@peakflo/agent-harness 0.0.0-stage → 0.2.2-rc.1

package/dist/adapters/model-gateway.js

@@ -0,0 +1,270 @@
+"use strict";
+/**
+ * Model-gateway seam for the extracted coding-agent adapters.
+ *
+ * In the 20x Electron app the adapters read the enterprise AI gateway
+ * credentials directly from SQLite via `src/main/enterprise-ai-gateway.ts`.
+ * That module cannot be extracted because it depends on Electron's
+ * `safeStorage` for encrypt/decrypt. The harness therefore takes the already
+ * decrypted config through an injected `ModelGatewayConfigSource` instead.
+ *
+ * `ENTERPRISE_AI_GATEWAY_PROVIDER_ID`, `ENTERPRISE_AI_GATEWAY_PROVIDER_NAME`
+ * and `buildEnterpriseAiGatewayProviderConfig` are copied verbatim (behaviour
+ * identical) from 20x `src/main/enterprise-ai-gateway.ts`; only the formatting
+ * follows this package's Prettier config.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionModelGateway = exports.ENTERPRISE_AI_GATEWAY_PROVIDER_NAME = exports.ENTERPRISE_AI_GATEWAY_PROVIDER_ID = void 0;
+exports.buildEnterpriseAiGatewayProviderConfig = buildEnterpriseAiGatewayProviderConfig;
+exports.buildPiAiGatewayProviderConfig = buildPiAiGatewayProviderConfig;
+exports.__clearGatewayModelCacheForTest = __clearGatewayModelCacheForTest;
+exports.fetchGatewayModels = fetchGatewayModels;
+exports.ENTERPRISE_AI_GATEWAY_PROVIDER_ID = 'peakflo';
+exports.ENTERPRISE_AI_GATEWAY_PROVIDER_NAME = 'Peakflo';
+function buildEnterpriseAiGatewayProviderConfig(stored) {
+    /*
+     * REAL LIMITS, OR NONE AT ALL.
+     *
+     * opencode has no capability data for this custom provider, so without a
+     * `limit` it applies its own default of 32000 output tokens. LiteLLM refuses
+     * rather than clamps:
+     *
+     *   max_tokens is too large: 32000. This model supports at most 16384
+     *   completion tokens, whereas you provided 32000.
+     *
+     * The turn failed before producing one token, and the message named the
+     * MODEL rather than the default nobody chose.
+     *
+     * The fix is NOT a conservative constant. The gateway reports the true
+     * numbers per model at `/model/info`, so `fetchGatewayModels` reads them and
+     * they are passed straight through here. A model the gateway says nothing
+     * about gets NO `limit` key, and opencode keeps its default — because a
+     * ceiling invented for an unknown model is how the 32000 failure happened in
+     * the first place.
+     *
+     * BOTH KEYS OR NEITHER: opencode rejects the entire config with
+     * ConfigInvalidError when `limit` carries only one of them, which makes every
+     * model uncallable. `fetchGatewayLimits` therefore emits a limit only when it
+     * has both.
+     */
+    const models = (stored.models ?? []).reduce((acc, model) => {
+        acc[model.id] = model.limit
+            ? { name: model.name, limit: model.limit }
+            : { name: model.name };
+        return acc;
+    }, {});
+    return {
+        [exports.ENTERPRISE_AI_GATEWAY_PROVIDER_ID]: {
+            npm: '@ai-sdk/openai-compatible',
+            name: exports.ENTERPRISE_AI_GATEWAY_PROVIDER_NAME,
+            options: {
+                baseURL: stored.baseUrl,
+                apiKey: stored.apiKey
+            },
+            models
+        }
+    };
+}
+/** Build the provider entry Pi stores under `providers.peakflo`. */
+function buildPiAiGatewayProviderConfig(stored) {
+    return {
+        name: exports.ENTERPRISE_AI_GATEWAY_PROVIDER_NAME,
+        baseUrl: stored.baseUrl,
+        api: 'openai-completions',
+        // The per-turn virtual key is resolved from the child environment. It is
+        // never persisted in models.json.
+        apiKey: '$PEAKFLO_AI_GATEWAY_API_KEY',
+        models: (stored.models ?? []).map((model) => ({
+            id: model.id,
+            name: model.name,
+            reasoning: false,
+            input: ['text', 'image'],
+            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+            ...(model.limit?.context == null
+                ? {}
+                : { contextWindow: model.limit.context }),
+            ...(model.limit?.output == null ? {} : { maxTokens: model.limit.output })
+        }))
+    };
+}
+/* -------------------------------------------------------------------------- */
+/* The per-session holder                                                      */
+/* -------------------------------------------------------------------------- */
+/**
+ * The gateway config for the turn that is running right now.
+ *
+ * Created ONCE and re-pointed per turn, exactly like `SessionTokenInjector`
+ * and for the same reason: the adapter is constructed once and holds this
+ * reference for the whole process life, so swapping the object would leave it
+ * reading a credential from a session that has already ended.
+ *
+ * `readModelGatewayConfig()` returns `null` when no turn is live, which is the
+ * same answer `readEnterpriseAiGatewayConfig(db)` gives in 20x when no gateway
+ * is configured. Null means "no gateway provider" — it does NOT mean "fall
+ * back to whatever credentials happen to be on this machine".
+ */
+class SessionModelGateway {
+    config = null;
+    readModelGatewayConfig() {
+        return this.config;
+    }
+    /** Install the gateway for the turn about to run. */
+    set(config) {
+        this.config = config;
+    }
+    /**
+     * Swap in a re-minted credential without disturbing `baseUrl`/`models` — the
+     * LONG TURNS fix's answer to a fixed per-turn LiteLLM key TTL. A no-op when
+     * no turn is live (the config was already revoked or never set), which is
+     * the correct outcome for a refresh that raced the turn's own end.
+     */
+    updateApiKey(apiKey) {
+        if (!this.config)
+            return;
+        this.config = { ...this.config, apiKey };
+    }
+    /** Drop the credential the moment the turn ends. */
+    revoke() {
+        this.config = null;
+    }
+}
+exports.SessionModelGateway = SessionModelGateway;
+/**
+ * Fetch the gateway's model list the way 20x does.
+ *
+ * 20x (`src/main/enterprise-auth.ts:905`) calls `${baseUrl}/models` — NOT
+ * `/v1/models`, and the two do not return the same set on the Peakflo
+ * deployment — with the tenant's virtual key, and accepts `id` OR `model_name`,
+ * because some LiteLLM deployments return only the latter. Reading one field
+ * silently drops half the catalogue.
+ *
+ * WHY THE HARNESS NEEDS THIS AT ALL. It used to register a provider containing
+ * exactly ONE model: the one the lease named. That is enough for the turn to
+ * run, and it makes the backend's own provider list a lie — `config.providers()`
+ * is what 20x's agent form reads to offer a choice, so a one-entry provider
+ * means the backend can never report what is actually reachable.
+ *
+ * FAILURE IS NOT FATAL. A gateway that will not answer must not stop a turn
+ * whose model is already known, so the caller falls back to the lease's single
+ * model. Returning an empty list here means "ask again later", never "there are
+ * no models".
+ */
+/**
+ * The catalogue changes far more slowly than turns arrive.
+ *
+ * WITHOUT A CACHE THIS RAN ON EVERY TURN, adding a network round trip — up to
+ * the 10s timeout when the gateway is slow — to the front of every single one,
+ * and pointing every runner in the fleet at `/models` at the rate their users
+ * type. The list it fetches is a PROVIDER CATALOGUE: it changes when somebody
+ * edits a LiteLLM config, not between one message and the next.
+ *
+ * Keyed on the base url, NOT on the api key. The key is minted per turn, so
+ * keying on it would miss every time and the cache would be decorative. Two
+ * turns of the same tenant hitting the same gateway see the same catalogue,
+ * which is the point.
+ *
+ * A FAILURE IS NOT CACHED. An empty list is what this returns when the gateway
+ * cannot be reached, and remembering that for five minutes would extend one
+ * outage into a longer one for no reason.
+ */
+const MODEL_CACHE_TTL_MS = 5 * 60 * 1000;
+const modelCache = new Map();
+/** Exported for tests, which must not inherit another test's catalogue. */
+function __clearGatewayModelCacheForTest() {
+    modelCache.clear();
+}
+/**
+ * Per-model limits, keyed by the id `/models` uses.
+ *
+ * SEPARATE AND FAILURE-TOLERANT. A gateway that serves `/models` but not
+ * `/model/info` must still yield a usable model list, so this answers with an
+ * empty map rather than throwing. The caller then reports models with no
+ * limits, which is honest.
+ */
+async function fetchGatewayLimits(params, base) {
+    const out = new Map();
+    try {
+        const response = await fetch(`${base}/model/info`, {
+            headers: { Authorization: `Bearer ${params.apiKey}` },
+            signal: AbortSignal.timeout(params.timeoutMs ?? 10_000)
+        });
+        if (!response.ok)
+            return out;
+        const body = (await response.json());
+        for (const entry of body.data ?? []) {
+            const id = typeof entry?.model_name === 'string' ? entry.model_name : '';
+            const info = (entry?.model_info ?? {});
+            const context = info.max_input_tokens;
+            const output = info.max_output_tokens;
+            // BOTH OR NEITHER: opencode rejects the whole config when `limit` is
+            // present with only one key, so a half-known model gets no limit at all.
+            if (id &&
+                typeof context === 'number' &&
+                typeof output === 'number' &&
+                context > 0 &&
+                output > 0) {
+                out.set(id, { context, output });
+            }
+        }
+    }
+    catch {
+        // Same reasoning as the caller: an enrichment must never fail a turn.
+    }
+    return out;
+}
+async function fetchGatewayModels(params) {
+    const cacheKey = params.baseUrl.replace(/\/+$/, '');
+    const hit = modelCache.get(cacheKey);
+    if (!params.force && hit && Date.now() - hit.at < MODEL_CACHE_TTL_MS) {
+        return hit.models;
+    }
+    const base = params.baseUrl.replace(/\/+$/, '');
+    try {
+        const response = await fetch(`${base}/models`, {
+            headers: { Authorization: `Bearer ${params.apiKey}` },
+            signal: AbortSignal.timeout(params.timeoutMs ?? 10_000)
+        });
+        if (!response.ok)
+            return [];
+        const body = (await response.json());
+        const models = (body.data ?? [])
+            .map((entry) => {
+            const id = typeof entry?.id === 'string' && entry.id
+                ? entry.id
+                : typeof entry?.model_name === 'string'
+                    ? entry.model_name
+                    : null;
+            return id ? { id, name: id } : null;
+        })
+            .filter((m) => m !== null);
+        /*
+         * ASK THE GATEWAY FOR THE LIMITS. DO NOT GUESS THEM.
+         *
+         * `/models` returns ids only, so an earlier version declared a single
+         * conservative ceiling for every model. That was a guess, and a guess is
+         * what broke the turn it was meant to fix: opencode's own default of 32000
+         * output tokens is above gpt-4o-mini's real ceiling of 16384, and LiteLLM
+         * refuses rather than clamps.
+         *
+         * `/model/info` reports the true numbers per model — gpt-4o-mini
+         * 128000/16384, gpt-4.1 1047576/32768 — so use them. A model the gateway
+         * says nothing about keeps NO limit, which leaves opencode on its own
+         * default: worse than a real number, better than a number we invented for
+         * a model we know nothing about.
+         */
+        const limits = await fetchGatewayLimits(params, base);
+        for (const model of models) {
+            const limit = limits.get(model.id);
+            if (limit)
+                model.limit = limit;
+        }
+        // Only a SUCCESSFUL answer is remembered — see the note on the cache.
+        modelCache.set(cacheKey, { at: Date.now(), models });
+        return models;
+    }
+    catch {
+        // Deliberately silent: this is an enrichment, and the turn proceeds on the
+        // model it was already given.
+        return [];
+    }
+}

package/dist/adapters/opencode-adapter.d.ts

@@ -0,0 +1,403 @@
+/**
+ * Extracted verbatim from 20x `src/main/adapters/opencode-adapter.ts`.
+ * CHANGED (nothing else):
+ *  - imports: `../utils/opencode-config` -> `./opencode-config`
+ *  - `import type { DatabaseManager } from '../database'` -> the narrow
+ *    structural `SettingsReader` type below (`getSetting` is the only member
+ *    this file ever used; its real signature in 20x `src/main/database.ts` is
+ *    `getSetting(key: string): string | undefined`).
+ *  - the enterprise AI gateway is injected: `readEnterpriseAiGatewayConfig(this.db)`
+ *    is now `this.gateway?.readModelGatewayConfig() ?? null`, because 20x's
+ *    `enterprise-ai-gateway.ts` decrypts via Electron `safeStorage` and cannot
+ *    be extracted. The constructor gained an optional second `gateway` param.
+ * The `@opencode-ai/sdk` type queries and dynamic imports are UNCHANGED; the
+ * SDK is an optional dependency and is declared ambiently in
+ * `./optional-agent-sdks.d.ts` so `tsc` succeeds when it is not installed.
+ * Source formatting (no semicolons) preserved.
+ */
+import { OpencodeServerPolicy } from './opencode-server-policy';
+import type { ModelGatewayConfigSource } from './model-gateway';
+import type { CodingAgentAdapter, SessionConfig, SessionStatus, SessionMessage, MessagePart } from './coding-agent-adapter';
+/**
+ * Narrow structural stand-in for 20x's `Pick<DatabaseManager, 'getSetting'>`.
+ * `getSetting` is the only member this file ever touched; the signature is
+ * copied from 20x `src/main/database.ts`.
+ */
+type SettingsReader = {
+    getSetting(key: string): string | undefined;
+};
+export declare class OpencodeAdapter implements CodingAgentAdapter {
+    private db?;
+    private gateway?;
+    /**
+     * WHOSE OPENCODE SERVER THIS IS. Defaults to `shared`, which is 20x's
+     * behaviour and the reason the desktop is not regressed by this change:
+     * a host that passes nothing keeps exactly what it had. The HARNESS
+     * passes an owned policy (see `cli.ts`), and an owned policy never
+     * adopts, never binds a well-known port and never kills anything.
+     */
+    private serverPolicy;
+    /** Callback set by agent-manager to trigger an immediate poll cycle */
+    onDataAvailable?: (sessionId: string) => void;
+    private sdkLoading;
+    private serverInstance;
+    private serverUrl;
+    private serverStarting;
+    /** The shared V2 SDK client created alongside the server via createOpencode */
+    private sharedClient;
+    /** A separate V2 client with a reasonable timeout for quick operations (config, providers, health) */
+    private quickClient;
+    private clients;
+    /** Separate clients with no timeout, used ONLY for session.prompt() which runs indefinitely */
+    private promptClients;
+    private v2Client;
+    private promptAborts;
+    /** Provider errors captured from prompt results (surfaced via getStatus) */
+    private promptErrors;
+    /** Absolute paths to generated OpenCode plugin files registered for this session/workspace */
+    private pluginFilePaths;
+    /** Absolute paths to generated support files used by runtime plugins */
+    private runtimeSupportFilePaths;
+    /** Absolute path to the generated tillDone config support file */
+    private tillDoneConfigPath;
+    /** Whether the merged config has been pushed at least once to the running server.
+     *  Config is pushed once on first server connection; subsequent pushes happen only
+     *  via explicit `notifyConfigChanged()` calls (e.g. after settings edit or key rotation).
+     *  This avoids PATCH /global/config storms that abort all running sessions. */
+    private configPushed;
+    /** Maximum number of automatic retries for transient prompt errors (e.g. "Aborted") */
+    private static readonly PROMPT_MAX_RETRIES;
+    /** Base delay (ms) for exponential backoff between prompt retries */
+    private static readonly PROMPT_RETRY_BASE_DELAY_MS;
+    /** Pending permission requests per session (captured from SSE events).
+     *  Each session may have multiple pending permissions (parallel tool calls). */
+    private pendingPermissions;
+    /** Abort controller for the SSE event subscription */
+    private sseAbort;
+    /** Per-session permission mode ('ask' = surface in UI, 'allow' = auto-approve) */
+    private sessionPermissionModes;
+    /** Per-session workspace directory — needed for permission replies and other
+     *  session-scoped V2 API calls initiated from global SSE events. */
+    private sessionWorkspaceDirs;
+    /** Per-session MCP server configs — retained for re-registration on session resume
+     *  (e.g. after 20x restart when stdio MCP server processes are dead). */
+    private sessionMcpConfigs;
+    /** Per-session names of MCP servers that could not be attached. Read by the
+     *  agent-manager so the session documentation does not advertise tools that
+     *  are not there. */
+    private sessionMcpAttachFailures;
+    constructor(db?: SettingsReader | undefined, gateway?: ModelGatewayConfigSource | undefined, 
+    /**
+     * WHOSE OPENCODE SERVER THIS IS. Defaults to `shared`, which is 20x's
+     * behaviour and the reason the desktop is not regressed by this change:
+     * a host that passes nothing keeps exactly what it had. The HARNESS
+     * passes an owned policy (see `cli.ts`), and an owned policy never
+     * adopts, never binds a well-known port and never kills anything.
+     */
+    serverPolicy?: OpencodeServerPolicy);
+    /** The state directory an OWNED server keeps its sessions in, else null. */
+    ownedStateDir(): string | null;
+    /**
+     * WHICH opencode can honour a `ses_...` handle this adapter minted.
+     *
+     * Not the process and not the port: two opencode servers sharing one state
+     * directory each read the other's sessions immediately, and a session
+     * outlives the server that created it. Measured against opencode 1.18.23.
+     * So the answer is an identity of the STATE DIRECTORY, and it is stable
+     * across both a server restart and a harness restart.
+     */
+    backendInstanceId(): string;
+    private loadSDK;
+    private ensureSDKLoaded;
+    initialize(): Promise<void>;
+    /**
+     * Wait for a group of MCP servers to reach a terminal state.
+     * Uses one status query per retry cycle (batched) instead of polling per server.
+     */
+    private waitForMcpServersReady;
+    /**
+     * Query MCP status via SDK.
+     * Prefer mcp.list() (same view as `opencode mcp list`), fall back to mcp.status().
+     */
+    private getMcpStatusMap;
+    private parseMcpListData;
+    /**
+     * Register MCP servers with the OpenCode backend (mcp.add + mcp.connect).
+     * Called from both createSession (initial setup) and resumeSession (after 20x
+     * restart when stdio MCP server processes are dead and need re-registration).
+     *
+     * Returns which servers are attached and which are not. The caller MUST act on
+     * the failures: OpenCode receives its MCP servers only through these runtime
+     * calls, so a swallowed failure produces a session that silently has no tools
+     * while AGENTS.md still advertises them.
+     */
+    private registerMcpServers;
+    /**
+     * Attach the MCP servers of a session and verify the result.
+     *
+     * OpenCode keeps MCP servers only in the memory of the `opencode serve`
+     * process, so an attach failure is invisible in the session itself: the agent
+     * simply has no task-management tools while AGENTS.md advertises them. This
+     * helper therefore retries the failures once, and reports what is still
+     * missing so the caller can escalate instead of continuing silently.
+     */
+    private attachAndVerifyMcpServers;
+    private setMcpAttachFailures;
+    /**
+     * Names of MCP servers that are configured for the session but are NOT
+     * attached to the OpenCode backend, so none of their tools can be called.
+     */
+    getMcpAttachFailures(sessionId: string): string[];
+    /**
+     * Disconnect the MCP servers that were attached for a session.
+     *
+     * Each attached stdio server is a child process of the shared `opencode serve`
+     * process, and it lives as long as that server does — which is days, because
+     * the server is shared and often adopted rather than spawned. Without this the
+     * stdio children accumulate one per session (the task-management-mcp leak).
+     * Servers still needed by another live session are kept.
+     */
+    private disconnectSessionMcpServers;
+    private getScopedPartId;
+    /**
+     * Returns the shared SDK client, ensuring the server is running first.
+     * Pass `quick: true` to get a client with a bounded timeout (for config queries, health checks).
+     */
+    private getClient;
+    /**
+     * Push the merged provider/auth config to the running OpenCode server.
+     *
+     * ⚠️  PATCH /global/config causes the server to call disposeAllInstancesAndEmitGlobalDisposed(),
+     * which aborts every running session processor AND disconnects all MCP servers.
+     *
+     * Strategy:
+     *   - When sessions are active: push via directory-scoped PATCH /config for each
+     *     active session directory. This updates the config without killing MCP connections.
+     *   - When no sessions are active: safe to use global endpoint.
+     */
+    private pushMergedConfigToClient;
+    /**
+     * Notify the adapter that provider config has changed (e.g. user edited agent settings,
+     * AI gateway key was rotated).  Pushes the updated config to the running server.
+     *
+     * Call this from the agent-manager when settings change — do NOT call it on every
+     * createSession or getClient, since PATCH /global/config aborts all running sessions.
+     */
+    notifyConfigChanged(): Promise<void>;
+    getProviders(serverUrl?: string, directory?: string): Promise<{
+        providers: {
+            id: string;
+            name: string;
+            models: unknown;
+            [key: string]: unknown;
+        }[];
+        default: Record<string, string>;
+    } | null>;
+    private getProvidersInner;
+    /**
+     * Remove models from the enterprise AI gateway provider that are no longer
+     * present in the fresh config stored in SQLite. Mutates the providers array
+     * in place.
+     */
+    private filterStaleProviderModels;
+    /**
+     * Recover from a broken opencode server by killing it, clearing its
+     * corrupted database, and resetting adapter state so the next call
+     * spawns a fresh server.
+     */
+    private recoverFromBrokenServer;
+    checkHealth(): Promise<{
+        available: boolean;
+        reason?: string;
+    }>;
+    private findAccessibleServer;
+    /**
+     * Ensures common binary install paths (e.g. ~/.opencode/bin) are in PATH
+     * so the SDK's createOpencode can find the `opencode` binary.
+     */
+    private ensureBinaryPaths;
+    private setBashTimeoutDefault;
+    /**
+     * Spawn THIS runner's own opencode server.
+     *
+     * Three properties, each deliberate:
+     *  - a port the kernel chose, bound to LOOPBACK ONLY, so it collides with
+     *    nothing and is reachable from nowhere else;
+     *  - its own state directory, so its sessions are its own and are not
+     *    pruned, listed or shared by anybody else's use of opencode;
+     *  - spawned, so `stopServer` has a `serverInstance` to close and the
+     *    "adopted, not mine to close" branch is unreachable.
+     *
+     * The state directory is passed through `XDG_DATA_HOME`, which is how
+     * opencode locates `opencode.db` — verified against opencode 1.18.23 by
+     * pointing a server at a private directory and finding its database there.
+     */
+    private startOwnedServer;
+    private ensureServerRunning;
+    createSession(config: SessionConfig): Promise<string>;
+    resumeSession(sessionId: string, config: SessionConfig): Promise<SessionMessage[]>;
+    sendPrompt(sessionId: string, parts: MessagePart[], config: SessionConfig): Promise<void>;
+    /**
+     * Returns true if the error message indicates a transient condition that
+     * may succeed on retry (e.g. OpenCode server aborted the session processor
+     * due to a config push, or the provider returned a temporary overload).
+     */
+    private isRetryablePromptError;
+    /**
+     * Executes a prompt with automatic retry for transient errors.
+     * Keeps the AbortController in promptAborts alive during retries so
+     * getStatus() continues to report BUSY.
+     */
+    private executePromptWithRetry;
+    getStatus(sessionId: string, config: SessionConfig): Promise<SessionStatus>;
+    /**
+     * Returns ERROR with captured prompt error if one exists, otherwise IDLE.
+     * Called from getStatus when the backend reports no active work.
+     */
+    private resolveIdleOrPromptError;
+    /**
+     * Transforms a raw OpenCode tool part into the structured format the renderer expects.
+     * OpenCode returns tool name as `part.tool` (string) and details in `part.state`.
+     */
+    private transformToolPart;
+    pollMessages(sessionId: string, seenMessageIds: Set<string>, seenPartIds: Set<string>, partContentLengths: Map<string, string>, config: SessionConfig): Promise<MessagePart[]>;
+    getRunningTools(sessionId: string, config: SessionConfig): Promise<Array<{
+        partId: string;
+        toolName: string;
+        startTime?: number;
+        input?: Record<string, unknown>;
+    }>>;
+    abortPrompt(sessionId: string, _config: SessionConfig): Promise<void>;
+    destroySession(sessionId: string, _config: SessionConfig): Promise<void>;
+    /**
+     * Writes all generated runtime plugin files needed for this session.
+     * MUST be called BEFORE ensureServerRunning() so plugins are discovered at startup.
+     */
+    private writeRuntimePluginFiles;
+    private writeSecretPlugin;
+    private writeTillDonePlugin;
+    private readTillDoneConfig;
+    private readTillDoneConfigFile;
+    private writeTillDoneConfig;
+    /**
+     * TELL OPENCODE TO ASK — defect G1's fifth wire, and the one that decides
+     * whether the other four are observable at all on this backend.
+     *
+     * THE PROBLEM. This adapter REACTS to `permission.asked`: it queues the
+     * permission, reports WAITING_APPROVAL, and offers getPendingApproval /
+     * respondToApproval. Nothing ever asked OpenCode to EMIT one. Only
+     * `external_directory` defaults to "ask" — `bash`, `edit` and `webfetch`
+     * default to allow — so the entire approval path was unreachable for every
+     * action a user would actually want to approve.
+     *
+     * MEASURED against a real `opencode serve` 1.18.25, real model, real `ls -a`:
+     *   no `permission` in the effective config  ->  permission.asked x0
+     *   `permission: {bash|edit|webfetch:'ask'}` ->  permission.asked x1, shaped
+     *      { id, sessionID, permission:'bash', patterns:['ls -a'], ... },
+     *      exactly what `handleServerEvent` already parses.
+     *
+     * WHY A FILE IN THE SESSION'S WORKSPACE, AND NOT THE MERGED SERVER CONFIG.
+     *
+     * The obvious place is `buildMergedOpencodeConfig`, and it is WRONG in two
+     * ways that only showed up by running it:
+     *
+     *   1. IT IS SERVER-WIDE. One OpenCode server serves every session on the
+     *      host — including, on a desktop, sessions this harness did not create.
+     *      A verification run that set it there immediately began raising
+     *      permission prompts for unrelated agent sessions belonging to the
+     *      machine's owner.
+     *   2. IT PERSISTS. `client.global.config.update` WRITES THROUGH to
+     *      `~/.config/opencode/opencode.json`. Setting a permission policy there
+     *      permanently rewrites the user's own OpenCode configuration — a file
+     *      this product does not own.
+     *
+     * A per-directory `opencode.json` has neither problem, and OpenCode really
+     * does honour it per session: with one shared server, `GET /config` returned
+     * `null` for the server's own cwd and `{bash:'ask',...}` for a session
+     * workspace containing this file. Verified before relying on it.
+     *
+     * WHY IT IS DERIVED FROM THE SESSION'S OWN MODE. Because it can be, now that
+     * it is per-session. A `bypassPermissions` agent writes `allow` and never
+     * pays a round trip; an asking agent writes `ask` and its permissions reach a
+     * human. One agent's choice cannot affect another's.
+     *
+     * THE MERGE IS DELIBERATELY ONE-WAY. Any `opencode.json` already in the
+     * workspace keeps its other keys, but NOT its permission block: a file in the
+     * workspace is attacker-influenceable — the agent can write there — so
+     * letting it weaken this would be defect G10's shape, an access control
+     * bypassable by a file on disk.
+     */
+    private writeSessionPermissionConfig;
+    private writeTillDoneSessionConfig;
+    private removeTillDoneSessionConfig;
+    private buildSecretInjectorPluginCode;
+    private buildTillDonePluginCode;
+    getAllMessages(sessionId: string, config: SessionConfig): Promise<SessionMessage[]>;
+    registerMcpServer(_serverName: string, _mcpConfig: {
+        type: 'local' | 'remote';
+        command?: string[];
+        url?: string;
+        headers?: Record<string, string>;
+        environment?: Record<string, string>;
+    }, _workspaceDir?: string): Promise<void>;
+    private getV2Client;
+    respondToQuestion(sessionId: string, answers: Record<string, string>, config: SessionConfig): Promise<void>;
+    /**
+     * Returns the first pending permission for a session, formatted as an
+     * approval request the agent-manager can render.  The agent-manager
+     * duck-types for this method on any adapter during polling.
+     */
+    getPendingApproval(sessionId: string): {
+        toolCallId: string;
+        question: string;
+        options: Array<{
+            optionId: string;
+            name: string;
+            kind: string;
+        }>;
+    } | null;
+    /**
+     * Responds to a pending permission via the OpenCode HTTP API.
+     * Called by agent-manager when the user approves/denies in the UI.
+     */
+    respondToApproval(sessionId: string, approved: boolean, optionId?: string): Promise<boolean>;
+    /**
+     * Fallback: respond to a pending permission via the OpenCode V2 API.
+     * Used when the in-memory pendingPermissions map is empty (e.g., after
+     * app restart or watchdog abort) but the permission is still pending
+     * in the OpenCode backend.
+     *
+     * Uses v2Client.permission.list() (top-level, lists all sessions) and
+     * v2Client.permission.reply() to find and respond to the permission.
+     */
+    private respondToPermissionViaV2;
+    /**
+     * Subscribes to the OpenCode server's SSE event stream to capture
+     * `permission.asked` events.  Must be called after the server is running.
+     * Runs in the background; reconnects automatically on disconnect.
+     */
+    private startEventSubscription;
+    private processEventStream;
+    /**
+     * Handle a single SSE event from the OpenCode server.
+     * We only care about `permission.asked` events.
+     *
+     * The /global/event endpoint wraps events in a `payload` envelope:
+     *   { payload: { id, type, properties } }
+     * The /event endpoint returns events directly:
+     *   { id, type, properties }
+     * We handle both formats.
+     */
+    private handleServerEvent;
+    /**
+     * Silently approve a permission request (used when permissionMode is 'allow').
+     * Uses the V2 SDK permission.reply() which hits the correct endpoint
+     * (POST /permission/{requestID}/reply). The V1 endpoint
+     * (POST /session/{id}/permissions/{permissionID}) returns 404 for
+     * permissions created by the V2 system.
+     */
+    private autoApprovePermission;
+    private stopEventSubscription;
+    stopServer(): Promise<void>;
+}
+export {};