@coreplane/switchboard 1.235.0 → 1.237.0

package/dist/assets/Dockerfile

@@ -87,6 +87,17 @@ RUN npm install -g @earendil-works/pi-coding-agent@0.85.1 \
   && pi --version | grep -qx '0.85.1' \
   && pi --help | grep -q -- '--mode <mode>'
 
+# OpenCode, the second harness (docs/reference/specs/harness.md): `@opencode/cli`
+# at the EXACT pin held by src/deploy/imageOpenCodeHarness.test.ts, beside pi.
+# The wrapper's postinstall hard-links the platform binary into place, so it
+# is the one install script allowed by name; the grep proves the binary on
+# PATH prints the pin's version text (`opencode v2.0.3`, exactly); the npm
+# cache (a 200 MB tarball) is dropped in the same layer. Dark until a
+# deployment names it: nothing here starts it on its own.
+RUN npm install -g --allow-scripts=@opencode/cli @opencode/cli@2.0.3 \
+  && npm cache clean --force \
+  && opencode --version | grep -qx 'opencode v2.0.3'
+
 # Non-root user; agents run bash with this user's (container-scoped) permissions.
 RUN useradd -m -u 1001 switchboard
 WORKDIR /app

package/dist/assets/config/config.example.yaml

@@ -311,10 +311,15 @@ workspaceDir: ./workspaces
 # them the request is refused naming what is missing. Per unit: at most
 # `maxRounds` review rounds and `maxMinutes` minutes of wall clock — whichever
 # hits first ends the unit, and each child round's own budget is clipped to the
-# remaining time. `maxMinutes` is the ship preset's declared budget: a channel or
-# user `boundary.maxMinutes` and a per-message `budget:` directive clip it like
-# any preset's, and the card says so. Defaults shown; both must be integers >= 1;
-# any other key under `ship` fails the load by name.
+# remaining time. The pipeline is budgeted for the loop, not one round: the
+# coding child's directive is additionally capped to leave two review rounds and
+# one merge poll (11 minutes) on the clock, so a child that uses its whole
+# budget still hands the review its time — which is why `maxMinutes` must be an
+# integer >= 14 (the loop's reserve plus one round). `maxMinutes` is the ship
+# preset's declared budget: a channel or user `boundary.maxMinutes` and a
+# per-message `budget:` directive clip it like any preset's, and the card says
+# so. Defaults shown; `maxRounds` must be an integer >= 1; any other key under
+# `ship` fails the load by name.
 # ship:
 #   maxRounds: 3      # review rounds per unit
 #   maxMinutes: 120   # the ship preset's wall-clock budget in minutes (the registry's default)

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -1807,6 +1807,18 @@ export class RunHistoryDO extends DurableObject<Env> {
     this.ctx.storage.transactionSync(() => {
       result = this.upsertInTransaction(record, proposal);
     });
+    // A coordinator child closed OUTSIDE the ledger's finish — the run loop or
+    // a reclaim writing an `interrupted` record, the pi harness's typed restart,
+    // a resume abandoning a lost workspace — still wakes its parent's wait at
+    // once (run-history item 47): the same `run-finished-<runId>` event rides
+    // this commit. The tombstone a run writes at its start is excluded (its
+    // `finishedAt` equals `startedAt`); the parent confirms by `read-record`
+    // before it acts, so a duplicate send is harmless.
+    if (result.stored && record.parentInstanceId !== undefined && record.finishedAt > record.startedAt) {
+      const event = await sendRunFinished(this.env.SHIP_COORDINATOR, record);
+      if (event.kind === "failed")
+        console.warn(`[runs/put] ${record.id} → ${event.type} not delivered to ${event.instance}: ${event.reason}`);
+    }
     if ((await this.ctx.storage.getAlarm()) === null)
       await this.ctx.storage.setAlarm(systemClock() + RUN_SWEEP_INTERVAL_MS);
     return result;

package/dist/assets/deploy/cloudflare-resident/Dockerfile

@@ -201,6 +201,18 @@ RUN npm install -g @earendil-works/pi-coding-agent@0.85.1 \
   && pi --version | grep -qx '0.85.1' \
   && pi --help | grep -q -- '--mode <mode>'
 
+# OpenCode, the second harness (docs/reference/specs/harness.md): `@opencode/cli`
+# at the EXACT pin held by src/deploy/imageOpenCodeHarness.test.ts, beside pi.
+# The wrapper's postinstall hard-links the platform binary into place, so it
+# is the one install script allowed by name; the grep proves the binary on
+# PATH prints the pin's version text (`opencode v2.0.3`, exactly); the npm
+# cache (a 200 MB tarball) is dropped in the same layer, and the proof runs
+# again as worker1 below. Dark until a deployment names it: nothing here
+# starts it on its own.
+RUN npm install -g --allow-scripts=@opencode/cli @opencode/cli@2.0.3 \
+  && npm cache clean --force \
+  && opencode --version | grep -qx 'opencode v2.0.3'
+
 # Agent commands never run as root (repo code runs unprivileged, one user per
 # thread — docs/reference/specs/resident-repos.md). The SDK's exec has no user/uid option
 # (verified against 0.13.0-next.751.1), so the container server itself runs as
@@ -230,6 +242,12 @@ RUN su -s /bin/bash worker1 -c "playwright screenshot --viewport-size=640,480 'd
 # own, named by PI_CODING_AGENT_DIR at start).
 RUN su -s /bin/bash worker1 -c "pi --version | grep -qx '0.85.1'"
 
+# OpenCode once more, as worker1: a run's server is started as the thread's
+# user through the same `su`, so the BUILD proves an unprivileged user finds
+# the pin on PATH and the binary runs without a writable home (its roots are
+# the run's own, named by the XDG variables at start).
+RUN su -s /bin/bash worker1 -c "opencode --version | grep -qx 'opencode v2.0.3'"
+
 # bun once more, as worker1: a thread's `bun install` runs as the thread's user
 # through the same `su`, whose PATH is /etc/environment's rather than this
 # file's — so the BUILD proves that PATH resolves the pin, not the base's bun.