@cloudcli-ai/cloudcli 1.35.1 → 1.36.1

package/server/modules/providers/tests/skills.test.ts

@@ -444,34 +444,22 @@ test('providerSkillsService lists opencode project and user compatibility skills
 });
 
 /**
- * This test covers Gemini and Cursor skill directory rules, including shared
+ * This test covers Cursor skill directory rules, including shared
  * `.agents/skills` project support.
  */
-test('providerSkillsService lists gemini and cursor skills from their configured directories', { concurrency: false }, async () => {
+test('providerSkillsService lists cursor skills from its configured directories', { concurrency: false }, async () => {
   const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'llm-skills-gc-'));
   const workspacePath = path.join(tempRoot, 'workspace');
   await fs.mkdir(workspacePath, { recursive: true });
 
   const restoreHomeDir = patchHomeDir(tempRoot);
   try {
-    await writeSkill(
-      path.join(tempRoot, '.gemini', 'skills'),
-      'gemini-user-dir',
-      'gemini-user',
-      'Gemini user skill',
-    );
     await writeSkill(
       path.join(tempRoot, '.agents', 'skills'),
       'agents-user-dir',
       'agents-user',
       'Agents user skill',
     );
-    await writeSkill(
-      path.join(workspacePath, '.gemini', 'skills'),
-      'gemini-project-dir',
-      'gemini-project',
-      'Gemini project skill',
-    );
     await writeSkill(
       path.join(workspacePath, '.agents', 'skills'),
       'agents-project-dir',
@@ -491,14 +479,6 @@ test('providerSkillsService lists gemini and cursor skills from their configured
       'Cursor user skill',
     );
 
-    const geminiSkills = await providerSkillsService.listProviderSkills('gemini', { workspacePath });
-    const geminiByName = new Map(geminiSkills.map((skill) => [skill.name, skill]));
-    assert.equal(geminiByName.get('gemini-user')?.scope, 'user');
-    assert.equal(geminiByName.get('agents-user')?.scope, 'user');
-    assert.equal(geminiByName.get('gemini-project')?.scope, 'project');
-    assert.equal(geminiByName.get('agents-project')?.scope, 'project');
-    assert.equal(geminiByName.get('gemini-project')?.command, '/gemini-project');
-
     const cursorSkills = await providerSkillsService.listProviderSkills('cursor', { workspacePath });
     const cursorByName = new Map(cursorSkills.map((skill) => [skill.name, skill]));
     assert.equal(cursorByName.get('agents-project')?.scope, 'project');
@@ -515,7 +495,7 @@ test('providerSkillsService lists gemini and cursor skills from their configured
  * This test covers managed global skill creation for providers that own a
  * writable user skill directory.
  */
-test('providerSkillsService adds global skills for claude, codex, gemini, and cursor', { concurrency: false }, async () => {
+test('providerSkillsService adds global skills for claude, codex, and cursor', { concurrency: false }, async () => {
   const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'llm-skills-create-'));
   const restoreHomeDir = patchHomeDir(tempRoot);
 
@@ -618,22 +598,6 @@ test('providerSkillsService adds global skills for claude, codex, gemini, and cu
     );
     await assert.rejects(fs.stat(pendingBatchSkillPath), { code: 'ENOENT' });
 
-    const createdGeminiSkills = await providerSkillsService.addProviderSkills('gemini', {
-      entries: [
-        {
-          directoryName: 'gemini-global-dir',
-          content: '---\nname: gemini-global\ndescription: Gemini global skill\n---\n\nGemini body.\n',
-        },
-      ],
-    });
-    const createdGeminiSkill = createdGeminiSkills[0];
-    assert.ok(createdGeminiSkill);
-    assert.equal(createdGeminiSkill.command, '/gemini-global');
-    assert.equal(
-      createdGeminiSkill.sourcePath.endsWith(path.join('.gemini', 'skills', 'gemini-global-dir', 'SKILL.md')),
-      true,
-    );
-
     const createdCursorSkills = await providerSkillsService.addProviderSkills('cursor', {
       entries: [
         {
@@ -656,9 +620,6 @@ test('providerSkillsService adds global skills for claude, codex, gemini, and cu
     const listedCodexSkills = await providerSkillsService.listProviderSkills('codex');
     assert.equal(listedCodexSkills.some((skill) => skill.name === 'replacement'), true);
 
-    const listedGeminiSkills = await providerSkillsService.listProviderSkills('gemini');
-    assert.equal(listedGeminiSkills.some((skill) => skill.name === 'gemini-global'), true);
-
     const listedCursorSkills = await providerSkillsService.listProviderSkills('cursor');
     assert.equal(listedCursorSkills.some((skill) => skill.name === 'cursor-global'), true);
 

package/server/modules/websocket/services/chat-run-registry.service.ts

@@ -318,6 +318,22 @@ export const chatRunRegistry = {
     run.writer.sendComplete(opts);
   },
 
+  /**
+   * Safety-net variant of `completeRun` scoped to one specific run: a no-op
+   * unless `run` is still the session's current, running run. A runtime
+   * promise can resolve after its own `complete` already streamed AND a new
+   * run has replaced it in the registry (a queued message sends within
+   * milliseconds of the previous turn ending) — the session-keyed
+   * `completeRun` would terminate that newer run.
+   */
+  completeRunIfCurrent(run: ChatRun, opts: { exitCode: number; aborted?: boolean }): void {
+    if (runs.get(run.appSessionId) !== run || run.status !== 'running') {
+      return;
+    }
+
+    run.writer.sendComplete(opts);
+  },
+
   /**
    * Test-only escape hatch: clears every tracked run.
    */

package/server/modules/websocket/services/chat-websocket.service.ts

@@ -1,8 +1,11 @@
+import path from 'node:path';
+
 import type { WebSocket } from 'ws';
 
 import { sessionsDb } from '@/modules/database/index.js';
 import { chatRunRegistry } from '@/modules/websocket/services/chat-run-registry.service.js';
 import { connectedClients, WS_OPEN_STATE } from '@/modules/websocket/services/websocket-state.service.js';
+import { getGlobalImageAssetsDir, normalizeImageDescriptors } from '@/shared/image-attachments.js';
 import type {
   AnyRecord,
   AuthenticatedWebSocketRequest,
@@ -10,6 +13,37 @@ import type {
 } from '@/shared/types.js';
 import { parseIncomingJsonObject } from '@/shared/utils.js';
 
+/**
+ * Trust boundary for client-supplied image attachments: chat.send options come
+ * straight from the browser, and the provider runtimes read the referenced
+ * files off disk (Claude base64-encodes them into the prompt). Only images
+ * that live directly inside the global upload store (`~/.cloudcli/assets`,
+ * where POST /api/assets/images puts them) are allowed through — anything
+ * else (absolute paths elsewhere, traversal, subdirectories) is dropped.
+ *
+ * Exported for tests; `assetsRootOverride` exists only for them.
+ */
+export function filterImagesToUploadStore(images: unknown, assetsRootOverride?: string): AnyRecord[] {
+  const assetsRoot = path.resolve(assetsRootOverride ?? getGlobalImageAssetsDir());
+
+  return normalizeImageDescriptors(images).filter((descriptor) => {
+    // Relative paths are anchored in the store; absolute ones must already be in it.
+    const resolved = path.resolve(assetsRoot, descriptor.path);
+    const relative = path.relative(assetsRoot, resolved);
+    const isDirectChild =
+      relative.length > 0 &&
+      !relative.startsWith('..') &&
+      !path.isAbsolute(relative) &&
+      !relative.includes(path.sep) &&
+      !relative.includes('/');
+
+    if (!isDirectChild) {
+      console.warn(`[Chat] Dropping image outside the upload store: ${descriptor.path}`);
+    }
+    return isDirectChild;
+  });
+}
+
 /**
  * One provider runtime entry point. All five runtimes share this signature,
  * which lets the chat handler dispatch through a provider-keyed map instead
@@ -161,6 +195,9 @@ async function handleChatSend(
   // gateway writer captures and maps back to the app session id.
   const runtimeOptions: AnyRecord = {
     ...clientOptions,
+    // Image attachments are re-validated server-side: only files inside the
+    // global upload store may reach the provider runtimes' file reads.
+    images: filterImagesToUploadStore(clientOptions.images),
     sessionId: session.provider_session_id ?? undefined,
     resume: Boolean(session.provider_session_id),
     cwd: clientOptions.cwd ?? session.project_path ?? undefined,
@@ -175,8 +212,10 @@ async function handleChatSend(
   } finally {
     // Safety net: a runtime that crashed (or resolved) without emitting its
     // terminal `complete` would otherwise leave the session stuck in
-    // "processing" forever on every connected client.
-    chatRunRegistry.completeRun(sessionId, { exitCode: 1 });
+    // "processing" forever on every connected client. Scoped to THIS run —
+    // a queued message can start the session's next run before this promise
+    // settles, and the session-keyed completeRun would kill that new run.
+    chatRunRegistry.completeRunIfCurrent(run, { exitCode: 1 });
   }
 }
 

package/server/modules/websocket/services/shell-websocket.service.ts

@@ -146,14 +146,6 @@ function buildShellCommand(
     return 'codex';
   }
 
-  if (provider === 'gemini') {
-    const command = initialCommand || 'gemini';
-    if (resumeSessionId) {
-      return `${command} --resume "${resumeSessionId}"`;
-    }
-    return command;
-  }
-
   if (provider === 'opencode') {
     if (resumeSessionId) {
       return `opencode --session "${resumeSessionId}"`;
@@ -477,9 +469,7 @@ export function handleShellConnection(
               ? 'Cursor'
               : provider === 'codex'
                 ? 'Codex'
-                : provider === 'gemini'
-                  ? 'Gemini'
-                  : provider === 'opencode'
+                : provider === 'opencode'
                     ? 'OpenCode'
                   : 'Claude';
           welcomeMsg = hasSession && resumeSessionId

package/server/modules/websocket/tests/chat-image-filter.test.ts

@@ -0,0 +1,44 @@
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import { filterImagesToUploadStore } from '@/modules/websocket/services/chat-websocket.service.js';
+
+const STORE = path.join(os.tmpdir(), 'cloudcli-assets-store');
+
+test('images inside the upload store pass through', () => {
+  const inside = path.join(STORE, 'shot.png');
+  const result = filterImagesToUploadStore(
+    [{ path: inside, name: 'shot.png', mimeType: 'image/png' }],
+    STORE,
+  );
+  assert.equal(result.length, 1);
+  assert.equal(result[0].path, inside);
+});
+
+test('bare filenames are anchored inside the store', () => {
+  const result = filterImagesToUploadStore(['shot.png'], STORE);
+  assert.equal(result.length, 1);
+});
+
+test('paths outside the store, traversal, and subdirs are dropped', () => {
+  const result = filterImagesToUploadStore(
+    [
+      { path: 'C:/Users/victim/.ssh/id_rsa' },
+      { path: '/etc/passwd' },
+      { path: '../outside.png' },
+      { path: path.join(STORE, '..', 'escaped.png') },
+      { path: path.join(STORE, 'nested', 'deep.png') },
+      { path: STORE }, // the store folder itself is not a file
+    ],
+    STORE,
+  );
+  assert.deepEqual(result, []);
+});
+
+test('malformed payloads yield no images', () => {
+  assert.deepEqual(filterImagesToUploadStore(undefined, STORE), []);
+  assert.deepEqual(filterImagesToUploadStore('nope', STORE), []);
+  assert.deepEqual(filterImagesToUploadStore([{ name: 'no-path' }, 42], STORE), []);
+});

package/server/modules/websocket/tests/chat-run-registry.test.ts

@@ -129,6 +129,44 @@ test('complete marks the run finished and duplicate completes are dropped', asyn
   });
 });
 
+test('a finished run\'s safety net cannot complete the session\'s next run', async () => {
+  await withIsolatedDatabase(() => {
+    sessionsDb.createAppSession('app-run-9', 'codex', '/workspace/demo');
+    const connection = new FakeConnection();
+
+    const firstRun = chatRunRegistry.startRun({
+      appSessionId: 'app-run-9',
+      provider: 'codex',
+      providerSessionId: null,
+      connection,
+      userId: null,
+    });
+    assert.ok(firstRun);
+    firstRun.writer.send({ kind: 'complete', provider: 'codex', sessionId: 'native-9', exitCode: 0 });
+
+    // A queued message starts the next run before the first run's runtime
+    // promise settles (the chat handler's `finally` hasn't executed yet).
+    const secondRun = chatRunRegistry.startRun({
+      appSessionId: 'app-run-9',
+      provider: 'codex',
+      providerSessionId: null,
+      connection,
+      userId: null,
+    });
+    assert.ok(secondRun);
+
+    // First run's safety net fires late: it must not touch the new run.
+    chatRunRegistry.completeRunIfCurrent(firstRun, { exitCode: 1 });
+    assert.equal(chatRunRegistry.isProcessing('app-run-9'), true);
+    assert.equal(connection.frames.filter((frame) => frame.kind === 'complete').length, 1);
+
+    // The second run's own safety net still works while it is current.
+    chatRunRegistry.completeRunIfCurrent(secondRun, { exitCode: 1 });
+    assert.equal(chatRunRegistry.isProcessing('app-run-9'), false);
+    assert.equal(connection.frames.filter((frame) => frame.kind === 'complete').length, 2);
+  });
+});
+
 test('listRunningRuns returns only currently running app sessions', async () => {
   await withIsolatedDatabase(() => {
     sessionsDb.createAppSession('app-run-7', 'claude', '/workspace/demo');
@@ -186,22 +224,22 @@ test('replayEvents returns only events after the requested seq', async () => {
 
 test('attachConnection reroutes the live stream to a new socket', async () => {
   await withIsolatedDatabase(() => {
-    sessionsDb.createAppSession('app-run-5', 'gemini', '/workspace/demo');
+    sessionsDb.createAppSession('app-run-5', 'opencode', '/workspace/demo');
     const firstConnection = new FakeConnection();
     const run = chatRunRegistry.startRun({
       appSessionId: 'app-run-5',
-      provider: 'gemini',
+      provider: 'opencode',
       providerSessionId: null,
       connection: firstConnection,
       userId: null,
     });
     assert.ok(run);
 
-    run.writer.send({ kind: 'stream_delta', provider: 'gemini', sessionId: 'g', content: 'before' });
+    run.writer.send({ kind: 'stream_delta', provider: 'opencode', sessionId: 'o', content: 'before' });
 
     const secondConnection = new FakeConnection();
     assert.equal(chatRunRegistry.attachConnection('app-run-5', secondConnection), true);
-    run.writer.send({ kind: 'stream_delta', provider: 'gemini', sessionId: 'g', content: 'after' });
+    run.writer.send({ kind: 'stream_delta', provider: 'opencode', sessionId: 'o', content: 'after' });
 
     assert.deepEqual(firstConnection.frames.map((frame) => frame.content), ['before']);
     assert.deepEqual(secondConnection.frames.map((frame) => frame.content), ['after']);

package/server/openai-codex.js

@@ -14,13 +14,14 @@
  */
 
 import { Codex } from '@openai/codex-sdk';
+
+import { buildCodexInputItems, normalizeImageDescriptors } from './shared/image-attachments.js';
 import { notifyRunFailed, notifyRunStopped } from './services/notification-orchestrator.js';
 import { sessionsService } from './modules/providers/services/sessions.service.js';
 import { providerAuthService } from './modules/providers/services/provider-auth.service.js';
 import { providerModelsService } from './modules/providers/services/provider-models.service.js';
 import { createCompleteMessage, createNormalizedMessage } from './shared/utils.js';
 
-// Track active sessions
 const activeCodexSessions = new Map();
 
 function readUsageNumber(value) {
@@ -228,6 +229,8 @@ export async function queryCodex(command, options = {}, ws) {
     cwd,
     projectPath,
     model,
+    effort,
+    images,
     permissionMode = 'default'
   } = options;
 
@@ -239,6 +242,12 @@ export async function queryCodex(command, options = {}, ws) {
 
   const workingDirectory = cwd || projectPath || process.cwd();
   const { sandboxMode, approvalPolicy } = mapPermissionModeToCodexOptions(permissionMode);
+  const catalog = (await providerModelsService.getProviderModels('codex')).models;
+  const selectedModel = catalog.OPTIONS.find((option) => option.value === resolvedModel) || null;
+  const allowedEfforts = selectedModel?.effort?.values?.map((value) => value.value) || [];
+  const resolvedEffort = typeof effort === 'string' && effort !== 'default' && allowedEfforts.includes(effort)
+    ? effort
+    : undefined;
 
   let codex;
   let thread;
@@ -248,19 +257,17 @@ export async function queryCodex(command, options = {}, ws) {
   const abortController = new AbortController();
 
   try {
-    // Initialize Codex SDK
     codex = new Codex();
 
-    // Thread options with sandbox and approval settings
     const threadOptions = {
       workingDirectory,
       skipGitRepoCheck: true,
       sandboxMode,
       approvalPolicy,
-      model: resolvedModel
+      model: resolvedModel,
+      modelReasoningEffort: resolvedEffort,
     };
 
-    // Start or resume thread
     if (sessionId) {
       thread = codex.resumeThread(sessionId, threadOptions);
     } else {
@@ -280,13 +287,16 @@ export async function queryCodex(command, options = {}, ws) {
       });
     };
 
-    // Existing sessions can be tracked immediately; new sessions are tracked after thread.started.
     if (capturedSessionId) {
       registerSession(capturedSessionId);
     }
 
-    // Execute with streaming
-    const streamedTurn = await thread.runStreamed(command, {
+    // Execute with streaming. Turns with image attachments send structured
+    // input items so Codex reads the images from their local asset paths.
+    const turnInput = normalizeImageDescriptors(images).length > 0
+      ? buildCodexInputItems(command, images, workingDirectory)
+      : command;
+    const streamedTurn = await thread.runStreamed(turnInput, {
       signal: abortController.signal
     });
 

package/server/opencode-cli.js

@@ -1,19 +1,59 @@
-import { spawn } from 'child_process';
 import fsSync from 'node:fs';
 
 import crossSpawn from 'cross-spawn';
 import Database from 'better-sqlite3';
 
+import { appendImagesInputTag } from './shared/image-attachments.js';
 import { sessionsService } from './modules/providers/services/sessions.service.js';
 import { providerAuthService } from './modules/providers/services/provider-auth.service.js';
 import { providerModelsService } from './modules/providers/services/provider-models.service.js';
 import { notifyRunFailed, notifyRunStopped } from './services/notification-orchestrator.js';
-import { createCompleteMessage, createNormalizedMessage, getOpenCodeDatabasePath } from './shared/utils.js';
+import { createCompleteMessage, createNormalizedMessage, flattenPromptForWindowsShell, getOpenCodeDatabasePath } from './shared/utils.js';
 
-const spawnFunction = process.platform === 'win32' ? crossSpawn : spawn;
+// cross-spawn resolves .cmd shims/PATHEXT on Windows and delegates to
+// child_process.spawn everywhere else.
+const spawnFunction = crossSpawn;
 
 const activeOpenCodeProcesses = new Map();
 
+/**
+ * Maps the UI permission mode onto OpenCode's non-interactive controls.
+ *
+ * OpenCode has no single "permission mode" flag; each mode uses a different
+ * lever of the `opencode run` CLI (verified against v1.17.13):
+ * - plan              → the built-in read-only `plan` agent (`--agent plan`).
+ * - bypassPermissions → `--auto`, which auto-approves every permission that
+ *                       is not explicitly denied in the user's config.
+ * - acceptEdits       → the OPENCODE_PERMISSION env var, whose JSON body the
+ *                       CLI merges into its permission config. Forcing
+ *                       `edit: allow` guarantees file edits go through while
+ *                       every other rule stays under the user's own config.
+ * - default           → nothing; the user's opencode.json governs. In
+ *                       non-interactive `run` mode any `ask` rule is denied.
+ *
+ * Exported for tests only.
+ */
+export function resolveOpenCodePermissionOptions(permissionMode) {
+  switch (permissionMode) {
+    case 'plan':
+      return { args: ['--agent', 'plan'], env: {} };
+    case 'bypassPermissions':
+      return { args: ['--auto'], env: {} };
+    case 'acceptEdits':
+      return { args: [], env: { OPENCODE_PERMISSION: JSON.stringify({ edit: 'allow' }) } };
+    default:
+      return { args: [], env: {} };
+  }
+}
+
+function resolveOpenCodeEffort(model, effort, modelsDefinition) {
+  const selectedModel = modelsDefinition?.OPTIONS?.find((option) => option.value === model);
+  const allowedEfforts = selectedModel?.effort?.values?.map((value) => value.value) || [];
+  return typeof effort === 'string' && effort !== 'default' && allowedEfforts.includes(effort)
+    ? effort
+    : undefined;
+}
+
 function readOpenCodeSessionId(event) {
   if (!event || typeof event !== 'object') {
     return null;
@@ -84,7 +124,7 @@ function readOpenCodeTokenUsage(sessionId) {
 
 async function spawnOpenCode(command, options = {}, ws) {
   return new Promise((resolve, reject) => {
-    const { sessionId, projectPath, cwd, model, sessionSummary } = options;
+    const { sessionId, projectPath, cwd, model, effort, sessionSummary, images, permissionMode } = options;
     const workingDir = cwd || projectPath || process.cwd();
     const processKey = sessionId || Date.now().toString();
     let capturedSessionId = sessionId || null;
@@ -192,7 +232,15 @@ async function spawnOpenCode(command, options = {}, ws) {
       }
     };
 
-    void providerModelsService.resolveResumeModel('opencode', sessionId, model).then((resolvedModel) => {
+    void providerModelsService.resolveResumeModel('opencode', sessionId, model).then(async (resolvedModel) => {
+      let effortModels = null;
+      try {
+        effortModels = (await providerModelsService.getProviderModels('opencode')).models;
+      } catch (error) {
+        console.warn('[OpenCode] Unable to load provider models for effort validation:', error);
+      }
+
+      const resolvedEffort = resolveOpenCodeEffort(resolvedModel, effort, effortModels);
       const args = ['run', '--format', 'json'];
       // OpenCode's `run` command owns workspace selection through `--dir`.
       // Relying on the child-process cwd alone is not enough on Linux, where
@@ -204,14 +252,23 @@ async function spawnOpenCode(command, options = {}, ws) {
       if (resolvedModel) {
         args.push('--model', resolvedModel);
       }
+      if (resolvedEffort) {
+        args.push('--variant', resolvedEffort);
+      }
+      const permissionOptions = resolveOpenCodePermissionOptions(permissionMode);
+      args.push(...permissionOptions.args);
       if (command && command.trim()) {
-        args.push(command.trim());
+        // Image attachments ride along as an <images_input> path list appended
+        // to the prompt; the session history reader strips the tag back out.
+        // opencode is a .cmd shim on Windows, so the whole argument must be
+        // newline-free or cmd.exe silently truncates it at the first newline.
+        args.push(flattenPromptForWindowsShell(appendImagesInputTag(command.trim(), images)));
       }
 
       opencodeProcess = spawnFunction('opencode', args, {
         cwd: workingDir,
         stdio: ['pipe', 'pipe', 'pipe'],
-        env: { ...process.env },
+        env: { ...process.env, ...permissionOptions.env },
       });
 
       activeOpenCodeProcesses.set(processKey, opencodeProcess);

package/server/opencode-cli.test.js

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
 
-import { spawnOpenCode } from './opencode-cli.js';
+import { resolveOpenCodePermissionOptions, spawnOpenCode } from './opencode-cli.js';
 
 const findEnvKey = (name) =>
   Object.keys(process.env).find((key) => key.toLowerCase() === name.toLowerCase()) || name;
@@ -14,7 +14,10 @@ async function createFakeOpenCodeExecutable(binDir) {
   await writeFile(scriptPath, `
 const capturePath = process.env.OPENCODE_ARGS_CAPTURE;
 if (capturePath) {
-  require('node:fs').writeFileSync(capturePath, JSON.stringify(process.argv.slice(2)));
+  require('node:fs').writeFileSync(capturePath, JSON.stringify({
+    args: process.argv.slice(2),
+    permissionEnv: process.env.OPENCODE_PERMISSION ?? null,
+  }));
 }
 
 const events = [
@@ -86,10 +89,116 @@ test('spawnOpenCode emits session_created before normalized live messages for ne
     assert.equal(complete?.sessionId, 'open-live-1');
     assert.equal(messages.some((message) => message.kind === 'error'), false);
 
-    const launchedArgs = JSON.parse(await readFile(argsCapturePath, 'utf8'));
+    const capture = JSON.parse(await readFile(argsCapturePath, 'utf8'));
+    const launchedArgs = capture.args;
     assert.ok(Array.isArray(launchedArgs));
     assert.deepEqual(launchedArgs.slice(0, 4), ['run', '--format', 'json', '--dir']);
     assert.equal(launchedArgs[4], tempRoot);
+    // No permission mode requested → no permission flags and no env override.
+    assert.equal(launchedArgs.includes('--auto'), false);
+    assert.equal(launchedArgs.includes('--agent'), false);
+    assert.equal(capture.permissionEnv, null);
+  } finally {
+    if (previousPath === undefined) {
+      delete process.env[pathKey];
+    } else {
+      process.env[pathKey] = previousPath;
+    }
+
+    if (previousPathExt === undefined) {
+      delete process.env[pathExtKey];
+    } else {
+      process.env[pathExtKey] = previousPathExt;
+    }
+
+    if (previousArgsCapture === undefined) {
+      delete process.env.OPENCODE_ARGS_CAPTURE;
+    } else {
+      process.env.OPENCODE_ARGS_CAPTURE = previousArgsCapture;
+    }
+
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});
+
+test('resolveOpenCodePermissionOptions maps UI permission modes onto OpenCode controls', () => {
+  assert.deepEqual(resolveOpenCodePermissionOptions('plan'), {
+    args: ['--agent', 'plan'],
+    env: {},
+  });
+  assert.deepEqual(resolveOpenCodePermissionOptions('bypassPermissions'), {
+    args: ['--auto'],
+    env: {},
+  });
+  assert.deepEqual(resolveOpenCodePermissionOptions('acceptEdits'), {
+    args: [],
+    env: { OPENCODE_PERMISSION: '{"edit":"allow"}' },
+  });
+  // default and anything unknown leave the user's own opencode config in charge.
+  assert.deepEqual(resolveOpenCodePermissionOptions('default'), { args: [], env: {} });
+  assert.deepEqual(resolveOpenCodePermissionOptions(undefined), { args: [], env: {} });
+});
+
+test('spawnOpenCode passes permission mode flags and env to the CLI', async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'opencode-cli-perms-'));
+  const pathKey = findEnvKey('PATH');
+  const pathExtKey = findEnvKey('PATHEXT');
+  const previousPath = process.env[pathKey];
+  const previousPathExt = process.env[pathExtKey];
+  const previousArgsCapture = process.env.OPENCODE_ARGS_CAPTURE;
+  const writer = {
+    userId: null,
+    sessionId: null,
+    send() {},
+    setSessionId(sessionId) {
+      this.sessionId = sessionId;
+    },
+  };
+
+  try {
+    await createFakeOpenCodeExecutable(tempRoot);
+    process.env[pathKey] = `${tempRoot}${path.delimiter}${previousPath || ''}`;
+    if (process.platform === 'win32') {
+      process.env[pathExtKey] = previousPathExt?.toUpperCase().includes('.CMD')
+        ? previousPathExt
+        : `.COM;.EXE;.BAT;.CMD${previousPathExt ? `;${previousPathExt}` : ''}`;
+    }
+
+    const scenarios = [
+      {
+        permissionMode: 'plan',
+        expectArgs: ['--agent', 'plan'],
+        expectPermissionEnv: null,
+      },
+      {
+        permissionMode: 'bypassPermissions',
+        expectArgs: ['--auto'],
+        expectPermissionEnv: null,
+      },
+      {
+        permissionMode: 'acceptEdits',
+        expectArgs: [],
+        expectPermissionEnv: '{"edit":"allow"}',
+      },
+    ];
+
+    for (const scenario of scenarios) {
+      const argsCapturePath = path.join(tempRoot, `opencode-args-${scenario.permissionMode}.json`);
+      process.env.OPENCODE_ARGS_CAPTURE = argsCapturePath;
+
+      await spawnOpenCode('Hi', { cwd: tempRoot, permissionMode: scenario.permissionMode }, writer);
+
+      const capture = JSON.parse(await readFile(argsCapturePath, 'utf8'));
+      for (const expectedArg of scenario.expectArgs) {
+        assert.ok(
+          capture.args.includes(expectedArg),
+          `${scenario.permissionMode}: expected "${expectedArg}" in ${JSON.stringify(capture.args)}`,
+        );
+      }
+      // The prompt stays the last positional argument, after any permission flags.
+      assert.equal(capture.args[capture.args.length - 1], 'Hi');
+      assert.equal(capture.permissionEnv, scenario.expectPermissionEnv);
+    }
   } finally {
     if (previousPath === undefined) {
       delete process.env[pathKey];