@bybrawe/opencode-loop 0.6.6 → 0.6.7

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## Unreleased (main only)
+
+No unreleased changes yet.
+
+## 0.6.7 - 2026-10-09
+
+- Recover the native Loop+Goal coexistence canary's cold Windows server bootstrap with bounded read-only session polling and distinguish server startup hangs from actual autonomous-ownership conflicts.
+- Enforce fail-closed corrupt Loop state reads and protect per-session writes across multiple processes on Windows and Linux, including dead-owner recovery.
+- Support manual native V2 compaction through the public `session.compact` capability, verified by matching manual `inputID`, completion and terminal boundaries.
+- Add read-only Windows Desktop command-registry diagnostics for Loop and Goal and parent-versus-child workspace comparisons; the separate GUI `command.updated` refresh is proposed upstream but not published.
+- Align `/loop-help` with the current compaction behavior, rather than advertising the removed V2 limitation.
+
 ## 0.6.6 - 2026-10-04
 
 - Make a normal Loop install/update strictly Loop-only: it no longer installs, detects, refreshes, migrates, or modifies the dedicated `@bybrawe/opencode-goal` package.

package/README.md

@@ -1,6 +1,6 @@
 # OpenCode Loop
 
-## Native OpenCode 2 (0.6.6)
+## Native OpenCode 2 (0.6.7)
 
 The npm and V2 entrypoints use the official `@opencode/plugin` `Plugin.define()` contract. The installer now registers the exact `@bybrawe/opencode-loop` package in OpenCode's plural `plugins` configuration instead of copying a loose global plugin directory. OpenCode therefore resolves `@opencode/plugin` from Loop's own production dependency graph; explicit `--legacy-v1` remains a separate compatibility path.
 
@@ -8,7 +8,7 @@ The installer defaults to the native V2 package plugin. It needs no loose local
 
 V2 prompt admission and durable inbox/execution/compaction events own scheduling. Core-generated user-role messages never authorize a session abort. An unfinished dedicated Goal reserves its session, including paused and handed-off states; Loop does not wake or replace that Goal. Soft iteration timeouts do not abort a native model/tool/compaction turn.
 
-Scheduled shell commands use Loop-managed bounded local child processes; the OpenCode 2 `ctx.shell` surface is a hook domain, not a command-execution API. Automatic compaction stays host-owned. **The public OpenCode 2 SessionDomain has no manual compaction action, so `/loop-compact`, `--compact`, and `--compact-every` are rejected before job creation instead of probing undocumented `session.compact` fields.** Use OpenCode's built-in manual/automatic compaction on V2.
+Automatic compaction remains host-owned. On OpenCode 2 versions exposing public `session.compact`, Loop's explicit native compaction is capability-gated and waits for its own manual `session.compaction.started` input ID, compaction completion, and a session terminal event. Older hosts reject unsupported compaction before scheduling.
 
 Prompt/command timers, watch and stop conditions, verification, preflight/postrun, notifications, checkpoints and diagnostic commands use the V2 runtime. Uncertain restart admissions pause for review rather than replaying potentially admitted work. The dedicated `@bybrawe/opencode-goal` plugin owns `/goal`; legacy Loop Goal records are preserved and are not silently reinterpreted as new Goal contracts.
 
@@ -17,7 +17,7 @@ Prompt/command timers, watch and stop conditions, verification, preflight/postru
 
 OpenCode Loop adds `/loop`, scheduled prompt/command/shell jobs, compact scheduling, verification/checkpoints, and the `opencode-loopd` background daemon.
 
-> **Current stable release: `0.6.6`.**
+> **Current stable release: `0.6.7`.**
 
 ## Install or update
 
@@ -68,6 +68,10 @@ If you installed Goal too:
 /goal status
 ```
 
+If both native commands work in terminal TUI but are missing from Windows Desktop, follow the [Windows Desktop command-registry diagnostic guide](docs/OPENCODE2-DESKTOP-WINDOWS.md). Do not replace native commands with legacy Markdown bridges.
+
+On a version containing the diagnostic, run `npx -y @bybrawe/opencode-loop@latest --desktop-diagnostics --workspace "C:\\path\\to\\your\\project"` to check both commands against the currently registered *local* V2 service without printing its credentials. This does not install or modify Goal or Loop.
+
 Global npm alternative:
 
 ```bash

package/examples/OPENCODE2-0.6.7.md

@@ -0,0 +1,26 @@
+# OpenCode Loop 0.6.7
+
+OpenCode 2 native reliability and package parity patch, tested alongside **separately installed** OpenCode Goal 1.3.48.
+
+## Changes
+
+- Protect per-session Loop state across multiple OpenCode processes with file locks, fail-closed corrupt-file reads, crash/dead-owner lock recovery and atomic writes on Windows/Linux.
+- Restore manual native compaction with the public OpenCode 2 `session.compact` capability, requiring its exact manual compaction input ID, completion and terminal. Reject unsupported hosts without corrupting scheduled work.
+- Provide read-only Windows Desktop native `/loop` and `/goal` command-catalog diagnostics and explicit project-directory comparisons. This is **not** a claim that Windows Desktop GUI autocomplete is fixed upstream.
+- Bound Loop+Goal Windows cold-server startup probes and separate unresponsive host bootstrap from real Loop/Goal ownership conflicts.
+- Align native `/loop-help` with the current V2 compaction contract.
+
+## Install independently
+
+```powershell
+npx -y @bybrawe/opencode-loop@0.6.7
+npx -y @bybrawe/opencode-goal@1.3.48
+```
+
+A normal Loop install touches Loop only; it never installs or updates the dedicated Goal package. Legacy `/loop-goal*` commands stay opt-in, and existing state is preserved.
+
+## Verification
+
+When npm confirms publication, fully restart OpenCode and run `/loop-help`, `/loop-doctor`, `/goal status` in terminal TUI. For Windows Desktop use the [read-only diagnostic](../docs/OPENCODE2-DESKTOP-WINDOWS.md) without adding Markdown slash-command bridges.
+
+Required release gates: immutable Goal source, Windows/Ubuntu package regressions, exact-main CI, installed-pair real host and clean npm consumer checks. GitHub tag and release creation require separate repository authorization, which may fail independently of verified npm publication.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bybrawe/opencode-loop",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "Idle-safe /loop scheduling and background automation for OpenCode, with optional legacy Loop Goal compatibility and a separately installable OpenCode Goal companion.",
   "type": "module",
   "main": "src/plugin.js",
@@ -24,8 +24,8 @@
     "build:plugin": "bun build src/source/v1.js --outfile=src/index.js --target=bun --format=esm --external=@opencode-ai/plugin/tool && bun build src/source/server.js --outfile=src/server.js --target=bun --format=esm --external=@opencode-ai/plugin/tool && bun build src/source/native.js --outfile=src/native.js --target=bun --format=esm",
     "build:plugin:npm": "npm run build:plugin",
     "prepack": "node --check src/plugin.js && node --check src/v2.js && node --check src/index.js && node --check src/server.js && node --check src/native.js",
-    "check": "node --check src/source/v1.js && node --check src/source/core/args.js && node --check src/source/core/continuation.js && node --check src/source/core/schedule-syntax.js && node --check src/source/core/state.js && node --check src/source/core/jobs.js && node --check src/source/core/process.js && node --check src/source/opencode/sdk.js && node --check src/source/opencode/session-context.js && node --check src/source/opencode/command-router.js && node --check src/source/opencode/goal-commands.js && node --check src/source/opencode/loop-commands.js && node --check src/source/opencode/loop-registration.js && node --check src/source/runtime/session-activity.js && node --check src/source/runtime/session-status.js && node --check src/source/runtime/schedule-policy.js && node --check src/source/runtime/scheduler-diagnostics.js && node --check src/source/runtime/companion-goal.js && node --check src/source/runtime/loop-diagnostics.js && node --check src/source/runtime/compaction.js && node --check src/source/runtime/action-dispatch.js && node --check src/source/runtime/network-recovery.js && node --check src/source/runtime/empty-turn.js && node --check src/source/runtime/terminal-guard.js && node --check src/source/runtime/run-finalization.js && node --check src/source/runtime/run-admission.js && node --check src/source/runtime/executor.js && node --check src/source/runtime/scheduler.js && node --check src/source/runtime/goal-prompt.js && node --check src/source/runtime/goal-report.js && node --check src/source/runtime/goal-evidence.js && node --check src/source/runtime/goal-runtime.js && node --check src/source/runtime/goal-policy.js && node --check src/source/runtime/goal-steering.js && node --check src/source/runtime/job-workspace.js && node --check src/source/opencode2/prompt-runtime.js && node --check src/source/opencode2/diagnostics.js && node --check src/source/opencode2/logging.js && node --check src/source/server.js && node --check src/source/legacy-v1.js && node --check src/index.js && node --check src/server.js && node --check scripts/install-node.mjs && node --check scripts/install-with-goals.mjs && node --check scripts/loopd.mjs && node --check scripts/pulse-check.mjs && node --check scripts/install-test.mjs && node --check scripts/goal-companion-test.mjs && node --check scripts/loopd-test.mjs && node --check scripts/smoke-test.mjs && node --check scripts/host-adapter-contract-test.mjs && node --check scripts/server-entry-test.mjs && node --check scripts/command-router-test.mjs && node --check scripts/goal-command-handlers-test.mjs && node --check scripts/loop-command-handlers-test.mjs && node --check scripts/loop-registration-test.mjs && node --check scripts/schedule-syntax-test.mjs && node --check scripts/schedule-policy-test.mjs && node --check scripts/session-activity-test.mjs && node --check scripts/session-status-test.mjs && node --check scripts/session-status-idle-recovery-test.mjs && node --check scripts/session-error-recovery-test.mjs && node --check scripts/empty-turn-recovery-test.mjs && node --check scripts/network-recovery-test.mjs && node --check scripts/compaction-runtime-test.mjs && node --check scripts/executor-runtime-test.mjs && node --check scripts/scheduler-runtime-test.mjs && node --check scripts/goal-runtime-test.mjs && node --check scripts/goal-policy-test.mjs && node --check scripts/goal-steering-test.mjs && node --check scripts/job-workspace-test.mjs && node --check scripts/v2-prompt-runtime-test.mjs && node --check scripts/v2-prompt-interval-test.mjs && node --check scripts/v2-command-runtime-test.mjs && node --check scripts/v2-command-adapter-test.mjs && node --check scripts/v2-diagnostics-test.mjs && node --check scripts/v2-logging-test.mjs && node --check scripts/comprehensive-watchdog.mjs && node --check scripts/comprehensive-test.mjs && node --check scripts/host-loop-canary.mjs && node --check scripts/host-goal-steering-canary.mjs && node --check scripts/publish-workflow-test.mjs && node --check scripts/goal-compaction-safety-test.mjs && node --check src/source/native.js && node --check src/source/opencode2/native-plugin.js && node --check src/source/opencode2/native-runtime.js && node --check src/source/opencode2/native-policy.js && node --check src/native.js && node --check scripts/native-entry-test.mjs && node --check scripts/package-native-smoke.mjs && node --check src/v1.js && node --check scripts/native-cli-io-test.mjs && node --check scripts/native-lifecycle-test.mjs && node --check scripts/native-plugin-lifetime-test.mjs && node --check src/source/core/progress.js && node --check scripts/native-presets-test.mjs && node --check scripts/control-plane-until-test.mjs && node --check src/source/opencode2/session-location.js && node --check scripts/native-session-location-test.mjs && node --check src/plugin.js && node --check src/v2.js",
-    "test": "node --test scripts/native-session-location-test.mjs && node --test scripts/control-plane-until-test.mjs && node --test scripts/native-presets-test.mjs && node --test scripts/native-plugin-lifetime-test.mjs && node --test scripts/native-cli-io-test.mjs scripts/native-lifecycle-test.mjs && node scripts/native-entry-test.mjs && node scripts/native-coexistence-test.mjs && node scripts/native-shell-test.mjs && node scripts/native-install-test.mjs && node scripts/native-v2-test.mjs && node scripts/goal-compaction-safety-test.mjs && node scripts/publish-workflow-test.mjs && node scripts/server-entry-test.mjs && node scripts/command-router-test.mjs && node scripts/goal-command-handlers-test.mjs && node scripts/loop-command-handlers-test.mjs && node scripts/loop-registration-test.mjs && node scripts/schedule-syntax-test.mjs && node scripts/schedule-policy-test.mjs && node scripts/session-activity-test.mjs && node scripts/session-status-test.mjs && node scripts/session-status-idle-recovery-test.mjs && node scripts/session-error-recovery-test.mjs && node scripts/empty-turn-recovery-test.mjs && node scripts/network-recovery-test.mjs && node scripts/compaction-runtime-test.mjs && node scripts/action-dispatch-test.mjs && node scripts/run-finalization-test.mjs && node scripts/run-admission-test.mjs && node scripts/executor-runtime-test.mjs && node scripts/scheduler-runtime-test.mjs && node scripts/goal-runtime-test.mjs && node scripts/goal-policy-test.mjs && node scripts/goal-steering-test.mjs && node scripts/job-workspace-test.mjs && node scripts/v2-prompt-runtime-test.mjs && node scripts/v2-prompt-interval-test.mjs && node scripts/v2-command-runtime-test.mjs && node scripts/v2-command-adapter-test.mjs && node scripts/v2-diagnostics-test.mjs && node scripts/v2-logging-test.mjs && node scripts/install-test.mjs && node scripts/goal-companion-test.mjs && node scripts/loopd-test.mjs && node scripts/smoke-test.mjs && node scripts/host-adapter-contract-test.mjs && node scripts/comprehensive-watchdog.mjs",
+    "check": "node --check src/source/v1.js && node --check src/source/core/args.js && node --check src/source/core/continuation.js && node --check src/source/core/schedule-syntax.js && node --check src/source/core/state.js && node --check src/source/core/jobs.js && node --check src/source/core/process.js && node --check src/source/opencode/sdk.js && node --check src/source/opencode/session-context.js && node --check src/source/opencode/command-router.js && node --check src/source/opencode/goal-commands.js && node --check src/source/opencode/loop-commands.js && node --check src/source/opencode/loop-registration.js && node --check src/source/runtime/session-activity.js && node --check src/source/runtime/session-status.js && node --check src/source/runtime/schedule-policy.js && node --check src/source/runtime/scheduler-diagnostics.js && node --check src/source/runtime/companion-goal.js && node --check src/source/runtime/loop-diagnostics.js && node --check src/source/runtime/compaction.js && node --check src/source/runtime/action-dispatch.js && node --check src/source/runtime/network-recovery.js && node --check src/source/runtime/empty-turn.js && node --check src/source/runtime/terminal-guard.js && node --check src/source/runtime/run-finalization.js && node --check src/source/runtime/run-admission.js && node --check src/source/runtime/executor.js && node --check src/source/runtime/scheduler.js && node --check src/source/runtime/goal-prompt.js && node --check src/source/runtime/goal-report.js && node --check src/source/runtime/goal-evidence.js && node --check src/source/runtime/goal-runtime.js && node --check src/source/runtime/goal-policy.js && node --check src/source/runtime/goal-steering.js && node --check src/source/runtime/job-workspace.js && node --check src/source/opencode2/prompt-runtime.js && node --check src/source/opencode2/diagnostics.js && node --check src/source/opencode2/logging.js && node --check src/source/server.js && node --check src/source/legacy-v1.js && node --check src/index.js && node --check src/server.js && node --check scripts/install-node.mjs && node --check scripts/install-with-goals.mjs && node --check scripts/loopd.mjs && node --check scripts/pulse-check.mjs && node --check scripts/state-process-test.mjs && node --check scripts/state-integrity-test.mjs && node --check scripts/install-test.mjs && node --check scripts/desktop-command-diagnostics.mjs && node --check scripts/desktop-command-diagnostics-test.mjs && node --check scripts/goal-companion-test.mjs && node --check scripts/loopd-test.mjs && node --check scripts/smoke-test.mjs && node --check scripts/host-adapter-contract-test.mjs && node --check scripts/server-entry-test.mjs && node --check scripts/command-router-test.mjs && node --check scripts/goal-command-handlers-test.mjs && node --check scripts/loop-command-handlers-test.mjs && node --check scripts/loop-registration-test.mjs && node --check scripts/schedule-syntax-test.mjs && node --check scripts/schedule-policy-test.mjs && node --check scripts/session-activity-test.mjs && node --check scripts/session-status-test.mjs && node --check scripts/session-status-idle-recovery-test.mjs && node --check scripts/session-error-recovery-test.mjs && node --check scripts/empty-turn-recovery-test.mjs && node --check scripts/network-recovery-test.mjs && node --check scripts/compaction-runtime-test.mjs && node --check scripts/executor-runtime-test.mjs && node --check scripts/scheduler-runtime-test.mjs && node --check scripts/goal-runtime-test.mjs && node --check scripts/goal-policy-test.mjs && node --check scripts/goal-steering-test.mjs && node --check scripts/job-workspace-test.mjs && node --check scripts/v2-prompt-runtime-test.mjs && node --check scripts/v2-prompt-interval-test.mjs && node --check scripts/v2-command-runtime-test.mjs && node --check scripts/v2-command-adapter-test.mjs && node --check scripts/v2-diagnostics-test.mjs && node --check scripts/v2-logging-test.mjs && node --check scripts/comprehensive-watchdog.mjs && node --check scripts/comprehensive-test.mjs && node --check scripts/host-goal-bootstrap.mjs && node --check scripts/host-goal-bootstrap-test.mjs && node --check scripts/host-loop-canary.mjs && node --check scripts/host-goal-steering-canary.mjs && node --check scripts/publish-workflow-test.mjs && node --check scripts/goal-compaction-safety-test.mjs && node --check src/source/native.js && node --check src/source/opencode2/native-plugin.js && node --check src/source/opencode2/native-runtime.js && node --check src/source/opencode2/native-policy.js && node --check src/native.js && node --check scripts/native-entry-test.mjs && node --check scripts/package-native-smoke.mjs && node --check src/v1.js && node --check scripts/native-cli-io-test.mjs && node --check scripts/native-lifecycle-test.mjs && node --check scripts/native-plugin-lifetime-test.mjs && node --check src/source/core/progress.js && node --check scripts/native-presets-test.mjs && node --check scripts/control-plane-until-test.mjs && node --check src/source/opencode2/session-location.js && node --check scripts/native-session-location-test.mjs && node --check src/plugin.js && node --check src/v2.js",
+    "test": "node --test scripts/native-session-location-test.mjs && node --test scripts/control-plane-until-test.mjs && node --test scripts/native-presets-test.mjs && node --test scripts/native-plugin-lifetime-test.mjs && node --test scripts/native-cli-io-test.mjs scripts/native-lifecycle-test.mjs && node scripts/native-entry-test.mjs && node scripts/native-coexistence-test.mjs && node scripts/native-shell-test.mjs && node scripts/native-install-test.mjs && node scripts/native-v2-test.mjs && node scripts/goal-compaction-safety-test.mjs && node scripts/publish-workflow-test.mjs && node scripts/server-entry-test.mjs && node scripts/command-router-test.mjs && node scripts/goal-command-handlers-test.mjs && node scripts/loop-command-handlers-test.mjs && node scripts/loop-registration-test.mjs && node scripts/schedule-syntax-test.mjs && node scripts/schedule-policy-test.mjs && node scripts/session-activity-test.mjs && node scripts/session-status-test.mjs && node scripts/session-status-idle-recovery-test.mjs && node scripts/session-error-recovery-test.mjs && node scripts/empty-turn-recovery-test.mjs && node scripts/network-recovery-test.mjs && node scripts/compaction-runtime-test.mjs && node scripts/action-dispatch-test.mjs && node scripts/run-finalization-test.mjs && node scripts/run-admission-test.mjs && node scripts/executor-runtime-test.mjs && node scripts/scheduler-runtime-test.mjs && node scripts/goal-runtime-test.mjs && node scripts/goal-policy-test.mjs && node scripts/goal-steering-test.mjs && node scripts/job-workspace-test.mjs && node scripts/v2-prompt-runtime-test.mjs && node scripts/v2-prompt-interval-test.mjs && node scripts/v2-command-runtime-test.mjs && node scripts/v2-command-adapter-test.mjs && node scripts/v2-diagnostics-test.mjs && node scripts/v2-logging-test.mjs && node scripts/state-process-test.mjs && node scripts/state-integrity-test.mjs && node scripts/install-test.mjs && node --test scripts/desktop-command-diagnostics-test.mjs && node scripts/goal-companion-test.mjs && node scripts/loopd-test.mjs && node scripts/smoke-test.mjs && node --test scripts/host-goal-bootstrap-test.mjs && node scripts/host-adapter-contract-test.mjs && node scripts/comprehensive-watchdog.mjs",
     "canary:host": "node scripts/host-loop-canary.mjs && node scripts/host-goal-steering-canary.mjs",
     "install:global": "node scripts/install-with-goals.mjs",
     "pack:zip": "node scripts/make-zip.mjs",

package/scripts/comprehensive-test.mjs

@@ -337,7 +337,7 @@ async function testActionRoutingAndSafety() {
   try {
     await h.command("loop-shell", "0s --safe npm run format")
     await h.command("loop-now", "shell")
-    await delay(25)
+    await waitForValue(() => h.records.shells[0], 2_000)
     assert.equal(h.records.shells.length, 1)
     assert.equal(h.records.shells[0].command, "npm run format", "safe mode must allow a harmless format script")
   } finally {
@@ -403,8 +403,8 @@ async function testActionRoutingAndSafety() {
   try {
     await h.command("loop-command", "0s /custom-command alpha beta")
     await h.command("loop-now", "command")
-    await delay(25)
-    assert.deepEqual(h.records.commands[0], {
+    const dispatched = await waitForValue(() => h.records.commands[0], 2_000)
+    assert.deepEqual(dispatched, {
       command: "custom-command",
       arguments: "alpha beta",
       agent: "build",

package/scripts/desktop-command-diagnostics-test.mjs

@@ -0,0 +1,92 @@
+import assert from "node:assert/strict"
+import { createServer } from "node:http"
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { spawnSync } from "node:child_process"
+import { fileURLToPath } from "node:url"
+import test from "node:test"
+import { diagnose } from "./desktop-command-diagnostics.mjs"
+
+test("Windows Desktop native catalog probe checks both commands but never returns credentials", async () => {
+  const home = await mkdtemp(path.join(tmpdir(), "loop-desktop-diagnostic-"))
+  const workspace = path.join(home, "project with spaces")
+  const desktopWorkspace = path.join(home, "desktop parent project")
+  const cfg = path.join(home, ".config", "opencode")
+  const state = path.join(home, ".local", "state", "opencode")
+  const calls = []
+  const password = "private-diagnostic-password"
+  const server = createServer((req, res) => {
+    calls.push({ url: req.url, directory: req.headers["x-opencode-directory"], auth: req.headers.authorization })
+    res.setHeader("Content-Type", "application/json")
+    if (req.url === "/api/info") return res.end(JSON.stringify({ pid: process.pid, version: "2.0.22" }))
+    if (req.url === "/api/command") {
+      const native = req.headers["x-opencode-directory"] === desktopWorkspace
+        ? [{ name: "init" }] : [{ name: "loop" }, { name: "goal" }, { name: "loop-help" }]
+      return res.end(JSON.stringify(native))
+    }
+    res.writeHead(404).end("{}")
+  })
+  try {
+    await mkdir(cfg, { recursive: true })
+    await mkdir(state, { recursive: true })
+    await mkdir(workspace, { recursive: true })
+    await mkdir(desktopWorkspace, { recursive: true })
+    await writeFile(path.join(cfg, "opencode.json"), JSON.stringify({
+      plugins: ["@bybrawe/opencode-loop@0.6.6", "@bybrawe/opencode-goal@1.3.47"],
+      secrets: password,
+    }))
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve))
+    const url = "http://127.0.0.1:" + server.address().port
+    await writeFile(path.join(state, "service.json"), JSON.stringify({
+      url, pid: process.pid, version: "2.0.22", password,
+    }))
+    const result = await diagnose({ home, workspace, env: {} })
+    assert.equal(result.service.status, "ready")
+    assert.deepEqual(result.service.commands, { loop: true, goal: true, count: 3 })
+    assert.deepEqual(result.config.pins.loop, ["@bybrawe/opencode-loop@0.6.6"])
+    assert.deepEqual(result.config.pins.goal, ["@bybrawe/opencode-goal@1.3.47"])
+    assert.ok(calls.every((c) => c.directory === workspace))
+    assert.ok(calls.every((c) => c.auth === "Basic " + Buffer.from("opencode:" + password).toString("base64")))
+    assert.ok(!JSON.stringify(result).includes(password), "no secret may appear in diagnostic output")
+    const beforeCompare = calls.length
+    const compared = await diagnose({ home, workspace, compareWorkspace: desktopWorkspace, env: {} })
+    assert.equal(compared.comparison.workspace, desktopWorkspace)
+    assert.equal(compared.comparison.status, "ready")
+    assert.deepEqual(compared.comparison.commands, { loop: false, goal: false, count: 1 })
+    assert.equal(compared.comparison.matchesPrimary, false, "Desktop parent and terminal child must be comparable")
+    assert.ok(calls.slice(beforeCompare).some((entry) =>
+      entry.url === "/api/command" && entry.directory === desktopWorkspace &&
+      entry.auth === "Basic " + Buffer.from("opencode:" + password).toString("base64")
+    ), "comparison must use the same authorized local server and the requested Desktop project location")
+    assert.ok(!JSON.stringify(compared).includes(password), "comparison never exposes credentials")
+    const same = await diagnose({ home, workspace, compareWorkspace: workspace, env: {} })
+    assert.equal(same.comparison, undefined, "identical workspace needs no redundant catalog probe")
+    const bad = await diagnose({
+      home, workspace, env: {}, server: "https://example.com", fetchImpl: () => { throw new Error("must not contact remote") },
+    })
+    assert.equal(bad.service.status, "refused-nonlocal-or-invalid-url")
+    await writeFile(path.join(state, "service.json"), JSON.stringify({ url, pid: process.pid + 5, password }))
+    const stale = await diagnose({ home, workspace, env: {} })
+    assert.equal(stale.service.status, "stale-service-registration")
+  } finally {
+    await new Promise((resolve) => server.close(resolve))
+    await rm(home, { recursive: true, force: true })
+  }
+})
+
+test("installer desktop diagnosis is read-only and does not invoke Loop or Goal installers", async () => {
+  const home = await mkdtemp(path.join(tmpdir(), "loop-desktop-installer-"))
+  try {
+    const installer = fileURLToPath(new URL("./install-with-goals.mjs", import.meta.url))
+    const result = spawnSync(process.execPath, [installer, "--desktop-diagnostics", "--workspace", home, "--json"], {
+      encoding: "utf8", timeout: 15_000, env: { ...process.env, OPENCODE_CONFIG_DIR: path.join(home, "no-config"), XDG_STATE_HOME: path.join(home, "no-state") },
+    })
+    assert.equal(result.status, 0, result.stderr)
+    const report = JSON.parse(result.stdout)
+    assert.equal(report.service.status, "registration-not-found")
+    assert.equal(report.workspace, home)
+    assert.equal(await readFile(path.join(home, "no-config", "opencode.json"), "utf8").then(() => true, () => false), false)
+    assert.ok(!result.stdout.includes("Installed/updated"), "installer must not run in diagnosis mode")
+  } finally { await rm(home, { recursive: true, force: true }) }
+})

package/scripts/desktop-command-diagnostics.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+// Read-only diagnosis for a Windows OpenCode Desktop/TUI command mismatch.
+// Never publish service.json, config content, authorization or response bodies.
+import { readFile, stat } from "node:fs/promises"
+import { homedir } from "node:os"
+import path from "node:path"
+import process from "node:process"
+import { fileURLToPath } from "node:url"
+
+const packageNames = Object.freeze(["loop", "goal"])
+const allowHosts = new Set(["localhost", "127.0.0.1", "[::1]"])
+const knownConfigs = ["opencode.json", "opencode.jsonc", "config.json", "config.jsonc"]
+
+async function readSmall(file) {
+  try {
+    const info = await stat(file)
+    if (!info.isFile() || info.size > 1024 * 1024) return undefined
+    return await readFile(file, "utf8")
+  } catch (error) {
+    if (error?.code === "ENOENT") return undefined
+    throw error
+  }
+}
+
+function localUrl(raw) {
+  if (typeof raw !== "string") return
+  let url
+  try { url = new URL(raw) } catch { return }
+  if (!["http:", "https:"].includes(url.protocol)) return
+  if (!allowHosts.has(url.hostname.toLowerCase())) return
+  if (url.username || url.password) return
+  if ((url.pathname && url.pathname !== "/") || url.search || url.hash) return
+  return url.origin
+}
+
+function presentPins(raw) {
+  const result = {}
+  for (const name of packageNames) {
+    const prefix = "@bybrawe/opencode-" + name + "@"
+    const hits = raw.match(new RegExp(prefix.replace(/[.*+?^$\\{\\}()|[\\]\\\\]/g, "\\$&") + "[0-9]+\\.[0-9]+\\.[0-9]+", "g")) ?? []
+    result[name] = [...new Set(hits)].sort()
+  }
+  return result
+}
+
+async function configPins(env, home) {
+  const configHome = env.OPENCODE_CONFIG_DIR
+    ?? path.join(env.XDG_CONFIG_HOME ?? path.join(home, ".config"), "opencode")
+  const files = []
+  const pins = { loop: [], goal: [] }
+  for (const name of knownConfigs) {
+    const file = path.join(configHome, name)
+    const value = await readSmall(file)
+    if (value === undefined) continue
+    files.push(file)
+    const found = presentPins(value)
+    for (const kind of packageNames) pins[kind].push(...found[kind])
+  }
+  for (const kind of packageNames) pins[kind] = [...new Set(pins[kind])].sort()
+  return { directory: configHome, files, pins }
+}
+
+function commandsFrom(json) {
+  const body = Array.isArray(json) ? json : Array.isArray(json?.data) ? json.data : undefined
+  if (!body) return undefined
+  return new Set(body.flatMap((item) => typeof item?.name === "string" ? [item.name] : []))
+}
+
+async function request(fetchImpl, base, pathname, headers) {
+  try {
+    const response = await fetchImpl(base + pathname, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(5_000),
+    })
+    if (![200, 201].includes(response.status)) return { status: response.status }
+    const json = await response.json()
+    return { status: response.status, json }
+  } catch (error) {
+    return { error: error?.name === "TimeoutError" ? "timeout" : "connection-failed" }
+  }
+}
+
+async function catalog(fetchImpl, origin, headers) {
+  let response = await request(fetchImpl, origin, "/api/command", headers)
+  if (response.status === 404) response = await request(fetchImpl, origin, "/command", headers)
+  return response
+}
+
+export async function diagnose({
+  env = process.env, home = homedir(), workspace = process.cwd(),
+  compareWorkspace, server, serviceFile, fetchImpl = fetch,
+} = {}) {
+  const cwd = path.resolve(workspace)
+  const comparisonDirectory = typeof compareWorkspace === "string" && compareWorkspace.trim()
+    ? path.resolve(compareWorkspace) : undefined
+  const config = await configPins(env, home)
+  const registeredFile = serviceFile ?? path.join(
+    env.XDG_STATE_HOME ?? path.join(home, ".local", "state"), "opencode", "service.json",
+  )
+  const output = { workspace: cwd, config, service: { source: server ? "explicit" : "registration", status: "unavailable" } }
+  let url = server
+  let password = env.OPENCODE_PASSWORD ?? env.OPENCODE_SERVER_PASSWORD
+  let version
+  let pid
+  if (!server) {
+    const raw = await readSmall(registeredFile)
+    if (raw === undefined) {
+      output.service.status = "registration-not-found"
+      return output
+    }
+    let info
+    try { info = JSON.parse(raw) }
+    catch {
+      output.service.status = "registration-invalid"
+      return output
+    }
+    url = info?.url
+    password = info?.password
+    version = typeof info?.version === "string" ? info.version : undefined
+    pid = Number.isInteger(info?.pid) ? info.pid : undefined
+  }
+  const origin = localUrl(url)
+  if (!origin) {
+    output.service.status = "refused-nonlocal-or-invalid-url"
+    return output
+  }
+  output.service.host = new URL(origin).host
+  if (version) output.service.registeredVersion = version
+  const headers = { "x-opencode-directory": cwd, accept: "application/json" }
+  if (typeof password === "string" && password.length) {
+    headers.authorization = "Basic " + Buffer.from("opencode:" + password).toString("base64")
+  }
+  const info = await request(fetchImpl, origin, "/api/info", headers)
+  if (info.error) {
+    output.service.status = info.error
+    return output
+  }
+  if (info.status === 401 || info.status === 403) {
+    output.service.status = "authorization-failed"
+    return output
+  }
+  if (info.status === 200 && info.json) {
+    const hostPID = info.json?.pid
+    if (pid !== undefined && hostPID !== undefined && pid !== hostPID) {
+      output.service.status = "stale-service-registration"
+      return output
+    }
+    if (typeof info.json.version === "string") output.service.actualVersion = info.json.version
+  }
+  const list = await catalog(fetchImpl, origin, headers)
+  if (list.error) {
+    output.service.status = list.error
+    return output
+  }
+  if (list.status === 401 || list.status === 403) {
+    output.service.status = "authorization-failed"
+    return output
+  }
+  const names = commandsFrom(list.json)
+  if (!names) {
+    output.service.status = "command-catalog-unavailable"
+    output.service.httpStatus = list.status
+    return output
+  }
+  output.service.status = "ready"
+  output.service.commands = { loop: names.has("loop"), goal: names.has("goal"), count: names.size }
+  if (comparisonDirectory && comparisonDirectory !== cwd) {
+    const comparisonHeaders = { ...headers, "x-opencode-directory": comparisonDirectory }
+    const compared = await catalog(fetchImpl, origin, comparisonHeaders)
+    const comparedNames = commandsFrom(compared.json)
+    output.comparison = {
+      workspace: comparisonDirectory,
+      status: comparedNames ? "ready" : compared.error || (
+        compared.status === 401 || compared.status === 403 ? "authorization-failed" : "command-catalog-unavailable"
+      ),
+      ...(comparedNames ? {
+        commands: { loop: comparedNames.has("loop"), goal: comparedNames.has("goal"), count: comparedNames.size },
+        matchesPrimary: comparedNames.has("loop") === names.has("loop") && comparedNames.has("goal") === names.has("goal"),
+      } : {}),
+    }
+  }
+  return output
+}
+
+export async function runDesktopDiagnosticCli(args = process.argv.slice(2), options = {}) {
+  let workspace = process.cwd(), compareWorkspace, server, json = false
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    if (arg === "--help" || arg === "-h") {
+      console.log("Usage: opencode-loop --desktop-diagnostics [--workspace PATH] [--compare-workspace PATH] [--server LOCAL_URL] [--json]")
+      console.log("Read-only check of both native /loop and /goal registrations; never prints credentials.")
+      return 0
+    }
+    if (arg === "--json") { json = true; continue }
+    if (arg === "--workspace" || arg === "--compare-workspace" || arg === "--server") {
+      if (!args[i + 1]) { console.error("Missing value for " + arg); return 2 }
+      if (arg === "--workspace") workspace = args[++i]
+      else if (arg === "--compare-workspace") compareWorkspace = args[++i]
+      else server = args[++i]
+      continue
+    }
+    console.error("Unknown Desktop diagnostic option: " + arg)
+    return 2
+  }
+  const result = await diagnose({ ...options, workspace, compareWorkspace, server })
+  if (json) console.log(JSON.stringify(result, null, 2))
+  else {
+    console.log("OpenCode Desktop native command diagnosis (read-only)")
+    console.log("Workspace: " + result.workspace)
+    console.log("Global config: " + result.config.directory)
+    for (const kind of packageNames)
+      console.log("Configured " + kind + " spec: " + (result.config.pins[kind].join(", ") || "not found (text scan)"))
+    console.log("Local service: " + result.service.status + (result.service.registeredVersion ? " (" + result.service.registeredVersion + ")" : ""))
+    if (result.service.commands)
+      console.log("Server /loop: " + result.service.commands.loop + " | /goal: " + result.service.commands.goal)
+    if (result.comparison) {
+      console.log("Compared workspace: " + result.comparison.workspace)
+      console.log("Compared catalog: " + result.comparison.status)
+      if (result.comparison.commands) {
+        console.log("Compared /loop: " + result.comparison.commands.loop + " | /goal: " + result.comparison.commands.goal)
+        console.log("Same native command visibility across directories: " + result.comparison.matchesPrimary)
+      }
+    }
+    if (!result.service.commands)
+      console.log("No confirmed local server catalog. Desktop may use a different connection or service.")
+    console.log("This checks one local service and directory; it cannot prove which connection Desktop currently uses.")
+  }
+  return 0
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  runDesktopDiagnosticCli().then((code) => { process.exitCode = code }).catch((error) => {
+    console.error("Desktop diagnostic failed: " + (error?.code || error?.name || "unknown error"))
+    process.exitCode = 1
+  })
+}

package/scripts/host-goal-bootstrap-test.mjs

@@ -0,0 +1,46 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+import { waitForSessionBootstrap } from "./host-goal-bootstrap.mjs"
+
+const baseURL = "http://127.0.0.1:4011"
+const workspace = "C:\\projects\\space in path"
+
+test("bounded GET /session bootstrap retries transient host readiness without sending work", async () => {
+  const calls = []
+  let attempts = 0
+  const fetchImpl = async (input, init) => {
+    calls.push({ url: new URL(input.toString()), method: init.method, directory: init.headers["x-opencode-directory"] })
+    if (new URL(input.toString()).pathname === "/command") return { status: 200 }
+    attempts++
+    if (attempts < 4) throw Object.assign(new Error("timed out"), { name: "TimeoutError" })
+    return { ok: true, json: async () => ({ data: [{ id: "ses_test" }] }) }
+  }
+  const result = await waitForSessionBootstrap({
+    baseURL, workspace, fetchImpl, timeoutMs: 250, perRequestMs: 10, intervalMs: 1,
+  })
+  assert.deepEqual(result.data, [{ id: "ses_test" }])
+  assert.equal(attempts, 4)
+  assert.ok(calls.some((c) => c.url.pathname === "/command"))
+  assert.ok(calls.every((c) => c.method === "GET" && c.directory === workspace))
+  assert.ok(calls.filter((c) => c.url.pathname === "/session").every((c) => c.url.searchParams.get("directory") === workspace))
+})
+
+test("bootstrap fails immediately on authorization, malformed response or unsafe service", async () => {
+  const unauthorized = async () => ({ ok: false, status: 401 })
+  await assert.rejects(waitForSessionBootstrap({ baseURL, workspace, fetchImpl: unauthorized }), /non-retryable HTTP 401/)
+  const malformed = async () => ({ ok: true, json: async () => ({ status: "unknown" }) })
+  await assert.rejects(waitForSessionBootstrap({ baseURL, workspace, fetchImpl: malformed }), /unexpected payload/)
+  await assert.rejects(
+    waitForSessionBootstrap({ baseURL: "https://example.com", workspace, fetchImpl: () => { throw new Error("must not connect") } }),
+    /restricted to a local service/,
+  )
+})
+
+test("persistent startup stall is bounded, preserves diagnostics, and never claims ownership collision", async () => {
+  let calls = 0
+  const stalled = async () => { calls++; throw Object.assign(new Error("timeout"), { name: "TimeoutError" }) }
+  await assert.rejects(waitForSessionBootstrap({
+    baseURL, workspace, fetchImpl: stalled, timeoutMs: 45, perRequestMs: 5, intervalMs: 1,
+  }), /did not become ready after \d+ bounded attempts.*plugin initialization must be investigated/i)
+  assert.ok(calls >= 1 && calls < 80, "startup must have a bounded number of probes")
+})

package/scripts/host-goal-bootstrap.mjs

@@ -0,0 +1,71 @@
+// A TCP listener is not proof that OpenCode's session router and project
+// plugin graph have finished initialization. This is intentionally read-only:
+// never send a prompt/command or retry a mutating session request.
+export async function waitForSessionBootstrap({
+  baseURL, workspace, fetchImpl = fetch,
+  timeoutMs = 90_000, perRequestMs = 6_000, intervalMs = 300,
+} = {}) {
+  if (!URL.canParse(baseURL) || !workspace) throw new Error("Missing OpenCode bootstrap baseURL/workspace")
+  const base = new URL(baseURL)
+  if (!["localhost", "127.0.0.1", "[::1]"].includes(base.hostname))
+    throw new Error("OpenCode bootstrap is restricted to a local service")
+  if (base.username || base.password) throw new Error("Credentials must not be embedded in the bootstrap URL")
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 1) throw new Error("Invalid bootstrap timeout")
+  const url = new URL("/session", base)
+  url.searchParams.set("directory", workspace)
+  const deadline = Date.now() + timeoutMs
+  let attempts = 0
+  let last = "no response"
+  let commandProbe = "not checked"
+  while (Date.now() < deadline) {
+    attempts++
+    const remaining = deadline - Date.now()
+    const signal = AbortSignal.timeout(Math.max(1, Math.min(perRequestMs, remaining)))
+    try {
+      const res = await fetchImpl(url, {
+        method: "GET",
+        headers: { "x-opencode-directory": workspace, accept: "application/json" },
+        signal,
+        redirect: "error",
+      })
+      if (res.ok) {
+        const body = await res.json()
+        if (!Array.isArray(body?.data ?? body)) {
+          throw new Error("OpenCode GET /session returned an unexpected payload (not a session array)")
+        }
+        return body
+      }
+      if (![502, 503, 504].includes(res.status)) {
+        throw new Error("OpenCode GET /session returned non-retryable HTTP " + res.status)
+      }
+      last = "HTTP " + res.status
+    } catch (error) {
+      if (!["TimeoutError", "AbortError", "TypeError"].includes(error?.name)) throw error
+      last = error?.name === "TimeoutError" ? "request timed out" : error?.name === "AbortError" ? "request aborted" : "connection not ready"
+    }
+    // A side probe distinguishes a live command catalog from a stalled global
+    // bootstrap. It is diagnostic only: we never waive the session readiness
+    // requirement, and do not emit any endpoint response or credentials.
+    if (attempts % 3 === 0 && Date.now() < deadline) {
+      try {
+        const res = await fetchImpl(new URL("/command", base), {
+          method: "GET",
+          headers: { "x-opencode-directory": workspace, accept: "application/json" },
+          signal: AbortSignal.timeout(Math.min(2_000, deadline - Date.now())),
+          redirect: "error",
+        })
+        commandProbe = "HTTP " + res.status
+      } catch (error) {
+        commandProbe = error?.name === "TimeoutError" ? "timed out" : "unavailable"
+      }
+    }
+    if (Date.now() >= deadline) break
+    await new Promise((resolve) => setTimeout(resolve, Math.min(intervalMs, deadline - Date.now())))
+  }
+  throw new Error(
+    "OpenCode GET /session did not become ready after " + attempts
+    + " bounded attempts in " + timeoutMs + "ms"
+    + " (last=" + last + ", GET /command=" + commandProbe + ")."
+    + " Server routing/plugin initialization must be investigated before claiming a Goal/Loop collision.",
+  )
+}

package/scripts/host-goal-coexistence-canary.mjs

@@ -7,11 +7,12 @@ import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promis
 import os from "node:os"
 import path from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
+import { waitForSessionBootstrap } from "./host-goal-bootstrap.mjs"
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const isWindows = process.platform === "win32"
 const SERVER_READY_TIMEOUT_MS = isWindows ? 60_000 : 30_000
-const API_BOOTSTRAP_TIMEOUT_MS = isWindows ? 90_000 : 30_000
+const API_BOOTSTRAP_TIMEOUT_MS = isWindows ? 180_000 : 60_000
 const PREWARM_TIMEOUT_MS = isWindows ? 120_000 : 60_000
 const GOAL_OBJECTIVE = "prove dedicated Goal owns continuation over Loop"
 const GOAL_PROMPT_MARKER = "Continue working toward the active OpenCode goal."
@@ -341,7 +342,15 @@ async function main() {
       }
     }
 
-    const sessionsPayload = await api("/session", { method: "GET" })
+    // A Windows cold host may accept TCP before its session/project/plugin
+    // services are ready. Probe readiness in bounded requests rather than
+    // hanging for 90 seconds on one socket and attributing it to Goal/Loop.
+    const sessionsPayload = await waitForSessionBootstrap({
+      baseURL,
+      workspace,
+      timeoutMs: API_BOOTSTRAP_TIMEOUT_MS,
+      fetchImpl: fetch,
+    })
     assert.ok(Array.isArray(sessionsPayload?.data ?? sessionsPayload), "GET /session bootstrap did not return an array")
     const createdPayload = await api("/session", { method: "POST", body: JSON.stringify({ title: "Loop + Goal ownership canary" }) })
     const session = createdPayload?.data ?? createdPayload