@te-river/opencode-team-mode 1.6.2 → 1.7.1

package/README.md

@@ -19,10 +19,10 @@
 > **The lazy path:** paste this to any coding agent and let it do the work:
 >
 > ```text
-> Install the OpenCode plugin @te-river/opencode-team-mode. First run `opencode --version`:
-> 1.18.x → https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/docs/installation.md
+> Install the OpenCode plugin @te-river/opencode-team-mode. This package supports **OpenCode 2.x
+> only** — the 1.18.x personality was removed in the 1.7.0 line:
 > 2.x → https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/docs/installation-v2.md
-> (on 2.x a plugin cannot create an agent, so the six roles and six `/team-*` commands come
+> (a 2.x plugin cannot create an agent, so the six roles and six `/team-*` commands come
 > from a generator step in that guide — that step is not optional.) Then verify the install
 > using the checks in that guide.
 > ```
@@ -48,14 +48,14 @@ TeamMode's answer to each:
 | Pain | TeamMode's answer |
 |---|---|
 | 🔥 **Context flooding** | Every governed tool output over its content-class offload threshold (prose 4000 / data 2000 tokens, CJK-aware) is offloaded to a local run store and replaced by an 80-token preview + an HMAC handle. The agent pages through what it needs — the window never drowns. |
-| 🐌 **Round-trip overhead** | `tm_ptc_run`: the agent writes ONE program that makes N governed calls in a single turn. Zero LLM round-trips during the run. |
+| 🐌 **Round-trip overhead** | The host's own `execute` (Code Mode): the agent writes ONE program that makes N governed calls in a single turn. Zero LLM round-trips during the run. |
 | 🕳️ **Silent side effects** | R6/R2 approval gate: env-var reads and dangerous ops route through OpenCode's official confirmation dialog, auto-rejected after 1 unanswered minute (default). The plugin never approves on its own — it only ever rejects. |
 | 🌫️ **Hallucinated research** | Web access is a two-role grant with an allowlisted, governed tool chain. A fact that couldn't be fetched is reported as a gap — never fabricated. |
 | 🧭 **Walls of text** | Replies are steered into the shape the host renders fastest: a markdown table for per-file / per-case / per-finding results, fenced code for diffs and configs, a browser screenshot attached as an inline image only when you ask for one. The renderer's supported set is measured rather than assumed, and the prompts carry the negative half of that measurement — footnotes, `==highlight==`, a bare `---` rule and `$…$` math reach you as literal text, so agents are told not to use them, while `mermaid` diagrams are offered because this host does draw them. |
 | 🎯 **Goal drift** | The lead opens with `GOAL:` in your own words plus checkable `ACCEPTANCE:` criteria, and the run does not end while a criterion lacks evidence — the only legitimate stops are named (blocked on you, or provably unachievable). When a round settles with items still open on the host's todo list, `tm_join` says 目标未达成 and lists them, and the goal is carried through context compaction so a summarized transcript cannot redefine it. |
 
 | 🗣️ **Replies in a language you never chose** | The governed tools answer in Chinese, and an agent left to its own devices mirrors that straight back at you. Every role now carries a reply-language rule: your own language wins, and a Chinese string is quoted verbatim only where it IS the evidence (a close verdict, a refusal line) — translating a verdict is how an unchecked claim starts looking checked. |
-| ⏱️ **Rounds spent for the sake of looking careful** | 效率至上 is written into the lead and all five specialists: one wide call instead of three narrow ones, independent calls in the same round, ≥3 probes collapsed into one `tm_ptc_run`, no re-running a check to watch it pass again — with the boundary stated too: efficiency never buys its way out of the evidence rule, because an unverified "done" costs you the round *and* the bug. |
+| ⏱️ **Rounds spent for the sake of looking careful** | 效率至上 is written into the lead and all five specialists: one wide call instead of three narrow ones, independent calls in the same round, ≥3 probes collapsed into one `execute` (Code Mode) program, no re-running a check to watch it pass again — with the boundary stated too: efficiency never buys its way out of the evidence rule, because an unverified "done" costs you the round *and* the bug. |
 
 And the workflow discipline underneath: deterministic routing, a ≤30-line plan
 you approve before ≥2 dispatches execute, structured `STATUS/CHANGES/FINDINGS/
@@ -75,7 +75,7 @@ projects**: on a two-file script the team simply has less to govern.
 | 🏗️ **Architect** | System designer | Design docs, module structure, API contracts |
 | 💻 **Implementer** | Code writer | Building features, writing production code |
 | 🔍 **Reviewer** | Dimension-focused auditor | Single-dimension review by default; 3 in parallel only for high-risk changes |
-| 🧪 **Tester** | Test engineer | Tests with real edge cases; static verification (build / typecheck / lint); governed UI verification via `tm_browser` |
+| 🧪 **Tester** | Test engineer | Tests with real edge cases; static verification (build / typecheck / lint); governed UI verification via the host's native `browser_*` tools |
 | 🔎 **Researcher** | Knowledge finder | Local repo first, then the web — one of the two network roles (with the Lead) |
 
 Out of the box, **Team is your default agent** — new chats open straight into the
@@ -90,10 +90,10 @@ orchestrator (opt-out in [Configuration](#-configuration)).
 Copy this into any coding agent — it will edit your config, restart-remind you, and verify:
 
 ```text
-Install the OpenCode plugin @te-river/opencode-team-mode. First run `opencode --version`:
-1.18.x → https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/docs/installation.md
+Install the OpenCode plugin @te-river/opencode-team-mode. This package supports **OpenCode 2.x
+only** — the 1.18.x personality was removed in the 1.7.0 line:
 2.x → https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/docs/installation-v2.md
-(on 2.x a plugin cannot create an agent, so the six roles and six `/team-*` commands come from
+(a 2.x plugin cannot create an agent, so the six roles and six `/team-*` commands come from
 a generator step in that guide — that step is not optional.)
 (If a URL is unreachable — common on mainland-China networks — retry with
 the mirror prefix: https://ghproxy.net/ + the same path.)
@@ -273,45 +273,42 @@ through with `tm_fetch` when it genuinely needs the payload.
 
 | Tool | What it does | Roles |
 |---|---|---|
-| `tm_read` / `tm_grep` / `tm_bash` / `tm_fetch` | Governed file read / regex search / read-only shell (allowlist) / paged handle retrieval (JSON handles take a `fields` dot-path projection — a deliberately small jq subset like `items[].name`) | all six agents — **except on OpenCode 2.x, where the first three are not registered; see the note under this table** |
+| `tm_fetch` | Paged handle retrieval for offloaded results (JSON handles take a `fields` dot-path projection — a deliberately small jq subset like `items[].name`) | all six agents |
 | `tm_memory` | Session + project + global memory store (Markdown + frontmatter): add / search / list / forget / compact | all six agents |
 | `tm_board_write` | **The blackboard's write side**: places ONE new Markdown file at `<board-root>/<session-key>/<task-slug>/NN-<role>-<topic>[-rN].md` and chooses the name itself — a revision is a new round-suffixed file, never an overwrite, and the reply carries the path plus the byte count, never the content. It exists because the board used to need a file tool, and `architect` / `researcher` own none (no `write`, no `edit`, no `bash` even to stamp the session folder), so every oversized deliverable from those roles came back as `BLACKBOARD WRITE FAILED` plus the whole document pasted inline — the reply shape this team mandates was un-followable exactly where it mattered. Scope is enforced rather than asked: segments sanitized, target realpath-verified against the board root (a symlinked task dir is refused), the name always ends in `.md` so no `.env`/rc file can be produced, caps via `TM_BOARD_MAX_CHARS` + a per-session file limit | All six agents |
-| `tm_ptc_run` | Batch orchestration: one program, N governed calls, zero LLM round-trips; web roles also get `tm.search` / `tm.webfetch` inside the program | all six agents |
 | `tm_search` | Multi-engine web search with extracted, deduplicated, RRF-fused hit lists | Lead + Researcher |
 | `tm_webfetch` | Single governed GET of an allowlisted page (search pages auto-extracted). Manual redirects, re-checked per hop, and a refusal names the WHOLE chain (`跳转链: a → b（停在第 2 跳）`) — an allowlisted shortener that bounces off-site used to report only the off-site host, which read as "that site will not fetch" and sent the agent back to retry the entry URL it had just watched fail. A 429/503 carries its own `Retry-After` when the server sends delta-seconds (an HTTP-date is deliberately not laundered into a countdown), so "come back later" never looks like "no content here". The page GET also asks for Markdown first (`Accept: text/markdown,…`) — measured on `learn.microsoft.com`: 60,778 B of HTML becomes 11,449 B of Markdown, and every other host tried returns the same document either way, so the preference is free where it is ignored | Lead + Researcher |
-| `tm_ledger` | **The lead's task ledger** (`add` / `doing` / `done` / `blocked` / `list`), stored in the host's own `ctx.storage` per session — the landing spot for the LEDGER rule on OpenCode 2.x, which gives a plugin no `todowrite`. A repeated ask is ONE item, an id that matches two is refused with both printed, `blocked` carries the reason, and a write that did not reach storage is reported as a failure rather than as recorded. **v2 only** — v1 keeps the host's `todowrite` | Lead only |
-| `tm_join` | **Sub-agent collection** — there is no plugin-side dispatcher any more (`tm_dispatch` is removed: a child a plugin creates is a session the user can neither open nor stop from the interface). Delegation goes through the host's own `task` / `task { background: true }`, and `tm_join` is the read side: a status snapshot, a bounded `waitMs`, `cancel:true` to stop a runaway, and `claimNamedChild` so `tm_join { ids: ["ses_…"] }` pulls one child's WHOLE reply back through the offload pipeline (handle + ≤80-token preview) instead of kilotokens inline. It also rebuilds its registry from the host session tree after a restart, so leftover children are 接管 rather than lost. **On 2.x it also registers the children the host's own `subagent` tool created** (the ack's `metadata.sessionID` is the seam), so a background dispatch is never reported as "nothing to collect" while the user watches it run — and such a row says where its reply actually arrives (the host's injected message) and whether it settled by event or by inference. **Stopping one is a real call on both hosts:** `cancel: true` goes to `client.session.abort` on 1.18.x and to the host's `POST /api/session/{id}/interrupt` on 2.x (`tm_join { ids: ["ses_…"], cancel: true }` stops ONE named child; without `ids` it stops every still-running one). The host's own contract is `interrupted=true` for an active execution and `false` for the idle no-op, so the answer comes back as **five distinct verdicts** — 已由宿主中断 / 空闲未中断（it wasn't running: our row was stale, not failed）/ 未确认（the call worked, no boolean came back）/ 无中断缝 / 被宿主拒绝（with the host's reason) — counted in the reply and written to the trajectory (`stop_tried` / `stop_confirmed` / `stop_refused` / `stop_unknown`, readable via `tm_stats`). It will not summarise five different facts as one "已取消", and `resume` is never sent, because resuming pending steering is the opposite of cancelling. *(On `main` only — the published 1.6.1 still answers 宿主无 abort 接口 on 2.x.)* | Lead only |
-| `tm_pty` (**v1 only** — v2 registers nothing: the plugin ctx has no pty domain) | **Non-blocking command execution** on the host's own terminal sessions (`start`/`status`/`list`/`kill`) — independent builds and test suites overlap instead of queueing behind one 120 s bash call. Captures no output (the command tees its own log; read it with `tm_read`), and every start passes the R6 classifier, the R2 danger-face globs **and** the official confirmation dialog before a process exists | Lead only |
-| `tm_stats` | **The plugin reads its own trajectory back**: tokens kept out of the context window by offloading (net of the preview that arrived), seconds saved by dispatch overlap (serial cost minus the wall window the children actually used), PTC internals, governance counts (blocked subresources, refused `tm_pty` starts, clamped bash timeouts, cache hits, redactions) — plus the **host capability matrix** (`已验证/存在未用/待观察/缺失/需人眼` per host surface). Read-only over files this plugin wrote; run it first after an OpenCode upgrade. `{ recent: 20 }` appends a call-by-call recap — handle + payload path for every offloaded result, which is how you see what a governed tool actually returned (the host gives plugin tools no expandable card) | All agents |
-| `tm_browser` | Interactive browser session (**your default browser**): 18 Playwright verbs (snapshot-first `take_snapshot` → uid-addressed `click`/`fill`/`drag`/…, **including multi-tab `new_page` / `close_page`** so you can hold two pages at once) + 5 legacy compat verbs (open/navigate/read/screenshot/close); Playwright engine needs Node ≥ 20, below that (or on any import failure) it auto-degrades to the legacy CDP engine. It drives YOUR default browser channel (an Edge Beta default opens Edge Beta), stays headful unless the operator sets `TM_BROWSER_HEADLESS`, loads a page's own images/CSS/JS via the `same-site` subresource policy, and `take_screenshot { image:true }` attaches a JPEG so the model can actually see the screen. **One browser per agent**: `open` returns an id (`b1`) and every reply is tagged with it — that window, its uid numbering and its dialog-approved hosts belong to YOUR session; another agent's id is refused with the owner named (an id is a name, not a key), and `close { id:"all" }` closes only your own. `click` reports what the PAGE did, not merely that a mouse event was sent: it reads the target's observable state before and after (`aria-expanded`, URL, DOM node count) and answers `已点击 … · aria-expanded: false → true`, retries once if the page had not finished loading — the measured cause of a click that lands on a node with no handler — and says 页面没有任何可观测变化 rather than implying success. `close` will not say 已确认关闭 until the browser's OS process is gone — it waits on the pid, terminates it once if it lingers, and prints the pid either way, because a dropped connection is not a closed browser; when no pid could be resolved it says 进程未核验 rather than borrowing that sentence. A browser this process launched but could not reap is recorded in a per-workspace ledger (pid, owner pid, executable) and reclaimed by the next boot — only entries whose owner process is dead *and* whose pid still is that executable, terminated as a whole tree (`taskkill /T` on Windows), never another window's live tab. **A blank page now explains itself**: `same-site` cannot know that a site's own bundle lives on a brand-unrelated CDN (Baidu serves its scripts from `bdimg.com`), so when a page comes back with `0 个可寻址节点` while a script host was blocked, the reply says the blankness is **our gate**, names the host, and offers `allow_host { host }` — one official dialog for one bare domain, for your browser only, for this session, nothing written to config (re-navigate afterwards, the gate decides per request). A page that is really a human-verification wall (百度安全验证 / Cloudflare / access denied) is reported as a wall, because the move there is another source, not another retry | Lead + Researcher + Tester (UI verification) |
-
-> **On OpenCode 2.x, five of those tools are deliberately not registered.**
-> `tm_read` / `tm_grep` / `tm_bash` are replaced by the host's own `read` / `grep` /
-> `glob` / `shell`, and `tm_ptc_run` by the host's `execute` (Code Mode) — the same
-> job, one fewer tool for the model to choose between.  The governance did NOT
+| `tm_ledger` | **The lead's task ledger** (`add` / `doing` / `done` / `blocked` / `list`), stored in the host's own `ctx.storage` per session — the landing spot for the LEDGER rule, since OpenCode 2.x gives a plugin no `todowrite`. A repeated ask is ONE item, an id that matches two is refused with both printed, `blocked` carries the reason, and a write that did not reach storage is reported as a failure rather than as recorded | Lead only |
+| `tm_join` | **Sub-agent collection** — there is no plugin-side dispatcher any more (`tm_dispatch` is removed: a child a plugin creates is a session the user can neither open nor stop from the interface). Delegation goes through the host's own `task` / `task { background: true }`, and `tm_join` is the read side: a status snapshot, a bounded `waitMs`, `cancel:true` to stop a runaway, and `claimNamedChild` so `tm_join { ids: ["ses_…"] }` pulls one child's WHOLE reply back through the offload pipeline (handle + ≤80-token preview) instead of kilotokens inline. It also rebuilds its registry from the host session tree after a restart, so leftover children are 接管 rather than lost. **On 2.x it also registers the children the host's own `subagent` tool created** (the ack's `metadata.sessionID` is the seam), so a background dispatch is never reported as "nothing to collect" while the user watches it run — and such a row says where its reply actually arrives (the host's injected message) and whether it settled by event or by inference. **Stopping one is a real call:** `cancel: true` goes to the host's `POST /api/session/{id}/interrupt` on 2.x (`tm_join { ids: ["ses_…"], cancel: true }` stops ONE named child; without `ids` it stops every still-running one). The host's own contract is `interrupted=true` for an active execution and `false` for the idle no-op, so the answer comes back as **five distinct verdicts** — 已由宿主中断 / 空闲未中断（it wasn't running: our row was stale, not failed）/ 未确认（the call worked, no boolean came back）/ 无中断缝 / 被宿主拒绝（with the host's reason) — counted in the reply and written to the trajectory (`stop_tried` / `stop_confirmed` / `stop_refused` / `stop_unknown`, readable via `tm_stats`). It will not summarise five different facts as one "已取消", and `resume` is never sent, because resuming pending steering is the opposite of cancelling. *(On `main` only — the published 1.6.1 still answers 宿主无 abort 接口 on 2.x.)* | Lead only |
+| `tm_stats` | **The plugin reads its own trajectory back**: tokens kept out of the context window by offloading (net of the preview that arrived), seconds saved by dispatch overlap (serial cost minus the wall window the children actually used), governance counts (blocked subresources, clamped shell timeouts, cache hits, redactions) — plus the **host capability matrix** (`已验证/存在未用/待观察/缺失/需人眼` per host surface). Read-only over files this plugin wrote; run it first after an OpenCode upgrade. `{ recent: 20 }` appends a call-by-call recap — handle + payload path for every offloaded result, which is how you see what a governed tool actually returned (the host gives plugin tools no expandable card) | All agents |
+
+> **The v1 (1.18.x) personality was removed in full for the 1.7.0 line.** The package
+> exports `{id, setup}` and nothing else, so `tm_read` / `tm_grep` / `tm_bash` /
+> `tm_ptc_run` / `tm_pty` are gone with it — the host's own `read` / `grep` / `glob` /
+> `shell` and its `execute` (Code Mode) do that work now. The governance did NOT
 > disappear with them: an oversized native result is offloaded through
 > `tool.execute.after` (measured: `shell` 12,902 tokens arriving as a 78-token
 > preview), and the address red line plus R6's per-command classification ride the
-> host's `permission.evaluate`.  `tm_ledger` is the one tool that exists ONLY on v2 (the lead's list needs a home where
-> `todowrite` does not).
+> host's `permission.evaluate`. `tm_ledger` is the lead's list where the host gives a
+> plugin no `todowrite`.
 > **Nothing we change reaches outside Team.** Every v2 hook fires for every session on
 > the host, so the tool-surface trim, the 0.2 temperature, the blackboard note, the offload
 > of native results, the R6/address strictening and the forced-background dispatch all ask
 > "is this one of our six roles?" first — `build`, `plan` and your own agents stay as a
 > fresh install leaves them. Calls whose owner the host did not tell us are left alone too,
 > and counted (`tm_stats` prints `作用域：我们 · 他人 · 未判定`).
-> The installer writes the v2 variants of the six
-> role prompts, which name `read` / `grep` / `shell` instead of the aliases.
-> Everything above this note describes the v1 (1.18.x) surface, which still ships
-> all thirteen.
+> The installer writes the six
+> role prompts, which name `read` / `grep` / `shell` instead of the removed aliases.
 
 > **On OpenCode 2.x, interactive browsing is the host's, and it stays ours.** The
 > desktop renders a browser in its side panel, and that panel attaches to the
 > server's own browser service — a plugin cannot register a page of its own into it
 > (forensics: `docs/research/browser-pane.md`). So the three roles with network
 > grants (lead, researcher, tester) are pointed at the host's `browser_*` tools
-> first, and `tm_browser` remains the governed door for hosts with no desktop
-> browser attached (CLI, standalone). Handing browsing over did not mean handing
+> — the self-built `tm_browser` was removed in 1.7.0, so the host's catalog is the
+> only browser. On a host with no native browser catalog (CLI, standalone) there is
+> now no browser at all, and the agent reports that gap rather than simulating one.
+> Handing browsing over did not mean handing
 > governance over: `permission.evaluate` was observed NOT firing for `browser_*`, so
 > our gate sits on `tool.execute.before` instead — it classifies the URL of every
 > navigate/open, the path of every `browser_preview`, and every browser URL named
@@ -323,7 +320,7 @@ through with `tm_fetch` when it genuinely needs the payload.
 > leaked past the refusal). One exception to the offload rule lives here: a
 > `browser_snapshot` is an addressing table, not a document, so it is CAPPED (every
 > `[ref=…]` line kept, static text dropped, budget `TM_NATIVE_SNAPSHOT_MAX_TOKENS`
-> default 1 200 — the same budget `tm_browser` runs at) rather than replaced by a
+> default 1 200) rather than replaced by a
 > handle. Measured on a 261-ref page: a head cut keeps 118 refs, this keeps 261 of
 > them using 1 044 of 11 326 tokens.
 
@@ -332,8 +329,8 @@ through with `tm_fetch` when it genuinely needs the payload.
 > It doubles as the fallback chain: when a tool errors (no browser on this
 > host, blocked host), the agent says so and drops to the next rung — and
 > rung ③ is where a missing capability gets reported, never fabricated.
-> One stated exception: on the **web** channel `tm_search` / `tm_webfetch` /
-> `tm_browser` come first, because that path is the only one carrying the
+> One stated exception: on the **web** channel `tm_search` / `tm_webfetch` come
+> first, because that path is the only one carrying the
 > domain allowlist, the per-request confirmation dialog and the R6 red lines.
 
 > **What the host UI cannot show you.** OpenCode renders a *plugin* tool call
@@ -391,8 +388,8 @@ using an HMAC-signed, run-scoped, expiring handle — and on a JSON handle it
 can ask for a `fields` dot-path projection instead (a deliberately small jq
 subset: `items[].name`, `[].stargazers_count`), so a big API dump narrows to
 just the values needed without the raw body ever entering the window.
-`tm_bash` only allows read-only commands (allowlist), and failures come back
-as structured errors instead of raw dumps.
+The host's own `shell` runs read-only probes under its permission rules, and failures
+come back as structured errors instead of raw dumps.
 
 ### Session + project + global memory (tm_memory)
 
@@ -452,49 +449,28 @@ Two more channels complete the surface:
 - `tm_webfetch` — a known URL, one governed GET. Search-engine pages it
   fetches are auto-extracted to hit lists too. JSON endpoints like
   `registry.npmjs.org/<pkg>/latest` pass through untouched.
-- `tm_browser` — JS-rendered pages: **your DEFAULT browser** (Windows
-  registry / Linux `xdg-settings`; Chromium-family only — Firefox falls back
-  to the Edge/Chrome probe order because CDP is Chromium-proprietary;
-  `TM_BROWSER_PATH` overrides), headful by default, isolated temp profile,
-  **domain allowlist enforced at the network layer** per request and per
-  redirect hop. The action surface is chrome-devtools-mcp aligned: **16
-  Playwright verbs** (`navigate_page` · `take_snapshot` · `click` · `fill` ·
-  `hover` · `drag` · `press_key` · `select_page` · `upload_file` · `wait_for`
-  · `evaluate_script` · `list_console_messages` · `list_network_requests` ·
-  `list_pages` · `take_screenshot` · `handle_dialog`) plus 5 legacy compat
-  verbs (`open` / `navigate` / `read` / `screenshot` / `close`).
-  Snapshot-first: `take_snapshot` returns the aria snapshot with injected
-  `[uid=eN]` tokens, follow-up actions address nodes by uid instead of
-  guessed locators; snapshots are hard-capped by
-  `TM_BROWSER_SNAPSHOT_MAX_TOKENS` (default 1200).
-  **Engine split:** the primary engine is `playwright-core` (an optional
-  dependency — needs **Node ≥ 20**; on older Node, or if the import fails,
-  the session auto-degrades per instance to the zero-dep `cdp-legacy`
-  engine, which keeps the core verbs only; pin either via
-  `TM_BROWSER_ENGINE=playwright|cdp-legacy`). No browser download is ever
-  involved — Playwright launches YOUR installed browser by path, so
-  `npx playwright install` is not part of the user flow (the dependency
-  itself resolves at npm install/publish time). Isolated temp profile by
-  default: persistent logins only if you explicitly set
-  `TM_BROWSER_USER_DATA_DIR`. No cookies by design — the agent opens a blank
-  profile, which is also why a risk-scored site (Baidu) may hand it a
-  verification wall your own window walks past. Want it logged in: point the
-  variable at a DEDICATED directory and log in once by hand. The browser's **own** site-permission bubble
-  ("…wants to access other apps and services on this device") is
-  auto-**denied** at launch: that modal is not our confirmation channel, it has
-  no timeout, and on a machine left running unattended it would hang the page
-  indefinitely. Nothing is ever auto-allowed — a page that truly needs such a
-  permission fails visibly at that feature instead of invisibly at a dialog. A
-  window an agent forgets is now **reported**, not merely reaped: `open` states
-  the close duty in its own reply (with the real idle seconds), the reply
-  contract requires the tool's close verdict in `EVIDENCE`, and `tm_join` tells
-  the lead `⚠ N 个浏览器还开着` when a sub-agent settled while still holding one
-  — so you are never the only one who notices.
+- **Interactive browsing is the host's own `browser_*` tools** (`browser_tabs_open`
+  · `browser_navigate` · `browser_snapshot` · `browser_click` · `browser_evaluate`
+  …). The self-built `tm_browser` was **removed in 1.7.0** (a breaking change):
+  the desktop renders a browser in its side panel and that panel attaches to the
+  server's own browser service, so a plugin cannot register a page of its own
+  (forensics: `docs/research/browser-pane.md`). The host catalog is policed by
+  `src/host/v2-browser-gate.ts` at `execute.before` — the URL of every navigate/open,
+  the path of every `browser_preview`, and every browser URL named inside an
+  `execute` program are classified against the address red lines and the env-file
+  rule, and a refused call the host runs anyway has its page replaced with the same
+  refusal, so no out-of-policy content reaches the context, the store or the
+  trajectory. Calling convention differs from the deleted tool: `evaluate` takes
+  `{tabID, script}` where `script` is an **expression** (not a function source) and
+  the return value must be a scalar you `JSON.stringify` yourself; snapshot tokens
+  read `@e8 [link]`. **Known cost, accepted:** on a host with no native browser
+  catalog (CLI / standalone) there is now no browser at all — the agent reports that
+  gap rather than simulating one.
 
 When a fetch still returns **403 after the real-Chrome headers**, the error
 is a DIRECTIVE: the gate is JS-challenge / TLS-fingerprint based and only a
-real browser passes — the agent is told to call `tm_browser`
-(`action:"open"` → `action:"read"`) for that URL. Search hit lists also
+real browser passes — the agent is told to open that URL with the host's
+native `browser_navigate` (and read it with `browser_snapshot`). Search hit lists also
 filter known noise: engine-internal wrappers (`so.com/link?`, `ai.so.com`)
 and same-name-different-site domains (`maimai.cn` 脉脉 vs the maimai DX
 game) never ride along — extend the hit blacklist with `TM_HIT_BLACKLIST`.
@@ -512,9 +488,9 @@ mzh.moegirl.org.cn, space.bilibili.com — is covered):
 `TM_WEBFETCH_ALLOWED_DOMAINS` (`"*"` opens every host; a custom list REPLACES
 the seed, so keep the engine hosts or `tm_search` loses its targets). Architect /
 implementer / reviewer have NO network grant — web questions come back as a
-reported gap, never simulated. The tester carries `tm_browser` ONLY, for
-governed UI verification of the project (local dev servers, preview routes);
-open web fetching stays with the two network roles.
+reported gap, never simulated. The tester carries the host's native `browser_*`
+tools ONLY, for governed UI verification of the project (local dev servers,
+preview routes); open web fetching stays with the two network roles.
 
 **Out-of-allowlist targets are a gate, not a wall.** When a fetch / search /
 browser-open points at a host outside the allowlist, the tool hands the URL
@@ -527,6 +503,12 @@ remain hard-rejected with no dialog — R6 red lines are never consentable.
 
 ### Security: the R6 + R2 approval gate
 
+**On OpenCode 2.x, R6 is armed by default.** A Team role's native `read` of a `.env` is denied
+outright — no consent path — and a shell command that reads the environment goes to the host's own
+permission prompt (a plugin cannot raise a dialog on 2.x, so the shell face is the host's `ask`
+while the env-file face is a hard `deny`). Turn it off with the plugin option
+`envProtect: false` or with `TM_ENV_PROTECT=off`.
+
 **R6 environment protection.** With TeamMode active, the model cannot read
 environment variables silently. Env reads (`printenv`, `env`, `Get-ChildItem
 env:`, …) and env files (`.env`, shell rc) route through OpenCode's official
@@ -605,12 +587,18 @@ The plugin injects everything at startup — no agent files to copy.
 
 ```jsonc
 {
-  "plugin": [
-    ["@te-river/opencode-team-mode@latest", { "defaultAgent": false }]
+  "plugins": [
+    { "package": "@te-river/opencode-team-mode@latest", "options": { "defaultAgent": false } }
   ]
 }
 ```
 
+Note the shape: on 2.x a plugin entry is either a string or an **object** with `package` and
+`options`. The 1.x tuple form `["@te-river/opencode-team-mode@latest", { … }]` is rejected
+(`path=$.plugins.1 kind=invalid`, measured 2026-10-06). Options do arrive — with the object
+form the boot row reads `board_ttl_days=7` for `{ "ttlDays": 7 }`, so this is measured, not
+documented-and-hoped.
+
 Your own agents named `team` / `architect` / … always take precedence; the
 plugin never clobbers user definitions. See [Customization](#-customization)
 for overrides, extra agents and disabling roles.
@@ -620,11 +608,11 @@ for overrides, extra agents and disabling roles.
 | Env var | Default | Purpose |
 |---|---|---|
 | `TM_ENV_PROTECT` | `strict` | R6 mode: `strict` / `standard` / `off` (off also disarms the approval timer) |
-| `TM_R6_FINE_ASK` | classifier (v2 only) | On **v2** the command line is judged per-call by the host's `permission.evaluate` hook, so an ordinary `git status` asks nothing and an env dump still does. `off` falls back to asking about EVERY shell command — which is also what happens automatically on a host that does not expose the hook, and the boot note says which of the two caused it. v1 is unaffected: it classifies in the tool-call hook either way |
+| `TM_R6_FINE_ASK` | classifier | The command line is judged per-call by the host's `permission.evaluate` hook, so an ordinary `git status` asks nothing and an env dump still does. `off` falls back to asking about EVERY shell command — which is also what happens automatically on a host that does not expose the hook, and the boot note says which of the two caused it |
 | `TM_V2_CODEMODE` | catalog (opt-in `direct`) — **v2 only** | How our tools reach the model. OpenCode 2.x decides tool visibility with `options.codemode`. We used to send `codemode:false` by default and claim direct delivery — **a live 2.0.16 desktop session disproved it**: with the flag sent, every `tm_*` still arrived inside the host's Code Mode catalog ("They cannot be called directly…"), and the model's own callable list was the nine native tools. So the default now sends nothing, and `direct` is an experiment for a build that honours it. The observable truth is `tools_in_request` in the shutdown record (rendered by `tm_stats` as `请求内实际可见=…`), never the flag we sent |
 | `TM_LEDGER_MAX_ITEMS` | 200 | Ceiling on `tm_ledger` items per session. The host's `ctx.storage` has no TTL and no quota (measured), so the list refuses to grow past this instead of quietly dropping the oldest asks — and a refusal is something the lead can act on, while a silent truncation is a claim nobody can re-check |
 | `TM_V2_PROBE` | — (v2 only) | Path to a JSONL file where the surface probe records the host's real tool ids, permission action names and argument key names. Names and counts only — never a command line, path, URL or env value. It is how "does the host actually have X?" gets answered from the running build instead of from a doc; without it the same name sets still ride the trajectory so `tm_stats` can show them |
-| `TM_PRIVATE_SPACE` | `ask` on v1 · `deny` on **v2** | What private space (loopback, RFC1918, ULA, CGNAT, `.localhost`) does through our tools: `ask` routes it to the host dialog (v1 can raise one), `allow` opens the class, `deny` refuses it. v2 defaults to `deny` because a plugin there cannot raise a dialog — telling the agent to wait for a window that will never open is not a gate with a procedure — so the refusal prints both operator exits instead (`allow`, or that one hostname in `TM_WEBFETCH_ALLOWED_DOMAINS`). Never conflated with the FORBIDDEN ranges: cloud-metadata / link-local / reserved are refused under every setting and every allowlist, with no consent path |
+| `TM_PRIVATE_SPACE` | `deny` | What private space (loopback, RFC1918, ULA, CGNAT, `.localhost`) does through our tools: `allow` opens the class, `deny` refuses it. The default is `deny` because a 2.x plugin cannot raise a dialog — telling the agent to wait for a window that will never open is not a gate with a procedure — so the refusal prints both operator exits instead (`allow`, or that one hostname in `TM_WEBFETCH_ALLOWED_DOMAINS`). Never conflated with the FORBIDDEN ranges: cloud-metadata / link-local / reserved are refused under every setting and every allowlist, with no consent path |
 | `TM_V2_BROWSER_GATE` | on — **v2 only** | The gate over the host's `browser_*` catalog (URLs and preview paths at `execute.before`, plus the browser URLs named inside an `execute` program). `off` restores the host's ungoverned browsing; the boot line and `tm_stats` say which world is running |
 | `TM_NATIVE_REPORT_MAX_TOKENS` | 1600 — **v2 only** | The budget a report-shaped native result (anything carrying a Markdown table — `tm_stats` via Code Mode, a `tm_join` summary) keeps in context. Table lines and their headings win the space and the prose between them is what gets dropped, because a table with a hole in it is not a table; the full text still rides the handle |
 | `TM_NATIVE_SNAPSHOT_MAX_TOKENS` | 1200 — **v2 only** | The budget a native `browser_snapshot` / `browser_find` keeps in context. Addressing lines win it before static text does; past `budget × 4` the reply states how many ref lines did not fit, and kept + dropped always equals the total |
@@ -640,25 +628,27 @@ for overrides, extra agents and disabling roles.
 | `TM_BLACKBOARD_TTL` | `7` | store retention (days) |
 | `TM_BOARD_MAX_CHARS` | `200000` | tm_board_write: one board file's character cap — over it the write refuses (with a "split the topic" hint) instead of truncating a deliverable |
 | `TM_BOARD_MAX_FILES` | `200` | tm_board_write: markdown files allowed per session folder; the TTL sweeper is the only reclaim path, so the refusal names it and the `ttlDays` option |
-| `TM_BASH_READONLY_ALLOWED` | built-in table | tm_bash allowlist |
 | `TM_SEARCH_DEFAULT_ENGINE` | `auto` | tm_search engine when no `engine` arg is given (`auto` = classify + parallel fan-out + RRF fusion; any table name also pins a manual default) |
-| `TM_WEBFETCH_ALLOWED_DOMAINS` | the 24 seeded hosts on v1; `"*"` on **v2** | tm_webfetch / tm_search / tm_browser allowlist (`"*"` opens all; empty = deny all; a custom list REPLACES the seed — keep the engine hosts). A site's own asset CDN has to be seeded or `tm_browser` renders it blank — `bdimg.com` is there for exactly that reason; per-session gaps go through `tm_browser { action:"allow_host", host }` instead of an env edit. `"*"` does **not** cover private space: loopback / RFC1918 / CGNAT / `.localhost` still need the dialog on every use, and non-routable ranges (169.254.0.0/16 metadata, 0.0.0.0/8, multicast, reserved, plus the IPv4-mapped and DNS64 spellings of the same target) are a hard red line no setting can open |
-| `TM_BROWSER_PATH` | auto-detect | tm_browser executable override (default: your DEFAULT browser when Chromium-family, else Edge/Chrome probes) |
-| `TM_BROWSER_HEADLESS` | `auto` | `1` headless (CI) / `0` headful / `auto` (headless only on display-less Linux) |
-| `TM_BROWSER_ENGINE` | `playwright` | `playwright` (needs Node ≥ 20; any import failure auto-degrades) / `cdp-legacy` (zero-dep CDP pipe, core verbs only) |
-| `TM_BROWSER_SNAPSHOT_MAX_TOKENS` | `1200` | hard cap on `take_snapshot` payloads |
-| `TM_BROWSER_SUBRESOURCE` | `same-site` | what a page may load after its navigation was allowed: `same-site` = images/media/fonts/stylesheets always, scripts/XHR only for a site this session actually opened; `passive` = only the passive types; `off` = the legacy every-request gate. Blocked requests surface as a "N 个子资源请求被拦截" note on the next snapshot, and when the page has nothing addressable left the note says the blankness is ours and points at `allow_host` / this env var |
-| `TM_BROWSER_IDLE_MS` | `180000` | an untouched browser session closes itself after this many ms (0 disables) and tells the user — a window nobody owns is a user-facing bug |
-| `TM_BROWSER_ASK_EVAL` | `on` | `evaluate_script` runs arbitrary JS in YOUR browser — the one verb the domain allowlist can't cover (it limits where we navigate, not what a loaded page hands back). One official-dialog consent per browser session; no ask bridge ⇒ refused. `off` restores the old behaviour; the result redaction (JWT/bearer/cookie/api-key shapes) is NOT switchable |
-| `TM_WEB_CACHE_TTL_SEC` | `300` | how long a governed fetch may re-serve the same URL (0 = off). One store shared by tm_webfetch / tm_search / the PTC bridge; entries are hash-named (a token-bearing query never hits disk) and are only read or written for hops the STATIC allowlist admitted — dialog consent stays per-request, and a re-served page says 缓存命中 |
-| `TM_BROWSER_IMAGE_MAX_BYTES` | `400000` | ceiling on the JPEG `take_screenshot { image:true }` inlines into the model's context (above it the reply stays path-only and says why) |
+| `TM_WEBFETCH_ALLOWED_DOMAINS` | `"*"` | tm_webfetch / tm_search allowlist (`"*"` opens all; empty = deny all; a custom list REPLACES the seed — keep the engine hosts). `"*"` does **not** cover private space: loopback / RFC1918 / CGNAT / `.localhost` still need the dialog on every use, and non-routable ranges (169.254.0.0/16 metadata, 0.0.0.0/8, multicast, reserved, plus the IPv4-mapped and DNS64 spellings of the same target) are a hard red line no setting can open |
+| `TM_WEB_CACHE_TTL_SEC` | `300` | how long a governed fetch may re-serve the same URL (0 = off). One store shared by tm_webfetch / tm_search; entries are hash-named (a token-bearing query never hits disk) and are only read or written for hops the STATIC allowlist admitted — dialog consent stays per-request, and a re-served page says 缓存命中 |
 | `TM_SEARCH_WEIGHTS` | unset | per-engine fusion weight overrides, e.g. `bing=0.3,hn=0.25`; anything unset keeps the built-in table |
 | `TM_SEARCH_RELEVANCE_FLOOR` | `0.35` | weight fraction kept by a hit that shares no query token with its title/snippet/host (demotes junk without deleting an engine) |
 | `TM_SEARCH_MAX_HITS` | `10` | hits kept per engine leg and in the fused list |
 | `TM_SEARCH_DISABLED_ENGINES` | unset | engines removed from the roster AND from every `auto` route (`sogou,baidu` style) |
 | `TM_BASH_TIMEOUT_PROBE_MS` | `60000` | ceiling forced onto a `timeout` the model set for a read-only probe command (0 disables) |
+| `TM_PRUNE` | `on` | `off` stops context pruning entirely (settled message bodies stay in the request) |
+| `TM_PRUNE_AT_PERCENT` | `70` | prune once the request reaches this share of the model's window; derived from `limit.context`, never a fixed token count. **Clamped to 40–95** — a lower value is silently raised to 40, so a reproduction that sets 5 is really testing 40 |
+| `TM_PRUNE_KEEP_TAIL_PERCENT` | `40` | share of the window kept verbatim at the tail; the newest message is always kept |
+| `TM_RETRY` | `on` | `off` stops the retry governor (no backoff directive, no cooldown) |
+| `TM_RETRY_BASE_MS` | `5000` | first backoff after a quota/rate-limit error; doubles per consecutive error |
+| `TM_RETRY_MAX_MS` | `60000` | ceiling for that backoff |
+| `TM_RETRY_JITTER` | `0.3` | ± fraction applied to the wait, so parallel sessions do not re-fire together |
+| `TM_RETRY_BREAK_AFTER` | `5` | consecutive errors before the cooldown starts |
+| `TM_RETRY_COOLDOWN_MS` | `60000` | how long new sub-agent dispatches are refused once the breaker trips |
+| `TM_SPLIT_ADVICE` | `on` | `off` stops the split hint (the prompt discipline stays) |
+| `TM_SPLIT_BRIEF_TOKENS` | `4000` | a dispatch brief above this size earns a split hint on the next request. **Clamped to ≥200** — a lower value is silently raised, so a reproduction that sets 50 is really testing 200 |
+| `TM_SPLIT_MAX_CRITERIA` | `3` | the prompt's own rule: more acceptance criteria than this is a signal to split |
 | `TM_BASH_TIMEOUT_MAX_MS` | `0` | optional global ceiling for every other bash command — off by default so a real build keeps the timeout it asked for |
-| `TM_PTY_MAX` | `4` | concurrent `tm_pty` terminal sessions this plugin may keep running at once |
 | `TM_JOIN_MAX_WAIT_MS` | `60000` | ceiling on `tm_join { waitMs }`. Was 300 000, and a lead parked in it twice in a row (19 min of nothing) while its children worked — waiting is not parallelism, so the default now says "check, then work". A second consecutive wait after nothing settled is cut to 10 s and answered with what to do instead |
 | `TM_STORE_RECLAIM` | `on` | at boot, reclaim what an upgrade left behind: a per-workspace store shard idle past the TTL, and the pre-shard `blackboard/` + `trajectory/` under the temp-dir fallback (503 MB of expired runs on one real machine, with no sweeper pointed at them any more). Only TTL-expired entries are ever removed — a fresh run dir survives, because a session started before the upgrade may still be writing there. `off` leaves the disk exactly as found (the test runner sets it) |
 | `TM_TASK_OFFLOAD` | `on` | keep the HOST's background sub-agent inside the context budget: when `task { background: true }` finishes, the host injects the child's full reply into your session; this replaces an oversized body with a preview + a `tm_fetch`-style pointer (`tm_join { ids: [...] }`), touching ONLY synthetic parts that carry the host's own `<task id=… state="completed">` envelope and exceed the text offload threshold. Nothing is copied to disk — the text stays where it was written (the child session). `off` restores the host's verbatim injection. **On OpenCode 2.x this half does not apply**: a v2 plugin is never handed the injected message before it is persisted, and we deliberately do NOT rewrite outgoing messages (a wrong guess about that layer's shape deletes evidence silently — the v1 `experimental.chat.messages.transform` path is left unimplemented on purpose). The compensation there is contractual, not a rewrite: the child's oversized deliverable goes to the blackboard file and its reply carries the path, so the lead reads the summary and pulls the whole thing with `tm_join` |
@@ -668,19 +658,12 @@ for overrides, extra agents and disabling roles.
 | `TM_COMPACTION_AUTOCONTINUE` | `on` | `off` stops the host from silently resuming the turn after a compaction, so a human re-reads state first |
 | `TM_SHELL_NO_COLOR` | `on` | inject `NO_COLOR`/`TERM=dumb` into every child shell via `shell.env` (ANSI progress bars are pure context tax). Never overwrites a value the host already set |
 | `TM_SHELL_ENV` | — | explicit `KEY=VALUE;KEY2=VALUE2` passthrough into child shells — deliberately allowlisted, so this hook can't become a side channel for the parent environment |
-| `TM_BROWSER_USER_DATA_DIR` | — (isolated temp profile) | explicit persistent profile dir — the ONLY way logins survive between sessions, and honored by BOTH engines (playwright and cdp-legacy). Use a DEDICATED directory (e.g. `D:\tm-browser-profile`) and log in by hand the first time; pointing it at your browser's own data dir (`…\Microsoft\Edge\User Data`, `google-chrome`, Firefox `Profiles`) is refused before anything spawns, because that would have the agent browse as you while a force-kill reaper owns the process |
 | `TM_MEMORY_GLOBAL_DIR` | `~/.opencode-team/memories/global/` | tm_memory GLOBAL tier store |
 | `TM_MEMORY_SESSION_TTL_MIN` | `240` | session-tier entry TTL (lazy + boot sweep) |
 | `TM_MEMORY_MAX_ENTRIES` | `200` | per-scope entry cap; over it `add` fails on purpose — run `compact` |
 | `TM_MEMORY_STALE_DAYS` | `30` | age after which search hits are tagged `[stale Nd]` (`0` disables) |
 | `TM_MEMORY_SESSION_PERSIST` | — (ephemeral) | `1` also writes session entries under `memories/sessions/<sid>/` |
 | `TM_HIT_BLACKLIST` | `maimai.cn` | extra domains never listed as search hits (comma/semicolon separated; same-name-different-site noise like 脉脉) |
-| `TM_PTC_MAX_PROGRAM_CHARS` | `4000` | PTC program source cap |
-| `TM_PTC_MAX_CALLS` | `20` | PTC per-run bridge-call budget (1–200) |
-| `TM_PTC_MAX_ERRORS` | `3` | PTC per-run error budget (1–50) |
-| `TM_PTC_TIMEOUT_MS` | `60000` | PTC per-run wall-clock timeout (5s–10min) |
-| `TM_PTC_ENGINE` | `auto` | `auto` (worker→inline degrade) / `worker` / `inline` |
-| `TM_PTC_WEB_BRIDGE` | `on` | expose `tm.search` / `tm.webfetch` to PTC programs (`off` removes them from the bridge set) |
 
 ---
 
@@ -745,15 +728,27 @@ not the rule: a deliverable over ~50 lines goes to ONE named board file under
 
 **Disable one:** `"researcher": { "disable": true }`.
 
-**Board retention** via the tuple form: `["@te-river/opencode-team-mode@latest", { "ttlDays": 7 }]` (valid range (0, 365], invalid values fall back to 5).
+**Board retention** via the plugin entry's `options`:
+
+```jsonc
+{
+  "plugins": [
+    { "package": "@te-river/opencode-team-mode@latest", "options": { "ttlDays": 7 } }
+  ]
+}
+```
+
+Valid range (0, 365], invalid values fall back to 5. Measured 2026-10-06: with this shape the
+boot row reads `board_ttl_days=9` for `ttlDays: 9`. (The 1.x tuple form is rejected on 2.x:
+`path=$.plugins.1 kind=invalid`.)
 
 ---
 
 ## ❓ FAQ
 
 **Will this eat my tokens?**
-The opposite is the point. Offload + 80-token previews + PTC batch programs
-exist because a five-agent pipeline naively bolted onto one context window
+The opposite is the point. Offload + 80-token previews + the host's Code Mode
+`execute` exist because a five-agent pipeline naively bolted onto one context window
 *would* eat your tokens. The governance is the token-saver.
 
 **Is the web access safe?**
@@ -779,8 +774,9 @@ here fails the test suite before it ever reaches you.
 
 **Does it work in the CLI (TUI), or only Desktop?**
 Both. Desktop adds the color-coded picker and panels; the governed tools and
-the whole workflow are host-agnostic. On display-less Linux, `tm_browser`
-runs headless automatically.
+the whole workflow are host-agnostic. Interactive browsing is the host's own
+`browser_*` catalog, so a host with no native browser (CLI / standalone) has
+none — the agent reports that gap rather than simulating one.
 
 **What happens if I don't answer a confirmation dialog?**
 It auto-rejects after `TM_ASK_TIMEOUT_MIN` (default 1). The plugin never
@@ -790,7 +786,7 @@ self-approves — the only side it can take is yours or nobody's.
 
 ## 🗑️ Uninstall
 
-1. Remove the entry from the `"plugin"` array in your config file — **`"plugins"` (plural) on OpenCode 2.x**, which is also where the 2.x installers write; if you installed on 2.x, delete the generated `~/.config/opencode/agents/*.md` and `commands/team-*.md` too, and any `default_agent: "team"` you no longer want.
+1. Remove the entry from the `"plugins"` array in your config file; if you installed on 2.x, delete the generated `~/.config/opencode/agents/*.md` and `commands/team-*.md` too, and any `default_agent: "Team"` you no longer want.
 2. Delete the cache dir (table in [Install](#-read-this-once-save-yourself-an-hour-later)) if you want the disk space back.
 3. Restart OpenCode. The agents, commands and tools are gone; the stores under `<repo>/.git/opencode-team/` (and `~/.opencode-team/` for global memories) are plain files you can delete whenever.
 
@@ -803,28 +799,28 @@ No DLLs were harmed. Nothing was written to your working tree.
 ```
 opencode-team-mode/
 ├── src/
-│   ├── index.ts          ← Plugin entry (config + R6 guard + approval gate + tool segment)
+│   ├── index.ts          ← Plugin entry ({id, setup} — v2 only)
 │   ├── agents.ts         ← Agent structure (modes, colors, temperatures, whitelist matrix)
 │   ├── prompts/          ← Agent prompts (lead / specialists / shared) — pinned by tests
 │   ├── commands.ts       ← Slash command definitions
 │   ├── blackboard.ts     ← Shared blackboard + TTL sweeper
 │   ├── envprotect.ts     ← R6 facade (patterns / classifiers / gate predicates / hook)
-│   ├── approval-gate.ts  ← Unified approval gate (dialog timeout auto-reject)
+│   ├── identity.ts       ← Agent-name identity (case-insensitive lead match)
 │   ├── tm/               ← Governed tools: pipelines / store / preview / guard / refs /
-│   │                        webfetch / search / memory / browser / shell-bridge / ptc/ (9 modules)
-│   └── types.ts          ← Loader-contract types (1.18.x)
-├── docs/installation.md  ← The agent-consumable install guide (1.18.x)
+│   │                        webfetch / search / memory / browser / shell-bridge / board / ledger
+│   ├── host/             ← v2 personality (setup / guard / offload / session / events / …)
+│   └── types.ts          ← Loader-contract types
+├── docs/installation.md  ← Historical 1.18.x guide (no longer supported)
 ├── docs/installation-v2.md ← The 2.x install guide (roles arrive as generated config files)
 ├── scripts/              ← One-line installers (bash / PowerShell)
 ├── pt07/                 ← PT-07 baseline suite (seeded A/B token measurement)
 └── README.*.md           ← You are here (twice)
 ```
 
-The loader calls `server(input, options)` once: the `config` hook injects the
-six agents and six commands, the same call installs the R6
-`tool.execute.before` guard, arms the approval gate through an `event` hook,
-and registers the `tm_*` tools. User-defined agents with the same name always
-win — the plugin never clobbers.
+The loader calls `setup(ctx)` once: it registers the `tm_*` tools, installs the
+R6/address guard on `permission.evaluate`, attaches the JIT offload on
+`tool.execute.after`, and publishes the blackboard note. User-defined agents with
+the same name always win — the plugin never clobbers.
 
 ---
 
@@ -846,8 +842,8 @@ are intentionally loose but not psychic).
 ## 🔗 Links
 
 - [npm Package](https://www.npmjs.com/package/@te-river/opencode-team-mode) — `@te-river/opencode-team-mode`
-- [Installation guide, 1.18.x](./docs/installation.md) — the complete manual / agent-consumable procedure
-- [Installation guide, **OpenCode 2.x**](./docs/installation-v2.md) — a different install: a 2.x plugin cannot create an agent, so the six roles and six commands are generated into the config directory
+- [Installation guide, **OpenCode 2.x**](./docs/installation-v2.md) — the supported install: a 2.x plugin cannot create an agent, so the six roles and six commands are generated into the config directory
+- [Installation guide, 1.18.x](./docs/installation.md) — **historical only**: the 1.18.x personality was removed in the 1.7.0 line, so this page is kept for reference and is not a working install path
 - [OpenCode Desktop](https://opencode.ai) — Official website & download
 - [OpenCode Docs](https://opencode.ai/docs) — Configuration & plugin documentation
 - [OpenCode Plugin API](https://opencode.ai/docs/plugins) — Build your own plugins