create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/session-create/subagent-pick.js

@@ -20,8 +20,11 @@
 
 const crypto = require('crypto');
 const path = require('path');
+const url = require('node:url');
 
 const { WORKER_MODEL_ALIAS } = require('../model-proxy/lead-worker-picks');
+const { compareSemver } = require('../semver-compare');
+const { CODEX_NATIVE_SUBAGENT_DENY_MIN_VERSION } = require('../codex-harness-qualification');
 // The ONE literal effort grammar CTM accepts for a launch effort (same validator the lead-launch
 // override and the launch-truth store use), so a malformed value can never be projected as known.
 const { isValidEffort } = require('../launch-model-override');
@@ -34,12 +37,17 @@ const { isValidEffort } = require('../launch-model-override');
 const SUBAGENT_PICK_READ_TIMEOUT_MS = 1500;
 
 const LANES = new Set(['native', 'routed', 'inherit']);
-const AGENTS = new Set(['claude', 'codex']);
+const AGENTS = new Set(['claude', 'codex', 'opencode']);
 // D-5: a route resolution failure with one of these codes is a first-class 'unservable' pick
 // (surfaced in the picker, WP-6), never a silent fall-back to another route or model.
 const UNSERVABLE_ROUTE_CODES = new Set([
   'route_unknown', 'route_disabled', 'route_not_routable', 'route_not_servable',
 ]);
+// R-1/R-3 (subagent-pick-unreachable-origin-2026-10-28.html): a route that resolves fine here can
+// still be dialed from THIS machine only if its upstream origin answers. These are the two probe
+// verdicts that mean "no request from this host can succeed", so the pick is refused up front
+// instead of handing every native subagent an HTTP 502 at its first request.
+const ORIGIN_UNREACHABLE_REACH = new Set(['unreachable', 'no_server']);
 
 // Codex's built-in subagent role texts, copied VERBATIM from
 // codex-rs/core/src/agent/role.rs:349-381 @ 322bbf4d848; re-copy on Codex bumps.
@@ -165,8 +173,12 @@ function _originFields(origin, mirroredAt) {
 }
 
 /**
- * @param {{ ctmSessionId?: string, agent?: 'claude'|'codex', leadRoute?: object|null }} input
- * @param {{ walleClient?: object, readiness?: object, mirror?: object, setTimeout?: Function, clearTimeout?: Function }} deps
+ * @param {{ ctmSessionId?: string, agent?: 'claude'|'codex'|'opencode', leadRoute?: object|null }} input
+ * @param {{ walleClient?: object, readiness?: object, mirror?: object, setTimeout?: Function, clearTimeout?: Function, originVerdict?: Function }} deps
+ *   `originVerdict` is OPTIONAL: the credential-less upstream-origin probe
+ *   (lib/model-availability.js `originVerdict`) consulted for a ROUTED pick, so a route whose origin
+ *   cannot be reached from this machine is refused as `origin_unreachable` rather than launched
+ *   into a 502.
  *   `mirror` is OPTIONAL (lib/storage/delegate-pref-mirror-store.js). When present, a successful read
  *   backfills it from the read's ladder[] and a FAILED read folds it (M-1/M-2a) instead of giving up.
  * @returns {Promise<{kind:'none', reason:'vendor'|'read_failed'|'not_lead', detail?: string}
@@ -221,6 +233,13 @@ async function resolveSubagentPick(input, deps) {
   }
 
   // The lane gate above already dropped everything else, so this is 'routed' (D-4/D-5/D-11).
+  if (agent === 'opencode') {
+    // §6.5/§9 S-20 (opencode-lead-and-delegate-model-selection-2026-10-28.html): an OpenCode lead
+    // reaches a routed worker through the Wall-E MCP server, not through CTM's lead proxy -- the
+    // routed lane is WP-5. Until it lands this is a typed, non-fallback refusal, so a saved routed
+    // pick is visibly unserved rather than silently projected as something the lead cannot carry.
+    return { kind: 'unservable', agent, reason: 'opencode_routed_requires_mcp', source, ..._originFields(origin, mirroredAt) };
+  }
   if (agent === 'codex' && !args.leadRoute) {
     // D-11: checked BEFORE readiness -- the lead's transport is what makes this unservable, and
     // there is no point resolving a route we can never reach.
@@ -254,6 +273,25 @@ async function resolveSubagentPick(input, deps) {
         || metadataRevision.length > 256 || /[\u0000-\u001f\u007f]/.test(metadataRevision)) {
       return { kind: 'unservable', agent, reason: 'model_metadata_unavailable', source, ..._originFields(origin, mirroredAt) };
     }
+    // R-1/R-3/R-4: the route exists, but it is only servable if THIS machine can dial the
+    // upstream origin. Same cached, single-flighted probe buildAvailability uses -- no second
+    // probe path, and never a header off the route row.
+    const upstreamOrigin = require('../model-availability').originOf(resolved.baseUrl);
+    if (upstreamOrigin) {
+      const verdictFn = typeof d.originVerdict === 'function'
+        ? d.originVerdict
+        : require('../model-availability').originVerdict;
+      let verdict = null;
+      try {
+        verdict = await verdictFn(upstreamOrigin);
+      } catch (err) {
+        /* REPORT: a probe failure is "no gate" (R-3), never a refusal. */
+        process.stderr.write('[subagent-pick] origin verdict failed: ' + _detail(err) + '\n');
+      }
+      if (verdict && ORIGIN_UNREACHABLE_REACH.has(verdict.reach)) {
+        return { kind: 'unservable', agent, reason: 'origin_unreachable', source, ..._originFields(origin, mirroredAt) };
+      }
+    }
     return {
       kind: 'routed',
       agent,
@@ -326,22 +364,397 @@ function _codexPlan(model, effort, dataDir) {
     codexArgs,
     leadProxy: null,
     roleFile: { path: rolePath, contents: _roleFileBody(model, effort) },
+    nativeSubagents: '',
   };
 }
 
+// WP-1 (codex-native-subagent-pick-enforcement-2026-10-28.html §5 D-2, §10.1): the two ROOT config
+// overrides that make an injected `collaboration.spawn_agent` call answer `unsupported call` on the
+// installed Codex. NOT `--disable multi_agent[_v2]`: for a model whose catalog entry declares
+// `multi_agent_version: "v2"` (every GPT-6 model, §1.4) the session resolves to V2 and the flag form
+// is bypassed. `agents.enabled=false` alone is overridden when `features.multi_agent_v2` is on, so
+// BOTH tokens ship together. The worker deny tokens (lib/session-create/worker-launch-sandbox.js,
+// codexWorkerDenyArgs) are a separate, unchanged mechanism (OQ-1).
+const CODEX_NATIVE_SUBAGENT_DENY_ARGS = Object.freeze([
+  '-c', 'agents.enabled=false',
+  '-c', 'features.multi_agent_v2.disable_native_tools=true',
+]);
+
+// WP-1b: the deny prefix's own version floor lives with every other Codex version fact
+// (lib/codex-harness-qualification.js, CODEX_NATIVE_SUBAGENT_DENY_MIN_VERSION); see D-2b.
+
+/**
+ * D-3. True when a Codex lead's native children cannot be redirected to the stored ROUTED pick, so
+ * the launch must unregister the native multi-agent tools. An `inherit` pick means "same as the
+ * lead", which a native child already satisfies, so nothing is denied; every Claude pick is env-only.
+ * PURE.
+ * @param {{kind?: string, agent?: string, reason?: string}|null} pick  resolveSubagentPick() result
+ * @returns {boolean}
+ */
+function nativeSubagentsDenied(pick) {
+  return !!pick && pick.kind === 'unservable' && pick.agent === 'codex'
+    && pick.reason !== 'codex_inherit_unenforceable';
+}
+
+// R-6/§6.5 (§5 R-10): OpenCode's per-launch carrier. CTM NEVER writes OpenCode's user config or
+// state -- the pick rides `OPENCODE_CONFIG_CONTENT`, the inline runtime config OpenCode merges OVER
+// its file config for this process only, as an agent-config model for OpenCode's own built-in
+// subagents (`general`, `explore`). PURE, apart from reading the string it is handed.
+//
+//   native   name the pick's model on agent.general.model and agent.explore.model
+//   inherit  OpenCode's own default IS "a subagent follows the model of the primary agent that
+//            invoked it", so nothing is emitted at all -- and, decisively, no existing
+//            OPENCODE_CONFIG_CONTENT in the launch env is rewritten on the way past
+//
+// `existingConfigContent` is the launch env's current OPENCODE_CONFIG_CONTENT, if any. It is parsed
+// as a JSON object and EVERY other key is carried through verbatim. A value that is not a JSON
+// object (unparseable, null, an array, a bare scalar) is replaced by `{}` and reported in `applied`
+// as `existing_config_unparseable`, so a caller can see that something was discarded rather than
+// silently losing it.
+function _asConfigObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+
+function opencodeLaunchProjection({ pick, existingConfigContent } = {}) {
+  if (!pick || pick.kind !== 'native') return { env: {}, applied: [] };
+  const applied = [];
+  const raw = existingConfigContent === undefined || existingConfigContent === null ? '' : String(existingConfigContent);
+  let config = {};
+  if (raw.trim() !== '') {
+    let parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = null; // expected: an unparseable existing value is replaced and reported below
+    }
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) config = parsed;
+    else applied.push('existing_config_unparseable');
+  }
+  const model = String(pick.model || '');
+  const currentAgent = _asConfigObject(config.agent);
+  const next = {
+    ...config,
+    agent: {
+      ...currentAgent,
+      general: { ..._asConfigObject(currentAgent.general), model },
+      explore: { ..._asConfigObject(currentAgent.explore), model },
+    },
+  };
+  applied.push('agent.general.model', 'agent.explore.model');
+  return { env: { OPENCODE_CONFIG_CONTENT: JSON.stringify(next) }, applied };
+}
+
+// §5 R-6 / §9 S-21 (opencode-lead-and-delegate-model-selection-2026-10-28.html §6.5, WP-5): the
+// Wall-E MCP server for an OpenCode LEAD, carried inline for THIS launch only.
+//
+// R-6 is absolute: CTM NEVER writes `~/.config/opencode/*`. OpenCode merges `OPENCODE_CONFIG_CONTENT`
+// OVER its file config for this process only, so the server is injected by extending the very same
+// inline document an OpenCode pick already rides (see opencodeLaunchProjection). OpenCode's `mcp`
+// entries are LOCAL (stdio) servers: { type: 'local', command: [executable, ...args], enabled: true }.
+//
+// The entry itself (`walleMcp`) is the canonical stdio-proxy command resolved by Wall-E's own
+// mcp-integration (`{ command, args }`) -- never a hand-built path (see
+// CTM lib/walle-mcp-auto-config.js's opencodeWalleMcpEntry). `command` is the resolved real node
+// binary and `args` is the walle-mcp-stdio.js script; CTM_SESSION_ID / WALL_E_API_TOKEN already ride
+// the lead's own env, so nothing else has to be injected here.
+//
+// PURE: no fs, no env reads. `existingConfigContent` is parsed as a JSON object and EVERY other key
+// is carried through verbatim -- including the other servers of an existing `mcp` map. A value that
+// is not a JSON object (unparseable, null, an array, a bare scalar) is replaced by `{}` and REPORTED
+// to stderr (the same `existing_config_unparseable` fact opencodeLaunchProjection exposes in its
+// `applied` list), so a caller can see that something was discarded rather than silently losing it.
+// `walleMcp` null/absent -> null: nothing to add, and the caller keeps whatever it already had.
+function opencodeWalleMcpProjection({ existingConfigContent, walleMcp } = {}) {
+  if (!walleMcp) return null;
+  const command = [walleMcp.command, ...(Array.isArray(walleMcp.args) ? walleMcp.args : [])];
+  const raw = existingConfigContent === undefined || existingConfigContent === null ? '' : String(existingConfigContent);
+  let config = {};
+  if (raw.trim() !== '') {
+    let parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = null; // expected: an unparseable existing value is replaced and reported below
+    }
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) config = parsed;
+    else {
+      /* REPORT: the launch's existing inline config could not be parsed and is being discarded. */
+      process.stderr.write('[subagent-pick] existing OPENCODE_CONFIG_CONTENT discarded (existing_config_unparseable)\n');
+    }
+  }
+  const next = {
+    ...config,
+    mcp: {
+      ..._asConfigObject(config.mcp),
+      'wall-e': { type: 'local', command, enabled: true },
+    },
+  };
+  return JSON.stringify(next);
+}
+
+// WP-2 (opencode-model-selection-round-2-shared-route-logic-2026-10-30.html §5 R-3/R-6, §6.2, §9
+// S-7): a routed OpenCode LEAD's `ctm-lead` provider entry rides the SAME inline
+// OPENCODE_CONFIG_CONTENT document the subagent pick and the Wall-E MCP server ride -- ONE writer,
+// one blob, never ~/.config/opencode/*. `configPatch` is prepareLeadRoute's §6.2 patch
+// (`{ provider: { 'ctm-lead': opencodeLeadProvider(...) }, model: 'ctm-lead/lead' }`).
+//
+// PURE: no fs, no env reads. Same parse/carry-through/report rules as opencodeWalleMcpProjection
+// above: every other key is carried through verbatim, `provider` is DEEP-merged so a launch that
+// already holds other providers keeps them, and the top-level `model` ref is set (a stable ref,
+// R-4 -- the route/wire model live inside the provider entry, not the ref). A value that is not a
+// JSON object (unparseable, null, an array, a bare scalar) is replaced by `{}` and REPORTED to
+// stderr. `configPatch` null/absent -> null: nothing to add, and the caller keeps what it had.
+function opencodeLeadRouteProjection({ existingConfigContent, configPatch } = {}) {
+  if (!configPatch) return null;
+  const raw = existingConfigContent === undefined || existingConfigContent === null ? '' : String(existingConfigContent);
+  let config = {};
+  if (raw.trim() !== '') {
+    let parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = null; // expected: an unparseable existing value is replaced and reported below
+    }
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) config = parsed;
+    else {
+      /* REPORT: the launch's existing inline config could not be parsed and is being discarded. */
+      process.stderr.write('[subagent-pick] existing OPENCODE_CONFIG_CONTENT discarded (existing_config_unparseable)\n');
+    }
+  }
+  const next = {
+    ...config,
+    provider: {
+      ..._asConfigObject(config.provider),
+      ..._asConfigObject(configPatch.provider),
+    },
+    model: configPatch.model,
+  };
+  return JSON.stringify(next);
+}
+
+// WP-5 (opencode-v2-model-switch-standalone-plugin-2026-10-30.html §5 R-9, §5.2 D-9/D-10/D-11, §6.7):
+// the OpenCode 1.x MODEL CARRIER, added to the launch's inline `plugin` array for the ONE switch
+// relaunch. 1.x plugin entries are just strings, so an entry is a `file://` URL of a repo file and the
+// target rides the spawn env instead (D-10: no installer change, no `~/.config/opencode` write, R-6).
+//
+// The URL is derived from THIS module's location, so it points at the checkout CTM is running from.
+const OPENCODE_V1_CARRIER_URL = url.pathToFileURL(
+  path.join(__dirname, '..', 'opencode-v1-plugin', 'model-carrier.mjs'),
+).href;
+
+// PURE: no fs, no env reads. Same parse/carry-through/report rules as opencodeLeadRouteProjection
+// above: every other key of the inline document is carried through verbatim, and a value that is not
+// a JSON object (unparseable, null, an array, a bare scalar) is replaced by `{}` and REPORTED to
+// stderr. `plugin` is the existing array MINUS any entry equal to the carrier URL, PLUS the carrier
+// URL — so two calls leave exactly one carrier entry and any other plugin entry survives. A non-array
+// `plugin` is replaced by `[]` and reported the same way. Always returns a JSON string.
+function opencodeV1CarrierProjection({ existingConfigContent } = {}) {
+  const raw = existingConfigContent === undefined || existingConfigContent === null ? '' : String(existingConfigContent);
+  let config = {};
+  if (raw.trim() !== '') {
+    let parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = null; // expected: an unparseable existing value is replaced and reported below
+    }
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) config = parsed;
+    else {
+      /* REPORT: the launch's existing inline config could not be parsed and is being discarded. */
+      process.stderr.write('[subagent-pick] existing OPENCODE_CONFIG_CONTENT discarded (existing_config_unparseable)\n');
+    }
+  }
+  const existingPlugins = Array.isArray(config.plugin) ? config.plugin : null;
+  if (existingPlugins === null && config.plugin !== undefined) {
+    /* REPORT: a non-array plugin list is discarded so the carrier entry has somewhere to live. */
+    process.stderr.write('[subagent-pick] existing OpenCode plugin list discarded (plugin_not_array)\n');
+  }
+  const next = {
+    ...config,
+    plugin: [...(existingPlugins || []).filter((entry) => entry !== OPENCODE_V1_CARRIER_URL), OPENCODE_V1_CARRIER_URL],
+  };
+  return JSON.stringify(next);
+}
+
+// PURE: the OpenCode session id a RESTORE resumes, read from the launch argv. The value after
+// `--session` / `-s`, or after `--session=`. '' when there is none (e.g. `--continue`/`-c`, or a fresh
+// launch) — which is exactly the "no carrier" decision the spawn path makes.
+function opencodeResumeSessionId(args) {
+  const list = Array.isArray(args) ? args : [];
+  for (let i = 0; i < list.length; i += 1) {
+    const arg = String(list[i] == null ? '' : list[i]);
+    if (arg.startsWith('--session=')) return arg.slice('--session='.length);
+    if (arg === '--session' || arg === '-s') {
+      const next = list[i + 1];
+      return next == null ? '' : String(next);
+    }
+  }
+  return '';
+}
+
+// WP-5 (opencode-v2-model-switch-standalone-plugin-2026-10-30.html §5.1 R-9, §6.7): the PURE decision
+// for the OpenCode 1.x model carrier — a prompted v1 tab switches by park + resume relaunch, and the
+// carrier rides the ONE relaunch's inline config + env. Nothing is injected for a fresh tab (its
+// `--model` argv already works), a worker, a v2/unreadable binary, or a restore with no session id.
+// Returns `spawnEnv` UNCHANGED (same object) unless a carrier was armed, so a caller compares identity.
+function opencodeV1CarrierEnv({ agentType, isRestore, agentRole, line, nativeModel, launchLeadRoute, launchArgs, spawnEnv }) {
+  if (!spawnEnv || agentType !== 'opencode' || isRestore !== true || agentRole === 'worker' || line !== 'v1') return spawnEnv;
+  const target = typeof nativeModel === 'string' && nativeModel
+    ? nativeModel
+    : (launchLeadRoute && typeof launchLeadRoute === 'object' ? require('./opencode-lead-provider').OPENCODE_LEAD_MODEL_REF : '');
+  const sid = opencodeResumeSessionId(launchArgs);
+  if (!target || !sid) return spawnEnv;
+  return {
+    ...spawnEnv,
+    OPENCODE_CONFIG_CONTENT: opencodeV1CarrierProjection({ existingConfigContent: spawnEnv.OPENCODE_CONFIG_CONTENT }),
+    CTM_OPENCODE_SWITCH_MODEL: target,
+    CTM_OPENCODE_SWITCH_SESSION: sid,
+  };
+}
+
+// WP-2 (opencode-v2-model-switch-standalone-plugin-2026-10-30.html §5.1 R-3, §5.2 D-4/D-6, §6.2): the
+// OpenCode 2.x CTM plugin, carried inline in OPENCODE_CONFIG_CONTENT. 2.x plugin entries are objects
+// `{ package, options }` and the package must be an absolute DIRECTORY (a single file path is skipped,
+// P-S7), so the entry points at this repo directory and OpenCode loads its `server.js`. Nothing is
+// written under ~/.config/opencode (R-6): there is no install step and upgrades ship with CTM.
+const OPENCODE_V2_PLUGIN_DIR = path.join(__dirname, '..', 'opencode-v2-plugin');
+
+// PURE: no fs, no env reads. Same parse/carry-through/report rules as opencodeV1CarrierProjection
+// above: every other key of the inline document survives verbatim, and a value that is not a JSON
+// object (unparseable, null, an array, a bare scalar) is replaced by `{}` and REPORTED to stderr.
+// `plugins` is the existing array MINUS any entry whose package is this plugin dir, PLUS one
+// `{ package: OPENCODE_V2_PLUGIN_DIR, options }` — so two calls leave exactly one entry and any other
+// plugin entry survives. A non-array `plugins` is replaced by `[]` and reported the same way. When the
+// caller passes `options.switch_model` (WP-4), the inline `model` is set too (R-4, D-4). Always
+// returns a JSON string.
+function opencodeV2PluginProjection({ existingConfigContent, options } = {}) {
+  const raw = existingConfigContent === undefined || existingConfigContent === null ? '' : String(existingConfigContent);
+  let config = {};
+  if (raw.trim() !== '') {
+    let parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = null; // expected: an unparseable existing value is replaced and reported below
+    }
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) config = parsed;
+    else {
+      /* REPORT: the launch's existing inline config could not be parsed and is being discarded. */
+      process.stderr.write('[subagent-pick] existing OPENCODE_CONFIG_CONTENT discarded (existing_config_unparseable)\n');
+    }
+  }
+  const existingPlugins = Array.isArray(config.plugins) ? config.plugins : null;
+  if (existingPlugins === null && config.plugins !== undefined) {
+    /* REPORT: a non-array plugin list is discarded so the CTM plugin entry has somewhere to live. */
+    process.stderr.write('[subagent-pick] existing OpenCode plugins list discarded (plugins_not_array)\n');
+  }
+  const kept = (existingPlugins || []).filter((entry) => !(entry && typeof entry === 'object' && entry.package === OPENCODE_V2_PLUGIN_DIR));
+  const next = { ...config, plugins: [...kept, { package: OPENCODE_V2_PLUGIN_DIR, options }] };
+  const sw = options && typeof options === 'object' ? options.switch_model : null;
+  if (sw && typeof sw === 'object') next.model = String(sw.model && sw.model.providerID) + '/' + String(sw.model && sw.model.id);
+  return JSON.stringify(next);
+}
+
+// PURE: the switch target of a v2 RESTORE launch, derived EXACTLY like opencodeV1CarrierEnv's target:
+// a native `provider/model` pick wins, else a routed relaunch's fixed ref ctm-lead/lead, else ''. ''
+// means "no switch" -- a fresh launch, a worker, or a restore with no target at all.
+function opencodeV2SwitchTarget({ isRestore, nativeModel, launchLeadRoute } = {}) {
+  if (isRestore !== true) return '';
+  if (typeof nativeModel === 'string' && nativeModel) return nativeModel;
+  if (launchLeadRoute && typeof launchLeadRoute === 'object') return require('./opencode-lead-provider').OPENCODE_LEAD_MODEL_REF;
+  return '';
+}
+
+// PURE: split a target ref at the FIRST '/' into the 2.x plugin's `switch_model` argument (R-4). null
+// for a missing ref, no '/', an empty side, or an empty session id -- the cases where nothing may be
+// switched (an unqualified target simply carries no `switch_model`, it is never guessed).
+function opencodeV2SwitchModel(target, sessionID) {
+  if (typeof target !== 'string' || !target) return null;
+  const sid = String(sessionID == null ? '' : sessionID);
+  if (!sid) return null;
+  const at = target.indexOf('/');
+  if (at <= 0 || at === target.length - 1) return null;
+  const providerID = target.slice(0, at);
+  const id = target.slice(at + 1);
+  if (!providerID || !id) return null;
+  return { sessionID: sid, model: { providerID, id } };
+}
+
+// PURE: the `switch_model` a v2 plugin env carries (or null), read from the SAME inline blob OpenCode
+// receives -- so the spawn diagnostic can never disagree with what the plugin was handed.
+function opencodeV2SwitchModelOf(spawnEnv) {
+  if (!spawnEnv) return null;
+  let config = null;
+  try {
+    config = JSON.parse(String(spawnEnv.OPENCODE_CONFIG_CONTENT || ''));
+  } catch {
+    /* expected: a blob that is not JSON is one the projection never wrote, so it carries no switch */
+    return null;
+  }
+  const entries = config && typeof config === 'object' && Array.isArray(config.plugins) ? config.plugins : [];
+  const mine = entries.find((e) => e && typeof e === 'object' && e.package === OPENCODE_V2_PLUGIN_DIR);
+  const sw = mine && mine.options && typeof mine.options === 'object' ? mine.options.switch_model : null;
+  return sw && typeof sw === 'object' ? sw : null;
+}
+
+// PURE: the OpenCode 2.x spawn-path decision, the v2 twin of opencodeV1CarrierEnv above. Every v2 LEAD
+// launch carries the plugin, so unlike the 1.x carrier this is not gated on a restore. Returns
+// `spawnEnv` UNCHANGED (same object) unless agentType==='opencode', agentRole!=='worker', line==='v2'
+// and the launch argv names a session id (WP-1 puts `--session ses_…` on every v2 launch); then
+// `{ ...spawnEnv, OPENCODE_CONFIG_CONTENT: projection }` carrying identity from the same spawn env.
+// WP-4 (R-4): a RESTORE also carries `switch_model` (native target, else ctm-lead/lead) -- the project-
+// ion then sets the inline `model` too, so a never-prompted tab is seeded and an existing one switched.
+function opencodeV2PluginEnv({ agentType, isRestore, agentRole, line, nativeModel, launchLeadRoute, launchArgs, spawnEnv }) {
+  if (!spawnEnv || agentType !== 'opencode' || agentRole === 'worker' || line !== 'v2') return spawnEnv;
+  const sessionId = opencodeResumeSessionId(launchArgs);
+  if (!sessionId) return spawnEnv;
+  const options = {
+    ctm_port: String(spawnEnv.CTM_PORT || ''),
+    ctm_session_id: String(spawnEnv.CTM_SESSION_ID || ''),
+    process_generation: String(spawnEnv.CTM_MODEL_PROCESS_GENERATION || ''),
+    session_id: sessionId,
+  };
+  const switchModel = opencodeV2SwitchModel(opencodeV2SwitchTarget({ isRestore, nativeModel, launchLeadRoute }), sessionId);
+  if (switchModel) options.switch_model = switchModel;
+  return { ...spawnEnv, OPENCODE_CONFIG_CONTENT: opencodeV2PluginProjection({ existingConfigContent: spawnEnv.OPENCODE_CONFIG_CONTENT, options }) };
+}
+
 /**
  * PURE: no fs, no env reads. Same input -> same output.
- * @param {{ kind: string, agent?: 'claude'|'codex', model?: string, effort?: string }|null} pick
- * @param {{ agent?: 'claude'|'codex', leadRoute?: object|null, dataDir?: string }} options
+ * @param {{ kind: string, agent?: 'claude'|'codex'|'opencode', model?: string, effort?: string }|null} pick
+ * @param {{ agent?: 'claude'|'codex'|'opencode', leadRoute?: object|null, dataDir?: string, codexVersion?: string,
+ *            existingConfigContent?: string }} options
+ *   `codexVersion` is the version of the Codex binary THIS launch spawns (''/absent = unknown). The
+ *   deny prefix carries a config key that older Codex builds cannot load, so it is applied only at or
+ *   above CODEX_NATIVE_SUBAGENT_DENY_MIN_VERSION; an unknown version never denies.
  * @returns {{ env: Record<string,string>, deleteEnv: string[], codexArgs: string[],
- *            leadProxy: null|{alias:string}, roleFile: null|{path:string, contents:string} }}
+ *            leadProxy: null|{alias:string}, roleFile: null|{path:string, contents:string},
+ *            nativeSubagents: ''|'disabled' }}
  */
 function planSubagentLaunch(pick, options) {
   const opts = options || {};
-  // kind 'none' | 'unservable' (or a missing pick) is the byte-identical baseline: zero env keys,
-  // zero argv items, no role file (D-1).
+  // WP-1 (§5 D-2/D-3): a Codex pick that resolves `unservable` for any reason OTHER than
+  // `codex_inherit_unenforceable` is a ROUTED stored lane native children cannot reach, so this
+  // launch refuses them: the deny prefix rides the SAME `codexArgs` prepend as a native role file
+  // (D-5), with no env, no role file and no lead proxy. WP-1b: only when this launch's own Codex is
+  // new enough to know the config key. Unknown = not denied, so the compare's `null` (an unparseable
+  // side) is excluded EXPLICITLY: `null >= 0` is true in JavaScript (relational comparison coerces
+  // null to 0), so relying on the bare `>=` would deny every unprobed launch.
+  const codexVersionRank = compareSemver(opts.codexVersion, CODEX_NATIVE_SUBAGENT_DENY_MIN_VERSION);
+  if (nativeSubagentsDenied(pick) && codexVersionRank !== null && codexVersionRank >= 0) {
+    return {
+      env: {},
+      deleteEnv: [],
+      codexArgs: [...CODEX_NATIVE_SUBAGENT_DENY_ARGS],
+      leadProxy: null,
+      roleFile: null,
+      nativeSubagents: 'disabled',
+    };
+  }
+  // kind 'none' | `codex_inherit_unenforceable` | any Claude unservable | a missing pick is the
+  // byte-identical baseline: zero env keys, zero argv items, no role file (D-1).
   if (!pick || (pick.kind !== 'native' && pick.kind !== 'inherit' && pick.kind !== 'routed')) {
-    return { env: {}, deleteEnv: [], codexArgs: [], leadProxy: null, roleFile: null };
+    return { env: {}, deleteEnv: [], codexArgs: [], leadProxy: null, roleFile: null, nativeSubagents: '' };
   }
 
   const agent = pick.agent || opts.agent;
@@ -355,6 +768,14 @@ function planSubagentLaunch(pick, options) {
     return _codexPlan(model, effort, opts.dataDir);
   }
 
+  if (agent === 'opencode') {
+    // §5 R-10/§6.5: the OpenCode lane is per-launch inline config only. A native pick names the
+    // model on OpenCode's two built-in subagents; an inherit pick emits nothing (see
+    // opencodeLaunchProjection). No role file, no argv, no lead proxy.
+    const projection = opencodeLaunchProjection({ pick, existingConfigContent: opts.existingConfigContent });
+    return { env: projection.env, deleteEnv: [], codexArgs: [], leadProxy: null, roleFile: null, nativeSubagents: '' };
+  }
+
   // D-2/D-3/D-4: the Claude side is env-only. FORCE is what defeats per-call models, Explore and
   // frontmatter (C5-C7); without it a pick would be advisory only.
   if (pick.kind === 'inherit') {
@@ -364,6 +785,7 @@ function planSubagentLaunch(pick, options) {
       codexArgs: [],
       leadProxy: null,
       roleFile: null,
+      nativeSubagents: '',
     };
   }
   if (pick.kind === 'native') {
@@ -373,6 +795,7 @@ function planSubagentLaunch(pick, options) {
       codexArgs: [],
       leadProxy: null,
       roleFile: null,
+      nativeSubagents: '',
     };
   }
 
@@ -383,6 +806,7 @@ function planSubagentLaunch(pick, options) {
     codexArgs: [],
     leadProxy: null,
     roleFile: null,
+    nativeSubagents: '',
   };
   if (!opts.leadRoute) {
     // D-4: the lead is not on the proxy, so the launcher has to put it on one. It registers the
@@ -444,6 +868,11 @@ function projectSubagentPick(subagentPick) {
       source: String(subagentPick.source || ''),
       origin: String(subagentPick.origin || ''),
       ...(subagentPick.reason ? { reason: subagentPick.reason } : {}),
+      // WP-1 (§5 D-4): the fact the LAUNCH recorded, never a re-derivation from today's rule. The
+      // key is additive and only present when this launch actually carried the deny ('' is the
+      // separate "known not denied" state, null/absent = unknown) -- a session launched before the
+      // deny existed must never be described as denied.
+      ...(typeof subagentPick.nativeSubagents === 'string' ? { native_subagents: subagentPick.nativeSubagents } : {}),
     };
   }
   return subagentPick.reason && subagentPick.reason !== 'vendor'
@@ -467,6 +896,10 @@ function projectLaunchRow(row) {
     source: String(row.source || ''),
     origin: String(row.origin || ''),
     ...(row.reason ? { reason: row.reason } : {}),
+    // WP-1 (§5 D-4, v58): what the persisted launch DID about native sub-agents. null = a pre-v58
+    // row (unknown), '' = a known "not denied", 'disabled' = this launch carried the deny prefix.
+    // A malformed stored value never claims a deny -- the WRITE validates, the read does not trust.
+    native_subagents: row.native_subagents === '' || row.native_subagents === 'disabled' ? row.native_subagents : null,
   };
 }
 
@@ -474,6 +907,22 @@ module.exports = {
   resolveSubagentPick,
   reconcileMirrorDefaults,
   planSubagentLaunch,
+  nativeSubagentsDenied,
+  CODEX_NATIVE_SUBAGENT_DENY_ARGS,
+  CODEX_NATIVE_SUBAGENT_DENY_MIN_VERSION,
+  opencodeLaunchProjection,
+  opencodeWalleMcpProjection,
+  opencodeLeadRouteProjection,
+  opencodeV1CarrierProjection,
+  opencodeResumeSessionId,
+  opencodeV1CarrierEnv,
+  OPENCODE_V1_CARRIER_URL,
+  opencodeV2PluginProjection,
+  opencodeV2PluginEnv,
+  opencodeV2SwitchModel,
+  opencodeV2SwitchTarget,
+  opencodeV2SwitchModelOf,
+  OPENCODE_V2_PLUGIN_DIR,
   appliedNativeEffort,
   projectSubagentPick,
   projectLaunchRow,

package/template/coding-task-manager/lib/session-create/transcript.js

@@ -148,7 +148,7 @@ async function createWalleSession(state) {
     deps.sendWalleSessionHistory(ws, session, { source: 'walle-resume' })
       .catch((error) => deps.sendWalleHistoryErrorFrame(ws, id, {}, error));
   }
-  deps.broadcastSessionList(true);
+  deps.broadcastSessionList(true, { reason: 'walle-session-created' });
   if (initialMessage) {
     setImmediate(() => {
       deps.handleWalleMessage(ws, {

package/template/coding-task-manager/lib/session-create/worker-budget-setup.js

@@ -10,14 +10,24 @@ function isProxiedRecipe(recipe) {
 }
 
 // Copy the proxy's journaled stop record into the worker row, so every later status read sees it.
+// C7-B2-P1 (docs/worker-deferred-stop-record-generation-2026-10-27.html §5 D1/D3, §6): the copy is
+// fenced by the numeric generation this call was HANDED -- the one the exit path read BEFORE the awaited
+// journal read -- against the row's existing `Number(row.generation) || 1` interpretation. A row that is
+// absent, or whose number moved while the read was in flight, is observed only: no merge and no write.
+// This is a fence across one await on a numeric column, not a claim of physical launch identity and not
+// a claim that a numeric generation can never be reused (D4).
 async function persistStopRecord(db, ctmSessionId, generation) {
   const record = await readStopRecord({ ctmSessionId, generation });
   if (!record) return null;
   try {
     const row = db.getWorkerSession(ctmSessionId);
+    // Observation only: nothing is copied into a row this call cannot confirm still owns `generation`.
+    if (!row || (Number(row.generation) || 1) !== generation) return record;
     let runtime = {};
     try { runtime = JSON.parse(row.runtime_json) || {}; } catch { /* expected: a malformed runtime row is treated as empty */ }
-    db.updateWorkerSession(ctmSessionId, { runtime_json: JSON.stringify({ ...runtime, requestBudget: { ...(runtime.requestBudget || {}), stop: record, terminalCode: record.kind } }) });
+    // The merge is unchanged; the captured generation travels beside the patch as the existing helper's
+    // storage predicate, so a row that advanced since the read above matches zero rows.
+    db.updateWorkerSession(ctmSessionId, { runtime_json: JSON.stringify({ ...runtime, requestBudget: { ...(runtime.requestBudget || {}), stop: record, terminalCode: record.kind } }) }, { expectedGeneration: generation });
   } catch (error) {
     console.warn(`[worker-budget-setup] stop record not persisted (${String(error && error.code || 'persist_failed').slice(0, 48)})`);
   }
@@ -46,11 +56,20 @@ function initialSnapshot(generation, policy, capabilityRevision = '') {
 }
 
 // Proxied: persist the journaled stop (if any), then run(); proxyless (or no readable row): run() synchronously, as before.
+// C7-B2-P1 (§5 D2/D3, §6): the numeric generation read BEFORE the await is retained across it and handed
+// to run(), which never re-derives its target from a post-await status or runtime. The post-await recheck
+// sits INSIDE the existing catch boundary (it is part of the returned chain), so an unreadable current row
+// reports on the existing path and no callback runs -- including when the journal read returned null.
 function retireAfterStopRecord(getDb, ctmSessionId, readRecipe, run) {
   let db = null, row = null;
   try { db = getDb(); row = db.getWorkerSession(ctmSessionId); } catch { row = null; /* expected: an unreadable row is handled as proxyless */ }
   if (!row || !isProxiedRecipe(readRecipe(row))) return run();
-  return persistStopRecord(db, ctmSessionId, Number(row.generation) || 1).then(run)
+  const generation = Number(row.generation) || 1;
+  return persistStopRecord(db, ctmSessionId, generation).then(() => {
+    const current = db.getWorkerSession(ctmSessionId);
+    if (!current || (Number(current.generation) || 1) !== generation) return;
+    return run(generation);
+  })
     .catch((error) => { console.warn(`[worker-budget-setup] retire after exit failed (${String(error && error.code || 'retire_failed').slice(0, 48)})`); /* REPORT: the row stays un-stamped; the boot reload retries */ });
 }
 

package/template/coding-task-manager/lib/session-create/worker-continuation.js

@@ -128,7 +128,7 @@ function _validRecipe(row) {
   const agent = String(row.agent || recipe.agent || '');
   const route = String(row.route_alias || recipe.route || '');
   const model = String(row.model || recipe.model || '');
-  if (!['claude', 'codex'].includes(agent) || !route || !model) return null;
+  if (!['claude', 'codex', 'dsh'].includes(agent) || !route || !model) return null;
   if (recipe.route && recipe.route !== route) return null;
   if (recipe.model && recipe.model !== model) return null;
   return { ...recipe, briefPath: recipe.renderedBriefPath || recipe.briefPath, agent, route, model };
@@ -326,6 +326,12 @@ function createWorkerContinuation({ getDeps, admission = admissionDefault, helpe
 
     const recipe = _validRecipe(row);
     if (!recipe) return blocked('worker_recipe_missing', 'The durable worker launch recipe is unavailable.', { ctm_session_id: id });
+    // WP-14 (deepseek-harness-acp-agent-2026-10-28 D-21): a dsh worker is an ACP child, and this path
+    // relaunches an argv CLI against its provider transcript. Until ACP session/resume is wired here,
+    // refuse explicitly instead of launching the wrong process.
+    if (recipe.agent === 'dsh') {
+      return blocked('worker_resume_unsupported', 'A DeepSeek Harness worker cannot be resumed yet; delegate a new worker with the correction.', { ctm_session_id: id, retryable: false });
+    }
     const oldProfile = recipe.workerProfile || 'legacy';
     // D-11 (routed-worker-visibility-and-review-workers-2026-10-16.html): a review recipe is
     // capability-pinned exactly like an implementation one.