akm-cli 0.10.261013-beta → 0.10.261014-beta

package/dist/integrations/harnesses/opencode/roots.js

@@ -0,0 +1,50 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Where the user's OpenCode keeps its files: the XDG base directories on every
+ * platform (OpenCode's own `global-roots` does not special-case macOS or
+ * Windows), each with an `opencode` folder. The one place akm computes them.
+ */
+import os from "node:os";
+import path from "node:path";
+import { getDataDir } from "../../../core/paths.js";
+function xdgRoot(name, fallback, env) {
+    const set = env[name]?.trim();
+    if (set)
+        return path.join(set, "opencode");
+    const home = env.HOME?.trim() || env.USERPROFILE?.trim() || os.homedir();
+    return path.join(home, ...fallback, "opencode");
+}
+/** `$XDG_DATA_HOME/opencode`: the user's `opencode.db`. */
+function opencodeDataDir(env = process.env) {
+    return xdgRoot("XDG_DATA_HOME", [".local", "share"], env);
+}
+/** `$XDG_CACHE_HOME/opencode`: the plugin packages it installed. */
+export function opencodeCacheDir(env = process.env) {
+    return xdgRoot("XDG_CACHE_HOME", [".cache"], env);
+}
+/** `$OPENCODE_CONFIG_DIR`, else `$XDG_CONFIG_HOME/opencode`: `opencode.json`, agents and plugins. */
+export function opencodeConfigDir(env = process.env) {
+    return env.OPENCODE_CONFIG_DIR?.trim() || xdgRoot("XDG_CONFIG_HOME", [".config"], env);
+}
+/** OpenCode's SQLite session store, in OpenCode's data directory and in akm's. */
+export function databaseIn(directory) {
+    return path.join(directory, "opencode.db");
+}
+/**
+ * Everything akm's own OpenCode runtime keeps, under akm's data directory: the
+ * four XDG roots it is started with (`config`, `data`, `cache`, `state`) and its
+ * `tmp`. Nothing of the user's OpenCode is in it.
+ */
+export function akmRuntimeDir() {
+    return path.join(getDataDir(), "opencode-runtime");
+}
+/** The user's OpenCode database. */
+export function opencodeDatabasePath(env = process.env) {
+    return databaseIn(opencodeDataDir(env));
+}
+/** Where akm's own runtime keeps its sessions: the `opencode/opencode.db` OpenCode makes under the runtime's `XDG_DATA_HOME`. */
+export function akmOpencodeDatabasePath() {
+    return databaseIn(path.join(akmRuntimeDir(), "data", "opencode"));
+}

package/dist/integrations/harnesses/opencode/runtime/binary.js

@@ -0,0 +1,206 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The OpenCode binary akm's own agent runtime runs, fetched on first use.
+ *
+ * OpenCode 2 is published as a prebuilt binary on npm: `@opencode/cli`, whose
+ * platform packages each hold one executable. akm does not depend on that
+ * package: the package manager would install every platform package that matches
+ * the OS and CPU (four, for Linux x64, about 900 MB), because none of them
+ * declares its libc or CPU features. akm fetches the one that matches this
+ * machine from the npm registry the first time its runtime is used, checks it
+ * against the registry's integrity hash, and keeps the executable under
+ * `<akm cache dir>/opencode/<version>/`. Package selection mirrors the
+ * `postinstall.mjs` of `@opencode/cli`.
+ */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fetchWithRetry, isRecord, toErrorMessage } from "../../../../core/common.js";
+import { getCacheDir } from "../../../../core/paths.js";
+import { info } from "../../../../core/warn.js";
+import { writeResponseToFileCapped } from "../../../../runtime.js";
+import { extractTarGzMember } from "./tar.js";
+/**
+ * The OpenCode release akm's own runtime runs. It is pinned because the runtime depends on things no OpenCode release
+ * promises: the inline config's shape, the `--standalone` flag, the plugin API, the text `run` prints, and the
+ * `opencode.db` tables that `../session-log-v2.ts` reads. To move it, change this version and `PACKAGES` if the release
+ * adds or drops a platform package, then run `tests/integration/opencode-runtime-sessions.test.ts` against the new
+ * binary (it fetches it) and read `docs/reference/configuration.md` ("Without a harness") for what the version changes.
+ */
+export const OPENCODE_RUNTIME_VERSION = "2.1.4";
+const REGISTRY = "https://registry.npmjs.org";
+/** The platform packages of `@opencode/cli` at {@link OPENCODE_RUNTIME_VERSION}. */
+const PACKAGES = new Set([
+    "@opencode/cli-linux-x64",
+    "@opencode/cli-linux-x64-baseline",
+    "@opencode/cli-linux-x64-musl",
+    "@opencode/cli-linux-x64-baseline-musl",
+    "@opencode/cli-linux-arm64",
+    "@opencode/cli-linux-arm64-musl",
+    "@opencode/cli-darwin-x64",
+    "@opencode/cli-darwin-x64-baseline",
+    "@opencode/cli-darwin-arm64",
+    "@opencode/cli-windows-x64",
+    "@opencode/cli-windows-x64-baseline",
+    "@opencode/cli-windows-arm64",
+]);
+/** The package for a machine: `@opencode/cli-<platform>-<arch>`, with `-baseline` for an x64 CPU without AVX2 and `-musl` for musl. */
+export function opencodePackage({ platform, arch, musl, avx2 }) {
+    const name = [
+        `@opencode/cli-${platform}-${arch}`,
+        ...(arch === "x64" && !avx2 ? ["baseline"] : []),
+        ...(platform === "linux" && musl ? ["musl"] : []),
+    ].join("-");
+    if (!PACKAGES.has(name)) {
+        throw new Error(`OpenCode ${OPENCODE_RUNTIME_VERSION} publishes no binary for ${platform} ${arch} (${name}).`);
+    }
+    return name;
+}
+function run(command, args, timeout) {
+    return spawnSync(command, args, { encoding: "utf8", timeout, windowsHide: true });
+}
+const AVX2_WINDOWS_PROBE = '(Add-Type -MemberDefinition "[DllImport(""kernel32.dll"")] public static extern bool IsProcessorFeaturePresent(int ProcessorFeature);" -Name Kernel32 -Namespace Win32 -PassThru)::IsProcessorFeaturePresent(40)';
+/** Whether an x64 CPU has AVX2, asked the way OpenCode's own installer asks it. */
+function hasAvx2(platform) {
+    try {
+        if (platform === "linux")
+            return /(^|\s)avx2(\s|$)/i.test(fs.readFileSync("/proc/cpuinfo", "utf8"));
+        if (platform === "darwin") {
+            const probe = run("sysctl", ["-n", "hw.optional.avx2_0"], 1500);
+            return probe.status === 0 && probe.stdout.trim() === "1";
+        }
+        for (const shell of ["powershell.exe", "pwsh.exe", "pwsh", "powershell"]) {
+            const probe = run(shell, ["-NoProfile", "-NonInteractive", "-Command", AVX2_WINDOWS_PROBE], 3000);
+            if (probe.status !== 0)
+                continue;
+            const answer = probe.stdout.trim().toLowerCase();
+            if (answer === "true" || answer === "1")
+                return true;
+            if (answer === "false" || answer === "0")
+                return false;
+        }
+    }
+    catch {
+        // Not knowing is the baseline build, which runs everywhere.
+    }
+    return false;
+}
+/** Whether this Linux uses musl libc. */
+function isMusl() {
+    if (fs.existsSync("/etc/alpine-release"))
+        return true;
+    const probe = run("ldd", ["--version"], 5000);
+    return `${probe.stdout ?? ""}${probe.stderr ?? ""}`.toLowerCase().includes("musl");
+}
+/** This machine, as the package choice sees it. */
+export function detectHost(env = process.env, operatingSystem = process.platform, processArch = process.arch) {
+    const platform = { darwin: "darwin", linux: "linux", win32: "windows" }[operatingSystem];
+    const nodeArch = { x64: "x64", arm64: "arm64" }[processArch];
+    if (!platform || !nodeArch)
+        throw new Error(`OpenCode publishes no binary for ${operatingSystem} ${processArch}.`);
+    // An x64 process on Windows for ARM still names the host CPU in PROCESSOR_IDENTIFIER, and the arm64 build is the one to run.
+    const arch = platform === "windows" && nodeArch === "x64" && env.PROCESSOR_IDENTIFIER?.startsWith("ARM") ? "arm64" : nodeArch;
+    return { platform, arch, musl: platform === "linux" && isMusl(), avx2: arch === "x64" && hasAvx2(platform) };
+}
+/** Where the OpenCode binary is kept once fetched. */
+export function runtimeBinaryPath(platform = process.platform) {
+    return path.join(getCacheDir(), "opencode", OPENCODE_RUNTIME_VERSION, platform === "win32" ? "opencode.exe" : "opencode");
+}
+/** The `sha512-<base64>` integrity npm records for a tarball. */
+function sha512Integrity(file) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha512");
+        fs.createReadStream(file)
+            .on("data", (chunk) => hash.update(chunk))
+            .on("error", reject)
+            .on("end", () => resolve(`sha512-${hash.digest("base64")}`));
+    });
+}
+/** Throws unless the tarball at `file` has the integrity the registry lists for it. */
+export async function verifyIntegrity(file, expected) {
+    const listed = expected.split(/\s+/).filter((integrity) => integrity.startsWith("sha512-"));
+    if (listed.length === 0)
+        throw new Error(`the registry lists no sha512 integrity for it (${expected || "none"})`);
+    const actual = await sha512Integrity(file);
+    if (!listed.includes(actual))
+        throw new Error(`its sha512 integrity is ${actual}, not the ${listed.join(" or ")} the registry lists`);
+}
+async function registryDocument(url) {
+    const response = await fetchWithRetry(url, { headers: { accept: "application/json" } }, { timeout: 30_000 });
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error(`the registry answered HTTP ${response.status}`);
+    }
+    const dist = (await response.json()).dist;
+    if (!isRecord(dist) || typeof dist.tarball !== "string" || typeof dist.integrity !== "string") {
+        throw new Error("the registry document has no dist.tarball and dist.integrity");
+    }
+    return { tarball: dist.tarball, integrity: dist.integrity };
+}
+/**
+ * Fetch the binary of the package `name` into `binary`: the registry document of that one package, its tarball, the
+ * integrity check before anything is extracted, then the executable by temp file and rename. Two akm processes fetching
+ * at once both finish: a rename that loses to the other leaves the file the other made.
+ */
+async function fetchBinary(name, binary) {
+    const directory = path.dirname(binary);
+    fs.mkdirSync(directory, { recursive: true });
+    const download = path.join(directory, `.download-${process.pid}.tgz`);
+    const partial = path.join(directory, `.opencode-${process.pid}.tmp`);
+    try {
+        const { tarball, integrity } = await registryDocument(`${REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION}`);
+        info(`Fetching OpenCode ${OPENCODE_RUNTIME_VERSION} for akm's own agent runtime (about 114 MB, once) into ${directory}.`);
+        const response = await fetchWithRetry(tarball, undefined, { timeout: 60_000 });
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`${tarball} answered HTTP ${response.status}`);
+        }
+        // No overall deadline for a 114 MB file on a slow link: only 60 s without bytes fails it.
+        await writeResponseToFileCapped(download, response, { stallTimeoutMs: 60_000 });
+        await verifyIntegrity(download, integrity);
+        const size = await extractTarGzMember(download, `package/bin/${path.basename(binary)}`, partial);
+        fs.chmodSync(partial, 0o755);
+        try {
+            fs.renameSync(partial, binary);
+        }
+        catch (error) {
+            // Where an open executable cannot be replaced, the other process's file stands.
+            if (!fs.existsSync(binary) || fs.statSync(binary).size !== size)
+                throw error;
+        }
+    }
+    finally {
+        fs.rmSync(download, { force: true });
+        fs.rmSync(partial, { force: true });
+    }
+}
+/** Fetch the binary for this machine, naming the package, its URL and the cache path when it cannot. */
+async function fetchForThisMachine(binary) {
+    let name = "an @opencode/cli platform package";
+    try {
+        name = opencodePackage(detectHost());
+        await fetchBinary(name, binary);
+        return binary;
+    }
+    catch (error) {
+        throw new Error(`Could not fetch OpenCode ${OPENCODE_RUNTIME_VERSION}, which akm's own agent runtime runs: package ${name} from ${REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION} into ${path.dirname(binary)}: ${toErrorMessage(error)}. ` +
+            "Without network access for this step, enable the opencode harness with an installed OpenCode 2 instead (see docs/reference/configuration.md).");
+    }
+}
+let fetching;
+/**
+ * The path of the OpenCode binary akm's runtime runs, fetched first if it is not in the cache. A process fetches once,
+ * however many runs ask meanwhile.
+ */
+export function ensureRuntimeBinary() {
+    const binary = runtimeBinaryPath();
+    if (fs.existsSync(binary))
+        return Promise.resolve(binary);
+    fetching ??= fetchForThisMachine(binary).finally(() => {
+        fetching = undefined;
+    });
+    return fetching;
+}

package/dist/integrations/harnesses/opencode/runtime/command.js

@@ -0,0 +1,152 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The OpenCode 2 process akm's own runtime starts for one run, built the way the
+ * opencode harness builds model work on the user's OpenCode 2
+ * (`../agent-builder.ts`): `run --standalone --title akm`, the prompt on stdin,
+ * the inline config in `OPENCODE_CONFIG_CONTENT`. What differs is that the
+ * process is akm's own, so akm sets what a user's OpenCode keeps for itself:
+ *
+ *   - **The connection is the only provider.** `@ai-sdk/openai-compatible` (which
+ *     the binary bundles) at the connection's endpoint, with its key, and the one
+ *     model the run was dispatched with, with the context window and output cap the
+ *     connection states. The key is not in the config: the config names a 0600
+ *     file under akm's runtime directory that holds it (`{file:…}`), so no process
+ *     environment holds the key.
+ *   - **akm's roots.** OpenCode's config, data, cache and state directories and its
+ *     temp directory are akm's (`../roots.ts`), so nothing of the user's OpenCode
+ *     is read or written and the sessions land where akm's reader looks. The
+ *     inherited `OPENCODE_*` variables are dropped for the same reason.
+ *   - **Nothing from outside.** No hosted free models and no model catalog fetch
+ *     (a run with no usable provider fails instead of sending its prompt to
+ *     OpenCode's service), no project config (`AGENTS.md`, `opencode.json`) and no
+ *     Claude Code files (`~/.claude/skills`).
+ *   - **The resume sweep is off** because `--standalone` keeps the run to one
+ *     process that ends with it and replays nobody's killed sessions.
+ *   - **The agent's commands do not see any of this.** The plugin puts the
+ *     variables this module sets back to what akm runs in, or removes them, in the
+ *     environment of the commands the agent runs: they get the user's directories,
+ *     not the runtime's, and no OpenCode setting of akm's (an `opencode` they run
+ *     would otherwise load akm's provider and its key file).
+ *
+ * The run is OpenCode's default agent (or the native agent the request names) with
+ * its normal tools, akm's three read tools and the connection's request fields
+ * from the plugin (`../../../../assets/opencode/akm-plugin.js`).
+ */
+import path from "node:path";
+import { openAiBaseUrl } from "../../../../core/endpoint-url.js";
+import { effectiveRequestFields } from "../../../../core/llm-inference.js";
+/** The provider the connection is declared as; a process runs one connection, so the name is fixed. */
+const PROVIDER = "akm";
+const positiveInteger = (value) => typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
+/**
+ * A path as a `{file:…}` reference. OpenCode replaces the reference in the config's text before it parses it, so the
+ * path is read with the text's JSON escapes in it (measured on 2.1.4: a path holding a backslash or a quote is not
+ * found, and the request goes out with no key). Windows takes forward slashes, so its paths are written with them.
+ */
+function fileReference(file) {
+    return process.platform === "win32" ? file.replaceAll("\\", "/") : file;
+}
+/** What OpenCode assumes of a model that states no limit. It refuses a model whose limit states only one of the two. */
+const DEFAULT_LIMIT = { context: 200_000, output: 32_000 };
+/**
+ * The inline OpenCode config of a run. `keyFile` is where the connection's key is written for the run, when it has
+ * one. `ambient` is the environment the process is started over: the plugin gives the commands the agent runs these
+ * values back for the variables the run sets, and removes them where there is none.
+ */
+export function runtimeConfig(connection, pluginDirectory, keyFile, ambient = {}) {
+    const requestFields = effectiveRequestFields(connection.request, connection.inference);
+    const context = positiveInteger(connection.contextLength);
+    const output = positiveInteger(requestFields.max_tokens);
+    const limit = context === undefined && output === undefined
+        ? undefined
+        : { context: context ?? DEFAULT_LIMIT.context, output: output ?? DEFAULT_LIMIT.output };
+    return {
+        plugins: [
+            {
+                package: pluginDirectory,
+                options: {
+                    requestFields,
+                    shellEnv: Object.fromEntries(RUNTIME_VARIABLES.map((name) => [name, ambient[name] ?? null])),
+                },
+            },
+        ],
+        provider: {
+            [PROVIDER]: {
+                npm: "@ai-sdk/openai-compatible",
+                name: PROVIDER,
+                options: {
+                    baseURL: openAiBaseUrl(connection.endpoint),
+                    ...(connection.apiKey ? { apiKey: `{file:${fileReference(keyFile)}}` } : {}),
+                },
+                models: {
+                    [connection.model]: {
+                        name: connection.model,
+                        ...(limit ? { limit } : {}),
+                    },
+                },
+            },
+        },
+    };
+}
+/**
+ * The variables {@link runtimeEnv} sets that the commands the agent runs must not see as set: the runtime's roots (a
+ * command would read and write akm's directories instead of the user's) and akm's OpenCode settings (an `opencode` a
+ * command runs would load akm's provider and its key file). `AKM_OPENCODE_CLI`, between akm and its plugin, is
+ * harmless to a command and is left.
+ */
+const RUNTIME_VARIABLES = [
+    "XDG_CONFIG_HOME",
+    "XDG_DATA_HOME",
+    "XDG_CACHE_HOME",
+    "XDG_STATE_HOME",
+    "TMPDIR",
+    "OPENCODE_DISABLE_FREE_MODELS",
+    "OPENCODE_DISABLE_MODELS_FETCH",
+    "OPENCODE_DISABLE_PROJECT_CONFIG",
+    "OPENCODE_DISABLE_CLAUDE_CODE",
+    "OPENCODE_CONFIG_CONTENT",
+];
+/** What a run sets in the process's environment, over the one akm and the caller give every child. */
+export function runtimeEnv(config, where) {
+    const at = (...parts) => path.join(where.directory, ...parts);
+    return {
+        XDG_CONFIG_HOME: at("config"),
+        XDG_DATA_HOME: at("data"),
+        XDG_CACHE_HOME: at("cache"),
+        XDG_STATE_HOME: at("state"),
+        TMPDIR: at("tmp"),
+        OPENCODE_DISABLE_FREE_MODELS: "1",
+        OPENCODE_DISABLE_MODELS_FETCH: "1",
+        OPENCODE_DISABLE_PROJECT_CONFIG: "1",
+        OPENCODE_DISABLE_CLAUDE_CODE: "1",
+        OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
+        AKM_OPENCODE_CLI: JSON.stringify(where.akm),
+    };
+}
+/**
+ * A command that makes and migrates OpenCode's database and does nothing else (it lists the sessions, with no model and
+ * no background service), for the first start of a database.
+ */
+export function runtimePrepareArgv(binary) {
+    return [binary, "session", "list", "--standalone"];
+}
+/**
+ * The command line of a run; the prompt is not on it, it goes on stdin. `session` is the id the run's session is made
+ * with (`--session` makes a session of that id when none has it), so akm finds the session the run left.
+ */
+export function runtimeArgv(connection, dispatch, binary, session) {
+    return [
+        binary,
+        "run",
+        "--standalone",
+        "--title",
+        "akm",
+        "--session",
+        session,
+        ...(dispatch.agent ? ["--agent", dispatch.agent] : []),
+        "--model",
+        `${PROVIDER}/${connection.model}`,
+    ];
+}

package/dist/integrations/harnesses/opencode/runtime/index.js

@@ -0,0 +1,177 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * akm's own agent runtime: a pinned OpenCode 2 binary run as a process over a
+ * connection (`./command.ts`), for agent work when no harness is enabled. It is
+ * what the application's port (`integrations/agent/runtime-port.ts`) asks for.
+ *
+ * The binary is fetched on first use (`./binary.ts`). Each run is its own process,
+ * run through the same spawn path as a harness's, so the deadline, the caller's
+ * signal and the capture of its output are the ones every agent run has. The
+ * process keeps nothing between runs but akm's runtime directory, where its
+ * sessions are (`../roots.ts`); nothing here reads config.
+ */
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import akmPlugin from "../../../../assets/opencode/akm-plugin.js" with { type: "text" };
+import { toErrorMessage, writeFileAtomic } from "../../../../core/common.js";
+import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync, } from "../../../../core/file-lock.js";
+import { PORTABLE_INFERENCE_KEYS } from "../../../../core/llm-inference.js";
+import { openDatabase } from "../../../../storage/database.js";
+import { resolveAkmInvocation } from "../../../../tasks/resolve-akm-bin.js";
+import { buildChildEnv, runBuiltCommand, } from "../../../agent/spawn.js";
+import { akmOpencodeDatabasePath, akmRuntimeDir } from "../roots.js";
+import { v2SessionTokens } from "../session-log-v2.js";
+import { ensureRuntimeBinary, OPENCODE_RUNTIME_VERSION } from "./binary.js";
+import { runtimeArgv, runtimeConfig, runtimeEnv, runtimePrepareArgv } from "./command.js";
+/**
+ * What a request is lowered for when it runs here. The persona goes in the prompt, as for the opencode harness
+ * (`opencode run` has no system prompt flag); every portable setting is carried, as request fields the plugin lays over
+ * the model requests.
+ */
+const runtimeLowerer = {
+    id: "akm-runtime",
+    systemPrompt: false,
+    nativeAgent: true,
+    // Model work on a connection is a chat call (`buildExecution`), so no run here is confined; if one were lowered here, say so.
+    confinable: false,
+    inference: PORTABLE_INFERENCE_KEYS,
+};
+/** How long preparing the database may take: it is a few milliseconds of work and a process start. */
+const PREPARE_TIMEOUT_MS = 60_000;
+/** The connection's key, for the one run that reads it, kept as `credentials.json` is: 0600, in a 0700 directory. */
+function writeKeyFile(file, key) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    writeFileAtomic(file, key, 0o600);
+}
+/** Write the plugin where OpenCode loads it from (a directory, whose `index.mjs` is the module), when it is not already there. */
+function installPlugin(directory) {
+    const pluginDirectory = path.join(directory, "config", "akm-plugin");
+    const file = path.join(pluginDirectory, "index.mjs");
+    if (!fs.existsSync(file) || fs.readFileSync(file, "utf8") !== akmPlugin) {
+        fs.mkdirSync(pluginDirectory, { recursive: true });
+        const partial = `${file}.${process.pid}.tmp`;
+        fs.writeFileSync(partial, akmPlugin);
+        fs.renameSync(partial, file);
+    }
+    return pluginDirectory;
+}
+/**
+ * OpenCode makes and migrates its database when a process starts, and two processes doing that to one database break
+ * each other (one fails with "Standalone server exited before reporting readiness"; on 2.1.4 two runs started together
+ * on a fresh directory lose one of them every time). So the first start of this OpenCode version is a preparing run of
+ * its own, under a lock file in the runtime directory that every run, of this akm process or another, waits on, and it
+ * leaves a marker naming the version; a run that finds the marker and the database starts at once. A dead holder's
+ * lock is reclaimed. The run itself reports anything the preparation does not.
+ */
+async function prepareDatabase(directory, command, opts) {
+    const marker = path.join(directory, `prepared-${OPENCODE_RUNTIME_VERSION}`);
+    const lock = path.join(directory, "prepare.lock");
+    const prepared = () => fs.existsSync(marker) && fs.existsSync(akmOpencodeDatabasePath());
+    const deadline = Date.now() + PREPARE_TIMEOUT_MS;
+    while (!prepared() && !opts.signal?.aborted) {
+        const ownership = tryAcquireLockSync(lock, createLockPayload());
+        if (ownership) {
+            try {
+                if (prepared())
+                    return;
+                const result = await runBuiltCommand("akm's runtime preparing its database", command, {
+                    ...(opts.cwd ? { cwd: opts.cwd } : {}),
+                    ...(opts.signal ? { signal: opts.signal } : {}),
+                    timeoutMs: PREPARE_TIMEOUT_MS,
+                });
+                if (result.ok)
+                    fs.writeFileSync(marker, "");
+                return;
+            }
+            finally {
+                releaseLock(ownership);
+            }
+        }
+        const probe = probeLock(lock);
+        if (probe.state === "stale" && reclaimStaleLock(lock, probe))
+            continue;
+        if (Date.now() >= deadline) {
+            throw new Error(`Another akm process is still preparing the database of akm's runtime (lock ${lock}).`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+}
+/**
+ * The run's session as OpenCode recorded it, read once the process has ended: its id and the tokens its turn used,
+ * which a workflow's `budget.max_tokens` and the unit journal count. Nothing when the run made no session. Accounting
+ * is best-effort: a database that cannot be read leaves the run's result as it is.
+ */
+function sessionRecord(sessionId) {
+    try {
+        const db = openDatabase(akmOpencodeDatabasePath(), { readonly: true, create: false });
+        try {
+            const tokens = v2SessionTokens(db, sessionId);
+            if (!tokens)
+                return {};
+            return {
+                sessionId,
+                usage: { inputTokens: tokens.input, outputTokens: tokens.output, reasoningTokens: tokens.reasoning },
+            };
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        return {};
+    }
+}
+export const opencodeRuntime = {
+    lowering: runtimeLowerer,
+    async run(profile, opts, connection) {
+        const label = `akm's runtime on connection "${profile.name}"`;
+        const dispatch = opts.dispatch;
+        if (dispatch?.prompt === undefined)
+            throw new TypeError("A run on akm's runtime is given a prompt.");
+        const start = Date.now();
+        try {
+            const binary = await ensureRuntimeBinary();
+            const directory = akmRuntimeDir();
+            for (const name of ["config", "data", "cache", "state", "tmp"]) {
+                fs.mkdirSync(path.join(directory, name), { recursive: true });
+            }
+            const where = {
+                binary,
+                directory,
+                pluginDirectory: installPlugin(directory),
+                akm: resolveAkmInvocation().argv,
+            };
+            // The user's own OPENCODE_* variables configure their OpenCode, not this one.
+            const ambient = Object.fromEntries(Object.entries(buildChildEnv(opts)).filter(([name]) => !name.startsWith("OPENCODE_")));
+            // OpenCode's own ids start with `ses_`, which it requires of one it is given.
+            const session = `ses_akm${randomUUID().replaceAll("-", "")}`;
+            const keyFile = path.join(directory, "keys", session);
+            const config = runtimeConfig(connection, where.pluginDirectory, keyFile, ambient);
+            const env = { ...ambient, ...runtimeEnv(config, where) };
+            try {
+                if (connection.apiKey)
+                    writeKeyFile(keyFile, connection.apiKey);
+                await prepareDatabase(directory, { argv: runtimePrepareArgv(binary), env }, opts);
+                const result = await runBuiltCommand(label, { argv: runtimeArgv(connection, dispatch, binary, session), env, stdin: dispatch.prompt }, opts, "captured");
+                return { ...result, ...sessionRecord(session) };
+            }
+            finally {
+                fs.rmSync(keyFile, { force: true });
+            }
+        }
+        catch (error) {
+            return {
+                ok: false,
+                exitCode: null,
+                stdout: "",
+                stderr: toErrorMessage(error),
+                durationMs: Date.now() - start,
+                reason: "spawn_failed",
+                error: toErrorMessage(error),
+            };
+        }
+    },
+};