@openpalm/lib 0.11.0-beta.11 → 0.11.0-beta.14

package/src/control-plane/core-assets.ts

@@ -5,19 +5,24 @@
  *   stack/              — compose runtime assets (core.compose.yml)
  *
  * This module manages runtime-owned core files only.
- * Registry catalog refresh is handled separately in registry.ts.
+ * Addon compose bundle generation and registry catalog refresh are handled
+ * separately in registry.ts.
  * Env validation has moved to `akm vault` + the in-house redactor — the
  * historical `.env.schema` files (varlock format) were retired in #391.
  */
 import { mkdirSync, writeFileSync, readFileSync, existsSync, copyFileSync } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { resolveStateDir, resolveOpenPalmHome, resolveBackupsDir, resolveStashDir } from "./home.js";
+import { resolveDataDir, resolveOpenPalmHome, resolveBackupsDir, resolveStashDir } from "./home.js";
 import { createLogger } from "../logger.js";
 import { sha256 } from "./crypto.js";
 
 const logger = createLogger("core-assets");
 
+function bundledAssetPath(relPath: string): string {
+  return join(dirname(fileURLToPath(import.meta.url)), '../../../../.openpalm', relPath);
+}
+
 // ── Core Compose (stack/) ─────────────────────────────────────────────
 
 export function ensureCoreCompose(): string {
@@ -27,13 +32,21 @@ export function ensureCoreCompose(): string {
 }
 
 export function readCoreCompose(): string {
-  return readFileSync(`${resolveOpenPalmHome()}/config/stack/core.compose.yml`, "utf-8");
+  const livePath = `${resolveOpenPalmHome()}/config/stack/core.compose.yml`;
+  if (existsSync(livePath)) {
+    return readFileSync(livePath, 'utf-8');
+  }
+  return readFileSync(bundledAssetPath('config/stack/core.compose.yml'), 'utf-8');
+}
+
+export function readBundledStackAsset(name: string): string {
+  return readFileSync(bundledAssetPath(`config/stack/${name}`), 'utf-8');
 }
 
 // ── OpenCode System Config ──────────────────────────────────────────
 
 export function ensureOpenCodeSystemConfig(): void {
-  const dir = `${resolveStateDir()}/assistant`;
+  const dir = `${resolveDataDir()}/assistant`;
   mkdirSync(dir, { recursive: true });
 }
 
@@ -49,11 +62,11 @@ export function ensureOpenCodeSystemConfig(): void {
  * Returns the list of stash-relative paths that were actually written
  * (empty on re-run when every seed already exists on disk).
  *
- * `seeds` is a map of stash-relative path → file content. Keys MUST be
- * forward-slash relative paths that stay inside `data/stash/`; any key
- * that escapes the stash directory after canonicalization throws,
+ * `seeds` is a map of knowledge-relative path → file content. Keys MUST be
+ * forward-slash relative paths that stay inside `knowledge/`; any key
+ * that escapes the knowledge directory after canonicalization throws,
  * preventing a malicious caller from writing arbitrary files. Source of
- * truth for the seeded files lives at `.openpalm/stash/` in the
+ * truth for the seeded files lives at `.openpalm/knowledge/` in the
  * repo; the CLI embeds them at build time and passes the embedded
  * record directly.
  */
@@ -100,12 +113,15 @@ const VERSION = resolveAssetVersion();
 // overwritten) via seedOpenPalmDir (skipExisting) or SEEDED_ASSETS below.
 const MANAGED_ASSETS: { relPath: string; githubFilename: string }[] = [
   { relPath: "config/stack/core.compose.yml", githubFilename: ".openpalm/config/stack/core.compose.yml" },
+  { relPath: "config/stack/services.compose.yml", githubFilename: ".openpalm/config/stack/services.compose.yml" },
+  { relPath: "config/stack/channels.compose.yml", githubFilename: ".openpalm/config/stack/channels.compose.yml" },
 ];
 
 // Seeded once — written only when the file does not exist yet.
 // User edits always win; upgrade never touches these files.
 const SEEDED_ASSETS: { relPath: string; githubFilename: string }[] = [
   { relPath: "config/assistant/opencode.jsonc", githubFilename: ".openpalm/config/assistant/opencode.jsonc" },
+  { relPath: "config/stack/custom.compose.yml", githubFilename: ".openpalm/config/stack/custom.compose.yml" },
 ];
 
 async function downloadAsset(filename: string): Promise<string> {

package/src/control-plane/docker.ts

@@ -39,10 +39,12 @@ function run(
 
 /**
  * Resolve the Docker Compose project name.
- * Honors COMPOSE_PROJECT_NAME (Docker standard) and OP_PROJECT_NAME (legacy).
+ * Honors OP_PROJECT_NAME first for OpenPalm stacks, then COMPOSE_PROJECT_NAME.
  */
-export function resolveComposeProjectName(): string {
+export function resolveComposeProjectName(envOverrides: Record<string, string> = {}): string {
   return (
+    envOverrides.OP_PROJECT_NAME?.trim() ||
+    envOverrides.COMPOSE_PROJECT_NAME?.trim() ||
     process.env.OP_PROJECT_NAME?.trim() ||
     process.env.COMPOSE_PROJECT_NAME?.trim() ||
     "openpalm"
@@ -87,12 +89,14 @@ export async function checkDockerCompose(): Promise<DockerResult> {
   });
 }
 
-/** Build common prefix: compose -f ... --project-name ... --env-file ... */
-function buildComposeArgs(options: { files: string[]; envFiles?: string[] }): string[] {
-  const args = ["compose", ...options.files.flatMap((f) => ["-f", f]), "--project-name", resolveComposeProjectName()];
+/** Build common prefix: compose -f ... --project-name ... --env-file ... --profile ... */
+function buildComposeArgs(options: { files: string[]; envFiles?: string[]; profiles?: string[] }): string[] {
+  const envOverrides = collectEnvOverrides(options.envFiles);
+  const args = ["compose", ...options.files.flatMap((f) => ["-f", f]), "--project-name", resolveComposeProjectName(envOverrides)];
   for (const ef of options.envFiles ?? []) {
     if (existsSync(ef)) args.push("--env-file", ef);
   }
+  for (const p of options.profiles ?? []) args.push("--profile", p);
   return args;
 }
 
@@ -108,7 +112,7 @@ function collectEnvOverrides(envFiles?: string[]): Record<string, string> {
  * Must be called before any lifecycle mutation (install/apply/update).
  */
 export async function composePreflight(
-  options: { files: string[]; envFiles?: string[] }
+  options: { files: string[]; envFiles?: string[]; profiles?: string[] }
 ): Promise<DockerResult> {
   const args = buildComposeArgs(options);
   args.push("config", "--quiet");
@@ -119,22 +123,23 @@ export async function composePreflight(
  * Run compose config preflight validation before any mutation.
  * Skipped when OP_SKIP_COMPOSE_PREFLIGHT is set (tests, CI).
  */
-async function runPreflight(options: { files: string[]; envFiles?: string[] }): Promise<void> {
+async function runPreflight(options: { files: string[]; envFiles?: string[]; profiles?: string[] }): Promise<void> {
   if (options.files.length === 0 || process.env.OP_SKIP_COMPOSE_PREFLIGHT) return;
   const result = await composePreflight(options);
   if (!result.ok) {
-    const project = resolveComposeProjectName();
+    const project = resolveComposeProjectName(collectEnvOverrides(options.envFiles));
     const fileArgs = options.files.map((f) => `-f ${f}`).join(" ");
     const envArgs = (options.envFiles ?? []).map((f) => `--env-file ${f}`).join(" ");
+    const profileArgs = (options.profiles ?? []).map((p) => `--profile ${p}`).join(" ");
     throw new Error(
       `Compose preflight failed: ${result.stderr}\n` +
-      `Resolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} config --quiet`
+      `Resolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} ${profileArgs} config --quiet`
     );
   }
 }
 
 export async function composeConfigServices(
-  options: { files: string[]; envFiles?: string[] }
+  options: { files: string[]; envFiles?: string[]; profiles?: string[] }
 ): Promise<{ ok: boolean; services: string[] }> {
   const args = buildComposeArgs(options);
   args.push("config", "--services");
@@ -163,7 +168,6 @@ export async function composeUp(
     return { ok: false, stdout: "", stderr: "Compose file not found", code: 1 };
   }
   const args = buildComposeArgs(options);
-  for (const p of options.profiles ?? []) args.push("--profile", p);
   args.push("up", "-d");
   if (options.forceRecreate) args.push("--force-recreate");
   if (options.removeOrphans) args.push("--remove-orphans");
@@ -187,7 +191,6 @@ export async function composeDown(
     return { ok: false, stdout: "", stderr: "Compose file not found", code: 1 };
   }
   const args = buildComposeArgs(options);
-  for (const p of options.profiles ?? []) args.push("--profile", p);
   args.push("down");
   if (options.removeVolumes) args.push("-v");
   return run(args, undefined);
@@ -313,7 +316,6 @@ export async function composePullService(
 ): Promise<DockerResult> {
   await runPreflight(options);
   const args = buildComposeArgs(options);
-  for (const p of options.profiles ?? []) args.push("--profile", p);
   args.push("pull", service);
   return run(args, undefined, PULL_TIMEOUT_MS, collectEnvOverrides(options.envFiles));
 }
@@ -323,7 +325,6 @@ export async function composePull(
 ): Promise<DockerResult> {
   await runPreflight(options);
   const args = buildComposeArgs(options);
-  for (const p of options.profiles ?? []) args.push("--profile", p);
   args.push("pull");
   return run(args, undefined, PULL_TIMEOUT_MS, collectEnvOverrides(options.envFiles));
 }

package/src/control-plane/env.test.ts

@@ -86,25 +86,25 @@ describe("quoteEnvValue quoting strategy (via mergeEnvContent)", () => {
 
 describe("mergeEnvContent updates existing keys with special char values", () => {
   it("updates an existing key to a value with =", () => {
-    const input = "export ADMIN_TOKEN=old_value\n";
-    const result = mergeEnvContent(input, { ADMIN_TOKEN: "new=value=here" });
+    const input = "export TEST_VALUE=old_value\n";
+    const result = mergeEnvContent(input, { TEST_VALUE: "new=value=here" });
     const parsed = parseEnvContent(result);
-    expect(parsed.ADMIN_TOKEN).toBe("new=value=here");
+    expect(parsed.TEST_VALUE).toBe("new=value=here");
   });
 
   it("updates an existing key to a value with $", () => {
-    const input = "export ADMIN_TOKEN=old_value\n";
-    const result = mergeEnvContent(input, { ADMIN_TOKEN: "tok$en" });
+    const input = "export TEST_VALUE=old_value\n";
+    const result = mergeEnvContent(input, { TEST_VALUE: "tok$en" });
     const parsed = parseEnvContent(result);
-    expect(parsed.ADMIN_TOKEN).toBe("tok$en");
+    expect(parsed.TEST_VALUE).toBe("tok$en");
   });
 
   it("preserves export prefix when updating with special chars", () => {
-    const input = "export ADMIN_TOKEN=old_value\n";
-    const result = mergeEnvContent(input, { ADMIN_TOKEN: "new#value" });
-    expect(result).toMatch(/^export ADMIN_TOKEN=/m);
+    const input = "export TEST_VALUE=old_value\n";
+    const result = mergeEnvContent(input, { TEST_VALUE: "new#value" });
+    expect(result).toMatch(/^export TEST_VALUE=/m);
     const parsed = parseEnvContent(result);
-    expect(parsed.ADMIN_TOKEN).toBe("new#value");
+    expect(parsed.TEST_VALUE).toBe("new#value");
   });
 });
 

package/src/control-plane/env.ts

@@ -26,7 +26,7 @@ export function expandEnvVars(input: string, vars: Record<string, string>): stri
   return input.replace(/\$\{([^}:]+)(?::-([^}]*))?\}/g, (_, name, def) => vars[name] ?? def ?? '');
 }
 
-function quoteEnvValue(value: string): string {
+export function quoteEnvValue(value: string): string {
   if (value.length === 0) return '';
   const needsQuoting = /[#"'\\\n\r$]/.test(value) || value !== value.trim();
   if (!needsQuoting) return value;

package/src/control-plane/extends-support.test.ts

@@ -1,8 +1,8 @@
 /**
- * Verify that Compose `extends` is supported as an optional addon pattern.
+ * Verify that Compose `extends` is supported in the custom compose file.
  *
  * This is a narrow smoke test proving the canonical compose resolution
- * works when an addon uses Compose `extends` to inherit from a base service.
+ * works when custom.compose.yml uses Compose `extends` to inherit from a base service.
  */
 import { describe, test, expect, beforeAll, afterAll } from "bun:test";
 import { mkdirSync, writeFileSync, rmSync, existsSync } from "node:fs";
@@ -15,7 +15,7 @@ describe("compose extends support", () => {
 
   beforeAll(() => {
     fixtureDir = join(tmpdir(), `openpalm-extends-test-${Date.now()}`);
-    mkdirSync(join(fixtureDir, "stack/addons/extended-addon"), { recursive: true });
+    mkdirSync(join(fixtureDir, "stack"), { recursive: true });
 
     // Write a minimal core compose
     writeFileSync(
@@ -30,9 +30,9 @@ describe("compose extends support", () => {
       ].join("\n")
     );
 
-    // Write an addon that uses `extends`
+    // Write custom compose content that uses `extends`
     writeFileSync(
-      join(fixtureDir, "stack/addons/extended-addon/compose.yml"),
+      join(fixtureDir, "stack/custom.compose.yml"),
       [
         "services:",
         "  extended-service:",
@@ -54,16 +54,16 @@ describe("compose extends support", () => {
 
   test("fixture files exist", () => {
     expect(existsSync(join(fixtureDir, "stack/core.compose.yml"))).toBe(true);
-    expect(existsSync(join(fixtureDir, "stack/addons/extended-addon/compose.yml"))).toBe(true);
+    expect(existsSync(join(fixtureDir, "stack/custom.compose.yml"))).toBe(true);
   });
 
-  test("extends addon composes correctly with discoverStackOverlays", async () => {
+  test("extends custom compose works with discoverStackOverlays", async () => {
     const { discoverStackOverlays } = await import("./config-persistence.js");
     const overlays = discoverStackOverlays(join(fixtureDir, "stack"));
 
     expect(overlays.length).toBe(2);
     expect(overlays[0]).toContain("core.compose.yml");
-    expect(overlays[1]).toContain("extended-addon/compose.yml");
+    expect(overlays[1]).toContain("custom.compose.yml");
   });
 
   test.skipIf(skipDockerAssertions)("extends addon passes docker compose config preflight (requires Docker)", async () => {

package/src/control-plane/home.ts

@@ -2,13 +2,12 @@
  * Home directory layout for the OpenPalm control plane (v0.11.0+).
  *
  * Single ~/.openpalm/ root:
- *   config/    — user-editable config + system config files (auth.json, akm/)
- *   config/stack/ — compose runtime + stack config (stack.env, guardian.env, stack.yml, addons/)
- *   cache/     — regenerable/semi-persistent data (akm cache, guardian cache, rollback)
- *   state/     — persistent service data (assistant, admin, guardian, logs, backups, registry)
- *   stash/     — akm knowledge (skills, vaults, agents)
+ *   config/    — user-editable config + system config files (akm/)
+ *   config/stack/ — compose runtime + stack config (stack.env, stack.yml, auth.json, fixed compose files)
+ *   data/      — persistent service data, logs, backups, rollback
+ *   knowledge/ — akm knowledge (skills, vaults, agents)
  *   workspace/ — shared assistant work area
- *   config/stack/ — compose runtime assets + stack config (stack.env, guardian.env, stack.yml)
+ *   config/stack/ — compose runtime assets + stack config (stack.env, stack.yml)
  */
 import { mkdirSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
@@ -34,36 +33,31 @@ export function resolveConfigDir(): string {
 }
 
 export function resolveStashDir(): string {
-  return `${resolveOpenPalmHome()}/stash`;
+  return `${resolveOpenPalmHome()}/knowledge`;
 }
 
 export function resolveWorkspaceDir(): string {
   return `${resolveOpenPalmHome()}/workspace`;
 }
 
-export function resolveCacheDir(): string {
-  return `${resolveOpenPalmHome()}/cache`;
-}
-
-export function resolveStateDir(): string {
-  return `${resolveOpenPalmHome()}/state`;
+export function resolveDataDir(): string {
+  return `${resolveOpenPalmHome()}/data`;
 }
 
 export function resolveStackDir(): string {
   return `${resolveConfigDir()}/stack`;
 }
 
-// Derived from stateDir — used by registry.ts, rollback.ts, backup.ts, core-assets.ts
 export function resolveLogsDir(): string {
-  return `${resolveStateDir()}/logs`;
+  return `${resolveDataDir()}/logs`;
 }
 
 export function resolveBackupsDir(): string {
-  return `${resolveStateDir()}/backups`;
+  return `${resolveDataDir()}/backups`;
 }
 
 export function resolveRegistryDir(): string {
-  return `${resolveStateDir()}/registry`;
+  return `${resolveDataDir()}/registry`;
 }
 
 export function resolveRegistryAddonsDir(): string {
@@ -75,7 +69,7 @@ export function resolveRegistryAutomationsDir(): string {
 }
 
 export function resolveRollbackDir(): string {
-  return `${resolveCacheDir()}/rollback`;
+  return `${resolveDataDir()}/rollback`;
 }
 
 // ── Directory Setup ──────────────────────────────────────────────────
@@ -91,39 +85,33 @@ export function ensureHomeDirs(): void {
     `${home}/config`,
     `${home}/config/assistant`,
     `${home}/config/guardian`,
-    `${home}/config/akm`,           // AKM_CONFIG_DIR — akm setup config.json lives here
-
-    // cache/ — regenerable/semi-persistent data
-    `${home}/cache`,
-    `${home}/cache/akm`,            // akm registry index, downloaded artifacts
-    `${home}/cache/rollback`,       // rollback snapshots
-
-    // state/ — persistent service data
-    `${home}/state`,
-    `${home}/state/assistant`,      // assistant HOME bind mount
-    `${home}/state/admin`,          // admin home bind mount
-    `${home}/state/guardian`,       // guardian runtime data
-    `${home}/state/akm`,            // shared akm operational data (NOT config)
-    `${home}/state/akm/data`,
-    `${home}/state/akm/state`,
-    `${home}/state/logs`,
-    `${home}/state/logs/opencode`,
-    `${home}/state/backups`,
-    `${home}/state/registry`,
-    `${home}/state/registry/addons`,
-    `${home}/state/registry/automations`,
-
-    // stash/ — akm knowledge (skills, vaults, agents); stash/tasks/ for scheduled automations
-    `${home}/stash`,
-    `${home}/stash/vaults`,
-    `${home}/stash/tasks`,
+    `${home}/config/akm`,           // akm XDG config directory
+
+    // data/ — persistent service data
+    `${home}/data`,
+    `${home}/data/assistant`,      // assistant HOME bind mount
+    `${home}/data/assistant/.cache`,
+    `${home}/data/assistant/.local/bin`,
+    `${home}/data/assistant/.local/share/opencode`,
+    `${home}/data/assistant/.local/state/opencode`,
+    `${home}/data/admin`,          // admin home bind mount
+    `${home}/data/guardian`,       // guardian runtime data
+    `${home}/data/akm/cache`,      // akm cache
+    `${home}/data/akm/data`,       // akm durable data
+    `${home}/data/logs`,           // service logs and audit files
+    `${home}/data/backups`,        // lifecycle backup snapshots
+    `${home}/data/rollback`,       // deploy rollback snapshots
+    // knowledge/ — akm knowledge (skills, env, secrets, agents); knowledge/tasks/ for scheduled automations
+    `${home}/knowledge`,
+    `${home}/knowledge/env`,
+    `${home}/knowledge/secrets`,
+    `${home}/knowledge/tasks`,
 
     // workspace/ — shared assistant work area
     `${home}/workspace`,
 
-    // config/stack/ — compose runtime (addon overlays + stack config files)
+    // config/stack/ — compose runtime + stack config files
     `${home}/config/stack`,
-    `${home}/config/stack/addons`,
   ]) {
     mkdirSync(dir, { recursive: true });
   }

package/src/control-plane/host-opencode.test.ts

@@ -16,10 +16,9 @@ function makeState(homeDir: string): ControlPlaneState {
   return {
     homeDir,
     configDir: join(homeDir, "config"),
-    stashDir: join(homeDir, "stash"),
+    stashDir: join(homeDir, "knowledge"),
     workspaceDir: join(homeDir, "workspace"),
-    cacheDir: join(homeDir, "cache"),
-    stateDir: join(homeDir, "state"),
+    dataDir: join(homeDir, "data"),
     stackDir: join(homeDir, "config/stack"),
     services: {},
     artifacts: { compose: "" },
@@ -104,6 +103,48 @@ describe("detectHostOpenCode", () => {
       expect(status.providerCount).toBe(0);
     });
   });
+
+  it("returns modelPreferences when model and small_model are set", () => {
+    const configDir = join(xdgRoot, "config", "opencode");
+    mkdirSync(configDir, { recursive: true });
+    writeFileSync(join(configDir, "opencode.json"), JSON.stringify({
+      provider: { groq: {} },
+      model: "groq/llama-3.3-70b-versatile",
+      small_model: "groq/llama-3.1-8b-instant",
+    }));
+    withXdgEnv(`${xdgRoot}/config`, `${xdgRoot}/data`, () => {
+      const status = detectHostOpenCode();
+      expect(status.modelPreferences).toBeDefined();
+      expect(status.modelPreferences?.model).toBe("groq/llama-3.3-70b-versatile");
+      expect(status.modelPreferences?.small_model).toBe("groq/llama-3.1-8b-instant");
+    });
+  });
+
+  it("omits modelPreferences when no model fields are set", () => {
+    const configDir = join(xdgRoot, "config", "opencode");
+    mkdirSync(configDir, { recursive: true });
+    writeFileSync(join(configDir, "opencode.json"), JSON.stringify({
+      provider: { groq: {} },
+    }));
+    withXdgEnv(`${xdgRoot}/config`, `${xdgRoot}/data`, () => {
+      const status = detectHostOpenCode();
+      expect(status.modelPreferences).toBeUndefined();
+    });
+  });
+
+  it("returns partial modelPreferences when only model is set", () => {
+    const configDir = join(xdgRoot, "config", "opencode");
+    mkdirSync(configDir, { recursive: true });
+    writeFileSync(join(configDir, "opencode.json"), JSON.stringify({
+      provider: { anthropic: {} },
+      model: "anthropic/claude-sonnet-4-5",
+    }));
+    withXdgEnv(`${xdgRoot}/config`, `${xdgRoot}/data`, () => {
+      const status = detectHostOpenCode();
+      expect(status.modelPreferences?.model).toBe("anthropic/claude-sonnet-4-5");
+      expect(status.modelPreferences?.small_model).toBeUndefined();
+    });
+  });
 });
 
 // ── importHostOpenCode ────────────────────────────────────────────────────────
@@ -132,6 +173,8 @@ describe("importHostOpenCode", () => {
     writeFileSync(join(hostConfigDir, "opencode.json"), JSON.stringify({
       provider: { anthropic: { name: "Anthropic" }, groq: {} },
       model: "anthropic/claude-3-5-sonnet",
+      small_model: "openai/gpt-4o-mini",
+      disabled_providers: ["groq"],
       // These should be stripped:
       plugin: [{ module: "some-plugin" }],
       mcp: { server: {} },
@@ -153,14 +196,16 @@ describe("importHostOpenCode", () => {
     const destConfig = JSON.parse(readFileSync(join(opHome, "config", "assistant", "opencode.json"), "utf-8"));
     expect(destConfig.provider).toEqual({ anthropic: { name: "Anthropic" }, groq: {} });
     expect(destConfig.model).toBe("anthropic/claude-3-5-sonnet");
+    expect(destConfig.small_model).toBe("openai/gpt-4o-mini");
+    expect(destConfig.disabled_providers).toEqual(["groq"]);
     expect(destConfig.plugin).toBeUndefined();
     expect(destConfig.mcp).toBeUndefined();
 
     // Verify auth.json was written
-    expect(existsSync(join(opHome, "config", "auth.json"))).toBe(true);
+    expect(existsSync(join(opHome, "knowledge", "secrets", "auth.json"))).toBe(true);
 
     // Verify auth.json permissions are 0o600
-    const authStat = statSync(join(opHome, "config", "auth.json"));
+    const authStat = statSync(join(opHome, "knowledge", "secrets", "auth.json"));
     // On Linux, mode & 0o777 extracts permission bits
     expect(authStat.mode & 0o777).toBe(0o600);
   });
@@ -217,6 +262,34 @@ describe("importHostOpenCode", () => {
     expect(written.provider.anthropic.name).toBe("Host Anthropic");
   });
 
+  it("keeps existing model defaults and fills only missing host fields", () => {
+    const hostConfigDir = join(xdgRoot, "config", "opencode");
+    mkdirSync(hostConfigDir, { recursive: true });
+    writeFileSync(join(hostConfigDir, "opencode.json"), JSON.stringify({
+      provider: { openai: { name: "Host OpenAI" } },
+      model: "openai/gpt-4.1",
+      small_model: "openai/gpt-4.1-mini",
+      disabled_providers: ["groq"],
+    }));
+
+    const state = makeState(opHome);
+    const destDir = join(opHome, "config", "assistant");
+    mkdirSync(destDir, { recursive: true });
+    writeFileSync(join(destDir, "opencode.json"), JSON.stringify({
+      provider: { anthropic: { name: "Existing Anthropic" } },
+      model: "anthropic/claude-sonnet-4",
+    }));
+
+    withXdgEnv(`${xdgRoot}/config`, `${xdgRoot}/data`, () => {
+      importHostOpenCode(state);
+    });
+
+    const written = JSON.parse(readFileSync(join(destDir, "opencode.json"), "utf-8"));
+    expect(written.model).toBe("anthropic/claude-sonnet-4");
+    expect(written.small_model).toBe("openai/gpt-4.1-mini");
+    expect(written.disabled_providers).toEqual(["groq"]);
+  });
+
   it("returns zero counts when no host config is present", () => {
     const state = makeState(opHome);
     withXdgEnv(`${xdgRoot}/config`, `${xdgRoot}/data`, () => {
@@ -228,10 +301,9 @@ describe("importHostOpenCode", () => {
   });
 
   it("partial-merge auth: does not overwrite existing credential, adds new one", () => {
-    // Pre-seed OP_HOME/config/auth.json with one existing credential
-    const opConfigDir = join(opHome, "config");
-    mkdirSync(opConfigDir, { recursive: true });
-    writeFileSync(join(opConfigDir, "auth.json"), JSON.stringify({
+    // Pre-seed OP_HOME/knowledge/secrets/auth.json with one existing credential
+    mkdirSync(join(opHome, "knowledge", "secrets"), { recursive: true });
+    writeFileSync(join(opHome, "knowledge", "secrets", "auth.json"), JSON.stringify({
       azure: { type: "api", key: "existing" },
     }));
 
@@ -252,7 +324,7 @@ describe("importHostOpenCode", () => {
     });
 
     // Verify azure key was NOT overwritten
-    const written = JSON.parse(readFileSync(join(opConfigDir, "auth.json"), "utf-8")) as Record<string, { key: string }>;
+    const written = JSON.parse(readFileSync(join(opHome, "knowledge", "secrets", "auth.json"), "utf-8")) as Record<string, { key: string }>;
     expect(written.azure.key).toBe("existing");
     // Verify groq was added
     expect(written.groq.key).toBe("gsk-host");