@aitne/daemon 0.1.8 → 0.1.9

package/dist/core/backends/gemini-cli-core.js

@@ -5,6 +5,7 @@ import { APP_NAME, collectSessionDeniedTools, getAgentDayDateStr, INTEGRATION_DE
 import { readIntegrations } from "../../db/integrations-store.js";
 import { getContextDir } from "../../config.js";
 import { cleanupSessionWorkdir, createSessionWorkdir } from "../workdir.js";
+import { resolveUserSkillsRoot } from "../user-skills-root.js";
 import { BackendDecisiveFailure, BackendQuotaError, DelegatedProxyTimeoutError, classifyAbortReason, } from "../agent-core.js";
 import { IdleWatchdog } from "./idle-watchdog.js";
 import { buildDelegatedToolPrompt, emptyCost, tryParseToolResult, withDurationMs, } from "../../services/delegated-tool-runtime.js";
@@ -18,10 +19,11 @@ import { ALWAYS_DISALLOWED_TOOLS } from "../../safety/always-disallowed.js";
 import { CliPathCache, parseJsonLine, runLineCommand, } from "./cli-utils.js";
 import { isPathInsideOrEqual, jsonStringPathForms, shellPathForms, } from "../path-compat.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
-import { buildAgentDayBoundaryHint, extractGenericQuotaResetHint, } from "./quota-reset-hints.js";
+import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, } from "./cli-quota-guards.js";
+import { buildAgentDayBoundaryHint } from "./quota-reset-hints.js";
 import { auditStreamObservation, extractGeminiToolUseTarget, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
-import { estimateTextInputTokens, findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
+import { findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
 import { PriceFetcher } from "./price-fetcher.js";
 import { buildExecutionPrompt, buildSummaryPrompt } from "./prompt-utils.js";
 import { createLogger } from "../../logging.js";
@@ -64,9 +66,9 @@ const EMPTY_USAGE = {
  * threshold catches a fully hung CLI subprocess (zero stream events)
  * well before `executeTimeoutMinutes` (default 30 min) fires.
  *
- * Audit 2026-05-17: the delegated path had this guard; the reactive
- * path was unprotected and a hung subprocess could pin a session for
- * the full 30-min wall-clock.
+ * The reactive path needs this guard explicitly: without it, a hung
+ * subprocess could pin a session for the full executeTimeoutMinutes
+ * wall-clock.
  */
 const REACTIVE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
 export class GeminiCliCore {
@@ -158,6 +160,10 @@ export class GeminiCliCore {
             eventCorrelationId: params.event.correlationId,
             wikiUrlFetchEnabled: params.wikiUrlFetchEnabled ?? false,
             ...(isMessageEvent(params.event) ? { messageText: params.event.content } : {}),
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         }, streamCallbacks);
     }
     async executeResume(params, streamCallbacks) {
@@ -425,8 +431,8 @@ export class GeminiCliCore {
         // and therefore can never contain a native CLI skill tool we did
         // not register). The `gemini --help` subcommand probe below is the
         // real detector: `gemini --help` already lists `gemini skills`
-        // natively (verified 2026-05-15), so this is the call site that
-        // will trip on first deploy and surface the cleanup follow-up PR.
+        // natively, so this is the call site that will trip on first deploy
+        // and need cleanup.
         noteNativeSkillToolIfPresent("gemini", deduped);
         void probeCliNativeSkillSubcommand(this.cliPath, "gemini");
         return deduped;
@@ -467,7 +473,7 @@ export class GeminiCliCore {
         }
         this.assertPromptWithinMaxBudget(params.prompt, params.maxBudgetUsd, params.modelId);
         const startMs = Date.now();
-        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, `${this.config.dataDir}/skills`, {
+        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, resolveUserSkillsRoot(this.config), {
             backendId: this.backendId,
             processKey: params.processKey,
             character: this.config.character,
@@ -480,6 +486,12 @@ export class GeminiCliCore {
             ...((this.db ?? this.mcpContext?.db) ? { db: this.db ?? this.mcpContext?.db ?? null } : {}),
             ...(typeof params.messageText === "string" ? { messageText: params.messageText } : {}),
             ...(params.wikiWorkspaceName ? { wikiWorkspaceName: params.wikiWorkspaceName } : {}),
+            // AGENT_DEFINITIONS_DESIGN.md §4.2 — see ClaudeCodeCore. No-op for
+            // non-Agent executes.
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         });
         const ownsSessionDir = !params.sessionDir;
         const daemonReadToken = this.readTokenManager?.issue(sessionDir) ?? this.readToken;
@@ -565,8 +577,17 @@ export class GeminiCliCore {
         });
         try {
             idleWatchdog.start();
+            // Spawn the resolved CLI path, not the bare name. `this.cliPath` is the
+            // PATHEXT-resolved binary (e.g. `gemini.cmd` on Windows, where the npm
+            // shim has no extensionless entry); a literal `"gemini"` ENOENTs there.
+            // Mirrors the delegated/probe paths (~2330, ~2781). The getter is typed
+            // `string | null`, so narrow before assigning to the `string` field —
+            // `checkAuth()` already returns ok:false when null but doesn't narrow.
+            if (!this.cliPath) {
+                throw new BackendDecisiveFailure(this.backendId, "auth", new Error("gemini CLI not found on PATH"));
+            }
             const runResult = await runLineCommand({
-                command: "gemini",
+                command: this.cliPath,
                 args: this.buildArgs(params, policyPath),
                 cwd: sessionDir,
                 env: {
@@ -620,7 +641,7 @@ export class GeminiCliCore {
                             });
                         }
                     }
-                    // B-003 Phase 4.4 — persist MCP tool call to `mcp_tool_calls`.
+                    // Persist MCP tool call to `mcp_tool_calls`.
                     // Gemini emits `mcp_<server>_<tool>` (single underscore — see
                     // parseMcpToolName); host-installed Gemini MCPs (like
                     // `google-workspace` from extensions, or user-added `notion`)
@@ -1665,77 +1686,39 @@ ${fetchClause}`;
             logger.warn({ err }, "Failed to persist Gemini request counter");
         }
     }
+    // Failure classification + budget enforcement share a skeleton with the
+    // Codex core; the logic lives in `cli-quota-guards.ts` (single source of
+    // truth) and each backend passes its own regexes / label. Gemini adds a
+    // pre-auth policy-deny branch via `classifyGeminiPolicyDeny`.
     classifyFailure(message) {
-        if (isMaxBudgetMessage(message)) {
-            return new BackendQuotaError(this.backendId, "max_budget_usd", null, message);
-        }
-        if (/rate limit|quota|429/i.test(message)) {
-            // Best-effort reset-time extraction so the dashboard can surface
-            // "quota resets at HH:MM (TZ)". Google API quota errors often carry
-            // "Quota exceeded ... reset time YYYY-MM-DDTHH:MM:SSZ" or a
-            // retry-after offset; the helper falls through to null otherwise.
-            return new BackendQuotaError(this.backendId, "rate_limited", extractGenericQuotaResetHint(message), message);
-        }
-        // Policy-deny classification must run BEFORE the auth branch — the
-        // generated TOML's deny messages can legitimately contain words like
-        // "required" or "login" (e.g. a future "<X> login is not permitted in
-        // daemon mode" rule), and we don't want those to mis-tag as `auth`
-        // and trigger an auth-recovery flow when the real cause is the agent
-        // attempting a forbidden tool call. The match targets the wrap the
-        // Gemini CLI emits today for TOML deny hits — `Error executing tool
-        // …: Tool execution denied by policy. <denyMessage>`. Tight enough to
-        // avoid false positives on real auth/quota messages; not claimed to
-        // be exhaustive across other Gemini policy surfaces (sandbox kills,
-        // MCP allowlist, future hook variants), which can be added here as
-        // they're observed in the wild.
-        if (/tool execution denied|denied by policy/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "policy_denied", new Error(message));
-        }
-        if (/authentication page|oauth|api key|login|required/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "auth", new Error(message));
-        }
-        if (/timed out|timeout/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "timeout", new Error(message));
-        }
-        return new BackendDecisiveFailure(this.backendId, "other_non_retryable", new Error(message));
+        return classifyCliFailure({
+            backendId: this.backendId,
+            message,
+            // Google API quota surfaces as "rate limit" / "quota" / HTTP 429.
+            rateLimitPattern: /rate limit|quota|429/i,
+            authPattern: /authentication page|oauth|api key|login|required/i,
+            extraClassifier: classifyGeminiPolicyDeny,
+        });
     }
-    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, 
-    /**
-     * Mirrors `CodexCore.assertWithinMaxBudget` — Gemini also enforces the
-     * per-turn budget post-hoc (by the time we reject here Google has
-     * already consumed tokens), so attach the actual spend so the
-     * dispatcher's error path can write a `result='failed'` agent_actions
-     * row with `cost_usd` / `numTurns` / `durationMs` populated. Without
-     * this, budget-rejected Gemini runs silently drop their spend on the
-     * success-only audit path — the same dashboard gap the Codex fix
-     * closed. See `BackendQuotaSpend` for the full contract.
-     */
-    spend) {
-        if (maxBudgetUsd === undefined || costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Gemini CLI estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`, spend ? { ...spend, modelId, costUsd } : null);
+    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, spend) {
+        assertCostWithinMaxBudget({
+            backendId: this.backendId,
+            label: "Gemini CLI",
+            costUsd,
+            maxBudgetUsd,
+            modelId,
+            spend,
+        });
     }
     assertPromptWithinMaxBudget(prompt, maxBudgetUsd, modelId) {
-        if (maxBudgetUsd === undefined) {
-            return;
-        }
-        const estimatedUsage = {
-            inputTokens: estimateTextInputTokens(prompt),
-            outputTokens: 0,
-            cacheCreationInputTokens: 0,
-            cacheReadInputTokens: 0,
-        };
-        const { costUsd } = this.priceFetcher.estimateUsageCost({
+        assertPromptCostWithinMaxBudget({
             backendId: this.backendId,
+            label: "Gemini CLI",
+            prompt,
+            maxBudgetUsd,
             modelId,
-            usage: estimatedUsage,
-            fallbackModel: findRegisteredModel(this.backendId, modelId),
+            priceFetcher: this.priceFetcher,
         });
-        if (costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Gemini CLI estimated prompt cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
     }
     /**
      * Delegated proxy invocation — Gemini CLI path.
@@ -1787,7 +1770,7 @@ ${fetchClause}`;
                 cost: withDurationMs(emptyCost(), startMs),
             };
         }
-        // Daily-request quota gate. Mirrors `runTurn` (line 480-495) — Gemini
+        // Daily-request quota gate. Mirrors `runTurn`'s gate — Gemini
         // meters per-day model requests via plan-preset `dailyRequestCeiling`
         // (900/1350/1800), and proxy invocations consume the same quota as
         // direct execute()s. Without this gate, proxy calls would silently
@@ -1838,10 +1821,8 @@ ${fetchClause}`;
         // Local aborter bridged from the caller's signal so we can also
         // trigger an early abort on wrong-tool detection without polluting
         // the caller's signal. Without early abort, a wrong-tool failure
-        // burns the full 180s gemini wall-clock waiting for natural
-        // completion (audit log 2026-05-01: 9.5s when subprocess completes
-        // naturally, but up to 180s when the model loops on the missing
-        // tool name). Abort caps it at ~5s.
+        // burns the full gemini wall-clock waiting for natural completion;
+        // abort caps it at ~5s.
         const proxyAborter = new AbortController();
         const callerAbortListener = () => {
             proxyAborter.abort(abortSignal?.reason);
@@ -1856,14 +1837,14 @@ ${fetchClause}`;
                 });
             }
         }
-        // Idle / hang watchdog. `gemini-cli` has been observed (audit log
-        // 2026-05-02 / 2026-05-03: 9 / 83 cadence calls) to lock up entirely
-        // — subprocess alive, zero stream-json output, only the 180s wall-
-        // clock fires. The idle detector trips much earlier (75s default,
-        // see `delegated-proxy-config.ts`) by treating each arrived line as
-        // a heartbeat. On trip, we abort with a `DelegatedProxyTimeoutError`
-        // so the post-loop classifier maps to `errorClass="timeout"`,
-        // identical to wall-clock — the cadence retry path stays uniform.
+        // Idle / hang watchdog. `gemini-cli` has been observed to lock up
+        // entirely — subprocess alive, zero stream-json output, only the
+        // wall-clock fires. The idle detector trips much earlier (75s
+        // default, see `delegated-proxy-config.ts`) by treating each
+        // arrived line as a heartbeat. On trip, we abort with a
+        // `DelegatedProxyTimeoutError` so the post-loop classifier maps to
+        // `errorClass="timeout"`, identical to wall-clock — the cadence
+        // retry path stays uniform.
         let idleTimedOut = false;
         const idleTimeoutMs = DELEGATED_PROXY_DEFAULTS.idleTimeoutMsByBackend.gemini
             ?? DELEGATED_PROXY_DEFAULTS.idleTimeoutMs;
@@ -2112,8 +2093,9 @@ ${fetchClause}`;
                     cost,
                 };
             }
-            // Bump the per-agent-day counter on the success path only, mirroring
-            // `runTurn` line 720. Proxy success consumes one Gemini request
+            // Bump the per-agent-day counter on the success path only,
+            // mirroring `runTurn`'s success-path counter bump. Proxy success
+            // consumes one Gemini request
             // (turn-level approximation; tool fanout still counts as one,
             // matching the existing accounting).
             this.incrementRequestsCount(today);
@@ -2538,8 +2520,24 @@ ${fetchClause}`;
         return parts.join("\n");
     }
 }
-function isMaxBudgetMessage(message) {
-    return /max(?:imum)? budget|max_budget_usd|budget limit|per-turn budget/i.test(message);
+/**
+ * Gemini-specific pre-auth classifier for `classifyCliFailure`. Policy-deny
+ * classification must run BEFORE the auth branch — the generated TOML's deny
+ * messages can legitimately contain words like "required" or "login" (e.g. a
+ * future "<X> login is not permitted in daemon mode" rule), and we don't want
+ * those to mis-tag as `auth` and trigger an auth-recovery flow when the real
+ * cause is the agent attempting a forbidden tool call. The match targets the
+ * wrap the Gemini CLI emits today for TOML deny hits — `Error executing tool
+ * …: Tool execution denied by policy. <denyMessage>`. Tight enough to avoid
+ * false positives on real auth/quota messages; not claimed to be exhaustive
+ * across other Gemini policy surfaces (sandbox kills, MCP allowlist, future
+ * hook variants), which can be added here as they're observed in the wild.
+ */
+function classifyGeminiPolicyDeny(message, backendId) {
+    if (/tool execution denied|denied by policy/i.test(message)) {
+        return new BackendDecisiveFailure(backendId, "policy_denied", new Error(message));
+    }
+    return null;
 }
 function normalizeGeminiUsage(stats) {
     if (!stats) {
@@ -2721,4 +2719,3 @@ export function extractGeminiServerName(toolNamespace) {
         return rest.length > 0 ? rest : null;
     return sep === 0 ? null : rest.slice(0, sep);
 }
-//# sourceMappingURL=gemini-cli-core.js.map

package/dist/core/backends/idle-watchdog.d.ts

@@ -74,4 +74,3 @@ export declare class IdleWatchdog {
     hasFired(): boolean;
     private poll;
 }
-//# sourceMappingURL=idle-watchdog.d.ts.map

package/dist/core/backends/idle-watchdog.js

@@ -91,4 +91,3 @@ export class IdleWatchdog {
         this.onTimeout(idleMs);
     }
 }
-//# sourceMappingURL=idle-watchdog.js.map

package/dist/core/backends/install-methods.d.ts

@@ -90,4 +90,3 @@ export declare function resolveInstallCommand(backendId: BackendId, methodId: st
     executable: string;
     args: string[];
 } | null;
-//# sourceMappingURL=install-methods.d.ts.map

package/dist/core/backends/install-methods.js

@@ -286,4 +286,3 @@ export function resolveInstallCommand(backendId, methodId) {
         args: parts.slice(1),
     };
 }
-//# sourceMappingURL=install-methods.js.map

package/dist/core/backends/model-registry.d.ts

@@ -16,7 +16,7 @@ import type { BackendId, BackendModel, BackendModelTier, BackendUsage } from "@a
  */
 export declare const DEFAULT_CLAUDE_LITE_MODEL = "claude-haiku-4-5-20251001";
 export declare const DEFAULT_CLAUDE_MEDIUM_MODEL = "claude-sonnet-4-6";
-export declare const DEFAULT_CLAUDE_HIGH_MODEL = "claude-opus-4-7";
+export declare const DEFAULT_CLAUDE_HIGH_MODEL = "claude-opus-4-8";
 export declare const DEFAULT_CODEX_LITE_MODEL = "gpt-5.4-mini";
 export declare const DEFAULT_CODEX_MEDIUM_MODEL = "gpt-5.4";
 export declare const DEFAULT_CODEX_HIGH_MODEL = "gpt-5.4";
@@ -25,7 +25,7 @@ export declare const DEFAULT_GEMINI_MEDIUM_MODEL = "gemini-3.1-pro-preview";
 export declare const DEFAULT_GEMINI_HIGH_MODEL = "gemini-3.1-pro-preview";
 export declare const DEFAULT_OPENCODE_LITE_MODEL = "anthropic/claude-haiku-4-5";
 export declare const DEFAULT_OPENCODE_MEDIUM_MODEL = "anthropic/claude-sonnet-4-6";
-export declare const DEFAULT_OPENCODE_HIGH_MODEL = "anthropic/claude-opus-4-7";
+export declare const DEFAULT_OPENCODE_HIGH_MODEL = "anthropic/claude-opus-4-8";
 export declare function getModelsForBackend(backendId: BackendId): ReadonlyArray<BackendModel>;
 export declare function findRegisteredModel(backendId: BackendId, modelId: string): BackendModel | undefined;
 /**
@@ -60,4 +60,3 @@ export declare function estimateCostForUsage(model: BackendModel | undefined, us
 export declare function estimateTextInputTokens(text: string): number;
 /** Get the human-readable label for a model, falling back to the raw modelId. */
 export declare function getModelLabel(backendId: BackendId, modelId: string): string;
-//# sourceMappingURL=model-registry.d.ts.map

package/dist/core/backends/model-registry.js

@@ -16,7 +16,7 @@
 // Claude
 export const DEFAULT_CLAUDE_LITE_MODEL = "claude-haiku-4-5-20251001";
 export const DEFAULT_CLAUDE_MEDIUM_MODEL = "claude-sonnet-4-6";
-export const DEFAULT_CLAUDE_HIGH_MODEL = "claude-opus-4-7";
+export const DEFAULT_CLAUDE_HIGH_MODEL = "claude-opus-4-8";
 // Codex (gpt-5.4-mini is the lite-tier pick; gpt-5.4 is the medium-tier
 // default — morning_routine / hourly_check / evening_review run on this.
 // gpt-5.5 and gpt-5.5-chat-latest are the flagship reasoning models and
@@ -48,7 +48,7 @@ export const DEFAULT_GEMINI_HIGH_MODEL = "gemini-3.1-pro-preview";
 // in a later phase, so Phase 1 seeds Anthropic-compatible safe defaults.
 export const DEFAULT_OPENCODE_LITE_MODEL = "anthropic/claude-haiku-4-5";
 export const DEFAULT_OPENCODE_MEDIUM_MODEL = "anthropic/claude-sonnet-4-6";
-export const DEFAULT_OPENCODE_HIGH_MODEL = "anthropic/claude-opus-4-7";
+export const DEFAULT_OPENCODE_HIGH_MODEL = "anthropic/claude-opus-4-8";
 const MODEL_REGISTRY = [
     {
         backendId: "claude",
@@ -67,20 +67,43 @@ const MODEL_REGISTRY = [
         maxInputTokens: 1_000_000,
         maxOutputTokens: 64_000,
     },
+    {
+        backendId: "claude",
+        modelId: "claude-opus-4-8",
+        label: "Claude Opus 4.8",
+        displayName: "Claude Opus 4.8",
+        tier: "high",
+        available: true,
+        supportsToolUse: true,
+        supportsStreaming: true,
+        supportsPromptCaching: true,
+        // Anthropic Opus 4 tier: $15/$75/$1.50/$18.75 per MTok in/out/cache-read/cache-create
+        // — same band as 4.7. The SDK's `total_cost_usd` is the trusted source; pin
+        // `pricingTrusted` so the community price-fetcher can't clobber it with the
+        // stale 4.6-tier rate LiteLLM lists for the newest Opus generation.
+        usdPer1kIn: 0.015,
+        usdPer1kOut: 0.075,
+        usdPer1kCacheRead: 0.0015,
+        usdPer1kCacheCreate: 0.01875,
+        pricingTrusted: true,
+        maxInputTokens: 1_000_000,
+        maxOutputTokens: 128_000,
+    },
     {
         backendId: "claude",
         modelId: "claude-opus-4-7",
-        label: "Claude Opus 4.7",
-        displayName: "Claude Opus 4.7",
+        label: "Claude Opus 4.7 (legacy)",
+        displayName: "Claude Opus 4.7 (legacy)",
         tier: "high",
         available: true,
+        deprecated: true,
         supportsToolUse: true,
         supportsStreaming: true,
         supportsPromptCaching: true,
         // Anthropic Opus 4 tier: $15/$75/$1.50/$18.75 per MTok in/out/cache-read/cache-create.
-        // LiteLLM's community data lists 4-7 at 1/3 of this (4.6-tier rate); pin trust
-        // to the registry until upstream catches up. SDK's `total_cost_usd` confirms
-        // 4-7 is billed at the full Opus 4 rate.
+        // Demoted to legacy when 4.8 shipped; kept available so existing pins keep
+        // resolving with correct pricing. SDK's `total_cost_usd` confirms 4-7 is
+        // billed at the full Opus 4 rate.
         usdPer1kIn: 0.015,
         usdPer1kOut: 0.075,
         usdPer1kCacheRead: 0.0015,
@@ -158,13 +181,32 @@ const MODEL_REGISTRY = [
         maxInputTokens: 1_000_000,
         maxOutputTokens: 64_000,
     },
+    {
+        backendId: "opencode",
+        modelId: "anthropic/claude-opus-4-8",
+        label: "OpenCode Claude Opus 4.8",
+        displayName: "Claude Opus 4.8",
+        tier: "high",
+        available: true,
+        supportsToolUse: true,
+        supportsStreaming: true,
+        supportsPromptCaching: true,
+        usdPer1kIn: 0.015,
+        usdPer1kOut: 0.075,
+        usdPer1kCacheRead: 0.0015,
+        usdPer1kCacheCreate: 0.01875,
+        pricingTrusted: true,
+        maxInputTokens: 1_000_000,
+        maxOutputTokens: 128_000,
+    },
     {
         backendId: "opencode",
         modelId: "anthropic/claude-opus-4-7",
-        label: "OpenCode Claude Opus 4.7",
-        displayName: "Claude Opus 4.7",
+        label: "OpenCode Claude Opus 4.7 (legacy)",
+        displayName: "Claude Opus 4.7 (legacy)",
         tier: "high",
         available: true,
+        deprecated: true,
         supportsToolUse: true,
         supportsStreaming: true,
         supportsPromptCaching: true,
@@ -202,10 +244,9 @@ const MODEL_REGISTRY = [
         modelId: "gpt-5.5-chat-latest",
         label: "GPT-5.5 Instant",
         displayName: "GPT-5.5 Instant",
-        // Non-thinking sibling of gpt-5.5 — released 2026-05-05 as the new
-        // ChatGPT default (replacing GPT-5.3 Instant). Same model family /
-        // pricing as thinking gpt-5.5 but with no reasoning step, so it
-        // returns a token immediately. Registered under `high` to keep the
+        // Non-thinking sibling of gpt-5.5 — ChatGPT's default. Same model
+        // family / pricing as thinking gpt-5.5 but with no reasoning step,
+        // so it returns a token immediately. Registered under `high` to keep the
         // canonical pricing tier honest (latestHighFor still resolves to
         // thinking gpt-5.5 because that entry comes first in this array);
         // operators can pin it from /settings/models when low latency is
@@ -666,4 +707,3 @@ export function getModelLabel(backendId, modelId) {
 function roundUsd(value) {
     return Math.round(value * 1_000_000) / 1_000_000;
 }
-//# sourceMappingURL=model-registry.js.map

package/dist/core/backends/native-skill-discovery-probe.d.ts

@@ -21,8 +21,7 @@
  *
  *  2. {@link probeCliNativeSkillSubcommand} — runs `<cli> --help` once
  *     and scans the output for a top-level `skill` / `skills`
- *     subcommand. This is the ground-truth signal. Verified at
- *     2026-05-15:
+ *     subcommand. This is the ground-truth signal. Verified:
  *       - `gemini --help` already lists `gemini skills <command>`
  *         (aliased `skill`). When this probe is wired, Gemini will be
  *         the first backend to trip the alarm.
@@ -46,9 +45,8 @@ export declare function noteNativeSkillToolIfPresent(backendId: Exclude<BackendI
 /**
  * Top-level command-line detector. Two anchors:
  *   - `<cli> skill[s]` literal — every CLI we care about renders its
- *     usage lines that way (e.g. `gemini skills <command>` — verified
- *     2026-05-15, codex's hypothetical future form would be
- *     `codex skill <command>`).
+ *     usage lines that way (e.g. `gemini skills <command>`; codex's
+ *     hypothetical future form would be `codex skill <command>`).
  *   - Indented command-list entry `<indent>skill[s]<space>` — the
  *     "Commands:" block shape both yargs (Gemini) and clap (Codex)
  *     render.
@@ -77,4 +75,3 @@ export declare function __resetNativeSkillDiscoveryProbe(): void;
  *  without paying for a subprocess. */
 export declare const __test_helpTextLooksLikeSkillSubcommand: typeof helpTextLooksLikeSkillSubcommand;
 export {};
-//# sourceMappingURL=native-skill-discovery-probe.d.ts.map

package/dist/core/backends/native-skill-discovery-probe.js

@@ -21,8 +21,7 @@
  *
  *  2. {@link probeCliNativeSkillSubcommand} — runs `<cli> --help` once
  *     and scans the output for a top-level `skill` / `skills`
- *     subcommand. This is the ground-truth signal. Verified at
- *     2026-05-15:
+ *     subcommand. This is the ground-truth signal. Verified:
  *       - `gemini --help` already lists `gemini skills <command>`
  *         (aliased `skill`). When this probe is wired, Gemini will be
  *         the first backend to trip the alarm.
@@ -90,9 +89,8 @@ const HELP_PROBE_TIMEOUT_MS = 5_000;
 /**
  * Top-level command-line detector. Two anchors:
  *   - `<cli> skill[s]` literal — every CLI we care about renders its
- *     usage lines that way (e.g. `gemini skills <command>` — verified
- *     2026-05-15, codex's hypothetical future form would be
- *     `codex skill <command>`).
+ *     usage lines that way (e.g. `gemini skills <command>`; codex's
+ *     hypothetical future form would be `codex skill <command>`).
  *   - Indented command-list entry `<indent>skill[s]<space>` — the
  *     "Commands:" block shape both yargs (Gemini) and clap (Codex)
  *     render.
@@ -172,4 +170,3 @@ export function __resetNativeSkillDiscoveryProbe() {
 /** Test-only — extracted for direct coverage of the help-text matcher
  *  without paying for a subprocess. */
 export const __test_helpTextLooksLikeSkillSubcommand = helpTextLooksLikeSkillSubcommand;
-//# sourceMappingURL=native-skill-discovery-probe.js.map

package/dist/core/backends/opencode-basic-auth-fetch.d.ts

@@ -24,4 +24,3 @@ export interface BasicAuthCredentials {
  * sniffing the keychain at every call site.
  */
 export declare function createBasicAuthFetch(credentials: BasicAuthCredentials | null | undefined, underlyingFetch?: typeof fetch): typeof fetch;
-//# sourceMappingURL=opencode-basic-auth-fetch.d.ts.map

package/dist/core/backends/opencode-basic-auth-fetch.js

@@ -37,4 +37,3 @@ export function createBasicAuthFetch(credentials, underlyingFetch = fetch) {
         return underlyingFetch(input, { ...init, headers });
     };
 }
-//# sourceMappingURL=opencode-basic-auth-fetch.js.map

package/dist/core/backends/opencode-config-builder.d.ts

@@ -27,7 +27,7 @@
  * Pure function — no I/O, no DB reads. Wired into `OpencodeCore.execute()`
  * after `materializeMcpForSession` resolves the per-backend MCP list.
  */
-import { type ExecutionPermissionMode, type OpencodeMcpServerConfig, type OpencodeRuntimeConfig } from "@aitne/shared";
+import { type ExecutionPermissionMode, type OpencodeBashPermission, type OpencodeMcpServerConfig, type OpencodePermissionConfig, type OpencodeRuntimeConfig } from "@aitne/shared";
 export interface OpencodeConfigBuilderInput {
     modelId: string;
     executionMode: ExecutionPermissionMode;
@@ -64,6 +64,20 @@ export interface OpencodeConfigBuilderResult {
      */
     warnings: string[];
 }
+/**
+ * Merge two `OpencodePermissionConfig` blocks. The second argument
+ * **wins** for whole-key collisions — absolute-block entries override
+ * any user-configured allow/deny. For the `bash` pattern-map, the merge
+ * is per-pattern with `b` winning.
+ *
+ * Why per-pattern merge: a Phase-3 acceptance gate requires that an
+ * operator who explicitly allows `Bash(npm *)` does not have their
+ * allow erased by the absolute-block layer (which has no `npm *` deny).
+ * Same-pattern collisions deny-wins because the absolute-block layer
+ * is non-negotiable.
+ */
+declare function mergePermissions(base: OpencodePermissionConfig, override: OpencodePermissionConfig): OpencodePermissionConfig;
+declare function mergeBash(base: OpencodeBashPermission | undefined, override: OpencodeBashPermission): OpencodeBashPermission;
 /**
  * Build the complete `OpencodeRuntimeConfig` for a session.
  *
@@ -82,5 +96,18 @@ export declare function buildOpencodeRuntimeConfig(input: OpencodeConfigBuilderI
  * `instructions` glob list. Centralised here so callers don't repeat
  * the env-var-name string.
  */
+/**
+ * Test-only re-export of the internal merge helpers. The future-proof
+ * branches in `mergePermissions` (edit / webfetch / doom_loop /
+ * external_directory) and the `typeof override === "string"` short-circuit
+ * in `mergeBash` are unreachable from the current absolute-block layer
+ * (which only emits bash patterns). Surfacing them keeps the unit tests
+ * able to pin the merge contract that protects future absolute-block
+ * shapes — same convention as `claude-code-core._testInternals`.
+ */
+export declare const _testInternals: {
+    mergePermissions: typeof mergePermissions;
+    mergeBash: typeof mergeBash;
+};
 export declare function defensiveInstructionsFromEnv(env?: NodeJS.ProcessEnv): boolean;
-//# sourceMappingURL=opencode-config-builder.d.ts.map
+export {};

package/dist/core/backends/opencode-config-builder.js

@@ -166,7 +166,19 @@ export function buildOpencodeRuntimeConfig(input) {
  * `instructions` glob list. Centralised here so callers don't repeat
  * the env-var-name string.
  */
+/**
+ * Test-only re-export of the internal merge helpers. The future-proof
+ * branches in `mergePermissions` (edit / webfetch / doom_loop /
+ * external_directory) and the `typeof override === "string"` short-circuit
+ * in `mergeBash` are unreachable from the current absolute-block layer
+ * (which only emits bash patterns). Surfacing them keeps the unit tests
+ * able to pin the merge contract that protects future absolute-block
+ * shapes — same convention as `claude-code-core._testInternals`.
+ */
+export const _testInternals = {
+    mergePermissions,
+    mergeBash,
+};
 export function defensiveInstructionsFromEnv(env = process.env) {
     return env.PA_OPENCODE_DEFENSIVE_INSTRUCTIONS === "1";
 }
-//# sourceMappingURL=opencode-config-builder.js.map

package/dist/core/backends/opencode-core.d.ts

@@ -313,4 +313,3 @@ export declare const STAGE2_TRIAGE_JSON_SCHEMA: {
     readonly required: readonly ["action", "reason"];
     readonly additionalProperties: false;
 };
-//# sourceMappingURL=opencode-core.d.ts.map