@opencode/core 0.0.0-dev-19752 → 0.0.0-dev-19754

package/dist/chunks/{permission-gbrtfntv.js → location-6kqg9tnj.js}

@@ -1,98 +1,98 @@
+import {
+  Service83,
+  node87
+} from "./location-470p2a86.js";
 import {
   Service82,
   node86
-} from "./permission-08nwsgbb.js";
-import {
-  Service81,
-  node85
-} from "./permission-29dqn0y6.js";
+} from "./location-y07gmyf9.js";
 import {
   SessionMessage2
-} from "./permission-gftt206x.js";
+} from "./location-gftt206x.js";
 import {
   StepFailedError2
-} from "./permission-vmwh049b.js";
+} from "./location-vmwh049b.js";
 import {
   SessionEvent2
-} from "./permission-ec1grn59.js";
+} from "./location-ec1grn59.js";
 import {
   SessionMessageTable2
-} from "./permission-a1bz86dw.js";
+} from "./location-a1bz86dw.js";
 import {
   prepare4
-} from "./permission-bha4atvq.js";
+} from "./location-bha4atvq.js";
 import {
   provenance2
-} from "./permission-26k5bknw.js";
+} from "./location-26k5bknw.js";
 import {
   decodeMessageRow2,
   preview2
-} from "./permission-xfc78b52.js";
+} from "./location-98s8e1rw.js";
 import {
   Service76,
   node80
-} from "./permission-tevt2hwp.js";
+} from "./location-jv1xxs7q.js";
 import {
-  Service17,
-  node19
-} from "./permission-p37t57k6.js";
+  Service21,
+  node24
+} from "./location-h13g856r.js";
 import {
   llmClient2
-} from "./permission-5t3nmthw.js";
+} from "./location-5t3nmthw.js";
 import {
-  Service28,
-  node31
-} from "./permission-4pjf94tq.js";
+  Service37,
+  node40
+} from "./location-s4t99ejd.js";
 import {
   baseTranscript2
-} from "./permission-wkwqyyf5.js";
+} from "./location-wgxkb9zp.js";
 import {
   make8
-} from "./permission-c65xb1pg.js";
+} from "./location-x0809vwh.js";
 import {
-  Service6,
-  node8
-} from "./permission-p9b684vp.js";
+  Service9,
+  node11
+} from "./location-4dhnehv0.js";
 import {
-  Service24,
-  node27
-} from "./permission-25fxnrt3.js";
+  Service28,
+  node32
+} from "./location-fn5vdp5m.js";
 import {
   serialized2,
   nextPromotable2,
   promote2
-} from "./permission-4d3d5dnh.js";
+} from "./location-59k38er6.js";
 import {
-  Service7,
+  Service6,
   isUntitled2,
-  node9
-} from "./permission-30jnt07w.js";
+  node8
+} from "./location-ae9xvxm4.js";
 import {
   DrainResult2,
-  Service37
-} from "./permission-gst7axd9.js";
+  Service60
+} from "./location-zee1rnkq.js";
 import {
-  node52
-} from "./permission-wg07ty1b.js";
+  node43
+} from "./location-tr98cyyj.js";
 import {
-  node45
-} from "./permission-7v0nq500.js";
+  node49
+} from "./location-g17wn8cw.js";
 import {
   Outcome2,
   make7
-} from "./permission-vwa7vyvt.js";
+} from "./location-a8daz2nm.js";
 import {
-  Service23
-} from "./permission-phz3h32g.js";
+  Service35
+} from "./location-619r8v3y.js";
 import {
-  node21
-} from "./permission-7e7c6www.js";
+  node17
+} from "./location-wm55hp8j.js";
 import {
   MAX_STEPS_PROMPT2
-} from "./permission-y44na4kk.js";
+} from "./location-y44na4kk.js";
 import {
   __export
-} from "./permission-9rqn6x4v.js";
+} from "./location-9rqn6x4v.js";
 
 // src/session/runner/llm.ts
 var exports_llm = {};
@@ -105,16 +105,16 @@ import { and, desc, eq, sql } from "drizzle-orm";
 import { Cause, Effect, Exit, FiberMap, Layer } from "effect";
 import { makeLocationNode } from "@opencode/util/effect/app-node";
 var CONTINUE_AFTER_INCOMPLETE_STREAM = "The previous response was interrupted. Continue from where you left off without repeating completed content.";
-var layer = Layer.effect(Service37, Effect.gen(function* () {
-  const bus = yield* Service81;
-  const lifecycle = yield* Service17;
+var layer = Layer.effect(Service60, Effect.gen(function* () {
+  const bus = yield* Service82;
+  const lifecycle = yield* Service21;
   const store = yield* Service76;
-  const context = yield* Service24;
-  const modelTransport = yield* Service28;
-  const db = (yield* Service82).db;
-  const compaction = yield* Service6;
-  const plugins = yield* Service23;
-  const title = yield* Service7;
+  const context = yield* Service28;
+  const modelTransport = yield* Service37;
+  const db = (yield* Service83).db;
+  const compaction = yield* Service9;
+  const plugins = yield* Service35;
+  const title = yield* Service6;
   const steps = yield* make7;
   const titles = yield* FiberMap.make();
   const drain = Effect.fn("SessionRunner.drain")(function* (input) {
@@ -361,24 +361,24 @@ var layer = Layer.effect(Service37, Effect.gen(function* () {
       }
     }
   });
-  return Service37.of({ drain });
+  return Service60.of({ drain });
 }));
 var node7 = makeLocationNode({
-  service: Service37,
+  service: Service60,
   layer,
   deps: [
-    node85,
-    node19,
+    node86,
+    node24,
     llmClient2,
-    node27,
-    node31,
+    node32,
+    node40,
     node80,
+    node11,
+    node17,
     node8,
-    node21,
-    node9,
-    node52,
-    node45,
-    node86
+    node43,
+    node49,
+    node87
   ]
 });
 

package/dist/chunks/{permission-6msgmcgs.js → location-6msgmcgs.js}

@@ -1,6 +1,6 @@
 import {
   AbsolutePath2
-} from "./permission-922hggd3.js";
+} from "./location-922hggd3.js";
 
 // src/database/path.ts
 import nodePath from "path";

package/dist/chunks/{permission-jswts1sh.js → location-6qr3rp4k.js}

@@ -1,16 +1,16 @@
 import {
   __export
-} from "./permission-9rqn6x4v.js";
+} from "./location-9rqn6x4v.js";
 
 // src/workspace/driver.ts
 var exports_driver = {};
 __export(exports_driver, {
   Binding: () => Binding2,
-  Error: () => Error4,
+  Error: () => Error5,
   ProviderNotFound: () => ProviderNotFound2,
   RegistryService: () => RegistryService2,
   WorkspaceDriver: () => exports_driver,
-  make: () => make18,
+  make: () => make16,
   node: () => node59,
   registry: () => registry2,
   registryNode: () => registryNode2
@@ -19,7 +19,7 @@ import { makeGlobalNode } from "@opencode/util/effect/app-node";
 import { Context, Effect, Layer, Schema } from "effect";
 var Binding2 = Schema.Record(Schema.String, Schema.Json);
 
-class Error4 extends Schema.TaggedError()("WorkspaceDriver.Error", {
+class Error5 extends Schema.TaggedError()("WorkspaceDriver.Error", {
   message: Schema.optional(Schema.String),
   cause: Schema.optional(Schema.Defect())
 }) {
@@ -29,7 +29,7 @@ class ProviderNotFound2 extends Schema.TaggedError()("WorkspaceDriver.ProviderNo
   provider: Schema.String
 }) {
 }
-var make18 = (driver) => driver;
+var make16 = (driver) => driver;
 
 class RegistryService2 extends Context.Service()("@opencode/WorkspaceDriverRegistry") {
 }
@@ -46,4 +46,4 @@ var registryNode2 = (drivers) => makeGlobalNode({
 });
 var node59 = registryNode2({});
 
-export { Binding2, Error4, ProviderNotFound2, make18, RegistryService2, registry2, registryNode2, node59, exports_driver };
+export { Binding2, Error5, ProviderNotFound2, make16, RegistryService2, registry2, registryNode2, node59, exports_driver };

package/dist/chunks/{permission-06fcmjmr.js → location-6r44w5n7.js}

@@ -1,29 +1,29 @@
 import {
   ephemeral2,
-  Service81,
-  node85
-} from "./permission-29dqn0y6.js";
+  Service82,
+  node86
+} from "./location-y07gmyf9.js";
 import {
-  Service70,
-  node74
-} from "./permission-mz4kmcba.js";
+  Service69,
+  node73
+} from "./location-jp0yz35h.js";
 import {
   __export
-} from "./permission-9rqn6x4v.js";
+} from "./location-9rqn6x4v.js";
 
 // src/wellknown.ts
 var exports_wellknown = {};
 __export(exports_wellknown, {
   Auth: () => Auth2,
   Config: () => Config2,
-  Event: () => Event8,
+  Event: () => Event12,
   Manifest: () => Manifest2,
   RemoteConfig: () => RemoteConfig2,
-  Service: () => Service46,
+  Service: () => Service55,
   WellKnown: () => exports_wellknown,
   inspect: () => inspect2,
-  node: () => node48,
-  resolve: () => resolve2
+  node: () => node60,
+  resolve: () => resolve4
 });
 import { Integration } from "@opencode/schema/integration";
 import { Context, Effect, Layer, Ref, Schema, Semaphore } from "effect";
@@ -46,9 +46,9 @@ var Manifest2 = Schema.Struct({
   remote_config: Schema.optional(RemoteConfig2)
 }).annotate({ identifier: "WellKnown.Manifest" });
 
-class Service46 extends Context.Service()("@opencode/WellKnown") {
+class Service55 extends Context.Service()("@opencode/WellKnown") {
 }
-var Event8 = {
+var Event12 = {
   Updated: ephemeral2({ type: "wellknown.updated", schema: {} })
 };
 var inspect2 = Effect.fn("WellKnown.inspect")(function* (origin) {
@@ -56,7 +56,7 @@ var inspect2 = Effect.fn("WellKnown.inspect")(function* (origin) {
   const http = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
   return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.acceptJson)).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(Manifest2)), Effect.mapError((cause) => new Error(`Failed to load wellknown manifest from ${url}`, { cause })));
 });
-var resolve2 = Effect.fn("WellKnown.resolve")(function* (input) {
+var resolve4 = Effect.fn("WellKnown.resolve")(function* (input) {
   const manifest = yield* inspect2(input.origin);
   return yield* resolveEntry({ origin: input.origin, integrationID: Integration.ID.make(input.origin.replace(/\/+$/, "")), manifest }, input.variables ?? {});
 });
@@ -75,10 +75,10 @@ var resolveEntry = Effect.fnUntraced(function* (entry, variables) {
 });
 var sourcesKey = "wellknown:sources";
 var Sources = Schema.Array(Schema.String);
-var layer = Layer.effect(Service46, Effect.gen(function* () {
+var layer = Layer.effect(Service55, Effect.gen(function* () {
   const http = yield* HttpClient.HttpClient;
-  const kv = yield* Service70;
-  const bus = yield* Service81;
+  const kv = yield* Service69;
+  const bus = yield* Service82;
   const cache = yield* Ref.make(new Map);
   const lock = Semaphore.makeUnsafe(1);
   const loadEntry = Effect.fn("WellKnown.loadEntry")(function* (origin) {
@@ -109,10 +109,10 @@ var layer = Layer.effect(Service46, Effect.gen(function* () {
     if (!changed)
       return false;
     yield* Ref.set(cache, next);
-    yield* bus.publish(Event8.Updated, {});
+    yield* bus.publish(Event12.Updated, {});
     return true;
   }, (effect) => lock.withPermit(effect));
-  return Service46.of({
+  return Service55.of({
     entries: load,
     snapshot: () => Array.from(Ref.getUnsafe(cache).values()),
     refresh,
@@ -125,7 +125,7 @@ var layer = Layer.effect(Service46, Effect.gen(function* () {
       const origins = Schema.is(Sources)(sources) ? sources : [];
       yield* kv.set(sourcesKey, Array.from(new Set([...origins, origin])));
       yield* Ref.update(cache, (current) => new Map(current).set(origin, entry));
-      yield* bus.publish(Event8.Updated, {});
+      yield* bus.publish(Event12.Updated, {});
       return entry;
     }, (effect, _value) => lock.withPermit(effect)),
     remove: Effect.fn("WellKnown.remove")(function* (value) {
@@ -138,11 +138,11 @@ var layer = Layer.effect(Service46, Effect.gen(function* () {
         next.delete(origin);
         return next;
       });
-      yield* bus.publish(Event8.Updated, {});
+      yield* bus.publish(Event12.Updated, {});
     }, (effect, _value) => lock.withPermit(effect)),
     resolve: Effect.fn("WellKnown.resolveEntry")((entry, variables) => resolveEntry(entry, variables).pipe(Effect.provideService(HttpClient.HttpClient, http)))
   });
 }));
-var node48 = makeGlobalNode({ service: Service46, layer, deps: [httpClient, node74, node85] });
+var node60 = makeGlobalNode({ service: Service55, layer, deps: [httpClient, node73, node86] });
 
-export { Auth2, RemoteConfig2, Config2, Manifest2, Service46, Event8, inspect2, resolve2, node48, exports_wellknown };
+export { Auth2, RemoteConfig2, Config2, Manifest2, Service55, Event12, inspect2, resolve4, node60, exports_wellknown };

package/dist/chunks/{permission-88e6yazr.js → location-6r7eqvte.js}

@@ -1,33 +1,33 @@
 import {
   key2
-} from "./permission-nzyhnfxz.js";
+} from "./location-44h5tttr.js";
 import {
-  Service81
-} from "./permission-29dqn0y6.js";
+  Service82
+} from "./location-y07gmyf9.js";
 import {
   OAuth3,
-  Event15
-} from "./permission-x6h4pr1d.js";
+  Event17
+} from "./location-vtqj2nn1.js";
 import {
-  ID8,
+  ID10,
   MethodID2
-} from "./permission-edfdbxqm.js";
+} from "./location-9p3nq51p.js";
 import {
-  ID7,
+  ID9,
   aisdk2,
   mergeOverlay2,
-  Service65
-} from "./permission-z0xds83t.js";
+  Service67
+} from "./location-tbc1560d.js";
 import {
-  ID6
-} from "./permission-6mtv4z71.js";
+  ID8
+} from "./location-jvbe9kz0.js";
 import {
-  load3,
-  derive3
-} from "./permission-qa9q1t1p.js";
+  load2,
+  derive2
+} from "./location-a6akvax8.js";
 import {
   useragent2
-} from "./permission-vqzqm7px.js";
+} from "./location-9k0trt10.js";
 
 // src/plugin/provider/github-copilot.ts
 import { Effect, Option, Schema, Semaphore, Stream } from "effect";
@@ -59,7 +59,7 @@ var decodeUser = Schema.decodeUnknownOption(User);
 var JsonBody = Schema.fromJsonString(Schema.Unknown);
 var decodeBody = Schema.decodeUnknownOption(JsonBody);
 var oauth = (app) => ({
-  integrationID: ID8.make("github-copilot"),
+  integrationID: ID10.make("github-copilot"),
   method: {
     id: methodID,
     type: "oauth",
@@ -157,8 +157,8 @@ var oauth = (app) => ({
 var GithubCopilotPlugin2 = define({
   id: "opencode.provider.github.copilot",
   effect: Effect.fn(function* (ctx) {
-    const providers = yield* Service65;
-    const bus = yield* Service81;
+    const providers = yield* Service67;
+    const bus = yield* Service82;
     const loading = Semaphore.makeUnsafe(1);
     const loaded = {};
     const load = Effect.fn("GithubCopilotPlugin.load")(function* () {
@@ -173,9 +173,9 @@ var GithubCopilotPlugin2 = define({
         return;
       }
       const url = copilotBaseURL2(credential.metadata) ?? baseURL();
-      const provider = yield* providers.get(ID7.githubCopilot);
+      const provider = yield* providers.get(ID9.githubCopilot);
       const remote = yield* Effect.tryPromise({
-        try: () => load3(url, {
+        try: () => load2(url, {
           ...provider?.headers,
           Authorization: `Bearer ${credential.refresh}`,
           "User-Agent": useragent2(ctx.app),
@@ -194,13 +194,13 @@ var GithubCopilotPlugin2 = define({
       editor.method.update(oauth(ctx.app));
     });
     yield* ctx.provider.transform((evt) => {
-      const item = evt.get(ID7.githubCopilot);
+      const item = evt.get(ID9.githubCopilot);
       if (!item)
         return;
       if (loaded.models) {
         evt.add({
           info: item.provider,
-          models: Array.from(derive3(loaded.baseURL ?? baseURL(), loaded.models, Array.from(item.models.values())).values()),
+          models: Array.from(derive2(loaded.baseURL ?? baseURL(), loaded.models, Array.from(item.models.values())).values()),
           sourceConnection: loaded.connection
         });
         return;
@@ -214,17 +214,17 @@ var GithubCopilotPlugin2 = define({
       }
     });
     yield* ctx.model.transform((models) => {
-      if (models.get(ID7.githubCopilot, ID6.make("gpt-5-chat-latest"))) {
-        models.update(ID7.githubCopilot, ID6.make("gpt-5-chat-latest"), (model) => {
+      if (models.get(ID9.githubCopilot, ID8.make("gpt-5-chat-latest"))) {
+        models.update(ID9.githubCopilot, ID8.make("gpt-5-chat-latest"), (model) => {
           model.enabled = false;
         });
       }
     });
     const refresh = () => loading.withPermit(load().pipe(Effect.andThen(ctx.provider.reload())));
-    yield* bus.subscribe(Event15.Switched).pipe(Stream.filter((event) => event.data.integrationID === ID8.make("github-copilot")), Stream.runForEach(refresh), Effect.forkScoped({ startImmediately: true }));
+    yield* bus.subscribe(Event17.Switched).pipe(Stream.filter((event) => event.data.integrationID === ID10.make("github-copilot")), Stream.runForEach(refresh), Effect.forkScoped({ startImmediately: true }));
     yield* refresh().pipe(Effect.forkScoped);
     yield* ctx.aisdk.hook("sdk", Effect.fn(function* (evt) {
-      if (evt.model.providerID !== ID7.githubCopilot)
+      if (evt.model.providerID !== ID9.githubCopilot)
         return;
       if (evt.package !== "@ai-sdk/github-copilot")
         return;
@@ -233,7 +233,7 @@ var GithubCopilotPlugin2 = define({
       evt.sdk = mod.createOpenaiCompatible(evt.options);
     }));
     yield* ctx.session.hook("model.request", (evt) => Effect.gen(function* () {
-      if (evt.model.providerID !== ID7.githubCopilot)
+      if (evt.model.providerID !== ID9.githubCopilot)
         return;
       const session = yield* ctx.session.get({ sessionID: evt.sessionID }).pipe(Effect.orElseSucceed(() => {
         return;
@@ -243,9 +243,9 @@ var GithubCopilotPlugin2 = define({
       evt.headers["X-Interaction-Id"] = evt.sessionID;
       if (interaction !== "conversation-agent")
         evt.headers["x-initiator"] = "agent";
-    }), { providerID: ID7.githubCopilot });
+    }), { providerID: ID9.githubCopilot });
     yield* ctx.session.hook("http.request", (evt) => Effect.gen(function* () {
-      if (evt.model.providerID !== ID7.githubCopilot)
+      if (evt.model.providerID !== ID9.githubCopilot)
         return;
       const token = evt.request.headers.get("x-api-key");
       if (!token)
@@ -253,9 +253,9 @@ var GithubCopilotPlugin2 = define({
       const text = yield* Effect.promise(() => evt.request.clone().text());
       const body = Option.getOrUndefined(decodeBody(text));
       applyHeaders(evt.request.headers, token, ctx.app, requestMetadata(evt.request.url, body), true);
-    }), { providerID: ID7.githubCopilot });
+    }), { providerID: ID9.githubCopilot });
     yield* ctx.aisdk.hook("language", Effect.fn(function* (evt) {
-      if (evt.model.providerID !== ID7.githubCopilot)
+      if (evt.model.providerID !== ID9.githubCopilot)
         return;
       if (evt.sdk.responses === undefined && evt.sdk.chat === undefined) {
         evt.language = evt.sdk.languageModel(evt.model.modelID ?? evt.model.id);

package/dist/chunks/location-6rph4hcx.js

@@ -0,0 +1,49 @@
+import {
+  Service46
+} from "./location-6rr5h8pv.js";
+import {
+  match2
+} from "./location-y1fvbwt7.js";
+import {
+  observe2
+} from "./location-qsdy395h.js";
+import {
+  __export
+} from "./location-9rqn6x4v.js";
+
+// src/config/plugin/policy.ts
+var exports_policy = {};
+__export(exports_policy, {
+  ConfigPolicyPlugin: () => exports_policy,
+  Plugin: () => Plugin28
+});
+import { define } from "@opencode/plugin/effect/plugin";
+import { Effect } from "effect";
+var Plugin28 = define({
+  id: "opencode.config.policy",
+  effect: Effect.fn(function* (ctx) {
+    const config = yield* Service46;
+    const loaded = yield* observe2(config, ctx.event, ctx.provider.reload());
+    const policies = () => loaded.entries.filter((entry) => entry.type === "document").toReversed().flatMap((entry) => entry.info.experimental?.policies ?? []);
+    yield* ctx.provider.transform((providers) => {
+      for (const record of providers.list()) {
+        const policy = policies().findLast((policy) => policy.action === "provider.use" && match2(record.provider.id, policy.resource));
+        if (policy?.effect === "deny")
+          providers.remove(record.provider.id);
+      }
+    });
+    yield* ctx.permission.hook("evaluate", (event) => Effect.sync(() => {
+      const current = policies();
+      const denied = event.resources.some((resource) => {
+        const policy = current.findLast((policy) => policy.action === "permission" && match2(`${event.action}:${resource}`, policy.resource));
+        return policy?.effect === "deny";
+      });
+      if (!denied)
+        return;
+      event.effect = "deny";
+      event.message = "Blocked by configuration policy";
+    }));
+  })
+});
+
+export { Plugin28, exports_policy };