@jmanuelcorral/openteam 0.2.2 → 0.9.0

package/dist/web/configApi.d.ts

@@ -0,0 +1,154 @@
+import { type OpenTeamConfig } from "../config/schema";
+import type { StorageProvider } from "../storage/provider";
+/**
+ * Machine-specific key paths. Edits to these are routed to the ignored local
+ * overlay instead of the committed base, so saving in the console never pushes a
+ * value that would be wrong on a teammate's machine (P16, #197). `local.runtimes`
+ * is listed as the whole array because arrays replace wholesale on merge — the
+ * documented caveat is that overriding one runtime's `baseURL` restates the
+ * entire array.
+ */
+export declare const MACHINE_SPECIFIC_KEYS: readonly ["local.runtimes", "console.host", "console.port"];
+/**
+ * Keys the console process can serve fresh through a config getter WITHOUT a
+ * restart (P14 hybrid, hot half). Deliberately conservative: only
+ * `console.refreshMs` is read per-request by the renderer, so it is the one key
+ * the console genuinely applies live. Every other key is consumed by the
+ * opencode plugin session, which froze config at load and therefore needs a
+ * restart — reporting them as live would be the exact silent no-op the P14
+ * decision forbids.
+ */
+export declare const HOT_RELOADABLE_KEYS: readonly ["console.refreshMs"];
+/**
+ * Env-sourced secret descriptors (P8b). The value is NEVER read into any
+ * response — only its presence is reported, marked "set via environment".
+ */
+export declare const KNOWN_ENV_SECRETS: readonly [{
+    readonly key: "telemetry.connectionString";
+    readonly envVar: "APPLICATIONINSIGHTS_CONNECTION_STRING";
+    readonly label: "Application Insights connection string";
+}];
+export declare const SET_VIA_ENVIRONMENT: "set via environment";
+export declare function isMachineSpecificPath(path: string): boolean;
+export declare function isHotReloadablePath(path: string): boolean;
+/**
+ * Collect changed leaf paths comparing `next` against `prev`. Objects recurse;
+ * arrays and scalars are compared as a whole (the path stops at the array key),
+ * matching the merge semantics where arrays replace wholesale.
+ */
+export declare function diffConfigLeaves(prev: unknown, next: unknown, base?: string): string[];
+/** One audited config-write entry: the path plus a content-free descriptor. */
+export type ConfigAuditEntry = {
+    readonly path: string;
+    readonly valueHash?: string;
+    readonly chars?: number;
+    readonly value?: number | boolean | null;
+};
+export type ConfigAuditRecord = {
+    readonly ts: string;
+    readonly kind: "config.write";
+    readonly changed: readonly string[];
+    readonly entries: readonly ConfigAuditEntry[];
+    readonly wroteBase: boolean;
+    readonly wroteOverlay: boolean;
+};
+/**
+ * Describe a changed value for the audit trail WITHOUT leaking its content.
+ * Strings and structured values are stored as a hash plus character count;
+ * only non-string scalars (numbers, booleans, null) are recorded verbatim,
+ * because they can never carry a prompt body. This mirrors telemetry's stance:
+ * hash, never raw.
+ */
+export declare function auditValue(value: unknown): Omit<ConfigAuditEntry, "path">;
+/**
+ * Defensive scrub: replace any string that carries a known env-secret value with
+ * a redaction marker. The committed schema is already secret-free, so this never
+ * fires on a real config; it is belt-and-suspenders that guarantees a secret can
+ * never round-trip through the read endpoint even if one ever leaked into config.
+ */
+export declare function scrubSecretStrings(value: unknown, secrets: readonly string[]): unknown;
+export type ConfigSecretDescriptor = {
+    readonly key: string;
+    readonly source: typeof SET_VIA_ENVIRONMENT;
+    readonly set: boolean;
+};
+export type ConfigReadResult = {
+    readonly config: OpenTeamConfig;
+    readonly reload: {
+        readonly hotReloadable: readonly string[];
+        readonly restartRequired: readonly string[];
+    };
+    readonly overlay: {
+        readonly active: boolean;
+        readonly machineSpecificKeys: readonly string[];
+    };
+    readonly secrets: readonly ConfigSecretDescriptor[];
+};
+export type ConfigWriteResult = {
+    readonly status: 200;
+    readonly body: {
+        readonly ok: true;
+        readonly changed: readonly string[];
+        readonly applied: readonly string[];
+        readonly pendingRestart: readonly string[];
+        readonly wroteBase: boolean;
+        readonly wroteOverlay: boolean;
+    };
+} | {
+    readonly status: 400;
+    readonly body: {
+        readonly ok: false;
+        readonly error: string;
+    };
+};
+export type ConfigEditorPorts = {
+    storage: StorageProvider;
+    basePath?: string;
+    overlayPath?: string;
+    /** Reads an environment variable; injected so the read side is deterministic. */
+    env?: (name: string) => string | undefined;
+    /** Audit sink; every persisted write appends one content-free record. */
+    audit?: (record: ConfigAuditRecord) => void | Promise<void>;
+    /** Clock for the audit timestamp; injected for determinism. */
+    now?: () => string;
+    /**
+     * Fires after a write persists at least one change, so the composition root
+     * can reload the live config getter (P14 hybrid). Optional.
+     */
+    onPersisted?: () => void | Promise<void>;
+};
+/**
+ * Default machine-local audit log for console config writes. Content-free
+ * (paths + hashes, never a raw value) and git-ignored, so it never leaves the
+ * developer's machine and never lands in committed history.
+ */
+export declare const DEFAULT_CONFIG_AUDIT_PATH = ".opencode/openteam-local/config-audit.jsonl";
+/**
+ * The editor's editable surface (W7-S16 / #200). The console edits the openteam
+ * config object only. "System prompt" is the body of an agent Markdown file
+ * under `.opencode/agent/*.md`, not a config field; "harness" and "skills" have
+ * no openteam representation. The editor therefore mounts NO systemPrompt /
+ * harness / skills sub-tab, so it never claims to edit a field that does not
+ * exist.
+ */
+export type EditableArtifact = {
+    readonly id: string;
+    readonly kind: "openteam-config" | "agent-markdown";
+    readonly validated: boolean;
+    readonly mvp: boolean;
+};
+export declare function editableSurface(): readonly EditableArtifact[];
+export declare function createConfigEditor(ports: ConfigEditorPorts): {
+    editableSurface: typeof editableSurface;
+    read(): Promise<ConfigReadResult>;
+    write(submittedRaw: unknown): Promise<ConfigWriteResult>;
+};
+export type ConfigEditor = ReturnType<typeof createConfigEditor>;
+/**
+ * Restart-required top-level keys surfaced by the read endpoint. Behaviourally
+ * significant keys consumed by the opencode plugin session, which reads config
+ * once at load. Kept beside `HOT_RELOADABLE_KEYS` as the single classification
+ * source of truth (#193).
+ */
+export declare const RESTART_REQUIRED_KEYS: readonly ["baseline", "router", "local", "privacyMode", "graph", "orchestrator", "memory", "console.host", "console.port"];
+//# sourceMappingURL=configApi.d.ts.map

package/dist/web/configApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configApi.d.ts","sourceRoot":"","sources":["../../src/web/configApi.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA6B3D;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,YAChC,gBAAgB,EAChB,cAAc,EACd,cAAc,CACN,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,YAAI,mBAAmB,CAAU,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;aAE1B,GAAG,EAAE,4BAA4B;aACjC,MAAM,EAAE,uCAAuC;aAC/C,KAAK,EAAE,wCAAwC;EAEzC,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAC;AAElE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI3D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAwBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,OAAO,EACb,IAAI,SAAK,GACR,MAAM,EAAE,CAgBV;AA8BD,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAYzE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAwBT;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;KACjD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAClB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;KAChC,CAAC;CACH,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,CAAC;AAEN,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC3C,yEAAyE;IACzE,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,gDACS,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,eAAe,IAAI,SAAS,gBAAgB,EAAE,CAS7D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB;;YAgCzC,OAAO,CAAC,gBAAgB,CAAC;wBA6Bb,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;EA8FjE;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,YAChC,UAAU,EACV,QAAQ,EACR,OAAO,EACP,aAAa,EACb,OAAO,EACP,cAAc,EACd,QAAQ,EACR,cAAc,EACd,cAAc,CACN,CAAC"}

package/dist/web/configRoute.d.ts

@@ -0,0 +1,57 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { ConfigEditor } from "./configApi";
+/**
+ * HTTP routes for the console config editor: `GET /api/config` (read, redacted)
+ * and `POST /api/config` (write, validated). Both require the per-launch
+ * ephemeral token — config is more sensitive than the read-only dashboard, so it
+ * is token-gated even on pure loopback (a strict hardening, never a relaxation).
+ *
+ * Mutations are additionally CSRF-safe (W7-S06 / #190): the token is accepted
+ * ONLY in the `Authorization: Bearer` header (never `?token=`), cross-origin
+ * requests are rejected by `Origin`/`Sec-Fetch-Site`, and no ambient cookie auth
+ * exists. The surface is loopback-only (W7-S07 / #191): `console.host` cannot
+ * widen past `ConsoleHostSchema`, enforced by the write validator.
+ */
+export type ConfigRouteDeps = {
+    token: string;
+    editor: Pick<ConfigEditor, "read" | "write">;
+};
+/**
+ * A mutation is CSRF-safe only when it is same-origin. Any `Origin` whose host
+ * is not loopback is cross-origin and rejected. A missing `Origin`
+ * (same-origin navigations, non-browser clients) is allowed, but the bearer
+ * token is still required separately.
+ */
+export declare function isCrossOriginMutation(request: IncomingMessage): boolean;
+/**
+ * Routes `/api/config`. Returns `true` when it handled (and answered) the
+ * request, `false` so the server continues with its other routes.
+ */
+export declare function handleConfigRoute(request: IncomingMessage, response: ServerResponse, url: URL, deps: ConfigRouteDeps): Promise<boolean>;
+/** A synthetic or real opencode watcher event, narrowed to the fields we read. */
+export type ConfigChangeEvent = {
+    readonly type?: string;
+    readonly properties?: {
+        readonly event?: string;
+        readonly file?: string;
+    };
+};
+/**
+ * P14 hybrid reload (hot half). Holds a mutable config reference behind a getter
+ * and re-runs `load` when a `file.watcher.updated` `change` event names the
+ * config path. The console renderer consults `current()` per request, so a
+ * hot-reloadable key (`console.refreshMs`) is served fresh WITHOUT a restart; the
+ * `file.watcher.updated` firing for an external write is verified at integration
+ * time (it needs a live opencode process), with `watchSources` on the config
+ * path as the deterministic fallback.
+ */
+export declare function createConfigReloader<T>(deps: {
+    initial: T;
+    load: () => Promise<T>;
+    configPath: string;
+}): {
+    current: () => T;
+    reload: () => Promise<T>;
+    handleEvent: (event: ConfigChangeEvent) => Promise<boolean>;
+};
+//# sourceMappingURL=configRoute.d.ts.map

package/dist/web/configRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configRoute.d.ts","sourceRoot":"","sources":["../../src/web/configRoute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;CAC9C,CAAC;AA0CF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAcvE;AAiCD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,CAAC,CAmElB;AAED,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE;IAC5C,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG;IACF,OAAO,EAAE,MAAM,CAAC,CAAC;IACjB,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D,CAwBA"}

package/dist/web/console.d.ts

@@ -18,6 +18,14 @@ export type ConsoleRouteDeps = {
     drilldownEnabled?: boolean;
     /** Habilita la vista "Terminal" (PTY real, Fase 5). Opt-in. */
     ptyEnabled?: boolean;
+    /**
+     * Habilita el **modo diagnóstico local** (P11b): opt-in del operador para que
+     * las rutas de lectura (`stream`, `messages`) puedan servir texto verbatim en
+     * lugar de la referencia redactada por defecto. Requiere además `?diagnostic=1`
+     * en la petición. Off por defecto: sin esta bandera el contenido va redactado
+     * aunque la petición pida diagnóstico. Nunca debilita el token ni el loopback.
+     */
+    diagnosticEnabled?: boolean;
     /** Resuelve el origen del servidor opencode de una sesión (o `undefined`). */
     resolveEndpoint: (sessionID: string) => Promise<string | undefined>;
     /** Crea un cliente opencode para un endpoint (inyectable en tests). */

package/dist/web/console.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../src/web/console.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpE,uEAAuE;IACvE,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC;IAClD,mEAAmE;IACnE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC;CACnD,CAAC;AA4OF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,OAAO,CAAC,CAqDlB"}
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../src/web/console.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpE,uEAAuE;IACvE,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC;IAClD,mEAAmE;IACnE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC;CACnD,CAAC;AAiPF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,OAAO,CAAC,CA4DlB"}

package/dist/web/paths.d.ts

@@ -1,4 +1,5 @@
-/** Rutas por defecto de las fuentes que alimentan el console. */
-export declare const DEFAULT_BACKLOG_PATH = ".opencode/openteam-backlog.md";
-export declare const DEFAULT_DECISIONS_PATH = ".opencode/openteam-decisions.md";
+/** Rutas por defecto de las fuentes que alimentan el console.
+ * Portable team-state (P15b): committed under `.opencode/openteam/`. */
+export declare const DEFAULT_BACKLOG_PATH = ".opencode/openteam/backlog.md";
+export declare const DEFAULT_DECISIONS_PATH = ".opencode/openteam/decisions.md";
 //# sourceMappingURL=paths.d.ts.map

package/dist/web/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/web/paths.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,kCAAkC,CAAC;AACpE,eAAO,MAAM,sBAAsB,oCAAoC,CAAC"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/web/paths.ts"],"names":[],"mappings":"AAAA;wEACwE;AACxE,eAAO,MAAM,oBAAoB,kCAAkC,CAAC;AACpE,eAAO,MAAM,sBAAsB,oCAAoC,CAAC"}

package/dist/web/server.d.ts

@@ -4,11 +4,24 @@ import type { ConsoleClient } from "../console/opencodeClient";
 import type { PtyClient } from "../console/pty";
 import type { ConsoleInputs } from "../console/state";
 import type { GraphViewProjectionV1 } from "../telemetry/graphView";
+import { type ConfigRouteDeps } from "./configRoute";
 import { type StorageRouteDeps } from "./storageRoute";
 export type ConsoleServerDeps = {
     /** Relee las fuentes y produce los inputs crudos del console. */
     readSnapshot: () => Promise<ConsoleInputs>;
     config: ConsoleConfig;
+    /**
+     * Live console-config getter (P14 hybrid, hot half). When provided, the
+     * renderer reads hot-reloadable presentation keys (`console.refreshMs`) from
+     * this getter instead of the frozen `config`, so a reloaded value is served
+     * fresh without a restart. Absent → behaviour is identical to today.
+     */
+    getConsoleConfig?: () => ConsoleConfig;
+    /**
+     * Config editor surface (`/api/config`, read + write). Opt-in: without it the
+     * console exposes no config endpoint. Token-gated even on loopback.
+     */
+    configApi?: ConfigRouteDeps;
     /** Inyectable para tests; por defecto el `createServer` de `node:http`. */
     createServer?: typeof createHttpServer;
     /** Logger (por defecto `console`). */
@@ -26,12 +39,18 @@ export type ConsoleServerDeps = {
         drilldownEnabled?: boolean;
         /** Habilita la vista "Terminal" (PTY real, Fase 5). Opt-in. */
         ptyEnabled?: boolean;
+        /**
+         * Habilita el **modo diagnóstico local** (P11b): opt-in del operador para que
+         * el drill-down sirva texto verbatim en vez de la referencia redactada por
+         * defecto (requiere además `?diagnostic=1` en la petición). Off por defecto.
+         */
+        diagnosticEnabled?: boolean;
         createClient: (endpoint: string) => ConsoleClient;
         createPtyClient?: (endpoint: string) => PtyClient;
     };
     /**
      * Endpoint remoto de storage (`/storage/*`). Opcional y opt-in: expone el
-     * estado del equipo autenticado con token para una Console remota vía tunnel.
+     * estado del equipo autenticado con token para una Console remota.
      */
     storageApi?: StorageRouteDeps;
     /**
@@ -43,6 +62,16 @@ export type ConsoleServerDeps = {
     graphApi?: {
         readView: () => Promise<GraphViewProjectionV1 | null>;
     };
+    /**
+     * `true` when the operator enabled the console agent-tree view
+     * (`console.graphView.enabled`) but the graph engine is off (`graph.mode` ==
+     * "off"), so no `graphApi` provider is wired. The shell still mounts the
+     * agent-tree tab and renders the `graph.mode` remediation hint instead of a
+     * bare-missing tab (PRD W7 acceptance #9). `/api/graph` and the SSE `graph`
+     * frame stay absent because they follow `graphApi`. Absent/`false` → behaviour
+     * is identical to today.
+     */
+    graphDisabled?: boolean;
 };
 export type ConsoleServer = {
     url: string;

package/dist/web/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,IAAI,gBAAgB,EAIjC,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAOpE,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAW3E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,iEAAiE;IACjE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,aAAa,CAAC;IACtB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACvC,sCAAsC;IACtC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,8EAA8E;IAC9E,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,eAAe,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,+DAA+D;QAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC;QAClD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC;KACnD,CAAC;IACF;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;KACvD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AA2FF;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,aAAa,CAAC,CA2LxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,IAAI,gBAAgB,EAIjC,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,KAAK,eAAe,EAAqB,MAAM,eAAe,CAAC;AAOxE,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAW3E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,iEAAiE;IACjE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,aAAa,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACvC,sCAAsC;IACtC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,8EAA8E;IAC9E,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,eAAe,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,+DAA+D;QAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC;QAClD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC;KACnD,CAAC;IACF;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;KACvD,CAAC;IACF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAuGF;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,aAAa,CAAC,CAsMxB"}

package/dist/web/start.d.ts

@@ -9,6 +9,21 @@ import type { GraphViewProjectionV1 } from "../telemetry/graphView";
 import type { StorageRouteDeps } from "./storageRoute";
 export type ConsoleRuntimeDeps = {
     config: ConsoleConfig;
+    /**
+     * Live console-config getter (P14 hybrid). Passed through to the server so the
+     * renderer serves hot-reloadable keys fresh. Optional.
+     */
+    getConsoleConfig?: () => ConsoleConfig;
+    /**
+     * Config editor surface (`/api/config`). Optional and opt-in.
+     */
+    configApi?: import("./configRoute").ConfigRouteDeps;
+    /**
+     * Path of the tracked config file. When provided it is added to the watched
+     * set so an external edit triggers a debounced console refresh (P14 hybrid,
+     * cross-process fallback). Optional.
+     */
+    configPath?: string;
     /** Directorio de logs de sesión (`sessions/*.jsonl`). */
     sessionsDir: string;
     agentDir: string;

package/dist/web/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/web/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAIpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,sEAAsE;IACtE,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC;QAClD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC;KACnD,CAAC;IACF,oEAAoE;IACpE,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;KACvD,CAAC;IACF,8BAA8B;IAC9B,KAAK,CAAC,EAAE,cAAc,UAAU,EAAE,mBAAmB,CAAC;IACtD,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IAC3E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,CAAC,CAEzB"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/web/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAIpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,aAAa,CAAC;IACvC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,eAAe,EAAE,eAAe,CAAC;IACpD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,sEAAsE;IACtE,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC;QAClD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC;KACnD,CAAC;IACF,oEAAoE;IACpE,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;KACvD,CAAC;IACF,8BAA8B;IAC9B,KAAK,CAAC,EAAE,cAAc,UAAU,EAAE,mBAAmB,CAAC;IACtD,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IAC3E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,CAAC,CAEzB"}

package/dist/web/storageRoute.d.ts

@@ -2,8 +2,8 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { StorageProvider } from "../storage/provider";
 /**
  * Endpoint HTTP que expone un `StorageProvider` sobre la red (§ Fase 4). Permite
- * que una Console/sesión remota lea el estado del equipo a través del tunnel ya
- * existente, reutilizando el token efímero de la Console.
+ * que una Console/sesión remota lea el estado del equipo por HTTP,
+ * reutilizando el token efímero de la Console.
  *
  * Seguridad:
  * - Exige el token (bearer `Authorization` o `?token=`), como el resto de la

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jmanuelcorral/openteam",
-  "version": "0.2.2",
+  "version": "0.9.0",
   "packageManager": "bun@1.3.14",
   "description": "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
   "license": "MIT",
@@ -60,14 +60,14 @@
   "scripts": {
     "prebuild": "bun run clean",
     "build": "bun run build:js && bun run build:cli && bun run build:types",
-    "build:js": "bun build ./src/index.ts --target=node --format=esm --outfile=dist/index.js --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod",
-    "build:cli": "bun build ./src/cli.ts --target=node --format=esm --outfile=dist/cli.js --banner \"#!/usr/bin/env node\" --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @clack/prompts",
+    "build:js": "bun build ./src/index.ts --target=node --format=esm --outfile=dist/index.js --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph",
+    "build:cli": "bun build ./src/cli.ts --target=node --format=esm --outfile=dist/cli.js --banner \"#!/usr/bin/env node\" --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @clack/prompts --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph",
     "build:types": "tsc -p tsconfig.build.json",
     "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
     "test": "bun test",
     "test:cov": "bun test --coverage",
-    "certify:shadow": "bun test tests/certification/graph-shadow.test.ts",
-    "certify:release": "bun test tests/certification/graph-release.test.ts",
+    "certify:shadow": "bun run scripts/certify-artifact.ts shadow",
+    "certify:release": "bun run scripts/certify-artifact.ts release",
     "coverage:check": "node scripts/check-coverage.mjs",
     "typecheck": "tsc --noEmit",
     "lint": "biome check .",
@@ -82,8 +82,14 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@opencode-ai/plugin": "1.18.18",
-    "@opencode-ai/sdk": "1.18.18",
+    "@langchain/core": "1.2.9",
+    "@langchain/langgraph": "1.4.12",
+    "@opencode-ai/plugin": "1.18.19",
+    "@opencode-ai/sdk": "1.18.19",
+    "@opentelemetry/api": "1.9.1",
+    "@opentelemetry/exporter-trace-otlp-http": "0.221.0",
+    "@opentelemetry/resources": "2.10.0",
+    "@opentelemetry/sdk-trace-base": "2.10.0",
     "zod": "4.4.3"
   },
   "devDependencies": {

package/dist/cli/tunnel.d.ts

@@ -1,89 +0,0 @@
-import type { EventEmitter } from "node:events";
-/**
- * Comando `openteam tunnel`: expone la Console (y, opcionalmente, el servidor
- * opencode para terminal remota) vía Microsoft Dev Tunnels. El **núcleo es puro**
- * (parseo de flags, parseo de stdout de devtunnel, plan de seguridad §7); el
- * runner solo orquesta el proceso y espera la señal de parada. Sin secretos en
- * logs: passwords y tokens nunca se imprimen.
- */
-export type TunnelOptions = {
-    /** Expone también el puerto de opencode (terminal remota). Requiere password. */
-    terminal: boolean;
-    /** Túnel anónimo (sin auth). Requiere `--yes` (doble confirmación). */
-    allowAnonymous: boolean;
-    /** Confirmación explícita para operaciones peligrosas (túnel anónimo). */
-    yes: boolean;
-    /** Override del puerto de la Console. */
-    consolePort?: number;
-    /** Override del puerto de opencode. */
-    opencodePort?: number;
-};
-/** Parsea los flags de `openteam tunnel`. Determinista. Pure. */
-export declare function parseTunnelArgs(rest: readonly string[]): TunnelOptions;
-export type TunnelUrl = {
-    port: number;
-    url: string;
-};
-/**
- * Extrae las URLs públicas del stdout de `devtunnel host` (no tiene `--json`).
- * Reconoce la línea `Hosting port <p> at <url>`. Determinista. Pure.
- */
-export declare function parseDevtunnelUrls(stdout: string): TunnelUrl[];
-export type TunnelPlan = {
-    /** Puertos a hospedar (siempre incluye la Console). */
-    ports: number[];
-    /** `true` si el puerto de opencode se expone (terminal remota disponible). */
-    exposeTerminal: boolean;
-    /** `true` si el túnel es anónimo (sin auth). */
-    allowAnonymous: boolean;
-    /** Avisos no bloqueantes a mostrar al usuario. */
-    warnings: string[];
-    /** Errores bloqueantes; si hay alguno, `ok` es `false`. */
-    errors: string[];
-    ok: boolean;
-};
-export type TunnelPlanInput = {
-    options: TunnelOptions;
-    consolePort: number;
-    opencodePort: number;
-    hasServerPassword: boolean;
-};
-/**
- * Decide el plan del túnel aplicando el gating de seguridad §7 del PRD:
- * loopback→túnel autenticado por defecto, password obligatoria para terminal
- * remota, doble confirmación para túnel anónimo. Determinista. Pure.
- */
-export declare function planTunnel(input: TunnelPlanInput): TunnelPlan;
-/** Construye los argumentos de `devtunnel host` para el plan dado. Pure. */
-export declare function buildDevtunnelArgs(plan: TunnelPlan): string[];
-/** Proceso hijo mínimo que necesita el runner (subconjunto de `ChildProcess`). */
-export type TunnelChild = {
-    stdout: EventEmitter | null;
-    stderr: EventEmitter | null;
-    on: (event: "exit", cb: (code: number | null) => void) => void;
-    kill: () => void;
-};
-export type TunnelRunDeps = {
-    /** `true` si el CLI `devtunnel` está instalado. */
-    isInstalled: () => Promise<boolean>;
-    /** `true` si hay sesión iniciada en Dev Tunnels. */
-    isLoggedIn: () => Promise<boolean>;
-    /** Lanza `devtunnel` con los args dados. */
-    spawn: (command: string, args: string[]) => TunnelChild;
-    consolePort: number;
-    opencodePort: number;
-    hasServerPassword: boolean;
-    /** Espera hasta que el usuario para el proceso (Ctrl+C). */
-    waitForSignal: () => Promise<void>;
-    log: (message: string) => void;
-};
-export type TunnelRunResult = {
-    exitCode: number;
-};
-/**
- * `openteam tunnel`: comprueba `devtunnel` (instalado + login), aplica el plan de
- * seguridad, hospeda los puertos y muestra las URLs públicas hasta Ctrl+C. Solo
- * imprime URLs y avisos redactados; nunca password ni tokens.
- */
-export declare function runTunnel(deps: TunnelRunDeps, options: TunnelOptions): Promise<TunnelRunResult>;
-//# sourceMappingURL=tunnel.d.ts.map

package/dist/cli/tunnel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/cli/tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;GAMG;AAEH,MAAM,MAAM,aAAa,GAAG;IAC1B,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,cAAc,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,GAAG,EAAE,OAAO,CAAC;IACb,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAUF,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAoBtE;AAED,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CAgB9D;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,uDAAuD;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8EAA8E;IAC9E,cAAc,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,cAAc,EAAE,OAAO,CAAC;IACxB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CA2C7D;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAS7D;AAED,kFAAkF;AAClF,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,KAAK,IAAI,CAAC;IAC/D,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,mDAAmD;IACnD,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,oDAAoD;IACpD,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,4CAA4C;IAC5C,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,WAAW,CAAC;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,eAAe,CAAC,CAkD1B"}

package/dist/commands/orchestratorAgent.d.ts

@@ -1,30 +0,0 @@
-import type { FrontierChoice } from "./setup";
-/**
- * Ruta relativa (al cwd) del agente primario que `openteam setup` genera. El
- * nombre del fichero (`openteam`) es el nombre del agente en opencode.
- */
-export declare const ORCHESTRATOR_AGENT_PATH = ".opencode/agent/openteam.md";
-/**
- * Ruta del registro de casting (universo + tabla nombre→rol→modelo). Vive
- * **fuera** de `.opencode/agent/` a propósito: opencode carga como agente cada
- * `.md` de esa carpeta, así que un `roster.md` dentro aparecería como un agente
- * fantasma en el Tab-switcher. Lo guardamos junto al log de decisiones del
- * `scribe`, como fichero de datos del proyecto.
- */
-export declare const OPENTEAM_ROSTER_PATH = ".opencode/openteam-roster.md";
-/**
- * Construye el Markdown del agente primario `openteam` (orquestador multiagente):
- * un
- * orquestador que aparece en el Tab-switcher, elige un universo temático y
- * castea al equipo, y crea los subagentes a demanda (incluidos los roles
- * estándar scribe, ralph y guardian). Pure: no I/O.
- *
- * `frontier` fija el `model` del orquestador (baseline cheapest-capable), un
- * `provider/model` real y resoluble; el plugin de openteam sigue enrutando por
- * mensaje, así que los subagentes que cree pueden heredar el default y ser
- * enrutados local-first.
- */
-export declare function buildOrchestratorAgent(frontier: FrontierChoice, options?: {
-    yolo?: boolean;
-}): string;
-//# sourceMappingURL=orchestratorAgent.d.ts.map

package/dist/commands/orchestratorAgent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"orchestratorAgent.d.ts","sourceRoot":"","sources":["../../src/commands/orchestratorAgent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,MAAM,CAiOR"}

package/dist/commands/slashCommand.d.ts

@@ -1,39 +0,0 @@
-/**
- * Directorio (relativo al cwd) donde opencode descubre los slash commands del
- * proyecto. opencode escanea `{command,commands}/**\/*.md` (singular y plural) en
- * cada `.opencode/` del árbol y en `~/.config/opencode/`; el nombre del fichero
- * es el nombre del comando (verificado en el source de opencode v1.17.8:
- * `packages/opencode/src/config/command.ts`).
- */
-export declare const OPENTEAM_COMMAND_DIR = ".opencode/command";
-/**
- * Ruta del slash command principal `/openteam` (catch-all). Se mantiene como
- * constante estable para compatibilidad; el resto de comandos derivan de
- * {@link OPENTEAM_COMMAND_DIR}.
- */
-export declare const OPENTEAM_COMMAND_PATH = ".opencode/command/openteam.md";
-/** Un slash command listo para escribir en disco. */
-export type SlashCommandFile = {
-    /** Nombre del comando (fichero `<name>.md`), invocable como `/<name>`. */
-    name: string;
-    /** Ruta relativa al cwd del fichero markdown. */
-    path: string;
-    /** Contenido markdown (frontmatter + template). */
-    contents: string;
-};
-/**
- * Construye el Markdown del slash command `/openteam` (catch-all). Enseña al
- * agente a mapear los argumentos del usuario a una única llamada de la
- * herramienta `openteam`. Debe mantenerse alineado con las acciones de
- * `commandArgv` en `src/plugin/commandTool.ts`. Pure/determinista: sin I/O.
- */
-export declare function buildOpenteamCommand(): string;
-/**
- * Todos los slash commands que `openteam setup` escribe en
- * `.opencode/command/`. Además del catch-all `/openteam`, genera un comando
- * plano por acción (`/openteam-doctor`, `/openteam-agents`, …) para que todos
- * aparezcan y se autocompleten en la paleta de opencode al teclear `/openteam`.
- * Pure/determinista: sin I/O.
- */
-export declare function buildOpenteamCommands(): SlashCommandFile[];
-//# sourceMappingURL=slashCommand.d.ts.map

package/dist/commands/slashCommand.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"slashCommand.d.ts","sourceRoot":"","sources":["../../src/commands/slashCommand.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,kCAAwC,CAAC;AAE3E,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAkBF;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAmB7C;AAqBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,EAAE,CAuC1D"}

package/dist/orchestrator/ledger.d.ts

@@ -1,28 +0,0 @@
-/**
- * Tipos y reducción del ledger de progreso legacy.
- *
- * El ledger legacy (`progress.md`) registra, una línea por tarea, el desenlace
- * terminal de las tareas ya procesadas. Su **autoridad** fue retirada (R7): ya
- * no se lee ni se escribe como fuente de verdad. Lo que sobrevive es el modelo
- * de datos (`LedgerEntry` / `LedgerStatus`) y la reducción pura `latestStatuses`,
- * que la **importación terminal** a la autoridad de Graph
- * (`storage/graph/importLegacy.ts`) usa para colapsar entradas repetidas al
- * último estado por `taskID`. El parseo del texto legacy vive ahora inline en el
- * importador/migración, no aquí.
- *
- * Es **privacy-safe**: solo `taskID`, estado y un `detail` ya redactado; nunca
- * prompts ni datos sensibles.
- */
-export type LedgerStatus = "complete" | "failed";
-export type LedgerEntry = {
-    taskID: string;
-    status: LedgerStatus;
-    /** Metadatos redactados (modelo, tier, resultado de review). Nunca prompts. */
-    detail?: string;
-};
-/**
- * Estado más reciente por `taskID` (las líneas posteriores sobrescriben a las
- * anteriores: un `failed` seguido de `complete` cuenta como `complete`). Puro.
- */
-export declare function latestStatuses(entries: readonly LedgerEntry[]): Map<string, LedgerStatus>;
-//# sourceMappingURL=ledger.d.ts.map

package/dist/orchestrator/ledger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/orchestrator/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEjD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,WAAW,EAAE,GAC9B,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAM3B"}