carthagent 1.1.0-beta.2 → 1.1.0-beta.4

package/docs/release-notes-beta.3.md

@@ -0,0 +1,47 @@
+# Carthagent 1.1.0-beta.3 — release candidate
+
+This candidate makes continuation failures actionable. Publication is pending;
+these notes do not establish npm availability.
+
+## Continue the existing task
+
+- An exhausted persistent execution budget now reports the reason and recovery
+  command instead of an unexplained interrupt.
+- `--reset-budget` explicitly authorizes a fresh budget for a resumed session:
+
+  ```sh
+  ctg --print --continue --reset-budget "Continue the task"
+  ```
+
+- Ordinary continuation and payment preserve the execution budget, including
+  elapsed idle time. Billing credit is separate. Interactive users can run
+  `/delivery-budget-reset` before continuing the existing task.
+- CLI help consistently names Carthagent Cloud and documents `billing refresh`.
+
+## Acceptance evidence
+
+The source fix passed 1,132 tests with five skips, builds and lint. PR #242 CI
+passed Linux, macOS and Windows, browser and installed-package gates. One macOS
+22 service-stop identity timeout passed on retry; the separate push run passed.
+
+The authorized existing Cloud account completed a real range-fix task. The same
+session, profile and installed beta.2 runtime then continued with the source
+launcher and explicit reset, adding a regression and passing all five project
+tests independently. Final beta.3 installed acceptance remains required.
+
+Backend PRs #180–181 are deployed: automatic payment-status checks, clearer
+sign-in and refund guidance, direct Builder review, modern Stripe compatibility
+and accurate scheduled-cancellation dates while retaining paid access.
+Sandbox purchases, prorated upgrades, initial and upgrade SCA, declined-upgrade
+recovery, renewal, failed renewal, automatic refunds and disputes were exercised
+separately. These do not establish a single
+useful-task → payment boundary → same-task continuation journey: the model task
+used existing production credit and payments used an isolated sandbox backend.
+
+## Release channel
+
+Targets npm `next`; stable `latest` remains 1.0.7. Runtime prebuild
+[41537249365](https://github.com/B-icy/Carthagent/actions/runs/41537249365) uses
+reviewed source `c11103f8b57c6b3254473a78d535a404bea9a84a` and the unchanged
+combined-v5 runtime recipe. Final assets and manifest must pass immutable draft
+acceptance before publication.

package/docs/release-notes-beta.4.md

@@ -0,0 +1,18 @@
+# Carthagent 1.1.0-beta.4
+
+## Cloud-first onboarding
+
+- Fresh home shows **Continue with Carthagent Cloud** and explains sign-in and eligible starter credit.
+- `/login` opens Cloud authorization directly. `/connect` opens the provider picker with Cloud first under Recommended.
+- Terminal `ctg login` accepts Enter to choose its recommended Cloud default.
+
+## Continuing useful tasks
+
+- An explicit model selection when resuming a headless session now changes that session's model before continuing.
+- Headless observation allows at least 30 minutes instead of interrupting tasks after two minutes. Persistent execution budgets still apply, and `--reset-budget` remains an explicit authorization.
+
+## Validation scope
+
+The onboarding candidate was exercised in real narrow and wide terminals, with email authorization and actual model calls. A real Cloud ledger and Stripe test-mode payment verified quota rejection, payment activation, and explicit paid continuation of the same session. Payment alone did not restart the task or modify its files.
+
+Independent review rejected the generated expense-reporting task as unfinished and incorrect; this release does not claim successful completion of that task or production inference acceptance. See [the acceptance record](cloud-fresh-install-acceptance.md) for details and the local-profile backup incident.

package/lib/opencode/cli-runtime.mjs

@@ -100,6 +100,7 @@ function errorText(error) {
 function headlessFailureMessage(latest, headlessError) {
   const raw = errorText(latest?.error ?? latest?.session?.error ?? lastAssistantError(latest?.messages) ?? headlessError);
   const outcome = latest?.outcome ?? latest?.session?.outcome;
+  if (['elapsed-time', 'tool-calls', 'repair-rounds'].includes(latest?.budgetReason)) return `Session execution budget exhausted: ${latest.budgetReason}. Billing refresh does not reset execution limits. To authorize a fresh budget, resume this session with --reset-budget (for example: ctg --print --continue --reset-budget "Continue the task"), or run /delivery-budget-reset in the existing terminal session before continuing.`;
   if (/ModelNotSelectedError|No model is available|no provider|provider.*not (connected|selected|configured)|not authenticated/i.test(raw ?? '')) {
     return 'No AI provider connected. Run `ctg login` to connect one (Carthagent Cloud is recommended), or set an API key env var (e.g. ANTHROPIC_API_KEY), then retry. Run `ctg native --list-models` to see available models.';
   }
@@ -559,6 +560,9 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
           options.session = await latestSessionForWorkspace(client, cwd);
           if (!options.session) throw new Error('No native Carthagent session exists for this workspace to continue.');
         }
+        if (options.resetBudget && !options.session && !options.continue && !options.resume) {
+          throw new Error('--reset-budget requires --session, --continue or --resume.');
+        }
         eventController = new AbortController();
         const nativeEvents = [];
         let eventFailure;
@@ -600,6 +604,9 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
           const definitions = native.rpcDefinitions ?? await nativeRpcDefinitions();
           await client.rpc(definitions.SessionControls).framing({ sessionID, enabled: options.autoFraming }, { location: { directory: cwd }, signal: signal.controller.signal });
         }
+        if (options.resetBudget && sessionID) {
+          await client.session.command({ sessionID, name: 'delivery-budget-reset', text: '' }, { location: { directory: cwd }, signal: signal.controller.signal });
+        }
         if (framedPrompt) {
           if (!sessionID) {
             const created = await headlessApi.createSession(service, cwd, { body: {
@@ -637,6 +644,11 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
       let result;
       let headlessError;
       const requestedSession = options.session;
+      if (requestedSession && explicitModelSelection && model && !signal.controller.signal.aborted) {
+        const resumed = await client.session.get({ sessionID: requestedSession }, { signal: signal.controller.signal });
+        assertSessionWorkspace(resumed, cwd);
+        await client.session.switchModel({ sessionID: requestedSession, model }, { location: { directory: cwd }, signal: signal.controller.signal });
+      }
       if (requestedSession && Object.keys(sessionSettings).length && !signal.controller.signal.aborted) {
         await persistSessionOptions(client, requestedSession, metadata, sessionSettings, { signal: signal.controller.signal, directory: cwd });
       }
@@ -644,8 +656,16 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
         const definitions = native.rpcDefinitions ?? await nativeRpcDefinitions();
         await client.rpc(definitions.SessionControls).framing({ sessionID: requestedSession, enabled: options.autoFraming }, { location: { directory: cwd }, signal: signal.controller.signal });
       }
+      if (requestedSession && options.resetBudget && !signal.controller.signal.aborted) {
+        const resumed = await client.session.get({ sessionID: requestedSession }, { signal: signal.controller.signal });
+        assertSessionWorkspace(resumed, cwd);
+        await client.session.command({ sessionID: requestedSession, name: 'delivery-budget-reset', text: '' }, { location: { directory: cwd }, signal: signal.controller.signal });
+      }
       try {
         result = await headlessApi.runHeadless(service, cwd, framedPrompt || prompt || '', {
+          // The transport observer must allow useful coding tasks to finish.
+          // Persistent execution budgets remain enforced by the host plugin.
+          timeout: Math.max(30 * 60_000, (Number(sessionSettings.maxSeconds) || 0) * 1000 + 5000),
           sessionID: options.session,
           session: {
             title: promptText.slice(0, 80), ...(model ? { model } : {}), metadata,
@@ -658,7 +678,16 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
         headlessError = error;
         result = { session: { id: options.session }, messages: [], outcome: signal.controller.signal.aborted ? 'interrupted' : 'failed', terminal: true, error: error.message };
       }
-        const latest = headlessError ? result : await reconcileHeadlessResult(result, { client, signal: signal.controller.signal });
+        let latest = headlessError ? result : await reconcileHeadlessResult(result, { client, signal: signal.controller.signal });
+        if (latest.outcome === 'interrupted' && !latest.error && !latest.session?.error && !lastAssistantError(latest.messages) && latest.session?.id && typeof client.rpc === 'function' && !signal.controller.signal.aborted) {
+          // An interrupt may carry no error in the host projection. Read the
+          // authoritative persistent budget without restarting the task.
+          try {
+            const definitions = native.rpcDefinitions ?? await nativeRpcDefinitions();
+            const budget = await client.rpc(definitions.Carthagent).budgetStatus({ sessionID: latest.session.id }, { location: { directory: cwd }, signal: AbortSignal.any([signal.controller.signal, AbortSignal.timeout(2000)]) });
+            if (budget?.stopped) latest = { ...latest, budgetReason: budget.stopped, error: latest.error ?? headlessFailureMessage({ budgetReason: budget.stopped }) };
+          } catch { /* Keep the original failure when budget status is unavailable. */ }
+        }
         eventController.abort();
         await eventReader;
         if (eventFailure) throw new Error(`Native Carthagent event stream failed: ${eventFailure.message}`, { cause: eventFailure });
@@ -760,9 +789,10 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
       : interactive.find(item => item.id === 'experiential-labs') || interactive[0];
     if (!target && interactive.length > 1) {
       const prompt = readlineFactory({ input: stdin, output: stdout });
-      const choices = interactive.map((item, index) => `${index + 1}) ${item.name}`).join('\n');
-      const selected = await questionWithAbort(prompt, `Select provider:\n${choices}\nProvider number: `, controller.signal);
-      const index = Number(selected) - 1;
+      const defaultIndex = interactive.indexOf(integration);
+      const choices = interactive.map((item, index) => `${index + 1}) ${item.name}${item.id === 'experiential-labs' ? ' (recommended)' : ''}`).join('\n');
+      const selected = await questionWithAbort(prompt, `Select provider:\n${choices}\nProvider number [${defaultIndex + 1}]: `, controller.signal);
+      const index = selected.trim() === '' ? defaultIndex : Number(selected) - 1;
       if (!Number.isInteger(index) || index < 0 || index >= interactive.length) throw new Error('Select a listed provider number.');
       integration = interactive[index];
     }

package/lib/opencode/cli.mjs

@@ -26,6 +26,7 @@ const BOOL_FLAGS = new Map([
   ['--protect-existing', ['protectExisting', true]], ['--jev', ['jev', true]], ['--no-jev', ['jev', false]],
   ['--print', ['print', true]], ['--demo', ['demo', true]], ['-c', ['continue', true]],
   ['--continue', ['continue', true]], ['-r', ['resume', true]], ['--resume', ['resume', true]],
+  ['--reset-budget', ['resetBudget', true]],
 ]);
 
 const aliases = new Map([
@@ -84,9 +85,9 @@ export function cliHelp(version = '') {
   \x1b[32mhash\x1b[0m, \x1b[32mfingerprint\x1b[0m     Calculate workspace SHA-256 fingerprint
   \x1b[32mvalidate\x1b[0m <file.json> Validate acceptance contract
   \x1b[32mlogin\x1b[0m, \x1b[32mauth\x1b[0m             Connect an AI provider
-  \x1b[32maccount\x1b[0m               Show Ship credit, plan, grants and CLI sessions
-  \x1b[32mbilling\x1b[0m [checkout|portal] Open Ship billing
-  \x1b[32mlogout-cloud\x1b[0m [session] Revoke the current or named Ship session
+  \x1b[32maccount\x1b[0m               Show Cloud credit, plan, grants and CLI sessions
+  \x1b[32mbilling\x1b[0m [checkout|portal|refresh] Open or refresh Cloud billing
+  \x1b[32mlogout-cloud\x1b[0m [session] Revoke the current or named Cloud session
   \x1b[32marchive\x1b[0m [list|search|read|export] Read-only legacy session archive
   \x1b[32mreview\x1b[0m                Configure self-review or review a PR
   \x1b[32mserve\x1b[0m, \x1b[32mweb\x1b[0m, \x1b[32mstart\x1b[0m     Start the web dashboard
@@ -110,6 +111,8 @@ export function cliHelp(version = '') {
   --max-tools <n>          Session tool-call budget (0 disables)
   --max-seconds <n>        Session elapsed-time budget (0 disables)
   --max-repairs <n>        Automatic-repair budget (0 disables)
+  --reset-budget           Explicitly reset a resumed session's execution budget
+                           Budgets persist across continuation, including idle time.
   --protect-existing      Preserve files present at session start
   --rewrite-cap <n>        Whole-file writes per path (0 disables)
   --tool-output-cap <n>    Bound text output per tool result

package/lib/opencode/runtime-release.json

@@ -1,36 +1,36 @@
 {
   "version": 1,
-  "releaseVersion": "1.1.0-beta.2",
+  "releaseVersion": "1.1.0-beta.4",
   "compatibilityVersion": "2.0.32",
   "runtimeVersion": "0.0.0-ctg.2.0.32",
   "sourceRevision": "843a6c514e606b436a7fe713422ace0a93ad3d61",
-  "patchSha256": "ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975",
+  "patchSha256": "31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631",
   "lockSha256": "9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d",
   "assets": {
     "linux-x64": {
       "name": "opencode-linux-x64.tar.gz",
-      "archiveSha256": "0389612a88f9b002b819e4fc12eb5bd9e337b9c5352de60dd3f523e343ac01c2",
-      "executableSha256": "8a34735274c0b62049f6ae882dc955016fde54458efc18822fbcedb2e8eddeda"
+      "archiveSha256": "abdecf765542afe7e843059e73ecdd35d189ae8d02a7d41524cd7c28f02fce99",
+      "executableSha256": "9f998cb2d23e2c18258a5bcb9a9588228e6fef9f089b13bb2f74b80d8ee8d7f6"
     },
     "linux-arm64": {
       "name": "opencode-linux-arm64.tar.gz",
-      "archiveSha256": "7a01012e830a2bee2195402bf0c525bd345754ee4abb72af3ba4a597ceb096e5",
-      "executableSha256": "aea44aa7d12ee9aef5e6fd21fbfe1d23bd2aa2c731d955d5393c4fe2c4b1dcd7"
+      "archiveSha256": "d5e2315f3df07cb79c50c6b5221e1f5bb5ce029997ff30eaba5c71834d95d467",
+      "executableSha256": "38d4707b301966145cd6cc1dbf23c656a52f42d536c5ae219507f0473ebae97d"
     },
     "darwin-x64": {
       "name": "opencode-darwin-x64.tar.gz",
-      "archiveSha256": "cf88ba7c06a75a9e2021cfbb783a23fb93f09e2fb2dce86067346c8c666a2c5b",
-      "executableSha256": "17c67ad68d84a9c489a4d3567784aa8a2e3f7b086153693a57c1ef0a8b270a4f"
+      "archiveSha256": "568b1e3a5103421f0a08627b985b53becd727097644c1e5e6f5d5be393ecaea3",
+      "executableSha256": "4f69cbae17e1c83149cf1066adc117b0e35173158315fe8e841606510f34f770"
     },
     "darwin-arm64": {
       "name": "opencode-darwin-arm64.tar.gz",
-      "archiveSha256": "8db89fcec1f4fe502dfbb6f0e9ad6e2ccecdc6191ad14d6afa5338e9e0990341",
-      "executableSha256": "789dc613d191d339ef4b789d36dd32403db9422f11841659aea5a9ec4d3e6e37"
+      "archiveSha256": "1b164b4bcec032d7bc8276a6e585d7a469625a22408c3499f210bea562c96075",
+      "executableSha256": "42733a9a95257373f62ed9663ffbed2478456c537ee7f0d3f3bbdf91418de697"
     },
     "windows-x64": {
       "name": "opencode-windows-x64.tar.gz",
-      "archiveSha256": "9f7139dea76e662109a4c80b109b92525c993a37c69aae5b45623f8d69ab9467",
-      "executableSha256": "38edbca2f4304f2efa2afa57b654c362c14f422c141c3ebd82e1062221dccd80"
+      "archiveSha256": "535ecb051cf4f43f2acf3c18bec599a6739d7ff6565e32852e041addcc868806",
+      "executableSha256": "64b3052060df8ed07406c4b42b3a1d56e3500a7e2cd732756d615d443d9c0f33"
     }
   }
 }

package/lib/opencode/runtime.mjs

@@ -13,12 +13,12 @@ export const OPENCODE_VERSION = '2.0.32';
 export const CTG_RUNTIME_VERSION = '0.0.0-ctg.2.0.32';
 export const CTG_RUNTIME_SOURCE = '843a6c514e606b436a7fe713422ace0a93ad3d61';
 export const CTG_RUNTIME_LOCK_SHA256 = '9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d';
-export const CTG_RUNTIME_PATCH_SHA256 = 'ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975';
+export const CTG_RUNTIME_PATCH_SHA256 = '31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631';
 // Update only this development pin after reviewing a new checked-in patch and
 // script/ctg/prepare-development-runtime.sh. The published release pin above,
 // its build recipe, and the release manifest stay immutable until a separately
 // verified runtime release is promoted.
-export const CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256 = 'ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975';
+export const CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256 = '31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631';
 const DEFAULT_ROOT = path.join(homedir(), '.carthagent', 'opencode');
 const require = createRequire(import.meta.url);
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "carthagent",
-  "version": "1.1.0-beta.2",
+  "version": "1.1.0-beta.4",
   "workspaces": [
     "plugins/carthagent"
   ],

package/plugins/carthagent/src/tui.tsx

@@ -3,7 +3,7 @@ import { Plugin } from "@opencode/plugin/tui";
 import { Show } from "solid-js";
 import { writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
-import { nativeProviderName } from "../../../lib/opencode/provider-policy.mjs";
+import { nativeLoginProvider, nativeProviderName } from "../../../lib/opencode/provider-policy.mjs";
 import { framePrompt } from "../../../lib/tui/framing.mjs";
 import { carthagentConfigPath, loadCarthagentConfig, resolveReviewMode, reviewKickoff, saveCarthagentConfig } from "../../../lib/review.mjs";
 import { COMMANDS, NATIVE_COMMAND_COLLISIONS } from "./ui/commands.js";
@@ -114,7 +114,7 @@ export default Plugin.define({
           context.ui.router.navigate({ type: "plugin", name: "daily-quests", data: { ...(sessionID ? { sessionID } : {}) } });
           return;
         case "login":
-          context.keymap.dispatch("provider.connect");
+          context.keymap.dispatch("provider.connect", arg ? nativeLoginProvider(arg)?.id ?? arg : "experiential-labs");
           return;
         case "help": case "ctg-help":
           await context.ui.dialog.alert({ title: "Carthagent commands", message: COMMANDS.map((command) => `/${command.name}${command.args ? ` ${command.args}` : ""}${command.aliases?.length ? ` (${command.aliases.map((alias) => `/${alias}`).join(", ")})` : ""} — ${command.description}`).join("\n") + "\n\nCtrl+R sessions · Ctrl+T settings · Ctrl+N new session are native Carthagent actions." });

package/script/ctg/build-owned-runtime.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 ROOT="$(git rev-parse --show-toplevel)"
 EXPECTED_SOURCE="843a6c514e606b436a7fe713422ace0a93ad3d61"
 EXPECTED_LOCK="9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d"
-EXPECTED_PATCH="ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975"
+EXPECTED_PATCH="31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631"
 TARGET="${1:-opencode-linux-x64}"
 HOST_PLATFORM="$(node -p 'process.platform')"
 HOST_ARCH="$(node -p 'process.arch')"
@@ -34,7 +34,7 @@ if ! git diff --cached --quiet HEAD --; then
   exit 1
 fi
 expected_inputs=(
-  "docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch"
+  "docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch"
   "script/ctg/build-owned-runtime.sh"
 )
 actual_status="$(git status --porcelain --untracked-files=all)"
@@ -86,7 +86,7 @@ if [[ "$(bun --version)" != "1.4.2" ]]; then
   exit 1
 fi
 
-patch_file="$ROOT/docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch"
+patch_file="$ROOT/docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch"
 actual_patch="$("${HASH_COMMAND[@]}" "$patch_file" | awk '{print $1}')"
 if [[ "$actual_patch" != "$EXPECTED_PATCH" ]]; then
   echo "Patch checksum mismatch: $actual_patch" >&2

package/tests/cli.test.mjs

@@ -102,11 +102,11 @@ test('check fails clearly when no delivery report exists', t => {
   assert.match(result.stderr, /No delivery report/);
 });
 
-test('guidance routing is not a user-facing command and Ship account commands are documented', t => {
+test('guidance routing is not a user-facing command and Cloud account commands are documented', t => {
   const result = run(fixture(t), '--help');
   assert.equal(result.status, 0, result.stderr);
   assert.doesNotMatch(result.stdout, /\broute\b|\bprofiles\b/);
-  assert.match(result.stdout, /account.*Ship credit/);
+  assert.match(result.stdout, /account.*Cloud credit/);
   assert.match(result.stdout, /billing.*checkout\|portal/);
   assert.match(result.stdout, /logout-cloud/);
 });

package/tests/native-ship-plan.test.mjs

@@ -10,7 +10,7 @@ import ts from 'typescript';
 import { parseOpenCodeArgs } from '../lib/opencode/cli.mjs';
 import { normalizeSessionOptions } from '../lib/opencode/session-options.mjs';
 
-const patch = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch', import.meta.url), 'utf8');
+const patch = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch', import.meta.url), 'utf8');
 const path = 'packages/tui/src/routes/session/plan-items.ts';
 const section = patch.split(`diff --git a/${path} b/${path}\n`)[1]?.split('\ndiff --git ')[0];
 assert.ok(section, 'the plan graph parser is part of the reproducible runtime patch');
@@ -72,14 +72,19 @@ test('development runtime source and preparation recipe pin the actual Ship grap
   assert.equal(CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256, digest);
   const prepare = readFileSync(new URL('../script/ctg/prepare-development-runtime.sh', import.meta.url), 'utf8');
   assert.ok(prepare.includes(`EXPECTED_PATCH="${digest}"`));
-  assert.ok(prepare.includes('docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch'));
+  assert.ok(prepare.includes('docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch'));
   assert.doesNotMatch(prepare, /bun (install|run|build)|gh release|npm publish/);
 });
 
-test('the shared release build recipe stays on the published patch', () => {
-  const published = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch', import.meta.url));
+test('the published runtime pin stays on its immutable release patch', () => {
+  const published = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch', import.meta.url));
   const digest = createHash('sha256').update(published).digest('hex');
   assert.equal(CTG_RUNTIME_PATCH_SHA256, digest);
+});
+
+test('the candidate build recipe pins the reviewed onboarding patch', () => {
+  const digest = createHash('sha256').update(patch).digest('hex');
   const build = readFileSync(new URL('../script/ctg/build-owned-runtime.sh', import.meta.url), 'utf8');
   assert.ok(build.includes(`EXPECTED_PATCH="${digest}"`));
+  assert.ok(build.includes('docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch'));
 });

package/tests/opencode-cli.test.mjs

@@ -42,6 +42,40 @@ test('native CLI selects headless execution and preserves output-mode options',
   assert.equal(invocation.prompt, 'Do work');
 });
 
+test('headless continuation explains persistent budget exhaustion and resets only on explicit request', async t => {
+  const { mkdtempSync, rmSync } = await import('node:fs');
+  const { tmpdir } = await import('node:os');
+  const cwd = mkdtempSync(join(tmpdir(), 'ctg-budget-continuation-'));
+  t.after(() => rmSync(cwd, { recursive: true, force: true }));
+  const { io, output } = ioCapture();
+  const calls = [];
+  let stopped = 'elapsed-time';
+  const runtime = await createOpenCodeCliRuntime({ cwd, io, stdout: { write() {} }, native: {
+    runtime: {}, service: { ensureService: async () => ({}) }, rpcDefinitions: { Carthagent: {} },
+    clientFactory: async () => ({
+      rpc: () => ({ budgetStatus: async () => ({ stopped }) }),
+      session: {
+        list: async () => ({ data: [{ id: 'same-session', location: { directory: cwd } }] }),
+        get: async () => ({ id: 'same-session', location: { directory: cwd } }),
+        command: async input => { calls.push(input); stopped = null; },
+      },
+    }),
+    headless: { runHeadless: async (_service, _cwd, _prompt, options) => {
+      assert.equal(options.sessionID, 'same-session');
+      calls.push('prompt');
+      return { session: { id: 'same-session' }, outcome: stopped ? 'interrupted' : 'succeeded', terminal: true,
+        messages: stopped ? [] : [{ type: 'assistant', finish: 'stop', content: [{ type: 'text', text: 'continued' }] }] };
+    } },
+  } });
+  assert.equal(parseOpenCodeArgs(['--continue', '--reset-budget', 'Continue']).resetBudget, true);
+  assert.equal(await runtime.run({ mode: 'headless', options: { continue: true }, prompt: 'Continue' }), 1);
+  assert.match(output.stderr.at(-1), /budget exhausted: elapsed-time.*--reset-budget/);
+  assert.deepEqual(calls, ['prompt'], 'no implicit budget reset or prompt retry');
+  assert.equal(await runtime.run({ mode: 'headless', options: { continue: true, resetBudget: true }, prompt: 'Continue' }), 0);
+  assert.deepEqual(calls.slice(1), [{ sessionID: 'same-session', name: 'delivery-budget-reset', text: '' }, 'prompt']);
+  await assert.rejects(runtime.run({ mode: 'headless', options: { resetBudget: true }, prompt: 'New task' }), /requires --session/);
+});
+
 test('headless CLI validates prompts and maps cancellation to conventional exit code', async () => {
   const { io, output } = ioCapture();
   assert.equal(await runOpenCodeCli({ argv: [], stdoutIsTTY: false, io, runtime: {} }), 1);
@@ -77,10 +111,10 @@ test('model, auth, cloud and domain entrypoints dispatch to injected native capa
   ]);
 });
 
-test('help preserves command aliases, Ship operations and isolation semantics', async () => {
+test('help preserves command aliases, Cloud operations and isolation semantics', async () => {
   const { output, io } = ioCapture();
   assert.equal(await runOpenCodeCli({ argv: ['--help'], io, version: '1.0.3' }), 0);
-  assert.match(output.stdout[0], /account.*Ship credit/);
+  assert.match(output.stdout[0], /account.*Cloud credit/);
   assert.match(output.stdout[0], /billing.*checkout\|portal/);
   assert.match(output.stdout[0], /--isolate\s+Isolate extension\/skill discovery \(not a worktree\)/);
   assert.equal(cliHelp('x').includes('--engine-cli, --agent-cli'), true);
@@ -518,6 +552,27 @@ test('no-prompt interactive explicit model and thinking selection applies to fre
   }
 });
 
+test('headless continuation switches an explicitly requested model before submitting to the same session', async () => {
+  const calls = [];
+  const runtime = await createOpenCodeCliRuntime({ cwd: '/project', stdout: { write() {} }, native: {
+    runtime: {}, service: { ensureService: async () => ({ url: 'http://127.0.0.1:1', headers: {} }) },
+    headless: { runHeadless: async (_service, _cwd, _prompt, options) => {
+      calls.push(['run', options.sessionID]);
+      assert.equal(options.timeout, 30 * 60_000);
+      return { session: { id: options.sessionID }, outcome: 'failed', terminal: true, messages: [] };
+    } },
+    clientFactory: async () => ({ session: {
+      get: async () => ({ id: 'ses_existing', location: { directory: '/project' }, metadata: {} }),
+      switchModel: async input => calls.push(['switch', input]),
+    } }),
+  } });
+  await runtime.run({ mode: 'headless', options: { session: 'ses_existing', provider: 'fixture', model: 'cheaper-model' }, prompt: 'continue' });
+  assert.deepEqual(calls, [
+    ['switch', { sessionID: 'ses_existing', model: { providerID: 'fixture', id: 'cheaper-model' } }],
+    ['run', 'ses_existing'],
+  ]);
+});
+
 test('resumed interactive model selection verifies workspace ownership before any session mutation or launch', async t => {
   const { mkdtempSync, rmSync } = await import('node:fs');
   const { tmpdir } = await import('node:os');
@@ -542,6 +597,11 @@ test('resumed interactive model selection verifies workspace ownership before an
     mode: 'interactive', options: { session: 'ses_foreign', model: 'fixture/explicit-model', maxTools: '3' }, prompt: '',
   }), /another workspace/);
   assert.deepEqual(calls, [['get', 'ses_foreign']], 'ownership is checked before switching models, updating metadata, or launching TUI');
+  calls.length = 0;
+  await assert.rejects(runtime.run({
+    mode: 'headless', options: { session: 'ses_foreign', model: 'fixture/explicit-model' }, prompt: 'continue',
+  }), /another workspace/);
+  assert.deepEqual(calls, [['get', 'ses_foreign']], 'headless model switches enforce the same workspace boundary');
 });
 
 test('interactive provider or thinking flags without a model fail instead of being silently ignored', async () => {
@@ -752,18 +812,19 @@ test('resumed native sessions merge explicit launcher options into their own wor
   assert.deepEqual(framingOverrides, [{ sessionID: 'ses_existing', enabled: false }]);
 });
 
-test('native login uses OpenCode integration OAuth status and completion lifecycle', async () => {
+test('native login defaults to Cloud on Enter and completes the host OAuth lifecycle', async () => {
   const calls = [];
   const opened = [];
+  const prompts = [];
   const service = { url: 'http://127.0.0.1:1', headers: {} };
   const integration = {
     id: 'experiential-labs', name: 'Carthagent Ship',
     methods: [{ id: 'carthagent-device', type: 'oauth', label: 'Sign in with Carthagent Ship' }],
   };
-  const runtime = await createOpenCodeCliRuntime({ cwd: '/project', io: ioCapture().io, stdin: { isTTY: true }, stdout: { isTTY: true }, openBrowserImpl: async url => { opened.push(url); return true; }, native: {
+  const runtime = await createOpenCodeCliRuntime({ cwd: '/project', io: ioCapture().io, stdin: { isTTY: true }, stdout: { isTTY: true }, readlineFactory: () => ({ close() {}, question: async text => { prompts.push(text); return ''; } }), openBrowserImpl: async url => { opened.push(url); return true; }, native: {
     runtime: {}, service: { ensureService: async () => service }, headless: {},
     clientFactory: async () => ({ integration: {
-      list: async input => { calls.push(['list', input]); return { data: [integration] }; },
+      list: async input => { calls.push(['list', input]); return { data: [{ id: 'openai', name: 'OpenAI', methods: [{ type: 'key' }] }, integration] }; },
       oauth: {
         connect: async input => { calls.push(['connect', input]); return { data: {
           attemptID: 'attempt-1', url: 'https://auth.example/device', instructions: 'Approve access', mode: 'auto',
@@ -775,6 +836,9 @@ test('native login uses OpenCode integration OAuth status and completion lifecyc
     } }),
   } });
   assert.equal(await runtime.login(), 0);
+  assert.match(prompts[0], /1\) Carthagent Cloud \(recommended\)/);
+  assert.match(prompts[0], /Provider number \[1\]:/);
+  assert.equal(calls[1][1].integrationID, 'experiential-labs');
   assert.deepEqual(opened, ['https://auth.example/device']);
   assert.deepEqual(calls.map(([name]) => name), ['list', 'connect', 'status']);
   assert.equal(calls[1][1].methodID, 'carthagent-device');

package/tests/owned-runtime-publish-workflow.test.mjs

@@ -106,7 +106,7 @@ function workflowJob(name) {
   return lines.slice(start, end).join('\n');
 }
 
-const combinedPatchPath = 'docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch';
+const combinedPatchPath = 'docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch';
 
 function sha256(bytes) {
   return createHash('sha256').update(bytes).digest('hex');
@@ -181,7 +181,13 @@ async function fixture(t) {
   execFileSync('git', ['init', '-q'], { cwd: ctg });
   execFileSync('git', ['-c', 'user.name=Workflow Fixture', '-c', 'user.email=fixture@example.invalid', 'add', combinedPatchPath, 'script/ctg/build-owned-runtime.sh'], { cwd: ctg });
   execFileSync('git', ['-c', 'user.name=Workflow Fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-qm', 'fixture candidate patch'], { cwd: ctg });
-  await copyFile(path.join(root, 'lib/opencode/runtime.mjs'), path.join(ctg, 'lib/opencode/runtime.mjs'));
+  // Publication uses a final package whose trust pin has been promoted after
+  // prebuild; the working tree may still retain the previous public release.
+  const runtimeSource = await readFile(path.join(root, 'lib/opencode/runtime.mjs'), 'utf8');
+  await writeFile(path.join(ctg, 'lib/opencode/runtime.mjs'), runtimeSource.replace(
+    /CTG_RUNTIME_PATCH_SHA256 = '[a-f0-9]{64}'/,
+    `CTG_RUNTIME_PATCH_SHA256 = '${patchSha256}'`,
+  ));
 
   const manifest = {
     version: 1,
@@ -403,9 +409,9 @@ test('draft metadata validation has scoped write capability; artifact mutation s
   assert.doesNotMatch(assembly, /contents: write/);
   assert.match(publish, /contents: write/);
   assert.match(uploadBlock, /gh release upload/);
-  assert.match(workflow, /git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch > opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch/);
-  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch\)"/);
-  assert.equal((workflow.match(/git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch > ctg\/docs\/patches\/opencode-v2\.0\.32-session-ui\.patch/g) ?? []).length, 1,
+  assert.match(workflow, /git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch > opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch/);
+  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch\)"/);
+  assert.equal((workflow.match(/git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch > ctg\/docs\/patches\/opencode-v2\.0\.32-session-ui\.patch/g) ?? []).length, 1,
     'candidate assembly must extract exact committed bytes at the pinned historical path');
   assert.match(verifyBlock, /git -C ctg show HEAD:script\/ctg\/build-owned-runtime\.sh/);
   assert.match(verifyBlock, /git -C ctg show "HEAD:\$patch_file" > ctg\/docs\/patches\/opencode-v2\.0\.32-session-ui\.patch/);
@@ -413,7 +419,7 @@ test('draft metadata validation has scoped write capability; artifact mutation s
   assert.match(workflow, /chmod \+x opencode\/script\/ctg\/build-owned-runtime\.sh/);
   assert.match(workflow, /GIT_CONFIG_KEY_0:\s*core\.autocrlf[\s\S]*?GIT_CONFIG_VALUE_0:\s*'false'/);
   assert.match(workflow, /git -C opencode config --local core\.autocrlf false/);
-  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch\)"/);
+  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch\)"/);
 });
 
 test('review-branch prebuild source is exact dispatch SHA; publish validation is default-branch-only', { skip: requiresUbuntuWorkflowShell, timeout: 60000 }, async (t) => {

package/tests/runtime-development-trust.test.mjs

@@ -83,7 +83,7 @@ async function fixture(t, patchSha256 = developmentPatch) {
 }
 
 test('packaged release trust stays valid independently of the development patch pin', async t => {
-  assert.equal(CTG_RUNTIME_PATCH_SHA256, 'ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975');
+  assert.equal(CTG_RUNTIME_PATCH_SHA256, '31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631');
   const published = await readRuntimeReleaseManifest();
   const packageJson = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
   assert.equal(published.releaseVersion, packageJson.version);