triss-coworker 0.35.0 → 0.36.0

package/CHANGELOG.md

@@ -7,6 +7,102 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.36.0] — 2026-08-18
+
+### Added
+
+- **OpenCode 2 coder engine (beta)**: `triss coder run --engine opencode2`
+  and `triss coder init --engine opencode2`, pinned to the exact verified
+  build `@opencode-ai/cli@0.0.0-next-17430` (`TRISS_CODER_OPENCODE2_VERSION`
+  to override). The beta runs every managed invocation `--standalone` with
+  auto-update disabled, isolates V2 state under `<project>/.triss/opencode2/`
+  (0700), folds the V2 event stream into the shared usage envelope
+  (`usage_source: "opencode2"`, terminal-error precedence, no fabricated
+  zeros), namespaces sessions per engine, and rides the shared opencode-v1
+  configuration backend for `coder model set` / rollback. See
+  docs/opencode2.md and docs/opencode2-engine-plan.md.
+
+### Security (opencode2 engine beta)
+
+- Fail-closed effective-configuration preflight for `coder run --engine
+  opencode2`: the managed provider projection (exact package, settings keys,
+  credential placeholder, and the worker `baseURL` compared against the
+  configured Triss worker endpoint), `provider.api` and model-level
+  transport overrides are rejected before any credential is forwarded, and
+  the permission gate requires deny-everything shell policy (no live
+  allow/ask rule — the credential sits in the child environment), proven
+  with a real last-match-wins evaluator.
+- `opencode2` runs resolve the engine binary to an absolute path
+  (`which` + `realpath`) and spawn exactly that path, re-verifying the same
+  path and version after the run.
+- Session store reads fail closed on malformed namespaces (no silent data
+  loss on rewrite); the lookup happens inside the isolation cleanup guard so
+  a malformed store never leaks a worktree/branch.
+- XDG runtime roots reject symlinked path components anywhere in the chain
+  below the project root.
+- `opencode init --engine opencode2` owns its flow: credential prompt and
+  `--local`/`--global` scope are honored, an exact-pin mismatch is terminal
+  before any config mutation, and the post-setup audit is the full provider
+  + permission preflight (not just the plugin/agent scan).
+- The full run preflight parses config layers through the JSONC-aware
+  canonical parser (comments and trailing commas no longer abort the run),
+  and `parseOpenCodeDocument` drops trailing commas followed by comments.
+
+### Fixed (review rounds 4–6)
+
+- Dual legacy/native config forms (`provider`+`providers`,
+  `plugin`+`plugins`, `permission`+`permissions`) reject — the pinned build
+  prefers the native value while a legacy-first projection audits the other
+  one; the worker key/endpoint provenance gate resolves each field's
+  EFFECTIVE source from the pre-dotenv snapshot (a decoy key in the project
+  `.triss.env` cannot mask a shell key); unrelated provider definitions
+  (in-process npm code) reject; the audit walks the canonical
+  (`realpathSync.native`) runtime directory; audited sources are re-audited
+  immediately before the credential-bearing spawn (TOCTOU); the top-level
+  key table is captured from the official schema (benign keys no longer
+  false-reject; object `lsp`/`formatter` and `experimental` reject).
+- A held session-store lock no longer discards a finished run:
+  `persistSessionMapping` retries with backoff and degrades to the lock-free
+  protocol (mapping kept, warning emitted, foreign lock untouched).
+- A corrupted `sessions.json` on the V1 `--isolate` path no longer strands
+  the `.triss/wt/<slug>` worktree and `coder/<slug>` branch.
+- `TRISS_CODER_ENGINE=opencode2` from a `.env` file now routes `coder init`
+  to the V2 flow (the engine is resolved after the env files load); the
+  pre-dotenv snapshots are threaded through so the provenance and
+  pin-shadow checks stay exact.
+- `coder init --engine opencode2` on a tree carrying the V1 bash allowlist
+  rejects BEFORE any credential/config write with actionable guidance; a
+  fresh V2 init warns that the shared deny-everything policy removes the
+  allowlisted commands from plain V1 runs (documented in
+  docs/opencode2.md, including two new troubleshooting rows).
+- Model inspection tolerates unrelated hostile config shapes (a non-string
+  plugin reference, unreadable directories) — the post-commit audit of a
+  successful `coder model set` no longer rolls back over them; `coder
+  models` warnings use the OpenCode branch for `opencode2` (no false
+  `configured-model-unavailable` for a shell-exported foreign model);
+  rollback of an `opencode2` record reports engine `opencode2`.
+- `opencode-go/` routes price as unknown (the Go reseller's tariffs are
+  unmodeled); the prefixed `TRISS_PRICE_OPENCODE_GO_<MODEL>` override is
+  the documented way to price them.
+- Unknown `engines.*` namespaces in the session store fail closed;
+  `ensureOpenCode2RuntimeDirs` reports the directories it created;
+  `.env.example` documents `TRISS_CODER_OPENCODE2_VERSION`.
+
+### Artifact integrity (0.36.0)
+
+- `triss-dsh-provider-bundle-0.36.0.tgz` — sha256
+  `0e3100362fc02d242deac114ec6e0c4c966bbe5edde4f156a2ffdb76ef2eb329`,
+  integrity `sha512-P2QoA6Ahu/J9swIJhk9IkuP1OLR+bzn4zJdUKyuskutbis2GUSt5m3n+QmqP7B0rB1JAqi0WGIMkUrTBcmf9cQ==`
+  (computed with the pinned release npm 11.6.2 via
+  `scripts/publish-gate.js pack-inspect`; `npm pack` output is
+  byte-deterministic — tar entries carry the fixed npm epoch mtime — so a
+  test pins this value against every future pack of the same content).
+- Root `triss-coworker-0.36.0.tgz` sha256 is reproducible via
+  `npm pack` at tag `v0.36.0` (the root tarball ships `CHANGELOG.md`, so its
+  hash cannot be recorded inside this file); registry verification compares
+  the packed artifact against the published tarball byte-for-byte
+  (`scripts/publish-gate.js pack-inspect`).
+
 ## [0.35.0] — 2026-08-14
 
 ### Added

package/README.md

@@ -279,7 +279,8 @@ The exposed tool set is **filtered by configured credentials**:
   `ZHIPU_API_KEY` (Z.AI GLM), `OPENCODE_API_KEY` (OpenCode Zen or Go),
   `MOONSHOT_API_KEY` (Moonshot Kimi), or `KIMI_API_KEY` (Kimi for Coding)
   (setup: `triss coder init`). `triss_coder_run` takes an optional `engine`
-  (`opencode` default, or `crush`); its timeout defaults to
+  (`opencode` V1 default; `--engine opencode2` beta — see
+  [opencode2.md](docs/opencode2.md) — or `crush`); its timeout defaults to
   1500s (25 min) over MCP, above the CLI's 900s, since coding runs are
   expected to be long; override per call via the `timeout` arg. For
   runs that may exceed it, use `triss coder run` on the CLI instead.
@@ -311,8 +312,8 @@ and writing**.
 | `triss review`     | Code review on a branch, PR, or explicitly piped diff (linked ticket only for branch/PR) | The agent reading the whole diff |
 | `triss commit-msg` | Generates a commit message from staged diff           | Hand-writing or copy-pasting from web LLMs |
 | `triss usage`      | Cumulative cost / token usage with per-project breakdown | Squinting at stderr after each call |
-| `triss coder init` | Sets up a coding agent (default `opencode` engine; `--engine crush` for crush): provider key/profile (`--provider worker` reuses `TRISS_WORKER_*`; Z.AI GLM default; Zen, Go, and Kimi are also supported), config, permission policy, and agent templates. Blocks (non-zero) on an unsafe existing `opencode.json` — missing deny-first bash policy (override with `--allow-unsafe-bash`) or a stale/cross-provider `small_model`. | Manually installing/configuring opencode |
-| `triss coder run` | Spawns the coding agent (the OpenAI-compatible Triss worker, GLM, Kimi, OpenCode Zen, or OpenCode Go) and prints one JSON envelope (`--engine opencode\|crush`; `--isolate` for a disposable worktree — opencode defaults to isolate-OFF, crush defaults to isolate-ON; crush adds opt-in `--restrict`/`--no-restrict` for its CLI allowlist). **POSIX only** (macOS/Linux) — refuses to run on Windows. | Manually driving `opencode run` and parsing its ndjson stream |
+| `triss coder init` | Sets up a coding agent (default `opencode` V1 engine; `--engine opencode2` for the V2 beta — shares the `opencode.json` config, see [docs/opencode2.md](docs/opencode2.md); `--engine crush` for crush): provider key/profile (`--provider worker` reuses `TRISS_WORKER_*`; Z.AI GLM default; Zen, Go, and Kimi are also supported), config, permission policy, and agent templates. Blocks (non-zero) on an unsafe existing `opencode.json` — missing deny-first bash policy (override with `--allow-unsafe-bash`) or a stale/cross-provider `small_model`. | Manually installing/configuring opencode |
+| `triss coder run` | Spawns the coding agent (the OpenAI-compatible Triss worker, GLM, Kimi, OpenCode Zen, or OpenCode Go) and prints one JSON envelope (`--engine opencode|opencode2|crush` — opencode V1 default, opencode2 beta per [docs/opencode2.md](docs/opencode2.md); `--isolate` for a disposable worktree — opencode defaults to isolate-OFF, crush defaults to isolate-ON; crush adds opt-in `--restrict`/`--no-restrict` for its CLI allowlist). **POSIX only** (macOS/Linux) — refuses to run on Windows. | Manually driving `opencode run` and parsing its ndjson stream |
 | `triss coder clean` | Removes finished `.triss/wt` isolation worktrees (`--all` forces all) | Manually finding and deleting stale git worktrees |
 | `triss init`       | Drops a tiny (~15 line) delegation block into `CLAUDE.md` / `AGENTS.md` | Hand-writing routing rules         |
 | `triss agent-help` | Prints the full delegation cookbook on demand (the nano block points here) | A 200-line CLAUDE.md that always loads |
@@ -587,8 +588,9 @@ default timeout, configurable via `--timeout <ms>`.
 
 Delegates an implementation task to a cheap coding agent — the existing
 OpenAI-compatible Triss worker, GLM, Kimi,
-OpenCode Zen, or OpenCode Go models (the `opencode` engine by default; `crush` is an
-alternative — see **Engines** below) instead of the primary model writing
+OpenCode Zen, or OpenCode Go models (the `opencode` V1 engine by default;
+`opencode2` beta — see [docs/opencode2.md](docs/opencode2.md) — or `crush`; see
+**Engines** below) instead of the primary model writing
 the code itself.
 
 ```bash

package/bin/triss.js

@@ -276,7 +276,7 @@ config
   .option('-f, --force', 're-prompt for keys that are already set')
   .option('--standard', 'API key + one model only — skip the standard/advanced prompt')
   .option('--advanced', 'full wizard with presets, base URL, integrations — skip the prompt')
-  .option('--coder-engine <name>', 'coder target only: coding engine to configure (opencode default, or crush). `coder init` uses --engine')
+  .option('--coder-engine <name>', 'coder target only: coding engine to configure (opencode default, opencode2 beta, or crush). `coder init` uses --engine')
   .option('--coder-provider <name>', 'coder target only: opencode engine provider (zai, worker, opencode-zen, opencode-go, moonshot, kimi-for-coding). `coder init` uses --provider')
   .action(wrap(runWizard));
 
@@ -324,14 +324,14 @@ config
 
 const coder = program
   .command('coder')
-  .description('Run a coding agent (OpenCode or Crush engine)');
+  .description('Run a coding agent (OpenCode V1, OpenCode 2 beta, or Crush engine)');
 
 coder
   .command('init')
-  .description('Install/configure a coding engine (opencode default, or crush), provider key, permission policy, and agent templates')
+  .description('Install/configure a coding engine (opencode default, opencode2 beta, or crush), provider key, permission policy, and agent templates')
   .option('-g, --global', 'save to the global scope (~/.config/triss/.env, ~/.config/opencode/)')
   .option('-l, --local', 'save to the project scope (./.triss.env, ./opencode.json)')
-  .option('--engine <name>', 'coding engine to configure: opencode (default) or crush')
+  .option('--engine <name>', 'coding engine to configure: opencode (default), opencode2 (beta — shares the opencode.json config; see docs/opencode2.md), or crush')
   .option('--provider <name>', 'opencode engine model provider: zai, worker (existing OpenAI-compatible TRISS_WORKER_* profile), opencode-zen, opencode-go, moonshot, or kimi-for-coding')
   .option('--allow-unverified', 'requires explicit --provider opencode-go (alias: go): allow the built-in fallback only after a temporary network or HTTP 408/429/500/502/503/504 catalogue failure (never bypasses 401/403, empty, or invalid responses)')
   .option('--allow-unsafe-bash', 'proceed even if an existing opencode.json has no deny-first bash policy (the agent runs with --auto)')
@@ -339,11 +339,11 @@ coder
 
 coder
   .command('run [prompt]')
-  .description('Spawn a coding agent — GLM, the OpenAI-compatible Triss worker, Kimi, OpenCode Zen, or OpenCode Go (opencode default, or --engine crush) — and print a JSON envelope to stdout')
-  .option('--engine <name>', 'coding engine: opencode (default) or crush')
+  .description('Spawn a coding agent — GLM, the OpenAI-compatible Triss worker, Kimi, OpenCode Zen, or OpenCode Go (opencode default; opencode2 beta or --engine crush) — and print a JSON envelope to stdout')
+  .option('--engine <name>', 'coding engine: opencode (default), opencode2 (beta — see docs/opencode2.md), or crush')
   .option('--session <id>', 'triss-side session slug, mapped to a real opencode session id in .triss/sessions.json')
   .option('--continue', 'continue the most recent opencode session (maps to opencode --continue)')
-  .option('--agent <name>', 'opencode agent template to use', 'coder')
+  .option('--agent <name>', 'agent template to use (V1 default: coder; opencode2 beta uses its built-in primary agent unless set)')
   .option('--provider <name>', 'OpenCode only: select a provider for one run; requires --model and does not modify .env or opencode.json')
   .option('--model <p/m>', 'override the MAIN model for this one run only (does not change small_model or repair persistent config; use `triss coder model set` for that)')
   .option('--small-model <p/m>', 'with --provider, override small_model for one run (defaults to the one-shot main model)')
@@ -366,10 +366,10 @@ coder
 coder
   .command('models')
   .description('List current + live coder models, provider compatibility, and credential readiness (read-only)\n\n' +
-    'Configuration sources:\n' +
-    '  • opencode: project opencode.json (local) or ~/.config/opencode/opencode.json (global)\n' +
+    'Configuration sources (layered; later sources win):\n' +
+    '  • opencode & opencode2: JSONC-aware layered config — global ~/.config/opencode/opencode.json, then every opencode.json/.opencode/opencode.json up from the project root to the Git boundary (project-local wins)\n' +
     '  • crush: ./.crush/crush.json (local) or ~/.local/share/crush/crush.json (global)')
-  .option('--engine <name>', 'coding engine: opencode (default) or crush')
+  .option('--engine <name>', 'coding engine: opencode (default), opencode2 (beta — layered JSONC config), or crush')
   .option('--provider <name>', 'provider kind: zai, worker, opencode-zen, opencode-go, moonshot, or kimi-for-coding')
   .option('--json', 'print the stable machine-readable state object (no secrets)')
   .action(wrap(runCoderModels));
@@ -391,7 +391,7 @@ coderModel
       '  • crush: project .crush/crush.json (local) or ~/.local/share/crush/crush.json (global)'
   )
   .option('--small <model>', 'small/fast model id (omit to keep the current compatible value)')
-  .option('--engine <name>', 'coding engine: opencode (default) or crush')
+  .option('--engine <name>', 'coding engine: opencode (default), opencode2 (beta — layered JSONC config), or crush')
   .option('--provider <name>', 'provider kind: zai, worker, opencode-zen, opencode-go, moonshot, or kimi-for-coding')
   .option('-g, --global', 'write to the global scope (OpenCode: ~/.config/opencode/opencode.json + global .env; Crush: ~/.local/share/crush/crush.json)')
   .option('-l, --local', 'write to the project scope (OpenCode: ./opencode.json + ./.triss.env; Crush: ./.crush/crush.json)')

package/docs/configuration.md

@@ -263,14 +263,15 @@ self-hosted endpoints).
 | Variable                        | Required | Default            | Notes                                     |
 | -------------------------------- | -------- | ------------------ | ------------------------------------------ |
 | `ZHIPU_API_KEY`                  | yes¹     | —                  | Z.AI API key for `ask`/`review --provider glm` and GLM coder models — <https://z.ai/manage-apikey/apikey-list> |
-| `OPENCODE_API_KEY`               | no¹      | —                  | Shared OpenCode credential for Zen `opencode/*` and paid Go `opencode-go/*` models (opencode engine only). A key alone does not prove Go subscription, quota, or regional readiness. See [opencode-zen.md](opencode-zen.md) and [opencode-go.md](opencode-go.md). |
+| `OPENCODE_API_KEY`               | no¹      | —                  | Shared OpenCode credential for Zen `opencode/*` and paid Go `opencode-go/*` models (opencode engines). A key alone does not prove Go subscription, quota, or regional readiness. See [opencode-zen.md](opencode-zen.md) and [opencode-go.md](opencode-go.md). |
 | `MOONSHOT_API_KEY`               | no¹      | —                  | Moonshot AI (Kimi) key for `ask`/`review --provider kimi` and `moonshotai/*` coder models — <https://platform.kimi.ai/console/api-keys> |
-| `KIMI_API_KEY`                   | no¹      | —                  | Kimi for Coding subscription key (opencode engine only) — unlocks `kimi-for-coding/*` models like `kimi-for-coding/k3` — <https://www.kimi.com/code/docs/en/> |
+| `KIMI_API_KEY`                   | no¹      | —                  | Kimi for Coding subscription key (opencode engines) — unlocks `kimi-for-coding/*` models like `kimi-for-coding/k3` — <https://www.kimi.com/code/docs/en/> |
 | `TRISS_KIMI_BASE_URL`            | no       | `https://api.moonshot.ai/v1` | Endpoint for `--provider kimi` ask/review calls — set `https://api.moonshot.cn/v1` for a China-mainland key. Trailing slashes are stripped; a blank/degenerate value falls back to the default |
 | `TRISS_CODER_MODEL`              | no       | `zai-coding-plan/glm-5.2`       | Resolved **main** model, passed to opencode via `--model`. Worker uses `triss-worker/<id>`, Go uses `opencode-go/<id>`, and Zen uses `opencode/<id>`. Main and small must stay within one provider prefix. |
 | `TRISS_CODER_SMALL_MODEL`        | no       | `zai-coding-plan/glm-5-turbo`   | Small/fast **management/init intent** — written to `opencode.json` `small_model` by `init`/`triss coder model set`. **Not** a runtime override of an already-pinned small role (see precedence) |
 | `TRISS_CODER_OPENCODE_VERSION`   | no       | `1.18.7`           | Pin override for the `opencode-ai` npm install |
-| `TRISS_CODER_ENGINE`             | no       | `opencode`          | Coding engine: `opencode` (default) or `crush` |
+| `TRISS_CODER_ENGINE`             | no       | `opencode`          | Coding engine: `opencode` (default), `opencode2` (beta — see [opencode2.md](./opencode2.md)), or `crush` |
+| `TRISS_CODER_OPENCODE2_VERSION`  | no       | `0.0.0-next-17430`  | Exact pin override for the `@opencode-ai/cli` npm install (opencode2 engine — exact match required) |
 | `TRISS_CODER_CRUSH_VERSION`      | no       | `0.1.6`             | Pin override for the `@phpcraftdream/crush` npm install (crush engine) |
 | `TRISS_CODER_CRUSH_RESTRICT`     | no       | unset (`0`)        | crush only — `1` opts INTO the CLI allowlist (`--restrict-run` + `--allow-bash`/`--allow-tool`, the only enforcement path that works today — crush 0.1.3 ignores the `permissions.run` config). Unset leaves crush unrestricted; crush then defaults to isolate-ON. CLI `--restrict`/`--no-restrict` overrides; crush.json `permissions.run.restrict` is the next fallback (forward-compat — currently inert) |
 

package/docs/glm-clients.md

@@ -46,22 +46,23 @@ needs — `ZHIPU_API_KEY` for GLM, `OPENCODE_API_KEY` for OpenCode Zen or Go (§
 
 ---
 
-## 2. The two clients (engines)
-
-| | **opencode** (engine #1, default) | **crush** (engine #2) |
-|---|---|---|
-| Select via | default, or `--engine opencode` | `--engine crush` / `TRISS_CODER_ENGINE=crush` |
-| npm package | `opencode-ai` (pinned `1.18.7`) | `@phpcraftdream/crush` (pinned `0.1.6`) |
-| Version pin env | `TRISS_CODER_OPENCODE_VERSION` | `TRISS_CODER_CRUSH_VERSION` |
-| Key it reads | `TRISS_WORKER_API_KEY` for `triss-worker/…`; `ZHIPU_API_KEY` for GLM; shared `OPENCODE_API_KEY` for `opencode/…` Zen and `opencode-go/…` Go models; `MOONSHOT_API_KEY` for `moonshotai/…`; `KIMI_API_KEY` for `kimi-for-coding/…` | `ZAI_API_KEY` (Triss bridges from `ZHIPU_API_KEY`; crush ≥0.1.1 also reads `ZHIPU_API_KEY` natively) |
-| Providers | Triss worker (`triss-worker/…`, OpenAI-compatible), Z.AI GLM, OpenCode Zen (`opencode/…`; [opencode-zen.md](opencode-zen.md)), OpenCode Go (`opencode-go/…`; [opencode-go.md](opencode-go.md)), Moonshot Kimi, and Kimi for Coding | Z.AI GLM only |
-| Provider config | `opencode.json` with a provider-qualified model prefix. Triss writes `provider["triss-worker"]` with `@ai-sdk/openai-compatible`; Zen/Kimi models resolve via OpenCode's built-in providers | `crush.json` `models` block (atoms `glm5_2` / `glm5_turbo`) |
-| Output | ndjson stream that Triss folds into one envelope | ONE JSON object at end-of-run — trivial last-line parse |
-| Sessions | slug → real `ses_…` id mapped in `.triss/sessions.json` | native get-or-create with the caller's arbitrary id — no map |
-| Safety model | **deny-first bash allowlist** in `opencode.json` (persistent, enforced) | config `permissions.run` seeded into `crush.json` for forward-compat, but **currently inert** — enforcement is opt-in via `--restrict`, which emits the allowlist as **CLI flags** (`--allow-bash`/`--allow-tool`). See §8 |
-| Isolation default | **OFF** (`opencode.json` policy is the safety layer) | **ON** (the disposable worktree is crush's reliable safety layer — the config allowlist is inert and a denied bash deadlocks to timeout) |
-| Per-call cost | engine-**calculated** from its own model catalogue, so a `0` is equally consistent with "coding plan" and "no rate in the catalogue"; Triss keeps it as `reported_total_usd` and only trusts a zero for a proven subscription/free call | real `delta_cost_usd` reported — a per-call charge Triss trusts, including an explicit `0` |
-| Sub-agents | opencode agent templates | `--agents single` (Triss forces this) |
+## 2. The engines
+
+| | **opencode** (engine #1, default) | **opencode2** (engine #2, beta) | **crush** (engine #3) |
+|---|---|---|---|
+| Select via | default, or `--engine opencode` | `--engine opencode2` / `TRISS_CODER_ENGINE=opencode2` | `--engine crush` / `TRISS_CODER_ENGINE=crush` |
+| Status | stable | beta — see [opencode2.md](./opencode2.md) | stable |
+| npm package | `opencode-ai` (pinned `1.18.7`) | `@opencode-ai/cli` (exact pin `0.0.0-next-17430`) | `@phpcraftdream/crush` (pinned `0.1.6`) |
+| Version pin env | `TRISS_CODER_OPENCODE_VERSION` | `TRISS_CODER_OPENCODE2_VERSION` (exact-match) | `TRISS_CODER_CRUSH_VERSION` |
+| Key it reads | `TRISS_WORKER_API_KEY` for `triss-worker/…`; `ZHIPU_API_KEY` for GLM; shared `OPENCODE_API_KEY` for `opencode/…` Zen and `opencode-go/…` Go models; `MOONSHOT_API_KEY` for `moonshotai/…`; `KIMI_API_KEY` for `kimi-for-coding/…` | same keys as opencode (shared config surface) | `ZAI_API_KEY` (Triss bridges from `ZHIPU_API_KEY`; crush ≥0.1.1 also reads `ZHIPU_API_KEY` natively) |
+| Providers | Triss worker (`triss-worker/…`, OpenAI-compatible), Z.AI GLM, OpenCode Zen (`opencode/…`; [opencode-zen.md](opencode-zen.md)), OpenCode Go (`opencode-go/…`; [opencode-go.md](opencode-go.md)), Moonshot Kimi, and Kimi for Coding | provider routing as resolved for V1 (fixture-gated per route; see [opencode2.md](./opencode2.md)) | Z.AI GLM only |
+| Provider config | `opencode.json` with a provider-qualified model prefix. Triss writes `provider["triss-worker"]` with `@ai-sdk/openai-compatible`; Zen/Kimi models resolve via OpenCode's built-in providers | shares `opencode.json` with V1 — one config, both engines | `crush.json` `models` block (atoms `glm5_2` / `glm5_turbo`) |
+| Output | ndjson stream that Triss folds into one envelope | ndjson event stream (V2 shape) folded by the same envelope contract | ONE JSON object at end-of-run — trivial last-line parse |
+| Sessions | slug → real `ses_…` id mapped in `.triss/sessions.json` | versioned session map under `engines.opencode2` — V1/V2 slugs never cross-resume | native get-or-create with the caller's arbitrary id — no map |
+| Safety model | **deny-first bash allowlist** in `opencode.json` (persistent, enforced) | deny-first policy shared from `opencode.json`, PLUS a static plugin/agent preflight that rejects any unverified source before spawn | config `permissions.run` seeded into `crush.json` for forward-compat, but **currently inert** — enforcement is opt-in via `--restrict`, which emits the allowlist as **CLI flags** (`--allow-bash`/`--allow-tool`). See §8 |
+| Isolation default | **OFF** (`opencode.json` policy is the safety layer) | **OFF** (same policy reasoning as V1) | **ON** (the disposable worktree is crush's reliable safety layer — the config allowlist is inert and a denied bash deadlocks to timeout) |
+| Per-call cost | engine-**calculated** from its own model catalogue, so a `0` is equally consistent with "coding plan" and "no rate in the catalogue"; Triss keeps it as `reported_total_usd` and only trusts a zero for a proven subscription/free call | same fold as V1 (`usage_source: opencode2`); per-step `step_finish` coverage — a run without it reports `usage_status: missing` with null counters, never zeros | real `delta_cost_usd` reported — a per-call charge Triss trusts, including an explicit `0` |
+| Sub-agents | opencode agent templates | none — the static agent gate rejects any agent source until subagents are fixture-verified (see [opencode2.md](./opencode2.md)) | `--agents single` (Triss forces this) |
 
 **Rule of thumb:** prefer **opencode** for the persistent bash-policy safety
 layer (it actually enforces); reach for **crush** when you want the simpler

package/docs/mcp.md

@@ -353,7 +353,9 @@ the default), `OPENCODE_API_KEY` (OpenCode Zen or paid OpenCode Go — see
   tool argument). Returns the JSON envelope — `engine`, `engine_version`,
   `session_id`, `exit_reason`, `final_text`, `files_changed`, `diff_stat`,
   `worktree`, `usage`, `warnings` — as the tool result. `engine` is the
-  `opencode`/`crush` enum (default `opencode`, or `TRISS_CODER_ENGINE`);
+  `opencode`/`opencode2`/`crush` enum (default `opencode` V1, or
+  `TRISS_CODER_ENGINE`; `opencode2` is the V2 beta — see
+  [opencode2.md](opencode2.md));
    `isolate` is unset by default in the schema — opencode resolves unset to
    isolate-OFF, crush resolves unset to isolate-ON (crush 0.1.3's
    `permissions.run` config is inert and denied bash deadlocks, so the