@wenrwa/marketplace-cli 0.7.7 → 0.8.1

package/dist/bridge/screenshotAttach.js

@@ -0,0 +1,173 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.realScreenshotDeps = exports.SCREENSHOT_POLL_INTERVAL_MS = exports.SCREENSHOT_POLL_MS = void 0;
+exports.resolveScreenshotFolder = resolveScreenshotFolder;
+exports.isSafeScreenshotName = isSafeScreenshotName;
+exports.handleScreenshotFrame = handleScreenshotFrame;
+/**
+ * Screenshot drop — LOCAL bridge only.
+ *
+ * Dragging the macOS floating screenshot thumbnail onto a browser hands the
+ * page a File backed by a *file promise*: the browser cannot read its bytes
+ * (NotReadableError), and macOS writes the real PNG into the screenshot
+ * folder only after the drop. The browser still knows the file's NAME, so it
+ * sends `attach-screenshot {rid, sessionId, name}` and this module:
+ *
+ *   1. resolves the screenshot folder (`defaults read com.apple.screencapture
+ *      location`, `~` expanded; default ~/Desktop; non-macOS → not-supported),
+ *   2. accepts `name` only as a plain image basename (no separators, no `..`,
+ *      png/jpg/jpeg/gif/webp),
+ *   3. polls for `<folder>/<name>` for up to ~6s (a regular file, ≤ 10 MB,
+ *      whose bytes sniff as an image — a half-written file keeps polling),
+ *   4. saves it through the SAME writer as `attach-file` (attachmentWriter).
+ *
+ * Never wired into the relay client: a hosted container cannot see the
+ * user's Desktop, and must not be asked to read its own disk by name.
+ */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const attachmentWriter_1 = require("./attachmentWriter");
+exports.SCREENSHOT_POLL_MS = 6000;
+exports.SCREENSHOT_POLL_INTERVAL_MS = 250;
+const SCREENSHOT_EXTS = new Set(['png', 'jpg', 'jpeg', 'gif', 'webp']);
+exports.realScreenshotDeps = {
+    platform: process.platform,
+    homedir: () => os.homedir(),
+    readScreencaptureLocation: () => new Promise((resolve) => {
+        (0, child_process_1.execFile)('defaults', ['read', 'com.apple.screencapture', 'location'], { timeout: 2000 }, (err, stdout) => {
+            resolve(err ? null : String(stdout));
+        });
+    }),
+    stat: (p) => {
+        try {
+            const s = fs.lstatSync(p);
+            return { isFile: s.isFile(), size: s.size };
+        }
+        catch {
+            return null;
+        }
+    },
+    readFile: (p) => fs.readFileSync(p),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    now: () => Date.now(),
+    attachment: attachmentWriter_1.realAttachmentDeps,
+};
+/** `~` expansion + absolute check; anything odd falls back to ~/Desktop (macOS's own default). */
+function resolveScreenshotFolder(raw, home) {
+    const fallback = path.join(home, 'Desktop');
+    const v = (raw ?? '').trim();
+    if (!v)
+        return fallback;
+    let expanded = v;
+    if (v === '~')
+        expanded = home;
+    else if (v.startsWith('~/'))
+        expanded = path.join(home, v.slice(2));
+    if (!path.isAbsolute(expanded))
+        return fallback;
+    return path.normalize(expanded);
+}
+/** A plain image basename: no path separators, no traversal, no NUL, image extension. */
+function isSafeScreenshotName(name) {
+    if (typeof name !== 'string' || name.length === 0 || name.length > 255)
+        return false;
+    if (/[\\/\0]/.test(name))
+        return false;
+    if (name === '.' || name === '..' || name.includes('..'))
+        return false;
+    if (name.startsWith('.'))
+        return false;
+    const ext = /\.([A-Za-z0-9]+)$/.exec(name)?.[1]?.toLowerCase();
+    return !!ext && SCREENSHOT_EXTS.has(ext);
+}
+/** The `attach-screenshot` frame → `file-attached` reply. */
+async function handleScreenshotFrame(frame, sessions, deps = exports.realScreenshotDeps) {
+    const head = {
+        t: 'file-attached',
+        rid: frame.rid,
+        ...(typeof frame.sessionId === 'string' ? { sessionId: frame.sessionId } : {}),
+    };
+    const fail = (reason) => ({ ...head, ok: false, reason });
+    if (deps.platform !== 'darwin')
+        return fail('not-supported');
+    const root = (0, attachmentWriter_1.attachmentRootFor)(sessions, frame.sessionId);
+    if (!root)
+        return fail('no-session');
+    if (!isSafeScreenshotName(frame.name))
+        return fail('bad-name');
+    const name = frame.name;
+    try {
+        const folder = resolveScreenshotFolder(await deps.readScreencaptureLocation(), deps.homedir());
+        const file = path.join(folder, name);
+        // Belt and braces: the joined path must sit directly in the folder.
+        if (path.dirname(file) !== folder)
+            return fail('bad-name');
+        const deadline = deps.now() + exports.SCREENSHOT_POLL_MS;
+        let last = 'not-found';
+        for (;;) {
+            const st = deps.stat(file);
+            if (st && st.isFile) {
+                if (st.size > attachmentWriter_1.MAX_ATTACHMENT_BYTES)
+                    return fail('too-large');
+                if (st.size > 0) {
+                    const data = deps.readFile(file);
+                    if (data.length > attachmentWriter_1.MAX_ATTACHMENT_BYTES)
+                        return fail('too-large');
+                    if ((0, attachmentWriter_1.sniffImageExt)(data)) {
+                        const r = (0, attachmentWriter_1.writeAttachment)({ root, name, dataBase64: data.toString('base64') }, deps.attachment);
+                        return r.ok
+                            ? { ...head, ok: true, path: r.path, bytes: r.bytes, ...((0, attachmentWriter_1.pasteIfOpencode)(sessions, frame.sessionId, r.path) ? { pasted: true } : {}) }
+                            : fail(r.reason);
+                    }
+                    // Present but not (yet) an image — maybe still being written.
+                    last = 'not-image';
+                }
+            }
+            else if (st && !st.isFile) {
+                // A directory or symlink by that name is never a screenshot.
+                return fail('not-image');
+            }
+            if (deps.now() >= deadline)
+                return fail(last);
+            await deps.sleep(exports.SCREENSHOT_POLL_INTERVAL_MS);
+        }
+    }
+    catch {
+        return fail('error');
+    }
+}

package/dist/bridge/server.d.ts

@@ -9,10 +9,13 @@ import { WriteGitignoreResult } from './writeGitignore';
 import { LocalContextWriteResult } from './localContextWriter';
 import { GitRun } from './changesReporter';
 import { buildChangesReport as buildChangesReportReal } from './changesReport';
+import { ScreenshotDeps } from './screenshotAttach';
 export interface BridgeServerOpts {
     sessionToken: string;
     allowedOrigin: string;
     sessions: SessionManager;
+    /** Screenshot drop (`attach-screenshot`) seams — tests only; defaults to the real macOS/fs. */
+    screenshotDeps?: ScreenshotDeps;
     /** 0 (default) = ephemeral port. */
     port?: number;
     /** Workspace-scoped terminals: resolve a repo URL to a local checkout dir
@@ -226,6 +229,12 @@ export interface BridgeServerOpts {
      * bridge.ts) — see the 'open' handler's agentId branch.
      */
     hiveOpSettingsPath?: string;
+    /** oc-07 — resolved installed MCP server + API URL for local OpenCode agents (same as mcpRegister's). */
+    mcpServer?: {
+        command: string;
+        args: string[];
+    };
+    mcpApiUrl?: string;
     /**
      * rival-10 — every file touch of a LOCAL WORKSPACE AGENT (an `open` with
      * agentId + workspaceId), handed on for the ranked rival feed. The hook

package/dist/bridge/server.js

@@ -63,6 +63,7 @@ const sessionAnchor_1 = require("./sessionAnchor");
 // the SAME activity records fcct-24's tail already parses below.
 const sessionTouchTracker_1 = require("./sessionTouchTracker");
 const attachmentWriter_1 = require("./attachmentWriter");
+const screenshotAttach_1 = require("./screenshotAttach");
 const PROTOCOL_VERSION = 1;
 function send(ws, frame) {
     if (ws.readyState === ws_1.WebSocket.OPEN)
@@ -392,6 +393,8 @@ function startBridgeServer(opts) {
                     ...(opts.writeLocalFile ? ['local-file-write'] : []),
                     // Terminal attach — this bridge answers `attach-file` frames.
                     'terminal-attach',
+                    // Screenshot drop — answers `attach-screenshot` (macOS only).
+                    ...((opts.screenshotDeps ?? screenshotAttach_1.realScreenshotDeps).platform === 'darwin' ? ['attach-screenshot'] : []),
                 ],
             });
             return;
@@ -558,6 +561,8 @@ function startBridgeServer(opts) {
                         sessionId: rec.sessionId,
                         ...(rec.filePaths ? { filePaths: rec.filePaths } : {}),
                         ...(rec.thinking !== undefined ? { thinking: rec.thinking } : {}),
+                        // oc-22 — an OpenCode permission/question prompt; absent for everything else.
+                        ...(rec.kind ? { kind: rec.kind } : {}),
                     });
                 }
             },
@@ -730,6 +735,10 @@ function startBridgeServer(opts) {
                             // arena client actually asked to open.
                             const launch = (0, agentLaunch_1.resolveAgentLaunch)({
                                 autonomous: !!frame.autonomous,
+                                ...(frame.opencode ? { opencode: frame.opencode } : {}),
+                                ...(frame.connectToken ? { connectToken: frame.connectToken } : {}),
+                                ...(opts.mcpServer ? { mcpServer: opts.mcpServer } : {}),
+                                ...(opts.mcpApiUrl ? { apiUrl: opts.mcpApiUrl } : {}),
                                 ...(cwd ? { sessionPin: { agentId, exists: agentSessionExists } } : {}),
                                 ...(opts.activityFile && opts.hiveOpSettingsPath
                                     ? { activity: { settingsPath: opts.hiveOpSettingsPath, sessionId: agentId, activityFile: opts.activityFile } }
@@ -762,7 +771,9 @@ function startBridgeServer(opts) {
                                     send(ws, {
                                         t: 'data',
                                         sessionId,
-                                        data: '\r\n\x1b[31mclaude not found on PATH — install Claude Code CLI, then reopen this pane.\x1b[0m\r\n',
+                                        data: launch.command === 'opencode'
+                                            ? `\r\n\x1b[31m${(0, agentLaunch_1.missingCommandMessage)('opencode')}, then reopen this pane.\x1b[0m\r\n`
+                                            : '\r\n\x1b[31mclaude not found on PATH — install Claude Code CLI, then reopen this pane.\x1b[0m\r\n',
                                     });
                                 }).catch((err) => {
                                     console.error('[bridge] session attach failed:', err);
@@ -938,6 +949,13 @@ function startBridgeServer(opts) {
                         // input. Shared handler with relayClient.ts (both lanes).
                         send(ws, (0, attachmentWriter_1.handleAttachFrame)(frame, opts.sessions));
                         break;
+                    case 'attach-screenshot':
+                        // Local lane ONLY (never relayClient.ts): reads the user's macOS
+                        // screenshot folder by a validated basename, then the same writer.
+                        void (0, screenshotAttach_1.handleScreenshotFrame)(frame, opts.sessions, opts.screenshotDeps ?? screenshotAttach_1.realScreenshotDeps)
+                            .then((reply) => send(ws, reply))
+                            .catch(() => send(ws, { t: 'file-attached', rid: frame.rid, sessionId: frame.sessionId, ok: false, reason: 'error' }));
+                        break;
                     default:
                         send(ws, { t: 'error', message: 'unknown frame type' });
                 }

package/dist/bridge/sessionManager.d.ts

@@ -141,6 +141,11 @@ export declare class SessionManager {
      *  session or one opened without a resolved folder (a bare shell). Lets the
      *  attach path re-announce the root to a reattaching pane — see Session.cwd. */
     cwdOf(id: string): string | undefined;
+    /** oc-16 — the engine a live session was launched as (undefined: bare shell/unknown). */
+    engineOf(id: string): 'claude' | 'opencode' | undefined;
+    /** oc-16 — write straight to a live session's PTY, no pane attachment needed
+     *  (the `attach-file` frame is handled outside any attach handle). */
+    writeTo(id: string, data: string): boolean;
     /**
      * `id` (pucc-14): honor a caller-supplied session id instead of minting a
      * random one. In relay multiplex mode the RELAY owns the session id (it is the

package/dist/bridge/sessionManager.js

@@ -114,6 +114,19 @@ class SessionManager {
     cwdOf(id) {
         return this.sessions.get(id)?.cwd;
     }
+    /** oc-16 — the engine a live session was launched as (undefined: bare shell/unknown). */
+    engineOf(id) {
+        return this.sessions.get(id)?.engine;
+    }
+    /** oc-16 — write straight to a live session's PTY, no pane attachment needed
+     *  (the `attach-file` frame is handled outside any attach handle). */
+    writeTo(id, data) {
+        const s = this.sessions.get(id);
+        if (!s || s.exited)
+            return false;
+        s.pty.write(data);
+        return true;
+    }
     /**
      * `id` (pucc-14): honor a caller-supplied session id instead of minting a
      * random one. In relay multiplex mode the RELAY owns the session id (it is the
@@ -140,7 +153,13 @@ class SessionManager {
         const spawnOne = (size) => isClaude
             ? (0, launchSupervisor_1.superviseLaunch)(this.factory, { ...opts, ...size }, this.launchSupervisor)
             : this.factory.spawn({ ...opts, ...size });
-        const gated = this.launchGate && (isClaude || this.everyOpenIsAgentLaunch);
+        // oc-08 — an OpenCode launch is staggered like any agent launch, but is NOT
+        // supervised: launchSupervisor's retries are Claude Code wording
+        // ("Session ID ... already in use" / "No conversation found") and would
+        // never match OpenCode's output. OpenCode resumes by a captured id
+        // (`-s`), and a stale one surfaces as OpenCode's own error in the pane.
+        const isOpencode = opts.command === 'opencode';
+        const gated = this.launchGate && (isClaude || isOpencode || this.everyOpenIsAgentLaunch);
         const pty = gated
             ? this.launchGate.launch(spawnOne, { cols: opts.cols, rows: opts.rows })
             : spawnOne({ cols: opts.cols, rows: opts.rows });
@@ -154,6 +173,7 @@ class SessionManager {
             attachEpoch: 0,
             exited: false,
             cwd: opts.cwd,
+            engine: isOpencode ? 'opencode' : isClaude ? 'claude' : undefined,
         };
         pty.onData((data) => {
             // Single write path to the PTY itself is untouched (ADR-0028) — this is

package/dist/commands/bridge.js

@@ -74,6 +74,7 @@ const autostart_1 = require("../bridge/autostart");
 const repoCheckout_1 = require("../bridge/repoCheckout");
 const bundleInstaller_1 = require("../bridge/bundleInstaller");
 const agentLaunch_1 = require("../bridge/agentLaunch");
+const opencodeConfig_1 = require("../bridge/opencodeConfig");
 const contextWriter_1 = require("../bridge/contextWriter");
 const memoryBrief_1 = require("../bridge/memoryBrief");
 const containerFileRelay_1 = require("../bridge/containerFileRelay");
@@ -170,6 +171,20 @@ function bridgeApiUrl() {
 // RELAY_URL/RELAY_TOKEN env vars are the container-friendly fallback (the
 // image sets these instead of passing CLI flags), and a URL with no token
 // anywhere is a startup error rather than a confusing runtime failure.
+/**
+ * oc-08 — OpenCode is usable only if it is on PATH AND at least the minimum
+ * version oc-04 verified (the local lane runs the user's own install, which
+ * can be anything). Missing and too-old get the same install hint.
+ */
+function opencodeUsable() {
+    try {
+        const out = (0, child_process_1.execFileSync)('opencode', ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
+        return (0, opencodeConfig_1.opencodeVersionOk)(out);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * lws-06 / fcct-27 — is a binary on PATH? Best-effort and shared: the loopback
  * lane degrades to a shell + a red in-pane line when `claude` is missing, the
@@ -178,6 +193,8 @@ function bridgeApiUrl() {
  * this machine can run Claude Code.
  */
 function commandExistsOnPath(command) {
+    if (command === 'opencode')
+        return opencodeUsable();
     try {
         (0, child_process_1.execFileSync)(process.platform === 'win32' ? 'where' : 'command', process.platform === 'win32' ? [command] : ['-v', command], { stdio: 'ignore', shell: process.platform !== 'win32' });
         return true;
@@ -722,8 +739,8 @@ exports.bridgeCommand = new commander_1.Command('bridge')
             // workspace checkout under the same /data/repos/<workspaceId> root. Pure
             // file writes (path-safe + idempotent) — Claude Code orchestrates the
             // crew natively next run; the credits crewExecutionEngine is never called.
-            installBundle: ({ workspaceId, files }) => {
-                const result = (0, bundleInstaller_1.installBundle)({ workspaceId, files }, {
+            installBundle: ({ workspaceId, files, engine }) => {
+                const result = (0, bundleInstaller_1.installBundle)({ workspaceId, files, engine }, {
                     reposBaseDir,
                     mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
                     writeFile: (p, content) => fs.writeFileSync(p, content),
@@ -755,7 +772,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
               only sends one when the pilot has files selected, so most workspaces
               never got the pointers at all.
             */
-            refreshContextPointers: async ({ workspaceId }) => {
+            refreshContextPointers: async ({ workspaceId, engine }) => {
                 const memoryAvailable = Boolean(process.env.WENRWA_CONNECT_TOKEN);
                 // 2026-10-02 — the same reply says whether this is a MATCH workspace.
                 const briefInfo = memoryAvailable ? await (0, memoryBrief_1.fetchWorkspaceBrief)(workspaceId) : null;
@@ -763,6 +780,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                 const result = (0, contextWriter_1.writeContext)({
                     workspaceId,
                     pointersOnly: true,
+                    engine,
                     workGraphAvailable: Boolean(process.env.WENRWA_CONNECT_TOKEN),
                     memoryAvailable,
                     memoryBrief,
@@ -778,7 +796,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                     console.log(chalk_1.default.green(`✓ Context pointers ${result.action} → workspace ${workspaceId}`));
                 }
             },
-            writeContext: async ({ workspaceId, content }) => {
+            writeContext: async ({ workspaceId, content, engine }) => {
                 // wmr-03 — the workspace's memory brief, fetched at manifest time so
                 // the agent has it in context from its next turn. Never blocks the
                 // write: fetchWorkspaceBrief resolves null on any failure (PRD D2), and
@@ -791,6 +809,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                 const result = (0, contextWriter_1.writeContext)({
                     workspaceId,
                     content,
+                    engine,
                     // wgcp-01 — same gate as checkStorageQuota above: WENRWA_CONNECT_TOKEN
                     // is only injected at container boot when this workspace actually has
                     // MCP world-wiring (hosted-container.service.ts's machineEnv). Absent
@@ -809,7 +828,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                     writeFile: (p, c) => fs.writeFileSync(p, c),
                     mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
                 });
-                console.log(chalk_1.default.green(`✓ Context manifest ${result.action} → workspace ${workspaceId} (CLAUDE.md)`));
+                console.log(chalk_1.default.green(`✓ Context manifest ${result.action} → workspace ${workspaceId} (${path.posix.basename(result.claudeMdPath ?? 'CLAUDE.md')})`));
                 return { action: result.action, claudeMdPath: result.claudeMdPath };
             },
             // cve-06 (ADR-0047 / ADR-0032): read ONE file out of
@@ -844,7 +863,9 @@ exports.bridgeCommand = new commander_1.Command('bridge')
             // straight to the SAME pure claudeTranscriptReader.ts that derives
             // the path exactly as autolaunch.sh names it (psp-01: agentId ==
             // the .jsonl filename).
-            readTranscript: ({ workspaceId, agentId }) => (0, claudeTranscriptReader_1.readAgentTranscript)(reposBaseDir, workspaceId, agentId, {
+            readTranscript: ({ workspaceId, agentId, engine, opencodeSessionId }) => (0, claudeTranscriptReader_1.readAgentTranscript)(reposBaseDir, workspaceId, agentId, {
+                engine,
+                opencodeSessionId,
                 existsSync: (p) => fs.existsSync(p),
                 statSize: (p) => fs.statSync(p).size,
                 readFileUtf8: (p) => fs.readFileSync(p, 'utf-8'),
@@ -1066,6 +1087,8 @@ exports.bridgeCommand = new commander_1.Command('bridge')
         port: Number(opts.port),
         activityFile,
         hiveOpSettingsPath,
+        ...(mcpInstall.ok ? { mcpServer: { command: mcpInstall.command, args: mcpInstall.args } } : {}),
+        mcpApiUrl: bridgeApiUrl(),
         // tchp-18: the loopback changes reporter is opt-in; without this the
         // tchp-12 machinery never constructs on a laptop and local panels sit
         // on "Waiting for changes…" forever.
@@ -1288,8 +1311,12 @@ exports.bridgeCommand = new commander_1.Command('bridge')
             // opt-in consents to, and the consent copy says so; it does NOT change
             // what an ordinary local agent does (that still honours its own flag,
             // default off — ADR-0035).
-            resolveLaunch: ({ sessionId }) => (0, agentLaunch_1.resolveAgentLaunch)({
+            resolveLaunch: ({ sessionId, opencode, connectToken }) => (0, agentLaunch_1.resolveAgentLaunch)({
                 autonomous: true,
+                ...(opencode ? { opencode } : {}),
+                ...(connectToken ? { connectToken } : {}),
+                ...(mcpInstall.ok ? { mcpServer: { command: mcpInstall.command, args: mcpInstall.args } } : {}),
+                apiUrl: bridgeApiUrl(),
                 ...(activityFile && hiveOpSettingsPath && sessionId
                     ? { activity: { settingsPath: hiveOpSettingsPath, sessionId, activityFile } }
                     : {}),
@@ -1318,13 +1345,13 @@ exports.bridgeCommand = new commander_1.Command('bridge')
             // with no brief and no error anywhere. The local workspace's root comes
             // from the folder registry — no base dir can derive a folder the user
             // named themselves.
-            installBundle: ({ workspaceId, files }) => {
+            installBundle: ({ workspaceId, files, engine }) => {
                 const entry = (0, folderRegistry_1.findEntryByWorkspaceId)((0, folderRegistry_1.loadFolderRegistry)(), workspaceId);
                 if (!entry) {
                     console.error(chalk_1.default.red(`✗ Crew bundle for unknown local workspace ${workspaceId} — nothing written`));
                     return { written: [], skipped: [] };
                 }
-                const result = (0, bundleInstaller_1.installBundle)({ workspaceId, files }, {
+                const result = (0, bundleInstaller_1.installBundle)({ workspaceId, files, engine }, {
                     reposBaseDir: '',
                     workspaceRoot: entry.path,
                     mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),

package/hooks/opencode-plugin.mjs

@@ -0,0 +1,186 @@
+// HiveOp OpenCode activity plugin (oc-06). Self-contained ESM: no imports beyond node:*.
+// Writes the SAME JSONL lines as the Claude Code hooks (hooks/post-tool-use.js, stop.js)
+// to $HIVEOP_ACTIVITY_FILE, which the bridge already tails. Copies of this file live in
+// infra/terminal-image/opencode/ (hosted) and cli/hooks/ (local); a test keeps them identical.
+//
+// Event -> line:
+//   tool.execute.before / .after   -> kind 'tool'  (working, thinking "<Verb> <file>")
+//   session.idle, session.status idle -> kind 'stop' (idle, thinking '')
+//   permission.asked, question.asked  -> kind 'needs_you' (thinking 'Waiting for you')
+//   permission.replied                -> kind 'tool', tool '' (working, thinking 'Working')
+//   session.updated (primary session, real title) -> OSC 0 pane title (oc-17), written to /dev/tty
+//     because OpenCode's own title ("OpenCode" / "OC | <title>") is switched off by the launch
+//     (OPENCODE_DISABLE_TERMINAL_TITLE=1): the app's auto-title ingestion shows the title verbatim.
+// No-op without HIVEOP_ACTIVITY_FILE and WENRWA_SESSION_ID; nothing ever throws into OpenCode.
+// ONLY plugin functions may be exported: OpenCode loads every export as a plugin, and a helper
+// export breaks every prompt (Plugin.trigger reads hooks off its return value).
+import fs from 'node:fs'
+import path from 'node:path'
+
+// OpenCode tool ids -> the Claude Code names the bridge/touch tracker already understand.
+const TOOL_NAME = {
+  read: 'Read', edit: 'Edit', write: 'Write', patch: 'MultiEdit', multiedit: 'MultiEdit', bash: 'Bash',
+}
+const FILE_TOOLS = new Set(['Read', 'Edit', 'Write', 'Update', 'Create', 'MultiEdit', 'NotebookEdit'])
+const VERB = {
+  Read: 'Reading', Edit: 'Editing', Write: 'Writing', Update: 'Updating',
+  Create: 'Creating', MultiEdit: 'Editing', NotebookEdit: 'Editing', Bash: 'Running',
+}
+const MAX_BASH_PATHS = 5
+
+// Same algorithm as hooks/post-tool-use.js extractBashPaths (kept in step by a parity test).
+function extractBashPaths(command, pathExists, cwd) {
+  if (!command || typeof command !== 'string') return []
+  const tokens = command.match(/"[^"]*"|'[^']*'|[^\s;|&()<>]+/g) || []
+  const root = (cwd || '').replace(/\/+$/, '')
+  const out = []
+  const seen = new Set()
+  const bare = (s) => s.replace(/^['"]|['"]$/g, '').replace(/[),;]+$/, '')
+  for (let i = 1; i < tokens.length; i++) {
+    const prev = bare(tokens[i - 1])
+    if (prev === 'cd' || prev === 'pushd') continue
+    const t = bare(tokens[i])
+    if (!t || t.startsWith('-')) continue
+    const norm = t.replace(/\/+$/, '')
+    if (!norm || seen.has(norm)) continue
+    if (norm === '.' || (root && norm === root)) continue
+    let ok = false
+    try { ok = !!pathExists(t) } catch { ok = false }
+    if (!ok) continue
+    seen.add(norm)
+    out.push(t)
+    if (out.length >= MAX_BASH_PATHS) break
+  }
+  return out
+}
+
+const exists = (p) => { try { return fs.existsSync(p) } catch { return false } }
+
+/** Build the 'tool' record fields for an OpenCode tool call. */
+function toolRecord(toolId, args) {
+  const tool = typeof toolId === 'string' ? (TOOL_NAME[toolId.toLowerCase()] || toolId) : ''
+  const a = args && typeof args === 'object' ? args : {}
+  const paths = []
+  for (const k of ['filePath', 'file_path', 'notebook_path']) if (typeof a[k] === 'string') paths.push(a[k])
+  const filePaths = FILE_TOOLS.has(tool)
+    ? paths.filter((p, i) => p && paths.indexOf(p) === i)
+    : tool === 'Bash' ? extractBashPaths(a.command, exists, process.cwd()) : []
+  const base = filePaths.length ? String(filePaths[0]).split('/').pop() : ''
+  return { kind: 'tool', tool, filePaths, thinking: (VERB[tool] || 'Working') + (base ? ' ' + base : '') }
+}
+
+function append(extra, env) {
+  try {
+    const file = env.HIVEOP_ACTIVITY_FILE
+    const sessionId = env.WENRWA_SESSION_ID || ''
+    if (!file || !sessionId) return
+    fs.mkdirSync(path.dirname(file), { recursive: true })
+    fs.appendFileSync(file, JSON.stringify({ sessionId, workspaceId: env.WENRWA_WORKSPACE_ID || '', ...extra }) + '\n')
+  } catch {}
+}
+
+// OpenCode's placeholder titles until the title generator runs ("New session - <iso>").
+const DEFAULT_TITLE = /^(New session|Child session) - \d{4}-\d{2}-\d{2}T/
+const MAX_TITLE = 80
+
+/** oc-17: the OSC 0 sequence for a session.updated event's info, or '' (sub-agent, placeholder, empty). */
+function titleSequence(info) {
+  if (!info || info.parentID || typeof info.title !== 'string') return ''
+  const t = info.title.replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').replace(/\s+/g, ' ').trim()
+  if (!t || DEFAULT_TITLE.test(t)) return ''
+  return '\x1b]0;' + (t.length > MAX_TITLE ? t.slice(0, MAX_TITLE - 1) + '\u2026' : t) + '\x07'
+}
+
+let lastTitle = ''
+function setPaneTitle(info, ttyPath = '/dev/tty') {
+  try {
+    const seq = titleSequence(info)
+    if (!seq || seq === lastTitle) return
+    const fd = fs.openSync(ttyPath, 'a')
+    try { fs.writeSync(fd, seq) } finally { fs.closeSync(fd) }
+    lastTitle = seq
+  } catch {}
+}
+
+let reportedToGateway = ''
+
+/**
+ * oc-05 (hosted): POST the primary session's id to $HIVEOP_GATEWAY_URL/hiveop/session, authenticated
+ * by the per-agent gateway token (it already identifies the agent). Best-effort: one retry, never
+ * throws, no-op without gateway env. Last one wins server-side, so a fresh session after a
+ * "Session not found" fallback replaces the dead id.
+ */
+async function reportSessionToGateway(id, env = process.env) {
+  try {
+    const base = String(env.HIVEOP_GATEWAY_URL || '').replace(/\/+$/, '')
+    const token = env.HIVEOP_GATEWAY_TOKEN || ''
+    if (!id || !base || !token || id === reportedToGateway) return
+    reportedToGateway = id // claimed up front so a burst of events posts once; released on failure
+    for (let attempt = 0; attempt < 2; attempt++) {
+      try {
+        const res = await fetch(`${base}/hiveop/session`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+          body: JSON.stringify({ sessionId: id }),
+          signal: AbortSignal.timeout(5000),
+        })
+        if (res.ok) return
+        if (res.status < 500) break
+      } catch {}
+      await new Promise((r) => setTimeout(r, 1500))
+    }
+    if (reportedToGateway === id) reportedToGateway = ''
+  } catch {}
+}
+
+/**
+ * oc-05 hook point: capture the generated id of an agent's PRIMARY session so the next launch
+ * can `opencode -s <id>`. Sub-agent sessions (info.parentID) never overwrite it.
+ * Local lane: first id is written to a file under HIVEOP_OPENCODE_SESSIONS_DIR (keyed by agent).
+ * Hosted lane: the id is POSTed to the gateway (see reportSessionToGateway).
+ */
+function captureSessionId(event, env = process.env) {
+  try {
+    const p = (event && event.properties) || {}
+    if (!event || event.type !== 'session.created' || (p.info && p.info.parentID)) return
+    const id = p.sessionID || (p.info && p.info.id) || ''
+    void reportSessionToGateway(id, env)
+    const agentId = env.WENRWA_AGENT_ID || ''
+    if (!agentId) return
+    const dir = env.HIVEOP_OPENCODE_SESSIONS_DIR || '/data/.hiveop/opencode-sessions'
+    fs.mkdirSync(dir, { recursive: true })
+    const f = path.join(dir, agentId)
+    if (!fs.existsSync(f)) fs.writeFileSync(f, id)
+  } catch {}
+}
+
+export const HiveOp = async () => {
+  const env = process.env
+  let lastKind = ''
+  const emit = (extra) => {
+    // session.status idle and session.idle both fire per turn end: write one stop line.
+    if (extra.kind === 'stop' && lastKind === 'stop') return
+    lastKind = extra.kind
+    append({ ...extra, ...(extra.kind === 'stop' ? { thinking: '' } : {}) }, env)
+  }
+  return {
+    event: async ({ event }) => {
+      try {
+        if (!event) return
+        const p = event.properties || {}
+        if (event.type === 'session.created') captureSessionId(event, env)
+        else if (event.type === 'session.updated') setPaneTitle(p.info, env.HIVEOP_TITLE_TTY || '/dev/tty')
+        else if (event.type === 'session.idle') emit({ kind: 'stop' })
+        else if (event.type === 'session.status' && p.status && p.status.type === 'idle') emit({ kind: 'stop' })
+        else if (event.type === 'permission.asked' || event.type === 'question.asked') emit({ kind: 'needs_you', thinking: 'Waiting for you' })
+        else if (event.type === 'permission.replied') emit({ kind: 'tool', tool: '', filePaths: [], thinking: 'Working' })
+      } catch {}
+    },
+    'tool.execute.before': async (input, output) => {
+      try { emit(toolRecord(input && input.tool, (output && output.args) || (input && input.args))) } catch {}
+    },
+    'tool.execute.after': async (input, output) => {
+      try { emit(toolRecord(input && input.tool, (input && input.args) || (output && output.args))) } catch {}
+    },
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.7.7",
+  "version": "0.8.1",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",