subcommandReportedKeys.add(backendId);
+    logger.warn({
+        backendId,
+        hint: `${backendId} CLI ships a top-level \`skill\`/\`skills\` subcommand `
+            + "(native skill loader). Evaluate dropping the `<skill-index>` block "
+            + "+ on-demand `Read` protocol from this backend's instruction file "
+            + "(docs/design/appendices/skills-unification.md §Risks).",
+    }, "native_skill_discovery.subcommand_detected");
+}
+/** Test-only: reset both dedupe sets so multiple probe invocations exercise
+ *  the log path independently. */
+export function __resetNativeSkillDiscoveryProbe() {
+    reportedKeys.clear();
+    subcommandReportedKeys.clear();
+}
+/** Test-only — extracted for direct coverage of the help-text matcher
+ *  without paying for a subprocess. */
+export const __test_helpTextLooksLikeSkillSubcommand = helpTextLooksLikeSkillSubcommand;

package/dist/core/backends/opencode-basic-auth-fetch.d.ts

@@ -0,0 +1,26 @@
+/**
+ * docs/design/appendices/opencode-backend.md §6.6.1 — HTTP Basic Auth `fetch` wrapper for
+ * the Remote-mode `RemoteOpencodeServerManager` (and as a defense-in-depth
+ * for Managed mode when `OPENCODE_SERVER_PASSWORD` is non-empty).
+ *
+ * Managed mode runs on loopback (`127.0.0.1`) and the spawned opencode
+ * server in 1.14.50 does not enforce Basic Auth by default — but if the
+ * operator's environment has a global `OPENCODE_SERVER_PASSWORD` set, the
+ * server will require the header. Always wiring this wrapper means the
+ * daemon stays correct under both setups without conditional plumbing.
+ *
+ * Phase 5 (Remote mode) is the primary consumer; in Phase 2 the wrapper
+ * is constructed and exercised by the manager's `fetch` injection slot.
+ */
+export interface BasicAuthCredentials {
+    username: string;
+    password: string;
+}
+/**
+ * Return a `fetch`-compatible function that adds an HTTP Basic Auth
+ * `Authorization` header to every request when `credentials` is set.
+ * When `credentials` is null/undefined, the underlying fetch is returned
+ * unchanged — callers can wire this wrapper unconditionally without
+ * sniffing the keychain at every call site.
+ */
+export declare function createBasicAuthFetch(credentials: BasicAuthCredentials | null | undefined, underlyingFetch?: typeof fetch): typeof fetch;

package/dist/core/backends/opencode-basic-auth-fetch.js

@@ -0,0 +1,39 @@
+/**
+ * docs/design/appendices/opencode-backend.md §6.6.1 — HTTP Basic Auth `fetch` wrapper for
+ * the Remote-mode `RemoteOpencodeServerManager` (and as a defense-in-depth
+ * for Managed mode when `OPENCODE_SERVER_PASSWORD` is non-empty).
+ *
+ * Managed mode runs on loopback (`127.0.0.1`) and the spawned opencode
+ * server in 1.14.50 does not enforce Basic Auth by default — but if the
+ * operator's environment has a global `OPENCODE_SERVER_PASSWORD` set, the
+ * server will require the header. Always wiring this wrapper means the
+ * daemon stays correct under both setups without conditional plumbing.
+ *
+ * Phase 5 (Remote mode) is the primary consumer; in Phase 2 the wrapper
+ * is constructed and exercised by the manager's `fetch` injection slot.
+ */
+/**
+ * Return a `fetch`-compatible function that adds an HTTP Basic Auth
+ * `Authorization` header to every request when `credentials` is set.
+ * When `credentials` is null/undefined, the underlying fetch is returned
+ * unchanged — callers can wire this wrapper unconditionally without
+ * sniffing the keychain at every call site.
+ */
+export function createBasicAuthFetch(credentials, underlyingFetch = fetch) {
+    if (!credentials)
+        return underlyingFetch;
+    const { username, password } = credentials;
+    if (!username || !password)
+        return underlyingFetch;
+    // RFC 7617 — username:password base64-encoded. Use Buffer to keep the
+    // call usable in non-browser Node runtimes.
+    const token = Buffer.from(`${username}:${password}`, "utf8").toString("base64");
+    const authHeader = `Basic ${token}`;
+    return async (input, init) => {
+        const headers = new Headers(init?.headers ?? {});
+        if (!headers.has("authorization")) {
+            headers.set("authorization", authHeader);
+        }
+        return underlyingFetch(input, { ...init, headers });
+    };
+}

package/dist/core/backends/opencode-config-builder.d.ts

@@ -0,0 +1,113 @@
+/**
+ * docs/design/appendices/opencode-backend.md §5.1 / §5.8 / Phase 3 — assemble the
+ * complete `OpencodeRuntimeConfig` envelope a session needs.
+ *
+ * Inputs (already normalised by caller):
+ *   - `modelId`: provider/model composite from the BackendRouter.
+ *   - `executionMode`: per-backend Safe/Allow posture.
+ *   - `disallowedTools`: per-session denylist (Claude-shaped).
+ *   - `allowedToolsOverride`: dashboard widen list (Claude-shaped) or null.
+ *   - `mcpRender`: result of `renderOpencodeMcp` — the per-session `mcp`
+ *     map plus warnings the dashboard surfaces.
+ *
+ * Outputs:
+ *   - `config`: the envelope to pass through to `serverManager.ensureConfig()`
+ *     (which hashes it and bounces the server if it differs from the
+ *     running hash). Per §5.1 the daemon ALWAYS emits a full self-contained
+ *     JSON — no field is left to the merge layer.
+ *   - `warnings`: collected from both translators so the dashboard can
+ *     show the operator which entries opencode can't express verbatim.
+ *
+ * Self-contained invariant: every field on `OpencodeRuntimeConfig` is
+ * explicit (or deliberately omitted) so the daemon's behaviour does not
+ * depend on the merge-vs-replace semantics of `OPENCODE_CONFIG_CONTENT`
+ * (§10 D1, deferred). This means a same-envelope second turn produces a
+ * bit-identical config and skips the bounce (§5.1 cost model).
+ *
+ * Pure function — no I/O, no DB reads. Wired into `OpencodeCore.execute()`
+ * after `materializeMcpForSession` resolves the per-backend MCP list.
+ */
+import { type ExecutionPermissionMode, type OpencodeBashPermission, type OpencodeMcpServerConfig, type OpencodePermissionConfig, type OpencodeRuntimeConfig } from "@aitne/shared";
+export interface OpencodeConfigBuilderInput {
+    modelId: string;
+    executionMode: ExecutionPermissionMode;
+    disallowedTools: readonly string[];
+    allowedToolsOverride: readonly string[] | null;
+    mcpDisallowed: readonly string[];
+    /**
+     * Per-session MCP map (already filtered to enabled + opencode-targeted
+     * + name-linted by `renderOpencodeMcp`). Empty when no MCP targets the
+     * session.
+     */
+    mcp: Record<string, OpencodeMcpServerConfig>;
+    /**
+     * V1+V2 — `AGENTS.md` and `.claude/skills/<name>/SKILL.md` are
+     * auto-discovered from the session cwd. The default is therefore an
+     * EMPTY instructions array; the daemon explicitly omits the field.
+     * Operators set `PA_OPENCODE_DEFENSIVE_INSTRUCTIONS=1` to force-emit
+     * the defensive glob list.
+     */
+    defensiveInstructions?: boolean;
+    /**
+     * Extra hard-disable tool entries (e.g. `read: false` when a session
+     * must have zero read capability). Composed with the V8 subagent
+     * suppression (`task: false`) the builder always emits.
+     */
+    extraHardDisable?: Record<string, boolean>;
+}
+export interface OpencodeConfigBuilderResult {
+    config: OpencodeRuntimeConfig;
+    /**
+     * Operator-facing notices from the permission translator and the MCP
+     * renderer. Dashboard surfaces these inline on the runtime-config
+     * preview tile.
+     */
+    warnings: string[];
+}
+/**
+ * Merge two `OpencodePermissionConfig` blocks. The second argument
+ * **wins** for whole-key collisions — absolute-block entries override
+ * any user-configured allow/deny. For the `bash` pattern-map, the merge
+ * is per-pattern with `b` winning.
+ *
+ * Why per-pattern merge: a Phase-3 acceptance gate requires that an
+ * operator who explicitly allows `Bash(npm *)` does not have their
+ * allow erased by the absolute-block layer (which has no `npm *` deny).
+ * Same-pattern collisions deny-wins because the absolute-block layer
+ * is non-negotiable.
+ */
+declare function mergePermissions(base: OpencodePermissionConfig, override: OpencodePermissionConfig): OpencodePermissionConfig;
+declare function mergeBash(base: OpencodeBashPermission | undefined, override: OpencodeBashPermission): OpencodeBashPermission;
+/**
+ * Build the complete `OpencodeRuntimeConfig` for a session.
+ *
+ * Ordering invariants (locked by `opencode-config-builder.test.ts`):
+ *   1. The per-session translator's output is built FIRST (so warnings
+ *      reflect what the operator configured).
+ *   2. The absolute-block layer is merged on top — its denies always win
+ *      over any per-session allow.
+ *   3. `tools` is composed as `{ task: false, …caller-extras, …read-hard-
+ *      disable }` — the order matches the JSON serialisation order and
+ *      keeps the hash stable across same-envelope turns.
+ */
+export declare function buildOpencodeRuntimeConfig(input: OpencodeConfigBuilderInput): OpencodeConfigBuilderResult;
+/**
+ * `PA_OPENCODE_DEFENSIVE_INSTRUCTIONS=1` opts in to the defensive
+ * `instructions` glob list. Centralised here so callers don't repeat
+ * the env-var-name string.
+ */
+/**
+ * Test-only re-export of the internal merge helpers. The future-proof
+ * branches in `mergePermissions` (edit / webfetch / doom_loop /
+ * external_directory) and the `typeof override === "string"` short-circuit
+ * in `mergeBash` are unreachable from the current absolute-block layer
+ * (which only emits bash patterns). Surfacing them keeps the unit tests
+ * able to pin the merge contract that protects future absolute-block
+ * shapes — same convention as `claude-code-core._testInternals`.
+ */
+export declare const _testInternals: {
+    mergePermissions: typeof mergePermissions;
+    mergeBash: typeof mergeBash;
+};
+export declare function defensiveInstructionsFromEnv(env?: NodeJS.ProcessEnv): boolean;
+export {};

package/dist/core/backends/opencode-config-builder.js

@@ -0,0 +1,184 @@
+/**
+ * docs/design/appendices/opencode-backend.md §5.1 / §5.8 / Phase 3 — assemble the
+ * complete `OpencodeRuntimeConfig` envelope a session needs.
+ *
+ * Inputs (already normalised by caller):
+ *   - `modelId`: provider/model composite from the BackendRouter.
+ *   - `executionMode`: per-backend Safe/Allow posture.
+ *   - `disallowedTools`: per-session denylist (Claude-shaped).
+ *   - `allowedToolsOverride`: dashboard widen list (Claude-shaped) or null.
+ *   - `mcpRender`: result of `renderOpencodeMcp` — the per-session `mcp`
+ *     map plus warnings the dashboard surfaces.
+ *
+ * Outputs:
+ *   - `config`: the envelope to pass through to `serverManager.ensureConfig()`
+ *     (which hashes it and bounces the server if it differs from the
+ *     running hash). Per §5.1 the daemon ALWAYS emits a full self-contained
+ *     JSON — no field is left to the merge layer.
+ *   - `warnings`: collected from both translators so the dashboard can
+ *     show the operator which entries opencode can't express verbatim.
+ *
+ * Self-contained invariant: every field on `OpencodeRuntimeConfig` is
+ * explicit (or deliberately omitted) so the daemon's behaviour does not
+ * depend on the merge-vs-replace semantics of `OPENCODE_CONFIG_CONTENT`
+ * (§10 D1, deferred). This means a same-envelope second turn produces a
+ * bit-identical config and skips the bounce (§5.1 cost model).
+ *
+ * Pure function — no I/O, no DB reads. Wired into `OpencodeCore.execute()`
+ * after `materializeMcpForSession` resolves the per-backend MCP list.
+ */
+import { buildOpencodePermission, } from "@aitne/shared";
+import { buildOpencodeAbsoluteBlockPermission } from "../../safety/always-disallowed.js";
+/**
+ * Defensive `instructions` glob list (V12 — only useful when the
+ * session cwd is symlinked or chrooted in a way that defeats
+ * auto-discovery). Skills are intentionally NOT listed here — including
+ * `.claude/skills/**\/SKILL.md` would inflate the system prompt with
+ * every skill body. Skills auto-discover separately via opencode's
+ * `skill` tool (§5.5).
+ */
+const DEFENSIVE_INSTRUCTIONS = [
+    "AGENTS.md",
+    ".opencode/agent/*.md",
+];
+/**
+ * Merge two `OpencodePermissionConfig` blocks. The second argument
+ * **wins** for whole-key collisions — absolute-block entries override
+ * any user-configured allow/deny. For the `bash` pattern-map, the merge
+ * is per-pattern with `b` winning.
+ *
+ * Why per-pattern merge: a Phase-3 acceptance gate requires that an
+ * operator who explicitly allows `Bash(npm *)` does not have their
+ * allow erased by the absolute-block layer (which has no `npm *` deny).
+ * Same-pattern collisions deny-wins because the absolute-block layer
+ * is non-negotiable.
+ */
+function mergePermissions(base, override) {
+    const out = { ...base };
+    // bash — pattern-map vs triple merge
+    if (override.bash !== undefined) {
+        out.bash = mergeBash(base.bash, override.bash);
+    }
+    // triple-only keys — override wins (absolute-block layer never emits
+    // these today, but kept future-proof).
+    if (override.edit !== undefined)
+        out.edit = override.edit;
+    if (override.webfetch !== undefined)
+        out.webfetch = override.webfetch;
+    if (override.doom_loop !== undefined)
+        out.doom_loop = override.doom_loop;
+    if (override.external_directory !== undefined) {
+        out.external_directory = override.external_directory;
+    }
+    return out;
+}
+function mergeBash(base, override) {
+    // Override is a triple: it is by definition the strongest expression on
+    // this key, so it wins wholesale.
+    if (typeof override === "string")
+        return override;
+    if (base === undefined) {
+        return { ...override };
+    }
+    if (typeof base === "string") {
+        // Base is a wholesale triple ("deny" / "ask" / "allow" — only "deny"
+        // is reachable today via bare `Bash` in disallowedTools, but the
+        // future-proof branches stay so a per-session translator gaining
+        // bash:"ask"/"allow" emission later does not silently regress).
+        //
+        // The override is a pattern map of absolute-block denies. We MUST
+        // preserve base's wholesale semantic, otherwise a user who said
+        // "deny all bash" (bare `Bash`) would see their policy silently
+        // widened to "deny only the absolute-block patterns" once those
+        // patterns merge in. Encode the wholesale semantic as a `"*"`
+        // catch-all on the merged pattern map — opencode's pattern matcher
+        // prefers specific patterns over `*`, so the absolute-block entries
+        // remain enforceable AND the catch-all carries the base value for
+        // every unlisted command.
+        const merged = { ...override };
+        if (merged["*"] === undefined) {
+            merged["*"] = base;
+        }
+        return merged;
+    }
+    // Both are pattern-maps. Merge — override wins per-key.
+    const merged = { ...base };
+    for (const [pat, value] of Object.entries(override)) {
+        merged[pat] = value;
+    }
+    return merged;
+}
+/**
+ * Build the complete `OpencodeRuntimeConfig` for a session.
+ *
+ * Ordering invariants (locked by `opencode-config-builder.test.ts`):
+ *   1. The per-session translator's output is built FIRST (so warnings
+ *      reflect what the operator configured).
+ *   2. The absolute-block layer is merged on top — its denies always win
+ *      over any per-session allow.
+ *   3. `tools` is composed as `{ task: false, …caller-extras, …read-hard-
+ *      disable }` — the order matches the JSON serialisation order and
+ *      keeps the hash stable across same-envelope turns.
+ */
+export function buildOpencodeRuntimeConfig(input) {
+    const warnings = [];
+    const perSession = buildOpencodePermission({
+        disallowedTools: input.disallowedTools,
+        allowedToolsOverride: input.allowedToolsOverride ?? null,
+        mcpDisallowed: input.mcpDisallowed,
+        mode: input.executionMode,
+    });
+    warnings.push(...perSession.warnings);
+    const absolute = buildOpencodeAbsoluteBlockPermission();
+    warnings.push(...absolute.warnings);
+    // mergePermissions: per-session is the base, absolute-block is the
+    // override. This produces "absolute wins" semantics for any same-key
+    // collision in the bash pattern map.
+    const permission = mergePermissions(perSession.permission, absolute.permission);
+    const tools = {
+        // V8 — subagent suppression. opencode's `task` tool spawns subagents
+        // outside the daemon's audit/stream surface; we always disable it.
+        task: false,
+        ...(input.extraHardDisable ?? {}),
+        ...perSession.toolsHardDisable,
+    };
+    const config = {
+        tools,
+        permission,
+    };
+    // Only emit `model` when the composite parses as provider/model. The
+    // server falls back to its own configured default when the field is
+    // omitted; this keeps the bounce-hash stable when callers (tests)
+    // pass an ad-hoc model id.
+    if (input.modelId.includes("/")) {
+        config.model = input.modelId;
+    }
+    if (Object.keys(input.mcp).length > 0) {
+        config.mcp = input.mcp;
+    }
+    if (input.defensiveInstructions) {
+        config.instructions = [...DEFENSIVE_INSTRUCTIONS];
+    }
+    return { config, warnings };
+}
+/**
+ * `PA_OPENCODE_DEFENSIVE_INSTRUCTIONS=1` opts in to the defensive
+ * `instructions` glob list. Centralised here so callers don't repeat
+ * the env-var-name string.
+ */
+/**
+ * Test-only re-export of the internal merge helpers. The future-proof
+ * branches in `mergePermissions` (edit / webfetch / doom_loop /
+ * external_directory) and the `typeof override === "string"` short-circuit
+ * in `mergeBash` are unreachable from the current absolute-block layer
+ * (which only emits bash patterns). Surfacing them keeps the unit tests
+ * able to pin the merge contract that protects future absolute-block
+ * shapes — same convention as `claude-code-core._testInternals`.
+ */
+export const _testInternals = {
+    mergePermissions,
+    mergeBash,
+};
+export function defensiveInstructionsFromEnv(env = process.env) {
+    return env.PA_OPENCODE_DEFENSIVE_INSTRUCTIONS === "1";
+}