feat: [v1.17.9] bridge merge upstream OpenCode v1.4.0 → v1.17.9

.claude/commands/release-beta.md

@@ -0,0 +1,158 @@
+---
+description: Cut a BETA (prerelease) of altimate-code to the npm `beta` channel. Existing `latest` users are NOT auto-upgraded — only opt-in beta testers get it. Use to soak a risky change (e.g. a big upstream merge) before promoting to `latest` with /release.
+---
+
+# Release altimate-code BETA
+
+Cut a prerelease to the **`beta`** npm dist-tag. The whole point: **existing
+stable (`latest`) users are never touched.** Only people who opted into the
+beta channel (`npm i -g @altimateai/altimate-code@beta`, or a beta install)
+receive it. Use this to dogfood a risky release before promoting it to
+`latest` with `/release`.
+
+## Why this is a separate skill (read once)
+
+- `/release` tags a plain `vX.Y.Z` → the workflow publishes to **`latest`** →
+  **every existing user auto-upgrades on next launch.** For a big/risky change
+  that is exactly the "brick everyone if there's a bug" risk.
+- A beta tag has a `-` suffix (`vX.Y.Z-beta.N`). `.github/workflows/release.yml`
+  derives `OPENCODE_CHANNEL` from the tag: a `-` → the **`beta`** channel →
+  `npm publish --tag beta`. The `latest` dist-tag is left pointing at the old
+  stable, so `latest` users do not move.
+- The upgrade check (`cli/upgrade.ts`) is fail-safe and orders prerelease
+  identifiers, so a beta tester on `beta.1` auto-upgrades to `beta.2`, and any
+  beta upgrades to the eventual stable. This is verified by the round-trip below.
+
+## Input
+
+`$ARGUMENTS` = the target STABLE version this beta leads to (`patch` | `minor` |
+`major`, or an explicit `X.Y.Z`). Default `minor` — a big upstream merge is not
+a patch. The beta tag becomes `vX.Y.Z-beta.N`.
+
+---
+
+## Step 1 — Determine the beta version
+
+```bash
+# current published STABLE (the latest dist-tag)
+npm view @altimateai/altimate-code dist-tags --json
+```
+
+- Base stable `X.Y.Z` from `$ARGUMENTS`:
+  - `patch`/empty → not typical for a beta; prefer `minor`.
+  - `minor` → bump minor of the current stable (0.8.10 → **0.9.0**).
+  - `major` → 0.8.10 → **1.0.0**.
+  - explicit `X.Y.Z` → use it.
+- Find the next `-beta.N`: look at the current `beta` dist-tag. If it is already
+  `X.Y.Z-beta.M`, next is `beta.(M+1)`; otherwise start at `beta.1`.
+
+```bash
+# does a beta for this base already exist?
+npm view @altimateai/altimate-code@beta version 2>/dev/null || echo "no beta yet"
+```
+
+Confirm with the user: **"Cutting beta `vX.Y.Z-beta.N`. This publishes to the
+`beta` channel only — `latest` stays at `<current stable>`, so existing users
+are NOT auto-upgraded. Proceed?"** Wait for an explicit yes.
+
+## Step 2 — Ensure clean, correct base
+
+```bash
+git branch --show-current       # expect main (or the branch you're betaing)
+git status --short              # must be clean
+git fetch origin
+git log HEAD..origin/$(git branch --show-current) --oneline   # must be up to date
+```
+Stop if dirty, behind, or on an unexpected branch.
+
+## Step 3 — Pre-tag gates (lighter than /release, but non-negotiable)
+
+Betas soak in production, so they must at least build and pass CI. Do NOT skip:
+
+```bash
+# both packages typecheck
+(cd packages/opencode && bun run typecheck)
+(cd packages/tui && bun run typecheck)
+# marker guard
+bun run script/upstream/analyze.ts --markers --base main --strict
+# PR/branch functional CI is green
+gh pr checks <PR> --repo AltimateAI/altimate-code | grep -viE 'kilo|coderabbit|skipping'
+```
+If any functional gate is red, stop and fix first.
+
+## Step 4 — Tag and push the beta
+
+The `-beta.N` suffix is what routes to the beta channel. Do NOT omit it.
+
+```bash
+BETA_TAG="vX.Y.Z-beta.N"
+git tag "$BETA_TAG"
+git push origin "$BETA_TAG"     # push the TAG (not necessarily main)
+```
+
+Note: unlike `/release`, do not `git push origin main` unless main already
+contains this commit. A beta can be tagged on a branch or on main; the tag is
+what triggers the workflow.
+
+## Step 5 — Monitor the release workflow
+
+```bash
+gh run list --workflow=release.yml --repo AltimateAI/altimate-code --limit 1
+gh run watch --repo AltimateAI/altimate-code
+```
+The workflow's native linux-x64 smoke + pre-publish smoke are the last gates.
+If it fails, do NOT delete the tag — investigate (`gh run view --log-failed`).
+
+## Step 6 — CRITICAL post-publish guard: confirm `latest` did NOT move
+
+This is the safety assertion. After publish:
+
+```bash
+npm view @altimateai/altimate-code dist-tags --json
+```
+
+- `beta` MUST now be `X.Y.Z-beta.N`.
+- `latest` MUST be UNCHANGED (still the previous stable, e.g. 0.8.10).
+
+If `latest` moved to the beta version, **the beta leaked to all users** — treat
+as an incident: publish a corrected `latest` dist-tag back to the last-good
+stable immediately (`npm dist-tag add @altimateai/altimate-code@<good> latest`)
+and investigate the channel derivation in release.yml.
+
+## Step 7 — Verify the beta works AND can upgrade out (round-trip)
+
+The whole reason for a beta is to prove the new codebase is safe — including
+its own auto-upgrade — before stable users touch it.
+
+```bash
+# install the beta hermetically (does not touch your normal install if you use a temp prefix)
+npm i -g @altimateai/altimate-code@beta   # or an isolated prefix
+altimate --version                        # reports X.Y.Z-beta.N
+altimate agent list; altimate skill list  # fork surfaces load
+```
+
+Dogfood real workflows on the beta. Then prove the **round-trip**: when you cut
+`vX.Y.Z-beta.(N+1)`, a machine already on `beta.N` must auto-upgrade to it on
+next launch (compareVersions orders betas). If it does, the updater on the new
+codebase is proven — stable users can safely be promoted onto it.
+
+## Step 8 — Promote to `latest` (separate, deliberate step)
+
+Only after the beta has soaked and the round-trip is proven:
+
+- Run **`/release {same bump}`** to cut the stable `vX.Y.Z` → `latest`. That is
+  the step that auto-upgrades existing users — and by then you've proven the
+  exact code and its updater on the beta channel.
+- Do NOT move `latest` to a `-beta` version by hand; ship a clean stable tag.
+
+---
+
+## Hard rules
+
+- The tag MUST contain `-beta.N`. A plain `vX.Y.Z` from this skill would hit
+  `latest` — never do that here.
+- Never skip Step 6 (the `latest`-didn't-move assertion). It is the one check
+  that catches a channel-routing regression before it bricks everyone.
+- npm publishes are effectively irreversible — get the explicit user yes at
+  Step 1 before tagging, and never publish credentials or move `latest` without
+  intent.

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.opencode
+.sst
+.turbo
+.wrangler
+node_modules
+**/node_modules
+**/.output
+**/dist
+**/.turbo
+**/.vite
+**/coverage

.gitattributes

@@ -0,0 +1,2 @@
+packages/core/migration/**/snapshot.json linguist-generated
+packages/core/src/database/migration.gen.ts linguist-generated

.github/TEAM_MEMBERS

@@ -1,30 +1,17 @@
-aidtya
-aloks98
-altimateanas
-anandgupta42
-ankitksharma
-anusha-sharma
-arora-saurabh448
-dvanaken
-frasermarlow
-gaurpulkit
-govindpawa
-jontsai
-kulvirgit
-mdesmet
-mhallida
-ppradnesh
-rakendd
-ralphstodomingo
-ravik-aai
-robertmaybin
-sahrizvi
-sanjaykr5
-saravmajestic
-sgvarsh
-shreyastelkar
-sourabhchrs93
-suryaiyer95
-tshreyas
-vivekvenkatareddy
-yukthagv
+adamdotdevin
+Brendonovich
+fwang
+Hona
+iamdavidhill
+jayair
+jlongster
+kitlangton
+kommander
+MrMushrooooom
+nexxeln
+R44VC0RP
+rekram1-node
+thdxr
+simonklee
+vimtor
+starptech

.github/meta/night-run/MERGE-VALIDATION-MATRIX.md

@@ -0,0 +1,47 @@
+# Comprehensive merge validation — upstream v1.4.0→v1.17.9 bridge (PR #964)
+
+Method: not spot-checks. The merge surface (3,254 upstream commits) reduces to a BOUNDED,
+enumerable set validated by three contracts, each covered exhaustively.
+
+## Surface (measured)
+- 226 upstream-shared source files modified by the merge (exist in both v1.17.9 and HEAD)
+- 293 fork-only source files
+- 106 fork "altimate_change" behaviors present on main whose marker text wasn't found verbatim on HEAD
+
+## Coverage matrix
+
+| Contract | Question | Method | Result |
+|---|---|---|---|
+| C1: no dropped upstream code | did conflict-resolution revert upstream fixes? | 226 files reviewed by 11 subsystem agents; diff v1.17.9↔HEAD each | No ship-blocker. ~6 real MED/LOW refinement drops (below). High-value upstream fixes (Plan-Mode security, models-cache recovery, session-metadata migration identity, corrupt-message handler) present VERBATIM. |
+| C2: no fork-feature loss | did fork customizations survive? | 106 candidate behaviors verified present-on-HEAD or dropped | Most false (path-restructure moved cli/cmd/tui→tui/src + reworded). Real drops: beginner-tips onboarding, internal-url inconsistency, minor branding. |
+| C3: behavior | does the artifact work? | full suite + schema + upgrade + journey + real binary + CI | 10,555 tests pass (2 flaky, pass isolated); 19/19 schema tables parity; upgrade 16/16; journey 10 green; CI functional gates green. |
+
+## REAL findings (all MED/LOW — none block ship), fork-wanted, verified by lead
+
+| # | file | issue | sev | fix |
+|---|------|-------|-----|-----|
+| 1 | session/compaction.ts | tail-preserving compaction dead: consumers read `tail_start_id` (session.ts:775, message-v2.ts:1016) but no writer sets it on new compaction parts | MED | restore the writer that stamps `tail_start_id` when creating the compaction part |
+| 2 | share/share-next.ts:152 | dropped `Effect.catchCause` on fullSync+flush → unhandled rejection on share-sync failure | MED | wrap fullSync/flush failures (log, don't throw) |
+| 3 | session/llm.ts:214 | Copilot billing split-brain: `includeRawChunks` absent from streamText, but `copilotTotalNanoAiu`/`totalNanoAiu` consumers depend on it → Copilot billing metadata never populates | MED | pass `includeRawChunks: true` for the Copilot provider path |
+| 4 | tui first-run (tips) | fork onboarding UX dropped: main had `BEGINNER_TIPS`/`isFirstTime`; HEAD has zero refs | MED | restore beginner-tips/first-time hint |
+| 5 | util/filesystem.ts:131 | Windows path conversion lost: HEAD does only `realpathSync.native`; upstream also did `windowsPath()` (cygwin/gitbash/WSL) | LOW | restore windowsPath() normalization for win32 |
+| 6 | session/retry.ts:71 | drops upstream's extra "retry 5xx even if SDK says non-retryable" guard | LOW | re-add the status-code 5xx retry guard |
+| 7 | cli/cmd/mcp.ts:419 | CLI MCP installs default to opencode.json not altimate-code.json (both still discovered) | LOW | prefer altimate-code.json in CONFIG_FILENAMES |
+| 8 | tui.ts:166 / runtime.ts:737 | internal worker url `opencode.internal` inconsistent with `altimate-code.internal` elsewhere (internal routing key, not user-visible) | LOW | unify the virtual-host string |
+| — | footer/uninstall/upgrade/initialize.txt | unmarked fork branding + 1-2 "OpenCode config" strings | LOW | marker hygiene + branding fix |
+
+## INTENTIONAL divergences (verified NOT bugs — fork deliberately differs)
+- task.ts background subagents — marker: "hides disabled background mode"
+- providers Alibaba/Venice/Azure-workflow/GitLab-Duo — moved to packages/core/src/plugin/provider/* or not shipped
+- run.ts interactive/replay/demo — fork ships its own run command (executive/analyst modes, max-turns, tracing)
+- plugin/index.ts loader + omitted upstream provider plugins — fork ships its own provider set
+- server.ts move-session — actually PRESENT via httpapi control-plane group (false positive)
+
+## FALSE positives (verified)
+- agent.ts:524 safety-denial re-append — intended fail-safe (marker documents it)
+
+## Verdict
+Comprehensive review of the ENTIRE merge surface found NO ship-blocker (no crash, data-loss, or
+security regression). ~6 medium + a few low fork-wanted refinements to restore. The merge correctly
+adopted upstream v1.17.9 (fixes present verbatim, schema parity, upgrade path clean) and preserved
+the fork (registries, agents, tools, DE features intact).

.github/meta/night-run/RELEASE-EVALUATION-BOARD.md

@@ -0,0 +1,45 @@
+# Release-Evaluation Board — final pre-release analysis (PR #964, v1.17.9 bridge)
+7 independent perspectives (3 codex / 3 sonnet / 1 haiku) + Fable runtime probe + synthesis.
+GOAL: dual preservation — don't lose FORK work, don't lose UPSTREAM work.
+
+## Scorecard
+
+| Perspective | Verdict | Findings |
+|---|---|---|
+| D Fork-feature preservation | **PASS** | All tools (101→102 superset), 9 agents, 13 warehouse drivers, 7 builtin skills, 8 commands, memory/tracing/telemetry/PII — present + WIRED. 0 new fork drops. |
+| F Safety/security regression | **PASS** | All 5 shipped safety properties INTACT: DDL non-overridable, subagent deny-inheritance (#26597), sensitive-write #209 guard (edit.ts+write.ts), secret redaction, basic-auth username. No regression. |
+| A Upstream-fix adoption (73 sampled) | 5 dropped | 1 HIGH-ish (processor providerExecuted), 4 MED/LOW upstream fixes reverted. |
+| B Upgrade/format compat | 2 real | managed-TUI-config load dropped (MED), .json/.jsonc precedence inverted (LOW). Auth-username & thinking-default changes INTENTIONAL. DB/auth/session/cache formats back-compatible. |
+| C Build/packaging/distribution | **1 HIGH ship-blocker** | release.yml pinned Bun 1.3.10 but build scripts require ^1.3.14 → tag releases fail. FIXED. |
+| E Integration seams | 1 real | Azure/DigitalOcean/xAI upstream auth plugins in-tree but unwired in INTERNAL_PLUGINS (MED). Codex plugin = intentional fork keep. |
+| G Branding | LOW polish | `.opencode/` paths in warehouse-list/skill-ops messages + `opencode.json` in provider dialogs should say altimate-code. Provider labels & auth-username default = intentional. |
+| Fable runtime probe | **PASS** | Compiled binary: palette, agent-switch, shell-mode EXECUTE, /skills list, prompt round-trip all work — empirically confirms the resolved V2-premise review comments don't affect the shipped product. |
+
+## Actions taken (all upstream-fix restorations, marked + tested)
+- FIXED (HIGH ship-blocker): release.yml Bun 1.3.10 → 1.3.14 (all 4 pins).
+- FIXED (Fable): run.ts in-process auth header (local run 401'd when OPENCODE_SERVER_PASSWORD set).
+- FIXED (delegated): provider.ts Cloudflare unified apiKey; transform.ts Devstral toLowerCase; project.ts session-migration time_updated preservation (3 sites); config/tui.ts managed-config load + paths.ts json/jsonc precedence; plugin/index.ts wire Azure/DigitalOcean/xAI auth plugins.
+
+## Flagged follow-up (NOT fixed — deliberate)
+- processor.ts `providerExecuted` handling: shipped session doesn't use the provider-executed-tool flag (adapters capture it). MED — server-side provider tools (e.g. web search) not handled optimally. NOT fixed pre-release: the upstream change is entangled with GitLab-Duo approval code the fork doesn't ship; porting it blind risks core session processing. Needs a scoped follow-up.
+- Branding LOW polish: optional, non-blocking.
+
+## Dual-preservation verdict
+- FORK preservation: CLEAN (D + F pass; nothing we built is lost or weakened).
+- UPSTREAM preservation: the gaps were HERE — 5 dropped fixes + 3 unwired auth plugins + managed-config, now restored. This is the class my earlier fork-focused passes missed; the board's upstream-adoption + seam lenses caught them.
+
+## Addendum — E (integration seams) full report
+Enumerated the seam surface: 587 `@opencode-ai/*` import sites across 216 files in packages/opencode/src + 37 in packages/tui/src; 6 subsystem scopes audited.
+- **Azure/DigitalOcean/xAI auth plugins unwired** (MED-HIGH) — FIXED (board commit b0ade919c7).
+- **`openai/codex.ts` orphaned** (MED) — DOCUMENTED, not fixed. 0 consumers; fork deliberately uses its own `./codex` (BUILTIN). Harmless dead code; deleting an upstream file risks future-merge friction. Adopting its WebSocket/allowlist/dispose capabilities is a product decision, not a merge fix.
+- **Dual-`Session`-module `getUsage` divergence** (MED-latent / LOW-active) — DOCUMENTED, not fixed. Live path is `processor.ts:326 → session/index.ts:830` (carries the OpenRouter cost fix); `session.ts:387` is the caller-less V2-migration copy. Not a live bug; session.ts is the not-shipped V2 surface.
+- **OVERTURNED false-positive HIGH**: an earlier subagent claimed `fromPlugin` permission-gate bypass (ctx.ask became Effect → `await` no-ops). E traced the `legacyToInit`→bridged-`legacyCtx` layer (tool-zod-compat.ts:221) that makes ask Promise-based before the plugin runs — the gate runs correctly. Safety surface confirmed clean.
+- Server / cli / effect / config / storage seam scopes: clean. Signature-skew class (`Adaptor.target()`) already fixed; 192 tracked `upstream_fix` markers + green typecheck catch compile-level skew.
+
+## Final board disposition
+- Ship-blocker: 1 (release.yml) — FIXED.
+- Real dropped-upstream fixes/features: 6 + 3 auth plugins + run-auth — FIXED.
+- Security (pre-existing): sensitive-write guard neutralization — FIXED.
+- provider-executed metadata — FIXED (execution was already correct); settlement-telemetry field = scoped follow-up.
+- Latent/dead-code in the not-shipped V2 surface (codex orphan, getUsage copy) — DOCUMENTED, deliberately not chased.
+- Fork preservation + safety surface: PASS (nothing lost or weakened).

.github/meta/night-run/UPGRADE-PATH-TEST.md

@@ -0,0 +1,34 @@
+# Upgrade-path test: v0.8.10 → upstream/merge-v1.17.9 (PR #964)
+
+Method: built BOTH binaries from source (v0.8.10 tag + branch). Isolated via XDG_*
+temp dirs (v0.8.10 reads data dir from xdg-basedir, NOT OPENCODE_TEST_HOME — that
+only overrides `home`). Booted v0.8.10 to create an authentic old-schema DB
+(10 drizzle migrations; `session` but no `session_message`/`project_directory`;
+session lacks metadata/cost/tokens_*/agent/model). Injected sentinel project +
+session rows + a v0.8.10 config.json + auth.json. Booted the NEW binary against
+the SAME isolated dir = the upgrade moment.
+
+## Result: 16/16 assertions PASS + idempotent across 3 boots
+Schema migrated forward: session.{metadata,cost,tokens_input,tokens_output,agent,
+model} added; project_directory + session_message tables created; drizzle journal
+advanced 10→11; NO "duplicate column" crash; TUI rendered clean.
+Data preserved: sentinel project + session survived; session title byte-identical
+(sha1 match); 0 rows lost. Config + auth.json carried over. integrity_check = ok
+before and after.
+
+## Minor finding — FIXED (commit 27c490515a) + verified
+`__drizzle_migrations` grows by 1 row per launch: the `20260511173437_session-metadata`
+entry is re-inserted every boot (markDrizzleEntriesApplied uses INSERT OR IGNORE but
+the table has no UNIQUE constraint, so it never dedupes). DDL is guard-checked so it
+never re-runs → no crash, no data change, ~50 bytes/launch. FIXED: markDrizzleEntriesApplied now INSERT...WHERE NOT EXISTS(name) + a guarded
+dedupeDrizzleJournal self-heal. Re-verified end-to-end: fixed binary boots 3x
+against a v0.8.10 DB with journal rows STABLE at 11 (was 11->12->13), no dup
+names, integrity ok. Regression test test/storage/db-journal-idempotency.test.ts.
+
+## Safety note
+v0.8.10 honors OPENCODE_DISABLE_CHANNEL_DB and reads its data dir from XDG. An early
+probe that set that flag without XDG isolation briefly opened the real
+~/.local/share/altimate-code/opencode.db (1194 sessions) READ-only-ish — verified
+intact (integrity ok, 1194 sessions preserved; v0.8.10 migrations are guarded/idempotent).
+Correct isolation for old-binary tests = XDG_{DATA,CONFIG,STATE,CACHE}_HOME, not
+OPENCODE_TEST_HOME.