@sleep2agi/agent-network 2.3.0-preview.16 → 2.3.0-preview.160

package/dist/src/node-skills.d.ts

@@ -0,0 +1,57 @@
+export declare const SKILL_FILE_MAX_BYTES: number;
+export declare const SKILLS_LIST_MAX = 300;
+export declare const SKILL_DESCRIPTION_MAX = 300;
+export type SkillScope = "project" | "user" | "system";
+export interface SkillRoot {
+    /** 绝对目录(只在节点本机使用,不外传)。 */
+    dir: string;
+    /** 外传的显示前缀,例如 `.claude/skills`、`~/.claude/skills`、`$CODEX_HOME/skills`。 */
+    label: string;
+    scope: SkillScope;
+}
+export interface SkillContext {
+    workDir: string;
+    home?: string;
+    codexHome?: string;
+}
+export interface SkillSummary {
+    name: string;
+    scope: SkillScope;
+    path_rel: string;
+    description: string;
+    /** 只有团队技能才带。不写进 scope：旧客户端会把不认识的 scope 当成「项目」。 */
+    origin?: "team";
+}
+export declare function isValidSkillName(name: unknown): name is string;
+/** 按优先级(高 → 低)列出某运行时会加载技能的根目录。同名技能以先出现的为准。 */
+export declare function skillRootsForRuntime(runtime: string | null | undefined, ctx: SkillContext): SkillRoot[];
+/** 从 SKILL.md 开头的 YAML frontmatter 取 description(单行 / 引号 / `|` `>` 块)。 */
+export declare function parseSkillDescription(text: string): string;
+export declare const TEAM_COPY_MARKER = ".anet-team-copy";
+export declare function teamSkillsDir(ctx: SkillContext): string;
+/** 每个运行时只链进这一个用户级目录。codex 用本节点的 CODEX_HOME，没有专属目录才用 ~/.codex。 */
+export declare function teamSkillDest(runtime: string | null | undefined, ctx: SkillContext): {
+    dir: string;
+    label: string;
+    machineWide: boolean;
+} | null;
+/** 是不是我们建的：链接目标在团队目录下，或者复制标记里记的 source 解析后在团队目录下。不看名字。
+ *  只有标记、source 却指向别处的（比如用户把复制件拷出去自己改了），不算我们的，不删。 */
+export declare function isOurTeamEntry(dest: string, teamDir: string): Promise<boolean>;
+export declare function listSkills(runtime: string | null | undefined, ctx: SkillContext): Promise<SkillSummary[]>;
+export interface SkillReadResult extends SkillSummary {
+    content: string;
+}
+export declare function readSkill(runtime: string | null | undefined, ctx: SkillContext, name: unknown): Promise<SkillReadResult>;
+export interface TeamSkillSay {
+    log: (message: string) => void;
+    warn: (message: string) => void;
+}
+/** 启动时把 ~/.anet/skills/<name> 链进该运行时的用户级目录。同名且不是我们建的，不覆盖。 */
+export declare function installTeamSkills(runtime: string | null | undefined, ctx: SkillContext, say?: TeamSkillSay): Promise<void>;
+export declare function teamSkillWarnings(runtime: string | null | undefined, ctx: SkillContext): Promise<string[]>;
+export declare function skillView(runtime: string | null | undefined, ctx: SkillContext): Promise<{
+    skills: SkillSummary[];
+    roots: string[];
+    warnings: string[];
+}>;

package/dist/src/normalize-runtime.d.ts

@@ -1,9 +1,36 @@
-export type RuntimeName = "claude-code-cli" | "codex-sdk" | "claude-agent-sdk" | "grok-build-acp";
-/** Operator-facing default for any runtime slot that comes in empty / missing / unrecognized. */
+export type RuntimeName = "claude-code-cli" | "codex-sdk" | "claude-agent-sdk" | "grok-build-acp" | "grok-build-cli" | "opencode-cli" | "codex-app-server";
+/** 一个 runtime 复用的是哪种**外部登录态**，而不是 API key。 */
+export type ReusedLogin = "claude" | "codex" | "grok";
+/**
+ * runtime → 它复用的外部登录。**只有一处定义**，VENDORS 的 `requiresAuth`
+ * 与登录态探测都引用这里。
+ *
+ * 不在表里 = 该 runtime 走 API key，不复用任何登录：
+ *   · `claude-agent-sdk` —— 走 ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY
+ *   · `opencode-cli`     —— 走 ANTHROPIC_API_KEY / OPENAI_API_KEY（vendor preset 从 env 读，不 prompt）
+ * 这条区分是有意写下来的：Vincent 那句「复用会员登录状态、不用自己输 key 和 url」
+ * 点名的是 Claude Code / Codex / Grok 三家，opencode 不在其中，别顺手加进来。
+ */
+export declare const RUNTIME_REUSED_LOGIN: Readonly<Partial<Record<RuntimeName, ReusedLogin>>>;
+/** 该 runtime 复用哪种登录；返回 undefined 表示它用 API key。 */
+export declare function reusedLoginFor(runtime: RuntimeName): ReusedLogin | undefined;
+/** Operator-facing default for a runtime slot that is empty or missing. */
 export declare const DEFAULT_RUNTIME: RuntimeName;
+export declare const SUPPORTED_RUNTIME_NAMES: readonly RuntimeName[];
 type ProfileLike = {
     runtime?: string;
     codexRuntime?: string;
 };
+/**
+ * Legacy normalization used by display and migration code. Missing, empty,
+ * and unknown values all use the safe default for backward compatibility.
+ * Security-sensitive create/start paths must call `normalizeRuntimeStrict`.
+ */
 export declare function normalizeRuntime(profileOrRuntime?: ProfileLike | string): RuntimeName;
+/**
+ * Canonicalize a runtime at an execution boundary. Missing/empty still means
+ * the documented default, but any non-empty unknown value is rejected so a
+ * typo or future runtime cannot silently execute as Claude.
+ */
+export declare function normalizeRuntimeStrict(profileOrRuntime?: ProfileLike | string): RuntimeName;
 export {};

package/dist/src/offline-age.d.ts

@@ -0,0 +1,29 @@
+/**
+ * #1648 — 名册上「刚停的节点」和「掉了三天没人发现的节点」渲染成同一个数字。
+ *
+ * `anet status` 原先只印 `N offline`。实测（2026-08-31，84 台 外部团队相关节点）:
+ * 45 台 offline 里 27 台 >3 天、18 台 1–3 天、**近 6 小时内 0 台** ——
+ * 「当前没有活故障」和「有 45 台掉了」是完全不同的两个结论，而屏幕上只有后者。
+ */
+/**
+ * 🔴 hub 存的 `last_seen_at` 是 **UTC**，但字符串里**没有时区标记**
+ * （形如 `2026-08-30 21:11:24`）。直接 `new Date(raw)` 会被当成**本地时间**：
+ * 在 UTC+8 上就是整整 8 小时的偏差，而且它**不会报错** —— 只会把「4 分钟前」
+ * 读成「8 小时前」。这个错本人在 2026-08-31 亲自犯过一次，差点把
+ * 「舰队心跳陈旧」报出去。
+ */
+export declare function parseHubTimestamp(raw: unknown): number | null;
+export type OfflineAges = {
+    under1h: number;
+    h1to24: number;
+    d1to3: number;
+    over3d: number;
+    /** 🔴 没有可用时间戳的那些必须单独一格,不能并进任何一档 —— 见下 */
+    unknown: number;
+    total: number;
+};
+export declare function summarizeOfflineAges(offline: ReadonlyArray<{
+    last_seen_at?: unknown;
+}>, nowMs: number): OfflineAges;
+/** 返回空串表示「没有值得多说一句的东西」，调用方据此决定印不印。 */
+export declare function formatOfflineAges(a: OfflineAges): string;

package/dist/src/one-line-cell.d.ts

@@ -0,0 +1,20 @@
+/**
+ * CLI 里那几张对齐表(`anet status` 的 needs-attention / working,以及 Recent Tasks
+ * 和 `anet tasks`)把**用户提供的文本**直接 `slice(0, N)` 塞进一行。
+ *
+ * 🔴 任务正文里有换行时,截出来的那段会**把整张表打断**。实测(2026-08-31,
+ *    真跑 `anet status` 才看见,读代码看不出来):
+ *
+ *      grok-v1          blocked  【把你自己的名册状态修正过来 —— 两步，别做别的】
+ *
+ *      你今天两次在 22 秒内答了我的探测（G
+ *
+ *    第二行完全脱离了对齐,而且读起来像另一个节点的输出。
+ *
+ * 这里把所有空白(含 \n \r \t 和连续空格)折成单个空格再截。
+ *
+ * 🔴 **有意不加省略号**:加了会改变列宽,而列宽是这几张表现有的对齐依据。
+ *    「截断了却看不出来」是另一个问题(先存在于这里,本次不动),
+ *    不要顺手在一个修显示错位的改动里改掉它。
+ */
+export declare function oneLineCell(text: unknown, max: number): string;

package/dist/src/opencode-agent-node-pair.d.ts

@@ -0,0 +1,28 @@
+export declare const PAIRED_AGENT_NETWORK_VERSION = "2.3.0-preview.160";
+export declare const PAIRED_AGENT_NODE_VERSION = "2.5.0-preview.126";
+export declare const PAIRED_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.126";
+export declare const OPENCODE_AGENT_NETWORK_VERSION = "2.3.0-preview.160";
+export declare const OPENCODE_AGENT_NODE_VERSION = "2.5.0-preview.126";
+export declare const OPENCODE_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.126";
+export type PairedAgentNodeResolution = {
+    spec: string;
+    args: string[];
+    allowPathGlobal: false;
+};
+/** The codex bridge must resolve the immutable release pair, independent of PATH. */
+export declare function pairedAgentNodeResolution(): PairedAgentNodeResolution;
+/** Cold npm downloads get their own budget, separate from bridge attachment. */
+export declare function pairedAgentNodeResolveTimeoutMs(env?: NodeJS.ProcessEnv): number;
+export declare function pairedAgentNodeResolveError(error: any, timeoutMs: number): string;
+export declare function agentNodeHelpSupportsCodexAppServer(help: string): boolean;
+export declare function opencodeExactPairInstallCommand(): string;
+/** Runtime capability advertised by agent-node's operator-facing help. */
+export declare function agentNodeHelpSupportsOpencode(help: string): boolean;
+/**
+ * Resolve a package-owned agent-node entrypoint and verify its immutable
+ * release identity before it can receive `opencode-cli`. Capability text is
+ * not a security boundary: an older preview already advertised the runtime.
+ */
+export declare function validateAgentNodePackageEntrypoint(rawEntrypoint: string, packageSpec: string, expectedVersion?: string, forbiddenRoots?: readonly string[]): string;
+/** Skip invalid/local PATH shims and return the first exact trusted package. */
+export declare function resolveAgentNodePackageEntrypointFromPath(searchPath: string, packageSpec: string, expectedVersion: string, forbiddenRoots?: readonly string[]): string;

package/dist/src/opencode-auth-login.d.ts

@@ -0,0 +1,43 @@
+import type { OpencodePresetId } from "./opencode-preset";
+export declare const OPENCODE_AUTH_LOGIN_ROOT_PREFIX = "opencode-auth-login-";
+export declare const OPENCODE_AUTH_LOGIN_OWNER_FILE = ".owner.json";
+export declare const OPENCODE_AUTH_LOGIN_CLEANUP_PREFIX = ".anet-opencode-auth-cleanup-";
+export interface OpencodeAuthLoginSandbox {
+    readonly nodeWorkDir: string;
+    readonly provider: OpencodePresetId;
+    readonly root: string;
+    readonly cwd: string;
+    readonly authPath: string;
+    readonly env: Readonly<NodeJS.ProcessEnv>;
+}
+export interface CreateOpencodeAuthLoginSandboxOptions {
+    nodeWorkDir: string;
+    provider: OpencodePresetId | string;
+    parentEnv?: NodeJS.ProcessEnv;
+    /** Internal/test-only trusted external base override. */
+    launchBase?: string;
+}
+export interface OpencodeAuthLoginCredential {
+    provider: OpencodePresetId;
+    type: "api";
+    key: string;
+}
+/** Deterministic exact-1.18.1 login argv for the selected API-key flow. */
+export declare function buildOpencodeAuthLoginArgs(provider: OpencodePresetId | string): string[];
+/** Prepare a fresh, node-scoped environment for one interactive login. */
+export declare function createOpencodeAuthLoginSandbox(options: CreateOpencodeAuthLoginSandboxOptions): OpencodeAuthLoginSandbox;
+/** Repeat external-root ancestor and inode validation immediately before the
+ * vetted upstream binary is spawned. */
+export declare function revalidateOpencodeAuthLoginSandbox(sandbox: OpencodeAuthLoginSandbox): void;
+/**
+ * Read only the selected provider's exact API-key shape from the fresh root.
+ * OAuth/browser-login records and mixed/multi-provider documents are refused.
+ */
+export declare function readOpencodeAuthLoginCredential(sandbox: OpencodeAuthLoginSandbox): OpencodeAuthLoginCredential;
+/** Safely remove a sandbox created by this process. Idempotent after removal. */
+export declare function cleanupOpencodeAuthLoginSandbox(sandbox: OpencodeAuthLoginSandbox): void;
+/**
+ * Lifecycle helper for CLI integration. Spawn/wait/read the credential inside
+ * `action`; the fresh tree is cleaned on success, child failure, or throw.
+ */
+export declare function withOpencodeAuthLoginSandbox<T>(options: CreateOpencodeAuthLoginSandboxOptions, action: (sandbox: OpencodeAuthLoginSandbox) => T | Promise<T>): Promise<T>;

package/dist/src/opencode-free-tier.d.ts

@@ -0,0 +1,27 @@
+/**
+ * #540 — OpenCode Zen's free tier rejects any request in which a tool is
+ * disabled or a permission is denied, answering
+ * "OpenCode's free tier can only be used from within OpenCode" (measured on
+ * opencode-ai 1.18.1 and 1.18.34 with `{"tools":{"bash":false}}`). Our default
+ * safe preset disables every built-in tool, so a free Zen model on a default
+ * node fails every task. `anet node create` must say so instead of promising
+ * that free models "can still start".
+ *
+ * The default preset itself is intentionally NOT changed here.
+ */
+/** OpenCode Zen free models are `opencode/<id>-free`. */
+export declare function isOpencodeZenFreeModel(model: string | undefined | null): boolean;
+/** Replaces the old "Keyless/free models can still start without a credential." */
+export declare const OPENCODE_KEYLESS_FREE_MODEL_NOTE: string;
+/** The exact command that sets flags.opencodeUnsafeTools=true in a node config. */
+export declare function opencodeUnsafeToolsCommand(configFile: string): string;
+/**
+ * Warning lines for a node whose model is a Zen free model while the safe
+ * preset is active. Empty when the combination is not the failing one.
+ */
+export declare function opencodeFreeTierSafePresetWarning(opts: {
+    nodeId: string;
+    model: string | undefined | null;
+    unsafeTools: boolean;
+    configFile: string;
+}): string[];

package/dist/src/opencode-generation-create.d.ts

@@ -0,0 +1,27 @@
+export type OpencodeGenerationCreateResult<P> = {
+    ok: true;
+    profile: P;
+} | {
+    ok: false;
+    refusal: string;
+};
+export declare function applyOpencodeGenerationCreateOption<P extends {
+    opencodeGeneration?: unknown;
+    opencodeMode?: string;
+    flags?: Record<string, any>;
+}>(profile: P, opts: Record<string, unknown> & {
+    "opencode-generation"?: string;
+    "opencode-unsafe-tools"?: string;
+}): OpencodeGenerationCreateResult<P>;
+/** Start-time gate for a stored profile: one line when it must not start,
+ *  else null. V1 (and a config without the field) is never refused. */
+export declare function opencodeStartGenerationRefusal(profile: {
+    opencodeGeneration?: unknown;
+    opencodeMode?: string;
+    flags?: Record<string, any>;
+}, opts: {
+    copresence: boolean;
+    configFile?: string;
+}): string | null;
+/** Exact install command for a generation's pin. */
+export declare function opencodeGenerationInstallCommand(generation: "v1" | "v2"): string;

package/dist/src/opencode-generation-record.d.ts

@@ -0,0 +1,24 @@
+import { type OpencodeGeneration } from "./opencode-versions";
+export declare const OPENCODE_GENERATION_FIELD = "opencodeGeneration";
+/** Profile about to be serialised by saveProfile: add the generation when it
+ *  is missing, otherwise return the very same object. */
+export declare function stampOpencodeGeneration<T extends Record<string, any>>(profile: T, generation?: OpencodeGeneration): T;
+/**
+ * Raw `config.json` text → the same text with `opencodeGeneration` appended,
+ * or null when nothing should be written:
+ *   – the field is already present (whatever its value), or
+ *   – the file is not valid JSON / not an object, or
+ *   – the file is not in the canonical `JSON.stringify(_, null, 2) + "\n"`
+ *     form saveProfile writes (hand-edited). Re-serialising such a file could
+ *     touch bytes of other fields, and an absent field already means V1.
+ * In the canonical case the result differs from the input only by the one
+ * appended key, so every other field keeps its exact bytes.
+ */
+export declare function recordOpencodeGenerationInConfigText(raw: string, generation?: OpencodeGeneration): string | null;
+/** Start-time backfill for a node created before #542. IO is injected so the
+ *  caller keeps its own symlink-safe private-file reader/writer. Never throws:
+ *  the record is advisory and an absent field already reads as V1. */
+export declare function backfillOpencodeGeneration(io: {
+    read: () => string | undefined;
+    write: (body: string) => void;
+}): boolean;

package/dist/src/opencode-launch-env.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Process-loader hooks that must never cross the opencode-cli launcher
+ * boundary. The exact agent-node package/entrypoint check happens before the
+ * node profile env is merged; allowing that profile to supply one of these
+ * variables would let code run before the verified entrypoint's first line.
+ */
+export declare const OPENCODE_AGENT_NODE_LOADER_ENV_KEYS: readonly ["NODE_OPTIONS", "NODE_PATH", "NODE_V8_COVERAGE", "NODE_REDIRECT_WARNINGS", "NODE_COMPILE_CACHE", "BUN_OPTIONS", "BUN_PRELOAD", "LD_PRELOAD", "LD_LIBRARY_PATH", "LD_AUDIT", "LD_DEBUG_OUTPUT", "DYLD_INSERT_LIBRARIES", "DYLD_LIBRARY_PATH", "DYLD_FRAMEWORK_PATH", "DYLD_FALLBACK_LIBRARY_PATH", "OPENSSL_CONF", "OPENSSL_ENGINES", "OPENSSL_MODULES"];
+/**
+ * Return a child env that preserves the launcher's original executable search
+ * path and removes pre-entrypoint loader/write hooks. Other operator settings
+ * (locale, proxy, custom CA, channel integration) remain backward-compatible.
+ */
+export declare function hardenOpencodeAgentNodeEnv(source: NodeJS.ProcessEnv, launcherPath: string | undefined): NodeJS.ProcessEnv;

package/dist/src/opencode-owner-mode.d.ts

@@ -0,0 +1,6 @@
+/** Linux user-private-group compatibility for ordinary umask 0002 installs. */
+export declare function opencodeOwnedPathModeIsSafe(stat: {
+    uid: number;
+    gid: number;
+    mode: number | bigint;
+}, runtimeUid?: number | undefined, runtimeGid?: number | undefined): boolean;

package/dist/src/opencode-package-binary.d.ts

@@ -0,0 +1,44 @@
+export interface ValidateOpencodePackageBinaryOptions {
+    expectedVersion: string;
+    /** A package payload may not be inside, or contain, the current project or
+     * node state tree. This rejects project-local same-version impersonators. */
+    forbiddenRoots?: readonly string[];
+    /** #543 — npm package that must own the entrypoint. Absent = V1
+     *  `opencode-ai`, exactly the pre-#543 gate; V2 passes `@opencode/cli`. */
+    packageName?: string;
+}
+/** Current cwd plus every enclosing source-workspace boundary. This catches a
+ * monorepo root's node_modules when anet is invoked from packages/app. */
+export declare function discoverOpencodeForbiddenRoots(cwd?: string): string[];
+/**
+ * Bind an executable to the exact npm `opencode-ai` payload identity.
+ *
+ * `--version` output alone is not an identity boundary: a checkout can put a
+ * same-version credential-stealing shim first on PATH. Only the canonical
+ * package entrypoint with matching package metadata and trusted path modes is
+ * admitted. The returned path is the one callers must spawn verbatim.
+ */
+export declare function validateOpencodePackageBinary(rawBinary: string, options: ValidateOpencodePackageBinaryOptions): string;
+/** Resolve the first *valid package-owned* OpenCode entry on PATH. Invalid
+ * project-local shims are skipped so a later trusted global install can win. */
+/** #1845 层① —— 包身份校验只依赖 POSIX 的 lstat/uid/mode 语义,darwin 与 linux 等价
+ * (2026-09-07 Mac mini 真跑:home 前缀 npm 安装 → VALIDATE_OK;/tmp 下祖先 1777 仍被拒)。
+ * win32 没有 uid、也没有 0o111 可执行位,继续拦。平台可注入,便于在 Linux CI 上测三种分支。 */
+export declare const OPENCODE_VERIFIER_PLATFORMS: ReadonlySet<NodeJS.Platform>;
+export declare function opencodeVerifierSupportsPlatform(platform?: NodeJS.Platform): boolean;
+export declare function resolveOpencodePackageBinaryFromPath(searchPath: string, options: ValidateOpencodePackageBinaryOptions, platform?: NodeJS.Platform): string;
+/**
+ * Board #541 — resolve the first trusted package entrypoint matching any of
+ * `acceptedVersions`, trying each version across the whole PATH in order (the
+ * release pin first), and report which exact version was admitted. Every
+ * candidate still goes through the full `validateOpencodePackageBinary`
+ * identity gate; only the accepted version set is wider. When nothing matches,
+ * the error from the first (release-pin) attempt is rethrown so diagnostics
+ * keep naming the pin the operator should install.
+ */
+export declare function resolveAcceptedOpencodePackageBinaryFromPath(searchPath: string, options: Omit<ValidateOpencodePackageBinaryOptions, "expectedVersion"> & {
+    acceptedVersions: readonly string[];
+}, platform?: NodeJS.Platform): {
+    binary: string;
+    version: string;
+};

package/dist/src/opencode-pin.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Version this branch was validated against by the maintainers.
+ * Bumped when a new opencode-ai release passes the full Docker/E2E gate —
+ * in the shared supported-versions table (`opencode-versions.ts`, #542),
+ * which agent-node's package gate reads from its byte-identical copy.
+ */
+export declare const OPENCODE_BUILTIN_PIN = "1.18.34";
+/**
+ * Earlier release pins that remain accepted for one transition window so a
+ * host still holding the previous exact install keeps starting after an anet
+ * upgrade (board #541). Each entry passed the full Docker/E2E gate when it was
+ * the pin; start prints `opencodeLegacyPinNote()` so the operator upgrades.
+ * Derived from the shared supported-versions table (#542: v1 accepted
+ * versions minus the pin) — agent-node's gate reads the same table.
+ */
+export declare const OPENCODE_TRANSITION_VERSIONS: readonly string[];
+/** Versions a start may accept, preferred first: the release pin, then the
+ * transition versions. The order matters — a PATH holding both resolves to
+ * the release pin. */
+export declare function acceptedOpencodeVersions(pin?: string): string[];
+/** One-line upgrade note when a start accepted a transition version, else null. */
+export declare function opencodeLegacyPinNote(found: string, pin?: string): string | null;
+/** Exact upstream remediation shared by every CLI failure path. */
+export declare function opencodeExactInstallCommand(version?: string): string;
+/** Preserve package-identity diagnostics while always leaving a missing or
+ * untrusted install with an actionable exact-pin command. */
+export declare function formatOpencodePackageIdentityFailure(expectedVersion: string, detail: string): string;
+/** Where the per-machine override lives. Kept under `~/.anet/` so
+ *  it sits next to the other anet-local state. */
+export declare function opencodePinFilePath(homeDirOverride?: string): string;
+/** Shape of the override file written by `upgrade-pin`. */
+export interface OpencodePinOverride {
+    version: string;
+    /** ISO timestamp when the smoke test passed. Presence of this
+     *  field is REQUIRED for `readEffectivePin()` to trust the file —
+     *  a hand-edited version without a smoke marker is refused. */
+    smokePassedAt: string;
+    /** Free-form note about what the smoke checked (initialize +
+     *  session/new by default). Kept so a future review can tell what
+     *  bar the pin actually cleared. */
+    smokeNote?: string;
+}
+export interface EffectivePin {
+    version: string;
+    source: "override-file" | "builtin";
+    smokePassedAt?: string;
+}
+/**
+ * Recognize a validated override only when it records the exact built-in
+ * release pin. A different locally-smoked version is deliberately ignored:
+ * the lightweight ACP smoke does not replace the maintainer's full security
+ * and reply-path gate. Malformed/stale files also fall back to the built-in.
+ */
+export declare function readEffectivePin(homeDirOverride?: string): EffectivePin;
+/**
+ * Write the override — SHOULD ONLY be called after the smoke test
+ * has actually passed. The command layer in `bin/cli.ts` is
+ * responsible for gating this; this function does no
+ * verification of its own beyond shape.
+ */
+export declare function writePinOverride(version: string, smokePassedAt: string, smokeNote?: string, homeDirOverride?: string): void;

package/dist/src/opencode-preset.d.ts

@@ -0,0 +1,73 @@
+export type OpencodePresetId = "anthropic" | "openai";
+export interface OpencodePreset {
+    id: OpencodePresetId;
+    displayName: string;
+    envKey: string;
+    signupUrl: string;
+    /** How opencode's provider config identifies this vendor in the
+     *  `provider.<id>.options.baseUrl` config. Left null when we don't
+     *  need to override the built-in default. */
+    configProviderId: "anthropic" | "openai";
+}
+export declare const OPENCODE_PRESETS: OpencodePreset[];
+/**
+ * OpenCode tools disabled for the default `opencode-cli` profile.
+ *
+ * This policy reduces the model's ambient filesystem/shell surface. It is
+ * deliberately represented in the generated opencode.json so operators can
+ * inspect the default, but it is not an OS security boundary: a same-uid
+ * OpenCode process can still read files allowed by normal filesystem ACLs.
+ */
+export declare const OPENCODE_DEFAULT_DISABLED_TOOLS: readonly ["bash", "read", "glob", "grep", "edit", "write", "list", "task", "skill", "webfetch", "websearch", "question"];
+export declare function buildOpencodeDefaultToolsPolicy(): Record<string, false>;
+export declare function buildOpencodeDefaultPermissionPolicy(): Record<string, "deny">;
+export declare function findOpencodePreset(id: string): OpencodePreset | null;
+/**
+ * Look up the API key for a preset from the current process env.
+ * Callers MUST handle the `null` case (per RFC v0.3 D3 + 通信龙 PR③
+ * flag: "从 env 读, 别 prompt"). Returns null so the wizard can
+ * emit a clear message telling the operator to export the env var
+ * and re-run — rather than silently continuing without a key.
+ */
+export declare function readPresetKeyFromEnv(preset: OpencodePreset, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * opencode.ai's auth.json shape:
+ *   { "<providerId>": { "type": "api", "key": "..." } }
+ * Same shape verified against the release pin opencode-ai@1.18.1.
+ */
+export declare function buildAuthJsonBody(preset: OpencodePreset, apiKey: string): string;
+export type OpencodePrivateProfileFilename = "config.json" | ".env";
+/**
+ * Establish the boundary before saveProfile/rewritePlainSecrets writes the
+ * node token or dotenv key. The expected shape is exactly
+ * `<project>/.anet/nodes/<node>`. Every existing path is inspected with
+ * lstat + O_NOFOLLOW and inode checks; absent private directories are created
+ * one component at a time. A pre-planted node-root/config/.env symlink is a
+ * hard error before any secret-bearing write.
+ */
+export declare function prepareOpencodeNodeForProfileWrite(nodeWorkDir: string): string;
+export declare function readOpencodePrivateProfileFile(nodeWorkDir: string, filename: OpencodePrivateProfileFilename): string | undefined;
+export declare function writeOpencodePrivateProfileFile(nodeWorkDir: string, filename: OpencodePrivateProfileFilename, body: string): string;
+/**
+ * Write auth.json into the opencode config root that lives under
+ * `nodeWorkDir` (the per-node OpenCode data root). mode 0o600 limits
+ * filesystem access to the owning OS account; it does not prevent a
+ * same-uid OpenCode child from opening the file directly. Directory is
+ * created if missing.
+ *
+ * Returns the absolute path we wrote for logging.
+ */
+export declare function writeOpencodeAuthJson(nodeWorkDir: string, preset: OpencodePreset, apiKey: string): string;
+/**
+ * New keyless nodes must not inherit a private-but-preplanted credential.
+ * Keep the file present as an explicit empty object so the creation log's
+ * "auth not configured" statement matches the state OpenCode will consume.
+ */
+export declare function clearOpencodeAuthJson(nodeWorkDir: string): string;
+/**
+ * Companion opencode.json: records only the selected blessed provider
+ * identity and safe-by-default tool policy. Pre-existing model routing and
+ * arbitrary OpenCode integrations are stripped; operators may explicitly set
+ * a model after creation, which the runtime's separate safe renderer retains.
+ */
+export declare function writeOpencodeConfigJson(nodeWorkDir: string, preset: OpencodePreset): string;

package/dist/src/opencode-runtime-binding.d.ts

@@ -0,0 +1,30 @@
+export declare const OPENCODE_RUNTIME_BINDING_SCHEMA_VERSION: 1;
+export declare const OPENCODE_RUNTIME_BINDING_RUNTIME: "opencode-cli";
+export declare const OPENCODE_RUNTIME_BINDINGS_DIRECTORY = "opencode-runtime-bindings";
+export interface OpencodeRuntimeBinding {
+    schemaVersion: typeof OPENCODE_RUNTIME_BINDING_SCHEMA_VERSION;
+    runtime: typeof OPENCODE_RUNTIME_BINDING_RUNTIME;
+    projectRoot: string;
+    nodeId: string;
+}
+/** Windows reports synthetic POSIX permission bits; retain all other checks there. */
+export declare function isOpencodeRuntimeBindingModeSecure(mode: number, exactMode?: number, platform?: NodeJS.Platform): boolean;
+/** Resolve the deterministic binding path without creating HOME state. */
+export declare function opencodeRuntimeBindingPath(nodeWorkDir: string, homeDirectory?: string): string;
+/** Persist an external, immutable-by-config record that this node was created as OpenCode. */
+export declare function writeOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): string;
+/** Read and validate a binding. Missing bindings return undefined; unsafe or tampered state throws. */
+export declare function readOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): OpencodeRuntimeBinding | undefined;
+/**
+ * Remove only the exact, validated binding for this node. Missing exact state is
+ * idempotent; malformed, replaced, or unsafe state always fails closed.
+ */
+export declare function removeOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): boolean;
+/** Assert that the external record exists and exactly identifies this node as opencode-cli. */
+export declare function assertExactOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): OpencodeRuntimeBinding;
+/**
+ * Refuse OpenCode node state committed to a surrounding Git index. A normal
+ * non-Git project is allowed. Git is always invoked directly with argv and a
+ * literal pathspec; no shell or command interpolation is used.
+ */
+export declare function assertOpencodeNodeStateUntracked(nodeWorkDir: string): void;

package/dist/src/opencode-safe-root.d.ts

@@ -0,0 +1,36 @@
+/** Exact 1.18.1 project/instruction discovery surface plus project-root
+ * redirects. Any existing entry, including a broken symlink, is a refusal. */
+export declare const OPENCODE_SAFE_ANCESTOR_CANDIDATES: readonly ["opencode.jsonc", "opencode.json", ".opencode", "AGENTS.md", "CLAUDE.md", "CONTEXT.md", ".claude", ".agents", ".git"];
+interface PathIdentity {
+    path: string;
+    dev: number | bigint;
+    ino: number | bigint;
+}
+export interface OpencodeSafeExternalRoot {
+    readonly base: string;
+    readonly root: string;
+    readonly cwd: string;
+    readonly dev: number | bigint;
+    readonly ino: number | bigint;
+    readonly baseDev: number | bigint;
+    readonly baseIno: number | bigint;
+    readonly ancestors: readonly PathIdentity[];
+}
+/** #1845 层② —— 运行时隔离 base 的平台策略。规则(祖先不可符号链接、非 root 只能是本 uid、无 0o022 写位、
+ * base 本身 uid-owned 0700)三平台一样;不同的只有**默认 base 在哪**:
+ *   linux  → /run/user/<uid>(systemd 的每用户 0700 运行目录;缺失时仅 root 可建)
+ *   darwin → realpath($TMPDIR)(macOS 每用户 0700 的 /private/var/folders/xx/<hash>/T;2026-09-07 Mac mini 量过
+ *            全链:T 700 uid、<hash> 755 uid、其余 755 root,满足同一套祖先规则)
+ *   其它   → 拦(win32 没有 uid 语义)
+ * 显式 base(参数或 ANET_OPENCODE_SAFE_BASE)三平台通用。platform / env 可注入,便于在 Linux CI 上测 darwin 分支。 */
+export declare const OPENCODE_SAFE_ROOT_PLATFORMS: ReadonlySet<NodeJS.Platform>;
+export declare function defaultOpencodeRuntimeBase(uid: number, platform: NodeJS.Platform, env: NodeJS.ProcessEnv): string;
+export declare function resolveOpencodeTrustedRuntimeBase(explicit?: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): PathIdentity;
+export declare function createOpencodeSafeExternalRoot(options: {
+    prefix: string;
+    boundaries?: readonly string[];
+    base?: string;
+}): OpencodeSafeExternalRoot;
+export declare function revalidateOpencodeSafeExternalRoot(context: OpencodeSafeExternalRoot): void;
+export declare function cleanupOpencodeSafeExternalRoot(context: OpencodeSafeExternalRoot): void;
+export {};

package/dist/src/opencode-smoke-env.d.ts

@@ -0,0 +1 @@
+export declare function buildOpencodeSmokeEnv(parentEnv: NodeJS.ProcessEnv, smokeRoot: string, cwd?: string): NodeJS.ProcessEnv;

package/dist/src/opencode-versions.d.ts

@@ -0,0 +1,44 @@
+export type OpencodeGeneration = "v1" | "v2";
+export type OpencodeSupportStatus = "supported" | "preview" | "unsupported";
+export interface OpencodeGenerationSupport {
+    readonly generation: OpencodeGeneration;
+    /** npm package that provides the `opencode` executable. */
+    readonly packageName: string;
+    /** Release pin: the exact version a fresh install is told to use.
+     *  null when no version of this generation is vetted. */
+    readonly pin: string | null;
+    /** Every exact version a start may accept, preferred first (pin first).
+     *  Empty when the generation is unsupported. */
+    readonly acceptedVersions: readonly string[];
+    readonly status: OpencodeSupportStatus;
+}
+/** The V1 release pin. Kept as its own literal line so shell suites can
+ *  read it with a single anchored sed (tests/test1225…/run.sh). */
+export declare const OPENCODE_V1_PIN = "1.18.34";
+/** The V2 preview pin (#543). Vetted by tests/test543-… against a stub model. */
+export declare const OPENCODE_V2_PIN = "2.0.22";
+export declare const OPENCODE_SUPPORTED_VERSIONS: readonly OpencodeGenerationSupport[];
+/** Generation assumed for every node record that does not name one. */
+export declare const OPENCODE_DEFAULT_GENERATION: OpencodeGeneration;
+export declare function isOpencodeGeneration(value: unknown): value is OpencodeGeneration;
+export declare function opencodeGenerationSupport(generation: OpencodeGeneration): OpencodeGenerationSupport;
+/** Exact versions a start may accept for `generation`, preferred first.
+ *  Always empty for an unsupported generation. */
+export declare function acceptedOpencodeVersionsFor(generation: OpencodeGeneration): readonly string[];
+export declare function isAcceptedOpencodeVersionFor(generation: OpencodeGeneration, version: string): boolean;
+/** Generation recorded on a node config; a config without one (every node
+ *  created before #542) is V1. An unrecognised value is returned as
+ *  undefined so callers can refuse it instead of guessing. */
+export declare function opencodeGenerationOfConfig(config: {
+    opencodeGeneration?: unknown;
+} | null | undefined): OpencodeGeneration | undefined;
+/** Why `generation` may not run on a node with these settings, as ONE
+ *  actionable line — or null when it may. V1 is never refused here. V2
+ *  (#543 preview) runs only in co-presence mode and only with
+ *  flags.opencodeUnsafeTools=true: it ignores the V1 safety env, so under the
+ *  default safe preset it would run with every local tool enabled. */
+export declare function opencodeGenerationRefusal(generation: OpencodeGeneration, opts: {
+    unsafeTools: boolean;
+    mode?: "headless" | "copresence" | string;
+    configFile?: string;
+}): string | null;