fix(source-control): generate clean OpenCode messages locally and over SSH

[nwparker]

	Files	Added	Deleted	Net
Test	8	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​365	$\color{#cf222e}{\Huge{\mathbf{−}}}$​19	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​346
Prod	13	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​241	$\color{#cf222e}{\Huge{\mathbf{−}}}$​77	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​164

ELI5

OpenCode generates clean commit messages, review details and branch names using its configured model. Orca shows the actual provider error when generation fails.

What Changed

Replace the retired free-model default with Config default. Read JSON events to extract the final assistant answer and reject error events, including failures with exit code zero. Put run before OpenCode command flags and translate the precise v2 unsupported-variant rejection to model#variant, preserving split/inline model options and argument terminators.

SSH generation uses the execution host’s existing bounded login-environment resolver, then spawns the agent directly. Profile banners stay out of generated text and explicit environment overrides remain intact. One deadline includes both login-environment probes, executable lookup and child execution. Expired requests start no child; cancellation during profile resolution settles promptly without cancelling a shared cached probe. The optional RPC field remains compatible with older hosts.

Why

OpenCode owns model configuration, and hosted free models can disappear. Structured events distinguish the answer from tool output and progress. Reusing the existing environment resolver fixes missing SSH PATH entries without running the model inside an interactive shell. Retrying only the exact unsupported-argument error avoids repeating provider failures or silently switching models. Format metadata is read from the final arguments and stops at --, so literal message text cannot change output parsing.

Credit @andy-murr’s #5197 for the SSH shell intent and @coelho-doti’s closed #13065 for the argument-order fix intent. This adapts both to the current implementation.

Linked Issue

Fixes #20227
Fixes #4720

Related #12936: current installed OpenCode first-turn automatic branch/workspace rename passed through the real TUI and existing hooks; the original older environment was not reconstructed.

Related #15801 and #17691: current and official legacy success/provider-error paths were validated, but neither original UnknownError was reproduced. This PR does not claim their closure. #17551 interactive launch and #18561 accounts/Devin remain separate ownership.

Visual Proof

Before: installed OpenCode 2.0.16 rejects the retired model. After: the same hidden Source Control surface generates a clean commit message with Config default.

Testing

• I manually tested these changes locally
• Automated tests added/updated, or explained why not below

Actual CLI and desktop proof, with isolated profiles, home and all XDG directories:

• macOS installed OpenCode 2.0.16: Source Control Generate, production commit/review/branch services, raw PTY argument failures and successful retries, and a live free-provider answer. A real TUI first submitted prompt triggered existing hooks, renamed the generated workspace/branch and cleared its pending flag.
• Linux SSH official OpenCode 1.18.34: stock hidden desktop Source Control Generate traversed normal SSH authority and a fully deployed private relay to the real CLI. A private login profile supplied the binary missing from noninteractive PATH; the Message field showed the clean answer. No shared relay or user config was changed. Existing isolated keychain flags were used for the Mac test profile.
• Windows dedicated host with official OpenCode 2.0.16 in WSL: hidden production Source Control Generate used the explicit WSL project runtime and real staged Git context. It produced the expected clean message; a real provider HTTP401 surfaced the concrete error. The fixture needed an app-process-only Git safe-directory entry for its UNC path, with no global Git or guest-profile changes. This proves WSL generation, while native Windows authenticated generation and the historical Ollama/plugin UnknownError remain unverified.
• macOS official OpenCode 1.18.20 and installed 2.0.16: real provider HTTP401 events and desktop alerts surfaced the concrete rejection message. Legacy desktop success passed with fresh version-owned data. Original Windows/Ollama/plugin configuration for AI commit message reports \UnknownError\ while opencode succeeds #15801 and unspecified configuration for [Bug]: Can't generate commit messages/PRs with OpenCode #17691 remain unavailable, so those UnknownError reports stay unconfirmed.

On current main 53f9ea7, the complete 21-file change passes 141 focused tests in seven files, full Node typecheck, strict lint and formatting for the four review-correction files, six changed-line scans, and git diff --check. Nine timeout/format assertions fail on the original source; independent review found two further deadline-boundary failures before the final correction. All unrelated main files and contributor ancestry are preserved. Earlier broader generation/environment/relay validation passed 269 tests across 26 files, relay builds and hidden Electron builds.

The new deadline and format edge cases are controlled source-level reproductions. Two private installed 2.0.16 format attempts stalled before model HTTP/output and were stopped; they do not prove live generation success. The earlier genuine CLI/UI proof above is retained. A prior native Windows pinned-cmd PTY CI qualification failed outside these 21 files; its cause remains unverified. Fresh exact-head CI must pass before merge, including the Windows lanes.

All app/tests used ORCA_BACKGROUND_LAUNCH=1; no test window was shown or activated. Existing user windows, agent configuration and shared services were preserved. Real model responses used an isolated deterministic provider except the separately recorded live free-provider run.

AI Disclosure

Additional parser correction: valid named errors with empty data retain their error name; present malformed message types still fail validation. The new regressions failed 3 cases before and pass all 12 afterward; 31 related generation tests passed. A real isolated official OpenCode 1.18.20 run emitted MessageOutputLengthError with empty data under a private hook-fault control, and the actual parser now reports that name. Ordinary length finishes on installed 2.0.16 and 1.18.20 did not emit an error; no natural output-length failure is claimed. Targeted type-aware lint and independent review passed.

Review

Self-reviewed final-answer/error parsing, model selection, v1/v2 argument boundaries, cancellation and host ownership. The rebase preserves main’s intentional #24559 relay-lifetime revert; it does not restore that unrelated shutdown feature. #5197 is a proposed supersession only after review and merge. #23748 remains unrelated interactive-launch scope and is not superseded.

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

Older hosts may ignore the optional environment-resolution field and retain their previous PATH limitation. Folder workspaces use the existing cwd route; GitLab review context is preserved. No Git commands, account stores, status producers or terminal-screen rules change. Explicit unavailable model choices fail with a useful error.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

📝 Walkthrough

Walkthrough

OpenCode generation now uses JSON output and a config-default model option. The generation path parses OpenCode events and can retry a rejected --variant option. The change also adds OpenCode Go API-key storage and settings controls, expands Antigravity session discovery and transcript-based CLI continuation, and adds Qoder China and Qwen Code integrations. CI cache selection and relay execution behavior are also updated.

Fixed issue severity: Medium

Priority: ➖ Normal

Merge Risk: 🔵 Low · up to 1aeb4

This change can be merged with small follow-ups. The CI documentation should describe the new automatic cache default, and one test should restore its encryption flag even when an assertion fails. Neither issue affects product behavior.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1aeb4

The reviewed paths preserve important safeguards around execution targets, cancellation, and failed credential migration. No introduced vulnerability was confirmed, but shared credential ownership and incomplete recovery coverage prevent a minimal-risk assessment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The reviewed credential consumer sends the selected key as a Bearer header to a fixed HTTPS usage endpoint. Shared storage spans profiles using the same home directory; the traced consumer reads account usage, and does not demonstrate that this stored key is injected into generation processes.

Trust Boundaries and Controls

• observed — Transcript-reference startup checks source and destination execution-host ownership and WSL compatibility. Tests reject SSH aliases claiming local WSL ownership. Production Windows reference startup supplies a resolved shell; the weaker shell-omitted quoting helper therefore was not shown to create an executable attack path through the reviewed worktree flow. Actual transcript access is delegated to the external CLI.

Resilience and Maintainability Implications

• observed — Credential save and clear invalidate the local usage snapshot and advance its fetch generation, preventing the previous credential's pending result from being accepted as current. This is a local lifecycle control, not evidence of interprocess invalidation or provider-side revocation.

Hardening Proposals

• proposed — Make shared credential ownership and existing-key precedence explicit to users. If separate profiles are intended to preserve independent account choices, use profile-scoped storage or an explicit migration choice instead. This is a design proposal, not a verified isolation failure.

🚥 Pre-merge checks | ✅ 2 | ❌ 2 | ❓ 1

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The whole-PR summary includes substantial changes unrelated to [#20227] or [#4720]. Examples include Antigravity AI-vault scanning and resume behavior (src/main/ai-vault/, `src/renderer/src/lib/ai-v…	Remove the unrelated feature and workflow changes from this pull request, or move them to separate pull requests. Retain the OpenCode source-control generation changes and their supporting tests.
Description check	⚠️ Warning	The description includes the required sections and gives detailed rationale, testing, visual proof, linked issues, and review notes. However, it describes a focused 21-file OpenCode source-control cha…	Align the pull request contents and description. Split or remove unrelated changes, or document their purpose, user impact, and testing in the description. Update the small-and-focused checklist claim and file/test counts to match the actua…
Docstring Coverage	❓ Inconclusive	Docstring coverage is 7.79% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 77 functions across 67 files. (163 skipped…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	[#20227] The OpenCode specs now use Config default instead of the retired free model, request JSON output, and parse assistant text and error events. [#4720] The shared generation path handles OpenCod…
Title check	✅ Passed	The title clearly describes the main OpenCode source-control change: generating clean messages locally and over SSH.

Full details: Out of Scope Changes check

Explanation

The whole-PR summary includes substantial changes unrelated to [#20227] or [#4720]. Examples include Antigravity AI-vault scanning and resume behavior (src/main/ai-vault/, src/renderer/src/lib/ai-vault-*), Qoder CN and Qwen Code agent support (src/main/qoder/, src/main/qwen-code/, and shared agent files), OpenCode Go API-key storage and usage handling (src/main/opencode/, src/main/rate-limits/, and src/main/ipc/opencode-go-*), terminal shortcut policy changes, and CI cache/workflow changes. These do not implement or test the linked OpenCode source-control generation issues.

Full details: Docstring Coverage

Explanation

Docstring coverage is 7.79% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 77 functions across 67 files. (163 skipped: 14 unsupported, 149 over the file limit.)

Full details: Description check

Explanation

The description includes the required sections and gives detailed rationale, testing, visual proof, linked issues, and review notes. However, it describes a focused 21-file OpenCode source-control change, while the supplied change summary also lists extensive unrelated changes, including Qoder/Qwen support, Antigravity session handling, OpenCode Go credentials, and keybinding changes.

Resolution

Align the pull request contents and description. Split or remove unrelated changes, or document their purpose, user impact, and testing in the description. Update the small-and-focused checklist claim and file/test counts to match the actual changeset.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

Important

The new OpenCode event parser rejects legitimate provider errors that carry a data object without a string message, so those failures surface as OpenCode returned invalid JSON events. instead of the real reason — the opposite of this PR's stated goal.

Reviewed changes

• Config-default OpenCode model — opencode/opencode2 specs replace the retired opencode/deepseek-v4-flash-free default with a default sentinel, and finalizeModelDiscoveryOutput re-inserts that Config default entry when the CLI probe lists only concrete models.
• Structured JSON output — OpenCode specs now emit --format json; planCommitMessageGeneration marks the plan outputFormat: 'opencode-json' only when the surviving args carry --format json. The new parseOpenCodeGenerationOutput extracts text events, resets on step_start, and fails on the first error event.
• Failure surfacing — finalizeFromAgentOutput parses JSON output on both success and non-zero exit so a provider error replaces raw stderr in the user-facing message.
• run ordering and variant retry — mergeOpenCodeGenerationArgs moves run ahead of command-override prefix args; openCodeVariantRetryPlan rewrites a rejected --variant into model#variant and re-runs on the same host for agentId === 'opencode'.
• SSH login-shell environment — executeCommitMessagePlan sends shell: true; the relay resolves the execution host's login-shell env (bounded and cached), supports cancellation during resolution, and old relays ignore the optional field.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run re-reviewed the delta on top of the prior pullfrog review (1b60ec5d): the fix for the flagged OpenCode error-schema issue.

• Permissive error data — parseOpenCodeGenerationOutput's zod schema now makes error.data.message optional, so a legitimate named error carrying empty or differently-shaped data (e.g. MessageOutputLengthError with data: {}) resolves to error.data.message, then error.message, then error.name, instead of collapsing to OpenCode returned invalid JSON events.
• Regression coverage — new cases assert named errors without a data.message surface the name (or a top-level message), while a present-but-non-string data.message still fails validation.

The prior inline thread is resolved, the new cases fail against the pre-fix schema, and the 12-case parser suite passes.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fdb2f51f-184c-4d29-b2ed-0df79840005d

📥 Commits

Reviewing files that changed from the base of the PR and between b032867 and 786c97f.

📒 Files selected for processing (21)

• src/main/providers/ssh-git-noninteractive-provider.ts
• src/main/providers/ssh-git-provider-commit-message.test.ts
• src/main/text-generation/command-environment-process.test.ts
• src/main/text-generation/commit-message-agent-environment.ts
• src/main/text-generation/commit-message-model-discovery-policy.ts
• src/main/text-generation/opencode-generation-events.test.ts
• src/main/text-generation/source-control-agent-failure.ts
• src/main/text-generation/source-control-local-process.ts
• src/main/text-generation/source-control-remote-generation.ts
• src/main/text-generation/source-control-text-generation-requests.ts
• src/relay/agent-exec-handler.ts
• src/relay/agent-exec-shell-environment.test.ts
• src/shared/command-option-occurrence.ts
• src/shared/commit-message-agent-spec.test.ts
• src/shared/commit-message-agent-specs-primary.ts
• src/shared/commit-message-plan.test.ts
• src/shared/commit-message-plan.ts
• src/shared/opencode-generation-command.test.ts
• src/shared/opencode-generation-command.ts
• src/shared/opencode-generation-output.test.ts
• src/shared/opencode-generation-output.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

[pullfrog]

✅ No new issues found.

Reviewed changes

This run re-reviewed the delta on top of the prior pullfrog review (98fdecc7): the two fixes the author pushed in response to the earlier deadline and option-terminator findings.

• Bound the SSH generation deadline — agent-exec-handler.ts now computes one absolute deadline from the (clamped) request timeout and covers the two login-shell probes (through PromiseSettlementWaiters + an AbortController), the Windows executable lookup, and child execution. An expired profile wait or executable lookup spawns no child and returns timedOut; abort and lane cancellation settle canceled without cancelling the shared cached resolver. Fake-timer tests cover the probe budget, the final-millisecond boundary, abort/cancel during resolution, and a synchronous Windows PATH lookup that exhausts the budget.
• Derive outputFormat before -- — commit-message-plan.ts now reads the format option from the final generator args with findOptionOccurrence(..., ['--format'], true), so a literal --format json after an option terminator no longer flips outputFormat: 'opencode-json'. New planner tests cover both the argv and command-override terminator cases plus the active --format=json case.

Both changes match the intent of the prior CodeRabbit threads (both now resolved), the terminator fix is behavior-preserving for the non-terminated cases the old scan handled, and the deadline does not regress the existing 60s generation budget against the +5s transport margin.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run re-reviewed the delta on top of the prior pullfrog review (98fdecc7): the two fixes the author pushed in response to the earlier deadline and option-terminator findings.

• Bound the SSH generation deadline — agent-exec-handler.ts now computes one absolute deadline from the (clamped) request timeout and covers the two login-shell probes (through PromiseSettlementWaiters + an AbortController), the Windows executable lookup, and child execution. An expired profile wait or executable lookup spawns no child and returns timedOut; abort and lane cancellation settle canceled without cancelling the shared cached resolver. Fake-timer tests cover the probe budget, the final-millisecond boundary, abort/cancel during resolution, and a synchronous Windows PATH lookup that exhausts the budget.
• Derive outputFormat before -- — commit-message-plan.ts now reads the format option from the final generator args with findOptionOccurrence(..., ['--format'], true), so a literal --format json after an option terminator no longer flips outputFormat: 'opencode-json'. New planner tests cover both the argv and command-override terminator cases plus the active --format=json case.

Both changes match the intent of the prior CodeRabbit threads (both now resolved), the terminator fix is behavior-preserving for the non-terminated cases the old scan handled, and the deadline does not regress the existing 60s generation budget against the +5s transport margin.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (1)

🟡 Minor · Update the default-cache guidance. · ci-runner-efficiency.md:221

docs/reference/ci-runner-efficiency.md:221
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Update the default-cache guidance.

Line 221 says the default retains setup-node cache behavior. The new auto default instead selects lookup-only mode for eligible non-PR installs. State which installs use lookup-only mode and that callers can select false to retain archive restoration.

🧹 Nitpick comments (1)

src/main/ai-vault/ssh-session-list.ts (1)

114-114: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove the duplicate includeAntigravityIdeSessions assignment.

Line 114 passes args?.includeAntigravityIdeSessions directly. Lines 117-119 then set the same key again through a conditional spread. The two assignments produce the same result, so one of them is dead code. Keep the conditional spread, because it matches the relay params at lines 66-68.

♻️ Proposed fix

-        includeAntigravityIdeSessions: args?.includeAntigravityIdeSessions,

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 288f0006-d625-4c9d-b268-62583ce59681

📥 Commits

Reviewing files that changed from the base of the PR and between 786c97f and 1aeb41b.

⛔ Files ignored due to path filters (1)

• src/shared/agent-icons/qoder-cn.png is excluded by !**/*.png

📒 Files selected for processing (217)

• .github/actions/install-node-dependencies/action.yml
• .github/workflows/mobile.yml
• config/scripts/ci-dependency-download-cache.test.mjs
• config/scripts/ci-pnpm-store-mode.test.mjs
• config/scripts/mobile-release-shell-switch-workflow.test.mjs
• config/scripts/mobile-typecheck-workflow.test.mjs
• config/scripts/pr-e2e-gate-contract.test.mjs
• config/scripts/pr-e2e-linux-packages.test-fixture.mjs
• config/scripts/pr-workflow-parallelism.test.mjs
• config/tsconfig.cli.json
• docs/reference/ci-runner-efficiency.md
• mobile/src/components/mobile-agent-icon-assets.ts
• mobile/src/tasks/mobile-tui-agents.ts
• src/main/agent-hooks/managed-agent-hook-registry.ts
• src/main/agent-hooks/managed-hook-command-contract.test.ts
• src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts
• src/main/agent-hooks/remote-managed-hook-installers.ts
• src/main/agent-hooks/server-retired-pane-new-turn.test.ts
• src/main/agent-workspace-trust-spawn.test.ts
• src/main/ai-vault/antigravity-history-prompt.ts
• src/main/ai-vault/antigravity-ide-history.test.ts
• src/main/ai-vault/antigravity-index-file-admission.test.ts
• src/main/ai-vault/antigravity-index-reader.test.ts
• src/main/ai-vault/antigravity-index-reader.ts
• src/main/ai-vault/antigravity-opening-prompt-workspace.test.ts
• src/main/ai-vault/antigravity-recorded-history.test.ts
• src/main/ai-vault/antigravity-transcript-candidates.ts
• src/main/ai-vault/cached-session-list.ts
• src/main/ai-vault/remote-session-scan-concurrency.ts
• src/main/ai-vault/remote-session-scanner-discovery.ts
• src/main/ai-vault/remote-session-scanner-sources.ts
• src/main/ai-vault/remote-session-scanner-types.ts
• src/main/ai-vault/remote-session-scanner.ts
• src/main/ai-vault/runtime-session-scanner.ts
• src/main/ai-vault/session-parse-cache-antigravity-upgrade.test.ts
• src/main/ai-vault/session-parse-cache-bounds.test.ts
• src/main/ai-vault/session-parse-cache-persistence.test.ts
• src/main/ai-vault/session-parse-cache-snapshot-serialization.ts
• src/main/ai-vault/session-root-dedup.ts
• src/main/ai-vault/session-scanner-accumulator.ts
• src/main/ai-vault/session-scanner-antigravity-history.ts
• src/main/ai-vault/session-scanner-antigravity-metadata.ts
• src/main/ai-vault/session-scanner-antigravity-parser.ts
• src/main/ai-vault/session-scanner-antigravity-paths.ts
• src/main/ai-vault/session-scanner-antigravity-sources.ts
• src/main/ai-vault/session-scanner-candidates.ts
• src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts
• src/main/ai-vault/session-scanner-types.ts
• src/main/ai-vault/session-scanner.ts
• src/main/ai-vault/ssh-session-list.ts
• src/main/claude/hook-settings.ts
• src/main/claude/windows-hook-files.test.ts
• src/main/credentials/api-key-file-unreadable-error.ts
• src/main/credentials/encrypted-api-key-file-store.ts
• src/main/execution-host-workspace-trust.ts
• src/main/ipc/ai-vault-runtime-scan.ts
• src/main/ipc/ai-vault.test.ts
• src/main/ipc/ai-vault.ts
• src/main/ipc/credential-change-rate-limit-refresh.test.ts
• src/main/ipc/credential-change-rate-limit-refresh.ts
• src/main/ipc/minimax-credentials.ts
• src/main/ipc/opencode-go-credentials.test.ts
• src/main/ipc/opencode-go-credentials.ts
• src/main/ipc/register-core-handlers/register-core-handlers.test.ts
• src/main/ipc/register-core-handlers/register-core-handlers.ts
• src/main/minimax/minimax-api-key-store.test.ts
• src/main/minimax/minimax-api-key-store.ts
• src/main/opencode-usage/opencode-database-discovery.ts
• src/main/opencode/opencode-credential-backend.test.ts
• src/main/opencode/opencode-credential-backend.ts
• src/main/opencode/opencode-go-api-key-store.test.ts
• src/main/opencode/opencode-go-api-key-store.ts
• src/main/persistence/applying-settings/settings-update.ts
• src/main/persistence/applying-settings/terminal-settings-migrations.ts
• src/main/persistence/leasing-ssh-ptys/secret-validation.ts
• src/main/persistence/loading-store/legacy-opencode-go-api-key-migration.test.ts
• src/main/persistence/loading-store/legacy-opencode-go-api-key-migration.ts
• src/main/persistence/loading-store/loaded-state-parsing.ts
• src/main/persistence/loading-store/profile-state-delayed-authority-fixture.ts
• src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts
• src/main/persistence/loading-store/state-serialization-secret-handling.ts
• src/main/persistence/loading-store/state-write-round-trip.test.ts
• src/main/persistence/loading-store/store.ts
• src/main/protected-secret-persistence.ts
• src/main/qoder/hook-service.test.ts
• src/main/qoder/hook-service.ts
• src/main/qoder/workspace-trust.ts
• src/main/qwen-code/hook-service.ts
• src/main/rate-limits/opencode-go-api-key-source.test.ts
• src/main/rate-limits/opencode-go-api-key-source.ts
• src/main/rate-limits/opencode-go-usage-source-selection.test.ts
• src/main/rate-limits/opencode-go-usage-source-selection.ts
• src/main/rate-limits/service-opencode-go-credentials.test.ts
• src/main/rate-limits/service-refresh-orchestration.test.ts
• src/main/rate-limits/service/service-account-refresh.ts
• src/main/rate-limits/service/service-configuration.ts
• src/main/rate-limits/service/service-fetch-targets.ts
• src/main/rate-limits/service/service-full-cycle-preparation.ts
• src/main/rate-limits/service/service-state.ts
• src/main/rate-limits/service/service-types.ts
• src/main/runtime/__fixtures__/qoder-cn-signin.meta.json
• src/main/runtime/__fixtures__/qoder-cn-signin.txt
• src/main/runtime/__fixtures__/qoder-cn-startup.meta.json
• src/main/runtime/__fixtures__/qoder-cn-startup.txt
• src/main/runtime/__fixtures__/readiness-census/synthetic--qoder-cn.json
• src/main/runtime/__fixtures__/readiness-census/transcript--qoder-cn-signin@agent.json
• src/main/runtime/__fixtures__/readiness-census/transcript--qoder-cn-signin@unknown.json
• src/main/runtime/__fixtures__/readiness-census/transcript--qoder-cn-startup@agent.json
• src/main/runtime/__fixtures__/readiness-census/transcript--qoder-cn-startup@unknown.json
• src/main/runtime/qoder-transcripts.test.ts
• src/main/runtime/readiness-census-synthetic-matrix.ts
• src/main/runtime/readiness-census-transcript-catalog.ts
• src/main/runtime/rpc/methods/ai-vault.test.ts
• src/main/runtime/rpc/methods/ai-vault.ts
• src/main/runtime/terminal-wait-detection.ts
• src/main/runtime/tui-idle-evidence-source.test.ts
• src/main/runtime/tui-idle-evidence-source.ts
• src/main/runtime/tui-idle-evidence.ts
• src/main/ssh/ssh-relay-session-managed-hooks.test.ts
• src/main/ssh/ssh-relay-session.ts
• src/main/startup/main-process-account-services.ts
• src/main/workspace-trust-test-fixtures.ts
• src/preload/api-types.ts
• src/preload/api/opencode-go-credentials-bridge.ts
• src/preload/index.ts
• src/preload/opencode-go-credentials.test.ts
• src/relay/agent-exec-handler.ts
• src/relay/agent-exec-shell-environment.test.ts
• src/relay/agent-workspace-trust-spawn.test.ts
• src/relay/ai-vault-handler.ts
• src/relay/ai-vault-service-entry.ts
• src/relay/ai-vault-transcript-stream.ts
• src/renderer/src/components/agent/AgentCombobox.test.tsx
• src/renderer/src/components/dashboard-popout/preview-terminal-shortcuts.test.ts
• src/renderer/src/components/dashboard-popout/preview-terminal-shortcuts.ts
• src/renderer/src/components/right-sidebar/AiVaultPanel.tsx
• src/renderer/src/components/right-sidebar/AiVaultSessionDetails.tsx
• src/renderer/src/components/right-sidebar/AiVaultSessionRow.tsx
• src/renderer/src/components/right-sidebar/AiVaultVirtualRow.test.tsx
• src/renderer/src/components/right-sidebar/AiVaultVirtualRow.tsx
• src/renderer/src/components/right-sidebar/ai-vault-session-launch-target.ts
• src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
• src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat.ts
• src/renderer/src/components/right-sidebar/ai-vault-session-resume.ts
• src/renderer/src/components/right-sidebar/ai-vault-session-row-display.tsx
• src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx
• src/renderer/src/components/settings/accounts-pane-opencode-credentials.test.ts
• src/renderer/src/components/settings/accounts-pane-opencode-credentials.tsx
• src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx
• src/renderer/src/components/settings/shortcut-terminal-status.ts
• src/renderer/src/components/tab-group/AiVaultSessionDropLayer.tsx
• src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts
• src/renderer/src/components/terminal-pane/terminal-shortcut-policy.ts
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/lib/agent-catalog.tsx
• src/renderer/src/lib/agent-favicon-assets.ts
• src/renderer/src/lib/agent-picker-search.test.ts
• src/renderer/src/lib/agent-picker-search.ts
• src/renderer/src/lib/agent-status.ts
• src/renderer/src/lib/ai-vault-antigravity-reference-host.test.ts
• src/renderer/src/lib/ai-vault-antigravity-reference-startup.ts
• src/renderer/src/lib/ai-vault-resume-command.test.ts
• src/renderer/src/lib/ai-vault-resume-command.ts
• src/renderer/src/lib/ai-vault-resume-shell.ts
• src/renderer/src/lib/ai-vault-resume-target.ts
• src/renderer/src/lib/local-preflight-context.ts
• src/renderer/src/lib/local-project-runtime-workspace.ts
• src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts
• src/renderer/src/runtime/agent-resume-host-authority-capability.ts
• src/renderer/src/runtime/remote-agent-session-launch.test.ts
• src/renderer/src/web/preload-api/web-agent-accounts-api.ts
• src/renderer/src/web/preload-api/web-ai-vault-api.ts
• src/renderer/src/web/web-preload-api-agent-providers.test.ts
• src/renderer/src/web/web-preload-api-composition.test.ts
• src/renderer/src/web/web-preload-api.ts
• src/shared/agent-headless-command.ts
• src/shared/agent-hook-listener/provider-dispatch.ts
• src/shared/agent-hook-listener/provider-event-routing.ts
• src/shared/agent-hook-listener/providers/compatible-lifecycle-events.ts
• src/shared/agent-hook-listener/source-routing.ts
• src/shared/agent-hook-relay.ts
• src/shared/agent-hook-types.ts
• src/shared/agent-kind.ts
• src/shared/agent-process-recognition.ts
• src/shared/agent-session-resume-runtime-capabilities.ts
• src/shared/agent-session-resume.ts
• src/shared/agent-title-identity.ts
• src/shared/agent-title-status.ts
• src/shared/ai-vault-resume-command.ts
• src/shared/ai-vault-types.ts
• src/shared/antigravity-session-origin.ts
• src/shared/antigravity-transcript-reference.test.ts
• src/shared/commit-message-plan.test.ts
• src/shared/commit-message-plan.ts
• src/shared/default-global-settings.ts
• src/shared/global-settings-types.ts
• src/shared/keybindings-terminal-context.test.ts
• src/shared/keybindings/definitions-core-2.ts
• src/shared/keybindings/effective.ts
• src/shared/node-bounded-file-reader.ts
• src/shared/protocol-version.ts
• src/shared/qoder-agent.test.ts
• src/shared/qoder-cn-launch-recipe.test.ts
• src/shared/rpc-contract/ai-vault-params.ts
• src/shared/skills-cli-agent-keys.ts
• src/shared/ssh-ai-vault-relay.ts
• src/shared/telemetry-property-schemas.ts
• src/shared/terminal-title-agent-type.ts
• src/shared/tui-agent-config-types.ts
• src/shared/tui-agent-config.ts
• src/shared/tui-agent-display-names.ts
• src/shared/tui-agent-permissions.ts
• src/shared/tui-agent-rest-signal.test.ts
• src/shared/tui-agent-rest-signal.ts
• src/shared/tui-agent-selection.ts
• src/shared/tui-agent.ts
• tests/e2e/cross-version-wire/qoder-registration-downgrade.unit.test.ts

💤 Files with no reviewable changes (2)

• src/main/persistence/applying-settings/settings-update.ts
• src/main/persistence/leasing-ssh-ptys/secret-validation.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/shared/commit-message-plan.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.