create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/landing/window.js

@@ -0,0 +1,57 @@
+'use strict';
+// WP-1 (docs/landing-pipeline-batched-multi-host-2026-10-30.html §5 D-3, §6, §8 WP-1, §9 S-1):
+// the adaptive batch window.
+//
+// The window is how many runnable queued jobs one gate is asked to cover. It is Zuul's rule: +1 on a
+// batch PASS (up to `landing.batch.max`), halve on a batch FAIL (never below 1). A window of 1 is
+// exactly the serial queue that existed before this change, so a repository that never writes the
+// file keeps today's behaviour.
+//
+// State lives at `<landing-dir>/window.json` — the same directory, the same atomic writer and the
+// same `contract` stamp as every other file the queue owns (`state.js`). Nothing here reads git,
+// spawns a process or knows about jobs: it is one integer and one transition.
+
+const path = require('path');
+
+const state = require('./state');
+
+const DEFAULT_SIZE = 1;
+const FILE = 'window.json';
+
+function windowFile(root) {
+  return path.join(root, FILE);
+}
+
+function normalize(raw) {
+  if (!raw || typeof raw !== 'object') return DEFAULT_SIZE;
+  // Strictly a number: a `"8"` written by hand is a malformed window, and the safe reading of a
+  // malformed window is the serial one.
+  if (typeof raw.size !== 'number' || !Number.isInteger(raw.size) || raw.size < 1) return DEFAULT_SIZE;
+  return raw.size;
+}
+
+// `{ size }`, defaulting to `{ size: 1 }` when the file is absent, unreadable or malformed — an
+// unknown window is the conservative one (today's serial behaviour), never a silent batch of eight.
+function readWindow(root) {
+  return { size: normalize(state.readJsonSafe(windowFile(root))) };
+}
+
+// D-3: the transition, read-modify-write inside the queue's mutex (the runner is the only writer, but
+// the file lives beside every other piece of shared state and gets the same protection). `max` is the
+// ceiling (`landing.batch.max`, ≥ 1): a PASS never grows past it and a FAIL never shrinks below 1.
+function bumpWindow(root, verdict, max) {
+  const ceiling = Number.isInteger(max) && max >= 1 ? max : DEFAULT_SIZE;
+  return state.withMutex(root, () => {
+    const before = readWindow(root).size;
+    const size = verdict === 'PASS' ? Math.min(before + 1, ceiling) : Math.max(Math.floor(before / 2), 1);
+    state.writeJsonAtomic(windowFile(root), { contract: state.CONTRACT, size });
+    return { size, before };
+  });
+}
+
+module.exports = {
+  DEFAULT_SIZE,
+  windowFile,
+  readWindow,
+  bumpWindow,
+};

package/template/coding-task-manager/lib/launch-environment.js

@@ -0,0 +1,121 @@
+'use strict';
+
+// WP-0 of docs/launch-environment-host-carried-adoption-2026-10-26.html (§5 D-1, §6).
+//
+// ONE rule-versioned capture function for the per-session launch environment. The record it produces is a
+// self-describing OBSERVATION -- { rule, state, values, reason } -- never a verdict about the session: it
+// carries the rule that produced it (LAUNCH_ENV_RULE) so a later reader can convert a record written under
+// an older rule (see lib/adopted-launch-environment.js, WP-2) instead of guessing. `rule` is an ordinal,
+// not a content hash; the hash of the rule's inputs lives in tests/launch-environment.test.js
+// (launchEnvironmentRuleDigest) so changing a projected key, a bound or the credential regex without
+// bumping LAUNCH_ENV_RULE fails loudly.
+//
+// Dependency-free on purpose: node:crypto (rule digest) and node:buffer (byte bounds). No fs, no config.
+
+const crypto = require('node:crypto');
+const { Buffer } = require('node:buffer');
+
+// Rule 2 = "the projected launch-context keys HOME/CODEX_HOME/TMPDIR are not private" (the rule since
+// 4768eeced3); rule 1 = the pre-2026-10-25 reading.
+const LAUNCH_ENV_RULE = 2;
+
+// The keys a lead-model switch re-projects into the launch context (lib/lead-model-restore-reconciliation.js
+// projectDeferredRestoreLaunch: HOME / CODEX_HOME from the launch context, TMPDIR alongside them). They are
+// PROJECTED launch context, not per-session private overrides: a spawn still receives them, but their presence
+// must never turn an otherwise empty override set into a private environment that only a surviving owner can
+// reproduce. Anything else in the env is private and is captured by value.
+const PROJECTED_LAUNCH_CONTEXT_KEYS = Object.freeze(['HOME', 'CODEX_HOME', 'TMPDIR']);
+
+// Bounds of a capturable private environment (moved here from lib/lead-model-restore-reconciliation.js).
+const MAX_SOURCE_ENV_ENTRIES = 64;
+const MAX_SOURCE_ENV_BYTES = 32 * 1024;
+const MAX_SOURCE_ENV_VALUE_BYTES = 8 * 1024;
+
+// A key whose value is credential-shaped must never be written to a handoff manifest file.
+const CREDENTIAL_KEY_RE = /(?:API_KEY|AUTH_TOKEN|_TOKEN|SECRET|PASSWORD|CREDENTIAL)/i;
+
+const LAUNCH_ENV_STATES = Object.freeze(['captured', 'captured-empty', 'unavailable']);
+const LAUNCH_ENV_REASONS = Object.freeze(['not_object', 'too_many_entries', 'bad_key', 'bad_value',
+  'too_many_bytes', 'credential_keys', 'legacy_worker_private_env', 'legacy_no_receipt']);
+
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+
+/** Returns a NEW object holding only the non-projected entries of `env`; never mutates its input and maps a
+ * non-object to `{}`. */
+function privateOverridesFromEnv(env) {
+  if (!env || typeof env !== 'object' || Array.isArray(env)) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (!PROJECTED_LAUNCH_CONTEXT_KEYS.includes(key)) out[key] = value;
+  }
+  return out;
+}
+
+function unavailable(reason) {
+  return Object.freeze({ rule: LAUNCH_ENV_RULE, state: 'unavailable', values: null, reason });
+}
+
+/** Captures a raw per-session private environment. Frozen result; never throws. */
+function captureLaunchEnvironment(privateEnv) {
+  if (!privateEnv || typeof privateEnv !== 'object' || Array.isArray(privateEnv)) return unavailable('not_object');
+  const entries = Object.entries(privateEnv);
+  if (entries.length > MAX_SOURCE_ENV_ENTRIES) return unavailable('too_many_entries');
+  const values = {};
+  let bytes = 0;
+  for (const [key, value] of entries) {
+    if (!ENV_KEY_RE.test(key)) return unavailable('bad_key');
+    if (typeof value !== 'string' || value.includes('\0')
+        || Buffer.byteLength(value, 'utf8') > MAX_SOURCE_ENV_VALUE_BYTES) return unavailable('bad_value');
+    bytes += Buffer.byteLength(key, 'utf8') + Buffer.byteLength(value, 'utf8');
+    if (bytes > MAX_SOURCE_ENV_BYTES) return unavailable('too_many_bytes');
+    values[key] = value;
+  }
+  const state = entries.length ? 'captured' : 'captured-empty';
+  return Object.freeze({ rule: LAUNCH_ENV_RULE, state, values: Object.freeze(values), reason: null });
+}
+
+// A record is a NEW frozen object rebuilt from validated fields: a tampered record (extra fields, a
+// non-frozen values object, values that no longer satisfy the bounds) never reaches a caller as itself.
+function normalizeLaunchEnvironment(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (value.rule !== LAUNCH_ENV_RULE || !LAUNCH_ENV_STATES.includes(value.state)) return null;
+  if (value.state === 'unavailable') {
+    if (typeof value.reason !== 'string' || !LAUNCH_ENV_REASONS.includes(value.reason)) return null;
+    if (value.values !== null) return null;
+    return Object.freeze({ rule: LAUNCH_ENV_RULE, state: 'unavailable', values: null, reason: value.reason });
+  }
+  if (value.reason !== null) return null;
+  const recaptured = captureLaunchEnvironment(value.values);
+  if (recaptured.state !== value.state) return null;
+  return Object.freeze({ rule: LAUNCH_ENV_RULE, state: value.state, values: recaptured.values, reason: null });
+}
+
+/** Validator in the `modelStorageRootsMetadata` style: `{}` or `{ launchEnvironment: frozenRecord }` so a
+ * caller spreads it. Only rule-2 records whose declared state agrees with a re-capture are accepted. With
+ * `{ manifest: true }` a record whose values hold a CREDENTIAL_KEY_RE key is REWRITTEN to
+ * `{ rule, state:'unavailable', values:null, reason:'credential_keys' }` (so no secret reaches the 0600
+ * manifest file); the other record keeps its values. */
+function launchEnvironmentMetadata(value, { manifest = false } = {}) {
+  const record = normalizeLaunchEnvironment(value);
+  if (!record) return {};
+  if (manifest && record.values && Object.keys(record.values).some((key) => CREDENTIAL_KEY_RE.test(key))) {
+    return { launchEnvironment: Object.freeze({ rule: LAUNCH_ENV_RULE, state: 'unavailable', values: null,
+      reason: 'credential_keys' }) };
+  }
+  return { launchEnvironment: record };
+}
+
+/** sha256 over the rule's inputs: projected keys, bounds and the credential regex. Pinned in
+ * tests/launch-environment.test.js -- bump LAUNCH_ENV_RULE and add a converter case when it changes. */
+function launchEnvironmentRuleDigest() {
+  return crypto.createHash('sha256').update(JSON.stringify({
+    rule: LAUNCH_ENV_RULE,
+    projected: PROJECTED_LAUNCH_CONTEXT_KEYS,
+    limits: [MAX_SOURCE_ENV_ENTRIES, MAX_SOURCE_ENV_BYTES, MAX_SOURCE_ENV_VALUE_BYTES],
+    credentialRe: CREDENTIAL_KEY_RE.source,
+  })).digest('hex');
+}
+
+module.exports = { LAUNCH_ENV_RULE, PROJECTED_LAUNCH_CONTEXT_KEYS, LAUNCH_ENV_STATES, LAUNCH_ENV_REASONS,
+  privateOverridesFromEnv, captureLaunchEnvironment, launchEnvironmentMetadata, launchEnvironmentRuleDigest,
+  MAX_SOURCE_ENV_ENTRIES, MAX_SOURCE_ENV_BYTES, MAX_SOURCE_ENV_VALUE_BYTES, CREDENTIAL_KEY_RE };

package/template/coding-task-manager/lib/launch-model-override.js

@@ -23,12 +23,8 @@ const {
   CLAUDE_OPTION_SIGNATURES, CLAUDE_SHORT_OPTIONS, locateClaudeSettingsArg,
 } = require('./native-lead-settings-argv');
 
-const MODEL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:/@+\-[\]]*$/;
-const MAX_MODEL_ID_LENGTH = 200;
-
-function isValidOverrideModel(model) {
-  return typeof model === 'string' && model.length > 0 && model.length <= MAX_MODEL_ID_LENGTH && MODEL_ID_RE.test(model);
-}
+// The ONE model-id rule lives in a leaf module (the session host loads it); re-exported here.
+const { isValidOverrideModel } = require('./model-id-rule');
 
 // Drops an existing `--model X` / `--model=X` / `-m X` / `-m=X` so the override is the only model flag.
 function stripModelFlags(args) {
@@ -42,12 +38,30 @@ function stripModelFlags(args) {
   return out;
 }
 
+// OpenCode's OWN launcher form (docs/opencode-lead-and-delegate-model-selection-2026-10-28.html §6.3,
+// R-8): the TUI's global flags come first and `--model` is spelled the long way only. Kept separate
+// from `stripModelFlags` above so the Claude/Codex argv grammar (where `-m` is the Codex global and
+// the model flag is appended/anchored) is never changed by an OpenCode-only rule.
+function stripOpencodeModelFlags(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = String(args[i]);
+    if (arg === '--model' || arg === '-m') { i += 1; continue; }
+    if (arg.startsWith('--model=') || arg.startsWith('-m=')) continue;
+    out.push(args[i]);
+  }
+  return out;
+}
+
 /**
- * @param {{ agentType: string, args: string[], model: unknown }} input
+ * @param {{ agentType: string, args: string[], model: unknown, line?: 'v1'|'v2'|null }} input
+ *   `line` is the OpenCode binary's shape (lib/opencode-cli.js). It matters ONLY for
+ *   `agentType === 'opencode'`; every other agent ignores it, and `null`/absent keeps the 1.x
+ *   behaviour byte-identical.
  * @returns {{ args: string[], applied: boolean, reason: string }}
  *   applied=false returns the input args untouched (same array) with the reason why.
  */
-function applyLaunchModelOverride({ agentType, args, model } = {}) {
+function applyLaunchModelOverride({ agentType, args, model, line } = {}) {
   const list = Array.isArray(args) ? args : [];
   if (model == null || model === '') return { args: list, applied: false, reason: 'none' };
   if (!isValidOverrideModel(model)) return { args: list, applied: false, reason: 'invalid_model' };
@@ -68,6 +82,18 @@ function applyLaunchModelOverride({ agentType, args, model } = {}) {
     const head = stripModelFlags(list.slice(0, resumeIdx));
     return { args: [...head, '-m', model, ...list.slice(resumeIdx)], applied: true, reason: '' };
   }
+  if (agentType === 'opencode') {
+    // 2.x (R-4, WP-4): the TUI rejects `--model`, so the target never touches this argv. Strip every
+    // prior model flag so a stale one cannot survive either; the model rides the inline config +
+    // plugin `switch_model` the spawn path writes (lib/session-create/subagent-pick.js
+    // opencodeV2PluginEnv). `applied:true` records that the switch IS carried, just not here.
+    if (line === 'v2') return { args: stripOpencodeModelFlags(list), applied: true, reason: 'opencode-v2-plugin-carrier' };
+    // 1.x: OpenCode takes its global flags first; strip every prior model flag (`--model X`,
+    // `--model=X`, `-m X`, `-m=X`). This rides a FRESH relaunch only (a resumed 1.x conversation
+    // keeps the model its last user message recorded -- §5 R-4), so the launcher never has to
+    // reconcile a resume.
+    return { args: ['--model', model, ...stripOpencodeModelFlags(list)], applied: true, reason: '' };
+  }
   return { args: list, applied: false, reason: 'unsupported_agent' };
 }
 
@@ -482,5 +508,5 @@ function applyLaunchEffortOverride(argv, agent, effort) {
 }
 
 module.exports = { applyLaunchModelOverride, isValidOverrideModel, applyLaunchEffortOverride, isValidEffort,
-  applyLaunchModelPin, stripModelFlags, insertBeforeCodexResume, rebindCodexForkLaunchPlan, ensureCodexResumeTarget,
-  ensureClaudeResumeTarget };
+  applyLaunchModelPin, stripModelFlags, stripOpencodeModelFlags, insertBeforeCodexResume, rebindCodexForkLaunchPlan,
+  ensureCodexResumeTarget, ensureClaudeResumeTarget };

package/template/coding-task-manager/lib/launch-plan-pool.js

@@ -1172,7 +1172,8 @@ function createLaunchPlanCoordinator(options = {}) {
       // (or clearing it themselves) is an implicit "always recompute".
       // An explicit replacement bypasses the cache: the caller is saying the previous plan is no
       // longer valid, so replaying it would defeat the retry it asked for.
-      const warmKey = !replacement && warmPlanCacheEnabled && spec?.warmPlanInputs ? buildWarmPlanKey(spec.warmPlanInputs) : '';
+      const warmKey = !replacement && warmPlanCacheEnabled && spec?.warmPlanInputs ? buildWarmPlanKey({ ...spec.warmPlanInputs,
+        requestedLaunch: JSON.stringify([String(spec.cmd || ''), Array.isArray(spec.args) ? spec.args.map(String) : [], String(spec.modelId || '')]) }) : '';
       if (warmKey) {
         const cachedPlan = warmPlanCache.get(sessionId, warmKey);
         if (cachedPlan && states.get(sessionId)?.generation === generation

package/template/coding-task-manager/lib/launch-plan-warm-cache.js

@@ -32,6 +32,11 @@ function buildWarmPlanKey({
   // full-MCP argv and silently ignore the setting. Defaults to '' so a caller that never
   // sets a profile keeps a stable key.
   mcpProfile = '',
+  // The REQUESTED launch (cmd, argv, model) the plan is built from. A plan is a function of the
+  // argv it was handed, so a restore asking for `--session <id>` must never be served the plan of
+  // the earlier fresh launch: an OpenCode tab has no CTM transcript, so the other inputs never move
+  // after its first prompt (opencode-v2-model-switch-standalone-plugin-2026-10-30.html revision 2).
+  requestedLaunch = '',
 } = {}) {
   return [
     Number(transcriptMtimeMs) || 0,
@@ -40,6 +45,7 @@ function buildWarmPlanKey({
     Number(codexConfigMtimeMs) || 0,
     String(cliVersionStamp || ''),
     String(mcpProfile || ''),
+    String(requestedLaunch || ''),
   ].join('\u241F');
 }
 

package/template/coding-task-manager/lib/lead-model-observer.js

@@ -53,10 +53,40 @@ function provenTurnOutcome(turn) {
   return outcome && SETTLED_OUTCOMES.has(outcome) ? outcome : null;
 }
 
+// WP-1: the owner fields every Claude observation derives from its result (`withCapturedRouteOwner`
+// then overrides them from the item's captured owner when it has one).
+function claudeObservedOwner(result) {
+  return {
+    ...(Number.isSafeInteger(result.processGeneration) ? { processGeneration: result.processGeneration } : {}),
+    ...(typeof result.providerSessionId === 'string' ? { providerThreadId: result.providerSessionId } : {}),
+    ...(typeof result.profileFingerprint === 'string' ? { profileFingerprint: result.profileFingerprint } : {}),
+    ...(typeof result.routeId === 'string' ? { routeId: result.routeId } : {}),
+  };
+}
+
+/*
+ * WP-1/D-1: a REFUSED Claude turn, as the switch consumes it. `model` is EMPTY on purpose -- the
+ * refusal names no model, which is exactly why the switch's `no_model` guard used to swallow it. The
+ * failure is only open while it is NEWER than the newest successful turn; a good turn after it wins.
+ */
+function claudeFailureObservation(failure, observedOwner) {
+  const atMs = Number(failure.atMs) || 0;
+  const status = Number.isSafeInteger(failure.status) ? failure.status : null;
+  return {
+    model: '', outcome: 'failed', apiErrorStatus: status, error: `API Error ${status == null ? 'unknown' : status}`,
+    source: 'transcript:turn', observedAtMs: atMs,
+    ...(failure.turnId ? { turnId: String(failure.turnId) } : {}),
+    ...observedOwner,
+  };
+}
+
 function turnObservationFrom(item, result) {
   if (!result) return null;
   if (item?.agentType === 'claude') {
     const truth = result.modelTruth;
+    if (truth && truth.lastTurnFailure && Number(truth.lastTurnFailure.atMs) > Number(truth.lastTurnAtMs || 0)) {
+      return withCapturedRouteOwner(claudeFailureObservation(truth.lastTurnFailure, claudeObservedOwner(result)), item);
+    }
     if (truth && truth.lastTurn && Number(truth.lastTurnAtMs) > 0) {
       return withCapturedRouteOwner({
         model: String(truth.lastTurn), effort: truth.effort || null, source: 'transcript:turn', observedAtMs: Number(truth.lastTurnAtMs),
@@ -116,8 +146,20 @@ function nativeTurnObservation(item, result) {
   const source = item?.agentType === 'claude' ? 'transcript:turn' : item?.agentType === 'codex' ? 'codex:turn-context' : null;
   if (!source || !Array.isArray(result.observations)) return null;
   let best = null;
+  // WP-1/D-1: a refused turn arrives as its OWN observation kind; it is not a turn, so it never
+  // competes for `best` -- it only wins by being newer than the newest completed turn.
+  let bestFailure = null;
   for (const o of result.observations) {
-    if (!o || o.kind !== 'completed-turn' || o.source !== source) continue;
+    if (!o || o.source !== source) continue;
+    if (o.kind === 'failed-turn') {
+      const at = Number(o.observedAtMs);
+      if (!Number.isFinite(at) || at < 0) continue;
+      if (!bestFailure || at > bestFailure.at) bestFailure = { at, status: o.apiErrorStatus, turnId: o.sourceRevision || null,
+        processGeneration: o.processGeneration, providerThreadId: o.providerSessionId || null,
+        profileFingerprint: o.profileFingerprint || null, routeId: o.routeId || null };
+      continue;
+    }
+    if (o.kind !== 'completed-turn') continue;
     if (typeof o.value !== 'string' || !o.value.length) continue;
     const at = Number(o.observedAtMs);
     if (!Number.isFinite(at) || at < 0) continue;
@@ -128,6 +170,20 @@ function nativeTurnObservation(item, result) {
         profileFingerprint: o.profileFingerprint || null, routeId: o.routeId || null,
       };
   }
+  // A refusal newer than the newest successful turn is the answer; equal timestamps keep the
+  // completed turn, matching the decoder's own (timestamp, index) preference.
+  if (bestFailure && (!best || bestFailure.at > best.observedAtMs)) {
+    return withCapturedRouteOwner({
+      model: '', outcome: 'failed', apiErrorStatus: Number.isSafeInteger(bestFailure.status) ? bestFailure.status : null,
+      error: `API Error ${Number.isSafeInteger(bestFailure.status) ? bestFailure.status : 'unknown'}`,
+      source, observedAtMs: bestFailure.at,
+      ...(bestFailure.turnId ? { turnId: String(bestFailure.turnId) } : {}),
+      ...(Number.isSafeInteger(bestFailure.processGeneration) ? { processGeneration: bestFailure.processGeneration } : {}),
+      ...(bestFailure.providerThreadId ? { providerThreadId: String(bestFailure.providerThreadId) } : {}),
+      ...(bestFailure.profileFingerprint ? { profileFingerprint: String(bestFailure.profileFingerprint) } : {}),
+      ...(bestFailure.routeId ? { routeId: String(bestFailure.routeId) } : {}),
+    }, item);
+  }
   if (!best) return null;
   const obs = { model: String(best.model), effort: best.effort, source: best.source, observedAtMs: best.observedAtMs };
   if (best.turnId) obs.turnId = String(best.turnId);

package/template/coding-task-manager/lib/lead-model-options.js

@@ -34,6 +34,10 @@ const { isValidOverrideModel, isValidEffort } = require('./launch-model-override
 const { parseClaudeModel, resolveReasoningControl } = require('../../shared/reasoning-control');
 const { scanTomlStatements } = require('./agent-hooks-codex-toml');
 const { projectNativeModelArguments } = require('./session-model-launch-policy');
+// WP-8 step 4 (§9b M-12): the ONE ACP config-option readers (lib/session-create/dsh-session.js), so the
+// picker read, the owner bind and the runtime's setModel/setEffort agree on what the bridge offers.
+const { findModelOption, findEffortOption, plainModelIdFromConfigValue, configOptionEntries } = require('./session-create/dsh-session');
+const { servesAnthropicMessages, anthropicDeployments } = require('./acp/dsh-route-patch');
 
 const fs = require('fs');
 const os = require('os');
@@ -41,7 +45,7 @@ const path = require('path');
 const { codexHome } = require('./codex-paths');
 
 const CACHE_TTL_MS = 5 * 60 * 1000;
-const SUPPORTED_AGENTS = ['claude', 'codex'];
+const SUPPORTED_AGENTS = ['claude', 'codex', 'opencode', 'dsh'];
 const ALIAS_LABELS = Object.freeze({ opus: 'Opus', sonnet: 'Sonnet', haiku: 'Haiku', fable: 'Fable' });
 // C3: the configured global is SMALL. Both the production reader and the injected-reader normalizer
 // apply this same UTF-8 byte bound, so "over the cap" is one state, not two.
@@ -374,11 +378,84 @@ function codexRows(models) {
   }));
 }
 
+// --- DeepSeek Harness routes (WP-8 step 4, §9b M-12; D-12) ------------------------------------------
+// dsh takes NO argv model (D-12) and has no CLI catalog of its own: its Lead rows are the Wall-E routes
+// that can carry an ACP child, one row per (route, model). The predicate is lib/acp/dsh-route-patch.js's
+// own pair — the route advertises `anthropic-messages` in `upstream_apis` AND has at least one
+// `anthropic-messages` deployment (pi-ai's Bearer path exists only on that wire, D-21) — so the picker,
+// the create card and `prepareDshRoute` can never disagree about which routes exist. Read from the SAME
+// redacted worker-route feed the dsh launch uses (`oauthProxySupervisor.listWorkerRoutes()`, the
+// `dshRouteDeps.listRoutes` wiring in server.js).
+function dshRoutesFromFeed(routes) {
+  const out = [];
+  for (const route of (Array.isArray(routes) ? routes : [])) {
+    if (!route || typeof route.id !== 'string' || !route.id) continue;
+    if (route.enabled === false || route.enabled === 0 || route.routable === false) continue;
+    if (!servesAnthropicMessages(route)) continue;
+    const models = [];
+    for (const deployment of anthropicDeployments(route)) {
+      const wire = deployment.wireModelId.trim();
+      if (wire && !models.includes(wire)) models.push(wire);
+    }
+    if (!models.length) continue;
+    out.push({ routeAlias: String(route.id), name: String(route.name || route.display_name || route.id), models });
+  }
+  return out;
+}
+
+// Production's route reader: the worker-route feed above, projected into `[{routeAlias, name, models}]`.
+// Lazy for the same reason as `listOpencodeModels` below: a caller that injects its own reader (every
+// test, and a host that already holds one) never loads the proxy supervisor.
+async function defaultListDshRoutes() {
+  return dshRoutesFromFeed(await require('./oauth-proxy-supervisor').listWorkerRoutes());
+}
+
+// The live ACP child's own `configOptions` for this session, or null when it is not running. The
+// production runtime holds them in memory on its own process entry
+// (`lib/acp/dsh-session-runtime.js` `get(id).configOptions`, §9b M-16), so the wiring belongs where
+// that runtime instance is in scope (the `createLeadModelOptions` call site). With no reader the tab
+// still answers (gateway rows only), which is exactly what a parked/childless dsh session gets.
+const noDshConfigOptions = () => null;
+
+// WP-8 step 4 (§9b M-12): a dsh tab ALSO offers the models ITS OWN live child advertises on the route
+// it is running right now. Those rows carry NO `route_id` (the same route), so a pick from them is an
+// in-place `session/set_config_option` and never a relaunch (WP-8 step 3). Built fresh on every get —
+// never cached with the route rows, which describe Wall-E's catalog, not this child — and the caller's
+// cached `value` object is never mutated.
+function dshSessionRows(agent, value, sessionId, getDshConfigOptions) {
+  if (agent !== 'dsh') return value;
+  let configOptions = null;
+  try { configOptions = getDshConfigOptions(String(sessionId || '')); }
+  catch (error) { void error; /* REPORT: a failing reader means "no live child", i.e. gateway rows only */ }
+  if (!Array.isArray(configOptions) || !configOptions.length) return value;
+  const modelOption = findModelOption(configOptions);
+  const rows = [];
+  for (const entry of configOptionEntries(modelOption)) {
+    const plain = plainModelIdFromConfigValue(entry.value);
+    if (!plain) continue;
+    rows.push({ kind: 'model', value: plain, label: entry.name || plain });
+  }
+  const effortOption = findEffortOption(configOptions);
+  const levels = configOptionEntries(effortOption).map((entry) => entry.value);
+  return {
+    ...value,
+    rows: rows.concat(Array.isArray(value.rows) ? value.rows : []),
+    efforts: { values: levels, model_default: null },
+  };
+}
+
 /**
  * @param {object} deps
  * @param {(sessionId: string) => ({ type: string, agent: string|null }|null)} deps.getSessionInfo
  * @param {() => Promise<object[]>} deps.loadCatalog   Wall-E coding-catalog rows (rejects when Wall-E is unreachable)
  * @param {() => Promise<{ state: string, reason?: string, error?: string, models: object[] }>} deps.listCodexModels
+ * @param {(opts?: object) => Promise<object[]>} [deps.listOpencodeModels]  `<opencode> models --verbose`
+ *   rows (lib/opencode-cli.js `opencodeCatalog`). Rejects with `.code === 'opencode_catalog_unavailable'`.
+ * @param {() => Promise<object[]>} [deps.listDshRoutes]  the Anthropic-messages routes a dsh child may
+ *   run on, `[{ routeAlias, name, models: string[] }]`. Absent = the real worker-route feed
+ *   (lib/oauth-proxy-supervisor.js `listWorkerRoutes()`); rejects into `list_error`.
+ * @param {(sessionId: string) => (object[]|null)} [deps.getDshConfigOptions]  the live dsh child's own
+ *   ACP `configOptions`, or null/absent when it is not running (gateway rows only).
  * @param {() => ({ path?: string, text: string }|{ state: string }|null|Promise<object|null>)} [deps.readClaudeSettings]
  *   `$CLAUDE_CONFIG_DIR/settings.json`, else `~/.claude/settings.json`. The legacy `{ path, text }` shape
  *   is still accepted (the path is ignored); `null` means "no config file".
@@ -388,6 +465,9 @@ function codexRows(models) {
  */
 function createLeadModelOptions({
   getSessionInfo, loadCatalog, listCodexModels,
+  listOpencodeModels = () => require('./opencode-cli').opencodeCatalog(),
+  listDshRoutes = defaultListDshRoutes,
+  getDshConfigOptions = noDshConfigOptions,
   readClaudeSettings = defaultReadClaudeSettings,
   readCodexConfigToml = defaultReadCodexConfigToml,
   now = Date.now,
@@ -405,6 +485,13 @@ function createLeadModelOptions({
   let generation = 0;
 
   async function build(agent) {
+    // OpenCode (docs/opencode-lead-and-delegate-model-selection-2026-10-28.html §6.2, R-5): the rows
+    // are the CLI's OWN `models --verbose` catalog -- Wall-E's coding catalog describes Anthropic
+    // routes, not OpenCode providers, so it is neither read nor counted here.
+    if (agent === 'opencode') return buildOpencode();
+    // dsh (docs/deepseek-harness-acp-agent-2026-10-28.html §9b M-12): its rows are the routes that can
+    // carry an ACP child, never Wall-E's coding-catalog rows (which describe Anthropic CLI providers).
+    if (agent === 'dsh') return buildDsh();
     let catalogRows = null;
     let catalogError = '';
     let catalogErrorCode = '';
@@ -456,6 +543,66 @@ function createLeadModelOptions({
     return forAgentOf(entryFor(agent));
   }
 
+  // The OpenCode rows: whatever the installed CLI lists, or none plus the typed reason (R-5 says a
+  // pick must equal a catalog row, so an unreadable catalog yields NO clickable rows -- never a
+  // guessed one). `not_switchable_count` is null on purpose: Wall-E's catalog says nothing about
+  // OpenCode providers, so there is no honest count to publish.
+  async function buildOpencode() {
+    let rows = [];
+    let listError = '';
+    try {
+      const listed = await listOpencodeModels();
+      rows = Array.isArray(listed) ? listed : [];
+    } catch (error) {
+      // REPORT: the picker footer shows this (same `list_error` field Codex uses); nothing is thrown.
+      const code = String((error && error.code) || 'opencode_catalog_unavailable');
+      const message = String((error && error.message) || error || '').trim();
+      listError = (message.startsWith(code) ? message : `${code}: ${message}`).slice(0, 200);
+    }
+    return {
+      agent: 'opencode',
+      source: 'opencode-cli',
+      rows,
+      not_switchable_count: null,
+      ...(listError ? { list_error: listError } : {}),
+    };
+  }
+
+  // The dsh rows: one `gateway` row per (route, model), labelled with the model id and sub-labelled with
+  // the route's display name (the same two strings a Claude gateway row shows). `not_switchable_count`
+  // is null for the same reason as OpenCode's: Wall-E's coding catalog says nothing about which models a
+  // dsh child may run, so there is no honest count of "hidden" rows.
+  async function buildDsh() {
+    let routes = [];
+    let listError = '';
+    try {
+      const listed = await listDshRoutes();
+      routes = Array.isArray(listed) ? listed : [];
+    } catch (error) {
+      // REPORT: the picker footer shows this (the same `list_error` field Codex and OpenCode use).
+      const code = String((error && error.code) || 'dsh_routes_unavailable');
+      const message = String((error && error.message) || error || '').trim();
+      listError = (message.startsWith(code) ? message : `${code}: ${message}`).slice(0, 200);
+    }
+    const rows = [];
+    for (const route of routes) {
+      if (!route || typeof route.routeAlias !== 'string' || !route.routeAlias) continue;
+      const name = String(route.name || route.routeAlias);
+      for (const model of (Array.isArray(route.models) ? route.models : [])) {
+        const value = String(model || '').trim();
+        if (!value) continue;
+        rows.push({ kind: 'gateway', value, route_id: route.routeAlias, label: value, sublabel: name });
+      }
+    }
+    return {
+      agent: 'dsh',
+      source: 'dsh-routes',
+      rows,
+      not_switchable_count: null,
+      ...(listError ? { list_error: listError } : {}),
+    };
+  }
+
   // The per-generation entry holder. It is deliberately ONE object per (agent, generation): a
   // background revalidation mutates this object in place, so an answer already delivered under the
   // same generation keeps matching the accepted expensive entry (C5) even while a revalidation runs.
@@ -573,6 +720,13 @@ function createLeadModelOptions({
   function beginConfigRead(agent, gen) {
     const ordinal = (configInvocation.get(agent) || 0) + 1;
     configInvocation.set(agent, ordinal);
+    // OpenCode has no configured-global CTM may read: R-6 forbids writing (or inferring from) its
+    // user config/state, so `absent` is the one honest record and NEITHER reader above runs. A dsh tab
+    // is the same: the DeepSeek Harness has no CLI config file at all (D-12 — CTM never injects a model
+    // into dsh), so its record is the state-only `absent` one, published without opening any path.
+    if (agent === 'opencode' || agent === 'dsh') {
+      return { ordinal, gen, promise: Promise.resolve({ gen, ordinal, record: finalizeConfigRecord(stateOnlyConfigRecord('absent')) }) };
+    }
     const reader = agent === 'claude' ? readClaudeSettings : readCodexConfigToml;
     const promise = readConfigRecordFor(agent, reader).then(
       (record) => ({ gen, ordinal, record }),
@@ -672,7 +826,10 @@ function createLeadModelOptions({
     if (read.gen !== generation) return supersededResponse();
     const record = acceptConfigRecord(agent, read.ordinal, applyCodexListFallback(read.record, agent, value));
     if (record === SUPERSEDED) return supersededResponse();
-    return publish(agent, entry, value, record);
+    // WP-8 step 4 (§9b M-12): a dsh tab's answer is the cached route rows PLUS the live child's own
+    // in-route rows and effort levels. Only the dsh branch touches the cached object, and it returns a
+    // fresh one, so the agent-level cache stays exactly what `buildDsh()` produced.
+    return publish(agent, entry, dshSessionRows(agent, value, sessionId, getDshConfigOptions), record);
   }
 
   // D-7: Wall-E POSTs /api/internal/model-registry/changed whenever the model registry or pricing
@@ -692,4 +849,4 @@ function createLeadModelOptions({
   return { get, invalidate, isCurrent };
 }
 
-module.exports = { createLeadModelOptions, claudeModelValue, claudeCatalogRows, aliasRows, CACHE_TTL_MS, claudeEfforts, CLI_EFFORTS };
+module.exports = { createLeadModelOptions, claudeModelValue, claudeCatalogRows, aliasRows, CACHE_TTL_MS, claudeEfforts, CLI_EFFORTS, dshRoutesFromFeed };