pi-opencode-cli-bridge 0.2.4 → 0.2.5

package/README.md

@@ -33,12 +33,16 @@ The original MIT copyright notice is preserved in [LICENSE](LICENSE). The new pa
 
 - Node.js **22.19.0 or newer**.
 - Pi Coding Agent **1.2.0 or newer**; the development SDK is pinned to 1.2.0.
-- OpenCode installed on the same machine and available on `PATH`, or selected with `OPENCODE_PI_BIN`. Tested with OpenCode 1.19.0; other versions, including 2.x, are unverified.
+- OpenCode installed on the same machine and available on `PATH`, or selected with `OPENCODE_PI_BIN`. Tested with OpenCode **1.19.0** and **2.0.30**; other releases are unverified.
 
 Check OpenCode before starting Pi:
 
 ```sh
 opencode --version
+opencode models
+# Metadata on OpenCode 2.x:
+opencode api --standalone get /api/model
+# Metadata on OpenCode 1.x:
 opencode models opencode --verbose
 ```
 
@@ -107,15 +111,15 @@ The `test` command prints diagnostic commands; it does not send a model request
 
 An explicit model list skips startup discovery and starts with conservative fallback capabilities. Run `/opencode-pi update` to discover image input, reasoning variants, token limits and costs.
 
-Without an override, discovery selects active models whose reported input and output costs are zero. When cost metadata is missing, selection falls back to the upstream free-model naming rules. Review costs before explicitly selecting a paid model.
+Without an override, discovery selects active `opencode/` models whose reported input and output costs are zero. OpenCode 2.x discovery uses the local `/api/model` endpoint, excludes disabled models, and checks every pricing tier before selecting a free model. For explicitly configured tiered models, displayed costs conservatively use the highest reported rate for each cost field. When cost metadata is missing, selection falls back to the upstream free-model naming rules. Review costs before explicitly selecting a paid model.
 
 ## How it works
 
 1. The extension discovers models through the local CLI.
 2. It replays Pi's transcript system messages to recover the current system prompt and tool declarations, including later changes.
-3. It creates a temporary OpenCode project containing a `pi-model` agent and a `tool.execute.before` plugin. Native tool declarations remain on the request. Execution is stopped twice: the plugin throws before any native tool runs, and the agent sets every permission to `ask`, which non-interactive `opencode run` rejects automatically. The second layer still holds if the plugin is missing or fails to load.
-4. It sends the prompt over standard input to `opencode run --format json`. User and tool-result images are written to temporary files and attached only when the model supports images.
-5. If the model calls a native OpenCode tool anyway, the call is still blocked. When every native call in that step has a Pi equivalent in the current tool list (`bash`, `read`, `write`, `edit` with a single replacement, `grep`, and `glob` as `find`), the bridge stops OpenCode and returns them as Pi tool calls. Paths inside the temporary project become relative to Pi's working directory. Otherwise OpenCode continues: the model sees a correction asking it to use a Pi tool, and the turn fails only if it does not recover.
+3. It creates a temporary OpenCode project containing a `pi-model` agent whose permissions are all `ask`. Non-interactive `opencode run` rejects those permission requests automatically, while native tool declarations remain on the model request. On 1.x, a generated `tool.execute.before` plugin provides a second guard; 2.x relies on the permission guard, not the legacy plugin.
+4. It sends the prompt over standard input to `opencode run --format json`. On 2.x, it uses a private `--standalone` server, sets the subprocess working directory instead of the removed `--dir` flag, and selects reasoning variants with `provider/model#variant` instead of `--variant`. User and tool-result images are written to temporary files and attached only when the model supports images.
+5. If the model calls a native OpenCode tool anyway, the call is still blocked. When every native call in that step has a Pi equivalent in the current tool list (`bash` or 2.x `shell`, `read`, `write`, `edit` with a single replacement, `grep`, and `glob` as `find`), the bridge stops OpenCode and returns them as Pi tool calls. Paths inside the temporary project become relative to Pi's working directory. Otherwise OpenCode continues: the model sees a correction asking it to use a Pi tool, and the turn fails only if it does not recover.
 6. Text markers such as `<pi_tool_call>{"name":"read","arguments":{"path":"example.txt"}}</pi_tool_call>` become Pi tool calls. Tool names must be in the current Pi tool list; execution then follows Pi's normal validation and permission pipeline. DeepSeek models sometimes write their native DSML tool-call blocks (`<｜DSML｜invoke name="...">`) as text instead; complete blocks are converted the same way, and an incomplete one fails the turn with a diagnostic instead of ending it silently.
 7. Successful continuation turns reuse an OpenCode session and send only the new transcript. Changes to the model, prompt, tools or transcript prefix start a fresh session.
 
@@ -132,11 +136,11 @@ Reasoning variants, image support and token limits follow CLI discovery. Token u
 
 - Prompts, system instructions, tool declarations, conversation text and attached images pass to OpenCode and its model provider. Do not send confidential data unless that provider's policies are suitable.
 - The extension does not directly extract credentials or call model HTTP endpoints. The OpenCode subprocess still runs as your user and can use its own configuration, credentials and inherited environment.
-- The native-tool guard is a guard rail, **not a sandbox**. An integration test runs the real OpenCode 1.19.0 CLI against a local model fixture that requests native `write` and `bash` calls, and checks that neither runs with the plugin intact, missing, or failing at startup. Other OpenCode versions, tools contributed by your own global OpenCode configuration (for example MCP servers), and a hostile local process are not covered.
+- The native-tool guard is a guard rail, **not a sandbox**. Integration tests run the real OpenCode 1.19.0 and 2.0.30 CLIs against a local model fixture that requests native `write` and `bash`/`shell` calls, and check that neither runs with the legacy plugin intact, missing, or failing at startup. Other OpenCode versions, tools contributed by your own global OpenCode configuration (for example MCP servers), and a hostile local process are not covered.
 - Pi and OpenCode can both retain local conversation data. Best-effort cleanup is not a guarantee of secure deletion.
 - Free-tier model availability and accepted request shapes can change. This fork makes no guarantee of continued access or compliance with a hosted provider's terms; review the applicable terms yourself.
 - Live tests with DeepSeek v4.1 Flash Free used thinking off. The first high-thinking test timed out; no default thinking setting is changed by this package.
-- At startup Pi warns if your OpenCode version is not 1.19.0, the version the native-tool guard was verified with.
+- At startup Pi warns if your OpenCode version is neither 1.19.0 nor 2.0.30, the exact releases covered by the native-tool guard tests.
 - Timeouts and cancellation escalate from `SIGTERM` to `SIGKILL` on the CLI's process group after 250 ms; on Windows the whole process tree is ended with `taskkill /T /F` (not tested on Windows). If OpenCode quits before reading the prompt, the turn shows OpenCode's own error rather than a broken-pipe error. Malformed or unexpected CLI events end the turn with an error instead of crashing Pi. Shutdown waits for session cleanup.
 
 See [SECURITY.md](SECURITY.md) for the trust boundaries and [docs/code-review.md](https://github.com/Gybra/pi-opencode-cli-bridge/blob/main/docs/code-review.md) for what was fixed and what remains. This is an experimental, unaudited fork.
@@ -151,7 +155,7 @@ OPENCODE_PI_INTEGRATION_BIN="$(which opencode)" npm run test:integration
 npm pack --dry-run
 ```
 
-`npm test` uses a fake OpenCode executable. `npm run test:integration` needs the real OpenCode CLI at exactly version 1.19.0 (on `PATH` or in `OPENCODE_PI_INTEGRATION_BIN`), runs it with isolated home and data directories against a local model fixture, and makes no network request. Neither suite needs API credentials. Development SDKs are pinned; Pi supplies those packages at runtime. The npm archive includes the extension source, README, security policy and license, not tests or installed dependencies.
+`npm test` uses a fake OpenCode executable. `npm run test:integration` needs the real OpenCode CLI at version 1.19.0 or 2.0.30 (on `PATH` or in `OPENCODE_PI_INTEGRATION_BIN`), runs it with isolated home and data directories against a local model fixture, and makes no network request. Neither suite needs API credentials. Development SDKs are pinned; Pi supplies those packages at runtime. The npm archive includes the extension source, README, security policy and license, not tests or installed dependencies.
 
 ## License
 

package/SECURITY.md

@@ -10,7 +10,7 @@ Never include prompts, conversation history, images, API keys, auth files or ses
 - Requests are delegated to the real OpenCode CLI. The extension does not directly read credentials, but the subprocess inherits the environment and uses OpenCode's own configuration and authentication.
 - System instructions, tool declarations, transcript text and image attachments can reach the selected model provider. Provider retention and training policies apply.
 - The current Pi tool list is checked before marker responses become Pi tool calls. Pi remains responsible for argument validation and tool permission checks.
-- Native OpenCode tools are blocked twice: a generated `tool.execute.before` plugin, and an agent permission of `ask` for everything, which non-interactive `opencode run` rejects. Native declarations remain visible to the model. Both layers depend on OpenCode 1.19.0 behavior, verified by an integration test with the real CLI. They are not a security boundary against a hostile local process, your own OpenCode configuration (it is loaded and may add tools or agent overrides), or other OpenCode versions.
+- Native OpenCode tools are guarded by an agent permission of `ask` for everything, which non-interactive `opencode run` rejects. On 1.19.0 a generated `tool.execute.before` plugin provides a second guard; on 2.0.30 the bridge relies on permissions, not that legacy plugin. Native declarations remain visible to the model. Real-CLI integration tests on both releases request `write` and `bash`/`shell` side effects and verify that neither executes with the legacy plugin intact, missing, or failing. These guards are not a security boundary against a hostile local process, your own OpenCode configuration (it is loaded and may add tools or agent overrides), or other OpenCode versions.
 - Temporary project directories and OpenCode session records are removed best-effort. Pi's own conversation history is not deleted by the extension.
 
 ## Known gaps

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-opencode-cli-bridge",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Bridge the OpenCode CLI into Pi Coding Agent",
   "type": "module",
   "main": "./src/index.ts",

package/src/index.ts

@@ -2,7 +2,7 @@ import { runOpenCodeProcess } from "./process.js";
 import { existsSync } from "node:fs";
 import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname, join, posix, win32 } from "node:path";
+import { dirname, join, posix, resolve, win32 } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { registerApiProvider } from "@earendil-works/pi-ai/compat";
 import {
@@ -29,8 +29,14 @@ import {
 const PROVIDER_ID = "opencode-cli";
 const API_ID = "opencode-cli-runner";
 const AGENT_ID = "pi-model";
-// The native-tool guard is verified against this CLI release by the integration test.
-const VERIFIED_OPENCODE_VERSION = "1.19.0";
+// Only exact releases exercised by the real-CLI native-side-effect tests belong here.
+const VERIFIED_OPENCODE_VERSIONS = ["1.19.0", "2.0.30"];
+const cliVersions = new Map<string, string | undefined>();
+
+async function usesV2Cli(): Promise<boolean> {
+  if (!cliVersions.has(opencodeBin())) await checkCliStatus();
+  return cliVersions.get(opencodeBin())?.startsWith("2.") === true;
+}
 const DEFAULT_CONTEXT_WINDOW = 128_000;
 const DEFAULT_MAX_TOKENS = 16_384;
 const DISCOVERY_TIMEOUT_MS = 8_000;
@@ -110,7 +116,11 @@ let lastDiscoveryError: string | undefined;
 
 function opencodeBin(): string {
   const configured = process.env.OPENCODE_PI_BIN?.trim();
-  if (configured) return configured;
+  if (configured) {
+    return configured.includes("/") || configured.includes("\\")
+      ? resolve(configured)
+      : configured;
+  }
   if (process.platform === "win32") {
     // npm's `opencode.cmd` shim cannot be launched by spawn() without a shell.
     // Resolve the native executable installed beside the active Node runtime.
@@ -310,51 +320,85 @@ export function parseVerboseModels(output: string): OpenCodeModelInfo[] {
     }
     if (typeof metadata !== "object" || metadata === null) continue;
 
-    const value = metadata as {
-      name?: unknown;
-      status?: unknown;
-      cost?: {
-        input?: unknown;
-        output?: unknown;
-        cache?: { read?: unknown; write?: unknown };
-      };
-      limit?: { context?: unknown; output?: unknown };
-      capabilities?: { reasoning?: unknown; input?: { image?: unknown } };
-      variants?: unknown;
-    };
-    const reasoning = value.capabilities?.reasoning === true;
-    const cost = parseModelCost(value);
-    const costFromMetadata =
-      costFigure(value.cost?.input) !== undefined &&
-      costFigure(value.cost?.output) !== undefined;
-    const status =
-      typeof value.status === "string" && value.status.trim()
-        ? value.status.trim()
-        : undefined;
-    records.set(id, {
-      id,
-      name:
-        typeof value.name === "string" && value.name.trim()
-          ? value.name.trim()
-          : modelDisplayName(id),
-      reasoning,
-      image: value.capabilities?.input?.image === true,
-      contextWindow: positiveNumber(
-        value.limit?.context,
-        contextWindowFor(id),
-      ),
-      maxTokens: positiveNumber(value.limit?.output, maxTokensFor(id)),
-      cost,
-      ...(costFromMetadata ? { costFromMetadata: true as const } : {}),
-      ...(status !== undefined ? { status } : {}),
-      ...(reasoning
-        ? { thinkingLevelMap: thinkingLevelMap(value.variants) }
-        : {}),
-    });
+    records.set(id, modelInfo(id, metadata));
   }
   return [...records.values()];
 }
 
+function modelInfo(id: string, metadata: unknown): OpenCodeModelInfo {
+  const value = metadata as {
+    name?: unknown;
+    status?: unknown;
+    cost?: {
+      input?: unknown;
+      output?: unknown;
+      cache?: { read?: unknown; write?: unknown };
+    };
+    limit?: { context?: unknown; output?: unknown };
+    capabilities?: { reasoning?: unknown; input?: { image?: unknown } };
+    variants?: unknown;
+  };
+  const reasoning = value.capabilities?.reasoning === true;
+  const cost = parseModelCost(value);
+  const costFromMetadata =
+    costFigure(value.cost?.input) !== undefined &&
+    costFigure(value.cost?.output) !== undefined;
+  const status =
+    typeof value.status === "string" && value.status.trim()
+      ? value.status.trim()
+      : undefined;
+  return {
+    id,
+    name:
+      typeof value.name === "string" && value.name.trim()
+        ? value.name.trim()
+        : modelDisplayName(id),
+    reasoning,
+    image: value.capabilities?.input?.image === true,
+    contextWindow: positiveNumber(value.limit?.context, contextWindowFor(id)),
+    maxTokens: positiveNumber(value.limit?.output, maxTokensFor(id)),
+    cost,
+    ...(costFromMetadata ? { costFromMetadata: true as const } : {}),
+    ...(status !== undefined ? { status } : {}),
+    ...(reasoning ? { thinkingLevelMap: thinkingLevelMap(value.variants) } : {}),
+  };
+}
+
+/** V2 exposes model metadata through its local API, not `models --verbose`. */
+function parseV2Models(output: string): OpenCodeModelInfo[] {
+  const data = objectRecord(JSON.parse(output))?.data;
+  if (!Array.isArray(data)) return [];
+  return data.flatMap((entry) => {
+    const value = objectRecord(entry);
+    if (value?.providerID !== "opencode" || typeof value.id !== "string" ||
+        !value.id.trim() || /[\s/#]/.test(value.id) || value.enabled === false) return [];
+    const capabilities = objectRecord(value.capabilities);
+    const variants = Array.isArray(value.variants)
+      ? value.variants.flatMap((v) => typeof objectRecord(v)?.id === "string" ? [String(v.id)] : [])
+      : [];
+    const costs = Array.isArray(value.cost) ? value.cost : [];
+    // Any paid tier makes automatic selection unsafe, even when the base tier is free.
+    if (costs.some((c) => costFigure(objectRecord(c)?.input) === undefined ||
+        costFigure(objectRecord(c)?.output) === undefined)) return [];
+    const cost = costs.length ? {
+      input: Math.max(...costs.map(c => c.input)),
+      output: Math.max(...costs.map(c => c.output)),
+      cache: {
+        read: Math.max(...costs.map(c => costFigure(objectRecord(c.cache)?.read) ?? 0)),
+        write: Math.max(...costs.map(c => costFigure(objectRecord(c.cache)?.write) ?? 0)),
+      },
+    } : undefined;
+    return [modelInfo(`opencode/${value.id}`, {
+      ...value, cost,
+      capabilities: {
+        reasoning: variants.length > 0 || typeof objectRecord(value.compatibility)?.reasoningField === "string",
+        input: { image: Array.isArray(capabilities?.input) && capabilities.input.includes("image") },
+      },
+      variants: Object.fromEntries(variants.map(id => [id, {}])),
+    })];
+  });
+}
+
 function runCapture(
   args: string[],
   input?: string,
@@ -390,6 +434,7 @@ export async function checkCliStatus(): Promise<CliStatus> {
     }
     const version =
       result.stdout.trim() || result.stderr.trim() || "OpenCode CLI is available";
+    cliVersions.set(opencodeBin(), /\d+\.\d+\.\d+/.exec(version)?.[0]);
     return { ok: true, summary: version };
   } catch (error) {
     return {
@@ -425,7 +470,10 @@ export async function discoverModels(opts?: {
   }
 
   try {
-    const result = await runCapture(["models", "opencode", "--verbose"]);
+    const v2 = await usesV2Cli();
+    const result = await runCapture(v2
+      ? ["api", "--standalone", "get", "/api/model"]
+      : ["models", "opencode", "--verbose"]);
     if (result.code !== 0) {
       throw new Error(
         result.stderr.trim() ||
@@ -433,9 +481,9 @@ export async function discoverModels(opts?: {
       );
     }
 
-    const metadata = parseVerboseModels(result.stdout);
+    const metadata = v2 ? parseV2Models(result.stdout) : parseVerboseModels(result.stdout);
     if (metadata.length === 0) {
-      throw new Error("opencode verbose model discovery returned no metadata");
+      throw new Error("opencode model discovery returned no metadata");
     }
     const byId = new Map(metadata.map((model) => [model.id, model]));
     const selected = configured?.length
@@ -444,7 +492,7 @@ export async function discoverModels(opts?: {
           (model) => isActiveModel(model.status) && isFreeModel(model),
         );
     if (selected.length === 0) {
-      throw new Error("opencode verbose model discovery returned no free models");
+      throw new Error("opencode model discovery returned no free models");
     }
 
     lastDiscoveryError = undefined;
@@ -642,31 +690,36 @@ export function translateNativeToolCall(
     name,
     arguments: Object.fromEntries(Object.entries(entries).filter(([, v]) => v !== undefined)),
   });
+  const fileKey = text("filePath") !== undefined ? "filePath" : "path";
   let result: ParsedToolCall | undefined;
   switch (tool) {
-    case "bash": {
+    case "bash":
+    case "shell": {
       // shortcut: absolute temp-project paths inside the command are not rewritten; parse them if models rely on it.
       const timeout = count("timeout");
-      if (text("command") === undefined || (args.workdir !== undefined && path("workdir") !== ".")) break;
+      if (text("command") === undefined ||
+          (args.workdir !== undefined && path("workdir") !== ".") ||
+          (tool === "shell" && (args.background === true || args.timeout === 0 ||
+            (args.cwd !== undefined && path("cwd") !== ".")))) break;
       result = call("bash", { command: text("command"), timeout: timeout && Math.ceil(timeout / 1000) });
       break;
     }
     case "read":
-      if (text("filePath") !== undefined) {
-        result = call("read", { path: path("filePath"), offset: count("offset"), limit: count("limit") });
+      if (text(fileKey) !== undefined) {
+        result = call("read", { path: path(fileKey), offset: count("offset"), limit: count("limit") });
       }
       break;
     case "write":
-      if (text("filePath") !== undefined && text("content") !== undefined) {
-        result = call("write", { path: path("filePath"), content: text("content") });
+      if (text(fileKey) !== undefined && text("content") !== undefined) {
+        result = call("write", { path: path(fileKey), content: text("content") });
       }
       break;
     case "edit":
       // Pi edits need one unique, non-empty match: no replaceAll or create-by-edit.
-      if (text("filePath") !== undefined && text("oldString") && text("newString") !== undefined &&
+      if (text(fileKey) !== undefined && text("oldString") && text("newString") !== undefined &&
           args.replaceAll !== true) {
         result = call("edit", {
-          path: path("filePath"),
+          path: path(fileKey),
           edits: [{ oldText: text("oldString"), newText: text("newString") }],
         });
       }
@@ -1264,7 +1317,9 @@ const pendingSessionDeletions = new Set<Promise<void>>();
 /** Best-effort, bounded deletion; shutdown also awaits one-shot deletions. */
 export function deleteOpenCodeSession(sessionId: string | undefined): Promise<void> {
   if (!sessionId) return Promise.resolve();
-  const task = runCapture(["session", "delete", sessionId], undefined, SESSION_DELETE_TIMEOUT_MS)
+  const args = ["session", "delete", sessionId];
+  if (cliVersions.get(opencodeBin())?.startsWith("2.")) args.push("--standalone");
+  const task = runCapture(args, undefined, SESSION_DELETE_TIMEOUT_MS)
     .then(() => undefined, () => undefined);
   pendingSessionDeletions.add(task);
   void task.finally(() => pendingSessionDeletions.delete(task));
@@ -1437,8 +1492,8 @@ You are the OpenCode side of a Pi Coding Agent bridge. Do not use OpenCode nativ
   // the request. Permission `deny` removes them before inference and is now
   // rejected as a third-party client. Keep declarations intact, but block
   // every native execution before side effects occur. The agent's `ask`
-  // permission keeps declarations too, and `opencode run` auto-rejects asks,
-  // so a plugin that fails to load still cannot run native tools.
+  // permission keeps declarations too, and `opencode run` auto-rejects asks.
+  // V2 relies on that permission guard; the legacy plugin only guards V1.
   await writeFile(
     join(pluginsDir, "pi-native-tool-blocker.js"),
     `export const PiNativeToolBlocker = async () => ({
@@ -1544,26 +1599,24 @@ export function streamOpenCode(
       );
       const imagePaths = await writeImageFiles(images, sessionDir);
       if (options?.signal?.aborted) throw new Error("Request was aborted");
+      const v2 = await usesV2Cli();
+      const requestedReasoning = options?.reasoning as ModelThinkingLevel | undefined;
+      const variant = requestedReasoning && requestedReasoning !== "off"
+        ? model.thinkingLevelMap?.[requestedReasoning] : undefined;
       const args = [
         "run",
         "-m",
-        model.id,
+        v2 && typeof variant === "string" && variant.trim() ? `${model.id}#${variant}` : model.id,
         "--agent",
         AGENT_ID,
         "--format",
         "json",
-        "--dir",
-        sessionDir,
+        ...(v2 ? ["--standalone"] : ["--dir", sessionDir]),
       ];
       if (isContinuation && piState?.opencodeSessionId) {
         args.push("--session", piState.opencodeSessionId);
       }
-      const requestedReasoning = options?.reasoning as
-        | ModelThinkingLevel
-        | undefined;
-      args.push(
-        ...reasoningCliArgs(requestedReasoning, model.thinkingLevelMap),
-      );
+      args.push(...reasoningCliArgs(requestedReasoning, v2 ? undefined : model.thinkingLevelMap));
       for (const path of imagePaths) args.push("--file", path);
 
       const handleLine = async (line: string) => {
@@ -1658,6 +1711,7 @@ export function streamOpenCode(
       };
 
       const result = await runOpenCodeProcess(opencodeBin(), args, {
+        cwd: v2 ? sessionDir : undefined,
         input: async () => {
           if (!payloadHook) return prompt;
           const replacement = await payloadHook({ prompt }, model);
@@ -1678,6 +1732,7 @@ export function streamOpenCode(
         env: {
           ...process.env,
           ...options?.env,
+          ...(v2 ? { PWD: sessionDir } : {}),
           OPENCODE_DISABLE_UPDATE_CHECK: "1",
           OPENCODE_CONFIG_DIR: join(sessionDir, ".opencode"),
         },
@@ -1998,9 +2053,9 @@ export default async function opencodePiExtension(pi: ExtensionAPI) {
       "info",
     );
     const version = /\d+\.\d+\.\d+/.exec(cliStatus.summary)?.[0];
-    if (version !== VERIFIED_OPENCODE_VERSION) {
+    if (!version || !VERIFIED_OPENCODE_VERSIONS.includes(version)) {
       ctx.ui.notify(
-        `opencode-pi: OpenCode ${version ?? cliStatus.summary} is not ${VERIFIED_OPENCODE_VERSION}, the version the native-tool guard was verified with. Native OpenCode tools may not stay blocked.`,
+        `opencode-pi: OpenCode ${version ?? cliStatus.summary} is not one of ${VERIFIED_OPENCODE_VERSIONS.join(", ")}, the versions the native-tool guard was verified with. Native OpenCode tools may not stay blocked.`,
         "warning",
       );
     }

package/src/process.ts

@@ -5,6 +5,7 @@ export type ProcessOptions = {
   timeoutMs: number;
   input?: string | (() => string | Promise<string>);
   env?: NodeJS.ProcessEnv;
+  cwd?: string;
   signal?: AbortSignal;
   onStart?: () => void | Promise<void>;
   onStdout?: (chunk: string) => void | Promise<void>;
@@ -21,6 +22,7 @@ export async function runOpenCodeProcess(
   const child = spawn(executable, args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: options.env,
+    cwd: options.cwd,
     // The npm launcher can spawn the native CLI; terminate that entire group.
     detached: process.platform !== "win32",
   });