Distillation

Date: Sep 16, 2026

• 🟡 (10:07) Audit plan comprised 5 ordered tasks: 1. Verify frozen base, patch hash, SEA hash, 33-file scope, and clean applicability to exact base (in_progress, high priority); 2. Read applicable repository and package instructions without using mutable candidate source (pending, high); 3. Construct and fingerprint a disposable exact base+patch inspection tree outside VCS (pending, high); 4. Audit all 33 changed files and trace recovery security invariants end to end (pending, high); 5. Report severity-ordered findings with frozen file:line evidence and exact verdict (pending, high).
• 🟡 (10:07) Frozen patch /tmp/opencode/session-recovery-final-v4.patch had SHA-256 c2c8afb07a7b6a49c1d40c5515d718ad5a934c9291e80a068693259c26c566a0.
• 🟡 (10:07) SEA binary /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server had SHA-256 56c1bc48b6e21397db05eb0d41f73d243a4b64da093fcfbe209baed65457f6e8.
• 🟡 (10:08) Frozen base resolved to commit ab9408c81cc9916177641ae8e9f08624fc27b5b9, with parent/base-related hashes d3323b963b9ef2de41a7ff9884299c74b93886ba and 2e9407768d1401a25b69febb36657638a779053a, timestamp 1789377773, and subject feat(app): adapt vertical tab density.
• 🟡 (10:08) Patch scope contained exactly 33 changed files with added/deleted line counts: packages/core/schema.json 527/48; packages/core/src/database/migration.gen.ts 1/0; packages/core/src/database/migration/20260914170650_session-recovery.ts 55/0; packages/core/src/database/schema.gen.ts 45/0; packages/core/src/session.ts 5/4; packages/core/src/session/compaction.ts 31/16; packages/core/src/session/context-epoch.ts 54/34; packages/core/src/session/execution/claim.ts 66/0; packages/core/src/session/execution/local.ts 118/19; packages/core/src/session/input.ts 342/31; packages/core/src/session/message-updater.ts 69/0; packages/core/src/session/projector.ts 77/1; packages/core/src/session/recovery-id.ts 6/0; packages/core/src/session/recovery.ts 315/0; packages/core/src/session/run-coordinator.ts 30/5; packages/core/src/session/runner/index.ts 4/0; packages/core/src/session/runner/llm.ts 207/90; packages/core/src/session/runner/publish-llm-event.ts 74/28; packages/core/src/session/sql.ts 70/1; packages/core/test/database-migration.test.ts 63/1; packages/core/test/session-execution-local.test.ts 239/0; packages/core/test/session-projector.test.ts 1557/3; packages/core/test/session-prompt.test.ts 247/25; packages/core/test/session-run-coordinator.test.ts 45/0; packages/core/test/session-runner-recorded.test.ts 4/10; packages/core/test/session-runner-tool-events.test.ts 4/0; packages/core/test/session-runner.test.ts 584/16; packages/opencode/src/server/routes/instance/httpapi/server.ts 2/1; packages/schema/src/session-event.ts 43/1; packages/schema/test/event-manifest.test.ts 8/5; packages/sdk/js/src/v2/gen/types.gen.ts 190/0; packages/sdk/openapi.json 657/44; packages/server/src/routes.ts 2/0.
• 🔴 (10:09) User stated legacy JavaScript SDK regeneration must use ./packages/sdk/js/script/build.ts.
• 🔴 (10:09) User stated that after changing the public Protocol or Server HttpApi, run bun run generate from packages/client; never edit src/generated or src/generated-effect directly.
• 🔴 (10:09) User requires runtime dependencies to flow from Schema to Core and Protocol, then from Core and Protocol to Server. Client runtime code may depend on Schema and Protocol, but never Core or Server; sdk-next composes Client, Core, and Server.
• 🔴 (10:09) User stated the repository’s default branch is dev; local main may not exist, so diffs should use dev or origin/dev.
• 🔴 (10:09) User requires branch names of at most 3 words, separated by hyphens, with no slashes or type prefixes such as feat/ or fix/; examples: session-recovery, fix-scroll-state, regenerate-sdk.
• 🔴 (10:09) User requires conventional commit and PR-title format type(scope): summary; valid types are feat, fix, docs, chore, refactor, and test, with optional affected-package scopes such as core, opencode, tui, app, desktop, sdk, or plugin.
• 🔴 (10:09) User’s coding preferences: keep logic in one function unless composable/reusable; do not preemptively extract single-use helpers; avoid try/catch and any; use Bun APIs such as Bun.file() when possible; rely on type inference; prefer flatMap, filter, and map over loops; use filter type guards; and in Effect generators bind services to named variables rather than nested yields such as yield* (yield* Foo.Service).bar().
• 🔴 (10:09) User requires src/config modules to follow the existing top-of-file self-export pattern, e.g. export * as ConfigAgent from "./agent".
• 🔴 (10:09) User stated: “Never alias imports.” Forbidden forms include import { foo as bar } from "..." and renamed imports such as resolve as pathResolve.
• 🔴 (10:09) User stated: “Never use star imports.” Forbidden forms include import * as Foo from "..." and import type * as Foo from "..."; when namespace-style access is needed, import the module’s own exported namespace by name, e.g. import { Project } from "@opencode-ai/core/project" and use Project.ID.
• 🔴 (10:09) User prefers dynamic imports for heavy modules used only in selected paths, especially startup-sensitive entrypoints; destructure bindings near the top of the narrowest needed scope, keep branch-specific imports inside their branch, and avoid inline chains such as await import("./module").then((mod) => mod.value()) or (await import("./module")).value().
• 🔴 (10:09) User prefers avoiding mocks; globalThis.* should only be used as a last resort. Tests should exercise actual implementation rather than duplicating implementation logic.
• 🔴 (10:09) User stated tests cannot run from repository root because of the do-not-run-tests-from-root guard; run tests from package directories such as packages/opencode.
• 🔴 (10:09) User stated: always run bun typecheck from package directories, e.g. packages/opencode; never run tsc directly.
• 🔴 (10:09) User requires durable prompt admission to remain separate from model execution: SessionV2.prompt(...) admits one durable session_input row before scheduling advisory SessionExecution.wake(sessionID), unless resume: false requests admit-only behavior; the serialized runner promotes admitted inputs into visible user messages at safe boundaries.
• 🔴 (10:09) User requires the System Context algebra, registry, and built-ins to remain in src/system-context; Context Source producers stay with their observed domains; Session History selection and Context Epoch persistence remain Session-owned.
• 🔴 (10:09) User stated @opencode-ai/schema owns browser-safe wire and storage contracts shared by protocol, server, core, and generated SDKs; runtime behavior, service layers, side effects, and host-local implementation details belong in the owning domain package.
• 🔴 (10:09) User requires Schema package dependency direction @opencode-ai/schema <- @opencode-ai/protocol <- @opencode-ai/server; Schema values must be serializable contract definitions rather than service implementations or runtime registries.
• 🔴 (10:09) User stated current contracts are unversioned (Session, Permission, Question, Permission.Request), while retained compatibility/persistence/migration contracts are explicitly V1 (SessionV1, PermissionV1, PermissionV1.Request); V2 must not remain the permanent replacement-architecture name.
• 🔴 (10:09) User requires retained V1 contracts to live under src/v1/ after V1 isolation; new/current code must not depend on that subtree, and the subtree should be deleted when the legacy runtime retires.
• 🔴 (10:09) User requires events to be classified as current, shared transitional, or V1-only before entering a public manifest. V1-only events such as message.updated and message.part.* must stay out of current Protocol/SDK Next unless a current-client requirement is documented; compatibility events should remain only on existing App/TUI/CLI compatibility surfaces.
• 🔴 (10:09) User requires one canonical event/contract value and rejects bridge aliases such as PluginID, PluginEvent, PtyInfo, PtyEvent, and SessionTodoInfo; preferred access uses canonical namespaces such as Plugin.ID and SessionTodo.Info.
• 🔴 (10:09) User requires public Schema contracts to be readonly by default and forbids Schema.mutable(...) for public contracts; runtime mutation must be explicit via Types.DeepMutable, a purpose-built draft type, or another mutable API.
• 🔴 (10:09) User stated current ID constructors expose create(); directional constructors such as ascending() or descending() remain only for public ordering semantics or compatibility. Generated ID schemas must validate exactly the emitted prefix, including _; legacy loose validators must not be tightened without an explicit compatibility/migration decision.
• 🔴 [requested-tests] (10:09) User requires focused tests for contract/generated-surface changes, including optional properties omitting undefined, no accidental current-contract Schema.Any, stable and unique public identifiers, exact facade/schema identity, and exclusion of V1-only events from current Protocol manifests.
• 🔴 (10:09) User requires public JSON errors to be explicit endpoint-level Schema.ErrorClass contracts. Built-in HttpApiError.* is acceptable only when its empty/tagged body is the intended wire shape; SDK-visible errors carrying messages should use a declared API error such as ApiNotFoundError. Domain/storage services must remain free of HttpApi types, with expected domain errors translated at handler boundaries.
• 🔴 (10:09) User stated bun dev defaults to running OpenCode in packages/opencode; server debugging can use bun run --inspect=ws://localhost:6499/ --cwd packages/opencode ./src/index.ts serve --port 4096, with TUI attachment via opencode attach http://localhost:4096; TUI debugging can use bun run --inspect=ws://localhost:6499/ --cwd packages/opencode ./src/index.ts. bun dev spawn may be needed for server breakpoints because ordinary bun dev runs the server in a worker thread.
• 🟡 (10:09) Assistant verified both supplied SHA-256 hashes matched exactly, the patch declared exactly 33 changed files, and the base resolved to the requested immutable commit.
• 🟡 (10:09) Assistant stated it had read the base revision’s root, Schema, OpenCode, and HttpApi instructions plus affected package scripts without consulting mutable candidate source.