agent-lifecycle-kit 1.50.1__py3-none-any.whl

agent_lifecycle/host_protocol/inspection_gemini_cli.py

@@ -0,0 +1,163 @@
+"""Safe host inspection probes for Gemini CLI."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from agent_lifecycle.host_protocol.inspection_common import (
+    CommandRunner,
+    _check_cursor_plugin_config,
+    _check_hermes_registry,
+    _check_hermes_skills_config,
+    _check_hermes_slash_commands,
+    _check_json_plugin_config,
+    _check_scaffold_projection_files,
+    _cursor_model_count,
+    _cursor_subscription_tier,
+    _display_binary,
+    _first_non_empty_line,
+    _missing_markers,
+    _run_command_check,
+    _run_command_check_with_text,
+)
+
+def _inspect_gemini_cli(
+    *,
+    descriptor_path: Path | None,
+    host_bin: str,
+    project_root: Path,
+    timeout_seconds: float,
+    command_runner: CommandRunner,
+) -> tuple[list[dict[str, Any]], dict[str, Any], list[dict[str, Any]]]:
+    checks: list[dict[str, Any]] = []
+    blockers: list[dict[str, Any]] = []
+    capabilities: dict[str, Any] = {
+        "hostCommands": {
+            "status": "CHECKED",
+            "binary": _display_binary(host_bin),
+            "profile": "gemini-cli-safe-cli",
+        },
+        "headlessExecution": {"status": "UNKNOWN"},
+        "eventStream": {"status": "UNKNOWN"},
+        "usageAttestation": {"status": "UNKNOWN", "requiresLiveReceipt": True},
+        "permissionMode": {"status": "UNKNOWN"},
+        "modelSelection": {"status": "UNKNOWN"},
+        "skillDiscovery": {"status": "UNKNOWN"},
+        "extensionDiscovery": {"status": "UNKNOWN"},
+        "mcpDiscovery": {"status": "UNKNOWN"},
+        "localModelRouting": {"status": "UNKNOWN"},
+        "authState": {"status": "NOT_PROBED", "reason": "no-safe-auth-status-command-discovered"},
+        "configuration": {},
+    }
+
+    if descriptor_path is not None:
+        projection = _check_scaffold_projection_files(descriptor_path.parent, project_root=project_root, host="gemini-cli")
+        checks.append(projection)
+        if projection["status"] == "FAIL":
+            blockers.append({"code": "gemini-cli-projection-unavailable", "message": "Gemini CLI scaffold projection files are missing or invalid"})
+        capabilities["configuration"]["projection"] = projection["details"]
+
+    version_check, version_text = _run_command_check(
+        "gemini-cli-version",
+        [host_bin, "--version"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+    )
+    checks.append(version_check)
+    if version_check["status"] == "FAIL":
+        blockers.append({"code": "gemini-cli-binary-unavailable", "message": "Gemini CLI binary is unavailable or failed version probing"})
+    capabilities["hostVersion"] = version_text
+
+    help_check, _ = _run_command_check(
+        "gemini-cli-help",
+        [host_bin, "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=[
+            "--prompt",
+            "--output-format",
+            "stream-json",
+            "--model",
+            "--yolo",
+            "--approval-mode",
+            "--sandbox",
+            "--worktree",
+            "skills",
+            "mcp",
+            "extensions",
+        ],
+    )
+    checks.append(help_check)
+    if help_check["status"] == "FAIL":
+        blockers.append({"code": "gemini-cli-help-unavailable", "message": "Gemini CLI help does not expose required adapter surfaces"})
+    else:
+        capabilities["headlessExecution"] = {"status": "SUPPORTED", "command": "--prompt", "streamJson": "--output-format stream-json"}
+        capabilities["eventStream"] = {"status": "DISCOVERED", "source": "stream-json-output", "requiresReceiptValidation": True}
+        capabilities["usageAttestation"] = {
+            "status": "UNPROVEN",
+            "source": "stream-json-output",
+            "requiresLiveReceipt": True,
+        }
+        capabilities["permissionMode"] = {
+            "status": "DISCOVERED",
+            "yoloFlag": "--yolo",
+            "approvalMode": "--approval-mode",
+            "sandboxFlag": "--sandbox",
+            "adapterPolicy": "fail-closed",
+        }
+        capabilities["modelSelection"] = {"status": "DISCOVERED", "selector": "--model"}
+
+    skills_help, _ = _run_command_check(
+        "gemini-cli-skills-help",
+        [host_bin, "skills", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["list", "install", "enable", "disable"],
+    )
+    checks.append(skills_help)
+    if skills_help["status"] == "FAIL":
+        blockers.append({"code": "gemini-cli-skills-surface-unavailable", "message": "Gemini CLI skills command surface is unavailable"})
+    else:
+        capabilities["skillDiscovery"] = {"status": "DISCOVERED", "source": "skills-command"}
+
+    extensions_help, _ = _run_command_check(
+        "gemini-cli-extensions-help",
+        [host_bin, "extensions", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["install", "validate", "list"],
+    )
+    checks.append(extensions_help)
+    if extensions_help["status"] == "FAIL":
+        blockers.append({"code": "gemini-cli-extensions-surface-unavailable", "message": "Gemini CLI extensions command surface is unavailable"})
+    else:
+        capabilities["extensionDiscovery"] = {"status": "DISCOVERED", "source": "extensions-command"}
+
+    mcp_help, _ = _run_command_check(
+        "gemini-cli-mcp-help",
+        [host_bin, "mcp", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["add", "list", "enable", "disable"],
+    )
+    checks.append(mcp_help)
+    if mcp_help["status"] == "FAIL":
+        blockers.append({"code": "gemini-cli-mcp-surface-unavailable", "message": "Gemini CLI MCP command surface is unavailable"})
+    else:
+        capabilities["mcpDiscovery"] = {"status": "DISCOVERED", "source": "mcp-command"}
+
+    gemma_help, _ = _run_command_check(
+        "gemini-cli-gemma-help",
+        [host_bin, "gemma", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["setup", "start", "status"],
+    )
+    checks.append(gemma_help)
+    if gemma_help["status"] == "FAIL":
+        blockers.append({"code": "gemini-cli-local-model-surface-unavailable", "message": "Gemini CLI local model routing surface is unavailable"})
+    else:
+        capabilities["localModelRouting"] = {"status": "DISCOVERED", "source": "gemma-command"}
+
+    return checks, capabilities, blockers

agent_lifecycle/host_protocol/inspection_hermes.py

@@ -0,0 +1,161 @@
+"""Safe host inspection probes for Hermes."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from agent_lifecycle.host_protocol.inspection_common import (
+    CommandRunner,
+    _check_cursor_plugin_config,
+    _check_hermes_registry,
+    _check_hermes_skills_config,
+    _check_hermes_slash_commands,
+    _check_json_plugin_config,
+    _check_scaffold_projection_files,
+    _cursor_model_count,
+    _cursor_subscription_tier,
+    _display_binary,
+    _first_non_empty_line,
+    _missing_markers,
+    _run_command_check,
+    _run_command_check_with_text,
+)
+
+def _inspect_hermes(
+    *,
+    descriptor_maturity: Any,
+    descriptor_path: Path | None,
+    host_bin: str,
+    project_root: Path,
+    timeout_seconds: float,
+    command_runner: CommandRunner,
+) -> tuple[list[dict[str, Any]], dict[str, Any], list[dict[str, Any]]]:
+    checks: list[dict[str, Any]] = []
+    blockers: list[dict[str, Any]] = []
+    capabilities: dict[str, Any] = {
+        "hostCommands": {
+            "status": "CHECKED",
+            "binary": _display_binary(host_bin),
+            "profile": "hermes-safe-cli",
+        },
+        "headlessExecution": {"status": "UNKNOWN"},
+        "eventStream": {"status": "UNKNOWN"},
+        "usageAttestation": {"status": "UNKNOWN", "requiresLiveReceipt": True},
+        "permissionMode": {"status": "UNKNOWN"},
+        "modelSelection": {"status": "UNKNOWN"},
+        "skillDiscovery": {"status": "UNKNOWN"},
+        "slashCommands": {"status": "UNKNOWN"},
+        "authState": {"status": "NOT_PROBED", "reason": "credential-state-redacted"},
+        "configuration": {},
+    }
+
+    root_skills = _check_hermes_skills_config(project_root / "skills.sh.json", project_root=project_root)
+    checks.append(root_skills)
+    if root_skills["status"] == "FAIL":
+        blockers.append({"code": "hermes-skills-config-unavailable", "message": "Hermes skills config is missing or invalid"})
+    capabilities["configuration"]["skillsConfig"] = root_skills["details"]
+
+    if descriptor_path is not None:
+        registry = _check_hermes_registry(
+            descriptor_path.parent / "hermes.registry.json",
+            project_root=project_root,
+            expected_maturity=str(descriptor_maturity) if isinstance(descriptor_maturity, str) else None,
+        )
+        checks.append(registry)
+        if registry["status"] == "FAIL":
+            blockers.append({"code": "hermes-registry-unavailable", "message": "Hermes registry metadata is missing or invalid"})
+        capabilities["configuration"]["registry"] = registry["details"]
+
+        slash_commands = _check_hermes_slash_commands(descriptor_path.parent / "slash-commands.json", project_root=project_root)
+        checks.append(slash_commands)
+        if slash_commands["status"] == "FAIL":
+            blockers.append({"code": "hermes-slash-commands-unavailable", "message": "Hermes slash-command metadata is missing or invalid"})
+        capabilities["configuration"]["slashCommands"] = slash_commands["details"]
+        if slash_commands["status"] == "PASS":
+            capabilities["slashCommands"] = {"status": "DISCOVERED", "unsupportedOperationPolicy": "fail-closed"}
+
+    version_check, version_text = _run_command_check(
+        "hermes-version",
+        [host_bin, "--version"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+    )
+    checks.append(version_check)
+    if version_check["status"] == "FAIL":
+        blockers.append({"code": "hermes-binary-unavailable", "message": "Hermes binary is unavailable or failed version probing"})
+    capabilities["hostVersion"] = version_text
+
+    root_help, _ = _run_command_check(
+        "hermes-root-help",
+        [host_bin, "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["--oneshot", "--usage-file", "--model", "--provider", "--yolo", "--safe-mode", "skills", "auth", "status"],
+    )
+    checks.append(root_help)
+    if root_help["status"] == "FAIL":
+        blockers.append({"code": "hermes-root-help-unavailable", "message": "Hermes root help does not expose required adapter surfaces"})
+    else:
+        capabilities["headlessExecution"] = {"status": "DISCOVERED", "command": "--oneshot", "usageFile": "--usage-file"}
+        capabilities["usageAttestation"] = {
+            "status": "DISCOVERED",
+            "source": "usage-file",
+            "requiresLiveReceipt": True,
+        }
+        capabilities["permissionMode"] = {"status": "DISCOVERED", "autoApproveFlag": "--yolo", "safeModeFlag": "--safe-mode", "adapterPolicy": "fail-closed"}
+        capabilities["modelSelection"] = {"status": "DISCOVERED", "selector": "--model", "providerSelector": "--provider"}
+
+    chat_help, _ = _run_command_check(
+        "hermes-chat-help",
+        [host_bin, "chat", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["--query", "--model", "--provider", "--toolsets", "--skills", "--yolo", "--safe-mode"],
+    )
+    checks.append(chat_help)
+    if chat_help["status"] == "FAIL":
+        blockers.append({"code": "hermes-chat-help-unavailable", "message": "Hermes chat help does not expose required adapter surfaces"})
+
+    skills_help, _ = _run_command_check(
+        "hermes-skills-help",
+        [host_bin, "skills", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["install", "list", "check"],
+    )
+    checks.append(skills_help)
+    if skills_help["status"] == "FAIL":
+        blockers.append({"code": "hermes-skills-help-unavailable", "message": "Hermes skills help does not expose required adapter surfaces"})
+    else:
+        capabilities["skillDiscovery"] = {"status": "DISCOVERED", "source": "skills-command"}
+
+    auth_help, _ = _run_command_check(
+        "hermes-auth-help",
+        [host_bin, "auth", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["status", "list", "logout"],
+    )
+    checks.append(auth_help)
+    if auth_help["status"] == "FAIL":
+        blockers.append({"code": "hermes-auth-surface-unavailable", "message": "Hermes auth command surface is unavailable"})
+    else:
+        capabilities["authState"] = {
+            "status": "NOT_DISCLOSED",
+            "commandSurface": "DISCOVERED",
+            "reason": "credential-state-redacted",
+        }
+
+    status_help, _ = _run_command_check(
+        "hermes-status-help",
+        [host_bin, "status", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["--all", "redacted"],
+    )
+    checks.append(status_help)
+    if status_help["status"] == "FAIL":
+        blockers.append({"code": "hermes-status-surface-unavailable", "message": "Hermes status command surface is unavailable"})
+
+    return checks, capabilities, blockers

agent_lifecycle/host_protocol/inspection_kimi_code.py

@@ -0,0 +1,169 @@
+"""Safe host inspection probes for Kimi Code."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from agent_lifecycle.host_protocol.inspection_common import (
+    CommandRunner,
+    _check_cursor_plugin_config,
+    _check_hermes_registry,
+    _check_hermes_skills_config,
+    _check_hermes_slash_commands,
+    _check_json_plugin_config,
+    _check_scaffold_projection_files,
+    _cursor_model_count,
+    _cursor_subscription_tier,
+    _display_binary,
+    _first_non_empty_line,
+    _missing_markers,
+    _run_command_check,
+    _run_command_check_with_text,
+)
+
+def _inspect_kimi_code(
+    *,
+    descriptor_path: Path | None,
+    host_bin: str,
+    project_root: Path,
+    timeout_seconds: float,
+    command_runner: CommandRunner,
+) -> tuple[list[dict[str, Any]], dict[str, Any], list[dict[str, Any]]]:
+    checks: list[dict[str, Any]] = []
+    blockers: list[dict[str, Any]] = []
+    capabilities: dict[str, Any] = {
+        "hostCommands": {
+            "status": "CHECKED",
+            "binary": _display_binary(host_bin),
+            "profile": "kimi-code-safe-cli",
+        },
+        "headlessExecution": {"status": "UNKNOWN"},
+        "eventStream": {"status": "UNKNOWN"},
+        "usageAttestation": {"status": "UNKNOWN", "requiresLiveReceipt": True},
+        "permissionMode": {"status": "UNKNOWN"},
+        "modelSelection": {"status": "UNKNOWN"},
+        "skillDiscovery": {"status": "UNKNOWN"},
+        "providerDiscovery": {"status": "UNKNOWN"},
+        "agentProtocol": {"status": "UNKNOWN"},
+        "resultExport": {"status": "UNKNOWN"},
+        "configurationValidation": {"status": "UNKNOWN"},
+        "authState": {"status": "NOT_PROBED", "reason": "credential-state-redacted"},
+        "configuration": {},
+    }
+
+    if descriptor_path is not None:
+        projection = _check_scaffold_projection_files(descriptor_path.parent, project_root=project_root, host="kimi-code")
+        checks.append(projection)
+        if projection["status"] == "FAIL":
+            blockers.append({"code": "kimi-code-projection-unavailable", "message": "Kimi Code scaffold projection files are missing or invalid"})
+        capabilities["configuration"]["projection"] = projection["details"]
+
+    version_check, version_text = _run_command_check(
+        "kimi-code-version",
+        [host_bin, "--version"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+    )
+    checks.append(version_check)
+    if version_check["status"] == "FAIL":
+        blockers.append({"code": "kimi-code-binary-unavailable", "message": "Kimi Code binary is unavailable or failed version probing"})
+        capabilities["hostCommands"]["status"] = "BINARY_MISSING"
+        capabilities["hostVersion"] = None
+        return checks, capabilities, blockers
+    capabilities["hostVersion"] = version_text
+
+    help_check, _ = _run_command_check(
+        "kimi-code-help",
+        [host_bin, "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=[
+            "--prompt",
+            "--output-format",
+            "stream-json",
+            "--model",
+            "--yolo",
+            "--auto",
+            "--skills-dir",
+            "--session",
+            "--continue",
+            "--plan",
+            "export",
+            "provider",
+            "acp",
+            "login",
+            "doctor",
+        ],
+    )
+    checks.append(help_check)
+    if help_check["status"] == "FAIL":
+        blockers.append({"code": "kimi-code-help-unavailable", "message": "Kimi Code help surface is unavailable"})
+    else:
+        capabilities["headlessExecution"] = {"status": "SUPPORTED", "command": "--prompt", "streamJson": "--output-format stream-json"}
+        capabilities["eventStream"] = {"status": "DISCOVERED", "source": "stream-json-output", "requiresReceiptValidation": True}
+        capabilities["usageAttestation"] = {"status": "UNPROVEN", "requiresLiveReceipt": True}
+        capabilities["permissionMode"] = {
+            "status": "DISCOVERED",
+            "yoloFlag": "--yolo",
+            "autoFlag": "--auto",
+            "planFlag": "--plan",
+            "adapterPolicy": "fail-closed",
+        }
+        capabilities["modelSelection"] = {"status": "DISCOVERED", "selector": "--model"}
+        capabilities["skillDiscovery"] = {"status": "DISCOVERED", "source": "skills-dir"}
+        capabilities["authState"] = {"status": "NOT_PROBED", "commandSurface": "DISCOVERED", "reason": "login-is-device-code-flow"}
+
+    provider_help, _ = _run_command_check(
+        "kimi-code-provider-help",
+        [host_bin, "provider", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["add", "remove", "list", "catalog"],
+    )
+    checks.append(provider_help)
+    if provider_help["status"] == "FAIL":
+        blockers.append({"code": "kimi-code-provider-surface-unavailable", "message": "Kimi Code provider command surface is unavailable"})
+    else:
+        capabilities["providerDiscovery"] = {"status": "DISCOVERED", "source": "provider-command"}
+
+    export_help, _ = _run_command_check(
+        "kimi-code-export-help",
+        [host_bin, "export", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["sessionId", "--output", "--yes"],
+    )
+    checks.append(export_help)
+    if export_help["status"] == "FAIL":
+        blockers.append({"code": "kimi-code-export-surface-unavailable", "message": "Kimi Code export command surface is unavailable"})
+    else:
+        capabilities["resultExport"] = {"status": "DISCOVERED", "command": "export"}
+
+    acp_help, _ = _run_command_check(
+        "kimi-code-acp-help",
+        [host_bin, "acp", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["Agent Client Protocol", "stdio", "--login"],
+    )
+    checks.append(acp_help)
+    if acp_help["status"] == "FAIL":
+        blockers.append({"code": "kimi-code-acp-surface-unavailable", "message": "Kimi Code ACP command surface is unavailable"})
+    else:
+        capabilities["agentProtocol"] = {"status": "DISCOVERED", "source": "acp-stdio-server"}
+
+    doctor_help, _ = _run_command_check(
+        "kimi-code-doctor-help",
+        [host_bin, "doctor", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["config", "tui"],
+    )
+    checks.append(doctor_help)
+    if doctor_help["status"] == "FAIL":
+        blockers.append({"code": "kimi-code-doctor-surface-unavailable", "message": "Kimi Code configuration validation surface is unavailable"})
+    else:
+        capabilities["configurationValidation"] = {"status": "DISCOVERED", "source": "doctor-command"}
+
+    return checks, capabilities, blockers

agent_lifecycle/host_protocol/inspection_opencode.py

@@ -0,0 +1,147 @@
+"""Safe host inspection probes for OpenCode."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from agent_lifecycle.host_protocol.inspection_common import (
+    CommandRunner,
+    _check_cursor_plugin_config,
+    _check_hermes_registry,
+    _check_hermes_skills_config,
+    _check_hermes_slash_commands,
+    _check_json_plugin_config,
+    _check_scaffold_projection_files,
+    _cursor_model_count,
+    _cursor_subscription_tier,
+    _display_binary,
+    _first_non_empty_line,
+    _missing_markers,
+    _run_command_check,
+    _run_command_check_with_text,
+)
+
+def _inspect_opencode(
+    *,
+    descriptor_path: Path | None,
+    host_bin: str,
+    project_root: Path,
+    timeout_seconds: float,
+    command_runner: CommandRunner,
+) -> tuple[list[dict[str, Any]], dict[str, Any], list[dict[str, Any]]]:
+    checks: list[dict[str, Any]] = []
+    blockers: list[dict[str, Any]] = []
+    capabilities: dict[str, Any] = {
+        "hostCommands": {
+            "status": "CHECKED",
+            "binary": _display_binary(host_bin),
+            "profile": "opencode-safe-cli",
+        },
+        "headlessExecution": {"status": "UNKNOWN"},
+        "eventStream": {"status": "UNKNOWN"},
+        "usageAttestation": {"status": "UNKNOWN", "requiresLiveReceipt": True},
+        "permissionMode": {"status": "UNKNOWN"},
+        "modelSelection": {"status": "UNKNOWN"},
+        "resultExport": {"status": "UNKNOWN"},
+        "authState": {"status": "NOT_PROBED", "reason": "credential-state-redacted"},
+        "configuration": {},
+    }
+
+    root_config = _check_json_plugin_config(
+        project_root / "opencode.json",
+        project_root=project_root,
+        expected_plugin="./adapters/opencode/plugins/agent-lifecycle-kit.js",
+        check_name="opencode-root-config",
+    )
+    checks.append(root_config)
+    if root_config["status"] == "FAIL":
+        blockers.append({"code": "opencode-root-config-unavailable", "message": "OpenCode root plugin config is missing or invalid"})
+    capabilities["configuration"]["rootConfig"] = root_config["details"]
+
+    if descriptor_path is not None:
+        adapter_config_path = descriptor_path.parent / "opencode.json"
+        adapter_config = _check_json_plugin_config(
+            adapter_config_path,
+            project_root=project_root,
+            expected_plugin="./plugins/agent-lifecycle-kit.js",
+            check_name="opencode-adapter-config",
+        )
+        checks.append(adapter_config)
+        if adapter_config["status"] == "FAIL":
+            blockers.append({"code": "opencode-adapter-config-unavailable", "message": "OpenCode adapter plugin config is missing or invalid"})
+        capabilities["configuration"]["adapterConfig"] = adapter_config["details"]
+
+    version_check, version_text = _run_command_check(
+        "opencode-version",
+        [host_bin, "--version"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+    )
+    checks.append(version_check)
+    if version_check["status"] == "FAIL":
+        blockers.append({"code": "opencode-binary-unavailable", "message": "OpenCode binary is unavailable or failed version probing"})
+    capabilities["hostVersion"] = version_text
+
+    auth_help, _ = _run_command_check(
+        "opencode-auth-help",
+        [host_bin, "auth", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["auth", "login", "logout"],
+    )
+    checks.append(auth_help)
+    if auth_help["status"] == "FAIL":
+        blockers.append({"code": "opencode-auth-surface-unavailable", "message": "OpenCode auth command surface is unavailable"})
+    else:
+        capabilities["authState"] = {
+            "status": "NOT_DISCLOSED",
+            "commandSurface": "DISCOVERED",
+            "reason": "credential-state-redacted",
+        }
+
+    run_help, _ = _run_command_check(
+        "opencode-run-help",
+        [host_bin, "run", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+        required_markers=["--format", "json", "--dir", "--auto", "--model"],
+    )
+    checks.append(run_help)
+    if run_help["status"] == "FAIL":
+        blockers.append({"code": "opencode-headless-run-unavailable", "message": "OpenCode run help does not expose required headless adapter flags"})
+    else:
+        capabilities["headlessExecution"] = {"status": "SUPPORTED", "command": "run", "jsonFormat": "--format json", "workingDirectory": "--dir"}
+        capabilities["eventStream"] = {"status": "DISCOVERED", "source": "run-json-output", "requiresReceiptValidation": True}
+        capabilities["permissionMode"] = {"status": "DISCOVERED", "autoApproveFlag": "--auto", "adapterPolicy": "fail-closed"}
+        capabilities["modelSelection"] = {"status": "DISCOVERED", "selector": "--model"}
+
+    export_help, _ = _run_command_check(
+        "opencode-export-help",
+        [host_bin, "export", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+    )
+    checks.append(export_help)
+    if export_help["status"] == "FAIL":
+        blockers.append({"code": "opencode-export-unavailable", "message": "OpenCode export command is unavailable"})
+    else:
+        capabilities["resultExport"] = {"status": "DISCOVERED", "command": "export"}
+
+    stats_help, _ = _run_command_check(
+        "opencode-stats-help",
+        [host_bin, "stats", "--help"],
+        timeout_seconds=timeout_seconds,
+        command_runner=command_runner,
+    )
+    checks.append(stats_help)
+    if stats_help["status"] == "FAIL":
+        blockers.append({"code": "opencode-stats-unavailable", "message": "OpenCode stats command is unavailable"})
+    else:
+        capabilities["usageAttestation"] = {
+            "status": "DISCOVERED",
+            "source": "stats-and-run-json-output",
+            "requiresLiveReceipt": True,
+        }
+
+    return checks, capabilities, blockers