@veris-ai/daytona-opencode 0.1.0

package/.opencode/plugin/daytona/tools/veris-receipt.js

@@ -0,0 +1,76 @@
+/**
+ * Copyright Veris AI
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The eleventh tool, and the only one this fork adds.
+ *
+ * Every other tool tells the agent what its own code did. This one tells it
+ * what the VENDOR received — read from the twin, not from the sandbox — which
+ * is the only way to tell a real integration from a plausible-looking one. An
+ * agent that says "I called the Stripe API and it worked" and an agent that
+ * fabricated the response produce identical transcripts; they produce different
+ * receipts.
+ */
+import { z } from 'zod';
+import { isVerisSandbox } from '@veris-ai/daytona';
+export const verisReceiptTool = (sessionManager, projectId, worktree, pluginCtx) => ({
+    description: 'Read the Veris receipt: what the vendor twin ACTUALLY received from this sandbox. ' +
+        'Use it after any change that is supposed to reach an external API, and before ' +
+        'reporting that the change works. A green run with an empty receipt means the code ' +
+        'never reached the dependency — the two are indistinguishable from inside the sandbox. ' +
+        'Pass a service name to see that service alone.',
+    args: {
+        service: z
+            .string()
+            .optional()
+            .describe('Service name (e.g. "stripe"). Omit for every service on the twin.'),
+    },
+    async execute(args, ctx) {
+        const sandbox = await sessionManager.getSandbox(ctx.sessionID, projectId, worktree, pluginCtx);
+        // Without this OpenCode renders the call as "verisReceipt Unknown".
+        const title = (t) => ctx.metadata({ title: t });
+        if (!isVerisSandbox(sandbox)) {
+            title('no twin attached');
+            return ('No Veris twin is attached to this sandbox, so there is no receipt to read.\n' +
+                'Set VERIS_API_KEY and VERIS_ENVIRONMENT_ID and start a new session to get one.');
+        }
+        if (args.service) {
+            const entry = await sandbox.veris.receipt(args.service);
+            title(`${args.service}: ${entry.requests} request(s)`);
+            if (entry.requests === 0) {
+                return (`Receipt for '${args.service}': ZERO requests.\n\n` +
+                    `The twin was reachable and answered nothing — the code under test never called it. ` +
+                    `Do not report this change as working.`);
+            }
+            const lines = entry.entries
+                .slice(0, 50)
+                .map((r) => `  ${r.method} ${r.path} -> ${r.status ?? 'no response (fault)'}`);
+            return (`Receipt for '${args.service}': ${entry.requests} request(s).\n` +
+                `${lines.join('\n')}${entry.entries.length > 50 ? `\n  … ${entry.entries.length - 50} more` : ''}`);
+        }
+        const receipt = await sandbox.veris.receipt();
+        const names = Object.keys(receipt.services);
+        const total = names.reduce((n, k) => n + (receipt.services[k]?.requests ?? 0), 0);
+        title(`${total} request(s) across ${names.length} service(s)`);
+        const header = `Veris receipt — twin ${sandbox.verisSandboxId}\n` +
+            `  interception: ${receipt.mode}   integrity: ${receipt.integrity}\n` +
+            (receipt.leaks.length ? `  blind spots: ${receipt.leaks.join(', ')}\n` : '');
+        if (total === 0) {
+            return (header +
+                `\nZERO requests reached the twin, across ${names.length || 'no'} service(s).\n\n` +
+                `Whatever just ran did not touch its external dependencies. If you were asked to ` +
+                `make an integration work, it does not work yet — say so rather than reporting success.`);
+        }
+        const body = names
+            .map((name) => {
+            const e = receipt.services[name];
+            const calls = e.entries
+                .slice(0, 20)
+                .map((r) => `    ${r.method} ${r.path} -> ${r.status ?? 'no response (fault)'}`);
+            return `  ${name}: ${e.requests} request(s)\n${calls.join('\n')}`;
+        })
+            .join('\n');
+        return `${header}\n${total} request(s) reached the twin:\n${body}`;
+    },
+});
+//# sourceMappingURL=veris-receipt.js.map

package/.opencode/plugin/daytona/tools/veris-receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"veris-receipt.js","sourceRoot":"","sources":["veris-receipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGlD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,cAAqC,EACrC,SAAiB,EACjB,QAAgB,EAChB,SAAsB,EACtB,EAAE,CAAC,CAAC;IACJ,WAAW,EACT,oFAAoF;QACpF,gFAAgF;QAChF,oFAAoF;QACpF,wFAAwF;QACxF,gDAAgD;IAClD,IAAI,EAAE;QACJ,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,mEAAmE,CAAC;KACjF;IACD,KAAK,CAAC,OAAO,CAAC,IAA0B,EAAE,GAAgB;QACxD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAE9F,oEAAoE;QACpE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;QAEvD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACzB,OAAO,CACL,8EAA8E;gBAC9E,gFAAgF,CACjF,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACvD,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,aAAa,CAAC,CAAA;YACtD,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CACL,gBAAgB,IAAI,CAAC,OAAO,uBAAuB;oBACnD,qFAAqF;oBACrF,uCAAuC,CACxC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO;iBACxB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC,CAAA;YAChF,OAAO,CACL,gBAAgB,IAAI,CAAC,OAAO,MAAM,KAAK,CAAC,QAAQ,gBAAgB;gBAChE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnG,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACjF,KAAK,CAAC,GAAG,KAAK,sBAAsB,KAAK,CAAC,MAAM,aAAa,CAAC,CAAA;QAE9D,MAAM,MAAM,GACV,wBAAwB,OAAO,CAAC,cAAc,IAAI;YAClD,mBAAmB,OAAO,CAAC,IAAI,iBAAiB,OAAO,CAAC,SAAS,IAAI;YACrE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAE9E,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,CACL,MAAM;gBACN,4CAA4C,KAAK,CAAC,MAAM,IAAI,IAAI,kBAAkB;gBAClF,kFAAkF;gBAClF,wFAAwF,CACzF,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,KAAK;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAA;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO;iBACpB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC,CAAA;YAClF,OAAO,KAAK,IAAI,KAAK,CAAC,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QACnE,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QAEb,OAAO,GAAG,MAAM,KAAK,KAAK,kCAAkC,IAAI,EAAE,CAAA;IACpE,CAAC;CACF,CAAC,CAAA"}

package/.opencode/plugin/daytona/tools/veris-receipt.ts

@@ -0,0 +1,103 @@
+/**
+ * Copyright Veris AI
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The eleventh tool, and the only one this fork adds.
+ *
+ * Every other tool tells the agent what its own code did. This one tells it
+ * what the VENDOR received — read from the twin, not from the sandbox — which
+ * is the only way to tell a real integration from a plausible-looking one. An
+ * agent that says "I called the Stripe API and it worked" and an agent that
+ * fabricated the response produce identical transcripts; they produce different
+ * receipts.
+ */
+
+import { z } from 'zod'
+import type { PluginInput } from '@opencode-ai/plugin'
+import type { ToolContext } from '@opencode-ai/plugin/tool'
+import { isVerisSandbox } from '@veris-ai/daytona'
+import type { DaytonaSessionManager } from '../core/session-manager'
+
+export const verisReceiptTool = (
+  sessionManager: DaytonaSessionManager,
+  projectId: string,
+  worktree: string,
+  pluginCtx: PluginInput,
+) => ({
+  description:
+    'Read the Veris receipt: what the vendor twin ACTUALLY received from this sandbox. ' +
+    'Use it after any change that is supposed to reach an external API, and before ' +
+    'reporting that the change works. A green run with an empty receipt means the code ' +
+    'never reached the dependency — the two are indistinguishable from inside the sandbox. ' +
+    'Pass a service name to see that service alone.',
+  args: {
+    service: z
+      .string()
+      .optional()
+      .describe('Service name (e.g. "stripe"). Omit for every service on the twin.'),
+  },
+  async execute(args: { service?: string }, ctx: ToolContext) {
+    const sandbox = await sessionManager.getSandbox(ctx.sessionID, projectId, worktree, pluginCtx)
+
+    // Without this OpenCode renders the call as "verisReceipt Unknown".
+    const title = (t: string) => ctx.metadata({ title: t })
+
+    if (!isVerisSandbox(sandbox)) {
+      title('no twin attached')
+      return (
+        'No Veris twin is attached to this sandbox, so there is no receipt to read.\n' +
+        'Set VERIS_API_KEY and VERIS_ENVIRONMENT_ID and start a new session to get one.'
+      )
+    }
+
+    if (args.service) {
+      const entry = await sandbox.veris.receipt(args.service)
+      title(`${args.service}: ${entry.requests} request(s)`)
+      if (entry.requests === 0) {
+        return (
+          `Receipt for '${args.service}': ZERO requests.\n\n` +
+          `The twin was reachable and answered nothing — the code under test never called it. ` +
+          `Do not report this change as working.`
+        )
+      }
+      const lines = entry.entries
+        .slice(0, 50)
+        .map((r) => `  ${r.method} ${r.path} -> ${r.status ?? 'no response (fault)'}`)
+      return (
+        `Receipt for '${args.service}': ${entry.requests} request(s).\n` +
+        `${lines.join('\n')}${entry.entries.length > 50 ? `\n  … ${entry.entries.length - 50} more` : ''}`
+      )
+    }
+
+    const receipt = await sandbox.veris.receipt()
+    const names = Object.keys(receipt.services)
+    const total = names.reduce((n, k) => n + (receipt.services[k]?.requests ?? 0), 0)
+    title(`${total} request(s) across ${names.length} service(s)`)
+
+    const header =
+      `Veris receipt — twin ${sandbox.verisSandboxId}\n` +
+      `  interception: ${receipt.mode}   integrity: ${receipt.integrity}\n` +
+      (receipt.leaks.length ? `  blind spots: ${receipt.leaks.join(', ')}\n` : '')
+
+    if (total === 0) {
+      return (
+        header +
+        `\nZERO requests reached the twin, across ${names.length || 'no'} service(s).\n\n` +
+        `Whatever just ran did not touch its external dependencies. If you were asked to ` +
+        `make an integration work, it does not work yet — say so rather than reporting success.`
+      )
+    }
+
+    const body = names
+      .map((name) => {
+        const e = receipt.services[name]!
+        const calls = e.entries
+          .slice(0, 20)
+          .map((r) => `    ${r.method} ${r.path} -> ${r.status ?? 'no response (fault)'}`)
+        return `  ${name}: ${e.requests} request(s)\n${calls.join('\n')}`
+      })
+      .join('\n')
+
+    return `${header}\n${total} request(s) reached the twin:\n${body}`
+  },
+})

package/.opencode/plugin/daytona/tools/write.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { z } from 'zod';
+import type { PluginInput } from '@opencode-ai/plugin';
+import type { ToolContext } from '@opencode-ai/plugin/tool';
+import type { DaytonaSessionManager } from '../core/session-manager';
+export declare const writeTool: (sessionManager: DaytonaSessionManager, projectId: string, worktree: string, pluginCtx: PluginInput) => {
+    description: string;
+    args: {
+        filePath: z.ZodString;
+        content: z.ZodString;
+    };
+    execute(args: {
+        filePath: string;
+        content: string;
+    }, ctx: ToolContext): Promise<string>;
+};

package/.opencode/plugin/daytona/tools/write.js

@@ -0,0 +1,18 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { z } from 'zod';
+export const writeTool = (sessionManager, projectId, worktree, pluginCtx) => ({
+    description: 'Writes content to file in Daytona sandbox',
+    args: {
+        filePath: z.string(),
+        content: z.string(),
+    },
+    async execute(args, ctx) {
+        const sandbox = await sessionManager.getSandbox(ctx.sessionID, projectId, worktree, pluginCtx);
+        await sandbox.fs.uploadFile(Buffer.from(args.content), args.filePath);
+        return `Written ${Buffer.byteLength(args.content, 'utf8')} bytes to ${args.filePath}`;
+    },
+});
+//# sourceMappingURL=write.js.map

package/.opencode/plugin/daytona/tools/write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.js","sourceRoot":"","sources":["write.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,cAAqC,EACrC,SAAiB,EACjB,QAAgB,EAChB,SAAsB,EACtB,EAAE,CAAC,CAAC;IACJ,WAAW,EAAE,2CAA2C;IACxD,IAAI,EAAE;QACJ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB;IACD,KAAK,CAAC,OAAO,CAAC,IAA2C,EAAE,GAAgB;QACzE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC9F,MAAM,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrE,OAAO,WAAW,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAA;IACvF,CAAC;CACF,CAAC,CAAA"}

package/.opencode/plugin/daytona/tools/write.ts

@@ -0,0 +1,27 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { z } from 'zod'
+import type { PluginInput } from '@opencode-ai/plugin'
+import type { ToolContext } from '@opencode-ai/plugin/tool'
+import type { DaytonaSessionManager } from '../core/session-manager'
+
+export const writeTool = (
+  sessionManager: DaytonaSessionManager,
+  projectId: string,
+  worktree: string,
+  pluginCtx: PluginInput,
+) => ({
+  description: 'Writes content to file in Daytona sandbox',
+  args: {
+    filePath: z.string(),
+    content: z.string(),
+  },
+  async execute(args: { filePath: string; content: string }, ctx: ToolContext) {
+    const sandbox = await sessionManager.getSandbox(ctx.sessionID, projectId, worktree, pluginCtx)
+    await sandbox.fs.uploadFile(Buffer.from(args.content), args.filePath)
+    return `Written ${Buffer.byteLength(args.content, 'utf8')} bytes to ${args.filePath}`
+  },
+})

package/.opencode/plugin/daytona/tools.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { DaytonaSessionManager } from './core/session-manager';
+import type { PluginInput } from '@opencode-ai/plugin';
+export declare function createDaytonaTools(sessionManager: DaytonaSessionManager, projectId: string, worktree: string, pluginCtx: PluginInput): {
+    bash: {
+        description: string;
+        args: {
+            command: import("zod").ZodString;
+            background: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        };
+        execute(args: {
+            command: string;
+            background?: boolean;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    read: {
+        description: string;
+        args: {
+            filePath: import("zod").ZodString;
+        };
+        execute(args: {
+            filePath: string;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    write: {
+        description: string;
+        args: {
+            filePath: import("zod").ZodString;
+            content: import("zod").ZodString;
+        };
+        execute(args: {
+            filePath: string;
+            content: string;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    edit: {
+        description: string;
+        args: {
+            filePath: import("zod").ZodString;
+            oldString: import("zod").ZodString;
+            newString: import("zod").ZodString;
+        };
+        execute(args: {
+            filePath: string;
+            oldString: string;
+            newString: string;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    multiedit: {
+        description: string;
+        args: {
+            filePath: import("zod").ZodString;
+            edits: import("zod").ZodArray<import("zod").ZodObject<{
+                oldString: import("zod").ZodString;
+                newString: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>>;
+        };
+        execute(args: {
+            filePath: string;
+            edits: Array<{
+                oldString: string;
+                newString: string;
+            }>;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    ls: {
+        description: string;
+        args: {
+            dirPath: import("zod").ZodOptional<import("zod").ZodString>;
+        };
+        execute(args: {
+            dirPath?: string;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    glob: {
+        description: string;
+        args: {
+            pattern: import("zod").ZodString;
+        };
+        execute(args: {
+            pattern: string;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    grep: {
+        description: string;
+        args: {
+            pattern: import("zod").ZodString;
+        };
+        execute(args: {
+            pattern: string;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    getPreviewURL: {
+        description: string;
+        args: {
+            port: import("zod").ZodNumber;
+        };
+        execute(args: {
+            port: number;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    gitSync: {
+        description: string;
+        args: {};
+        execute(_args: {}, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+    verisReceipt: {
+        description: string;
+        args: {
+            service: import("zod").ZodOptional<import("zod").ZodString>;
+        };
+        execute(args: {
+            service?: string;
+        }, ctx: import("@opencode-ai/plugin").ToolContext): Promise<string>;
+    };
+};

package/.opencode/plugin/daytona/tools.js

@@ -0,0 +1,35 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Tool implementations for Daytona sandbox integration
+ */
+import { bashTool } from './tools/bash';
+import { readTool } from './tools/read';
+import { writeTool } from './tools/write';
+import { editTool } from './tools/edit';
+import { multieditTool } from './tools/multiedit';
+import { lsTool } from './tools/ls';
+import { globTool } from './tools/glob';
+import { grepTool } from './tools/grep';
+import { getPreviewURLTool } from './tools/get-preview-url';
+import { gitSyncTool } from './tools/git-sync';
+import { verisReceiptTool } from './tools/veris-receipt';
+export function createDaytonaTools(sessionManager, projectId, worktree, pluginCtx) {
+    const repoPath = sessionManager.repoPath;
+    return {
+        bash: bashTool(sessionManager, projectId, worktree, pluginCtx, repoPath),
+        read: readTool(sessionManager, projectId, worktree, pluginCtx),
+        write: writeTool(sessionManager, projectId, worktree, pluginCtx),
+        edit: editTool(sessionManager, projectId, worktree, pluginCtx),
+        multiedit: multieditTool(sessionManager, projectId, worktree, pluginCtx),
+        ls: lsTool(sessionManager, projectId, worktree, pluginCtx),
+        glob: globTool(sessionManager, projectId, worktree, pluginCtx),
+        grep: grepTool(sessionManager, projectId, worktree, pluginCtx),
+        getPreviewURL: getPreviewURLTool(sessionManager, projectId, worktree, pluginCtx),
+        gitSync: gitSyncTool(sessionManager, projectId, worktree, pluginCtx),
+        verisReceipt: verisReceiptTool(sessionManager, projectId, worktree, pluginCtx),
+    };
+}
+//# sourceMappingURL=tools.js.map

package/.opencode/plugin/daytona/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAKxD,MAAM,UAAU,kBAAkB,CAChC,cAAqC,EACrC,SAAiB,EACjB,QAAgB,EAChB,SAAsB;IAEtB,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;IACxC,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;QACxE,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC9D,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QAChE,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC9D,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QACxE,EAAE,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC1D,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC9D,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC9D,aAAa,EAAE,iBAAiB,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QAChF,OAAO,EAAE,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QACpE,YAAY,EAAE,gBAAgB,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;KAC/E,CAAA;AACH,CAAC"}

package/.opencode/plugin/daytona/tools.ts

@@ -0,0 +1,45 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Tool implementations for Daytona sandbox integration
+ */
+
+import { bashTool } from './tools/bash'
+import { readTool } from './tools/read'
+import { writeTool } from './tools/write'
+import { editTool } from './tools/edit'
+import { multieditTool } from './tools/multiedit'
+import { lsTool } from './tools/ls'
+import { globTool } from './tools/glob'
+import { grepTool } from './tools/grep'
+import { getPreviewURLTool } from './tools/get-preview-url'
+import { gitSyncTool } from './tools/git-sync'
+import { verisReceiptTool } from './tools/veris-receipt'
+
+import type { DaytonaSessionManager } from './core/session-manager'
+import type { PluginInput } from '@opencode-ai/plugin'
+
+export function createDaytonaTools(
+  sessionManager: DaytonaSessionManager,
+  projectId: string,
+  worktree: string,
+  pluginCtx: PluginInput,
+) {
+  const repoPath = sessionManager.repoPath
+  return {
+    bash: bashTool(sessionManager, projectId, worktree, pluginCtx, repoPath),
+    read: readTool(sessionManager, projectId, worktree, pluginCtx),
+    write: writeTool(sessionManager, projectId, worktree, pluginCtx),
+    edit: editTool(sessionManager, projectId, worktree, pluginCtx),
+    multiedit: multieditTool(sessionManager, projectId, worktree, pluginCtx),
+    ls: lsTool(sessionManager, projectId, worktree, pluginCtx),
+    glob: globTool(sessionManager, projectId, worktree, pluginCtx),
+    grep: grepTool(sessionManager, projectId, worktree, pluginCtx),
+    getPreviewURL: getPreviewURLTool(sessionManager, projectId, worktree, pluginCtx),
+    gitSync: gitSyncTool(sessionManager, projectId, worktree, pluginCtx),
+    verisReceipt: verisReceiptTool(sessionManager, projectId, worktree, pluginCtx),
+  }
+}

package/.opencode/plugin/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Main entry point for the OpenCode Daytona plugin.
+ * Re-exports the default plugin from daytona.
+ */
+export { default } from './daytona/index';

package/.opencode/plugin/index.js

@@ -0,0 +1,10 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Main entry point for the OpenCode Daytona plugin.
+ * Re-exports the default plugin from daytona.
+ */
+export { default } from './daytona/index';
+//# sourceMappingURL=index.js.map

package/.opencode/plugin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA"}

package/.opencode/plugin/index.ts

@@ -0,0 +1,11 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Main entry point for the OpenCode Daytona plugin.
+ * Re-exports the default plugin from daytona.
+ */
+
+export { default } from './daytona/index'

package/README.md

@@ -0,0 +1,87 @@
+# @veris-ai/daytona-opencode
+
+An [OpenCode](https://opencode.ai) plugin. Every session runs in a
+[Daytona](https://daytona.io) sandbox whose calls to `api.stripe.com` and the
+rest of your vendor stack are answered by **Veris twins** — stateful,
+contract-accurate fakes — and the agent gets a tool that shows what the vendor
+actually received.
+
+## Install
+
+```jsonc
+// opencode.json
+{ "plugin": ["@veris-ai/daytona-opencode"] }
+```
+
+| variable | where from |
+|---|---|
+| `DAYTONA_API_KEY` | [app.daytona.io/dashboard/keys](https://app.daytona.io/dashboard/keys) |
+| `VERIS_API_KEY` | [studio.veris.ai](https://studio.veris.ai) |
+| `VERIS_ENVIRONMENT_ID` | a Veris environment — it decides which vendor services your twin gets |
+
+Then `opencode`. No image to build, no network configuration, nothing to start.
+
+## What the agent gets
+
+The ten sandbox-backed tools from [`@daytona/opencode`](https://www.npmjs.com/package/@daytona/opencode)
+— bash, read, write, edit, multiedit, ls, glob, grep, getPreviewURL, gitSync —
+plus one.
+
+**`verisReceipt`** reports what the twin *received*.
+
+```
+Veris receipt — twin sbx_a1b2c3
+  interception: gateway   integrity: verified
+
+1 request(s) reached the twin:
+  stripe: 1 request(s)
+    POST /v1/charges -> 200
+```
+
+This is the tool that separates a real integration from a plausible-looking one.
+Ask an agent to call the Stripe API and it will report success whether or not it
+made the call — the transcripts are identical. The receipts are not:
+
+```
+Receipt for 'stripe': ZERO requests.
+
+The twin was reachable and answered nothing — the code under test never called
+it. Do not report this change as working.
+```
+
+The system prompt tells the agent to check it before claiming an integration
+works. You can also just ask for it.
+
+## Why the sandbox cannot reach the real vendor
+
+The sandbox is created with a `domainAllowList` — the vendor hostnames the twin
+answers for, the Veris gateway, the twin's data planes, and package registries —
+and an `outboundProxyUrl` pointing at the gateway. Daytona drops anything not on
+the list and forwards the rest to the gateway, which answers vendor hostnames
+from the twin. `npm install` still works; `api.stripe.com` reaches your twin.
+
+Everything above happens inside `@veris-ai/daytona`, which this plugin uses in
+place of `@daytona/sdk`. See [its README](https://www.npmjs.com/package/@veris-ai/daytona)
+if you want the same thing without an agent.
+
+## Relationship to `@daytona/opencode`
+
+This is a fork of `@daytona/opencode` 0.192.0 (Apache-2.0, Copyright Daytona
+Platforms Inc.), and a deliberately small one: one changed import, one added
+tool, one paragraph in the system prompt, and a check that the Veris
+coordinates are set. The ten inherited tools, the git-sync flow and the session
+bookkeeping are untouched, so upstream changes stay easy to take.
+
+## Limitations
+
+- **Requires a Veris control plane that serves an HTTP CONNECT gateway.**
+  Without one, the first tool call fails saying exactly that.
+- **Git sync into the sandbox can fail with `Host key verification failed`.**
+  Inherited from upstream; the agent works, but local changes are not pushed
+  into the sandbox. Setting `DAYTONA_SSH_KNOWN_HOSTS` is the likely fix.
+- **QUIC/HTTP3 and ECH are not intercepted.** Both are reported in the receipt's
+  `leaks` rather than silently omitted.
+
+## License
+
+Apache-2.0. Source: [veris-ai/veris-daytona](https://github.com/veris-ai/veris-daytona).

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@veris-ai/daytona-opencode",
+  "version": "0.1.0",
+  "description": "Run every OpenCode session in a Daytona sandbox whose vendor API calls are answered by a Veris twin. One line in opencode.json: unmodified code, real hostnames, and a receipt of what the vendor actually received.",
+  "main": "./.opencode/plugin/index.js",
+  "types": "./.opencode/plugin/index.d.ts",
+  "files": [
+    ".opencode",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/veris-ai/veris-daytona.git",
+    "directory": "daytona-opencode"
+  },
+  "author": "Veris (https://veris.ai)",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/veris-ai/veris-daytona/issues"
+  },
+  "homepage": "https://github.com/veris-ai/veris-daytona/tree/main/daytona-opencode#readme",
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "veris",
+    "daytona",
+    "sandbox",
+    "integration-testing"
+  ],
+  "engines": {
+    "opencode": ">=1.16 <2"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@veris-ai/daytona": "^0.1.0",
+    "@daytona/sdk": "^0.204.1",
+    "@opencode-ai/plugin": "1.1.59",
+    "xdg-basedir": "^5.1.0",
+    "zod": "^4.2.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "^5.6.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}