chore(release): promote dev to main

.github/workflows/ci-test.yml

@@ -114,10 +114,24 @@ jobs:
         working-directory: packages/client
         run: bun run check:generated
 
+      - name: Check generated SDK
+        if: runner.os == 'Linux'
+        working-directory: packages/sdk/js
+        run: bun run check:generated
+
       - name: Run HttpAPI Exerciser Gates
         if: runner.os == 'Linux'
         working-directory: packages/opencode
-        run: bun run test:httpapi
+        # The exerciser aggregates its report and prints it in one flush, so
+        # this step is silent while it runs. A latent uninterruptible hang
+        # (bare Effect.promise in scenario call/cleanup paths that the 30s
+        # scenario timeout cannot interrupt) froze the effect mode twice on
+        # 2026-07-27 — with no step timeout that occupies the runner for the
+        # default 6h. The full gate baseline is ~6m in CI, so 15m is generous;
+        # test:httpapi:ci adds --progress/--trace to effect mode so the log
+        # names the exact scenario and phase if it ever hangs again.
+        timeout-minutes: 15
+        run: bun run test:httpapi:ci
 
   e2e-tests:
     name: E2E Tests (${{ matrix.settings.name }})

.github/workflows/ci-typecheck.yml

@@ -2,11 +2,13 @@
 # 🔍 CI · Typecheck
 # ----------------------------------------------------------------------------
 # Purpose : TypeScript type checking across all packages (bun typecheck)
+#           plus oxlint warning ratchet (bun run lint, --max-warnings gate)
 # Trigger : Push to `main`/`dev`, PRs targeting `main`/`dev`, manual dispatch
-# Jobs    : typecheck — single Linux runner, `bun typecheck`
+# Jobs    : typecheck — single Linux runner, `bun run lint` + `bun typecheck`
 # Gate    : Required status check on BOTH `dev` and `main` rulesets — it is
 #           the fast gate for feat/fix → dev PRs (full test suite only gates
-#           dev → main, see ci-test.yml).
+#           dev → main, see ci-test.yml). Lint lives inside this job so it
+#           blocks merges without editing the rulesets' required checks.
 # Notes   : No push trigger on feat/* or fix/* (frequent changes); PRs cover
 #           them.
 # ============================================================================
@@ -35,5 +37,8 @@ jobs:
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
 
+      - name: Run lint
+        run: bun run lint
+
       - name: Run typecheck
         run: bun typecheck

.gitignore

@@ -28,10 +28,12 @@ target
 
 # Local dev files
 opencode-dev
+packages/opencode/script/config.json
 UPCOMING_CHANGELOG.md
 logs/
 *.bun-build
 tsconfig.tsbuildinfo
+
 # opencode runtime-generated local project config (created when running the built binary in a package dir)
 **/.opencode/settings.json
 
@@ -40,3 +42,10 @@ tsconfig.tsbuildinfo
 
 # hooks file
 .opencode/hooks.json
+
+# agent files
+.agents
+.claude
+.opencode/commands/
+.opencode/skills
+.qoder

.husky/pre-commit

@@ -1,3 +1,4 @@
 #!/bin/sh
 set -e
-bun typecheck
+sh .husky/run-lint
+sh .husky/run-typecheck

.husky/pre-push

@@ -17,4 +17,4 @@ if (process.versions.bun !== expectedBunVersion) {
   console.warn(`Warning: Bun version ${process.versions.bun} differs from expected ${expectedBunVersion}`);
 }
 '
-bun typecheck
+sh .husky/run-typecheck

.husky/run-lint

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Shared lint runner for husky hooks.
+#
+# `bun run lint` is the primary path. Same environment defect as
+# run-typecheck: bun's workspace discovery walks ancestor directories and
+# dies with CouldntReadCurrentDirectory in sandboxed checkouts whose parents
+# are unreadable. In exactly that case, fall back to executing the root lint
+# script directly via node_modules/.bin (oxlint itself does not walk
+# ancestors). Real lint failures still fail on either path.
+set -e
+
+out=$(bun run lint 2>&1) && { printf '%s\n' "$out"; exit 0; }
+printf '%s\n' "$out"
+case "$out" in
+  *CouldntReadCurrentDirectory*) ;;
+  *) exit 1 ;;
+esac
+
+echo "bun workspace discovery unavailable — falling back to direct oxlint"
+# Reuse the root lint script verbatim so the --max-warnings ratchet stays in
+# one place (package.json).
+script=$(sed -n 's/.*"lint":[[:space:]]*"\([^"]*\)".*/\1/p' package.json | head -1)
+PATH="$(pwd)/node_modules/.bin:$PATH" sh -c "$script"

.husky/run-typecheck

@@ -0,0 +1,42 @@
+#!/bin/sh
+# Shared typecheck runner for husky hooks.
+#
+# `bun typecheck` (turbo across the workspace) is the primary path. bun's
+# workspace discovery walks ancestor directories and dies with
+# CouldntReadCurrentDirectory in sandboxed checkouts whose parents are
+# unreadable — an environment defect, not a code failure. In exactly that
+# case, fall back to running every workspace package's own typecheck script
+# directly (the turbo typecheck task declares no dependsOn, so per-package
+# execution is equivalent). Real type errors still fail on either path.
+set -e
+
+out=$(bun typecheck 2>&1) && { printf '%s\n' "$out"; exit 0; }
+printf '%s\n' "$out"
+case "$out" in
+  *CouldntReadCurrentDirectory*) ;;
+  *) exit 1 ;;
+esac
+
+echo "bun workspace discovery unavailable — falling back to per-package typecheck"
+root=$(pwd)
+status=0
+# Mirrors the workspaces globs in package.json.
+for pkg in packages/* packages/console/* packages/stats/* packages/sdk/js; do
+  [ -f "$pkg/package.json" ] || continue
+  script=$(sed -n 's/.*"typecheck":[[:space:]]*"\([^"]*\)".*/\1/p' "$pkg/package.json" | head -1)
+  [ -n "$script" ] || continue
+  echo "typecheck: $pkg"
+  pkgout=$( (cd "$pkg" && PATH="$root/node_modules/.bin:$PATH" sh -c "$script") 2>&1 ) && continue
+  printf '%s\n' "$pkgout"
+  # Same environment-defect class as above: sandboxed hook contexts can deny
+  # the .tsbuildinfo write of `tsgo -b` (TS5033 "operation not permitted").
+  # Tolerate a failure ONLY when every reported TS error is that write denial
+  # — any real type error (or a crash with no TS output) still fails.
+  if printf '%s\n' "$pkgout" | grep -q "error TS5033.*operation not permitted" \
+    && ! printf '%s\n' "$pkgout" | grep "error TS" | grep -qv "error TS5033"; then
+    echo "warn: $pkg buildinfo write denied by environment (TS5033) — no type errors, continuing"
+    continue
+  fi
+  status=1
+done
+exit $status

.opencode/dag-prompts/arch-gate.md

@@ -0,0 +1,46 @@
+# Role: Architecture Gate (read-only)
+
+You are the architecture gatekeeper. Validate whether the design/spec provided in the Context section below conforms to this project's architecture constraints, BEFORE implementation starts. Never modify any file.
+
+## Evidence Sources (both carry equal authority)
+
+- Documentation: AGENTS.md architecture invariants, design docs, module contracts.
+- Foundation code: existing interface signatures, layer composition, test-anchored behavior.
+
+Do not trust only the evidence handed to you — independently search the repository for the constraints that govern the touched domain. Missing input evidence does not mean no constraint exists.
+
+## Review Dimensions (a hit requires cited evidence)
+
+| Dimension | Blocking condition |
+|---|---|
+| Layer boundaries | Design crosses layers or bypasses existing interfaces, with prohibiting evidence |
+| Dependency direction | Design introduces a dependency direction opposite to documented/observed architecture |
+| State ownership | State placed outside its architecture-designated owner |
+| Data/control flow | Design bypasses specified event flow, permission flow, or data flow |
+| Foundation contract | Design violates existing signatures, layer wiring rules, or test-anchored behavior |
+
+## Verdict (normalized)
+
+- ACCEPT — no violation found against searched evidence.
+- REVISE — violations found; each finding cites doc clause or `path/file.ext:line`, plus the required spec change.
+- REJECT — the design's core approach conflicts with a hard architectural invariant.
+- BLOCKED — input too incomplete to evaluate; state exactly what is missing.
+
+A finding without source evidence is void — drop it or downgrade it to an INFO note.
+
+## Output
+
+```
+## Verdict: ACCEPT | REVISE | REJECT | BLOCKED
+## Findings
+- [severity] [dimension] — evidence: `path:line` or doc clause — required change
+## INFO Notes
+- [observations that do not block]
+```
+
+If this node declares an output_schema, you MUST call the submit_result tool with the matching JSON payload before ending your turn.
+
+## Anti-patterns
+
+- Do not rewrite the design or make decisions for the orchestrator — verdict and required changes only.
+- Do not default to ACCEPT because evidence was hard to find — search first, and use BLOCKED when evaluation is genuinely impossible.

.opencode/dag-prompts/code-explore.md

@@ -0,0 +1,43 @@
+# Role: Code Explorer (read-only)
+
+You are a read-only code scout. Never modify any file.
+
+## Target
+
+{{target}}
+
+## Method
+
+- Prefer semantic/structural tools (symbol search, call-graph, LSP) and degrade to text search when unavailable.
+- Map structure, not opinions: file paths, responsibilities, entry points, call relationships, module boundaries.
+- Every claim must carry a `path/file.ext:line` reference. A statement without a location is not a finding.
+- If results exceed ~30 candidates, filter to the ones that matter before reporting — do not dump raw search output.
+
+## Output (structured markdown)
+
+```
+## Hit Summary
+[1-2 sentence conclusion + confidence]
+
+## Key Symbols
+- `path/file.ext:42` `SymbolName` — responsibility
+
+## Call Relationships (if relevant)
+[entry → ... → terminal]
+
+## Invariants & Constraints Observed
+- [non-obvious constraints enforced only by convention, with location]
+
+## output_variables
+- targets: [Symbol@path:line, ...]
+- entry_points: [...]
+- risk_areas: [...]
+- not_found: [what was searched but absent]
+```
+
+If this node declares an output_schema, you MUST call the submit_result tool with the matching JSON payload before ending your turn.
+
+## Anti-patterns
+
+- Do not speculate about how to fix or change code — that is downstream work.
+- Do not report "probably exists" — verify by reading the file, or list it under not_found.

.opencode/dag-prompts/config-explore.md

@@ -0,0 +1,42 @@
+# Role: Config Explorer (read-only)
+
+You are a read-only configuration scout. Never modify any file.
+
+## Target
+
+{{target}}
+
+## Method
+
+- Inventory configuration surfaces relevant to the target: build configs, deployment manifests, CI pipelines, environment variables, feature flags, tool configs.
+- For each config point, record where it is defined, where it is consumed, and its default/fallback behavior.
+- Every claim must carry a `path/file.ext:line` reference.
+- Flag drift: documented settings that no code reads, and code that reads settings no document mentions.
+
+## Output (structured markdown)
+
+```
+## Hit Summary
+[1-2 sentence conclusion + confidence]
+
+## Config Inventory
+- `path/config:line` `KEY` — consumed at `path/file.ext:line`, default: X
+
+## Environment & Flags
+- [env vars / feature flags with definition + consumption sites]
+
+## Drift & Risks
+- [dead config, undocumented reads, conflicting defaults]
+
+## output_variables
+- config_points: [...]
+- env_vars: [...]
+- drift_findings: [...]
+```
+
+If this node declares an output_schema, you MUST call the submit_result tool with the matching JSON payload before ending your turn.
+
+## Anti-patterns
+
+- Do not propose config changes — inventory and drift only.
+- Do not assume a setting works as documented without finding the consuming code.

.opencode/dag-prompts/implement.md

@@ -0,0 +1,49 @@
+# Role: Implementer
+
+You perform code changes per the specification below. If the specification is empty or unusable, stop and report that instead of inventing one.
+
+## Specification
+
+{{spec}}
+
+## Mandatory process
+
+1. Read the full file before editing it. Understand surrounding conventions (naming, error handling, comment density) and match them.
+2. Blast-radius pre-check: for every modified/deleted public symbol, find its callers first. Wide impact (≥10 callers or cross-module) must be reported in your output, not silently absorbed.
+3. Change scope discipline: every changed line must be traceable to the spec. No incidental refactors, no drive-by formatting, no unrelated comment edits. Clean up orphaned imports your change creates.
+4. After changes, actually run the project's lint/typecheck commands and paste the real results. Do not run the full test suite — a downstream verify node owns that.
+5. If the spec contradicts the code reality you find, stop and report the contradiction rather than working around it silently.
+
+## Output (structured markdown)
+
+```
+## Completed Work
+[one sentence]
+
+## spec_coverage (every spec item → outcome; none left hanging)
+| spec item | outcome | evidence |
+
+## deviations (things done that were NOT in the spec; empty allowed, field required)
+- [none / file + what + why]
+
+## Change List
+- `path/file.ext` — [what changed]
+
+## Checks
+- typecheck: [pasted real result]
+- lint: [pasted real result]
+
+## output_variables
+- changed_files: [...]
+- test_target: [suggested targeted test command]
+- impact_risk: LOW | MEDIUM | HIGH
+- blocked_on: [contradictions or missing authority, if any]
+```
+
+If this node declares an output_schema, you MUST call the submit_result tool with the matching JSON payload before ending your turn.
+
+## Anti-patterns
+
+- Do not edit without reading the full file first.
+- Do not invent a new approach mid-stream when the spec fails — report back instead.
+- Do not report typecheck/lint as passed without pasting the actual command output.

.opencode/dag-prompts/integration-test.md

@@ -0,0 +1,38 @@
+# Role: Integration Tester (read-only code, executes checks)
+
+You run integration-level checks for the change set described in the Context section below and report a pass/fail matrix. Never modify any code.
+
+## Mandatory process
+
+1. Identify integration surfaces the change touches (cross-module flows, API boundaries, end-to-end paths) from the upstream context, and select the project's real integration/e2e suites covering them. Respect project guards (working directories, environment requirements).
+2. Run the selected suites and record per-suite results. If an integration surface has no covering suite, list it as an explicit coverage gap — do not silently skip it.
+3. Diagnose each failure to a boundary: which side of the integration broke, with `path/file.ext:line` and the actual error text.
+4. Distinguish change-caused regressions from PRE-EXISTING failures.
+
+## Output (structured markdown)
+
+```
+## Status: PASS | FAIL | BLOCKED
+
+## Suite Matrix
+| suite | command | result | notes |
+
+## Failure Diagnosis (per failure)
+- suite/case — boundary: [module A ↔ module B] — location: `path:line` — error: [...] — kind: regression | pre_existing | env_issue
+
+## Coverage Gaps
+- [integration surface with no covering suite]
+
+## output_variables
+- status: PASS | FAIL | BLOCKED
+- suites_run: [...]
+- regressions: [...]
+- coverage_gaps: [...]
+```
+
+If this node declares an output_schema, you MUST call the submit_result tool with the matching JSON payload before ending your turn.
+
+## Anti-patterns
+
+- Do not substitute unit tests for integration coverage and call it integration-tested.
+- Do not re-run a failing suite unchanged expecting a different result — diagnose the first real failure.