@khalilgharbaoui/opencode-claude-code-plugin 0.49.0 → 0.50.0

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/claude-code-language-model.ts
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/ids.ts
 import { randomInt } from "crypto";
@@ -3514,33 +3514,97 @@ function clearCompression(sessionKey2) {
 }
 
 // src/mcp-bridge.ts
-import * as fs4 from "fs";
-import * as path5 from "path";
-import * as os2 from "os";
+import * as fs5 from "fs";
+import * as path6 from "path";
+import * as os3 from "os";
 import * as crypto2 from "crypto";
 import {
   parse as parseJsonc,
   printParseErrorCode
 } from "jsonc-parser";
+
+// src/mcp-auth.ts
+import * as fs4 from "fs";
+import * as os2 from "os";
+import * as path5 from "path";
+var EXPIRY_SKEW_SECONDS = 30;
+function opencodeStateDir() {
+  const dataHome = process.env.XDG_DATA_HOME || path5.join(os2.homedir(), ".local", "share");
+  return path5.join(dataHome, "opencode");
+}
+function readMcpAuthStore(stateDir) {
+  const file = path5.join(stateDir, "mcp-auth.json");
+  try {
+    const stat = fs4.lstatSync(file);
+    if (!stat.isFile()) {
+      log.debug("ignoring opencode MCP auth store that is not a regular file", { path: file });
+      return {};
+    }
+    if (typeof stat.uid === "number" && typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+      log.debug("ignoring opencode MCP auth store owned by another user", { path: file });
+      return {};
+    }
+    const parsed = JSON.parse(fs4.readFileSync(file, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      log.debug("opencode MCP auth store has an unexpected shape", { path: file });
+      return {};
+    }
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function selectBearerToken(store, serverName, serverUrl, now = Date.now()) {
+  const entry = Object.prototype.hasOwnProperty.call(store, serverName) ? store[serverName] : void 0;
+  if (!entry || typeof entry !== "object") return { token: null, refusal: "no-entry" };
+  if (!entry.serverUrl || entry.serverUrl !== serverUrl) {
+    return { token: null, refusal: "url-mismatch" };
+  }
+  const accessToken = entry.tokens?.accessToken;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    return { token: null, refusal: "no-token" };
+  }
+  const expiresAt = entry.tokens?.expiresAt;
+  if (typeof expiresAt === "number" && expiresAt - now / 1e3 < EXPIRY_SKEW_SECONDS) {
+    return { token: null, refusal: "expired" };
+  }
+  return { token: accessToken, expiresAt: typeof expiresAt === "number" ? expiresAt : void 0 };
+}
+function buildFreshnessKey(expiresAt) {
+  return expiresAt === void 0 ? "no-expiry" : String(expiresAt);
+}
+function hasAuthorizationHeader(headers) {
+  return Object.keys(headers).some((key) => key.toLowerCase() === "authorization");
+}
+function injectBearerHeaders(server2, accessToken) {
+  const existing = server2.headers && typeof server2.headers === "object" && !Array.isArray(server2.headers) ? server2.headers : {};
+  if (hasAuthorizationHeader(existing)) return { ...server2 };
+  return {
+    ...server2,
+    headers: { ...existing, Authorization: `Bearer ${accessToken}` }
+  };
+}
+
+// src/mcp-bridge.ts
 var FILE_NAMES = ["opencode.jsonc", "opencode.json", "config.json"];
 var PROJECT_FILE_NAMES = ["opencode.json", "opencode.jsonc"];
 function fileExists(p) {
   try {
-    return fs4.statSync(p).isFile();
+    return fs5.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function dirExists(p) {
   try {
-    return fs4.statSync(p).isDirectory();
+    return fs5.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function readAndParse(file) {
   try {
-    const raw = fs4.readFileSync(file, "utf8");
+    const raw = fs5.readFileSync(file, "utf8");
     const errors = [];
     const parsed = parseJsonc(raw, errors, { allowTrailingComma: true });
     if (errors.length > 0) {
@@ -3576,14 +3640,14 @@ function deepMerge(target, source) {
 }
 function walkUp(opts) {
   const out = [];
-  let current = path5.resolve(opts.start);
+  let current = path6.resolve(opts.start);
   while (true) {
     for (const target of opts.targets) {
-      const candidate = path5.join(current, target);
+      const candidate = path6.join(current, target);
       if (opts.predicate(candidate)) out.push(candidate);
     }
-    if (opts.stop && current === path5.resolve(opts.stop)) break;
-    const parent = path5.dirname(current);
+    if (opts.stop && current === path6.resolve(opts.stop)) break;
+    const parent = path6.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -3591,28 +3655,28 @@ function walkUp(opts) {
 }
 function detectWorktree(cwd) {
   const override = process.env.OPENCODE_WORKTREE;
-  if (override) return path5.resolve(override);
-  let current = path5.resolve(cwd);
+  if (override) return path6.resolve(override);
+  let current = path6.resolve(cwd);
   while (true) {
-    const gitPath = path5.join(current, ".git");
+    const gitPath = path6.join(current, ".git");
     try {
-      if (fs4.existsSync(gitPath)) return current;
+      if (fs5.existsSync(gitPath)) return current;
     } catch {
     }
-    const parent = path5.dirname(current);
+    const parent = path6.dirname(current);
     if (parent === current) return void 0;
     current = parent;
   }
 }
 function globalConfigDir() {
-  const xdg = process.env.XDG_CONFIG_HOME ?? path5.join(os2.homedir(), ".config");
-  return path5.join(xdg, "opencode");
+  const xdg = process.env.XDG_CONFIG_HOME ?? path6.join(os3.homedir(), ".config");
+  return path6.join(xdg, "opencode");
 }
 function loadGlobalConfig(hostApi = "v1") {
   const dir = globalConfigDir();
   let merged = {};
   for (const name of FILE_NAMES.slice().reverse()) {
-    const file = path5.join(dir, name);
+    const file = path6.join(dir, name);
     if (!fileExists(file)) continue;
     const parsed = readAndParse(file);
     if (parsed) merged = mergeConfigLayer(merged, parsed, hostApi);
@@ -3622,7 +3686,7 @@ function loadGlobalConfig(hostApi = "v1") {
 function loadProjectFilesInDir(dir, hostApi = "v1") {
   let merged = {};
   for (const name of PROJECT_FILE_NAMES) {
-    const file = path5.join(dir, name);
+    const file = path6.join(dir, name);
     if (!fileExists(file)) continue;
     const parsed = readAndParse(file);
     if (parsed) merged = mergeConfigLayer(merged, parsed, hostApi);
@@ -3633,7 +3697,7 @@ function dotOpencodeDirs(cwd, worktree) {
   const dirs = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (p) => {
-    const abs = path5.resolve(p);
+    const abs = path6.resolve(p);
     if (!seen.has(abs) && dirExists(abs)) {
       seen.add(abs);
       dirs.push(abs);
@@ -3647,9 +3711,9 @@ function dotOpencodeDirs(cwd, worktree) {
   })) {
     push(dir);
   }
-  const home = os2.homedir();
+  const home = os3.homedir();
   if (home) {
-    const homeDot = path5.join(home, ".opencode");
+    const homeDot = path6.join(home, ".opencode");
     if (dirExists(homeDot)) push(homeDot);
   }
   const envDir = process.env.OPENCODE_CONFIG_DIR;
@@ -3667,7 +3731,33 @@ function substituteEnvPlaceholders(source) {
   }
   return out;
 }
-function translateServer(name, spec) {
+var warnedExpiredBearer = /* @__PURE__ */ new Set();
+function withBearerToken(name, spec, url, auth) {
+  if (!auth) return spec;
+  const lookup = selectBearerToken(auth.store, name, url);
+  if (lookup.token === null) {
+    if (lookup.refusal === "expired" && !warnedExpiredBearer.has(name)) {
+      warnedExpiredBearer.add(name);
+      log.warn(
+        "opencode's stored OAuth token for this MCP server has expired, so the bridged server carries no credential; re-authenticate it in opencode",
+        { server: name }
+      );
+    } else {
+      log.debug("no opencode OAuth token for bridged MCP server", {
+        server: name,
+        reason: lookup.refusal
+      });
+    }
+    return spec;
+  }
+  log.info("bridged MCP server carries opencode's stored OAuth token", { server: name });
+  return injectBearerHeaders(spec, lookup.token);
+}
+function bearerAuthContext(options) {
+  if (!options?.oauthTokens) return void 0;
+  return { store: readMcpAuthStore(options.stateDir ?? opencodeStateDir()) };
+}
+function translateServer(name, spec, auth) {
   if (spec.enabled === false) return null;
   const type = spec.type;
   if (type === "local") {
@@ -3693,7 +3783,7 @@ function translateServer(name, spec) {
       log.warn("skipping remote MCP server with no url", { name });
       return null;
     }
-    const out = {
+    let out = {
       type: "http",
       url: spec.url
     };
@@ -3702,7 +3792,7 @@ function translateServer(name, spec) {
         spec.headers
       );
     }
-    return out;
+    return withBearerToken(name, out, spec.url, auth);
   }
   log.warn("skipping MCP server with unknown type", {
     name,
@@ -3753,18 +3843,19 @@ function mergeMcp(target, source) {
   return out;
 }
 var MCP_PENDING_STATUS = "pending";
-function bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, hostApi = "v1") {
+function bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, hostApi = "v1", auth) {
   const {
     servers: merged,
     enabledServerNames: allEnabledServerNames,
     hash
-  } = mergeOpencodeMcp(cwd, runtimeStatus, hostApi);
+  } = mergeOpencodeMcp(cwd, runtimeStatus, hostApi, auth);
+  const authContext = bearerAuthContext(auth);
   const servers = {};
   const bridgedServerNames = [];
   for (const [name, spec] of Object.entries(merged)) {
     if (!spec || typeof spec !== "object") continue;
     if (excludeServers?.has(name)) continue;
-    const translated = translateServer(name, spec);
+    const translated = translateServer(name, spec, authContext);
     if (translated) {
       servers[name] = translated;
       bridgedServerNames.push(name);
@@ -3796,7 +3887,7 @@ function opencodeConfigLayers(cwd, hostApi = "v1") {
   const projectDirs = [];
   const seenProjectDirs = /* @__PURE__ */ new Set();
   for (const f of projectFiles) {
-    const d = path5.dirname(f);
+    const d = path6.dirname(f);
     if (!seenProjectDirs.has(d)) {
       seenProjectDirs.add(d);
       projectDirs.push(d);
@@ -3822,7 +3913,7 @@ function loadMergedOpencodeConfig(cwd, hostApi = "v1") {
   for (const layer of opencodeConfigLayers(cwd, hostApi)) merged = mergeConfigLayer(merged, layer, hostApi);
   return merged;
 }
-function mergeOpencodeMcp(cwd, runtimeStatus, hostApi = "v1") {
+function mergeOpencodeMcp(cwd, runtimeStatus, hostApi = "v1", auth) {
   let merged = {};
   for (const layer of opencodeConfigLayers(cwd, hostApi)) {
     const servers = extractMcpBlock(layer);
@@ -3846,7 +3937,19 @@ function mergeOpencodeMcp(cwd, runtimeStatus, hostApi = "v1") {
     enabledServerNames.push(name);
   }
   const mergedBody = JSON.stringify({ mcpServers: merged }, null, 2);
-  const hash = crypto2.createHash("sha256").update(mergedBody).digest("hex").slice(0, 12);
+  const hasher = crypto2.createHash("sha256").update(mergedBody);
+  const authContext = bearerAuthContext(auth);
+  if (authContext) {
+    for (const [name, spec] of Object.entries(merged)) {
+      if (!spec || typeof spec !== "object") continue;
+      const server2 = spec;
+      if (server2.type !== "remote" || typeof server2.url !== "string") continue;
+      const lookup = selectBearerToken(authContext.store, name, server2.url);
+      if (lookup.token === null) continue;
+      hasher.update(`\0bearer:${name}:${buildFreshnessKey(lookup.expiresAt)}`);
+    }
+  }
+  const hash = hasher.digest("hex").slice(0, 12);
   return { servers: merged, enabledServerNames, hash };
 }
 function finishBridge(input) {
@@ -3863,13 +3966,13 @@ function finishBridge(input) {
   }
   const body = JSON.stringify({ mcpServers: servers }, null, 2);
   const bodyDigest = crypto2.createHash("sha256").update(body).digest("hex").slice(0, 12);
-  const outPath = path5.join(
+  const outPath = path6.join(
     pluginTmpDir(),
     `mcp-${bodyDigest}.json`
   );
   try {
     if (!fileExists(outPath)) {
-      fs4.writeFileSync(outPath, body, { encoding: "utf8", mode: 384 });
+      fs5.writeFileSync(outPath, body, { encoding: "utf8", mode: 384 });
     }
   } catch (e) {
     log.warn("failed to write bridged MCP config", {
@@ -4536,17 +4639,17 @@ function tailIsReplyOnly(history, from) {
 }
 
 // src/session-resume-store.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 var MAX_RESUME_RECORDS = 256;
 var RESUME_RECORD_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var records = null;
 var pathOverride = null;
 function resumeStorePath() {
   if (pathOverride) return pathOverride;
-  const stateRoot = process.env.XDG_STATE_HOME || join5(homedir4(), ".local", "state");
-  return join5(stateRoot, "opencode-claude-code-plugin", "claude-sessions.json");
+  const stateRoot = process.env.XDG_STATE_HOME || join6(homedir5(), ".local", "state");
+  return join6(stateRoot, "opencode-claude-code-plugin", "claude-sessions.json");
 }
 function isDigest(value) {
   const entry = value;
@@ -4560,7 +4663,7 @@ function load() {
   if (records) return records;
   records = /* @__PURE__ */ new Map();
   try {
-    const parsed = JSON.parse(readFileSync2(resumeStorePath(), "utf8"));
+    const parsed = JSON.parse(readFileSync3(resumeStorePath(), "utf8"));
     const entries = parsed && typeof parsed === "object" ? parsed.sessions : null;
     if (entries && typeof entries === "object") {
       const cutoff = Date.now() - RESUME_RECORD_MAX_AGE_MS;
@@ -4575,7 +4678,7 @@ function save(update) {
   const file = resumeStorePath();
   const merged = /* @__PURE__ */ new Map();
   try {
-    const onDisk = JSON.parse(readFileSync2(file, "utf8"))?.sessions;
+    const onDisk = JSON.parse(readFileSync3(file, "utf8"))?.sessions;
     if (onDisk && typeof onDisk === "object") {
       for (const [key, record] of Object.entries(onDisk)) {
         if (isRecord2(record)) merged.set(key, record);
@@ -4588,7 +4691,7 @@ function save(update) {
   const kept = [...merged.entries()].filter(([, record]) => record.updatedAt >= cutoff).sort((a, b) => a[1].updatedAt - b[1].updatedAt).slice(-MAX_RESUME_RECORDS);
   records = new Map(kept);
   try {
-    mkdirSync3(join5(file, ".."), { recursive: true, mode: 448 });
+    mkdirSync3(join6(file, ".."), { recursive: true, mode: 448 });
     const tmp = `${file}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify({ version: 1, sessions: Object.fromEntries(kept) }), {
       mode: 384
@@ -6037,7 +6140,7 @@ async function handleBtwCommand(client, input, options = {}) {
 // src/diagnostic-bundle.ts
 import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
 import { openSync, readSync, closeSync, fstatSync, realpathSync } from "fs";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 
 // src/log-messages.ts
 var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
@@ -6133,6 +6236,7 @@ var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
   "no proxyTools entry was recognised; nothing will be proxied this turn",
   "no stdout after envelope write; respawning claude process to resume conversation",
   "opencode 2 event subscription ended; deleted sessions keep their claude process until idle eviction",
+  "opencode's stored OAuth token for this MCP server has expired, so the bridged server carries no credential; re-authenticate it in opencode",
   "pending proxy call arrived after stream close; rejecting",
   'permissionMode "plan" is enforced: claude cannot edit files or run commands, and --dangerously-skip-permissions is deliberately not passed so it stays that way. Headless Claude Code is not offered an ExitPlanMode tool, so nothing releases plan mode mid-session; approving a plan in chat does not unlock writes. Leaving plan mode means changing the config and restarting opencode.',
   `permissionPreset "read-only": this claude CLI has no --permission-prompts (2.1.263+), so permission requests are denied by the plugin's own can_use_tool handler instead of by the CLI. Same outcome, one layer fewer.`,
@@ -6398,7 +6502,7 @@ function createIdHasher(salt = randomBytes2(16).toString("hex")) {
   return (raw) => createHash4("sha256").update(salt).update("\0").update(raw).digest("hex").slice(0, 8);
 }
 function createRedactionContext(options = {}) {
-  const home = options.home ?? homedir5();
+  const home = options.home ?? homedir6();
   const homes = /* @__PURE__ */ new Set();
   if (home) homes.add(home);
   if (home) {
@@ -6583,8 +6687,8 @@ function redactLogLine(raw, context) {
   if (!parsed.data || Object.keys(parsed.data).length === 0) return head;
   return `${head} ${JSON.stringify(sanitizeLogData(parsed.data, context))}`;
 }
-function readLogTail(path14, maxBytes = BUNDLE_TAIL_BYTES) {
-  const fd = openSync(path14, "r");
+function readLogTail(path15, maxBytes = BUNDLE_TAIL_BYTES) {
+  const fd = openSync(path15, "r");
   try {
     const size = fstatSync(fd).size;
     const length = Math.min(size, maxBytes);
@@ -6789,14 +6893,14 @@ async function fetchPlanUsage(cliPath, options = {}) {
 }
 
 // src/stale-build.ts
-import * as fs6 from "fs";
-import * as path7 from "path";
+import * as fs7 from "fs";
+import * as path8 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/startup-diagnostics.ts
 import { execFile as execFile3 } from "child_process";
-import * as fs5 from "fs";
-import * as path6 from "path";
+import * as fs6 from "fs";
+import * as path7 from "path";
 import { promisify as promisify2 } from "util";
 import { fileURLToPath } from "url";
 
@@ -6831,8 +6935,8 @@ var cachedPluginVersion;
 function pluginVersion() {
   if (cachedPluginVersion) return cachedPluginVersion;
   try {
-    const here = path6.dirname(fileURLToPath(import.meta.url));
-    const raw = fs5.readFileSync(path6.join(here, "..", "package.json"), "utf8");
+    const here = path7.dirname(fileURLToPath(import.meta.url));
+    const raw = fs6.readFileSync(path7.join(here, "..", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     cachedPluginVersion = typeof version === "string" ? version : "unknown";
   } catch {
@@ -6856,7 +6960,7 @@ var opencodeVersionProbe;
 function detectOpencodeVersion(execPath = process.execPath) {
   if (opencodeVersionProbe) return opencodeVersionProbe;
   opencodeVersionProbe = (async () => {
-    if (!path6.basename(execPath).toLowerCase().includes("opencode")) {
+    if (!path7.basename(execPath).toLowerCase().includes("opencode")) {
       log.debug("skipping opencode version probe: execPath is not opencode", { execPath });
       return void 0;
     }
@@ -7085,10 +7189,10 @@ function defaultEntryPath() {
 }
 function readOnDiskBuild(entryPath) {
   try {
-    const raw = fs6.readFileSync(path7.join(path7.dirname(entryPath), "..", "package.json"), "utf8");
+    const raw = fs7.readFileSync(path8.join(path8.dirname(entryPath), "..", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     if (typeof version !== "string" || version.length === 0) return void 0;
-    const stat = fs6.statSync(entryPath);
+    const stat = fs7.statSync(entryPath);
     return { version, mtimeMs: stat.mtimeMs, size: stat.size };
   } catch {
     return void 0;
@@ -7099,7 +7203,7 @@ function recordLoadedBuild() {
   let mtimeMs;
   let size;
   try {
-    const stat = fs6.statSync(entryPath);
+    const stat = fs7.statSync(entryPath);
     mtimeMs = stat.mtimeMs;
     size = stat.size;
   } catch {
@@ -7537,7 +7641,7 @@ Could not build the report: ${message}`;
 
 // src/agent-models.ts
 import { readFile, readdir } from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 
 // src/models.ts
 var PROVIDER_ID = "claude-code";
@@ -8103,13 +8207,13 @@ async function readAgentMarkdownRecords(directories) {
       const name = entry.slice(0, -3);
       if (records2[name]) continue;
       try {
-        const text = await readFile(path8.join(directory, entry), "utf8");
+        const text = await readFile(path9.join(directory, entry), "utf8");
         records2[name] = parseAgentFrontmatter(text);
         const prompt = agentMarkdownBody(text);
         if (prompt) records2[name].prompt = prompt;
       } catch (err) {
         log.debug("failed to read agent markdown", {
-          file: path8.join(directory, entry),
+          file: path9.join(directory, entry),
           error: String(err)
         });
       }
@@ -8121,12 +8225,12 @@ function agentDirectories(home, projectDirectory) {
   const directories = [];
   if (projectDirectory) {
     for (const name of AGENT_DIR_NAMES) {
-      directories.push(path8.join(projectDirectory, ".opencode", name));
+      directories.push(path9.join(projectDirectory, ".opencode", name));
     }
   }
   if (home) {
     for (const name of AGENT_DIR_NAMES) {
-      directories.push(path8.join(home, ".config", "opencode", name));
+      directories.push(path9.join(home, ".config", "opencode", name));
     }
   }
   return directories;
@@ -8442,6 +8546,17 @@ function clipWithMarker(text, max) {
   return `${text.slice(0, max)}
 \u2026[truncated ${text.length - max} chars]`;
 }
+var MAX_REPLAY_MESSAGE_CHARS = 2e3;
+var MAX_REPLAY_LAST_REPLY_CHARS = 12e3;
+var MAX_REPLAY_HEAD_CHARS = 1e3;
+function clipMiddle(text, max) {
+  if (text.length <= max) return text;
+  const head = Math.min(Math.floor(max / 4), MAX_REPLAY_HEAD_CHARS);
+  const tail = max - head;
+  return `${text.slice(0, head)}
+\u2026[${text.length - max} chars omitted]\u2026
+${text.slice(-tail)}`;
+}
 function renderToolInput(input) {
   let raw;
   try {
@@ -8510,13 +8625,20 @@ function compactConversationHistory(prompt, opts = {}) {
     return null;
   }
   const historyParts = [];
+  let lastAssistant = -1;
+  for (let i = conversationMessages.length - 2; i >= 0; i--) {
+    if (conversationMessages[i].role === "assistant") {
+      lastAssistant = i;
+      break;
+    }
+  }
   for (let i = 0; i < conversationMessages.length - 1; i++) {
     const msg = conversationMessages[i];
     const role = msg.role === "user" ? "User" : msg.role === "assistant" ? "Assistant" : "Tool";
     const { text } = renderMessageContentForCompaction(msg);
     if (text.trim()) {
-      const truncated = text.length > 2e3 ? text.slice(0, 2e3) + "..." : text;
-      historyParts.push(`${role}: ${truncated}`);
+      const max = i === lastAssistant ? MAX_REPLAY_LAST_REPLY_CHARS : MAX_REPLAY_MESSAGE_CHARS;
+      historyParts.push(`${role}: ${clipMiddle(text, max)}`);
     }
   }
   if (historyParts.length === 0) {
@@ -8726,14 +8848,14 @@ function getTrailingUserMessages(prompt, opts = {}) {
 
 // src/skill-bridge.ts
 import * as crypto3 from "crypto";
-import * as fs7 from "fs";
-import * as os3 from "os";
-import * as path9 from "path";
+import * as fs8 from "fs";
+import * as os4 from "os";
+import * as path10 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function bundledSkillsDir() {
   try {
     const here = fileURLToPath3(import.meta.url);
-    const dir = path9.resolve(path9.dirname(here), "..", "skills");
+    const dir = path10.resolve(path10.dirname(here), "..", "skills");
     return dirExists2(dir) ? dir : null;
   } catch {
     return null;
@@ -8741,16 +8863,16 @@ function bundledSkillsDir() {
 }
 function dirExists2(p) {
   try {
-    return fs7.statSync(p).isDirectory();
+    return fs8.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function realPath(p) {
   try {
-    return fs7.realpathSync(p);
+    return fs8.realpathSync(p);
   } catch {
-    return path9.resolve(p);
+    return path10.resolve(p);
   }
 }
 function envEnabled(name) {
@@ -8771,10 +8893,10 @@ function declaredSkillName(source) {
   return SAFE_SKILL_NAME.test(name) ? name : null;
 }
 function readSkill(root, entry) {
-  const dir = path9.join(root, entry);
+  const dir = path10.join(root, entry);
   let source;
   try {
-    source = fs7.readFileSync(path9.join(dir, "SKILL.md"), "utf8");
+    source = fs8.readFileSync(path10.join(dir, "SKILL.md"), "utf8");
   } catch {
     return null;
   }
@@ -8792,47 +8914,47 @@ function skillRoots(cwd) {
   const roots = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (p) => {
-    const abs = path9.resolve(p);
+    const abs = path10.resolve(p);
     if (seen.has(abs)) return;
     seen.add(abs);
     if (dirExists2(abs)) roots.push(abs);
   };
-  const home = os3.homedir();
-  const homeDir = home ? path9.resolve(home) : null;
-  let current = path9.resolve(cwd);
+  const home = os4.homedir();
+  const homeDir = home ? path10.resolve(home) : null;
+  let current = path10.resolve(cwd);
   while (true) {
-    push(path9.join(current, ".opencode", "skills"));
+    push(path10.join(current, ".opencode", "skills"));
     if (current !== homeDir) {
-      push(path9.join(current, ".claude", "skills"));
-      push(path9.join(current, ".agents", "skills"));
+      push(path10.join(current, ".claude", "skills"));
+      push(path10.join(current, ".agents", "skills"));
     }
-    const parent = path9.dirname(current);
+    const parent = path10.dirname(current);
     if (parent === current) break;
     current = parent;
   }
-  if (homeDir) push(path9.join(homeDir, ".opencode", "skills"));
+  if (homeDir) push(path10.join(homeDir, ".opencode", "skills"));
   const envDir = process.env.OPENCODE_CONFIG_DIR;
   if (envDir) {
-    push(path9.join(envDir, "skills"));
-    push(path9.join(envDir, "skill"));
+    push(path10.join(envDir, "skills"));
+    push(path10.join(envDir, "skill"));
   }
-  const xdg = process.env.XDG_CONFIG_HOME ?? (homeDir ? path9.join(homeDir, ".config") : null);
+  const xdg = process.env.XDG_CONFIG_HOME ?? (homeDir ? path10.join(homeDir, ".config") : null);
   if (xdg) {
-    push(path9.join(xdg, "opencode", "skills"));
-    push(path9.join(xdg, "opencode", "skill"));
+    push(path10.join(xdg, "opencode", "skills"));
+    push(path10.join(xdg, "opencode", "skill"));
   }
   if (homeDir && !envEnabled("OPENCODE_DISABLE_EXTERNAL_SKILLS")) {
     if (!envEnabled("OPENCODE_DISABLE_CLAUDE_CODE_SKILLS")) {
-      push(path9.join(homeDir, ".claude", "skills"));
+      push(path10.join(homeDir, ".claude", "skills"));
     }
-    push(path9.join(homeDir, ".agents", "skills"));
+    push(path10.join(homeDir, ".agents", "skills"));
   }
   return roots;
 }
 function collectSkills(root, claimed, found) {
   let entries;
   try {
-    entries = fs7.readdirSync(root, { withFileTypes: true });
+    entries = fs8.readdirSync(root, { withFileTypes: true });
   } catch {
     return;
   }
@@ -8872,23 +8994,23 @@ function discoverBundledSkills() {
 }
 function claudeConfigDir(configDir) {
   const explicit = configDir ?? process.env.CLAUDE_CONFIG_DIR;
-  if (explicit) return path9.resolve(expandHome(explicit));
-  const home = os3.homedir();
-  return home ? path9.resolve(home, ".claude") : null;
+  if (explicit) return path10.resolve(expandHome(explicit));
+  const home = os4.homedir();
+  return home ? path10.resolve(home, ".claude") : null;
 }
 function installedPluginSkillRoots(configDir, cwd) {
   if (!configDir) return [];
   let parsed;
   try {
     parsed = JSON.parse(
-      fs7.readFileSync(path9.join(configDir, "plugins", "installed_plugins.json"), "utf8")
+      fs8.readFileSync(path10.join(configDir, "plugins", "installed_plugins.json"), "utf8")
     );
   } catch {
     return [];
   }
   const plugins = parsed?.plugins;
   if (!plugins || typeof plugins !== "object") return [];
-  const workspace = path9.resolve(cwd);
+  const workspace = path10.resolve(cwd);
   const roots = [];
   for (const installs of Object.values(plugins)) {
     if (!Array.isArray(installs)) continue;
@@ -8896,28 +9018,28 @@ function installedPluginSkillRoots(configDir, cwd) {
       const entry = install;
       if (typeof entry?.installPath !== "string" || !entry.installPath) continue;
       if (entry.scope !== "user" && !coversWorkspace(entry.projectPath, workspace)) continue;
-      roots.push(path9.join(entry.installPath, "skills"));
+      roots.push(path10.join(entry.installPath, "skills"));
     }
   }
   return roots;
 }
 function coversWorkspace(projectPath, workspace) {
   if (typeof projectPath !== "string" || !projectPath) return false;
-  const root = path9.resolve(projectPath);
+  const root = path10.resolve(projectPath);
   if (root === workspace) return true;
-  const rel = path9.relative(root, workspace);
-  return rel !== "" && !rel.startsWith("..") && !path9.isAbsolute(rel);
+  const rel = path10.relative(root, workspace);
+  return rel !== "" && !rel.startsWith("..") && !path10.isAbsolute(rel);
 }
 function discoverNativeClaudeSkills(opts) {
   const found = [];
   const scanned = /* @__PURE__ */ new Set();
   const scan = (root, scope) => {
-    const abs = path9.resolve(root);
+    const abs = path10.resolve(root);
     if (scanned.has(abs)) return;
     scanned.add(abs);
     let entries;
     try {
-      entries = fs7.readdirSync(abs, { withFileTypes: true });
+      entries = fs8.readdirSync(abs, { withFileTypes: true });
     } catch {
       return;
     }
@@ -8929,13 +9051,13 @@ function discoverNativeClaudeSkills(opts) {
     }
   };
   const configDir = claudeConfigDir(opts.configDir);
-  if (configDir) scan(path9.join(configDir, "skills"), "user");
-  const home = os3.homedir();
-  const homeDir = home ? path9.resolve(home) : null;
-  let current = path9.resolve(opts.cwd);
+  if (configDir) scan(path10.join(configDir, "skills"), "user");
+  const home = os4.homedir();
+  const homeDir = home ? path10.resolve(home) : null;
+  let current = path10.resolve(opts.cwd);
   while (true) {
-    if (current !== homeDir) scan(path9.join(current, ".claude", "skills"), "project");
-    const parent = path9.dirname(current);
+    if (current !== homeDir) scan(path10.join(current, ".claude", "skills"), "project");
+    const parent = path10.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -8969,10 +9091,10 @@ function dropNativelyLoadedSkills(skills, native) {
 }
 function readBundledSkillInfos() {
   return discoverBundledSkills().flatMap((skill) => {
-    const file = path9.join(skill.dir, "SKILL.md");
+    const file = path10.join(skill.dir, "SKILL.md");
     let text;
     try {
-      text = fs7.readFileSync(file, "utf8");
+      text = fs8.readFileSync(file, "utf8");
     } catch {
       return [];
     }
@@ -8996,15 +9118,15 @@ function readBundledSkillInfos() {
 }
 function linkSkill(source, target) {
   try {
-    fs7.symlinkSync(source, target, process.platform === "win32" ? "junction" : "dir");
+    fs8.symlinkSync(source, target, process.platform === "win32" ? "junction" : "dir");
     return;
   } catch {
-    fs7.cpSync(source, target, { recursive: true, dereference: true });
+    fs8.cpSync(source, target, { recursive: true, dereference: true });
   }
 }
 function fileExists2(p) {
   try {
-    return fs7.statSync(p).isFile();
+    return fs8.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -9013,14 +9135,14 @@ function buildSkillPluginDir(skills) {
   if (skills.length === 0) return null;
   const fingerprint = skills.map((s) => `${s.name}\0${s.dir}`).join("\n");
   const hash = crypto3.createHash("sha256").update(fingerprint).digest("hex").slice(0, 12);
-  const root = path9.join(pluginTmpDir(), `skills-${hash}`);
-  const manifest = path9.join(root, ".claude-plugin", "plugin.json");
+  const root = path10.join(pluginTmpDir(), `skills-${hash}`);
+  const manifest = path10.join(root, ".claude-plugin", "plugin.json");
   if (fileExists2(manifest)) return root;
   try {
-    fs7.rmSync(root, { recursive: true, force: true });
-    fs7.mkdirSync(path9.join(root, ".claude-plugin"), { recursive: true });
-    fs7.mkdirSync(path9.join(root, "skills"), { recursive: true });
-    fs7.writeFileSync(
+    fs8.rmSync(root, { recursive: true, force: true });
+    fs8.mkdirSync(path10.join(root, ".claude-plugin"), { recursive: true });
+    fs8.mkdirSync(path10.join(root, "skills"), { recursive: true });
+    fs8.writeFileSync(
       manifest,
       JSON.stringify(
         {
@@ -9033,7 +9155,7 @@ function buildSkillPluginDir(skills) {
       { encoding: "utf8", mode: 384 }
     );
     for (const skill of skills) {
-      linkSkill(skill.dir, path9.join(root, "skills", skill.name));
+      linkSkill(skill.dir, path10.join(root, "skills", skill.name));
     }
   } catch (err) {
     log.warn("failed to stage opencode skill plugin dir", {
@@ -9049,7 +9171,7 @@ function registerBundledSkillPath(config) {
   if (!dir) return false;
   config.skills ??= {};
   const paths = config.skills.paths ??= [];
-  if (paths.some((p) => path9.resolve(p) === dir)) return false;
+  if (paths.some((p) => path10.resolve(p) === dir)) return false;
   paths.push(dir);
   return true;
 }
@@ -9099,36 +9221,36 @@ import { EventEmitter as EventEmitter4 } from "events";
 import { randomUUID as randomUUID5 } from "crypto";
 import { existsSync as existsSync4, writeFileSync as writeFileSync5 } from "fs";
 import { unlink as unlink2 } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/claude-session-bun.ts
-import * as os4 from "os";
-import * as fs8 from "fs";
-import * as path10 from "path";
+import * as os5 from "os";
+import * as fs9 from "fs";
+import * as path11 from "path";
 import { execFileSync } from "child_process";
 import { randomUUID as randomUUID4 } from "crypto";
 import { StringDecoder } from "string_decoder";
 function resolveClaude(cmd = "claude") {
-  if (path10.isAbsolute(cmd) && fs8.existsSync(cmd)) return cmd;
+  if (path11.isAbsolute(cmd) && fs9.existsSync(cmd)) return cmd;
   const viaBun = Bun.which(cmd);
   if (viaBun) return viaBun;
-  const isWin = os4.platform() === "win32";
+  const isWin = os5.platform() === "win32";
   try {
     const out = execFileSync(isWin ? "where" : "which", [cmd], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
-    const first = out.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).find((p) => fs8.existsSync(p));
+    const first = out.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).find((p) => fs9.existsSync(p));
     if (first) return first;
   } catch {
   }
   throw new Error(`Could not resolve command on PATH: ${cmd}`);
 }
 function encodeCwd(cwd) {
-  const resolved = path10.resolve(cwd);
+  const resolved = path11.resolve(cwd);
   let real = resolved;
   try {
-    real = fs8.realpathSync.native(resolved);
+    real = fs9.realpathSync.native(resolved);
   } catch {
   }
   return real.replace(/[^a-zA-Z0-9]/g, "-");
@@ -9136,7 +9258,7 @@ function encodeCwd(cwd) {
 var bunPtySpawner = (argv, opts) => {
   const [command, ...args] = argv;
   const resolved = resolveClaude(command ?? "claude");
-  if (os4.platform() === "win32" && isBatchFile(resolved)) {
+  if (os5.platform() === "win32" && isBatchFile(resolved)) {
     throw new Error(
       `The interactive transport cannot run a Windows batch shim (${resolved}). Point \`cliPath\` at claude.exe, or use the default headless transport.`
     );
@@ -9244,10 +9366,10 @@ function classifyScreen(text) {
   return null;
 }
 function interactiveTranscriptPath(opts) {
-  return path10.join(
+  return path11.join(
     resolveConfigDir(opts.configDir),
     "projects",
-    encodeCwd(path10.resolve(opts.cwd)),
+    encodeCwd(path11.resolve(opts.cwd)),
     `${opts.sessionId}.jsonl`
   );
 }
@@ -9425,7 +9547,7 @@ var TranscriptCursor = class {
     const filePath = this.resolvePath();
     let stat;
     try {
-      stat = fs8.statSync(filePath);
+      stat = fs9.statSync(filePath);
     } catch {
       return;
     }
@@ -9441,13 +9563,13 @@ var TranscriptCursor = class {
     if (stat.size <= this.offset) return;
     let fd = null;
     try {
-      fd = fs8.openSync(filePath, "r");
+      fd = fs9.openSync(filePath, "r");
       const buffer = Buffer.allocUnsafe(
         Math.min(TRANSCRIPT_CHUNK_BYTES, stat.size - this.offset)
       );
       while (this.offset < stat.size) {
         const want = Math.min(buffer.length, stat.size - this.offset);
-        const read = fs8.readSync(fd, buffer, 0, want, this.offset);
+        const read = fs9.readSync(fd, buffer, 0, want, this.offset);
         this.stats.reads++;
         if (read <= 0) break;
         this.offset += read;
@@ -9458,7 +9580,7 @@ var TranscriptCursor = class {
     } finally {
       if (fd !== null) {
         try {
-          fs8.closeSync(fd);
+          fs9.closeSync(fd);
         } catch {
         }
       }
@@ -9488,12 +9610,12 @@ function isOwnPromptRecord(rec, normalized) {
 }
 function resolveConfigDir(configDir) {
   const value = configDir ?? process.env.CLAUDE_CONFIG_DIR;
-  if (!value) return path10.join(os4.homedir(), ".claude");
-  if (value === "~") return os4.homedir();
+  if (!value) return path11.join(os5.homedir(), ".claude");
+  if (value === "~") return os5.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\")) {
-    return path10.join(os4.homedir(), value.slice(2));
+    return path11.join(os5.homedir(), value.slice(2));
   }
-  return path10.resolve(value);
+  return path11.resolve(value);
 }
 function fatalScreenMessage(kind, configDir, cwd) {
   if (kind === "trust") {
@@ -9557,7 +9679,7 @@ var ClaudeSession = class {
   abandonTurn = false;
   o;
   constructor(opts = {}) {
-    this.cwd = path10.resolve(opts.cwd ?? process.cwd());
+    this.cwd = path11.resolve(opts.cwd ?? process.cwd());
     this.configDir = resolveConfigDir(opts.configDir);
     this.explicitConfigDir = opts.configDir ? this.configDir : void 0;
     this.signal = opts.signal;
@@ -9569,7 +9691,7 @@ var ClaudeSession = class {
     this.onExit = opts.onExit;
     this.spawnPty = opts.spawnPty ?? bunPtySpawner;
     this.sessionId = opts.resumeSessionId ?? randomUUID4();
-    this.jsonlPath = path10.join(
+    this.jsonlPath = path11.join(
       this.configDir,
       "projects",
       encodeCwd(this.cwd),
@@ -10280,7 +10402,7 @@ ${text2}`
 }
 function stageImage(data, extension) {
   try {
-    const file = join10(pluginTmpDir(), `attachment-${randomUUID5()}.${extension}`);
+    const file = join11(pluginTmpDir(), `attachment-${randomUUID5()}.${extension}`);
     writeFileSync5(file, data, { mode: 384, flag: "wx" });
     return file;
   } catch (err) {
@@ -10765,7 +10887,7 @@ function spawnInteractiveProcess(opts) {
 import { randomUUID as randomUUID6 } from "crypto";
 import { constants as fsConstants } from "fs";
 import { chmod as chmod2, copyFile as copyFile2, lstat as lstat2, mkdir as mkdir2 } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 var transcriptPath = interactiveTranscriptPath;
 function configDirForAccount(account) {
   const normalized = normalizeAccountName(account || DEFAULT_ACCOUNT);
@@ -10793,7 +10915,7 @@ async function carryTranscriptToAccount(input) {
   const carriedId = renamed ? (input.newSessionId ?? randomUUID6)() : sessionId;
   const target = renamed ? transcriptPath({ configDir: targetConfigDir, cwd, sessionId: carriedId }) : targetOwn;
   try {
-    await mkdir2(path11.dirname(target), { recursive: true, mode: 448 });
+    await mkdir2(path12.dirname(target), { recursive: true, mode: 448 });
     await copyFile2(live.file, target, fsConstants.COPYFILE_EXCL);
     await chmod2(target, 384);
   } catch (err) {
@@ -10813,7 +10935,7 @@ function dedupe2(dirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of dirs) {
-    const resolved = path11.resolve(dir);
+    const resolved = path12.resolve(dir);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
     out.push(resolved);
@@ -10822,13 +10944,13 @@ function dedupe2(dirs) {
 }
 
 // src/prompts.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir8 } from "os";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir9 } from "os";
 import { randomUUID as randomUUID7 } from "crypto";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute3, join as join11 } from "path";
-function readPromptFileIfPresent(path14) {
+import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute3, join as join12 } from "path";
+function readPromptFileIfPresent(path15) {
   try {
-    const content = readFileSync6(path14, "utf8").trim();
+    const content = readFileSync7(path15, "utf8").trim();
     return content || void 0;
   } catch {
     return void 0;
@@ -10837,7 +10959,7 @@ function readPromptFileIfPresent(path14) {
 function nearestWorkspaceAgentsPrompt(cwd) {
   let dir = cwd;
   while (true) {
-    const content = readPromptFileIfPresent(join11(dir, "AGENTS.md"));
+    const content = readPromptFileIfPresent(join12(dir, "AGENTS.md"));
     if (content) return content;
     const parent = dirname6(dir);
     if (parent === dir) return void 0;
@@ -10933,9 +11055,9 @@ function extractSystemMessages(prompt) {
 }
 var CLAUDE_NATIVE_INSTRUCTION_FILES = /* @__PURE__ */ new Set(["CLAUDE.md", "CLAUDE.local.md"]);
 function userAuthoredInstructions(forwarded, opts = {}) {
-  const readFile2 = opts.readFile ?? ((path14) => {
+  const readFile2 = opts.readFile ?? ((path15) => {
     try {
-      return readFileSync6(path14, "utf8");
+      return readFileSync7(path15, "utf8");
     } catch {
       return null;
     }
@@ -10947,16 +11069,16 @@ function userAuthoredInstructions(forwarded, opts = {}) {
   }
   const seen = /* @__PURE__ */ new Set();
   for (const match of forwarded.matchAll(/^Instructions from: (.+)$/gm)) {
-    const path14 = match[1].trim();
-    if (seen.has(path14) || !isAbsolute3(path14)) continue;
-    if (CLAUDE_NATIVE_INSTRUCTION_FILES.has(basename2(path14))) continue;
-    seen.add(path14);
-    const file = readFile2(path14);
+    const path15 = match[1].trim();
+    if (seen.has(path15) || !isAbsolute3(path15)) continue;
+    if (CLAUDE_NATIVE_INSTRUCTION_FILES.has(basename2(path15))) continue;
+    seen.add(path15);
+    const file = readFile2(path15);
     if (!file?.trim()) continue;
     const start = match.index + match[0].length + 1;
     const content = forwarded.startsWith(file, start) ? file : forwarded.startsWith(file.trimEnd(), start) ? file.trimEnd() : null;
     if (content === null) continue;
-    out.push({ text: `Instructions from: ${path14}
+    out.push({ text: `Instructions from: ${path15}
 ${content}`, content });
   }
   return out;
@@ -10976,8 +11098,8 @@ ${options.compressionSummary.trim()}`
   for (const s of extraSystemContent) {
     if (s.trim()) parts.push(s.trim());
   }
-  const configRoot = process.env.XDG_CONFIG_HOME ?? join11(homedir8(), ".config");
-  const globalAgents = readPromptFileIfPresent(join11(configRoot, "opencode", "AGENTS.md"));
+  const configRoot = process.env.XDG_CONFIG_HOME ?? join12(homedir9(), ".config");
+  const globalAgents = readPromptFileIfPresent(join12(configRoot, "opencode", "AGENTS.md"));
   const workspaceAgents = nearestWorkspaceAgentsPrompt(cwd);
   const forwarded = extraSystemContent.join("\n\n");
   const pushGlobal = !!globalAgents && !forwarded.includes(globalAgents);
@@ -10993,10 +11115,10 @@ ${options.compressionSummary.trim()}`
   if (includeMultiStepHint) parts.push(MULTI_STEP_TASK_HINT);
   const content = parts.join("\n\n");
   if (!content) return void 0;
-  const path14 = join11(pluginTmpDir(), `opencode-cc-sys-${randomUUID7()}.md`);
+  const path15 = join12(pluginTmpDir(), `opencode-cc-sys-${randomUUID7()}.md`);
   try {
-    writeFileSync6(path14, content, { encoding: "utf8", mode: 384 });
-    return path14;
+    writeFileSync6(path15, content, { encoding: "utf8", mode: 384 });
+    return path15;
   } catch (err) {
     log.warn("failed to write system prompt file", { error: String(err) });
     return void 0;
@@ -11423,7 +11545,9 @@ function effectiveMcpConfig(config, cwd, proxyConfigPath, runtimeStatus, exclude
   let bridgedHash = null;
   let allEnabledServerNames = [];
   if (config.bridgeOpencodeMcp !== false) {
-    const bridged = bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, config.hostApi);
+    const bridged = bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, config.hostApi, {
+      oauthTokens: config.bridgeMcpOauthTokens === true
+    });
     if (bridged) {
       if (bridged.path) paths.push(bridged.path);
       bridgedHash = bridged.hash;
@@ -14127,7 +14251,7 @@ var ClaudeCodeLanguageModel = class {
     let replayReason = "no-session-for-key";
     if (this.config.resumeAfterRestart !== false && includeHistoryContext && !compactionMode && !forkFromClaudeSessionId && failoverAnswer?.kind !== "switch") {
       const configDir = resolveConfigDir(this.config.configDir);
-      const transcriptPath2 = (id) => join12(configDir, "projects", encodeCwd(cwd), `${id}.jsonl`);
+      const transcriptPath2 = (id) => join13(configDir, "projects", encodeCwd(cwd), `${id}.jsonl`);
       const resumePoint = findResumePoint({
         sessionKey: sk,
         prompt: options.prompt,
@@ -15383,8 +15507,8 @@ var ClaudeCodeLanguageModel = class {
 };
 
 // src/account-tier.ts
-import { readFileSync as readFileSync7 } from "fs";
-import path12 from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import path13 from "path";
 var ORGANIZATION_TYPE_LABELS = {
   claude_max: "Max",
   claude_pro: "Pro",
@@ -15413,7 +15537,7 @@ function readAccountTier(account) {
   return label;
 }
 function readTierFromConfigDir(configDir, allowLegacyFallback) {
-  const candidates = [path12.join(configDir, ".claude.json")];
+  const candidates = [path13.join(configDir, ".claude.json")];
   if (allowLegacyFallback) candidates.push(expandHome("~/.claude.json"));
   for (const candidate of candidates) {
     const oauth = readOauthAccount(candidate);
@@ -15426,7 +15550,7 @@ function readTierFromConfigDir(configDir, allowLegacyFallback) {
 function readOauthAccount(file) {
   let raw;
   try {
-    raw = readFileSync7(file, "utf8");
+    raw = readFileSync8(file, "utf8");
   } catch {
     return void 0;
   }
@@ -15455,13 +15579,13 @@ function tierLabel(oauthAccount) {
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   realpathSync as realpathSync4,
   rmSync as rmSync3,
   writeFileSync as writeFileSync7
 } from "fs";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname7, join as join13, resolve as resolve5 } from "path";
+import { homedir as homedir10 } from "os";
+import { dirname as dirname7, join as join14, resolve as resolve5 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var STALE_PACKAGE_NAME = "opencode-claude-code-plugin";
 var SUSPECT_DESCRIPTION_TOKEN = "Claude Code";
@@ -15469,20 +15593,20 @@ var alreadyRan = false;
 function candidateCacheRoots() {
   const xdg = process.env.XDG_CACHE_HOME;
   return [
-    xdg ? join13(xdg, "opencode") : null,
-    join13(homedir9(), ".cache", "opencode"),
-    join13(homedir9(), "Library", "Caches", "opencode")
+    xdg ? join14(xdg, "opencode") : null,
+    join14(homedir10(), ".cache", "opencode"),
+    join14(homedir10(), "Library", "Caches", "opencode")
   ].filter((p) => Boolean(p));
 }
 function userOpencodeJsonPath() {
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join13(homedir9(), ".config");
-  return join13(xdgConfig, "opencode", "opencode.json");
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join14(homedir10(), ".config");
+  return join14(xdgConfig, "opencode", "opencode.json");
 }
 function userIntendsToUseUnscoped() {
   const cfg = userOpencodeJsonPath();
   if (!existsSync5(cfg)) return false;
   try {
-    const json = JSON.parse(readFileSync8(cfg, "utf8"));
+    const json = JSON.parse(readFileSync9(cfg, "utf8"));
     const plugins = json.plugin;
     if (!Array.isArray(plugins)) return false;
     return plugins.some(
@@ -15503,19 +15627,19 @@ function ourLoadedDir() {
 function ourVersion(dir) {
   if (!dir) return null;
   try {
-    const pkg = JSON.parse(readFileSync8(join13(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync9(join14(dir, "package.json"), "utf8"));
     return typeof pkg.version === "string" && pkg.version ? pkg.version : null;
   } catch {
     return null;
   }
 }
 function markerPath() {
-  const stateRoot = process.env.XDG_STATE_HOME ?? join13(homedir9(), ".local", "state");
-  return join13(stateRoot, "opencode-claude-code-plugin", "cleanup-stale.json");
+  const stateRoot = process.env.XDG_STATE_HOME ?? join14(homedir10(), ".local", "state");
+  return join14(stateRoot, "opencode-claude-code-plugin", "cleanup-stale.json");
 }
 function markerVersion() {
   try {
-    const marker = JSON.parse(readFileSync8(markerPath(), "utf8"));
+    const marker = JSON.parse(readFileSync9(markerPath(), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -15560,7 +15684,7 @@ function cleanupStaleUnscopedInstall() {
 }
 function cleanupOne(cacheRoot, ourDir) {
   if (!existsSync5(cacheRoot)) return;
-  const stalePath = join13(cacheRoot, "node_modules", STALE_PACKAGE_NAME);
+  const stalePath = join14(cacheRoot, "node_modules", STALE_PACKAGE_NAME);
   if (!existsSync5(stalePath)) return;
   let realStalePath = stalePath;
   try {
@@ -15568,11 +15692,11 @@ function cleanupOne(cacheRoot, ourDir) {
   } catch {
   }
   if (ourDir && realStalePath === ourDir) return;
-  const pkgJsonPath = join13(stalePath, "package.json");
+  const pkgJsonPath = join14(stalePath, "package.json");
   if (!existsSync5(pkgJsonPath)) return;
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync8(pkgJsonPath, "utf8"));
+    pkg = JSON.parse(readFileSync9(pkgJsonPath, "utf8"));
   } catch {
     return;
   }
@@ -15588,10 +15712,10 @@ function cleanupOne(cacheRoot, ourDir) {
     });
     return;
   }
-  const cachePkgJson = join13(cacheRoot, "package.json");
+  const cachePkgJson = join14(cacheRoot, "package.json");
   if (!existsSync5(cachePkgJson)) return;
   try {
-    const cfg = JSON.parse(readFileSync8(cachePkgJson, "utf8"));
+    const cfg = JSON.parse(readFileSync9(cachePkgJson, "utf8"));
     if (cfg?.dependencies?.[STALE_PACKAGE_NAME]) {
       delete cfg.dependencies[STALE_PACKAGE_NAME];
       writeFileSync7(cachePkgJson, JSON.stringify(cfg, null, 2) + "\n");
@@ -15671,7 +15795,7 @@ function registerOpencodeLogSink(client) {
 }
 
 // src/v2-client.ts
-import path13 from "path";
+import path14 from "path";
 function formatAgentTypeList(agents) {
   const lines = agents.flatMap((agent) => {
     if (agent.hidden === true || agent.mode === "primary") return [];
@@ -15700,7 +15824,7 @@ function toV1Session(info) {
   if (!info || typeof info !== "object") return void 0;
   const session = info;
   const root = session.location?.directory;
-  const directory = typeof root === "string" ? typeof session.subpath === "string" && session.subpath.length > 0 ? path13.resolve(root, session.subpath) : root : void 0;
+  const directory = typeof root === "string" ? typeof session.subpath === "string" && session.subpath.length > 0 ? path14.resolve(root, session.subpath) : root : void 0;
   return { ...info, directory, parentID: session.parentID };
 }
 function toV1Messages(messages) {
@@ -16235,6 +16359,9 @@ function createClaudeCode(settings = {}) {
       mcpConfig: settings.mcpConfig,
       strictMcpConfig: settings.strictMcpConfig,
       bridgeOpencodeMcp: settings.bridgeOpencodeMcp ?? true,
+      // No `?? true` twin: reading opencode's credential store is opt-in, so
+      // the absent value has to stay falsy.
+      bridgeMcpOauthTokens: settings.bridgeMcpOauthTokens,
       controlRequestBehavior: preset?.controlRequestBehavior ?? settings.controlRequestBehavior ?? "allow",
       controlRequestToolBehaviors: preset ? void 0 : settings.controlRequestToolBehaviors,
       controlRequestDenyMessage: settings.controlRequestDenyMessage,