@jskit-ai/assistant-core 0.1.213 → 0.1.214

package/test/opencodeConversationSession.test.js

@@ -230,7 +230,7 @@ async function fixture(t, options = {}) {
       connections: { resolve: options.resolve || (async () => ({ providerId: "test", model: "test-model", sdkPackage: "@ai-sdk/openai-compatible",
         modelLimits: { context: 32000, output: 4000 }, apiKey: key })) },
       host: { workdir: directory, env: { ...process.env, UNRELATED_SECRET: "must-not-inherit" },
-        commands: { opencode: command }, execution: options.execution, nativeTools: options.nativeTools, commandWrapper: options.commandWrapper },
+        commands: { opencode: command }, execution: options.execution, nativeTools: options.nativeTools, commandWrapper: options.commandWrapper, opencode: options.opencode },
       limits: { admissionTimeoutMs: 250, ...options.limits } });
     runtimes.push(value);
     return value;
@@ -242,7 +242,7 @@ async function fixture(t, options = {}) {
       connections: { resolve: options.resolve || (async () => ({ providerId: "test", model: "test-model", sdkPackage: "@ai-sdk/openai-compatible",
         modelLimits: { context: 32000, output: 4000 }, apiKey: key })) },
       host: { workdir: directory, env: { ...process.env, UNRELATED_SECRET: "must-not-inherit" },
-        commands: { opencode: command }, execution: options.execution, nativeTools: options.nativeTools, commandWrapper: options.commandWrapper },
+        commands: { opencode: command }, execution: options.execution, nativeTools: options.nativeTools, commandWrapper: options.commandWrapper, opencode: options.opencode },
       limits: { admissionTimeoutMs: 250, ...options.limits }
     },
     binding: () => storage.read("conversation", async tx => (await tx.readMetadata()).runtime.binding),
@@ -1056,7 +1056,7 @@ for (const savedStatus of ["cancelled", "failed", "unknown-tool", "interrupted"]
 
 // Opt-in bound host uses the same native server, registry and Send/monitor owner.
 // The original standalone fixture above remains byte-for-byte unchanged.
-async function boundToolFixture(t) {
+async function boundToolFixture(t, { runInContext, monitorRunInContext, monitorContext } = {}) {
   const { createOpenCodeConversationServer, openCodeApplicationToolSchemas } = await import("../src/server/conversation/openCodeProcess.js");
   const { createOpenCodeSharedRuntime, ensureOpenCodeSession } = await import("../src/server/conversation/openCodeRuntime.js");
   const { observeOpenCodeEvents } = await import("../src/server/conversation/openCodeTurn.js");
@@ -1086,7 +1086,7 @@ async function boundToolFixture(t) {
     const driver = createOpenCodeConversationDriver(f.driverOptions);
     const handle = await driver.open({ onFailure() {}, conversation: {
       publish() {}, native: { owner,
-        acquire: async context => ({ key, options: context || {} }),
+        acquire: async context => ({ key, options: context || {}, runInContext }),
         preparation: {
           cleanup: () => ({ sessionId: id, options: {}, application: {
             closeTerminals: async () => ({ ok: true }), beforeRelease: async () => {},
@@ -1120,12 +1120,16 @@ async function boundToolFixture(t) {
                 prompt: { text: input.message }, beforeDispatch: threadId => input.onPromptSending({ threadId }) }),
               commit: async admitted => { const turn = { turnId: input.messageId, messages: [{ role: "user", messageId: input.messageId, text: input.message }] }; receipts.push({ admitted, turn }); return turn; },
               monitor: {
+                runInContext: monitorRunInContext,
                 prepare: () => ({ fields: {} }),
                 create(target, turn, _metadata, options) { return {
                   observe: (_turn, signal) => observeOpenCodeEvents(target.server.client, target.upstreamSessionId,
                     { signal, abortController: turn.abortController, eventStartedAt: turn.eventStartedAt }),
                   eventReady: options.eventReady, finalResponse: { agent: "jskit-assistant-actions", model: { id: "test-model", providerID: "test" }, recoveryMessageId: `msg_recovery_${nativeId}` },
-                  async writeRun() {}, projectMessages: () => ({ failure: "", providerApiFailure: false }), completeResult: (_turn, result) => result.failure, onRetired() {}
+                  async writeRun() { await monitorContext?.("writeRun"); },
+                  async projectMessages() { await monitorContext?.("projectMessages"); return { failure: "", providerApiFailure: false }; },
+                  completeResult: (_turn, result) => result.failure,
+                  onRetired() { monitorContext?.("onRetired"); }
                 }; }
               }
             }, project: value => value };
@@ -1340,3 +1344,631 @@ test("opted bound OpenCode does not abort newer same-turn input when an already
     await peer.handle.cancel(); await waiting.completion;
   }
 });
+
+// Observe the original standalone HTTP/plugin fixture and its canonical writer.
+// Completed rows always come from the native prompt handler, never a seeded turn.
+const completedOpenCodeValue = { kind: "tool", text: "Checking.", toolName: "numbers_read", arguments: "{}" };
+const completedOpenCodeSchema = { type: "object", additionalProperties: false,
+  required: ["kind", "text", "toolName", "arguments"],
+  properties: { kind: { type: "string", enum: ["reply", "tool"] }, text: { type: "string", maxLength: 64 },
+    toolName: { type: "string", maxLength: 64 }, arguments: { type: "string", maxLength: 64 } } };
+async function completedOpenCodeFixture(t, options = {}) {
+  const context = { actor: { id: "owner" }, surface: "app", permissions: ["numbers.read"] };
+  let effects = 0;
+  let accountResolutions = 0;
+  const appendedRows = [];
+  const actions = applicationActions(async () => { effects++; return { value: 42 }; });
+  const f = await fixture(t, { ...options, context, actions,
+    assistantResponses: options.assistantResponses || [{ text: JSON.stringify(completedOpenCodeValue) }],
+    configuration: { ...configuration, outputSchema: completedOpenCodeSchema, ...options.configuration } });
+  await f.first.close();
+  const storage = { ...f.storage,
+    write: (id, callback) => f.storage.write(id, transaction => callback({ ...transaction,
+      async appendMessage(turnId, message) {
+        await transaction.appendMessage(turnId, message);
+        if (message.role === "system" && message.origin === "application") {
+          appendedRows.push(structuredClone(await transaction.readTurn(turnId)));
+        }
+      }
+    })) };
+  let runtime;
+  let conversation;
+  async function close() {
+    if (runtime) { await runtime.close(); runtime = null; }
+  }
+  async function reopen() {
+    await close();
+    runtime = createConversationRuntime({ engine: "opencode", storage, actions, authorize: () => true,
+      completedEnvelope: true, ...f.driverOptions,
+      connections: { resolve: async input => { accountResolutions++; return f.driverOptions.connections.resolve(input); } } });
+    try { conversation = await runtime.open({ id: "conversation", context }); }
+    catch (error) { await close(); throw error; }
+    return conversation;
+  }
+  await reopen();
+  const controller = new AbortController();
+  return { ...f, context, controller, appendedRows, actions, close, reopen,
+    effects: () => effects, accountResolutions: () => accountResolutions,
+    get conversation() { return conversation; },
+    async complete(messageId = "completed-opencode-response") {
+      const receipt = await conversation.wake({ messageId, text: "Read a number" });
+      const state = await conversation.wait();
+      const turn = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+      assert.equal(turn.metadata.runtime.status, "complete", state.error);
+      assert.equal(turn.metadata.runtime.completedEnvelope, true);
+      assert.equal(turn.assistant.text, JSON.stringify(completedOpenCodeValue));
+      return { messageId, turnId: receipt.turnId };
+    },
+    prepare: receipt => conversation.prepareCompletedResponse(receipt, { signal: controller.signal }) };
+}
+const executeCompletedOpenCode = (prepared, argumentsText = "{}") => prepared.tools.execute({
+  id: prepared.toolCallId, name: "numbers_read", arguments: argumentsText
+});
+
+test("completed OpenCode canonical admission preserves its trusted marker and actual native association", async t => {
+  const f = await completedOpenCodeFixture(t);
+  try {
+    const receipt = await f.complete();
+    assert.equal(f.appendedRows.length, 1);
+    const admitted = f.appendedRows[0];
+    assert.equal(admitted.turnId, receipt.turnId);
+    assert.equal(admitted.system.messageId, receipt.messageId);
+    assert.equal(admitted.system.origin, "application");
+    assert.equal(admitted.user, null);
+    assert.equal(admitted.metadata.runtime.completedEnvelope, true);
+    assert.equal(admitted.metadata.runtime.status, "running");
+    const canonical = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.equal(canonical.system.messageId, admitted.system.messageId);
+    assert.equal(canonical.metadata.runtime.segmentId, admitted.metadata.runtime.segmentId);
+    assert.equal(canonical.metadata.runtime.engine, "opencode");
+    assert.equal(canonical.metadata.runtime.status, "complete");
+    assert.equal(canonical.metadata.runtime.completedEnvelope, true);
+    const binding = await f.binding();
+    assert.match(binding.sessionId, /^ses_/);
+    assert.equal(typeof binding.accountIdentity, "string");
+    assert.ok(binding.accountIdentity);
+    const trace = await f.trace();
+    const prompts = trace.filter(row => row.url?.endsWith("/prompt_async"));
+    assert.equal(prompts.length, 1);
+    assert.equal(prompts[0].url, `/session/${binding.sessionId}/prompt_async`);
+    assert.equal(prompts[0].body.agent, "jskit-assistant");
+    assert.equal(prompts[0].body.model.modelID, "test-model");
+    assert.match(prompts[0].body.parts[0].text, /Return only one JSON value matching this JSON Schema/);
+    const sessions = JSON.parse(await readFile(binding.databasePath, "utf8"));
+    const native = sessions.find(row => row.id === binding.sessionId);
+    assert.ok(native);
+    const authored = native.messages.find(row => row.info.role === "user" && row.info.id === prompts[0].body.messageID);
+    assert.ok(authored, "The native owner recorded the actual admitted prompt ID");
+    const answer = native.messages.find(row => row.info.role === "assistant" && row.info.parentID === authored.info.id);
+    assert.ok(answer);
+    assert.equal(answer.info.finish, "stop");
+    assert.equal(answer.parts[0].text, JSON.stringify(completedOpenCodeValue));
+    assert.equal(canonical.assistant.messageId, `${receipt.turnId}:${answer.info.id}:assistant`);
+    const prepared = await f.prepare(receipt);
+    assert.equal(prepared.text, canonical.assistant.text);
+    assert.equal(prepared.toolCallId, `${receipt.messageId}:operation`);
+    assert.equal(f.effects(), 0);
+    assert.equal((await f.trace()).filter(row => row.url === "/api/session").length, 1);
+  } finally { await f.close(); }
+});
+
+test("completed OpenCode prepared handles and reopen retain one durable effect without native replay", async t => {
+  const f = await completedOpenCodeFixture(t);
+  try {
+    const receipt = await f.complete();
+    const originalBinding = await f.binding();
+    const readsBefore = (await f.trace()).filter(row => row.url?.includes("/message")).length;
+    const one = await f.prepare(receipt), two = await f.prepare(receipt);
+    assert.equal(one.text, JSON.stringify(completedOpenCodeValue));
+    assert.equal(one.toolCallId, `${receipt.messageId}:operation`);
+    assert.equal(two.toolCallId, one.toolCallId);
+    const [first, second] = await Promise.all([executeCompletedOpenCode(one), executeCompletedOpenCode(two)]);
+    assert.equal(first.ok, true);
+    assert.deepEqual(second, first);
+    assert.equal(f.effects(), 1);
+    await assert.rejects(executeCompletedOpenCode(two, '{"changed":true}'), /different arguments/);
+    const saved = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.equal(saved.metadata.applicationTools.length, 1);
+    assert.equal(saved.metadata.applicationTools[0].id, one.toolCallId);
+    assert.equal(saved.metadata.applicationTools[0].status, "complete");
+    await f.reopen();
+    assert.deepEqual(await executeCompletedOpenCode(await f.prepare(receipt)), first);
+    assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId)), saved);
+    const restored = await f.binding();
+    for (const key of ["sessionId", "accountIdentity", "workdir", "directory", "databasePath", "runtimeDirectory"]) {
+      assert.equal(restored[key], originalBinding[key]);
+    }
+    assert.equal(f.effects(), 1);
+    const trace = await f.trace();
+    assert.ok(trace.filter(row => row.url?.includes("/message")).length >= readsBefore + 4,
+      "Both prepared handles and the cold owner inspect the real native input history");
+    assert.equal(trace.filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+    assert.equal(trace.filter(row => row.url === "/api/session").length, 1);
+  } finally { await f.close(); }
+});
+
+test("completed OpenCode cached bindings cannot mask missing or changed persisted native fingerprints", async t => {
+  const f = await completedOpenCodeFixture(t);
+  try {
+    const receipt = await f.complete();
+    const prepared = await f.prepare(receipt);
+    const before = await f.storage.read("conversation", tx => tx.readMetadata());
+    for (const missing of [true, false]) {
+      const changed = structuredClone(before);
+      if (missing) delete changed.runtime.binding.accountIdentity;
+      else changed.runtime.binding.accountIdentity = "different-persisted-fixture-identity";
+      await f.storage.write("conversation", tx => tx.writeMetadata(changed));
+      try {
+        for (let attempt = 0; attempt < 2; attempt++) {
+          await assert.rejects(f.prepare(receipt), missing ? /no saved account fingerprint/ : /different account binding/);
+          await assert.rejects(executeCompletedOpenCode(prepared), /identity changed|no saved account fingerprint|different account binding/);
+          assert.deepEqual(await f.storage.read("conversation", tx => tx.readMetadata()), changed);
+        }
+      } finally { await f.storage.write("conversation", tx => tx.writeMetadata(before)); }
+    }
+    assert.equal(f.effects(), 0);
+    assert.equal((await f.trace()).filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+    assert.equal((await f.trace()).filter(row => row.url === "/api/session").length, 1);
+  } finally { await f.close(); }
+});
+
+test("completed OpenCode freshly resolved accounts cannot inherit cached completion authority", async t => {
+  const f = await completedOpenCodeFixture(t);
+  try {
+    const receipt = await f.complete();
+    const prepared = await f.prepare(receipt);
+    const before = await f.storage.read("conversation", tx => tx.readMetadata());
+    const resolutions = f.accountResolutions();
+    f.setKey("changed-opencode-fixture-account");
+    try {
+      for (let attempt = 0; attempt < 2; attempt++) {
+        await assert.rejects(f.prepare(receipt), /different account binding/);
+        await assert.rejects(executeCompletedOpenCode(prepared), /different account binding/);
+        assert.deepEqual(await f.storage.read("conversation", tx => tx.readMetadata()), before);
+      }
+      assert.ok(f.accountResolutions() >= resolutions + 4, "Every preparation and effect checks the original fresh connection resolver");
+      assert.equal(f.effects(), 0);
+      assert.equal((await f.trace()).filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+      assert.equal((await f.trace()).filter(row => row.url === "/api/session").length, 1);
+    } finally { f.setKey("test-key"); }
+  } finally { await f.close(); }
+});
+
+test("completed OpenCode requires its actual admitted native input on cold inspection", async t => {
+  const f = await completedOpenCodeFixture(t);
+  try {
+    const receipt = await f.complete();
+    await f.prepare(receipt);
+    const canonical = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    const binding = await f.binding();
+    const prompt = (await f.trace()).find(row => row.url?.endsWith("/prompt_async"));
+    await f.close();
+    const nativeSource = await readFile(binding.databasePath, "utf8");
+    const sessions = JSON.parse(nativeSource);
+    const session = sessions.find(row => row.id === binding.sessionId);
+    const accepted = session.messages.filter(row => row.info.role === "user" && row.info.id === prompt.body.messageID);
+    assert.equal(accepted.length, 1, "Remove only evidence that the original native prompt handler actually wrote");
+    session.messages = session.messages.filter(row => row !== accepted[0]);
+    await writeFile(binding.databasePath, JSON.stringify(sessions));
+    try {
+      const readsBefore = (await f.trace()).filter(row => row.url?.includes("/message")).length;
+      // If the original cold owner refuses before inspection, keep that real
+      // failure visible; do not seed or replace a native/canonical completion.
+      await f.reopen();
+      for (let attempt = 0; attempt < 2; attempt++) {
+        await assert.rejects(f.prepare(receipt), /could not verify this response association/);
+      }
+      assert.ok((await f.trace()).filter(row => row.url?.includes("/message")).length >= readsBefore + 2);
+      assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId)), canonical);
+      assert.equal(f.effects(), 0);
+      assert.equal((await f.trace()).filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+      assert.equal((await f.trace()).filter(row => row.url === "/api/session").length, 1);
+    } finally { await f.close(); await writeFile(binding.databasePath, nativeSource); }
+  } finally { await f.close(); }
+});
+
+test("completed OpenCode response custody refuses foreign native conversation and host scope before effects", async t => {
+  const f = await completedOpenCodeFixture(t);
+  try {
+    const receipt = await f.complete();
+    const prepared = await f.prepare(receipt);
+    const before = await f.storage.read("conversation", tx => tx.readMetadata());
+    const canonical = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    for (const [key, value] of [
+      ["sessionId", "ses_foreign_fixture_session"], ["workdir", "/different-fixture-workdir"],
+      ["directory", "/different-fixture-directory"], ["databasePath", "/different-fixture-history"],
+      ["runtimeDirectory", "/different-fixture-runtime"]
+    ]) {
+      const changed = structuredClone(before);
+      changed.runtime.binding[key] = value;
+      await f.storage.write("conversation", tx => tx.writeMetadata(changed));
+      try {
+        await assert.rejects(f.prepare(receipt), /different native conversation or host scope/);
+        await assert.rejects(executeCompletedOpenCode(prepared), /identity changed|different native conversation or host scope/);
+        assert.deepEqual(await f.storage.read("conversation", tx => tx.readMetadata()), changed);
+        assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId)), canonical);
+      } finally { await f.storage.write("conversation", tx => tx.writeMetadata(before)); }
+    }
+    assert.equal(f.effects(), 0);
+    assert.equal((await f.trace()).filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+    assert.equal((await f.trace()).filter(row => row.url === "/api/session").length, 1);
+  } finally { await f.close(); }
+});
+
+test("completed OpenCode caller markers preserve ordinary native discovery without completion authority", async t => {
+  const f = await completedOpenCodeFixture(t, { assistantResponses: [], configuration: { outputSchema: undefined } });
+  try {
+    const receipt = await f.conversation.send({ messageId: "ordinary-opencode", text: "tools", data: { completedEnvelope: true } });
+    const state = await f.conversation.wait();
+    const turn = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.equal(turn.metadata.runtime.status, "complete", state.error);
+    assert.equal(turn.metadata.runtime.completedEnvelope, undefined);
+    assert.equal(f.effects(), 0, "Caller data is not a completed-envelope effect authorization");
+    const initialTrace = await f.trace();
+    const ordinaryPrompt = initialTrace.find(row => row.url?.endsWith("/prompt_async"));
+    assert.equal(ordinaryPrompt.body.agent, "jskit-assistant-actions");
+    assert.match(ordinaryPrompt.body.parts[0].text, /\[Application data\]/);
+    assert.deepEqual(initialTrace[0].configuration.agent[ordinaryPrompt.body.agent].permission, {
+      "*": "ask", assistant_action_search: "allow", assistant_action_contract: "allow", assistant_action_execute: "allow"
+    });
+    await assert.rejects(f.prepare({ messageId: "ordinary-opencode", turnId: receipt.turnId }), /no current verified receipt/);
+    // The original native fixture invokes discovery only for exact plain tools.
+    const toolReceipt = await f.conversation.send({ messageId: "ordinary-opencode-tools", text: "tools" });
+    const toolsState = await f.conversation.wait();
+    const toolsTurn = await f.storage.read("conversation", tx => tx.readTurn(toolReceipt.turnId));
+    assert.equal(toolsTurn.metadata.runtime.status, "complete", toolsState.error);
+    assert.equal(toolsTurn.metadata.runtime.completedEnvelope, undefined);
+    assert.equal(toolsTurn.metadata.applicationTools.length, 3);
+    assert.equal(f.effects(), 1);
+    assert.equal(JSON.parse(toolsTurn.assistant.text).result.result.value, 42);
+    await assert.rejects(f.prepare({ messageId: "ordinary-opencode-tools", turnId: toolReceipt.turnId }), /no current verified receipt/);
+    const trace = await f.trace();
+    const prompts = trace.filter(row => row.url?.endsWith("/prompt_async"));
+    assert.equal(prompts.length, 2);
+    assert.equal(prompts[1].body.parts[0].text, "tools");
+    assert.equal(trace.filter(row => row.url === "/api/session").length, 1);
+  } finally { await f.close(); }
+});
+
+
+test("completed OpenCode prepared reply preserves native receipt and publishes one plain final across reopen", async t => {
+  const value = { kind: "reply", text: "  Verified OpenCode reply.  ", toolName: "", arguments: "" };
+  const f = await completedOpenCodeFixture(t, { assistantResponses: [{ text: JSON.stringify(value) }] });
+  try {
+    const { createConversationTranscript } = await import("../src/server/conversation/transcript.js");
+    const transcript = createConversationTranscript({ storage: f.storage });
+    const plain = await transcript.writeConversationUserMessage("conversation", {
+      messageId: "opencode-product-user", text: "Actual product request", data: { original: true }
+    });
+    const receipt = await f.conversation.wake({ messageId: "opencode-internal-reply", text: "Give a reply" },
+      { excludedMessageIds: [plain.user.messageId] });
+    const state = await f.conversation.wait();
+    assert.equal(state.status, "ready", state.error);
+    const raw = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.equal(raw.metadata.runtime.status, "complete");
+    assert.equal(raw.metadata.runtime.completedEnvelope, true);
+    assert.equal(raw.assistant.text, JSON.stringify(value));
+    const binding = await f.binding();
+    const nativeBefore = JSON.parse(await readFile(binding.databasePath, "utf8")).find(row => row.id === binding.sessionId);
+    const prompt = (await f.trace()).find(row => row.url?.endsWith("/prompt_async"));
+    const authored = nativeBefore.messages.find(row => row.info.role === "user" && row.info.id === prompt.body.messageID);
+    assert.ok(authored);
+    const answer = nativeBefore.messages.find(row => row.info.role === "assistant" && row.info.parentID === authored.info.id);
+    assert.ok(answer);
+    assert.equal(answer.info.finish, "stop");
+    assert.equal(answer.parts[0].text, JSON.stringify(value));
+    assert.equal(raw.assistant.messageId, `${receipt.turnId}:${answer.info.id}:assistant`);
+    const before = await f.storage.read("conversation", tx => tx.readMetadata());
+    const first = await f.prepare(receipt), second = await f.prepare(receipt);
+    const [one, two] = await Promise.all([first.publishReply({ turnId: plain.turnId }), second.publishReply({ turnId: plain.turnId })]);
+    assert.deepEqual(two, one);
+    assert.equal(one.assistant.text, "Verified OpenCode reply.");
+    assert.deepEqual(one.user, plain.user);
+    assert.equal(one.metadata?.runtime?.engine, undefined);
+    const { conversationMessageIdentity, conversationMessageVersion } = await import("../src/server/conversation/continuity.js");
+    const assistantIdentity = conversationMessageIdentity(plain.turnId, one.assistant);
+    const after = await f.storage.read("conversation", tx => tx.readMetadata());
+    assert.deepEqual(after.runtime.seen, { ...before.runtime.seen,
+      [assistantIdentity]: conversationMessageVersion(one.assistant, { includeData: true }) });
+    const savedRaw = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.deepEqual(savedRaw, { ...raw, metadata: { ...raw.metadata,
+      runtime: { ...raw.metadata.runtime, publishedReplyTurnId: plain.turnId } } });
+    await f.reopen();
+    assert.deepEqual(await (await f.prepare(receipt)).publishReply({ turnId: plain.turnId }), one);
+    assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId)), savedRaw);
+    assert.deepEqual((await f.storage.read("conversation", tx => tx.readMetadata())).runtime.seen, after.runtime.seen);
+    const restored = await f.binding();
+    for (const key of ["sessionId", "accountIdentity", "workdir", "directory", "databasePath", "runtimeDirectory"]) {
+      assert.equal(restored[key], binding[key]);
+    }
+    assert.deepEqual(JSON.parse(await readFile(restored.databasePath, "utf8")).find(row => row.id === restored.sessionId).messages,
+      nativeBefore.messages, "Publication and cold replay preserve the actual native input/answer identities and history");
+    assert.deepEqual((await f.conversation.read()).conversationLog.map(turn => turn.assistant?.text), ["Verified OpenCode reply."]);
+    const trace = await f.trace();
+    assert.equal(trace.filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+    assert.equal(trace.filter(row => row.url === "/api/session").length, 1);
+    assert.equal(f.effects(), 0);
+  } finally { await f.close(); }
+});
+
+test("completed OpenCode prepared reply rechecks the original fresh account before publication", async t => {
+  const value = { kind: "reply", text: "Verified OpenCode reply.", toolName: "", arguments: "" };
+  const f = await completedOpenCodeFixture(t, { assistantResponses: [{ text: JSON.stringify(value) }] });
+  try {
+    const { createConversationTranscript } = await import("../src/server/conversation/transcript.js");
+    const transcript = createConversationTranscript({ storage: f.storage });
+    const plain = await transcript.writeConversationUserMessage("conversation", {
+      messageId: "opencode-refused-product-user", text: "Actual product request"
+    });
+    const receipt = await f.conversation.wake({ messageId: "opencode-account-reply", text: "Give a reply" },
+      { excludedMessageIds: [plain.user.messageId] });
+    const state = await f.conversation.wait();
+    assert.equal(state.status, "ready", state.error);
+    const raw = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.equal(raw.metadata.runtime.status, "complete");
+    assert.equal(raw.assistant.text, JSON.stringify(value));
+    const prepared = await f.prepare(receipt);
+    const before = await f.storage.read("conversation", tx => tx.readMetadata());
+    const resolutions = f.accountResolutions();
+    f.setKey("changed-opencode-fixture-account");
+    try {
+      for (let attempt = 0; attempt < 2; attempt++) {
+        await assert.rejects(prepared.publishReply({ turnId: plain.turnId }), /different account binding/);
+        assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(plain.turnId)), plain);
+        assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId)), raw);
+        assert.deepEqual(await f.storage.read("conversation", tx => tx.readMetadata()), before);
+      }
+      assert.ok(f.accountResolutions() >= resolutions + 2, "Publication uses the actual fresh connection resolver, not the prepared cached account");
+      const trace = await f.trace();
+      assert.equal(trace.filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+      assert.equal(trace.filter(row => row.url === "/api/session").length, 1);
+      assert.equal(f.effects(), 0);
+    } finally { f.setKey("test-key"); }
+  } finally { await f.close(); }
+});
+
+
+// Preserve the original fixed-envelope decoded limits at the native wire boundary.
+const completedOpenCodeWireSchema = { type: "object", additionalProperties: false,
+  required: ["kind", "text", "toolName", "arguments"], properties: {
+    kind: { type: "string", enum: ["reply", "tool"] }, text: { type: "string", maxLength: 16000 },
+    toolName: { type: "string", maxLength: 256 }, arguments: { type: "string", maxLength: 262144 }
+  } };
+
+for (const kind of ["tool", "reply"]) test(`completed OpenCode ${kind} wire retains large decoded fields through native storage and preparation`, async t => {
+  const handover = "😀".repeat(20000);
+  const argumentsText = JSON.stringify({ value: handover }).replace(/[\u0080-\uffff]/g,
+    character => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+  const value = kind === "tool" ? { kind, text: "", toolName: "numbers_read", arguments: argumentsText }
+    : { kind, text: "\u0000".repeat(16000), toolName: "", arguments: "" };
+  const raw = JSON.stringify(value);
+  assert.ok(raw.length > (kind === "tool" ? 280000 : 16000));
+  if (kind === "tool") assert.equal(value.arguments.length, 240012);
+  else assert.equal(value.text.length, 16000);
+  const f = await completedOpenCodeFixture(t, { assistantResponses: [{ text: raw }],
+    configuration: { outputSchema: completedOpenCodeWireSchema },
+    limits: { maxFinalReplyCharacters: 16000, maxOutputCharacters: 1670455 } });
+  try {
+    const receipt = await f.conversation.wake({ messageId: `opencode-large-${kind}-wire`, text: "Read the completed envelope" });
+    const state = await f.conversation.wait();
+    assert.equal(state.status, "ready", state.error);
+    const saved = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.equal(saved.metadata.runtime.status, "complete");
+    assert.equal(saved.metadata.runtime.completedEnvelope, true);
+    assert.equal(saved.system.origin, "application");
+    assert.equal(saved.system.messageId, receipt.messageId);
+    assert.equal(f.appendedRows.length, 1);
+    assert.equal(f.appendedRows[0].metadata.runtime.completedEnvelope, true);
+    assert.equal(saved.assistant.text, raw);
+    const binding = await f.binding();
+    const nativeBefore = JSON.parse(await readFile(binding.databasePath, "utf8")).find(row => row.id === binding.sessionId);
+    const prompt = (await f.trace()).find(row => row.url?.endsWith("/prompt_async"));
+    const authored = nativeBefore.messages.find(row => row.info.role === "user" && row.info.id === prompt.body.messageID);
+    assert.ok(authored);
+    const answer = nativeBefore.messages.find(row => row.info.role === "assistant" && row.info.parentID === authored.info.id);
+    assert.ok(answer);
+    assert.equal(answer.info.finish, "stop");
+    assert.equal(answer.parts[0].text, raw);
+    assert.equal(saved.assistant.messageId, `${receipt.turnId}:${answer.info.id}:assistant`);
+    const prepared = await f.prepare(receipt);
+    assert.equal(prepared.text, raw);
+    const { readAssistantResponseEnvelope } = await import("../src/server/lib/assistantToolLoop.js");
+    const decoded = readAssistantResponseEnvelope(prepared.text);
+    assert.deepEqual(decoded, value);
+    if (kind === "tool") assert.equal(JSON.parse(decoded.arguments).value, handover);
+    assert.equal(f.effects(), 0, "Preparing and decoding do not execute the requested action");
+    await f.reopen();
+    const restored = await f.prepare(receipt);
+    assert.equal(restored.text, raw);
+    assert.equal(restored.toolCallId, prepared.toolCallId);
+    assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId)), saved);
+    const reopenedBinding = await f.binding();
+    assert.equal(reopenedBinding.sessionId, binding.sessionId);
+    assert.deepEqual(JSON.parse(await readFile(reopenedBinding.databasePath, "utf8")).find(row => row.id === binding.sessionId).messages,
+      nativeBefore.messages);
+    const trace = await f.trace();
+    assert.equal(trace.filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+    assert.equal(trace.filter(row => row.url === "/api/session").length, 1);
+    assert.deepEqual((await f.conversation.read()).conversationLog, []);
+    assert.equal(f.effects(), 0);
+  } finally { await f.close(); }
+});
+
+test("ordinary OpenCode forged-data wire retains the human cap in completed mode", async t => {
+  const value = { kind: "reply", text: "\u0000".repeat(16000), toolName: "", arguments: "" };
+  const raw = JSON.stringify(value);
+  const f = await completedOpenCodeFixture(t, { assistantResponses: [{ text: raw }],
+    configuration: { outputSchema: completedOpenCodeWireSchema },
+    limits: { maxFinalReplyCharacters: 16000, maxOutputCharacters: 1670455 } });
+  try {
+    const receipt = await f.conversation.send({ messageId: "opencode-ordinary-forged-wire", text: "An ordinary request",
+      data: { completedEnvelope: true } });
+    await f.conversation.wait();
+    const saved = await f.storage.read("conversation", tx => tx.readTurn(receipt.turnId));
+    assert.equal(saved.metadata.runtime.status, "failed");
+    assert.match(saved.metadata.runtime.error, /final reply limit/);
+    assert.equal(saved.metadata.runtime.completedEnvelope, undefined);
+    assert.equal(saved.user.origin, "user");
+    assert.deepEqual(saved.user.data, { completedEnvelope: true });
+    assert.notEqual(saved.assistant?.text, raw);
+    assert.equal((await f.conversation.inspectDelivery({ messageId: receipt.messageId })).status, "accepted");
+    assert.equal((await f.trace()).filter(row => row.url?.endsWith("/prompt_async")).length, 1);
+    assert.equal(f.effects(), 0);
+  } finally { await f.close(); }
+});
+
+
+test("managed OpenCode refreshes its own key in the retained native scope without transferring completed receipt authority", async t => {
+  const { createOpenCodeConversationServer } = await import("../src/server/conversation/openCodeProcess.js");
+  const { createOpenCodeSharedRuntime } = await import("../src/server/conversation/openCodeRuntime.js");
+  let f, owner, foreignScope = false;
+  const starts = [], stops = [];
+  f = await completedOpenCodeFixture(t, { opencode: async ({ connection }) => {
+    const runtimeDirectory = path.join(f.directory, "managed-native");
+    owner ||= createOpenCodeSharedRuntime({ scope: runtimeDirectory, onStop: event => stops.push(event) });
+    const selected = { modelProviderId: connection.providerId, canonicalUrl: connection.baseURL || "",
+      endpointCode: connection.sdkPackage || "", fingerprint: connection.apiKey };
+    return { runtime: owner, runtimeDirectory, allowCredentialRefresh: true,
+      registryPath: path.join(runtimeDirectory, "environments.json"),
+      databasePath: path.join(runtimeDirectory, foreignScope ? "foreign-native.json" : "native.json"), selected,
+      prepareServer: async () => ({ connections: [selected],
+        options: { command: f.driverOptions.host.commands.opencode, workdir: f.directory,
+          stateDirectory: runtimeDirectory, databasePath: path.join(runtimeDirectory, "native.json"),
+          sessionEnvironmentRegistry: path.join(runtimeDirectory, "environments.json"),
+          connection, env: f.driverOptions.host.env },
+        create: async options => {
+          const server = await createOpenCodeConversationServer(options);
+          starts.push({ options, server });
+          return server;
+        }
+      }) };
+  } });
+  try {
+    const first = await f.complete("managed-first");
+    const firstCanonical = await f.storage.read("conversation", tx => tx.readTurn(first.turnId));
+    const before = await f.binding();
+    const prior = JSON.parse(await readFile(before.databasePath, "utf8"));
+    const prepared = await f.prepare(first);
+    f.setKey("managed-replacement-key");
+    await assert.rejects(f.prepare(first), /different account binding/);
+    await assert.rejects(executeCompletedOpenCode(prepared), /different account binding/);
+    assert.deepEqual(await f.binding(), before);
+    assert.equal(f.effects(), 0);
+    const second = await f.complete("managed-second");
+    const secondCanonical = await f.storage.read("conversation", tx => tx.readTurn(second.turnId));
+    const after = await f.binding();
+    assert.equal(after.sessionId, before.sessionId);
+    assert.equal(starts.length, 2);
+    assert.equal(starts[0].options.databasePath, starts[1].options.databasePath);
+    assert.equal(starts[0].options.workdir, starts[1].options.workdir);
+    assert.equal(starts[0].options.connection.apiKey, "test-key");
+    assert.equal(starts[1].options.connection.apiKey, "managed-replacement-key");
+    assert.ok(stops.some(event => event.reason === "opencode-connection-changed"));
+    await assert.rejects(starts[0].server.client.health({ signal: AbortSignal.timeout(1000) }));
+    const trace = await f.trace();
+    assert.equal(trace.filter(row => row.url === "/api/session").length, 1);
+    assert.equal(trace.filter(row => row.url?.endsWith("/prompt_async")).length, 2);
+    const current = JSON.parse(await readFile(after.databasePath, "utf8")).find(row => row.id === after.sessionId);
+    const original = prior.find(row => row.id === before.sessionId);
+    assert.deepEqual(current.messages.slice(0, original.messages.length), original.messages);
+    assert.equal(f.appendedRows.length, 2);
+    assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(first.turnId)), firstCanonical);
+    foreignScope = true;
+    await assert.rejects(f.conversation.send({ messageId: "foreign-store", text: "Again" }), /another native history store or runtime/);
+    const refused = await f.binding();
+    assert.deepEqual(refused, { ...after, executionId: "", processDirectory: "" });
+    await assert.rejects(starts[1].server.client.health({ signal: AbortSignal.timeout(1000) }));
+    assert.deepEqual(JSON.parse(await readFile(after.databasePath, "utf8")).find(row => row.id === after.sessionId), current);
+    assert.equal(starts.length, 2);
+    assert.equal(f.appendedRows.length, 2);
+    assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(first.turnId)), firstCanonical);
+    assert.deepEqual(await f.storage.read("conversation", tx => tx.readTurn(second.turnId)), secondCanonical);
+    assert.equal((await f.trace()).filter(row => row.url?.endsWith("/prompt_async")).length, 2);
+    assert.equal(f.effects(), 0);
+  } finally {
+    await f.close();
+    await owner?.stop("managed-fixture-close");
+  }
+});
+
+
+test("opted bound OpenCode re-enters supplied callback context after admission ends", async t => {
+  const { AsyncLocalStorage } = await import("node:async_hooks");
+  const context = new AsyncLocalStorage();
+  const admission = { scope: "admission" }, control = { scope: "control" };
+  const released = Promise.withResolvers();
+  t.after(() => released.resolve());
+  let reentries = 0;
+  const f = await boundToolFixture(t, { runInContext(operation) {
+    reentries++;
+    return context.run(control, operation);
+  } });
+  const calls = [];
+  const main = await f.open("delayed-context-main", async call => {
+    await released.promise;
+    assert.equal(context.getStore(), control, "A retained callback must re-enter the supplied context");
+    calls.push(call.name);
+    return {};
+  });
+  const running = context.run(admission, () => main.send("delayed-context-words", "tools"));
+  await running.accepted;
+  assert.equal(context.getStore(), undefined, "The authored admission callback has ended");
+  released.resolve();
+  await running.completion;
+  assert.deepEqual(calls, ["assistant_action_search", "assistant_action_contract", "assistant_action_execute"]);
+  assert.equal(reentries, 3);
+  assert.equal(main.receipts.length, 1);
+  assert.equal(main.receipts[0].turn.messages[0].text, "tools");
+  assert.equal(f.owner.turns.get(main.key).active, false);
+});
+
+
+test("opted bound OpenCode retains supplied control through delayed monitor publication and retirement", async t => {
+  const { AsyncLocalStorage } = await import("node:async_hooks");
+  const context = new AsyncLocalStorage();
+  const admission = { scope: "admission" }, control = { scope: "control" };
+  const released = Promise.withResolvers();
+  t.after(() => released.resolve());
+  const phases = [];
+  const f = await boundToolFixture(t, {
+    runInContext: operation => context.run(control, operation),
+    monitorRunInContext: async operation => context.run(control, operation),
+    async monitorContext(phase) {
+      if (phase !== "onRetired") {
+        await released.promise;
+        assert.equal(context.getStore(), control, "The retained monitor must inherit supplied CONTROL");
+      }
+      phases.push({ phase, context: context.getStore() });
+    }
+  });
+  const calls = [];
+  const main = await f.open("delayed-monitor-main", async call => { calls.push(call.name); return {}; });
+  const running = context.run(admission, () => main.send("delayed-monitor-words", "tools"));
+  await running.accepted;
+  assert.equal(context.getStore(), undefined, "Send admission ended before delayed publication");
+  const retainedMonitor = f.owner.monitors.get(main.key);
+  assert.equal(f.owner.beginMessageMonitor(main.key, f.owner.processes.get(main.key), {}, {}, {
+    runInContext: async operation => context.run(control, operation),
+    prepare: () => assert.fail("An existing monitor must not be recreated")
+  }), retainedMonitor, "An async scope wrapper must preserve the original monitor promise");
+  const preparationFailure = new Error("Exact synchronous monitor preparation failure");
+  const scopeErrors = [];
+  assert.throws(() => f.owner.beginMessageMonitor("failed-monitor-preparation", {}, {}, {}, {
+    runInContext: async operation => context.run(control, operation),
+    prepare() { assert.equal(context.getStore(), control); throw preparationFailure; },
+    onError: error => scopeErrors.push(error)
+  }), error => error === preparationFailure);
+  await new Promise(resolve => setImmediate(resolve));
+  assert.deepEqual(scopeErrors, [], "A synchronous creation failure is not reported again by the scope wrapper");
+  released.resolve();
+  await running.completion;
+  assert.deepEqual(calls, ["assistant_action_search", "assistant_action_contract", "assistant_action_execute"]);
+  assert.ok(phases.some(value => value.phase === "writeRun"));
+  assert.ok(phases.some(value => value.phase === "projectMessages"));
+  assert.ok(phases.some(value => value.phase === "onRetired"));
+  assert.ok(phases.every(value => value.context === control));
+  assert.equal(main.receipts.length, 1);
+  assert.equal(main.receipts[0].turn.messages[0].text, "tools");
+  assert.equal(f.owner.turns.get(main.key).active, false);
+  assert.equal(f.owner.turns.get(main.key).state, "completed");
+});