@foxden-app/foxclaw 0.5.77 → 0.6.3

package/dist/opencode/events.d.ts

@@ -0,0 +1,61 @@
+import type { Event, PermissionRequest, QuestionRequest, SessionStatus } from '@opencode-ai/sdk/v2';
+export interface OpencodeTextEvent {
+    kind: 'text';
+    sessionId: string;
+    messageId: string;
+    partId: string;
+    text: string;
+    delta: string | null;
+}
+export interface OpencodeToolEvent {
+    kind: 'tool';
+    sessionId: string;
+    messageId: string;
+    partId: string;
+    callId: string;
+    tool: string;
+    status: string;
+    title: string | null;
+    error: string | null;
+}
+export type OpencodeBridgeEvent = OpencodeTextEvent | OpencodeToolEvent | {
+    kind: 'permission';
+    request: PermissionRequest;
+} | {
+    kind: 'permissionResolved';
+    sessionId: string;
+    requestId: string;
+} | {
+    kind: 'question';
+    request: QuestionRequest;
+} | {
+    kind: 'questionResolved';
+    sessionId: string;
+    requestId: string;
+} | {
+    kind: 'status';
+    sessionId: string;
+    status: SessionStatus;
+} | {
+    kind: 'idle';
+    sessionId: string;
+} | {
+    kind: 'error';
+    sessionId: string | null;
+    message: string;
+};
+/**
+ * Turns OpenCode's public SSE events into the small, stable event surface used
+ * by the Telegram bridge. State is intentionally kept here so reconnect and
+ * delta handling can be tested without starting a real server.
+ */
+export declare class OpencodeEventNormalizer {
+    private readonly roles;
+    private readonly textByPart;
+    private readonly sessionByMessage;
+    reset(): void;
+    accept(event: Event): OpencodeBridgeEvent[];
+    private normalizePart;
+    private clearSession;
+}
+export declare function formatOpencodeError(error: unknown): string;

package/dist/opencode/events.js

@@ -0,0 +1,145 @@
+/**
+ * Turns OpenCode's public SSE events into the small, stable event surface used
+ * by the Telegram bridge. State is intentionally kept here so reconnect and
+ * delta handling can be tested without starting a real server.
+ */
+export class OpencodeEventNormalizer {
+    roles = new Map();
+    textByPart = new Map();
+    sessionByMessage = new Map();
+    reset() {
+        this.roles.clear();
+        this.textByPart.clear();
+        this.sessionByMessage.clear();
+    }
+    accept(event) {
+        switch (event.type) {
+            case 'message.updated': {
+                this.roles.set(event.properties.info.id, event.properties.info.role);
+                this.sessionByMessage.set(event.properties.info.id, event.properties.info.sessionID);
+                return [];
+            }
+            case 'message.part.delta': {
+                if (event.properties.field !== 'text' || this.roles.get(event.properties.messageID) !== 'assistant') {
+                    return [];
+                }
+                const key = partKey(event.properties.messageID, event.properties.partID);
+                const text = `${this.textByPart.get(key) ?? ''}${event.properties.delta}`;
+                this.textByPart.set(key, text);
+                return [{
+                        kind: 'text',
+                        sessionId: event.properties.sessionID,
+                        messageId: event.properties.messageID,
+                        partId: event.properties.partID,
+                        text,
+                        delta: event.properties.delta,
+                    }];
+            }
+            case 'message.part.updated':
+                return this.normalizePart(event.properties.part);
+            case 'permission.asked':
+                return [{ kind: 'permission', request: event.properties }];
+            case 'permission.replied':
+                return [{
+                        kind: 'permissionResolved',
+                        sessionId: event.properties.sessionID,
+                        requestId: event.properties.requestID,
+                    }];
+            case 'question.asked':
+                return [{ kind: 'question', request: event.properties }];
+            case 'question.replied':
+            case 'question.rejected':
+                return [{
+                        kind: 'questionResolved',
+                        sessionId: event.properties.sessionID,
+                        requestId: event.properties.requestID,
+                    }];
+            case 'session.status':
+                if (event.properties.status.type === 'idle')
+                    this.clearSession(event.properties.sessionID);
+                return [{ kind: 'status', sessionId: event.properties.sessionID, status: event.properties.status }];
+            case 'session.idle':
+                this.clearSession(event.properties.sessionID);
+                return [{ kind: 'idle', sessionId: event.properties.sessionID }];
+            case 'session.error':
+                if (event.properties.sessionID)
+                    this.clearSession(event.properties.sessionID);
+                return [{
+                        kind: 'error',
+                        sessionId: event.properties.sessionID ?? null,
+                        message: formatOpencodeError(event.properties.error),
+                    }];
+            default:
+                return [];
+        }
+    }
+    normalizePart(part) {
+        if (part.type === 'text') {
+            if (this.roles.get(part.messageID) !== 'assistant')
+                return [];
+            const key = partKey(part.messageID, part.id);
+            const previous = this.textByPart.get(key) ?? '';
+            this.textByPart.set(key, part.text);
+            if (part.text === previous)
+                return [];
+            return [{
+                    kind: 'text',
+                    sessionId: part.sessionID,
+                    messageId: part.messageID,
+                    partId: part.id,
+                    text: part.text,
+                    delta: part.text.startsWith(previous) ? part.text.slice(previous.length) : null,
+                }];
+        }
+        if (part.type !== 'tool')
+            return [];
+        const state = part.state;
+        return [{
+                kind: 'tool',
+                sessionId: part.sessionID,
+                messageId: part.messageID,
+                partId: part.id,
+                callId: part.callID,
+                tool: part.tool,
+                status: state.status,
+                title: 'title' in state && typeof state.title === 'string' ? state.title : null,
+                error: state.status === 'error' ? state.error : null,
+            }];
+    }
+    clearSession(sessionId) {
+        for (const [messageId, owner] of this.sessionByMessage) {
+            if (owner !== sessionId)
+                continue;
+            this.sessionByMessage.delete(messageId);
+            this.roles.delete(messageId);
+            for (const key of this.textByPart.keys()) {
+                if (key.startsWith(`${messageId}:`))
+                    this.textByPart.delete(key);
+            }
+        }
+    }
+}
+function partKey(messageId, partId) {
+    return `${messageId}:${partId}`;
+}
+export function formatOpencodeError(error) {
+    if (!error)
+        return 'OpenCode session failed';
+    if (typeof error === 'string')
+        return error;
+    if (typeof error === 'object') {
+        const record = error;
+        if (typeof record.data?.message === 'string')
+            return record.data.message;
+        if (typeof record.message === 'string')
+            return record.message;
+        if (typeof record.name === 'string')
+            return record.name;
+    }
+    try {
+        return JSON.stringify(error);
+    }
+    catch {
+        return String(error);
+    }
+}

package/dist/opencode/runtime.d.ts

@@ -0,0 +1,14 @@
+import type { AppConfig } from '../config.js';
+import type { Logger } from '../logger.js';
+import type { BridgeStore } from '../store/database.js';
+import { OpencodeBridgeCore } from './controller.js';
+/** Keeps the optional OpenCode Telegram bot lifecycle out of the Codex runtime branches. */
+export declare class OpencodeTelegramRuntime {
+    private readonly bot;
+    private readonly app;
+    private readonly core;
+    constructor(config: AppConfig, store: BridgeStore, logger: Logger);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    getRuntimeStatus(): ReturnType<OpencodeBridgeCore['getRuntimeStatus']>;
+}

package/dist/opencode/runtime.js

@@ -0,0 +1,29 @@
+import { TelegramMessagingPort } from '../channels/telegram/telegram_messaging_port.js';
+import { getOpencodeTelegramCommands } from '../i18n.js';
+import { TelegramGateway } from '../telegram/gateway.js';
+import { OpencodeAppClient } from './client.js';
+import { OpencodeBridgeCore } from './controller.js';
+/** Keeps the optional OpenCode Telegram bot lifecycle out of the Codex runtime branches. */
+export class OpencodeTelegramRuntime {
+    bot;
+    app;
+    core;
+    constructor(config, store, logger) {
+        if (!config.opencodeBotToken)
+            throw new Error('OPENCODE_BOT_TOKEN is required for the OpenCode runtime');
+        this.bot = new TelegramGateway(config.opencodeBotToken, config.tgAllowedUserId, config.tgAllowedChatId, config.telegramPollIntervalMs, store, logger, true, getOpencodeTelegramCommands);
+        this.app = new OpencodeAppClient(config.opencodeCliBin, config.opencodeServerPassword, config.opencodeServerStatePath, config.opencodeServerLogPath, logger);
+        this.core = new OpencodeBridgeCore(config, store, logger, this.bot, this.app, new TelegramMessagingPort(this.bot));
+        this.core.registerInboundHandlers();
+    }
+    async start() {
+        await this.bot.initializeIdentity();
+        await this.core.start();
+    }
+    async stop() {
+        await this.core.stop();
+    }
+    getRuntimeStatus() {
+        return this.core.getRuntimeStatus();
+    }
+}

package/dist/store/database.d.ts

@@ -60,6 +60,7 @@ export declare class BridgeStore {
     } | null;
     getBinding(chatId: string): ThreadBinding | null;
     setBinding(chatId: string, threadId: string, cwd: string | null): void;
+    listBindings(): ThreadBinding[];
     clearBinding(chatId: string): void;
     getChatSettings(chatId: string): ChatSessionSettings | null;
     setChatSettings(chatId: string, model: string | null, reasoningEffort: ReasoningEffortValue | null, locale?: AppLocale | null): void;

package/dist/store/database.js

@@ -287,6 +287,15 @@ export class BridgeStore {
       ON CONFLICT(chat_id) DO UPDATE SET thread_id = excluded.thread_id, cwd = excluded.cwd, updated_at = excluded.updated_at
     `).run(chatId, threadId, cwd, Date.now());
     }
+    listBindings() {
+        const rows = this.db.prepare('SELECT chat_id, thread_id, cwd, updated_at FROM chat_bindings ORDER BY updated_at DESC').all();
+        return rows.map((row) => ({
+            chatId: String(row.chat_id),
+            threadId: String(row.thread_id),
+            cwd: row.cwd === null ? null : String(row.cwd),
+            updatedAt: Number(row.updated_at),
+        }));
+    }
     clearBinding(chatId) {
         this.db.prepare('DELETE FROM chat_bindings WHERE chat_id = ?').run(chatId);
     }

package/dist/telegram/gateway.d.ts

@@ -5,6 +5,10 @@ import type { Logger } from '../logger.js';
 import type { TelegramMessageEntity } from './addressing.js';
 import type { TelegramInboundAttachment } from './media.js';
 import type { TelegramInputRichMessage } from './rich.js';
+export type TelegramCommandProvider = (locale: 'en' | 'zh') => Array<{
+    command: string;
+    description: string;
+}>;
 export interface TelegramTextEvent {
     chatId: string;
     topicId: number | null;
@@ -45,11 +49,12 @@ export declare class TelegramGateway extends EventEmitter {
     private readonly store;
     private readonly logger;
     private readonly namespacedScopes;
+    private readonly commandProvider;
     private running;
     private botKey;
     private botUsername;
     private botUserId;
-    constructor(botToken: string, allowedUserId: string, allowedChatId: string | null, pollIntervalMs: number, store: BridgeStore, logger: Logger, namespacedScopes?: boolean);
+    constructor(botToken: string, allowedUserId: string, allowedChatId: string | null, pollIntervalMs: number, store: BridgeStore, logger: Logger, namespacedScopes?: boolean, commandProvider?: TelegramCommandProvider);
     get username(): string | null;
     get identity(): string | null;
     initializeIdentity(): Promise<string>;

package/dist/telegram/gateway.js

@@ -12,11 +12,12 @@ export class TelegramGateway extends EventEmitter {
     store;
     logger;
     namespacedScopes;
+    commandProvider;
     running = false;
     botKey;
     botUsername = null;
     botUserId = null;
-    constructor(botToken, allowedUserId, allowedChatId, pollIntervalMs, store, logger, namespacedScopes = false) {
+    constructor(botToken, allowedUserId, allowedChatId, pollIntervalMs, store, logger, namespacedScopes = false, commandProvider = getTelegramCommands) {
         super();
         this.botToken = botToken;
         this.allowedUserId = allowedUserId;
@@ -25,6 +26,7 @@ export class TelegramGateway extends EventEmitter {
         this.store = store;
         this.logger = logger;
         this.namespacedScopes = namespacedScopes;
+        this.commandProvider = commandProvider;
         this.botKey = `telegram:${crypto.createHash('sha256').update(this.botToken).digest('hex').slice(0, 8)}`;
     }
     get username() {
@@ -224,14 +226,14 @@ export class TelegramGateway extends EventEmitter {
     }
     async registerCommands() {
         await callTelegramApi(this.botToken, 'setMyCommands', {
-            commands: getTelegramCommands('zh'),
+            commands: this.commandProvider('zh'),
         });
         await callTelegramApi(this.botToken, 'setMyCommands', {
-            commands: getTelegramCommands('en'),
+            commands: this.commandProvider('en'),
             language_code: 'en',
         });
         await callTelegramApi(this.botToken, 'setMyCommands', {
-            commands: getTelegramCommands('zh'),
+            commands: this.commandProvider('zh'),
             language_code: 'zh',
         });
     }

package/dist/types.d.ts

@@ -11,7 +11,7 @@ export type SandboxModeValue = 'read-only' | 'workspace-write' | 'danger-full-ac
 export type AccessPresetValue = 'read-only' | 'default' | 'full-access';
 export type CollaborationModeValue = 'default' | 'plan';
 export type ActiveTurnMessageMode = 'steer' | 'queue';
-export type ReasoningEffortValue = 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
+export type ReasoningEffortValue = 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | 'ultra';
 export type ThreadStatusKind = 'active' | 'idle' | 'notLoaded' | 'systemError';
 export interface ChatSessionSettings {
     /** Bridge scope id (e.g. `telegram:…`). */

package/docs/cross-node-auth-sync.md

@@ -153,11 +153,11 @@ Auth sync test complete: sent 1, replies 1.
 
 If it shows `Missing replies: @peer_bot`, Telegram delivery may have succeeded, but the peer did not receive, decrypt, pass allowlist validation, or run the same auth sync configuration.
 
-The `/auth` panel also provides **Check all nodes and reconcile auth** (`/auth sync audit`). It asks every configured peer to validate every local candidate against the usage endpoint, then:
+The `/auth` panel's **Safe sync** action (`/auth sync safe`; `/auth sync audit` remains a compatibility alias) performs the complete all-node audit and reconciliation flow. It asks every configured peer to validate every local candidate against the usage endpoint, then:
 
 - selects the newest usage-validated copy for each same-name, same-account and same-user identity and distributes it to every peer;
 - allows a validated older copy to replace a newer timestamped copy only when the newer copy failed this explicit audit;
-- marks a candidate `?` only when every peer responded, no node has a valid copy, and at least two nodes independently reported it invalid;
+- sends a single-node invalid candidate through the encrypted channel for validation-only checks on other nodes, without importing it, and marks it `?` only when no valid result exists and at least two nodes independently report it invalid;
 - leaves candidates unchanged when any peer is missing or busy, or when account/user identities conflict;
 - refreshes enabled ChatGPT candidates whose `last_refresh` is at least 8 days old on the initiating node, then distributes the refreshed copies.
 

package/docs/user-manual.md

@@ -268,7 +268,7 @@ foxclaw send-media /absolute/path/output.mp4 "caption"
 It controls:
 
 - Model: server default, or a model returned by app-server.
-- Reasoning effort: for example `low`, `medium`, `high`, or `xhigh`, depending on model support.
+- Reasoning effort: for example `low`, `medium`, `high`, `xhigh`, `max`, or `ultra`, depending on model support.
 - Fast tier: available when supported by the selected model.
 - Access: `read-only`, `default`, or `full-access`.
 - Mode: `Agent` or `Plan`.
@@ -433,13 +433,13 @@ Quota remaining: window:percent|auth
 [✅ 20|25|personal] [✅]
 [🔐 —|—|team]       [✅]
 [☑️ All] [Enabled] [Attention]
-[🛡️ Access]             [🔑 Login]
-[🔄 Reload auth]
+[🔑 Login]
+[🩺 Safe sync]
 ```
 
 The right-side `✅` / `⏸️` button controls whether the candidate participates in auto-rotation. Tapping it toggles enabled/disabled, and the refreshed list shows the new state. Tapping a candidate switches auth, restarts that runtime, and refreshes the same panel with its buttons intact so you can switch again immediately. `--` means no quota snapshot has been observed for that candidate yet. Health summaries distinguish ready, low quota, quota exhausted, quota unknown, not recently refreshed, API key, invalid auth file, and needs login repair states.
 
-The **Check all nodes and reconcile auth** button asks every configured auth-sync peer to validate its candidates. FoxClaw adopts the newest valid copy, distributes it, marks an account `?` only after complete multi-node invalid consensus, and has the initiating node refresh enabled ChatGPT credentials last refreshed at least 8 days ago. Missing, busy, or identity-conflicting peers prevent invalid marking and stale refresh for that run.
+The **Safe sync** button asks every configured auth-sync peer to validate candidates, adopts the newest valid same-account copy, and distributes it. A candidate that exists on only one node is sent to other nodes for validation only, without being imported; it is marked `?` only when no node validates it and at least two nodes independently reject it. The initiating node also refreshes enabled ChatGPT credentials last refreshed at least 8 days ago. Missing, busy, or identity-conflicting peers prevent stale refresh for that run.
 
 When an auth candidate has already failed while in use and FoxClaw cannot recover a newer same-account credential from local mirror or cross-node sync, it is marked as `needs login repair`. These candidates are skipped by auto-rotation and proactive refresh, and are hidden from the `Enabled` filter. Their row shows a `?` action. Tapping it opens two choices: Login repair starts device-code login with that candidate selected; Delete removes the candidate from canonical storage and all local bot runtimes, and clears cached quota for it.
 
@@ -497,7 +497,7 @@ Commands:
 - `/auth sync events [filter]`: show recent sync event records, optionally filtered by candidate, peer, request id, kind, stage, or detail.
 - `/auth sync trace <requestId>`: show recent records for one request id or event id.
 - `/auth sync test`: send an encrypted ping and wait for peer pong replies to verify peer config, shared key, and Bot-to-Bot private messages.
-- `/auth sync audit`: run the same validate, reconcile, consensus, stale-refresh, and distribution flow as the `/auth` cluster-check button.
+- `/auth sync safe`: run the same all-node validation, reconciliation, invalid verification, stale-refresh, and distribution flow as the `/auth` Safe sync button. `/auth sync audit` remains a compatibility alias.
 - `/auth sync push all`: manually broadcast all locally verified candidates without refreshing tokens. “Sent” does not mean the peer imported files; check `/auth sync status` and `/auth` on the peer.
 
 Equivalent commands:

package/docs/zh/cross-node-auth-sync.md

@@ -153,11 +153,11 @@ auth sync 测试完成：已发送 1，收到回应 1。
 
 如果显示 `未回应：@peer_bot`，说明 Telegram 发送可能成功，但对方没有成功接收、解密、通过 allowlist，或没有运行同一组 auth sync 配置。
 
-`/auth` 面板还提供 **全节点自检并同步**（命令等价入口是 `/auth sync audit`）。它会让所有已配置 peer 用 usage 接口逐个验证本机候选，然后：
+`/auth` 面板的 **安全同步**（命令等价入口是 `/auth sync safe`，旧的 `/auth sync audit` 仍兼容）会执行完整的全节点自检与同步。它会让所有已配置 peer 用 usage 接口逐个验证本机候选，然后：
 
 - 对同名、同 account、同 ChatGPT 用户身份的候选，选择最新且验证有效的副本并分发给所有 peer；
 - 只有显式审计已经证明时间戳更晚的副本无效时，才允许经过验证的较旧有效副本替换它；
-- 仅当所有 peer 都回应、没有任何有效副本，且至少两个节点独立判定无效时，才把候选标为 `?`；
+- 对只存在于单个节点的无效候选，会通过加密通道交给其他节点做只验证、不导入的复核；没有任何有效结果且至少两个节点独立判定无效时，才把候选标为 `?`；
 - 任一 peer 未回应、忙碌或账号/用户身份冲突时，不做无效裁决；
 - 由发起节点刷新 `last_refresh` 已满 8 天的已启用 ChatGPT 候选，再把刷新结果分发给所有 peer。
 

package/docs/zh/user-manual.md

@@ -268,7 +268,7 @@ foxclaw send-media /absolute/path/output.mp4 "说明"
 它能配置：
 
 - 模型：使用服务端默认模型，或选择 app-server 返回的模型。
-- reasoning effort：例如 `low`、`medium`、`high`、`xhigh`，取决于模型支持情况。
+- reasoning effort：例如 `low`、`medium`、`high`、`xhigh`、`max` 或 `ultra`，取决于模型支持情况。
 - Fast tier：模型支持时可开关 fast 服务档。
 - Access：`read-only`、`default`、`full-access`。
 - Mode：`Agent` 或 `Plan`。
@@ -433,13 +433,13 @@ Candidates: 2
 [✅ 20|25|personal] [✅]
 [🔐 —|—|team]       [✅]
 [☑️ 全部] [已启用] [需关注]
-[🛡️ Access]             [🔑 设备登录]
-[🔄 Reload auth]
+[🔑 设备登录]
+[🩺 安全同步]
 ```
 
 右侧 `✅` / `⏸️` 表示当前是否参与自动轮转。点一下会切换启用/禁用，列表刷新后图标会随状态变化。点击候选会切换 auth、重启对应 runtime，并在原消息上刷新面板且保留按钮，因此可以立即连续切换。`--` 表示该候选还没有额度历史快照。健康摘要会区分正常、额度偏低、额度耗尽、额度未知、长期未刷新、API key、无效 auth 文件和需要登录修复。
 
-**全节点自检并同步** 按钮会通知所有已配置 auth-sync peer 验证本机候选。FoxClaw 会采用并分发最新有效副本；只有完整的多节点无效共识才会标记 `?`；`last_refresh` 已满 8 天的已启用 ChatGPT auth 由发起节点刷新后再分发。存在未回应、忙碌或身份冲突节点时，本轮不会做无效裁决和临期刷新。
+**安全同步** 按钮会通知所有已配置 auth-sync peer 验证候选，采用并分发同账号最新有效副本。只存在于一台机器的无效候选也会交给其他节点做只验证、不导入的复核；没有任何节点验证有效且至少两个节点独立确认无效后才标记 `?`。`last_refresh` 已满 8 天的已启用 ChatGPT auth 由发起节点刷新后再分发。存在未回应、忙碌或身份冲突节点时，本轮不会做临期刷新。
 
 当某个候选在实际使用中已经失败，并且 FoxClaw 无法从本机 mirror 或跨节点同步恢复同账号较新凭据时，会标为“需要登录修复”。这类候选不会参与自动轮转和后台主动刷新，也不会出现在“已启用”筛选里。它的按钮会显示 `?`。点击后有两个选择：`登录修复` 会在选中该候选的状态下启动设备码登录；`删除` 会从 canonical 和所有本机 bot runtime 中删除这个候选，并清理它的额度缓存。
 
@@ -497,7 +497,7 @@ AUTH_AUTO_DELETE_NEEDS_REPAIR=false
 - `/auth sync events [过滤]`：查看最近同步事件，可按候选名、peer、request id、事件类型、阶段或详情过滤。
 - `/auth sync trace <requestId>`：查看某个 request id 或事件 id 的最近流水。
 - `/auth sync test`：发送加密 ping 并等待 peer 返回 pong，确认 peer、共享密钥和 Bot-to-Bot 私聊可用。
-- `/auth sync audit`：执行与 `/auth` 面板“全节点自检并同步”按钮相同的验证、协商、无效共识、临期刷新和分发流程。
+- `/auth sync safe`：执行与 `/auth` 面板“安全同步”按钮相同的全节点验证、协商、无效复核、临期刷新和分发流程。`/auth sync audit` 保留为兼容别名。
 - `/auth sync push all`：手动广播当前节点已验证的全部候选，不刷新 token；“已发送”不等于对端已经导入，需要在 peer 上看 `/auth sync status` 和 `/auth`。
 
 命令等价用法：

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.5.77",
-  "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
+  "version": "0.6.3",
+  "description": "Foxden local execution claw for controlling Codex and OpenCode from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",
   "bin": {
@@ -55,6 +55,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
+    "@opencode-ai/sdk": "1.18.15",
     "dotenv": "^16.6.1",
     "qrcode-terminal": "^0.12.0"
   },