@kaydash9999/banker-plugins 0.15.0 → 0.15.2

package/skills/ralph-qa/references/payload-scan.mjs

@@ -5,17 +5,19 @@
  *   node payload-scan.mjs <file>
  *
  * Prints {"file", "count", "hits": [{"line", "kind"}]} and exits 0 when nothing was found,
- * 1 when something was, 2 when the file cannot be read or the arguments are not one file. A
- * private key hit also carries `end`, the line of its END marker (null when there is none):
- * the whole block is the secret, not just the BEGIN line. The matched text itself is never
+ * 1 when something was, 2 when the file cannot be read or scanned or the arguments are not one
+ * file. A private key hit also carries `end`, the line of its END marker (null when there is
+ * none): the whole block is the secret, not just the BEGIN line. The matched text itself is never
  * printed, so the report cannot become the leak. The patterns cover common key and token
  * formats, private key blocks (PGP too), secret assignments (quoted, or unquoted with letters
  * and digits), passwords (quoted, with a symbol, alone on a config or env-file line, or after a
  * Dockerfile `ENV KEY value`), secrets given as command-line flags, curl's user and password flag,
  * hex keys, Basic and Bearer credentials, credentials in URLs and
- * long high-entropy strings (a lockfile's sha512- integrity hash aside); they do not prove a
- * payload clean. Every repeat and lookahead is
- * bounded or anchored, so a long line takes linear time.
+ * long high-entropy strings (a lockfile's sha512- integrity hash and a Go or Terraform h1: hash
+ * aside); they do not prove a payload clean. A Docker secret file's path after a *_FILE key is
+ * not read as the password it points to. Every repeat and lookahead is bounded (a run longer than
+ * 65536 characters is read in pieces) or anchored, so a long line takes linear time and cannot
+ * overflow the regex stack.
  */
 import { readFileSync, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -27,24 +29,26 @@ const PASSWORD_KEY = String.raw`(?:${PASS_WORD}|비밀번호|패스워드)[\w-]{
 // An unquoted value that is not code: none of the characters an expression or a reference
 // holds, and at least one symbol (an identifier has none).
 const BARE = String.raw`[^\s;,"'().\[\]{}$<>]`;
-const PRIVATE_KEY = String.raw`(?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----`;
+// at most 8 words before PRIVATE KEY (RSA, EC, OPENSSH, ENCRYPTED, PGP): an open nested repeat
+// overflows V8's regex stack on a key marker before millions of words
+const PRIVATE_KEY = String.raw`(?:[A-Z0-9]{1,32} ){0,8}PRIVATE KEY(?: BLOCK)?-----`;
 
 export const PATTERNS = [
   ["aws-access-key", /(?<![A-Z0-9])(?:AKIA|ASIA)[A-Z0-9]{16}(?![A-Z0-9])/],
-  ["github-token", /(?<![A-Za-z0-9])(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{22,})/],
-  ["gitlab-token", /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}/],
-  ["anthropic-key", /(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_-]{20,}/],
-  ["openai-key", /(?<![A-Za-z0-9-])sk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}/],
-  ["stripe-key", /(?<![A-Za-z0-9])[rs]k_(?:live|test)_[A-Za-z0-9]{16,}/],
+  ["github-token", /(?<![A-Za-z0-9])(?:gh[pousr]_[A-Za-z0-9]{36,65536}|github_pat_[A-Za-z0-9_]{22,65536})/],
+  ["gitlab-token", /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,65536}/],
+  ["anthropic-key", /(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_-]{20,65536}/],
+  ["openai-key", /(?<![A-Za-z0-9-])sk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,65536}/],
+  ["stripe-key", /(?<![A-Za-z0-9])[rs]k_(?:live|test)_[A-Za-z0-9]{16,65536}/],
   ["npm-token", /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}/],
-  ["huggingface-token", /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{30,}/],
+  ["huggingface-token", /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{30,65536}/],
   ["google-api-key", /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}/],
-  ["slack-token", /(?<![A-Za-z0-9])xox[abprs]-[A-Za-z0-9-]{10,}/],
+  ["slack-token", /(?<![A-Za-z0-9])xox[abprs]-[A-Za-z0-9-]{10,65536}/],
   ["slack-webhook", /hooks\.slack\.com\/services\/T[A-Za-z0-9]+\/B[A-Za-z0-9]+\/[A-Za-z0-9]+/],
   ["private-key", new RegExp(`-----BEGIN ${PRIVATE_KEY}`)],
-  ["jwt", /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/],
-  ["bearer-token", /\bbearer\s+[A-Za-z0-9._~+/-]{20,}/i],
-  ["basic-auth", /\bauthorization["']?\s*[:=]\s*["']?basic\s+[A-Za-z0-9+/=]{8,}/i],
+  ["jwt", /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{10,65536}\.eyJ[A-Za-z0-9_-]{10,65536}\.[A-Za-z0-9_-]{10,65536}/],
+  ["bearer-token", /\bbearer\s+[A-Za-z0-9._~+/-]{20,65536}/i],
+  ["basic-auth", /\bauthorization["']?\s*[:=]\s*["']?basic\s+[A-Za-z0-9+/=]{8,65536}/i],
   ["url-credentials", /[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:@/]{0,256}:[^\s@/]{3,256}@/i],
   // quoted: 12 characters or more, or 8 to 11 holding a digit (a word like "development" is not one)
   ["assigned-secret", new RegExp(SECRET_KEY + String.raw`["'](?:[^"'\s]{12,256}|(?=[^"'\s]{0,10}\d)[^"'\s]{8,11})["']`, "i")],
@@ -56,15 +60,17 @@ export const PATTERNS = [
   // a Dockerfile's legacy `ENV KEY value` form, the value alone after the space
   ["dockerfile-env-password", new RegExp(String.raw`^[+\- ]?\s*ENV\s+[\w.-]{0,64}${PASS_WORD}[\w.-]{0,64}\s+["']?(?![-$<{%])[^\s"',;()\[\]{}=]{6,256}["']?\s*(?:#.*)?$`, "i")],
   ["flag-secret", /--(?:password|passwd|pass|token|api-key|apikey|secret|client-secret)(?:=|\s+)(?![-$])[^\s"']{6,256}/i],
-  // curl's -u flag with a user and password pair, glued to it or not; a uid:gid (docker) or a
-  // host:/path (rsync) is no credential
-  ["curl-user", /(?<!\S)(?:-u\s*|--user(?:\s+|=))(?!\d{1,10}:\d{1,10}\b(?![:@]))[^\s:=]{1,256}:(?!\/)\S{3,256}/],
-  ["assigned-hex", /(?:key|auth|token|secret)[\w-]{0,64}["']?\s*[:=]\s*["']?[0-9a-f]{32,}(?![0-9a-z])/i],
+  // curl's -u flag with a user and password pair, glued to it or not; a uid:gid (docker) that is
+  // the whole value, quoted or not, a host:/path (rsync), a date format (date -u +%H:%M) or an id
+  // substitution ($(id -u):$(id -g)) is no credential. A user:group of names is not told apart:
+  // that would let admin:admin through.
+  ["curl-user", /(?<!\S)(?:-u\s*|--user(?:\s+|=))(?!(["']?)\d{1,10}:\d{1,10}\1(?=["'`\s;|&)]|$))(?!["']?\+%|\))[^\s:=]{1,256}:(?!\/)\S{3,256}/],
+  ["assigned-hex", /(?:key|auth|token|secret)[\w-]{0,64}["']?\s*[:=]\s*["']?[0-9a-f]{32,65536}(?![0-9a-z])/i],
 ];
 
 // Long runs of base64-like characters whose Shannon entropy is that of random data, as
 // lineage's redaction measures them (32 characters or more, 4.5 bits per character or more).
-const LONG_RUN = /[A-Za-z0-9+/=]{32,}/g;
+const LONG_RUN = /[A-Za-z0-9+/=]{32,65536}/g;
 const ENTROPY_FLOOR = 4.5;
 
 export function entropy(s) {
@@ -75,10 +81,21 @@ export function entropy(s) {
   return bits;
 }
 
-// A subresource-integrity hash (`sha512-<base64>`, as lockfiles hold) is a public checksum.
+// A subresource-integrity hash (`sha512-<base64>`, as lockfiles hold) and a Go module or
+// Terraform lock hash (`h1:` and 43 base64 characters and `=`, as go.sum and .terraform.lock.hcl
+// hold) are public checksums.
 const SRI_PREFIX = /sha(?:256|384|512)-$/;
-const highEntropy = (line) => [...line.matchAll(LONG_RUN)]
-  .some((m) => !SRI_PREFIX.test(line.slice(Math.max(0, m.index - 7), m.index)) && entropy(m[0]) >= ENTROPY_FLOOR);
+const H1_PREFIX = /(?:^|[^A-Za-z0-9+/=])h1:$/;
+const publicHash = (line, m) => SRI_PREFIX.test(line.slice(Math.max(0, m.index - 7), m.index))
+  || (/^[A-Za-z0-9+/]{43}=$/.test(m[0]) && H1_PREFIX.test(line.slice(Math.max(0, m.index - 4), m.index)));
+const highEntropy = (line) => [...line.matchAll(LONG_RUN)].some((m) => !publicHash(line, m) && entropy(m[0]) >= ENTROPY_FLOOR);
+
+// A *_FILE key's absolute path, the Docker secret file official images take a password from, is
+// not that password: the kinds that read a value after a key name see a `-` there instead. The
+// other kinds still read the line as it is, so a key's own format shows wherever it sits.
+const SECRET_FILE_PATH = /(?<![\w.-])([\w.-]{0,128}_FILE["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?)\/[\w.@-]{1,128}(?:\/[\w.@-]{1,128}){0,32}(?=["']?(?:[\s,;#]|$))/gi;
+const KEYED = new Set(["assigned-secret", "assigned-secret-bare", "assigned-password", "env-password", "config-password",
+  "dockerfile-env-password"]);
 
 const KEY_END = new RegExp(`-----END ${PRIVATE_KEY}`);
 
@@ -92,8 +109,9 @@ export function scan(text) {
   let next = 0;
   lines.forEach((line, i) => {
     while (next < ends.length && ends[next] < i + 1) next += 1;
+    const keyed = line.replace(SECRET_FILE_PATH, "$1-");
     for (const [kind, re] of PATTERNS) {
-      if (!re.test(line)) continue;
+      if (!re.test(KEYED.has(kind) ? keyed : line)) continue;
       hits.push(kind === "private-key" ? { line: i + 1, kind, end: ends[next] ?? null } : { line: i + 1, kind });
     }
     if (highEntropy(line)) hits.push({ line: i + 1, kind: "high-entropy" });
@@ -114,7 +132,13 @@ function main(argv) {
     process.stderr.write(`payload-scan: cannot read ${file}: ${e.code ?? e.message}\n`);
     return 2;
   }
-  const result = scan(text);
+  let result;
+  try {
+    result = scan(text);
+  } catch (e) {
+    process.stderr.write(`payload-scan: cannot scan ${file}: ${e.message}\n`);
+    return 2;
+  }
   process.stdout.write(JSON.stringify({ file, ...result }, null, 2) + "\n");
   return result.count === 0 ? 0 : 1;
 }

package/skills/ralph-qa/references/verifier-probe.mjs

@@ -2,8 +2,9 @@
 /**
  * verifier-probe: which external CLI seats ralph-qa can seat, and with which model,
  * worked out from this machine alone. It sends no HTTP request and no prompt itself. The
- * only child processes are `codex --version`, `codex debug models --bundled` and
- * `opencode --version`, the last with opencode's model-list refresh turned off.
+ * only child processes are `codex --version` and `codex debug models --bundled`; it starts no
+ * gemini and no opencode (opencode 1.3.10 empties its cache folder, the models.dev copy the probe
+ * reads too, on any start that finds the folder's version file missing or old).
  *
  *   node verifier-probe.mjs --runtime=claude|codex [--codex[=<model>]] [--gemini[=<model>]] [--opencode[=<provider/model>]]
  *
@@ -187,21 +188,20 @@ export const DECISION_REASONS = [
 
 export const CLI_DEFAULT = "@cli-default";
 
-// opencode refreshes its models.dev list on every start, `--version` included, unless told not to.
-const OPENCODE_QUIET = { OPENCODE_DISABLE_MODELS_FETCH: "1", OPENCODE_DISABLE_AUTOUPDATE: "1" };
-
 const firstLine = (res) => (res?.status === 0 ? String(res.stdout).trim().split("\n")[0] || null : null);
 const absent = (cli) => ({ cli, present: false, decision: "unseated", reason: "cli-absent" });
 const adopt = (seat, model, reason) => ({ ...seat, decision: "adopt", model, reason });
 const withNotes = (seat, notes) => (notes.length ? { ...seat, notes: [...new Set([...(seat.notes ?? []), ...notes])] } : seat);
 
-// TOML keys: bare, "basic" or 'literal', dotted with optional spaces (`a."b.c" . d`).
+// TOML keys: bare, "basic" or 'literal', dotted with optional spaces (`a."b.c" . d`). TOML ends a
+// line only at \n or \r\n, so `.` runs over U+2028 and U+2029 too (the s flag): without it a
+// comment holding one hid a header or a key that codex reads.
 const KEY_SEG = String.raw`(?:"(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_-]+)`;
 const KEY_PATH = String.raw`${KEY_SEG}(?:\s*\.\s*${KEY_SEG})*`;
-const HEADER_RE = new RegExp(String.raw`^\s*\[(\[?)\s*(${KEY_PATH})\s*\]\]?\s*(?:#.*)?$`);
-const ASSIGN_RE = new RegExp(String.raw`^\s*(${KEY_PATH})\s*=\s*(.*)$`);
-const SEG_RE = /"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+)/g;
-const STRING_VALUE = /^(?:"((?:[^"\\]|\\.)*)"|'([^']*)')\s*(?:#.*)?$/;
+const HEADER_RE = new RegExp(String.raw`^\s*\[(\[?)\s*(${KEY_PATH})\s*\]\]?\s*(?:#.*)?$`, "s");
+const ASSIGN_RE = new RegExp(String.raw`^\s*(${KEY_PATH})\s*=\s*(.*)$`, "s");
+const SEG_RE = /"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+)/gs;
+const STRING_VALUE = /^(?:"((?:[^"\\]|\\.)*)"|'([^']*)')\s*(?:#.*)?$/s;
 
 // A dotted key's segments, quotes taken off (escapes kept as written).
 const keyPath = (text) => [...text.matchAll(SEG_RE)].map((m) => m[1] ?? m[2] ?? m[3]);
@@ -209,7 +209,7 @@ const keyPath = (text) => [...text.matchAll(SEG_RE)].map((m) => m[1] ?? m[2] ??
 // The walk's state: where it is (open string, nesting depth, table, array being gathered) and
 // what it found so far.
 const tomlState = () => ({ values: {}, arrays: {}, mcpServers: new Set(), mcpUnread: false, modelKeys: false,
-  open: null, depth: 0, table: [], roots: new Set(), array: null });
+  open: null, depth: 0, table: [], roots: new Set(), array: null, unplaced: false });
 
 // The index just past the one-line string that opens at `i` (the line's end when it never closes).
 function stringEnd(text, i) {
@@ -279,8 +279,9 @@ function noteMcp(state, full) {
 // True when a key path ends in `model`, or its inline-table value sets one.
 const setsModel = (full, value) => full[full.length - 1] === "model" || (value.startsWith("{") && /[{,]\s*model\s*=/.test(value));
 
-// The strings of a top-level array, gathered line by line until it closes; comments aside.
-const ARRAY_ITEM = /"((?:[^"\\]|\\.)*)"|'([^']*)'|#.*/g;
+// The strings of a top-level array, gathered line by line until it closes; comments aside. The
+// gathered text spans lines, so a comment ends at the line's end, U+2028 and U+2029 inside it.
+const ARRAY_ITEM = /"((?:[^"\\]|\\.)*)"|'([^']*)'|#[^\r\n]*/gs;
 function gatherArray(state, text) {
   if (!state.array) return;
   state.array.text += text + "\n";
@@ -312,7 +313,9 @@ function enterTable(state, header) {
 }
 
 // One line of readToml into `state`: walked inside a multi-line string, array or inline table
-// (a `model =` there still counts), else a table header or a `key = value`.
+// (a `model =` there still counts), else a table header or a `key = value`. Any other line but
+// a comment or a blank one is a line the probe could not place (a key it cannot spell, such as a
+// non-ASCII bare key), and the read is not whole.
 function tomlLine(state, line) {
   if (state.open || state.depth > 0) {
     if (!state.open && /(?:^|[{,])\s*model\s*=/.test(line)) state.modelKeys = true;
@@ -323,7 +326,8 @@ function tomlLine(state, line) {
   const header = HEADER_RE.exec(line);
   if (header) return enterTable(state, header);
   const assign = ASSIGN_RE.exec(line);
-  if (assign) assignment(state, keyPath(assign[1]), assign[2]);
+  if (assign) return assignment(state, keyPath(assign[1]), assign[2]);
+  if (!/^\s*(?:#|$)/.test(line)) state.unplaced = true;
 }
 
 // The servers each [mcp_servers] header in the text names when the lines after it are walked
@@ -356,9 +360,9 @@ const rawMcpNames = (lines) => lines.filter((l) => !/^\s*#/.test(l))
 // the first segment of every key and table (`roots`), the MCP server names wherever they are
 // defined (table headers, under [mcp_servers], dotted keys), whether servers were written in a
 // form it does not list or that the text names beyond what it listed (`mcpUnread`), whether any
-// table sets a model (`modelKeys`) and whether a multi-line string, array or inline table was
-// left open, and the strings of each top-level array (`arrays`). Enough for those keys; not a
-// TOML parser.
+// table sets a model (`modelKeys`), whether a multi-line string, array or inline table was left
+// open or a line could not be placed (`broken`), and the strings of each top-level array
+// (`arrays`). Enough for those keys; not a TOML parser.
 export function readToml(text) {
   const state = tomlState();
   const lines = String(text ?? "").split(/\r?\n/);
@@ -371,7 +375,7 @@ export function readToml(text) {
     mcpServers: [...state.mcpServers],
     mcpUnread: state.mcpUnread || unlisted.length > 0,
     modelKeys: state.modelKeys,
-    broken: state.open !== null || state.depth > 0,
+    broken: state.open !== null || state.depth > 0 || state.unplaced,
   };
 }
 
@@ -509,7 +513,7 @@ function mcpBlockedSeat(seat, conf, notes) {
   if (!bad && !conf.mcpUnread && !conf.broken) return null;
   if (bad) notes.push(`${bad} MCP server name(s) hold characters \`-c mcp_servers.<name>.enabled=false\` cannot address: rename them to letters, digits, _ and -`);
   if (conf.mcpUnread) notes.push("the probe could not list every MCP server the codex config defines (one inline mcp_servers table, or a name its walk did not place): write each server as its own [mcp_servers.<name>] table");
-  if (conf.broken) notes.push("the probe could not read the codex config to its end (a multi-line string, array or inline table left open), so its list of MCP servers may be short");
+  if (conf.broken) notes.push("the probe could not read the codex config to its end (a multi-line string, array or inline table left open, or a line it could not place), so its list of MCP servers may be short");
   return { ...seat, decision: "unseated", reason: "cli-call-failed" };
 }
 
@@ -519,12 +523,14 @@ function mcpBlockedSeat(seat, conf, notes) {
 const SEAT_KEYS = ["notify", "otel", "mcp_servers", "web_search", "tools", "analytics", "features", "hooks",
   "sandbox_mode", "sandbox_workspace_write", "approval_policy"];
 
-// The unseated seat when the managed file sets one of those keys; null otherwise.
+// The unseated seat when the managed file sets one of those keys, or could not be read to its
+// end (a line read short may set one); null otherwise.
 function managedBlockedSeat(seat, world, notes) {
   if (world.platform === "win32") return null;
-  const keys = readToml(world.readFile(CODEX_MANAGED)).roots.filter((k) => SEAT_KEYS.includes(k));
-  if (!keys.length) return null;
-  notes.push(`${CODEX_MANAGED} sets ${keys.join(", ")}, which codex applies over the seat's -c flags: the seat cannot hold its guards`);
+  const read = readToml(world.readFile(CODEX_MANAGED));
+  const keys = read.roots.filter((k) => SEAT_KEYS.includes(k));
+  if (!keys.length && !read.broken) return null;
+  notes.push(`${CODEX_MANAGED} ${keys.length ? `sets ${keys.join(", ")}` : "could not be read to its end"}, which codex applies over the seat's -c flags: the seat cannot hold its guards`);
   return { ...seat, decision: "unseated", reason: "cli-call-failed" };
 }
 
@@ -696,17 +702,21 @@ function geminiStatsNotes(settings) {
   return set === false ? [] : ["gemini sends usage statistics (metadata, not the payload) to play.googleapis.com; set privacy.usageStatisticsEnabled to false in its settings to stop it"];
 }
 
-// gemini runs the hooks its settings define in every session, this seat too; no flag turns them off.
-// gemini's own sandbox (tools.sandbox, or GEMINI_SANDBOX, which wins) restarts gemini in a docker or
-// podman container that the admin policy file does not reach, so every tool opens (0.62.0). The
-// seat command turns it off with GEMINI_SANDBOX=false; this says so when it is on.
+// gemini's own sandbox (tools.sandbox, or GEMINI_SANDBOX, which wins) restarts gemini inside it: a
+// docker or podman container, or sandbox-exec on macOS when the value is true. The admin policy
+// file does not reach a container, so every tool opens (0.62.0). The seat command turns it off
+// with GEMINI_SANDBOX=false; this says so when it is on. gemini reads "0" and "false" as off, the
+// env lower-cased and trimmed, the setting as written: "FALSE" there is no off value but a sandbox
+// command gemini does not know, and it stops (Invalid sandbox command). The seat's env goes first.
 function geminiSandboxNotes(settings, env) {
+  const off = (v) => v === "0" || v === "false";
   const fromEnv = String(env.GEMINI_SANDBOX ?? "").trim().toLowerCase();
   const set = settings.map((r) => r.value?.tools?.sandbox).find((v) => v !== undefined);
-  const on = fromEnv ? !["0", "false"].includes(fromEnv) : Boolean(set && (typeof set !== "object" || set.enabled));
+  const on = fromEnv ? !off(fromEnv) : Boolean(set && !off(set) && (typeof set !== "object" || set.enabled));
   return on ? ["gemini's own sandbox is on (tools.sandbox or GEMINI_SANDBOX): the seat command turns it off with GEMINI_SANDBOX=false, as the admin policy does not reach its container"] : [];
 }
 
+// gemini runs the hooks its settings define in every session, this seat too; no flag turns them off.
 function geminiHookNotes(settings) {
   const off = settings.some((r) => r.value?.hooksConfig?.enabled === false);
   const hooks = settings.some((r) => Object.keys(r.value?.hooks ?? {}).length > 0);
@@ -816,13 +826,12 @@ function opencodeDecision(seat, { configured, unsure, closed, catalog }) {
 function opencodeSeat(flag, { world, authorFamilies }) {
   if (!world.which("opencode")) return absent("opencode");
   const notes = [];
-  const version = firstLine(world.run("opencode", ["--version"], OPENCODE_QUIET));
   const cfg = opencodeConfig(world);
   const { configured: raw, models } = opencodeModels(cfg);
   const usable = safeOnly(models, "opencode config", notes);
   const configured = vetConfigured(usable.includes(raw) ? raw : null, authorFamilies, notes);
   const sorted = sortModels(usable, authorFamilies);
-  const seat = { cli: "opencode", present: true, version, configured, candidates: sorted.independent, unclassified: sorted.unclassified };
+  const seat = { cli: "opencode", present: true, configured, candidates: sorted.independent, unclassified: sorted.unclassified };
   notes.push(...cfg.unreadable.map((f) => `config not readable: ${f}`));
   if (world.env.OPENCODE_CONFIG_CONTENT) notes.push("$OPENCODE_CONFIG_CONTENT is not read: the seat command replaces it with its own reviewer agent");
   const catalog = catalogProviders(world);