@khalilgharbaoui/opencode-claude-code-plugin 0.33.0 → 0.33.2

package/README.md

@@ -21,7 +21,7 @@ Three ways to reach Claude from opencode. They differ in who authenticates, who
 | **Authentication** | An Anthropic Platform API key, held in opencode's own auth store. | Whatever the official `claude` CLI already holds: a subscription login, an API key, Bedrock, or Vertex. The plugin never reads, stores, or replays a token of its own, and there is no subscription token here to lift. | The Claude OAuth session, used outside the official client. Meridian runs a local proxy that maps Anthropic-style HTTP onto the Claude Agent SDK and your Claude session; `opencode-claude-auth` reads the OAuth tokens out of the macOS Keychain or `~/.claude/.credentials.json` and refreshes them against Anthropic's OAuth endpoint itself. |
 | **What is billed, and to whom** | Pay as you go on the Platform account that owns the key. | Whatever the CLI's own authentication bills. Headless `--print` is the Agent SDK path; an API key found anywhere the CLI looks switches the same turn onto Console pay-as-you-go instead. `apiKeySource` on the CLI's `system` init event is the field that says which, and the plugin warns once per process when a key is in effect. On a subscription, headless and interactive turns both draw from the plan's ordinary usage limits. See [which login bills what](#which-login-bills-what). | The subscription the reused session belongs to. Meridian's own FAQ: "Usage limits follow your Max subscription, not Anthropic API billing tiers." |
 | **Terms-of-service status** | The ordinary API route. Nothing unusual about it. | Sanctioned: the official client does the authenticating, and driving `claude` is what `claude` is for. | Disallowed. Anthropic disallowed reusing subscription authentication for third-party Claude use in February 2026, and each project says so in its own words: Meridian's wrapper "makes no claims regarding compliance with Anthropic's Terms of Service"; `opencode-claude-auth` calls itself "a community workaround" and notes that the terms say subscription tokens "should only be used with official Anthropic clients"; `opencode-claude-plan` quotes Consumer Terms 3.7 and asks you to accept that your account "could be suspended or terminated". |
-| **Model list and fast mode** | Whatever opencode's own provider registers. | 17 ids auto-registered, Haiku 4.5 through Opus 5.5 plus Fable and Mythos, each carrying a `(N×)` list-price suffix, and any other id `claude --model` accepts passes straight through. Three `-fast` Opus ids are this plugin's own markers and opt a headless session into fast mode through `--settings` (CLI 2.1.220+). See [Models](#models). | `opencode-claude-auth`'s README lists 14 model ids. Meridian's lists none, because model metadata comes from opencode's own `anthropic` provider. Neither README mentions fast mode. |
+| **Model list and fast mode** | Whatever opencode's own provider registers. | 18 ids auto-registered, Haiku 4.5 through Opus 5.5 plus Fable and Mythos, each carrying a `(N×)` list-price suffix, and any other id `claude --model` accepts passes straight through. Three `-fast` Opus ids are this plugin's own markers and opt a headless session into fast mode through `--settings` (CLI 2.1.220+). See [Models](#models). | `opencode-claude-auth`'s README lists 14 model ids. Meridian's lists none, because model metadata comes from opencode's own `anthropic` provider. Neither README mentions fast mode. |
 | **Which tools run where, under whose permissions** | All of them are opencode's, behind opencode's permission prompts and audit log. | Your choice, per tool. `Bash`, `Edit`, `Write`, `WebFetch` and `Task` are proxied by default: Claude calls an in-process MCP tool and **opencode** executes it, under its own permissions and audit log. Anything neither proxied nor named in `extraDisallowedTools` runs inside Claude Code under `--dangerously-skip-permissions`. See [Selective tool proxy](#selective-tool-proxy) and [Read-only mode](#read-only-mode). | All of them are opencode's, because the model call is an ordinary provider call. This is the one row where the third column matches the native provider and this plugin has to work for the same result. |
 | **Reasoning and effort** | opencode's own reasoning controls. | Five picker variants per model, `low` through `max`, handed to the CLI as `CLAUDE_CODE_EFFORT_LEVEL` at spawn. Effort is fixed for the life of a `claude` process, so it is part of the session key, and an agent's own `reasoningEffort` beats the effort a call arrived with. Thinking is Anthropic's summarized digest, not raw chain-of-thought. See [Extended thinking](#extended-thinking). | Meridian's SDK-features file exposes a `thinking` key. Neither README documents per-model effort variants. |
 | **Context window** | Whatever the model exposes. | The registered limits: 200k context / 64k output on the 4.5 generation, 1M / 128k on 4.6 and later, all at standard pricing with no above-200K tier. Claude Code may also compact or clear its own context mid-conversation, which the plugin can announce but not prevent. | Not stated in either README. |
@@ -102,7 +102,7 @@ The same package runs on opencode 1.x and 2.x, and nothing changes for 1.x. The
 }
 ```
 
-Your existing `provider.claude-code.options` block keeps working, because opencode 2 still reads 1.x config files. Its native spelling is `provider.claude-code.settings`, and plugin-level settings such as `accounts` may also go in the plugin entry itself: `{"package": "@khalilgharbaoui/opencode-claude-code-plugin", "options": {"accounts": ["work"]}}`.
+Your existing `provider.claude-code.options` block keeps working, because opencode 2 still reads 1.x config files. opencode 2's own spelling is `providers.claude-code.settings` (note the plural `providers`). All four places the plugin reads its settings from, lowest precedence first: `provider.claude-code.options`, `provider.claude-code.settings`, `providers.claude-code.settings`, and the plugin entry's own `options`, which wins over all of them. Plugin-level settings such as `accounts` usually go in that last one: `{"package": "@khalilgharbaoui/opencode-claude-code-plugin", "options": {"accounts": ["work"]}}`.
 
 For a local checkout, point opencode 2 at the **`dist` directory**, not the repository root. It loads `<dir>/server` or `<dir>/index` from a directory and never reads `package.json#main`:
 
@@ -470,7 +470,7 @@ reaches the CLI, so there is nothing there to fall back from.
 | `strictMcpConfig` | boolean | `false` | Pass `--strict-mcp-config` so Claude loads **only** the configured servers and ignores `~/.claude/settings.json`. |
 | `hotReloadMcp` | boolean | `true` | With MCP bridging on, compare the merged MCP config and runtime status at the start of each turn and respawn the `claude` process when they drifted, so a server you just enabled or disabled becomes visible without restarting opencode or opening a new chat. Eviction waits for pending proxy calls, never happening mid tool-call, and the session id is preserved for `--resume`. Set `false` to keep a cached subprocess until the chat is reset. It does not reload other provider options and does not watch the contents of files named in `mcpConfig`. |
 | `proxyOpencodeMcpTools` | boolean | `false` | Route opencode's MCP-backed tools through the in-process `opencode_proxy` server instead of bridging them straight into Claude's `--mcp-config`, so each call executes once, inside opencode, with its permission prompt and its tool row. **The default changed from `true` to `false` in this release, and no behaviour changed with it:** at `true` it used to route nothing at all, because discovery read opencode's tool registry, which contains built-ins and plugin-declared tools and has never contained an MCP tool. Discovery now reads the model tool set opencode passes the provider, which is where MCP tools actually are, so the option works, and turning it on is the operator's decision rather than a silent migration of traffic that the direct bridge is handling today. Two caveats before enabling it: pair it with `strictMcpConfig: true`, because a server also registered in Claude Code's own config is reached directly and bypasses the proxy entirely; and a routed call runs in opencode with the calling agent's permissions, the same trade [`proxyOpencodeTools`](#options-reference) makes. Servers whose tools are not found stay on the direct bridge, and a warning says so, so do not treat this as an exactly-once guarantee for write-capable tools. |
-| `proxyOpencodeTools` | string[] | `[]` | Forward named opencode tools through the proxy by their registry id, for tools another opencode plugin declares directly and that therefore belong to no MCP server (opencode-dcp's `compress`). Explicit allowlist; a forwarded tool runs inside opencode with the calling agent's permissions. A name already held by a proxy def is dropped with a warning rather than taking it over. See [Forwarding opencode's own tools](#forwarding-opencode-s-own-tools). |
+| `proxyOpencodeTools` | string[] | `[]` | Forward explicitly named opencode tools through the proxy (for example, a plugin's `compress` or V2 Code Mode `execute`). V1 uses registry ids; V2 uses the current model tool snapshot, including its real JSON Schema and agent visibility, not the registry's empty schemas. A forwarded tool runs inside opencode with the calling agent's permissions. A name already held by a proxy def is dropped with a warning. The read-only preset refuses `execute`. See [Forwarding opencode's own tools](#forwarding-opencode-s-own-tools) and [V2 Code Mode](#v2-code-mode). |
 | `stripContextReminders` | boolean | `false` | Remove opencode-dcp's `<dcp-system-reminder>` blocks from message text when no `compress` tool is proxied, so an order the model cannot follow stops being re-sent with every message that carries it. Inert as soon as `compress` is reachable. See [Trimming unsatisfiable context reminders](#trimming-unsatisfiable-context-reminders). |
 | `webSearch` | `"claude"` \| `"disabled"` \| `<tool>` | `"claude"` | Routing for Claude's built-in `WebSearch`. See [WebSearch routing](#websearch-routing). |
 | `multiStepContinuation` | boolean | `true` | Append a system-prompt hint nudging Claude to chain tool calls within one turn instead of pausing between subtasks. Each opencode turn boundary requires the user to manually press "continue", so for multi-step tasks this reduces friction. Set `false` to disable. |
@@ -1063,16 +1063,39 @@ Claude Code ships a built-in `WebSearch` tool. The `webSearch` option controls w
 
 ## MCP bridge
 
-If `bridgeOpencodeMcp` is true (the default), the plugin reads your opencode config's `mcp` block, translates it into Claude's MCP schema, writes it to a temp file, and passes that to `claude --mcp-config`. So whatever MCP servers you've already configured in opencode become available to Claude with no extra setup.
+If `bridgeOpencodeMcp` is true (the default), the plugin reads your opencode config's MCP servers, translates them into Claude's MCP schema, writes a private temp file, and passes it to `claude --mcp-config`. It accepts V1 `mcp.<server>` and V2 `mcp.servers.<server>`; V2's `servers` container and timeout defaults are not servers. `disabled: true` is supported alongside legacy `enabled: false`. Live runtime status takes precedence when available.
 
-### Discovery order (highest to lowest priority)
+### Discovery and precedence
 
-1. `OPENCODE_CONFIG` env var (file path)
-2. `OPENCODE_CONFIG_DIR` env var
-3. Walk up from the current `cwd` looking for `opencode.jsonc`, `opencode.json`, `config.json`, or a `.opencode/` directory
-4. Global `$XDG_CONFIG_HOME/opencode` or `~/.config/opencode`
+The disk bridge reads global config, then `OPENCODE_CONFIG`, then project direct files and `.opencode` files. V1 keeps its existing repo-boundary discovery, `.opencode` ordering and per-server deep merges.
 
-Later sources override earlier ones **by server name**, so a project-level MCP server replaces a global one with the same id.
+On V2, project discovery walks to the filesystem root (including ancestors above the repo). Direct files are applied parent-first, then `.opencode` files parent-first: the closest file wins within each group, and all `.opencode` files override direct files. Each higher-precedence server entry **replaces the entire server object**, so repeat its type, URL/command and other required fields in an override. Both `.json` and `.jsonc` are read, with `.jsonc` winning within a directory. Runtime toggles continue to participate in the hot-reload hash.
+
+### V2 Code Mode
+
+V2 normally exposes MCP tools through Code Mode's `execute` and its catalog, rather than as individual server-prefixed model tools. `proxyOpencodeMcpTools` matches individual tools only; on a Code Mode-only snapshot it warns and falls back to the direct Claude MCP bridge. This fallback does **not** execute tools under opencode's permission policy.
+
+To explicitly opt into Code Mode through opencode instead, use these provider settings (headless transport):
+
+```json
+{
+  "providers": {
+    "claude-code": {
+      "settings": {
+        "proxyOpencodeTools": ["execute"],
+        "bridgeOpencodeMcp": false,
+        "strictMcpConfig": true
+      }
+    }
+  }
+}
+```
+
+Preserve other entries in `proxyOpencodeTools`. `execute` is a code runner that can call **all tools in the session's Code Mode catalog**, not just MCP; opting in must be deliberate. It runs in opencode with the calling agent's permissions, and the plugin refuses it under `permissionPreset: "read-only"`. The plugin preserves the model-visible schema and tells Claude to call `mcp__opencode_proxy__execute` (discoverable via `ToolSearch`), using the original `search(...)` and `tools[...]` catalog signatures inside its code argument.
+
+`bridgeOpencodeMcp: false` prevents a second direct MCP connection, while `strictMcpConfig: true` excludes Claude's own MCP sources. Do not add the same servers through explicit `mcpConfig` if you want Code Mode-only routing. OpenCode still owns the MCP connections; disabling the disk bridge does not disable its catalog.
+
+For individual MCP proxies instead, set `codemode: false` on the relevant V2 MCP servers, then use `proxyOpencodeMcpTools: true` with `strictMcpConfig: true`. Neither approach guarantees exactly-once side effects across retries. Fully restart all opencode server/GUI processes after changing provider settings or plugin code; a new chat alone is insufficient. Real Claude smoke tests consume usage and run configured hooks, so request approval first.
 
 ### Translation
 
@@ -1636,7 +1659,7 @@ This plugin absorbs work from its forks directly, cherry-picked with the origina
 | [@willmcginnis](https://github.com/willmcginnis) | The proxy endpoint authentication (PR #28, GHSA-3mxm-w7gf-3c5x). | PR #28 |
 | [@nic-lan](https://github.com/nic-lan) | The issue #29 diagnosis of subagent output lost across the CLI resume boundary, and the fix for unattended output replaying as one text block per delta (PR #35). | #29, PR #35 |
 | [@acastro2](https://github.com/acastro2) (Alexandre Castro) | Found and fixed CLI tool results being emitted under a different name than their call, which made opencode 2 abort every turn that used a Claude-side MCP server (PR #46). | PR #46 |
-| [@bangnh1](https://github.com/bangnh1) | Independently found and diagnosed the turn-summed usage that tripped auto-compaction after a single prompt, measured on opencode 2 (PR #62; the fix landed as PR #63). | PR #62 |
+| [@bangnh1](https://github.com/bangnh1) | Independently found and diagnosed the turn-summed usage that tripped auto-compaction after a single prompt, measured on opencode 2 (PR #62; the fix landed as PR #63), and fixed opencode 2's MCP config layout (`mcp.servers`, `disabled`, `providers.<id>.settings`) with opt-in Code Mode `execute` proxying (PR #67). | PR #62, PR #67 |
 | [@JWebCoder](https://github.com/JWebCoder) (joao moura) | Diagnosed that auto-continue never fires on current CLIs (PR #15). | PR #15 |
 
 Commit hashes are on the contributors' forks where the work was cherry-picked; `git log --author` on this repo shows the preserved authorship.

package/dist/index.d.ts

@@ -1230,6 +1230,7 @@ declare class ClaudeCodeLanguageModel implements LanguageModelV3 {
     private doStreamForHost;
 }
 
+type McpHostApi = "v1" | "v2";
 interface BridgedMcp {
     /** Path to the temp file containing the translated `--mcp-config`. */
     path: string;
@@ -1270,7 +1271,7 @@ type RuntimeMcpStatus = Record<string, string>;
  * return its path + a stable hash. Returns null when no enabled MCP servers
  * remain after the merge + overlay.
  */
-declare function bridgeOpencodeMcp(cwd: string, runtimeStatus?: RuntimeMcpStatus, excludeServers?: ReadonlySet<string>): BridgedMcp | null;
+declare function bridgeOpencodeMcp(cwd: string, runtimeStatus?: RuntimeMcpStatus, excludeServers?: ReadonlySet<string>, hostApi?: McpHostApi): BridgedMcp | null;
 
 type AgentRecord = {
     mode?: string;

package/dist/index.js

@@ -2434,7 +2434,9 @@ function resolveDisallowedTools(options) {
 function resolveProxyOpencodeToolDefs(options) {
   const requested = options.requested ?? [];
   if (requested.length === 0) return [];
-  const items = options.items;
+  const items = options.modelTools !== void 0 ? options.modelTools.flatMap(
+    (tool) => (tool.type === void 0 || tool.type === "function") && typeof tool.name === "string" ? [{ id: tool.name, description: tool.description, parameters: tool.inputSchema }] : []
+  ) : options.items;
   if (!items) {
     log.warn(
       "proxyOpencodeTools is set but opencode's tool registry did not answer; forwarding nothing this spawn",
@@ -2460,12 +2462,20 @@ function resolveProxyOpencodeToolDefs(options) {
       unknown.push(name);
       continue;
     }
+    if (item.id === "execute" && options.allowCodeExecution === false) {
+      log.warn("Code Mode execute not forwarded: read-only permission preset");
+      continue;
+    }
     if (taken.has(item.id)) {
       collided.push(item.id);
       continue;
     }
     if (seen.has(item.id)) continue;
     seen.add(item.id);
+    if (item.id === "execute" && (!item.parameters || typeof item.parameters !== "object" || Array.isArray(item.parameters) || !Object.keys(item.parameters).length)) {
+      log.warn("Code Mode execute not forwarded: no model-visible input schema");
+      continue;
+    }
     out.push({
       name: item.id,
       description: typeof item.description === "string" ? item.description : "",
@@ -2502,6 +2512,7 @@ function resolveMcpProxyToolDefs(options) {
     if (tool?.type !== void 0 && tool.type !== "function") continue;
     const name = typeof tool?.name === "string" ? tool.name.trim() : "";
     if (!name) continue;
+    if (name === "execute") continue;
     const matchedServer = serversByLengthDesc.find(
       (server2) => name === server2 || name.startsWith(`${server2}_`)
     );
@@ -4709,24 +4720,24 @@ function globalConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME ?? path4.join(os2.homedir(), ".config");
   return path4.join(xdg, "opencode");
 }
-function loadGlobalConfig() {
+function loadGlobalConfig(hostApi = "v1") {
   const dir = globalConfigDir();
   let merged = {};
   for (const name of FILE_NAMES.slice().reverse()) {
     const file = path4.join(dir, name);
     if (!fileExists(file)) continue;
     const parsed = readAndParse(file);
-    if (parsed) merged = deepMerge(merged, parsed);
+    if (parsed) merged = mergeConfigLayer(merged, parsed, hostApi);
   }
   return merged;
 }
-function loadProjectFilesInDir(dir) {
+function loadProjectFilesInDir(dir, hostApi = "v1") {
   let merged = {};
   for (const name of PROJECT_FILE_NAMES) {
     const file = path4.join(dir, name);
     if (!fileExists(file)) continue;
     const parsed = readAndParse(file);
-    if (parsed) merged = deepMerge(merged, parsed);
+    if (parsed) merged = mergeConfigLayer(merged, parsed, hostApi);
   }
   return merged;
 }
@@ -4813,8 +4824,29 @@ function translateServer(name, spec) {
 }
 function extractMcpBlock(config) {
   const mcp = config.mcp;
-  if (!mcp || typeof mcp !== "object" || Array.isArray(mcp)) return {};
-  return mcp;
+  if (!isPlainObject(mcp)) return {};
+  if ("servers" in mcp && !isPlainObject(mcp.servers)) return {};
+  const native = isPlainObject(mcp.servers) && typeof mcp.servers.type !== "string" && typeof mcp.servers.enabled !== "boolean" && typeof mcp.servers.disabled !== "boolean";
+  const block = native ? mcp.servers : mcp;
+  return Object.fromEntries(
+    Object.entries(block).filter(([name, spec]) => isPlainObject(spec) && (native || name !== "timeout" || typeof spec.type === "string")).map(([name, spec]) => {
+      const server2 = spec;
+      return [name, {
+        ...server2,
+        ...typeof server2.disabled === "boolean" ? { enabled: !server2.disabled } : {}
+      }];
+    })
+  );
+}
+function mergeConfigLayer(target, source, hostApi) {
+  const merged = deepMerge(target, source);
+  if (hostApi === "v2" && isPlainObject(source.mcp)) {
+    merged.mcp = {
+      ...isPlainObject(merged.mcp) ? merged.mcp : {},
+      servers: { ...extractMcpBlock(target), ...extractMcpBlock(source) }
+    };
+  }
+  return merged;
 }
 function mergeMcp(target, source) {
   const out = { ...target };
@@ -4832,12 +4864,12 @@ function mergeMcp(target, source) {
   }
   return out;
 }
-function bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers) {
+function bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, hostApi = "v1") {
   const {
     servers: merged,
     enabledServerNames: allEnabledServerNames,
     hash
-  } = mergeOpencodeMcp(cwd, runtimeStatus);
+  } = mergeOpencodeMcp(cwd, runtimeStatus, hostApi);
   const servers = {};
   const bridgedServerNames = [];
   for (const [name, spec] of Object.entries(merged)) {
@@ -4857,10 +4889,10 @@ function bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers) {
     excludeServers
   });
 }
-function opencodeConfigLayers(cwd) {
-  const worktree = detectWorktree(cwd);
+function opencodeConfigLayers(cwd, hostApi = "v1") {
+  const worktree = hostApi === "v2" ? void 0 : detectWorktree(cwd);
   const layers = [];
-  layers.push(loadGlobalConfig());
+  layers.push(loadGlobalConfig(hostApi));
   const explicitConfig = process.env.OPENCODE_CONFIG;
   if (explicitConfig && fileExists(explicitConfig)) {
     const parsed = readAndParse(explicitConfig);
@@ -4882,22 +4914,30 @@ function opencodeConfigLayers(cwd) {
     }
   }
   for (const dir of projectDirs.slice().reverse()) {
-    layers.push(loadProjectFilesInDir(dir));
+    layers.push(loadProjectFilesInDir(dir, hostApi));
   }
-  for (const dir of dotOpencodeDirs(cwd, worktree)) {
-    layers.push(loadProjectFilesInDir(dir));
+  if (hostApi === "v2") {
+    const dirs = walkUp({ start: cwd, targets: [".opencode"], predicate: dirExists }).reverse();
+    const extra = process.env.OPENCODE_CONFIG_DIR;
+    if (extra && dirExists(extra)) layers.push(loadProjectFilesInDir(extra, hostApi));
+    for (const dir of dirs) layers.push(loadProjectFilesInDir(dir, hostApi));
+  } else {
+    for (const dir of dotOpencodeDirs(cwd, worktree)) {
+      layers.push(loadProjectFilesInDir(dir));
+    }
   }
   return layers;
 }
-function loadMergedOpencodeConfig(cwd) {
+function loadMergedOpencodeConfig(cwd, hostApi = "v1") {
   let merged = {};
-  for (const layer of opencodeConfigLayers(cwd)) merged = deepMerge(merged, layer);
+  for (const layer of opencodeConfigLayers(cwd, hostApi)) merged = mergeConfigLayer(merged, layer, hostApi);
   return merged;
 }
-function mergeOpencodeMcp(cwd, runtimeStatus) {
+function mergeOpencodeMcp(cwd, runtimeStatus, hostApi = "v1") {
   let merged = {};
-  for (const layer of opencodeConfigLayers(cwd)) {
-    merged = mergeMcp(merged, extractMcpBlock(layer));
+  for (const layer of opencodeConfigLayers(cwd, hostApi)) {
+    const servers = extractMcpBlock(layer);
+    merged = hostApi === "v2" ? { ...merged, ...servers } : mergeMcp(merged, servers);
   }
   if (runtimeStatus) {
     for (const name of Object.keys(merged)) {
@@ -5037,7 +5077,8 @@ function collectStartupDiagnostics(providers, opencodeVersion) {
   const cwd = describeSpawnCwd(firstOption(providers, "cwd"));
   let mcpServers = [];
   try {
-    mcpServers = mergeOpencodeMcp(cwd.resolved).enabledServerNames;
+    const hostApi = firstOption(providers, "hostApi") === "v2" || opencodeVersion?.replace(/^v/, "").startsWith("2.") ? "v2" : "v1";
+    mcpServers = mergeOpencodeMcp(cwd.resolved, void 0, hostApi).enabledServerNames;
   } catch (err) {
     log.debug("startup diagnostics could not read MCP config", {
       error: err instanceof Error ? err.message : String(err)
@@ -7609,6 +7650,13 @@ Structured questions in this environment go through exactly one tool: \`mcp__ope
 - If that tool is not in your visible tool list it is deferred \u2014 load it with ToolSearch (\`select:mcp__opencode_proxy__question\`), then call it by its FULL name.
 - Do NOT call bare \`question\` \u2014 that is not a tool. Always use the full \`mcp__opencode_proxy__question\` name when invoking it.
 - Claude Code's built-in \`AskUserQuestion\` is disabled in this environment; the proxy is the only way to ask structured questions.`;
+function codeModeProxyHint(active) {
+  return active ? `## opencode Code Mode
+
+Instructions referring to the execute tool mean \`mcp__opencode_proxy__execute\` in this Claude Code session. Use its full name; if deferred, load it with ToolSearch (\`select:mcp__opencode_proxy__execute\`). Pass the code argument unchanged, using the provided catalog's exact \`search(...)\` and \`tools[...]\` signatures inside that code. The catalog tools are not separate Claude tools. Calls execute in opencode under this session's permissions.` : `## opencode Code Mode unavailable
+
+The forwarded opencode catalog may mention execute, but this session does not expose an execute proxy. Do not invent an execute tool or claim a catalog call ran. For MCP servers available directly in Claude Code, discover their actual MCP tools with ToolSearch instead. If no matching tool exists, report that limitation; a shell/CLI call is not a test of MCP.`;
+}
 var CLAUDE_CLI_CONTEXT_NOTE = `## Runtime environment: Claude Code CLI
 
 You are running via the Claude Code CLI (not a direct API call). This affects context management:
@@ -8094,7 +8142,7 @@ function effectiveMcpConfig(config, cwd, proxyConfigPath, runtimeStatus, exclude
   let bridgedHash = null;
   let allEnabledServerNames = [];
   if (config.bridgeOpencodeMcp !== false) {
-    const bridged = bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers);
+    const bridged = bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, config.hostApi);
     if (bridged) {
       if (bridged.path) paths.push(bridged.path);
       bridgedHash = bridged.hash;
@@ -8154,7 +8202,7 @@ function resolvedProxyMcpTools(config, allEnabledServerNames, modelTools, taken)
   });
   if (resolution.defs.length === 0) {
     log.warn(
-      "proxyOpencodeMcpTools is on but no MCP tool was found in opencode's tool set; those servers stay on the direct bridge this spawn",
+      "proxyOpencodeMcpTools is on but no MCP tool was found in opencode's tool set; those servers stay on the direct bridge this spawn" + (config.hostApi === "v2" && modelTools?.some((tool) => tool.name === "execute") ? ". For V2 Code Mode, explicitly allowlist execute in proxyOpencodeTools and use bridgeOpencodeMcp: false with strictMcpConfig: true" : ""),
       { servers: allEnabledServerNames, modelTools: modelTools?.length ?? 0 }
     );
     return null;
@@ -10692,6 +10740,8 @@ var ClaudeCodeLanguageModel = class {
               const opencodeToolDefs = resolveProxyOpencodeToolDefs({
                 requested: self.config.proxyOpencodeTools,
                 items: liveToolInfo.items,
+                modelTools: self.config.hostApi === "v2" ? options.tools ?? [] : void 0,
+                allowCodeExecution: self.config.permissionPreset !== "read-only",
                 taken: new Set(
                   [...enrichedProxy ?? [], ...proxyMcpTools ?? []].map(
                     (t) => t.name
@@ -10737,7 +10787,8 @@ var ClaudeCodeLanguageModel = class {
                   ...extractSystemMessages(options.prompt),
                   ...taskProxyEnabled ? [SUBAGENT_DISPATCH_HINT] : [],
                   ...backgroundSubagentsSupported ? [BACKGROUND_SUBAGENT_HINT] : [],
-                  ...questionProxyActive ? [QUESTION_PROXY_HINT] : []
+                  ...questionProxyActive ? [QUESTION_PROXY_HINT] : [],
+                  ...self.config.hostApi === "v2" && options.tools?.some((t) => t.name === "execute") ? [codeModeProxyHint(opencodeToolDefs.some((t) => t.name === "execute"))] : []
                 ],
                 {
                   compressEnabled: pluginCompressEnabled,
@@ -11545,7 +11596,8 @@ function createV1ClientShim(ctx) {
     client.tool = {
       // V1: `{ data: [{ id, description, parameters }] }`. V2 returns the tools
       // themselves, with an Effect schema for input rather than JSON Schema, so
-      // `parameters` is empty; only `proxyOpencodeTools` reads it.
+      // `parameters` is empty. V2 proxyOpencodeTools uses the per-turn model
+      // snapshot instead, which also includes synthesized Code Mode execute.
       list: async () => {
         const tools = await toolList.call(ctx.tool);
         const data = (tools ?? []).flatMap((tool) => {
@@ -11726,9 +11778,11 @@ function plainObject(value) {
 }
 function configuredSeedSettings(config, pluginOptions) {
   const provider = plainObject(plainObject(config.provider)?.[BASE_PROVIDER_ID]);
+  const nativeProvider = plainObject(plainObject(config.providers)?.[BASE_PROVIDER_ID]);
   return {
     ...plainObject(provider?.options) ?? {},
     ...plainObject(provider?.settings) ?? {},
+    ...plainObject(nativeProvider?.settings) ?? {},
     ...pluginOptions ?? {}
   };
 }
@@ -12376,7 +12430,7 @@ var index_default = {
   setup: createV2Setup({
     createProvider: createClaudeCode,
     defaultProxyTools: DEFAULT_PROXY_TOOL_NAMES,
-    loadConfig: loadMergedOpencodeConfig,
+    loadConfig: (directory) => loadMergedOpencodeConfig(directory, "v2"),
     buildAgentRegistry: (config) => buildAgentRegistry(config)
   })
 };