@elliotsystems/eai 0.1.2 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elliotsystems/eai",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Elliot AI CLI entry point (eai) - launches the Elliot runtime with arguments forwarded verbatim.",
   "bin": {
     "eai": "./bin/eai"
@@ -8,14 +8,16 @@
   "files": [
     "bin",
     "lib",
+    "config",
+    "plugin",
     "README.md"
   ],
   "scripts": {
     "test": "node --test test/*.test.js",
-    "vendor": "node scripts/vendor.js",
-    "assemble": "node scripts/assemble.js",
     "publish:npm": "node scripts/publish.js",
-    "build:runtime": "bun run --cwd ../opencode/packages/opencode script/build.ts --skip-embed-web-ui"
+    "bundle": "node scripts/bundle.js",
+    "prepack": "node scripts/bundle.js",
+    "verify": "node scripts/verify-package.js"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -23,11 +25,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "optionalDependencies": {
-    "@elliotsystems/eai-darwin-arm64": "0.1.2",
-    "@elliotsystems/eai-darwin-x64": "0.1.2",
-    "@elliotsystems/eai-linux-x64": "0.1.2",
-    "@elliotsystems/eai-linux-arm64": "0.1.2",
-    "@elliotsystems/eai-windows-x64": "0.1.2"
+  "dependencies": {
+    "opencode-ai": "1.18.30"
   }
 }

package/plugin/opencode-plugin/README.md

@@ -0,0 +1,64 @@
+# @elliotsystems/opencode-plugin
+
+Elliot AI's OpenCode integration. Phase C2 scope: repository-scope injection for
+`elliot_knowledge_search`.
+
+## What it does — and pointedly does not
+
+The Elliot backend serves `knowledge_search` as an MCP tool on `/mcp/v1`; through the MCP
+server name `elliot`, the agent sees **`elliot_knowledge_search`**. This plugin's single
+job is to inject the session's repository (`owner/name`, derived from the worktree's git
+remote) into that tool's arguments, so retrieval can be repo-focused **while the model
+never names a repository**. The backend's `resolve_repo_scope` remains the only
+authorizer — a wrong or forged hint can select nothing the tenant wasn't already granted.
+
+No tokens (login/refresh/storage is OpenCode's native MCP OAuth — `opencode mcp auth
+elliot`), no transport, no prompt injection.
+
+## Setup
+
+`opencode.json`:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "elliot": {
+      "type": "remote",
+      "url": "https://backend.elliotsystemsonline.com/mcp/v1",
+      "oauth": { "clientId": "elliot-opencode" }
+    }
+  },
+  "plugin": [["@elliotsystems/opencode-plugin@0.1.0", { "serverNames": ["elliot"] }]]
+}
+```
+
+Then `opencode mcp auth elliot` once. Pin the plugin version — never `@latest`.
+
+`serverNames` must match your `mcp` key(s); the plugin recognises the composed tool key
+`<server>_knowledge_search` exactly (OpenCode composes MCP tool keys as
+`sanitize(client) + "_" + sanitize(tool)`).
+
+## Development
+
+```bash
+npm install
+npm test          # vitest — includes the security cases (scope overwrite/delete)
+npm run typecheck
+```
+
+Load the working copy into OpenCode with a path spec:
+`"plugin": [["file:///abs/path/to/opencode-plugin/src/index.ts", {}]]`.
+
+Windows note: if `bun`/OpenCode installs hit `EPERM (NtSetInformationFile())` on native
+packages, that's AV interference during cache renames — use
+`bun install --backend=copyfile` and/or add an AV exclusion (see Phase B findings).
+
+## Security invariants (tested)
+
+- Session truth **overwrites** any pre-existing `repo_scope_hint` in tool args.
+- With no derivable scope, a smuggled hint is **deleted**; search degrades to
+  tenant-wide (authorized, just unfocused) — never an error, never a forged scope.
+- Only the exact composed key on configured servers is touched; every other tool's
+  args pass through byte-identical.
+- Options are zod-`strict()`: unknown keys fail the plugin at load, loudly.

package/plugin/opencode-plugin/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@elliotsystems/opencode-plugin",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Elliot AI integration for OpenCode: tenant-aware knowledge tools, repository scope, and policy.",
+  "license": "MIT",
+  "main": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./tui": "./src/tui/index.tsx"
+  },
+  "files": [
+    "src",
+    "themes",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "@opentui/core": ">=0.4.5 <0.5",
+    "@opentui/solid": ">=0.4.5 <0.5",
+    "solid-js": ">=1.9.10 <2",
+    "zod": ">=3.23"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "elliot": {
+    "opencodeRange": ">=1.18.19 <1.19.0"
+  },
+  "oc-themes": [
+    "themes/elliot.json"
+  ]
+}

package/plugin/opencode-plugin/src/classifier.ts

@@ -0,0 +1,238 @@
+/**
+ * Shell-command classification — the policy intelligence glob patterns cannot express.
+ *
+ * Ported (adapted, not copied wholesale) from `elliot-cli/src/tools/bash-policy.ts`,
+ * which is pure and dependency-free. Three things here are beyond what OpenCode's
+ * native `permission.bash` globs can represent, which is exactly why this file exists:
+ *
+ *   1. **Category labels** (READ/TEST/BUILD/MUTATION/DESTRUCTIVE/UNKNOWN) — a glob
+ *      yields a verdict, never a reason. A human approving a prompt deserves the reason.
+ *   2. **Chain-splitting with worst-case ranking** — OpenCode does decompose pipelines
+ *      per command node (`tool/shell.ts:408`), but the *classification* of a compound
+ *      command as "only as safe as its most dangerous segment" is ours.
+ *   3. **The credential-exfiltration heuristic** — a relationship between two tokens
+ *      ("names a secret-shaped path" AND "invokes a network tool") in one command line.
+ *      No prefix pattern can see a relationship.
+ *
+ * Failure direction is inherited deliberately from the original: over-trigger toward
+ * `ask`, never under-trigger. A spurious prompt is a cost; a missed bypass is an
+ * incident. Notably `CHAIN_SPLIT_RE` is a naive split, not a shell parser — a literal
+ * `;` inside a quoted commit message can cause an extra prompt. That is the correct
+ * trade.
+ *
+ * Nothing here is repository-specific: every pattern is a generic command shape.
+ */
+
+export type Category = "READ" | "TEST" | "BUILD" | "MUTATION" | "DESTRUCTIVE" | "UNKNOWN"
+
+function firstToken(cmd: string): string {
+  return cmd.trim().split(/\s+/)[0] ?? ""
+}
+
+/**
+ * git is classified by SUBCOMMAND and flags, never lumped together: `git status` and
+ * `git push --force` share a prefix and share nothing else.
+ */
+function classifyGit(cmd: string): Category {
+  const rest = cmd.trim().replace(/^git\s+/i, "")
+  const sub = firstToken(rest).toLowerCase()
+
+  if (/(^|\s)(--force|-f)(\s|$)/i.test(rest) && sub === "push") return "DESTRUCTIVE"
+  if (sub === "push") return "MUTATION"
+  if (sub === "reset" && /--hard/i.test(rest)) return "DESTRUCTIVE"
+  if (sub === "reset") return "MUTATION"
+  if (sub === "clean" && /-\w*f/i.test(rest)) return "DESTRUCTIVE"
+  if (sub === "clean") return "MUTATION"
+  if (["commit", "checkout", "merge", "rebase", "stash", "branch"].includes(sub)) {
+    // Listing branches is a read; deleting one is not.
+    if (sub === "branch") return /(^|\s)-[dD]\b/.test(rest) ? "MUTATION" : "READ"
+    return "MUTATION"
+  }
+  if (["status", "log", "diff", "show", "remote"].includes(sub)) return "READ"
+  return "UNKNOWN"
+}
+
+const READ_PATTERNS: RegExp[] = [
+  /^(ls|dir)\b/i, /^cat\b/i, /^type\b/i, /^head\b/i, /^tail\b/i, /^wc\b/i,
+  /^pwd$/i, /^cd\b/i, /^echo\b/i,
+  /^find\b(?!.*(-delete|-exec))/i,
+  /^(which|where)\b/i,
+  /^node\s+(-v|--version)$/i,
+  /^npm\s+(ls|list)\b/i,
+  // Read-only pipeline filters. Present because OpenCode asks about every node of a
+  // pipeline, so an unclassified filter would drag an otherwise-READ pipeline to UNKNOWN.
+  // `sed`/`awk`/`xargs` are deliberately absent: `sed -i` writes, `awk` has
+  // `print > file` and `system()`, `xargs` executes whatever follows.
+  /^(grep|findstr|cut|sort|uniq|tr|jq)\b/i,
+]
+
+const TEST_PATTERNS: RegExp[] = [
+  /^npm\s+test\b/i, /^npm\s+run\s+test/i, /^(yarn|pnpm)\s+test\b/i,
+  /^python\s+-m\s+pytest\b/i, /^pytest\b/i, /^jest\b/i, /^vitest\b/i,
+  /^npx\s+vitest\b/i, /^go\s+test\b/i, /^cargo\s+test\b/i, /^mvn\s+test\b/i,
+  /^dotnet\s+test\b/i, /^make\s+test\b/i,
+]
+
+const BUILD_PATTERNS: RegExp[] = [
+  /^npm\s+run\s+build\b/i, /^(yarn|pnpm)\s+build\b/i, /^tsc\b/i,
+  /^go\s+build\b/i, /^cargo\s+build\b/i, /^mvn\s+package\b/i, /^make(\s+build)?$/i,
+]
+
+const MUTATION_PATTERNS: RegExp[] = [
+  /^npm\s+(install|uninstall|ci)\b/i, /^pip\s+(install|uninstall)\b/i,
+  /^mv\b/i, /^cp\b/i, /^mkdir\b/i, /^touch\b/i, /^chmod\b/i, /^chown\b/i,
+  /^docker\s+(run|stop|rm)\b/i, /^kill\b/i, /^taskkill\b/i,
+  // A single, non-recursive delete — real but bounded. `rm -rf` is caught as
+  // DESTRUCTIVE before this list is consulted.
+  /^rm\b/i, /^del\b/i,
+]
+
+/**
+ * Catastrophic and with no legitimate interactive use. Confirmation adds no safety
+ * against a runaway loop, so these are refused outright. Intentionally tiny — broad
+ * denial belongs to the DESTRUCTIVE default (`ask`), not here.
+ */
+const HARD_DENY_PATTERNS: RegExp[] = [
+  /:\(\)\s*\{\s*:\|\s*:&\s*\}\s*;\s*:/,      // classic fork bomb
+  /^rm\s+-rf?\s+(\/|~)(\s|$)/i,              // rm -rf /   |   rm -rf ~
+  /^rm\s+-rf?\s+\/\*(\s|$)/i,                // rm -rf /*
+  /^rmdir\s+\/s\s+\/q\s+[a-z]:\\?\s*$/i,     // rmdir /s /q C:\
+  /^mkfs\b/i,
+  /^format\s+[a-z]:/i,                        // Windows format C:
+]
+
+const DESTRUCTIVE_PATTERNS: RegExp[] = [
+  /^rm\s+-rf?\b/i, /^rmdir\s+\/s\b/i, /^del\b.*(\/f|\/s|\/q|\*)/i,
+  /\b(drop|truncate)\s+(table|database)\b/i, /\bdelete\s+from\b/i,
+  /^format\b/i, /^mkfs\b/i, /^dd\s+if=/i,
+  /^(shutdown|reboot|halt)\b/i, /^chmod\s+-R\s+777\s+\//i,
+  /(curl|wget)\b.*\|\s*(sh|bash|powershell)\b/i,  // pipe remote script into a shell
+]
+
+/**
+ * Process-kill tools, and the process names Elliot itself runs under.
+ *
+ * `eai` is an npm bin shim, so the launcher IS a `node.exe` process and the
+ * runtime is `opencode.exe`. That makes a by-name kill self-inflicted: asked to
+ * restart a dev stack, the agent reached for
+ *
+ *     Get-Process node | Stop-Process -Force
+ *
+ * which matched its own host and terminated the session mid-command. Because
+ * `Stop-Process -Force` maps to TerminateProcess, no signal handler, `finally`
+ * or `exit` hook runs -- so the terminal was also left in mouse-reporting mode,
+ * flooding the next shell with escape sequences. It killed every unrelated
+ * `node.exe` on the machine too.
+ *
+ * Denied outright rather than asked, because the confirmation prompt does not
+ * convey the real consequence: someone approving "restart the project" is not
+ * agreeing to kill the session asking the question.
+ */
+// `spps` and bare `kill` are PowerShell aliases for Stop-Process, so the same
+// self-kill works spelled either way; both are word-bounded, so `kill` matches
+// only the standalone verb and not `taskkill`/`pkill`/`killall`.
+const PROCESS_KILL_TOOL = /\b(Stop-Process|spps|taskkill|pkill|killall|kill)\b/i
+
+/** Word-bounded so `node_exporter` and `mynode` are not caught. */
+const AGENT_RUNTIME_NAME = /\b(node|bun|opencode|eai)(\.exe)?\b/i
+
+/**
+ * An explicit numeric PID means the caller already identified one process, which
+ * is the safe way to do this and stays allowed.
+ */
+const SCOPED_BY_PID = /(-Id\b|\/PID\b)\s*:?\s*\d+/i
+
+/**
+ * True when a command would kill processes by NAME and that name matches the
+ * runtime Elliot is running inside.
+ *
+ * Killing `uvicorn`, `vite` or any other dev process by name stays allowed --
+ * this is not a ban on process management, only on the shape that takes the
+ * agent down with it.
+ */
+export function killsAgentRuntime(command: string): boolean {
+  if (!PROCESS_KILL_TOOL.test(command)) return false
+  if (SCOPED_BY_PID.test(command)) return false
+  return AGENT_RUNTIME_NAME.test(command)
+}
+
+/** Secret-shaped paths and network tools — the two halves of the exfil heuristic. */
+const SECRET_PATH_PATTERN = /(\.env\b|id_rsa|\.aws\b|\.ssh\b|credentials|\.pem\b|\.p12\b)/i
+const NETWORK_TOOL_PATTERN = /\b(curl|wget|nc|ncat|scp|ftp|Invoke-WebRequest|Invoke-RestMethod)\b/i
+
+/**
+ * True when one command line both names a secret-shaped path AND invokes a network
+ * tool. Best-effort by design: it cannot prove intent, and it is the one rule here
+ * that no glob pattern could ever approximate.
+ */
+export function looksLikeCredentialExfiltration(command: string): boolean {
+  return SECRET_PATH_PATTERN.test(command) && NETWORK_TOOL_PATTERN.test(command)
+}
+
+/** Classify ONE command with no shell chaining in it. */
+function classifySingle(command: string): Category {
+  const cmd = command.trim()
+  if (!cmd) return "UNKNOWN"
+
+  if (/^git\b/i.test(cmd)) return classifyGit(cmd)
+
+  if (HARD_DENY_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (DESTRUCTIVE_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (looksLikeCredentialExfiltration(cmd)) return "DESTRUCTIVE"
+
+  if (TEST_PATTERNS.some((re) => re.test(cmd))) return "TEST"
+  if (BUILD_PATTERNS.some((re) => re.test(cmd))) return "BUILD"
+  if (MUTATION_PATTERNS.some((re) => re.test(cmd))) return "MUTATION"
+  if (READ_PATTERNS.some((re) => re.test(cmd))) return "READ"
+
+  return "UNKNOWN"
+}
+
+/** How restrictive each category is — used to pick the worst segment of a chain. */
+const RANK: Record<Category, number> = {
+  READ: 0, TEST: 0, BUILD: 0,
+  MUTATION: 1, UNKNOWN: 1,
+  DESTRUCTIVE: 2,
+}
+
+function worstOf(categories: Category[]): Category {
+  return categories.reduce((worst, c) => (RANK[c] > RANK[worst] ? c : worst))
+}
+
+/**
+ * Metacharacters that chain, pipe, substitute, or redirect — each hands control to a
+ * SECOND command the anchored (`^`) patterns above would never see. Without splitting,
+ * `git status ; rm -rf /` classifies as the READ head alone and the tail rides along.
+ */
+const CHAIN_SPLIT_RE = /(?:&&|\|\||>>|;|\||`|\$\(|\n|>|<|&)/
+
+function segmentsOf(command: string): string[] {
+  return command.trim().split(CHAIN_SPLIT_RE).map((s) => s.trim()).filter(Boolean)
+}
+
+export function classifyCommand(command: string): Category {
+  const cmd = command.trim()
+  if (!cmd) return "UNKNOWN"
+
+  // Whole-string checks first: a catastrophic or exfil shape is caught wherever it sits
+  // relative to a chaining operator.
+  if (HARD_DENY_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (DESTRUCTIVE_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (looksLikeCredentialExfiltration(cmd)) return "DESTRUCTIVE"
+  // Checked whole-string: the kill tool and the process name routinely sit on
+  // opposite sides of a pipe, so per-segment classification would see neither.
+  if (killsAgentRuntime(cmd)) return "DESTRUCTIVE"
+
+  const segments = segmentsOf(cmd)
+  if (segments.length <= 1) return classifySingle(cmd)
+
+  // A compound command is only as safe as its most dangerous segment.
+  return worstOf(segments.map(classifySingle))
+}
+
+export function isHardDenied(command: string): boolean {
+  const cmd = command.trim()
+  if (HARD_DENY_PATTERNS.some((re) => re.test(cmd))) return true
+  // A hard-deny command can hide as one segment of a chain.
+  return segmentsOf(cmd).some((seg) => HARD_DENY_PATTERNS.some((re) => re.test(seg)))
+}

package/plugin/opencode-plugin/src/elliot-auth.ts

@@ -0,0 +1,133 @@
+/**
+ * Elliot token read + refresh — the credential half of the proxy provider.
+ *
+ * Ported (trimmed, not imported) from `elliot-cli/src/auth/refresh.ts` and
+ * `elliot-cli/src/config.ts`: same `~/.elliot/config.json` shape, same
+ * refresh endpoint contract (`POST {backend_url}/auth/refresh` ->
+ * `{access_token, expires_in_seconds}`), same "never throw" discipline. This
+ * file exists inside `opencode-plugin` rather than importing the CLI package
+ * because the plugin ships and is loaded independently of `elliot-cli` — see
+ * `docs/superpowers/plans/2026-09-03-eai-proxy-auth.md`.
+ *
+ * `freshToken` is the only export the proxy provider's `auth.loader`/`fetch`
+ * needs: it never throws, so a stale/missing/corrupt config degrades to "no
+ * token" (the proxy 401s) rather than crashing OpenCode's model call.
+ */
+import * as fs from "node:fs"
+import * as os from "node:os"
+import * as path from "node:path"
+
+export interface ElliotConfig {
+  jwt_token?: string
+  refresh_token?: string
+  backend_url?: string
+  access_token_expires_at?: string
+  [k: string]: unknown
+}
+
+/** `${ELLIOT_HOME}/config.json`, or `~/.elliot/config.json` when unset. */
+export function elliotConfigPath(): string {
+  const home = process.env.ELLIOT_HOME ?? path.join(os.homedir(), ".elliot")
+  return path.join(home, "config.json")
+}
+
+/** Parsed config, or null when absent, unreadable, or not valid JSON. */
+export function readElliotConfig(): ElliotConfig | null {
+  try {
+    const raw = fs.readFileSync(elliotConfigPath(), "utf-8")
+    return JSON.parse(raw) as ElliotConfig
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Persist the config, owner-only (0600) — this file holds a live bearer
+ * token. Creates `~/.elliot` (0700) if it doesn't exist yet.
+ */
+export function writeElliotConfig(cfg: ElliotConfig): void {
+  const configPath = elliotConfigPath()
+  const configDir = path.dirname(configPath)
+  if (!fs.existsSync(configDir)) {
+    fs.mkdirSync(configDir, { recursive: true, mode: 0o700 })
+  }
+  fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2), { mode: 0o600 })
+  fs.chmodSync(configPath, 0o600)
+}
+
+/** `exp` (seconds since epoch) from a JWT's middle segment, or null. */
+function decodeJwtExp(token: string): number | null {
+  try {
+    const parts = token.split(".")
+    if (parts.length < 2) return null
+    const payload = JSON.parse(Buffer.from(parts[1], "base64").toString("utf-8"))
+    return typeof payload?.exp === "number" ? payload.exp : null
+  } catch {
+    return null
+  }
+}
+
+const REFRESH_SKEW_MS = 60_000
+
+/**
+ * True if the access token is expired or within `REFRESH_SKEW_MS` of
+ * expiring. Prefers the stored `access_token_expires_at`; falls back to
+ * decoding `jwt_token`'s `exp` claim; true (treat as expired -> refresh) when
+ * neither is decodable.
+ */
+export function isExpired(cfg: ElliotConfig, nowMs = Date.now()): boolean {
+  if (cfg.access_token_expires_at) {
+    const expiresAtMs = new Date(cfg.access_token_expires_at).getTime()
+    if (Number.isFinite(expiresAtMs)) {
+      return expiresAtMs - REFRESH_SKEW_MS <= nowMs
+    }
+  }
+  const exp = cfg.jwt_token ? decodeJwtExp(cfg.jwt_token) : null
+  if (exp === null) return true
+  return exp * 1000 - REFRESH_SKEW_MS <= nowMs
+}
+
+interface RefreshResponse {
+  access_token: string
+  expires_in_seconds: number
+}
+
+interface FreshTokenDeps {
+  fetchImpl?: typeof fetch
+  write?: (cfg: ElliotConfig) => void
+}
+
+/**
+ * A valid access token, refreshing + persisting when expired and a
+ * `refresh_token`/`backend_url` are present. NEVER throws: any failure
+ * (network, non-2xx, malformed response) falls back to the existing
+ * `jwt_token` — the proxy 401s on a stale token rather than this crashing the
+ * model call.
+ */
+export async function freshToken(
+  cfg: ElliotConfig,
+  deps?: FreshTokenDeps,
+): Promise<string | null> {
+  try {
+    if (cfg.jwt_token && !isExpired(cfg)) return cfg.jwt_token
+    if (!cfg.refresh_token || !cfg.backend_url) return cfg.jwt_token ?? null
+
+    const fetchImpl = deps?.fetchImpl ?? fetch
+    const write = deps?.write ?? writeElliotConfig
+
+    const response = await fetchImpl(`${cfg.backend_url}/auth/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: cfg.refresh_token }),
+    })
+    if (!response.ok) return cfg.jwt_token ?? null
+
+    const data = (await response.json()) as RefreshResponse
+    cfg.jwt_token = data.access_token
+    cfg.access_token_expires_at = new Date(Date.now() + data.expires_in_seconds * 1000).toISOString()
+    write(cfg)
+    return data.access_token
+  } catch {
+    return cfg.jwt_token ?? null
+  }
+}

package/plugin/opencode-plugin/src/identity.ts

@@ -0,0 +1,69 @@
+/**
+ * Make the agent call itself Elliot-AI.
+ *
+ * The visual layer was branded long before this: wordmark, palette, terminal
+ * title. But the agent's own sense of identity lives in the system prompt, and
+ * on a stock runtime that prompt opens with "You are OpenCode, ...". So asking
+ * the CLI "who are you?" got "I'm opencode" — every surface said Elliot except
+ * the one the user actually talks to.
+ *
+ * Fixed here rather than in the prompt files, because those are compiled into
+ * the stock upstream binary and patching them would put Elliot back inside
+ * OpenCode. `experimental.chat.system.transform` is upstream's own hook for
+ * exactly this (`packages/plugin/src/index.ts`), fired from both
+ * `agent/agent.ts` and `session/llm/request.ts`, so the fix stays in the
+ * overlay and survives an upstream upgrade.
+ */
+
+/** The product name the assistant should use for itself. */
+export const PRODUCT_NAME = "Elliot-AI"
+
+/**
+ * Matches ONLY the identity clause that opens a system prompt.
+ *
+ * Anchored to the start and requiring the following comma, because the prompts
+ * also contain `https://opencode.ai/docs` and
+ * `https://github.com/anomalyco/opencode`. Those are real upstream links: a
+ * blanket rename would silently turn working URLs into 404s, and would also
+ * corrupt references to `opencode.json` and `.opencode/` that the tool guidance
+ * depends on. Eight identity variants exist across the prompt files (`You are
+ * OpenCode,` / `You are opencode,`), and all of them share this shape.
+ */
+const IDENTITY = /^You are opencode,/i
+
+/**
+ * Prepended so the model can answer "what is your name" and "who made you"
+ * without inferring it from a rewritten sentence halfway down a long prompt.
+ *
+ * It states only what is true. The underlying model is deliberately not named:
+ * that is a provider detail that changes, and guessing it is how an assistant
+ * ends up confidently telling a customer something wrong.
+ */
+const IDENTITY_PREAMBLE = [
+  `You are ${PRODUCT_NAME}, the coding agent made by Elliot Systems.`,
+  `When asked who or what you are, say you are ${PRODUCT_NAME} by Elliot Systems.`,
+  `Never refer to yourself as OpenCode.`,
+  `OpenCode is the open-source harness you run on, not your identity. If a user`,
+  `asks directly what you are built on, you may say you are built on OpenCode.`,
+].join(" ")
+
+/**
+ * Rewrite the system prompt in place.
+ *
+ * Idempotent: re-running leaves the result unchanged, which matters because the
+ * hook fires per request and on a long session would otherwise stack the
+ * preamble dozens of times and eat the context window.
+ */
+export function applyElliotIdentity(system: string[]): string[] {
+  if (system.some((entry) => entry.startsWith(IDENTITY_PREAMBLE))) return system
+
+  for (let i = 0; i < system.length; i++) {
+    const entry = system[i]
+    if (typeof entry === "string" && IDENTITY.test(entry)) {
+      system[i] = entry.replace(IDENTITY, `You are ${PRODUCT_NAME},`)
+    }
+  }
+
+  system.unshift(IDENTITY_PREAMBLE)
+  return system
+}