pantheon-opencode 1.6.0-beta.7 → 1.6.0-beta.9

package/src/plugins/pantheon-hooks.ts

@@ -4,13 +4,14 @@
  * Re-created per Council Synthesis 2026-08-05 (P0): the previous hook plugin
  * was removed on 24-25/07 because it used the Bun Shell `$` from the plugin
  * API, whose interface has NO `.timeout()` method — every hook crashed with
- * `TypeError: $.quiet().nothrow().timeout is not a function`. The remaining
+ * `TypeError: $.quiet().nothrow().timeout is not a function`. The 10 functional
  * scripts in scripts/hooks/ (gitleaks covers only staged files, NOT tool
  * calls) were left orphaned. This plugin wires them back into the opencode
  * runtime via `node:child_process` (version-proof — see hook-runner.ts).
  *
- * Hook mapping:
- *   - tool.execute.before → in-process secret scan, validate-talos-scope.sh,
+ * Hook mapping (Claude Code protocol payload {tool_name, tool_input,
+ * agent_id, session_id} delivered on the script stdin):
+ *   - tool.execute.before → validate-talos-scope.sh, scan-secrets.sh,
  *     validate-tool-safety.sh + on-subagent-delegation-start.sh (only when the
  *     tool is a delegation tool such as `task`, to keep the audit log honest)
  *   - tool.execute.after  → format-multi-language.sh, log-session-start.sh +
@@ -22,7 +23,7 @@
  *     ({tool, sessionID, callID}). P0-4 (2026-08-06): a `chat.params` hook
  *     records the active agent per session (sessionAgent map), so payloadFor()
  *     now resolves the real agent_id — validate-talos-scope.sh enforces the
- *     Talos file-count boundary; the agent-agnostic secret scanner and
+ *     Talos file-count boundary; the agent-agnostic scan-secrets and
  *     validate-tool-safety protections remain fully active.
  *   - tool.execute.before CAN hard-deny — the old "cannot hard-deny" claim
  *     below this line is OUTDATED for 1.18.x (verified 2026-08-06 on the
@@ -33,15 +34,15 @@
  *     the tool body runs (the docs' .env-protection example relies on this).
  *     The permission system remains the primary deny path, but a thrown
  *     hook error is now a supported hard block (hybrid blocking, Fix 2
- *     2026-08-06): high-confidence token matches → the plugin logs via
- *     reportFailure (non-TUI channels) and THEN throws
+ *     2026-08-06): scan-secrets.sh exits 2 on high-confidence token matches
+ *     → the plugin logs via reportFailure (non-TUI channels) and THEN throws
  *     the DELIBERATE block error — the ONLY throw in this plugin. Exit 1
  *     (low-confidence header/KEY names) stays advisory: toast + logs, no
  *     block.
  *   - Logging policy (P0 fix 2026-08-06): NON-ZERO exit → NEVER console.
  *     `console.error` in a plugin writes to the process stderr, which the
  *     opencode TUI renders directly into the terminal — that polluted the
- *     chat with noisy nonzero hook output
+ *     chat with `[pantheon-hooks:scan-secrets.sh] exit 1: [SECRET SCAN]...`
  *     spam on every tool call. Non-zero exits now go to THREE non-TUI channels:
  *       1. client.tui.showToast() — one short, deduped TUI toast (per
  *          (script, exit code, masked match) per session) so the user gets a
@@ -59,8 +60,8 @@
  *   - Hooks NEVER throw: every body is try/catch'd and only logs. All three
  *     reporting channels (toast, app.log, file append) are individually
  *     try/catch'd so a failure in one can never take down the session.
- *     EXCEPTION (Fix 2, 2026-08-06): the deliberate high-confidence secret
- *     block — when the in-process scanner finds a token, the hook awaits
+ *     EXCEPTION (Fix 2, 2026-08-06): the deliberate scan-secrets high-
+ *     confidence block — when scan-secrets.sh exits 2, the hook awaits
  *     reportFailure FIRST (app.log + hooks.log) and only then throws. The
  *     throw is deliberately NOT swallowed by the surrounding try/catch
  *     (handled via a blockError variable thrown after it), because that
@@ -176,7 +177,6 @@ import { appendFile, mkdir } from 'node:fs/promises'
 import { join } from 'node:path'
 import type { Plugin, PluginInput } from '@opencode-ai/plugin'
 import { pantheonPluginOnce } from '../pantheon/plugin-once.ts'
-import { scanSecretPayload } from '../pantheon/secret-scanner.ts'
 import { getSharedBoard } from '../pantheon/shared-board.ts'
 import { type HookPayload, type HookResult, runHook } from './hook-runner.ts'
 
@@ -320,7 +320,8 @@ const sessionAgent = new Map<string, { agent: string; at: number }>()
 const RISKY_PATH_RE = /migration|schema\.sql|alembic|models\/|auth|password|token|secret/i
 
 /**
- * Fix 1 (2026-08-06): high-confidence secret token formats. Used by maskSecret()
+ * Fix 1 (2026-08-06): high-confidence secret token formats — mirrors
+ * scripts/hooks/scan-secrets.sh HIGH_CONFIDENCE_PATTERNS. Used by maskSecret()
  * to REDACT secret VALUES from any plugin log line: the talos-guard must
  * never write a raw credential to hooks.log (a real `sk-bf-...` token leaked
  * in plain text there on 2026-08-06). Header/KEY names (the Bifrost header alone,
@@ -340,8 +341,8 @@ function maskSecret(text: string): string {
 }
 
 /**
- * Fix 2 (2026-08-06): message thrown on a high-confidence token match.
- * This is the ONLY deliberate throw in the
+ * Fix 2 (2026-08-06): message thrown when scan-secrets.sh exits 2
+ * (HIGH_CONFIDENCE token match). This is the ONLY deliberate throw in the
  * plugin — it is thrown AFTER reportFailure so the log channels always write
  * first, and it is NOT swallowed by the hook's try/catch: opencode's
  * Plugin.trigger has no catch around hook invocations, so the rejection
@@ -1092,8 +1093,9 @@ function flushIdleReminders(ctx: HookContext): void {
  *               (echo routed to structured log + hooks.log, never the TUI).
  * No console.error / console.log anywhere in this path — the TUI stays clean.
  *
- * Returns the underlying HookResult (or null on unexpected failure) for the
- * non-scanner script hooks.
+ * Returns the underlying HookResult (or null on unexpected failure) so the
+ * tool.execute.before handler can inspect scan-secrets.sh's exit code for the
+ * Fix-2 hybrid block (code 2 = high-confidence token → throw after logging).
  */
 async function safeRun(
   ctx: HookContext,
@@ -1175,26 +1177,15 @@ const plugin: Plugin = async ({ client, directory }) => {
       // catch: opencode propagates the rejection to fail the tool call.
       let blockError: Error | null = null
       try {
-        const hooks = ['validate-talos-scope.sh', 'validate-tool-safety.sh']
+        const hooks = ['validate-talos-scope.sh', 'scan-secrets.sh', 'validate-tool-safety.sh']
         // P0-2: the delegation record must exist BEFORE the payload is built
         // so the start hook receives the delegation_id the stop hook joins on.
-        const args = output?.args ?? (input as { args?: unknown }).args
-        let payload = payloadFor(input, args)
-        // Validate and scan before touching delegation args or launching any
-        // hook subprocess. The shared scanner catches malformed serialization
-        // and returns a fixed fail-closed result.
-        const scan = scanSecretPayload({ ...payload, tool_input: args })
-        if (scan.status === 'invalid') {
-          blockError = new Error(
-            '[pantheon-hooks] Bloqueado: o scanner de segredos não validou a entrada da ferramenta (fail-closed)',
-          )
-        } else if (scan.status === 'block') {
-          blockError = new Error(SECRET_BLOCK_MESSAGE)
-        }
-        if (blockError === null && DELEGATION_TOOL_RE.test(input.tool)) {
+        let payload = payloadFor(input, output?.args ?? {})
+        if (DELEGATION_TOOL_RE.test(input.tool)) {
           hooks.push('on-subagent-delegation-start.sh')
           // tool.execute.before carries args on `output` (typed); `input.args`
           // also exists at runtime — read from whichever is present.
+          const args = output?.args ?? (input as { args?: unknown }).args
           const start: DelegationStart = {
             delegation_id: crypto.randomUUID(),
             agent: delegationAgent(input.tool, args),
@@ -1231,7 +1222,7 @@ const plugin: Plugin = async ({ client, directory }) => {
         const isWriteIntent =
           WRITE_INTENT_TOOLS.has(input.tool) ||
           (input.tool === 'bash' && BASH_WRITE_INTENT_RE.test(bashCommand))
-        if (blockError === null && isWriteIntent) {
+        if (isWriteIntent) {
           try {
             const values: string[] = []
             const scan = (v: unknown): void => {
@@ -1282,63 +1273,25 @@ const plugin: Plugin = async ({ client, directory }) => {
             // Advisory only — a failure here must never take down the hook.
           }
         }
-        // Scan the same serialized hook payload the removed stdin protocol
-        // delivered, but in-process and without logging untrusted input.
-        if (scan.status === 'invalid') {
-          const message =
-            '[pantheon-hooks] Bloqueado: o scanner de segredos não validou a entrada da ferramenta (fail-closed)'
-          await reportFailure(
-            ctx,
-            message,
-            { script: 'secret-scan', tool: input.tool, blocked: true, reason: 'invalid-input' },
-            'error',
-          )
-          blockError = new Error(message)
-        } else if (scan.status === 'block') {
-          for (const finding of scan.findings) {
-            await reportFailure(
-              ctx,
-              `[SECRET SCAN] High-confidence secret detected: ${finding.masked} (pattern: ${finding.pattern})`,
-              { script: 'secret-scan', tool: input.tool, pattern: finding.pattern },
-              'error',
-            )
-          }
+        // Fix 2 hybrid blocking: safeRun returns each script's HookResult;
+        // scan-secrets.sh exits 2 on HIGH_CONFIDENCE token matches
+        // (sk-bf-*, AKIA..., ghp_..., glpat-..., JWT, bearer...) → BLOCK the
+        // tool call. Exit 1 (low-confidence header/KEY names) stays advisory
+        // — safeRun already logged + toasted it, no block. The toast for
+        // code 1/2 fires inside safeRun BEFORE we reach the throw, and the
+        // reportFailure below is awaited first — log channels always write.
+        const results = await Promise.all(
+          hooks.map(async (script) => ({ script, result: await safeRun(ctx, script, payload) })),
+        )
+        const scan = results.find((r) => r.script === 'scan-secrets.sh')
+        if (scan?.result?.code === 2) {
           await reportFailure(
             ctx,
             SECRET_BLOCK_MESSAGE,
-            { script: 'secret-scan', tool: input.tool, blocked: true },
+            { script: 'scan-secrets', tool: input.tool, blocked: true, code: 2 },
             'error',
           )
-          void notifyToast(ctx, {
-            title: 'Pantheon Hook',
-            message: '⚠️ High-confidence secret detected — tool call blocked',
-            variant: 'error',
-            duration: 4000,
-            category: 'errors',
-            dedupeKey: `secret-scan|block|${input.sessionID}`,
-          })
           blockError = new Error(SECRET_BLOCK_MESSAGE)
-        } else if (scan.status === 'advisory') {
-          for (const finding of scan.findings) {
-            await reportFailure(
-              ctx,
-              `[SECRET SCAN] Potential secret detected (low confidence): ${finding.masked} (pattern: ${finding.pattern})`,
-              { script: 'secret-scan', tool: input.tool, pattern: finding.pattern },
-              'warn',
-            )
-          }
-          void notifyToast(ctx, {
-            title: 'Pantheon Hook',
-            message: '⚠️ Possible secret detected — see log',
-            variant: 'warning',
-            duration: 4000,
-            category: 'errors',
-            dedupeKey: `secret-scan|advisory|${input.sessionID}`,
-          })
-        }
-
-        if (blockError === null) {
-          await Promise.all(hooks.map(async (script) => safeRun(ctx, script, payload)))
         }
       } catch {
         // Never let a hook take down the opencode session — except the

package/src/plugins/tui/dist/tui-v2.d.ts

@@ -0,0 +1,9 @@
+//#region src/index-v2.d.ts
+/** @jsxImportSource @opentui/solid */
+declare const plugin: {
+  id: string;
+  setup(context: any): (() => void) | undefined;
+};
+//#endregion
+export { plugin as default };
+//# sourceMappingURL=tui-v2.d.ts.map

package/src/plugins/tui/dist/tui-v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tui-v2.d.ts","names":[],"sources":["../src/index-v2.tsx"],"mappings":";;cAuFM;;EAEW,MAAA"}

package/src/plugins/tui/dist/tui-v2.js

@@ -0,0 +1,151 @@
+import { createComponent, createElement, createTextNode, effect, insert, insertNode, setProp } from "@opentui/solid";
+import { For, Show, createMemo, createSignal, onCleanup, onMount } from "solid-js";
+import { Plugin } from "@opencode/plugin/tui";
+//#region src/index-v2.tsx
+/** @jsxImportSource @opentui/solid */
+const SINGLETON = Symbol.for("pantheon.tui.v2.loaded");
+function Sidebar(props) {
+	const { context } = props;
+	const [revision, setRevision] = createSignal(0);
+	const location = context.location ?? context.data.location.default();
+	const session = createMemo(() => {
+		revision();
+		return props.sessionID ? context.data.session.get(props.sessionID) : void 0;
+	});
+	const branch = createMemo(() => {
+		revision();
+		return context.data.location.vcs.info(location)?.branch?.current ?? null;
+	});
+	const delegations = createMemo(() => {
+		revision();
+		const id = props.sessionID;
+		if (!id) return [];
+		return (context.data.session.family(id) ?? []).filter((childID) => childID !== id).map((childID) => context.data.session.get(childID)).filter((child) => child?.parentID === id).slice(0, 6);
+	});
+	onMount(() => {
+		const stop = [];
+		for (const type of [
+			"session.created",
+			"session.updated",
+			"session.status",
+			"session.deleted"
+		]) try {
+			stop.push(context.data.on(type, () => setRevision((value) => value + 1)));
+		} catch {}
+		if (props.sessionID) context.data.session.sync(props.sessionID).then(() => setRevision((value) => value + 1));
+		context.data.location.vcs.sync(location).then(() => setRevision((value) => value + 1));
+		onCleanup(() => {
+			for (const unsubscribe of stop) unsubscribe();
+		});
+	});
+	const text = () => context.theme.text?.base;
+	const muted = () => context.theme.text?.muted ?? text();
+	return (() => {
+		var _el$ = createElement("box"), _el$2 = createElement("text"), _el$3 = createElement("text");
+		insertNode(_el$, _el$2);
+		insertNode(_el$, _el$3);
+		setProp(_el$, "flexDirection", "column");
+		setProp(_el$, "width", "100%");
+		setProp(_el$, "padding", 1);
+		setProp(_el$2, "attributes", 1);
+		insert(_el$2, `Pantheon v1.6.0-beta.9`);
+		insertNode(_el$3, createTextNode(`OpenCode V2 · plugin TUI ativo`));
+		insert(_el$, createComponent(Show, {
+			get when() {
+				return branch();
+			},
+			children: (value) => (() => {
+				var _el$7 = createElement("text");
+				insert(_el$7, () => `Branch: ${value()}`);
+				effect((_$p) => setProp(_el$7, "fg", muted(), _$p));
+				return _el$7;
+			})()
+		}), null);
+		insert(_el$, createComponent(Show, {
+			get when() {
+				return session();
+			},
+			get fallback() {
+				return (() => {
+					var _el$8 = createElement("text");
+					insertNode(_el$8, createTextNode(`Nenhuma sessão selecionada`));
+					effect((_$p) => setProp(_el$8, "fg", muted(), _$p));
+					return _el$8;
+				})();
+			},
+			children: (current) => [(() => {
+				var _el$0 = createElement("text");
+				insert(_el$0, () => `Sessão: ${current().title || current().id}`);
+				effect((_$p) => setProp(_el$0, "fg", text(), _$p));
+				return _el$0;
+			})(), createComponent(Show, {
+				get when() {
+					return current().agent;
+				},
+				get children() {
+					var _el$1 = createElement("text");
+					insert(_el$1, () => `Agente: ${current().agent}`);
+					effect((_$p) => setProp(_el$1, "fg", muted(), _$p));
+					return _el$1;
+				}
+			})]
+		}), null);
+		insert(_el$, createComponent(Show, {
+			get when() {
+				return delegations().length > 0;
+			},
+			get children() {
+				return [(() => {
+					var _el$5 = createElement("text");
+					insertNode(_el$5, createTextNode(`Delegações`));
+					setProp(_el$5, "attributes", 1);
+					effect((_$p) => setProp(_el$5, "fg", text(), _$p));
+					return _el$5;
+				})(), createComponent(For, {
+					get each() {
+						return delegations();
+					},
+					children: (child) => (() => {
+						var _el$10 = createElement("text");
+						insert(_el$10, () => `· ${child.title || child.id}`);
+						effect((_$p) => setProp(_el$10, "fg", muted(), _$p));
+						return _el$10;
+					})()
+				})];
+			}
+		}), null);
+		effect((_p$) => {
+			var _v$ = text(), _v$2 = muted();
+			_v$ !== _p$.e && (_p$.e = setProp(_el$2, "fg", _v$, _p$.e));
+			_v$2 !== _p$.t && (_p$.t = setProp(_el$3, "fg", _v$2, _p$.t));
+			return _p$;
+		}, {
+			e: void 0,
+			t: void 0
+		});
+		return _el$;
+	})();
+}
+const plugin = Plugin.define({
+	id: "pantheon.tui",
+	setup(context) {
+		const globalState = globalThis;
+		if (globalState[SINGLETON]) return;
+		globalState[SINGLETON] = true;
+		const unregister = context.ui.slot({
+			append: "sidebar.content",
+			render: ({ sessionID }) => createComponent(Sidebar, {
+				context,
+				sessionID
+			})
+		});
+		return () => {
+			if (typeof unregister === "function") unregister();
+			delete globalState[SINGLETON];
+		};
+	}
+});
+//#endregion
+export { plugin as default };
+
+//# sourceMappingURL=tui-v2.js.map

package/src/plugins/tui/dist/tui-v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tui-v2.js","names":[],"sources":[],"mappings":""}

package/src/plugins/tui/dist/tui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tui.d.ts","names":[],"sources":["../src/index.tsx"],"mappings":";;YAk9BY;;EAEV;;EAEA;;;;EAIA;;EAEA;EACA;;EAUA;;EAEA;EACA;EACA;;;;;;EAUA;;;;;;;;;;;wBAsBc,wBACd,aACA,oBACA,qBACC;;;;;;wBAkHmB,sBAAsB,cAAc,QAAQ;;;;;;;;;wBAyC5C,yBAAyB,eAAe,QAAQ;;;;;;;wBAUtD,oBACd;EAAS;EAAoB;eAC7B;;;;wBAUc,sBACd;EAAS;EAAoB;eAC7B;;;;;;wBAUc,YAAY;;;wBAMZ,WAAW;;;;wBAOX,yBAAyB,GAAG,iBAAiB,GAAG;;;;;wBAahD,oBACd,cAAc,mBACd,oBACA,cACA;EACG,QAAQ;EAAmB,QAAQ;;;;;wBAmCxB,sBACd,cAAc,mBACd,sBACA,cACA,4BACC;;qBAMU;;;;qBAKA;;;qBAIA;qBACA;;;;;;;;;;qBAWA;;;;;;;;qBASA;;;;;qBAMA;;;;;;;;;wBAUG,mBACd,OAAO,iBACP,aACA,uBACC;;;wBAWa,WAAW;;;;wBAeX,kBAAkB,OAAO,iBAAiB;;;YAQ9C;wBAEI,mBAAmB,OAAO,kBAAkB;wBAa5C,wBAAwB,OAAO;;;;wBAqB/B,uBAAuB;;;;;;;YAW3B,yBAAyB;;;;;YAMzB;;;;wBAKI,oBAAoB,OAAO,yBAAyB;YAuBxD;EACV;EACA;EACA;;;;;wBAsBc,oBACd;EACE;EACA;EACA;EACA;IAAU;IAAiB,QAAQ;;GAErC;EACG;EAAmB,UAAU;;;wBAYlB,kBACd,KAAK,YAAY,eACjB,mBACA,UAAU;;wBAWI,sBACd,KAAK,YAAY,eACjB,+BACA,cACA,iBACC;;;;;;;wBAca,4BACd,mBAAmB,mBACnB,eAAe,wBACd;;YAiGS;EACV;EACA;EACA;EACA;EACA;EACA;IACE;IACA,QAAQ;IACR;IACA;IACA;MAAS;MAAgB;;;;;YAKjB;;EAEV;;EAEA;;EAEA;EACA;;EAEA;EACA;;EAEA;;EAEA;EACA;EACA;EACA;;;YAIU;EACV;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;wBAYc,wBACd,MAAM,oBACN,eACC;;;wBAsDa,yBACd,KAAK,YAAY,sBACjB,MAAM,oBACN;;;wBAwEc,sBACd,KAAK,YAAY,sBACjB;;;;;;;;;wBAoBc,2BACd;EAAqB;EAAa;iBAClC,YAAY,uDACX;;;;;wBAwBa,sBACd,KAAK,YAAY,sBACjB,gBAAgB,sBAChB;;;wBAWc,kBAAkB,MAAM,sBAAsB;;;;;;wBAoB9C,uBACd,eAAe,uBACf,aAAa,oBACZ;;;;;;;;;;;;;;;;;wBA0Ca,2BACd,kBAAkB,mBAClB,6CACC;;;;;;;;;wBAyCa,iBAAiB,cAAc;;;;YAOnC;;EAEV;EACA;;IAEE;MAAU;;;IAEV;MAAU;QAAY;QAAe,SAAS;;;;;;;;;;wBASlC,wBAAwB,SAAS;;;;;;;;;;;;wBAuBjC,gBAAgB;EAAgB;;;;;;;wBAUhC,kBAAkB;EAAkC;;;YAKxD;;EAEV;;EAEA;;;EAGA;;;EAGA;EACA;IACE;IACA;;;;;;;;;;;;;;;;;;;;wBAqBY,mBACd,4BACA;EAAS;EAAkB;GAC3B,cACA;;;;;;;YA6BU;;;;;wBAMI,oBAAoB,OAAO,yBAAyB;;;qBAmBvD,uBAAuB,SAAS,OAAO;wBAOpC,mBAAmB,QAAQ;;;;wBAO3B,oBAAoB,OAAO,wBAAwB;;;;;wBAUnD,sBAAsB,OAAO;;;qBAShC;wBAEG,sBAAsB,kBAAkB;;;qBAO3C;;;;wBAoBG,8BACd,cACA;;;;qBAUW;wBAEG,wBACd,OAAO,iBACP,aACA;;;;wBAUc,wBAAwB,OAAO,iBAAiB;;;;qBAYnD;;;;;wBAMG,uBAAuB,kBAAkB;;;;wBAyBzC,sBACd,cAAc,mBACd,qBACA;EACG,SAAS;EAAmB;EAAgB;EAAsB;;;;;wBAevD,uBAAuB,kBAAkB;EACvD;EACA;EACA;;;;;wBAUc,mBACd,kBACA,kBACA,gBACA,YACA;wBA8Cc,4BACd,mBAAmB,mCACnB,aAAa,mBACb,cACA,2BACC;;;;;;wBA4Da,4BACd;EAEM,YAAY,cAAc,SAAS,mCAAmC;eAG5E;;wBAmBc,+BACd;EAEM,YAAY,cAAc,SAAS,mCAAmC;eAG5E;;;;YAuLU;EACV,KAAK,YAAY;;EAEjB,YAAY;;EAEZ;;;wBAIc,6BAA6B;;wBAe7B,6BACd,KAAK,cACL,WAAW;cAkgBP,QAAQ;EAAoB;EAAY,aAAa"}
+{"version":3,"file":"tui.d.ts","names":[],"sources":["../src/index.tsx"],"mappings":";;YAi7BY;;EAEV;;EAEA;;;;EAIA;;EAEA;EACA;;EAUA;;EAEA;EACA;EACA;;;;;;EAUA;;;;;;;;;;;wBAsBc,wBACd,aACA,oBACA,qBACC;;;;;;wBAkHmB,sBAAsB,cAAc,QAAQ;;;;;;;;;wBAyC5C,yBAAyB,eAAe,QAAQ;;;;;;;wBAUtD,oBACd;EAAS;EAAoB;eAC7B;;;;wBAUc,sBACd;EAAS;EAAoB;eAC7B;;;;;;wBAUc,YAAY;;;wBAMZ,WAAW;;;;wBAOX,yBAAyB,GAAG,iBAAiB,GAAG;;;;;wBAahD,oBACd,cAAc,mBACd,oBACA,cACA;EACG,QAAQ;EAAmB,QAAQ;;;;;wBAmCxB,sBACd,cAAc,mBACd,sBACA,cACA,4BACC;;qBAMU;;;;qBAKA;;;qBAIA;qBACA;;;;;;;;;;qBAWA;;;;;;;;qBASA;;;;;qBAMA;;;;;;;;;wBAUG,mBACd,OAAO,iBACP,aACA,uBACC;;;wBAWa,WAAW;;;;wBAeX,kBAAkB,OAAO,iBAAiB;;;YAQ9C;wBAEI,mBAAmB,OAAO,kBAAkB;wBAa5C,wBAAwB,OAAO;;;;wBAqB/B,uBAAuB;;;;;;;YAW3B,yBAAyB;;;;;YAMzB;;;;wBAKI,oBAAoB,OAAO,yBAAyB;YAuBxD;EACV;EACA;EACA;;;;;wBAsBc,oBACd;EACE;EACA;EACA;EACA;IAAU;IAAiB,QAAQ;;GAErC;EACG;EAAmB,UAAU;;;wBAYlB,kBACd,KAAK,YAAY,eACjB,mBACA,UAAU;;wBAWI,sBACd,KAAK,YAAY,eACjB,+BACA,cACA,iBACC;;;;;;;wBAca,4BACd,mBAAmB,mBACnB,eAAe,wBACd;;YAiGS;EACV;EACA;EACA;EACA;EACA;EACA;IACE;IACA,QAAQ;IACR;IACA;IACA;MAAS;MAAgB;;;;;YAKjB;;EAEV;;EAEA;;EAEA;EACA;;EAEA;EACA;;EAEA;;EAEA;EACA;EACA;EACA;;;YAIU;EACV;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;wBAYc,wBACd,MAAM,oBACN,eACC;;;wBAsDa,yBACd,KAAK,YAAY,sBACjB,MAAM,oBACN;;;wBAwEc,sBACd,KAAK,YAAY,sBACjB;;;;;;;;;wBAoBc,2BACd;EAAqB;EAAa;iBAClC,YAAY,uDACX;;;;;wBAwBa,sBACd,KAAK,YAAY,sBACjB,gBAAgB,sBAChB;;;wBAWc,kBAAkB,MAAM,sBAAsB;;;;;;wBAoB9C,uBACd,eAAe,uBACf,aAAa,oBACZ;;;;;;;;;;;;;;;;;wBA0Ca,2BACd,kBAAkB,mBAClB,6CACC;;;;;;;;;wBAyCa,iBAAiB,cAAc;;;;YAOnC;;EAEV;EACA;;IAEE;MAAU;;;IAEV;MAAU;QAAY;QAAe,SAAS;;;;;;;;;;wBASlC,wBAAwB,SAAS;;;;;;;;;;;;wBAuBjC,gBAAgB;EAAgB;;;;;;;wBAUhC,kBAAkB;EAAkC;;;YAKxD;;EAEV;;EAEA;;;EAGA;;;EAGA;EACA;IACE;IACA;;;;;;;;;;;;;;;;;;;;wBAqBY,mBACd,4BACA;EAAS;EAAkB;GAC3B,cACA;;;;;;;YA6BU;;;;;wBAMI,oBAAoB,OAAO,yBAAyB;;;qBAmBvD,uBAAuB,SAAS,OAAO;wBAOpC,mBAAmB,QAAQ;;;;wBAO3B,oBAAoB,OAAO,wBAAwB;;;;;wBAUnD,sBAAsB,OAAO;;;qBAShC;wBAEG,sBAAsB,kBAAkB;;;qBAO3C;;;;wBAoBG,8BACd,cACA;;;;qBAUW;wBAEG,wBACd,OAAO,iBACP,aACA;;;;wBAUc,wBAAwB,OAAO,iBAAiB;;;;qBAYnD;;;;;wBAMG,uBAAuB,kBAAkB;;;;wBAyBzC,sBACd,cAAc,mBACd,qBACA;EACG,SAAS;EAAmB;EAAgB;EAAsB;;;;;wBAevD,uBAAuB,kBAAkB;EACvD;EACA;EACA;;;;;wBAUc,mBACd,kBACA,kBACA,gBACA,YACA;wBA8Cc,4BACd,mBAAmB,mCACnB,aAAa,mBACb,cACA,2BACC;;;;;;wBA4Da,4BACd;EAEM,YAAY,cAAc,SAAS,mCAAmC;eAG5E;;wBAmBc,+BACd;EAEM,YAAY,cAAc,SAAS,mCAAmC;eAG5E;;;;YAuLU;EACV,KAAK,YAAY;;EAEjB,YAAY;;EAEZ;;;wBAIc,6BAA6B;;wBAe7B,6BACd,KAAK,cACL,WAAW;cAggBP,QAAQ;EAAoB;EAAY,aAAa"}

package/src/plugins/tui/dist/tui.js

@@ -10,9 +10,9 @@ import { For, Show, createMemo, createResource, createSignal, onCleanup, onMount
 /**
 * pantheon-tui — Pantheon TUI plugin for opencode.
 *
-* Bundled entry: `tsdown` emits `dist/tui.js`, and the package `exports`
-* (`./tui` → ./dist/tui.js, `./server` → ./dist/server.js) is the ONLY load
-* path — no raw TSX copy is shipped. Because the bundle inlines relative
+* V1 bundle: `tsdown` emits `dist/tui.js`, re-exported by root `tui.ts`.
+* OpenCode V2 uses the separate `src/index-v2.tsx` entry and native CLI plugin
+* API. No raw TSX implementation is shipped. Because the bundle inlines relative
 * imports, this entry may be split into modules without breaking the loader.
 *
 * Slots:
@@ -167,7 +167,7 @@ async function detectVersion(api) {
 			if (ver) return ver;
 		}
 	} catch {}
-	return "1.6.0-beta.7";
+	return "1.6.0-beta.9";
 }
 /**
 * usage-bar — AI subscription usage gauge for the opencode TUI.
@@ -509,22 +509,12 @@ async function loadConfig(configPath) {
 		return defaultConfig();
 	}
 }
-/** Vendored usage-bar plugin init: reads config, seeds the kv cache, registers
-*  the `app_bottom` slot, then starts the poll loop. Skips everything (and
+/** Vendored usage-bar plugin init: reads config, seeds the kv cache, starts
+*  the poll loop and registers the `app_bottom` slot. Skips everything (and
 *  registers nothing) when no provider is enabled — mirrors the standalone
 *  plugin's early return. */
 async function setupUsageBar(api) {
-	let disposed = false;
-	let clockInterval;
-	const pollTimeouts = /* @__PURE__ */ new Set();
-	api.lifecycle.onDispose(() => {
-		disposed = true;
-		if (clockInterval !== void 0) clearInterval(clockInterval);
-		for (const timeout of pollTimeouts) clearTimeout(timeout);
-		pollTimeouts.clear();
-	});
 	const config = await loadConfig(api.state.path?.config);
-	if (disposed) return;
 	if (api.state.path?.state) opencodeAuthFile = join(api.state.path.state, "auth.json");
 	const enabled = providers.filter((p) => config.providers[p.id].enabled);
 	if (enabled.length === 0) return;
@@ -536,6 +526,28 @@ async function setupUsageBar(api) {
 	const [byProvider, setByProvider] = createSignal(seed);
 	const [byStatus, setByStatus] = createSignal({});
 	const [now, setNow] = createSignal(Date.now());
+	setInterval(() => setNow(Date.now()), 1e3);
+	for (const p of enabled) {
+		const cfg = config.providers[p.id];
+		const poll = async () => {
+			const statusP = config.showStatus && p.statusUrl ? fetchStatus(p.statusUrl) : null;
+			const [all, status] = await Promise.all([p.fetchUsage(cfg), statusP]);
+			if (all) {
+				const windows = all.filter((w) => cfg.show[w.category] && w.resetsAt > Date.now());
+				setByProvider((prev) => ({
+					...prev,
+					[p.id]: windows
+				}));
+				api.kv.set(`usage-bar.${p.id}.windows`, windows);
+			}
+			if (status !== null) setByStatus((prev) => ({
+				...prev,
+				[p.id]: status
+			}));
+			setTimeout(poll, all ? POLL_MS : POLL_MS * 3);
+		};
+		poll();
+	}
 	api.slots.register({
 		order: 60,
 		slots: { app_bottom() {
@@ -684,42 +696,6 @@ async function setupUsageBar(api) {
 			});
 		} }
 	});
-	clockInterval = setInterval(() => setNow(Date.now()), 1e3);
-	const schedulePoll = (run, delay) => {
-		if (disposed) return;
-		const timeout = setTimeout(() => {
-			pollTimeouts.delete(timeout);
-			if (!disposed) run();
-		}, delay);
-		pollTimeouts.add(timeout);
-	};
-	for (const p of enabled) {
-		const cfg = config.providers[p.id];
-		const poll = async () => {
-			if (disposed) return;
-			const statusP = config.showStatus && p.statusUrl ? fetchStatus(p.statusUrl) : null;
-			const [all, status] = await Promise.all([p.fetchUsage(cfg), statusP]);
-			if (disposed) return;
-			if (all) {
-				const windows = all.filter((w) => cfg.show[w.category] && w.resetsAt > Date.now());
-				setByProvider((prev) => ({
-					...prev,
-					[p.id]: windows
-				}));
-				api.kv.set(`usage-bar.${p.id}.windows`, windows);
-			}
-			if (status !== null) setByStatus((prev) => ({
-				...prev,
-				[p.id]: status
-			}));
-			schedulePoll(runPoll, all ? POLL_MS : POLL_MS * 3);
-		};
-		const runPoll = () => {
-			if (disposed) return;
-			poll().catch(() => schedulePoll(runPoll, POLL_MS * 3));
-		};
-		runPoll();
-	}
 }
 /** True for `\s` characters (space, tab, newline, CR) — plain char checks so
 *  the parser stays regex-free (CodeQL flagged the old `\s*`/`\s+` + `(.+)`
@@ -2232,7 +2208,7 @@ const tui = (api, _options, _meta) => {
 	if (pantheonPluginOnce("pantheon:tui")) return;
 	const [version, setVersion] = createSignal(null);
 	detectVersion(api).then((detected) => setVersion(detected)).catch(() => setVersion(null));
-	setupUsageBar(api).catch(() => void 0);
+	setupUsageBar(api);
 	const liveStore = createLiveDelegationStore();
 	const unsubscribeLive = registerLiveDelegationEvents(api, liveStore);
 	api.lifecycle.onDispose(() => {

package/src/plugins/tui/index-v2.ts

@@ -0,0 +1,6 @@
+import { Plugin } from '@opencode/plugin'
+
+export default Plugin.define({
+  id: 'pantheon.tui.server',
+  setup() {},
+})