triss-coworker 0.37.2 → 0.38.0

package/CHANGELOG.md

@@ -7,6 +7,76 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.38.0] — 2026-08-22
+
+### Added
+
+- **Canonical OpenCode provider routing** — both `opencode` engines now resolve
+  Triss worker, Z.AI, OpenCode Zen, OpenCode Go, Moonshot, and Kimi for Coding
+  through one provider registry. Protected runs pin a transient provider in
+  `OPENCODE_CONFIG_CONTENT`, including model-specific Chat Completions,
+  Responses, and Anthropic transport metadata for audited Zen/Go models.
+- **Explicit raw best-effort credential mode** — literal
+  `TRISS_CODER_ALLOW_BEST_EFFORT_ISOLATION=1` allows either OpenCode engine to
+  run every canonical provider, including ordinary plugins, agents, custom
+  tools, and shell policies, while reporting credential isolation as
+  unavailable and warning that the selected raw credential is visible to the
+  same-UID child.
+
+### Changed
+
+- OpenCode 2 now installs from `@opencode-ai/cli@beta` and accepts compatible
+  releases at or above `0.0.0-beta-17793` when the required CLI capability
+  probe passes. `TRISS_CODER_OPENCODE2_VERSION` is a minimum-version override,
+  replacing the obsolete exact `next-*` pin.
+- `triss coder init`, `coder run`, `coder models`, `triss status`, and the MCP
+  coder path use the same provider ownership, credential, endpoint, package,
+  header, and transport rules. One-shot main/small model routing is validated
+  as one provider pair; OpenCode 2 continues to report its small role as
+  unavailable.
+- `triss-dsh-provider-bundle` is version-aligned and republished unchanged;
+  the routing and credential-mode behavior above belongs to the Triss runtime,
+  while the companion still exposes its existing OpenCode Zen, OpenCode Go,
+  and Z.AI catalogue routes.
+
+### Fixed
+
+- OpenCode 1 no longer sends Triss's run-scoped proxy token to the real
+  upstream because `OPENCODE_BASE_URL` was ignored. The transient provider
+  overlay now pins the credential proxy endpoint that the engine actually
+  uses, including the unprefixed `/responses` route.
+- The bounded effective-config audit now mirrors the real launch mode:
+  one-shot runs probe and launch with `--pure`; ordinary runs do neither, so
+  managed, account, MDM, and disk policy layers are audited without disabling
+  the deny-first project policy.
+- Protected credential-store checks now use the canonical local and global
+  Triss env paths (including `~/.config/triss/.env`), allow non-secret/control
+  entries, and reject readable stores containing provider credentials before
+  the engine starts.
+- Worker routes verify the configured base URL through the final effective
+  provider projection, and Zen/Go protected runs fail closed for unaudited or
+  unsupported model transports instead of guessing Chat Completions.
+
+### Security
+
+- Protected mode rejects persistent collisions with Triss's transient provider
+  alias and verifies the final merged provider/model projection before any
+  credential-bearing child is spawned. Raw best-effort mode remains an
+  explicit risk acknowledgement and never claims proxy isolation.
+
+### Artifact integrity (0.38.0)
+
+- `triss-dsh-provider-bundle-0.38.0.tgz` — sha256
+  `bd9efaf1a692f82c15e49333c9a23071d9e30eee49e8e4576535dd91176fc71e`,
+  integrity
+  `sha512-sunelgV+I7TsL0OfkjDiv2XcnRQc+nQ4o3KjgfVZq390t8g2sVBTQTxPtNp+LU5IE41zm+fTqpXusAZzVQRuUg==`
+  (computed with the pinned release npm 11.6.2 via `npm pack`; `npm pack`
+  output is byte-deterministic).
+- Root `triss-coworker-0.38.0.tgz` sha256 is reproducible via `npm pack` at
+  tag `v0.38.0` (the root tarball ships `CHANGELOG.md`, so its hash cannot be
+  recorded inside this file); registry verification compares the packed
+  artifact against the published tarball byte-for-byte.
+
 ## [0.37.2] — 2026-08-20
 
 ### Added

package/README.md

@@ -11,6 +11,9 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Changelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog-orange.svg)](CHANGELOG.md)
 
+**Website:** [triss.work](https://triss.work/) · **Quickstart:**
+[triss.work/docs/getting-started](https://triss.work/docs/getting-started/)
+
 Triss is a small CLI (`triss`) that hands token-heavy I/O off to a cheap
 DeepSeek model so your expensive primary agent (Claude Code, Codex, or
 anything else that can run a shell/MCP tool) stays focused on reasoning and
@@ -48,7 +51,7 @@ tokens of tracker chatter into its own context. Adding a new provider
 
 ## Requirements
 
-- **Node.js ≥ 22** (LTS). Check with `node --version`.
+- **Node.js ≥ 22.12** (LTS). Check with `node --version`.
   - Don't have it? Install via [nvm](https://github.com/nvm-sh/nvm), [fnm](https://github.com/Schniz/fnm), Homebrew (`brew install node`), or [nodejs.org](https://nodejs.org/).
 - **npm** (ships with Node.js) — used only for the package-manager install path.
   `pnpm` and `yarn` also work.
@@ -148,9 +151,9 @@ triss config wizard
 
 The wizard first asks **Standard** vs **Advanced**:
 
-- **Standard** — for most users. Just two prompts: API key + worker model
-  name. Triss writes the model into both `flash` and `pro` presets so
-  `--model pro` works the same as `--model flash`. No questions about
+- **Standard** — for most users. Two prompts for API key + worker model
+  (writes the model into both `flash` and `pro` so `--model pro` works), then
+  asks which agent to wire up: **Claude / Codex / Both**. No questions about
   Jira/Linear/base URL/etc. *Recommended starting point.*
 - **Advanced** — full control: separate `flash`/`pro` presets, custom
   base URL, integrations (Jira, Linear, …), default-preset choice.
@@ -206,7 +209,7 @@ top-level commands; `triss config <Tab>`, `triss jira <Tab>`,
 
 | Mode in `triss config wizard` | What it does about your agent |
 | ----------------------------- | ------------------------------ |
-| **Standard** (default)        | Installs **both** paths automatically — MCP server *and* global agent rules. No question asked. |
+| **Standard** (default)        | After the two prompts, asks **Claude / Codex / Both** and installs MCP + global rules accordingly. |
 | **Advanced** (`--advanced`)   | Asks at the end: Both / MCP only / rules only / Skip. Default = Both. |
 
 The two paths cooperate: MCP is primary, `CLAUDE.md` / `AGENTS.md` rules are
@@ -747,10 +750,12 @@ implicit persistent conversation), `result_retention`
 / `result_id` (`retained` only for isolated changed runs with enforced
 result-store quota and a successful reservation), and `execution_capabilities`
 (eight honest `enforced|best_effort|unavailable` values plus
-`effective_isolation`). The `opencode2` beta engine still returns the older
-envelope shape (`session_id`, `exit_reason`, `final_text`, `files_changed`,
-`diff_stat`, `worktree`, `usage`, `warnings`) without these fields — use its
-`files_changed` / `diff_stat` / `worktree` as evidence there. Non-isolated `files_changed` is `null`; the only
+`effective_isolation`). OpenCode 2 emits the same envelope v2 fields,
+including `envelope_version`, lifecycle fields, activity, and
+OpenCode best-effort raw runs explicitly report
+`credential_isolation: "unavailable"` plus the stable downgrade warning;
+Crush remains proxy-backed and reports the proxy's `best_effort` capability.
+Non-isolated `files_changed` is `null`; the only
 changes-expectation evidence is `run_files_changed`. Process completion and a
 non-empty final text are not task satisfaction — use `--isolate`, check
 `run_files_changed` in the envelope, and verify the retained worktree/diff
@@ -889,6 +894,14 @@ external plugins. Unreadable/JSONC/unknown layers fail closed. Concurrent
 same-user config mutation between preflight and spawn remains outside this
 guard's threat model.
 
+Every OpenCode 1 run performs this final effective-config check before the
+credential-bearing engine spawn, using a bounded `opencode debug config`
+subprocess and a disposable probe credential. The probe mirrors the actual
+run's plugin mode: explicit one-shot provider runs use `--pure` in both
+processes; ordinary runs omit it in both, so their disk-backed deny-first bash
+policy and later account/org, managed-directory, and macOS MDM layers remain
+visible to the audit.
+
 ```bash
 triss coder init --provider opencode-zen              # guided: key + opencode.json
 triss coder models --provider opencode-zen            # see live Zen ids
@@ -959,7 +972,7 @@ Not every engine speaks every provider:
 | Engine     | Providers served                                  |
 | ---------- | ------------------------------------------------- |
 | `opencode` | Triss worker, Z.AI GLM, OpenCode Zen, OpenCode Go, Moonshot, Kimi for Coding |
-| `opencode2` | Same provider routing as V1 (shares `opencode.json`; one-shot `--provider` / `--small-model` overlays rejected — see [docs/engines/opencode2.md](docs/engines/opencode2.md)) |
+| `opencode2` | Same canonical provider routing as V1 (transient `OPENCODE_CONFIG_CONTENT` overlay; protected proxy by default; explicit literal-1 `TRISS_CODER_ALLOW_BEST_EFFORT_ISOLATION` enables raw best-effort with an honest downgrade warning; see [docs/engines/opencode2.md](docs/engines/opencode2.md)) |
 | `crush`    | Z.AI GLM (coding-plan only)                       |
 
 `triss coder init` drives setup in that order — **engine, then provider,
@@ -1228,8 +1241,7 @@ OpenCode stores (quota usage on subscriptions, not necessarily cash paid).
 ### An earlier example week (the Triss worker)
 
 One full week of real usage on this codebase, captured from the DeepSeek
-dashboard (May 6–13, 2026, all at list price — DeepSeek's off-peak window
-would add another ~75% discount we did not use):
+dashboard (May 6–13, 2026, all at the list price then in effect):
 
 | Metric         | Pro       | Flash     | **Total**  |
 | -------------- | --------- | --------- | ---------- |
@@ -1257,9 +1269,9 @@ raw 5.8M input. That compounds across turns.
 For reference, here is a single measured call of the kind that drives
 the weekly numbers above:
 
-| Task | Source bytes | DeepSeek (pro, -75%) | DeepSeek (pro, list price) | Same job in Opus 4.x |
-| ---- | ------------ | -------------------- | -------------------------- | -------------------- |
-| `triss ask --urls --paths` over the original `claude-coworker-model` README + 12 of our source files (18.3K in / 2.4K out, structured 4-section report) | ≈ 65 KB | **\$0.010** | \$0.040 | ≈ \$0.45 |
+| Task | Source bytes | DeepSeek (pro, list price) | Same job in Opus 4.x |
+| ---- | ------------ | -------------------------- | -------------------- |
+| `triss ask --urls --paths` over the original `claude-coworker-model` README + 12 of our source files (18.3K in / 2.4K out, structured 4-section report) | ≈ 65 KB | **\$0.040** | ≈ \$0.45 |
 
 Real savings depend on which operations you delegate (bulk reads win
 the most; tiny lookups break even); see `templates/claude.md` for the

package/bin/triss.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-const [nodeMajor] = process.versions.node.split('.').map(Number);
-if (nodeMajor < 22) {
+const [nodeMajor, nodeMinor] = process.versions.node.split('.').map(Number);
+if (nodeMajor < 22 || (nodeMajor === 22 && nodeMinor < 12)) {
   process.stderr.write(
-    `triss requires Node.js >= 22 (you are on ${process.versions.node}).\n` +
+    `triss requires Node.js >= 22.12.0 (you are on ${process.versions.node}).\n` +
       `Upgrade via nvm/fnm or https://nodejs.org/.\n`,
   );
   process.exit(1);

package/docs/configuration.md

@@ -272,7 +272,8 @@ self-hosted endpoints).
 | `TRISS_CODER_SMALL_MODEL`        | no       | `zai-coding-plan/glm-5-turbo`   | Small/fast **management/init intent** — written to `opencode.json` `small_model` by `init`/`triss coder model set`. **Not** a runtime override of an already-pinned small role (see precedence) |
 | `TRISS_CODER_OPENCODE_VERSION`   | no       | `1.18.7`           | Pin override for the `opencode-ai` npm install |
 | `TRISS_CODER_ENGINE`             | no       | `opencode`          | Coding engine: `opencode` (default), `opencode2` (beta — see [opencode2.md](engines/opencode2.md)), or `crush` |
-| `TRISS_CODER_OPENCODE2_VERSION`  | no       | `0.0.0-next-17430`  | Exact pin override for the `@opencode-ai/cli` npm install (opencode2 engine — exact match required) |
+| `TRISS_CODER_OPENCODE2_VERSION`  | no       | `0.0.0-beta-17793`  | Minimum accepted OpenCode 2 version; install from `@opencode-ai/cli@beta` (unsupported `next/dev/tui-v2` overrides fail closed) |
+| `TRISS_CODER_ALLOW_BEST_EFFORT_ISOLATION` | no | unset | Only literal `1` enables OpenCode raw-credential best-effort mode; OpenCode reports credential isolation as unavailable and allows same-UID tools/plugins/shell to read the selected key. Crush continues to require its credential proxy. |
 | `TRISS_CODER_CRUSH_VERSION`      | no       | `0.1.6`             | Pin override for the `@phpcraftdream/crush` npm install (crush engine) |
 | `TRISS_CODER_SESSION_CAP`        | no       | `4`                 | Persistent v2 session inventory cap per engine (fail closed) |
 
@@ -389,13 +390,23 @@ provider key, Triss audits the pinned version's full file graph: global
 configs from the actual runtime directory to the Git root (or `/` for non-Git
 directories). JSONC and unreadable layers fail closed. Because account/org,
 managed-directory, and macOS MDM settings load after the in-memory overlay,
-Triss also runs `opencode debug config --pure` under the exact sanitized child
-environment with a random canary instead of the real credential. The final
+Triss also validates the final merged config before every OpenCode 1 run under
+the exact sanitized child environment, using a bounded `opencode debug config`
+subprocess and a random canary instead of the real credential. The probe mirrors
+the actual run: an explicit one-shot provider pair uses `--pure` for both probe
+and run, while an ordinary run omits `--pure` for both so its disk-backed
+deny-first bash policy and late managed layers remain visible. The final
 main/small pair and selected provider must still match before the real key is
-injected; the actual one-shot run also uses `--pure`. This includes inherited
-cwd and created or reused isolation worktrees. Concurrent same-user mutation
-between preflight and spawn remains outside the guard's threat model;
-unverified OpenCode versions fail closed.
+injected. This includes inherited cwd and created or reused isolation worktrees.
+Concurrent same-user mutation between preflight and spawn remains outside the
+guard's threat model; unverified OpenCode versions fail closed.
+
+For OpenCode 1, main and small models from the same provider may use different
+audited transports. Triss then creates two transient provider aliases and two
+model-scoped loopback proxy routes that share only the same one-run proxy token;
+each route remains pinned to its own protocol, package, path, and model. OpenCode
+2 validates an explicit small model as belonging to the selected provider but
+does not configure or route it because that beta has no small-model role.
 
 **Direct OpenCode `main` and `small`** (you run `opencode` yourself, not via
 `triss coder run`): `opencode.json` is the source of truth — project

package/docs/engines/opencode-zen.md

@@ -65,7 +65,8 @@ safety layer.
 The Zen catalogue is **live and authoritative whenever it is reachable**.
 Triss reads `GET https://opencode.ai/zen/v1/models` and treats whatever that
 endpoint returns (authenticated) as the truth; the hardcoded priority list is
-used only as the explicitly unverified offline fallback described below.
+used only as the offline availability fallback described below. Its ids still
+need audited transport metadata before secure init can write them.
 Discover the live catalogue on demand:
 
 ```bash
@@ -106,12 +107,18 @@ configuration are untouched, and GLM stays reachable through either engine (see
 model. The priority list below is an **offline fallback only** — used when the
 catalogue can't be fetched, and always labelled **not verified**:
 
-| Role | Offline priority (first available wins; the live list may differ) |
+| Role | Offline priority (first available wins; transport-audited ids only) |
 |---|---|
-| main | `deepseek-v4-flash-free` → `north-mini-code-free` → `nemotron-3-ultra-free` → `mimo-v2.5-free` |
-| small | `deepseek-v4-flash-free` → `north-mini-code-free` → `mimo-v2.5-free` |
+| main | `deepseek-v4-flash-free` → `nemotron-3-ultra-free` → `mimo-v2.5-free` |
+| small | `deepseek-v4-flash-free` → `mimo-v2.5-free` |
 
-The interactive picker only offers models the live catalogue actually lists.
+The offline path filters this list through Triss's audited transport registry;
+catalogue-only ids such as `north-mini-code-free` are not written by secure
+init when the live catalogue cannot be verified.
+
+The secure interactive picker only offers live catalogue models with audited
+transport metadata. Explicit unaudited ids remain available only through the
+best-effort raw path described above.
 For backward compatibility, Zen init keeps usable ids from a mixed response
 even when unrelated entries are malformed; a response with no usable ids still
 falls back as not verified. OpenCode Go intentionally uses a stricter all-entry

package/docs/engines/opencode2.md

@@ -10,14 +10,23 @@ engine remains the default and is unchanged by installing or configuring V2.
 ## Installation
 
 ```bash
-npm install -g @opencode-ai/cli@0.0.0-next-17430   # exact pin
+npm install -g @opencode-ai/cli@beta   # current V2 beta channel
 triss coder init --engine opencode2
 ```
 
-- The pin is an **exact match** (`TRISS_CODER_OPENCODE2_VERSION` to override).
-  `triss status` reports the installed `opencode2` version against the pin.
-- `triss coder init --engine opencode2` never spawns a V2 service; it only
-  probes `opencode2 --version`.
+- The supported floor is `0.0.0-beta-17793`. `TRISS_CODER_OPENCODE2_VERSION`
+  overrides the minimum accepted version; it is not an exact pin. `next-*`,
+  `dev-*`, and `tui-v2-*` overrides are unsupported.
+- `triss status` reports the installed version against the effective minimum
+  and the required CLI capabilities (`--standalone`, `--format`, `--auto`,
+  `--model`).
+- `triss coder init --engine opencode2` never spawns a V2 service; it probes
+  `opencode2 --version` and `opencode2 run --help` under isolated runtime
+  roots.
+- When the host lacks a compatible `ps -axo` process snapshot (for example a
+  minimal BusyBox container), the required CLI flags and version still qualify
+  the engine. Init, status, and runs report that resident-service verification
+  is best effort instead of misdiagnosing the installed beta as incompatible.
 
 ## Shared config implications
 
@@ -25,15 +34,19 @@ V2 **shares** the V1 `opencode.json` (global and/or project) and the same env
 pins — one config file, both engines. Consequences:
 
 - The **shell policies of the two engines are NOT one policy**: the opencode2
-  beta requires deny-everything (`permission.bash = {"*":"deny"}`) because the
+  beta requires deny-everything (`permission.bash = {"*":"deny"}`) in protected
+  mode because the
   credential sits in the child environment, while V1 init writes its
   allowlist (`git status`, `git diff`, `npm test`, …) into the same shared
-  file. A fresh `coder init --engine opencode2` writes the deny-everything
+  file. A fresh protected `coder init --engine opencode2` writes the deny-everything
   form (and warns that plain V1 `coder run` loses the allowlisted commands);
   a tree initialized by V1 init is **rejected by V2** until the allow rules
   are removed. Re-running plain `triss coder init` restores the V1 allowlist
   — and makes the tree V2-incompatible again. This tension is inherent to
   the shared-config beta and goes away only with real credential isolation.
+  Explicit best-effort mode (`TRISS_CODER_ALLOW_BEST_EFFORT_ISOLATION=1`)
+  accepts the raw-credential risk, so a fresh V2 config uses the normal V1
+  allowlist and an existing allow/ask policy remains byte-identical.
 - `triss coder model set` / `triss coder models` show a shared-config notice
   when the resolved engine is `opencode2`.
 - Model transactions (`model set`, rollback) ride the same
@@ -49,6 +62,15 @@ reports `small_role_effective: false` for `opencode2`; the `small_model` value
 in the shared config is an **OpenCode 1 compatibility value** and is shown as
 such. There is no per-V2 small override.
 
+Zen and Go protected runs use Triss's versioned, model-specific transport
+metadata. Audited models may use Chat Completions, Responses, or Anthropic
+Messages as indicated by that metadata; an unknown or Google/Gemini model is
+rejected before spawn instead of being guessed as Chat. In explicit
+`best_effort_raw` mode, an unknown Zen/Go model uses OpenCode's built-in
+provider metadata while persistent provider overrides are still rejected. An
+explicit `--small-model` is validated for provider ownership but does not
+participate in V2 transport resolution and is reported as `used: false`.
+
 ## Usage gaps
 
 Usage comes from per-step `step_finish` events (`usage_source: "opencode2"`).
@@ -59,12 +81,26 @@ maps `opencode2` into the same engine family as `opencode` (explicit
 engines — the Go reseller's tariffs are not modeled (a
 `TRISS_PRICE_OPENCODE_GO_<MODEL>` override prices it explicitly).
 
-## Plugin, agent, and custom-tool gates (fail closed)
+## Credential modes and executable surfaces
+
+Protected mode is the default. It passes only a run-scoped proxy token to the
+engine and keeps the strict deny-first executable-surface policy. Any
+configured or discovered plugin, agent, or custom-tool source rejects before
+the protected child starts.
+
+Explicit best-effort mode is selected only by the literal environment value
+`TRISS_CODER_ALLOW_BEST_EFFORT_ISOLATION=1`. It passes only the selected raw
+provider credential, does not start the credential proxy, allows normal shell
+policy and discovered agents/plugins/tools after config parse/shape checks,
+and emits `TRISS_CODER_CREDENTIAL_ISOLATION_DOWNGRADED`. The envelope reports
+`execution_capabilities.credential_isolation: "unavailable"`; same-UID code,
+plugins, tools, and shell commands may read the credential. Endpoint, model,
+package, header, and credential-binding pinning still applies.
 
-No V2 plugin, subagent, or custom tool is verified to preserve the deny-first
-policy yet, so **any** configured or discovered plugin, agent, or custom-tool
-source rejects the run **before any process spawns or credential is
-forwarded** — in both `coder init` and `coder run`:
+The structural/config-shape checks apply in both modes. The executable-source
+gate is mode-dependent: protected mode rejects these sources, while
+best-effort mode inspects them and permits them after the shape checks. In
+particular:
 
 - `~/.config/opencode/plugins`, `.opencode/plugin`, configured plugin entries;
 - `~/.config/opencode/agents/*`, `.opencode/agent/*`, configured agent
@@ -73,8 +109,10 @@ forwarded** — in both `coder init` and `coder run`:
   `.opencode/tool`, and `.opencode/tools` custom-tool directories.
 
 The error names the offending source path (never secrets). Remove or disable
-the source, then re-run. One-shot `--provider`/`--small-model` overlays are
-likewise rejected for `opencode2` until per-route translation fixtures exist.
+the source for protected mode, or explicitly acknowledge best-effort risk.
+One-shot provider selection is supported by both OpenCode engines; OpenCode 2
+validates a supplied small model but reports that it has no separate small
+role.
 
 ## Rollback
 
@@ -99,14 +137,16 @@ To fully remove V2: `npm uninstall -g @opencode-ai/cli` and delete
 
 | Symptom | Cause / fix |
 |---|---|
-| `live-allow-rule (git status)` / `… not deny-everything` from `coder init --engine opencode2` | The existing (typically V1-authored) `opencode.json` carries live bash allow rules — the V2 beta cannot run while any exist. V2 init rejects **before writing anything**: remove the allow rules from `opencode.json` (V1 runs lose them too), or stay on `--engine opencode` until the V2 beta grows real credential isolation. |
-| V1 `coder run` lost `git status` / `npm test` after a V2 init | A fresh V2 init writes deny-everything into the SHARED `opencode.json` (init prints this warning). Export `TRISS_CODER_ENGINE=opencode2`, or re-run plain `triss coder init` to restore the V1 allowlist — which makes the tree V2-incompatible again. |
-| `unsupported plugin source "…"` / `unsupported agent source "…"` / `unsupported custom tool source "…"` | The static preflight found an unverified source. Remove or disable it (see the path in the error). **Note:** the standard `~/.config/opencode/agents/` templates written by a V1 `triss coder init` also trip this gate — V2 beta requires a machine without V1 agent templates (or with them temporarily moved) until subagents are fixture-verified. |
+| `live-allow-rule (git status)` / `… not deny-everything` from protected `coder init --engine opencode2` | The existing (typically V1-authored) `opencode.json` carries live bash allow rules — protected V2 cannot run while any exist. Protected init rejects **before writing anything**: remove the allow rules from `opencode.json` (V1 runs lose them too), or use the explicit best-effort acknowledgement if the raw-credential risk is acceptable. |
+| V1 `coder run` lost `git status` / `npm test` after a protected V2 init | A fresh **protected** V2 init writes deny-everything into the SHARED `opencode.json` (init prints this warning). Export `TRISS_CODER_ENGINE=opencode2`, or re-run plain `triss coder init` to restore the V1 allowlist. A fresh best-effort V2 init writes the normal V1 allowlist and emits no false degradation warning. |
+| `unsupported plugin source "…"` / `unsupported agent source "…"` / `unsupported custom tool source "…"` | In protected mode, the static preflight found an unverified source. Remove or disable it (see the path in the error), or explicitly opt into `TRISS_CODER_ALLOW_BEST_EFFORT_ISOLATION=1`; best-effort mode permits normal plugins, agents, and custom tools after the structural/config-shape checks and warns that the selected raw credential is exposed. |
 | `Agent not found: "coder"` on an older Triss build | Older builds injected `--agent coder` into V2 runs; current builds use the engine's built-in primary agent when `--agent` is not passed. Update Triss. |
-| `opencode2 not found` | Install the exact pin: `npm install -g @opencode-ai/cli@0.0.0-next-17430`. |
-| `version mismatch (pin …)` | `TRISS_CODER_OPENCODE2_VERSION` override or reinstall the pinned build — V2 is exact-pin only. |
+| `opencode2 not found` | Install the current beta channel: `npm install -g @opencode-ai/cli@beta`. |
+| `below minimum` / `unsupported OpenCode 2 CLI contract` | Remove an obsolete `next-*` override or set a supported beta minimum at or above `0.0.0-beta-17793`; verify that `run --help` exposes the required flags. |
+| `OPENCODE2_SERVICE_SNAPSHOT_UNAVAILABLE` | This host cannot run the optional `ps -axo` resident-service check. The verified `--standalone` CLI contract remains usable with best-effort service verification; use a host with compatible process inspection when a post-probe service proof is required. |
+| `capability-probe-unavailable` | The isolated probe HOME/XDG root could not be created or inspected. Fix `TMPDIR`/filesystem permissions and retry; reinstalling OpenCode 2 does not repair this host error. |
 | `usage_status: "missing"` | The run emitted no `step_finish`; counters are null by contract, not a bug. |
 | `--session and --continue … ambiguous` | Pick one resume intent; they are mutually exclusive on V2. |
 | Session slug not found across engines | By design: V1 and V2 keep separate session maps; a slug never cross-resumes. |
-| `UnexpectedStatus` when resuming `--session ses_…` | Known upstream issue in pin `0.0.0-next-17430`: the V2 binary fails a resume by real session id (verified with a direct `opencode2 run --session` call outside Triss). Reported; not a Triss bug. |
+| `UnexpectedStatus` when resuming `--session ses_…` | An upstream beta compatibility issue. Capture the installed beta version and CLI capability output when reporting it; Triss does not roll back or maintain a future-beta denylist. |
 | `provider.no-route: Model unavailable: opencode-go/…` | Transient provider-side catalogue failure — the same command succeeded minutes earlier. Retry; if it persists, check the Go subscription/status page. |

package/docs/mcp.md

@@ -503,7 +503,11 @@ the default), `OPENCODE_API_KEY` (OpenCode Zen or paid OpenCode Go — see
    `debug config --pure` under the sanitized child environment and a random
    canary instead of the real key. Late provider/model overrides, unauditable
    JSONC, and unknown effective config fail closed; the actual run also uses
-   `--pure`.
+   `--pure`. All OpenCode 1 MCP runs perform the bounded final-config probe
+   before the credential-bearing spawn. Calls without `provider` omit `--pure`
+   from both probe and run, preserving their disk-backed deny-first bash policy
+   while keeping later account/org, managed-directory, and macOS MDM layers in
+   the audited view.
    Without `provider`, `model` keeps its legacy main-only semantics. `model`
    takes a `<provider>/<id>`
    string — a Triss worker model (`triss-worker/deepseek-v4-flash`, reuses

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triss-coworker",
-  "version": "0.37.2",
+  "version": "0.38.0",
   "description": "Give your AI coding agent a cheap DeepSeek coworker. Delegate bulk reads, boilerplate, and doc updates to save 60-70% of your token budget.",
   "type": "module",
   "bin": {
@@ -26,6 +26,7 @@
     "docs/troubleshooting.md",
     "docs/integrations/",
     "docs/engines/",
+    "!docs/website/",
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
@@ -77,9 +78,9 @@
   "bugs": {
     "url": "https://github.com/ayleen/triss-coworker/issues"
   },
-  "homepage": "https://github.com/ayleen/triss-coworker#readme",
+  "homepage": "https://triss.work",
   "engines": {
-    "node": ">=22"
+    "node": ">=22.12.0"
   },
   "packageManager": "npm@11.6.2",
   "dependencies": {

package/src/coder-credential-proxy.js

@@ -79,7 +79,8 @@ function isValidOrigin(endpoint) {
  * @param {string} opts.endpoint       canonical upstream ORIGIN (https, no path)
  * @param {string} opts.credential     real provider credential (in-memory only)
  * @param {string} [opts.pathPrefix='/v1'] OpenAI-compatible scope prefix
- * @param {string} [opts.authStyle='bearer'] 'bearer' | 'anthropic'
+ * @param {string} [opts.protocol] 'openai_chat' | 'openai_responses' | 'anthropic_messages'
+ * @param {string} [opts.authStyle='bearer'] compatibility alias for protocol auth
  * @param {string} [opts.token]        pre-generated single-run token (tests)
  * @param {number} [opts.maxRequests]  request-count cap
  * @param {number} [opts.maxBodyBytes] per-request body-byte cap
@@ -103,7 +104,10 @@ export async function startCoderCredentialProxy(opts = {}) {
   const pathPrefix = typeof opts.pathPrefix === 'string' && opts.pathPrefix.startsWith('/')
     ? opts.pathPrefix.replace(/\/+$/, '') || '/'
     : '/v1';
-  const authStyle = opts.authStyle === 'anthropic' ? 'anthropic' : 'bearer';
+  const protocol = ['openai_chat', 'openai_responses', 'anthropic_messages'].includes(opts.protocol)
+    ? opts.protocol
+    : opts.authStyle === 'anthropic' ? 'anthropic_messages' : 'openai_chat';
+  const authStyle = protocol === 'anthropic_messages' ? 'anthropic' : 'bearer';
   if (typeof provider !== 'string' || provider.length === 0) {
     throw new TypeError('startCoderCredentialProxy: provider is required');
   }
@@ -167,9 +171,9 @@ export async function startCoderCredentialProxy(opts = {}) {
   // for the pinned protocol is forwarded — the whole prefix subtree is NOT
   // open (other mutating or billed provider routes must be unreachable).
   const allowedPaths = new Set(
-    authStyle === 'anthropic'
+    protocol === 'anthropic_messages'
       ? [`${pathPrefix}/messages`]
-      : [`${pathPrefix}/chat/completions`],
+      : [protocol === 'openai_responses' ? `${pathPrefix}/responses` : `${pathPrefix}/chat/completions`],
   );
 
   function pathAllowed(url) {
@@ -218,6 +222,13 @@ export async function startCoderCredentialProxy(opts = {}) {
         res.end(JSON.stringify({ error: { message: 'absolute-URI forward-proxy route denied' } }));
         return;
       }
+      // The proxy is an inference-only surface.  Do not let a GET/PUT/etc.
+      // reach the body parser and get forwarded as POST upstream.
+      if (req.method !== 'POST') {
+        res.writeHead(405, { 'content-type': 'application/json', allow: 'POST' });
+        res.end(JSON.stringify({ error: { message: 'only POST is supported' } }));
+        return;
+      }
       // Provider/model pinning: only the pinned OpenAI-compatible scope is
       // forwarded; everything else is denied. The prefix match is
       // boundary-exact — a `/v10` route must not pass a `/v1` pin.
@@ -437,6 +448,7 @@ export async function startCoderCredentialProxy(opts = {}) {
     scopedBaseUrl: `http://${LOOPBACK_HOST}:${port}${pathPrefix}`,
     provider,
     model,
+    protocol,
     revoke,
     closed,
   };