Distillation

Date: Sep 16, 2026

• 🔴 (11:14) User supplied packages/opencode/package.json: package opencode is private, ESM, MIT-licensed, version 1.18.30; exports "./*": "./src/*.ts" and maps #db to ./src/storage/db.bun.ts for Bun/default and ./src/storage/db.node.ts for Node.
• 🔴 (11:14) User supplied exact packages/opencode/package.json scripts: "typecheck": "tsgo --noEmit", "test": "bun test --timeout 30000 --only-failures", "test:httpapi": "bun run script/httpapi-exercise.ts --mode coverage --fail-on-missing --fail-on-skip && bun run script/httpapi-exercise.ts --mode auth --fail-on-missing --fail-on-skip && bun run script/httpapi-exercise.ts --mode effect --fail-on-missing --fail-on-skip", "bench:test": "bun run script/bench-test-suite.ts", "profile:test": "bun run script/profile-test-files.ts", "build": "bun run script/build.ts", "build:server": "node script/build-server.mjs", "dev": "bun run ./src/index.ts", and "dev:temporary": "bun run ./src/temporary.ts".
• 🔴 (11:14) User supplied packages/sdk/js/package.json: package @opencode-ai/sdk is ESM, MIT-licensed, version 1.18.30; scripts are "test": "bun test", "typecheck": "tsgo --noEmit", and "build": "bun ./script/build.ts"; published files are limited to dist.
• 🔴 (11:14) User supplied exact @opencode-ai/sdk exports: "." → ./src/index.ts, "./client" → ./src/client.ts, "./server" → ./src/server.ts, "./v2" → ./src/v2/index.ts, "./v2/client" → ./src/v2/client.ts, "./v2/gen/client" → ./src/v2/gen/client/index.ts, "./v2/server" → ./src/v2/server.ts, and "./v2/types" → ./src/v2/gen/types.gen.ts.
• 🔴 (11:14) User supplied @opencode-ai/sdk dependency details: its sole runtime dependency is "cross-spawn": "catalog:"; development dependencies are @hey-api/openapi-ts 0.90.10, @tsconfig/node22, @types/cross-spawn, @types/node, @typescript/native-preview, and typescript.
• 🔴 (11:14) User’s review progress changed: frozen-input verification and immutable-guidance/package-script review are completed; inspection of all changed files and tracing security invariants is in progress; migration/schema/API-lineage/dependency/multi-node-startup auditing and the severity-ordered verdict remain pending.
• 🔴 (11:14) User stated through packages/core/src/session/execution/claim.ts that lease timestamps use node wall clocks, SESSION_EXECUTION_LEASE_MS must exceed the deployment’s maximum clock skew plus one renewal interval, execution IDs immediately fence a node after takeover, and an expired claim never renews itself.
• 🔴 (11:14) User supplied packages/core/src/session/execution/claim.ts: SessionExecutionClaim.Claim contains readonly sessionID, executionID, and ownerID; claim mutations require matching session_id, execution id, owner_id, and expires_at > now.
• 🔴 (11:14) User supplied claim-update behavior in packages/core/src/session/execution/claim.ts: update() sets optional assistant_message_id/phase values and renews expires_at to now + SESSION_EXECUTION_LEASE_MS; absence of an updated row defects with SessionExecutionClaim.Lost.
• 🔴 (11:14) User supplied claim-clear behavior in packages/core/src/session/execution/claim.ts: clear() deletes only a still-unexpired row matching Session, execution, and owner identity; absence of a deleted row defects with SessionExecutionClaim.Lost.
• 🔴 (11:14) User supplied SessionExecutionClaim.transaction() behavior in packages/core/src/session/execution/claim.ts: it uses a database transaction with { behavior: "immediate" }, renews the claim through update(db, claim), and only then runs the supplied effect; database failures are converted with Effect.orDie.
• 🔴 (11:15) User supplied packages/core/src/session/execution/local.ts: each process creates one random ownerID; each drain creates a random executionID; active claims are tracked in Map<SessionSchema.ID, SessionExecutionClaim.Claim>.
• 🔴 (11:15) User supplied local claim-acquisition behavior: a drain inserts SessionExecutionTable with phase: "ready", time_created: now, and expires_at: now + leaseDuration, using .onConflictDoNothing(); if insertion does not return a row, the drain returns without running.
• 🔴 (11:15) User supplied local recovery selection behavior: after acquiring a claim, it selects at most one SessionRecoveryTable row for the Session where wake_pending = true and recovery_error IS NULL, ordered by time_created then execution_id, and passes its continuation_message_id to input.run(...).
• 🔴 (11:15) User supplied local lease-heartbeat behavior: input.run(claim, force, recovery?.continuationMessageID) races via Effect.raceFirst against repeated SessionExecutionClaim.update(db, claim) calls spaced at leaseDuration / 3.
• 🔴 (11:15) User supplied local drain-exit behavior: the matching entry is removed from activeClaims; successful drains clear the claim; interrupted drains leave it uncleared; non-interrupt failures re-read the claim and clear it only when its phase is neither "unknown" nor "continue".
• 🔴 (11:15) User supplied local interruption behavior: if no active claim exists, interruption delegates to coordinator.interrupt(sessionID); otherwise it renews the claim, forks a scoped renewal loop every leaseDuration / 3, and interrupts through the coordinator with claim clearing as the final effect. SessionExecutionClaim.Lost during that clear is ignored, while other defects are rethrown.
• 🔴 (11:15) User supplied local placement behavior: SessionExecutionLocal loads the Session from SessionStore, defects with Session not found: ${claim.sessionID} when absent, and runs SessionRunner.Service.use((runner) => runner.run({ ...claim, force, recoveryInputID })) under locations.get(session.location).
• 🔴 (11:15) User supplied SessionExecutionLocal.node construction: makeGlobalNode provides SessionExecution.Service with dependencies [Database.node, SessionStore.node, LocationServiceMap.node].