Add resilient OpenCode tool activity

.github/workflows/release.yml

@@ -232,6 +232,24 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
+      - name: Require signed OpenCode compatibility registry
+        shell: bash
+        env:
+          NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_URL: ${{ secrets.OPENCODE_SCHEMA_REGISTRY_URL }}
+          NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY: ${{ secrets.OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY }}
+          NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS: ${{ secrets.OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS }}
+        run: |
+          node scripts/check-opencode-registry-release.mjs
+          {
+            echo "NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_URL=$NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_URL"
+            echo "NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY<<COVEN_OPENCODE_KEY_EOF"
+            printf '%s\n' "$NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY"
+            echo "COVEN_OPENCODE_KEY_EOF"
+            echo "NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS<<COVEN_OPENCODE_KEYS_EOF"
+            printf '%s\n' "$NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS"
+            echo "COVEN_OPENCODE_KEYS_EOF"
+          } >> "$GITHUB_ENV"
+
       # Decode the App Store Connect API key onto the runner for the custom
       # macOS release script. The path is exported into the env for later
       # steps. Runs only on the macOS leg.

docs/opencode-compatibility-registry.md

@@ -0,0 +1,22 @@
+# OpenCode compatibility registry
+
+Coven Cave can update OpenCode JSON event schemas independently of an app release only when its packaged build includes a trusted registry configuration. The registry publishes signed, versioned JSON bundles; Cave embeds the corresponding Ed25519 **public** key and accepts a bundle only after signature, expiry, schema, and monotonic-sequence validation.
+
+## Release configuration
+
+Every desktop release must provide these GitHub Actions secrets:
+
+- `OPENCODE_SCHEMA_REGISTRY_URL` — canonical HTTPS URL for the signed OpenCode bundle.
+- `OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY` — PEM-encoded Ed25519 public key that verifies that bundle.
+
+For a rotation release, replace the single-key secret with `OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS`: a JSON object of one to four `{ "key-id": "PEM" }` entries containing the active key and the retiring key. The release workflow maps this to `NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS`; it is an alternative to the single-key setting, not an additional trust source.
+
+The release workflow maps these values to `NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_URL` and `NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY`, then runs `scripts/check-opencode-registry-release.mjs` before packaging. They are public verification material, intentionally compiled into the desktop application. A release fails closed if either value is missing, non-HTTPS, or not an Ed25519 key.
+
+Development and test processes may inject `COVEN_OPENCODE_SCHEMA_REGISTRY_URL` and `COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY` instead. Without a configured registry, the source-trusted built-in profile is the offline/development baseline; it does not provide independently deployed schema recovery and must not be used to ship a desktop release.
+
+## Publishing and rotation
+
+The registry publisher owns the private signing key; it must never be placed in Cave, the release workflow, logs, or issue text. Publish an immutable bundle for each increasing `sequence`, with canonical RFC 3339 UTC timestamps and the detached Ed25519 signature over the bundle payload. Cave rejects rewrites at an existing sequence and lower sequences even after a cache entry expires.
+
+To rotate a key, publish a Cave release carrying an active-plus-previous keyring before publishing bundles signed only by the new key. New bundles include the signed `keyId`; Cave stores that verified signer alongside its cache, so an offline client can continue using a valid prior-key bundle during the overlap. Keep the prior key in the packaged keyring for one release window (and no more than the bundle expiry), then remove it in a later release after the registry has served the new key successfully. Emergency revocation removes the compromised key in a new release and intentionally falls back to the bundled parser for any cache that only it signed. Record the registry endpoint, public-key fingerprint, owner, rotation date, and retirement date in the release checklist.

scripts/cave-home-migration-windows.test.ts

@@ -113,19 +113,25 @@ try {
   const candidateFailureCave = path.join(candidateFailureHome, "cave");
   await mkdir(candidateFailureCave, { recursive: true });
   let candidateAttempts = 0;
+  let candidateClock = 0;
   const candidates = new Set<string>();
   const persistentEperm = async (candidate: string) => {
     candidateAttempts += 1;
+    candidateClock += 100;
     candidates.add(candidate);
     const error = new Error("injected persistent Windows EPERM") as NodeJS.ErrnoException;
     error.code = "EPERM";
     throw error;
   };
   await assert.rejects(
-    migrateCaveHome({ lockTimeoutMs: 150, lockCandidateRename: persistentEperm }),
+    migrateCaveHome({
+      lockTimeoutMs: 500,
+      lockNow: () => candidateClock,
+      lockCandidateRename: persistentEperm,
+    }),
     (error) => error?.code === "ETIMEDOUT",
   );
-  assert.ok(candidateAttempts >= 2);
+  assert.ok(candidateAttempts >= 2, "the injected monotonic clock permits the intended retry sequence independent of CI scheduling");
   assert.equal(candidates.size, 1, "candidate retries reuse one directory on Windows");
   assert.equal(
     (await readdir(candidateFailureCave)).some((name) => name.startsWith(".migration.lock.candidate-")),

scripts/check-opencode-registry-release.mjs

@@ -0,0 +1,38 @@
+// Release-only guard for the OpenCode compatibility registry. The public key
+// is intentionally embedded in the desktop build (it verifies, never signs);
+// the private Ed25519 key remains solely in the registry publishing service.
+import { createPublicKey } from "node:crypto";
+
+const url = process.env.NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_URL;
+const publicKey = process.env.NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEY;
+const publicKeys = process.env.NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS;
+
+function fail(message) {
+  console.error(`::error::${message}`);
+  process.exitCode = 1;
+}
+let keyring;
+try {
+  keyring = publicKeys
+    ? JSON.parse(publicKeys)
+    : publicKey
+      ? { legacy: publicKey }
+      : null;
+} catch {
+  keyring = null;
+}
+if (!url || !keyring || typeof keyring !== "object" || Array.isArray(keyring)) {
+  fail("OpenCode compatibility registry URL and an Ed25519 public key or bounded keyring must be configured for every desktop release.");
+} else {
+  try {
+    if (new URL(url).protocol !== "https:") throw new Error("registry URL must use HTTPS");
+    const entries = Object.entries(keyring);
+    if (!entries.length || entries.length > 4) throw new Error("registry keyring must contain one to four keys");
+    for (const [id, pem] of entries) {
+      if (!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(id) || typeof pem !== "string") throw new Error("registry keyring has an invalid key id");
+      if (createPublicKey(pem).asymmetricKeyType !== "ed25519") throw new Error("registry key must be Ed25519");
+    }
+  } catch (error) {
+    fail(`Invalid OpenCode compatibility registry configuration: ${error instanceof Error ? error.message : "unknown error"}`);
+  }
+}

scripts/check-opencode-registry-release.test.mjs

@@ -0,0 +1,15 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+
+const workflow = await readFile(new URL("../.github/workflows/release.yml", import.meta.url), "utf8");
+const guard = await readFile(new URL("./check-opencode-registry-release.mjs", import.meta.url), "utf8");
+const docs = await readFile(new URL("../docs/opencode-compatibility-registry.md", import.meta.url), "utf8");
+
+assert.match(workflow, /Require signed OpenCode compatibility registry[\s\S]*?NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_URL[\s\S]*?check-opencode-registry-release\.mjs/);
+assert.match(workflow, /NEXT_PUBLIC_COVEN_OPENCODE_SCHEMA_REGISTRY_PUBLIC_KEYS/);
+assert.match(guard, /new URL\(url\)\.protocol !== "https:"/);
+assert.match(guard, /asymmetricKeyType !== "ed25519"/);
+assert.match(guard, /keyring must contain one to four keys/);
+assert.match(docs, /rotation/i);
+assert.match(docs, /built-in profile/i);
+console.log("check-opencode-registry-release.test.mjs: ok");

scripts/git-hooks-pre-commit.test.mjs

@@ -1,12 +1,18 @@
 import assert from "node:assert/strict";
-import { chmodSync, cpSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const hookSource = path.join(root, "scripts", "git-hooks", "pre-commit");
+// On Windows `bash` may resolve to the WSL launcher, which is not a usable
+// shell when WSL is uninstalled or partially configured. Prefer Git Bash when
+// available; the hook itself still executes under the same Bash implementation
+// used by Git for Windows and GitHub's Windows runners.
+const gitBash = "C:\\Program Files\\Git\\bin\\bash.exe";
+const bashCommand = process.platform === "win32" && existsSync(gitBash) ? gitBash : "bash";
 
 function run(cmd, args, cwd) {
   const result = spawnSync(cmd, args, { cwd, encoding: "utf8" });
@@ -32,7 +38,7 @@ function stagedRepo({ filePath, content }) {
 }
 
 function runHook(repo) {
-  return run("bash", ["scripts/git-hooks/pre-commit"], repo);
+  return run(bashCommand, ["scripts/git-hooks/pre-commit"], repo);
 }
 
 {

scripts/run-tests.mjs

@@ -101,6 +101,7 @@ export const SUITES = {
     "scripts/codemods/tokenize-tsx-design.test.mjs",
     "scripts/eslint/design-system-plugin.test.mjs",
     "scripts/bundle-budget.test.mjs",
+    "scripts/check-opencode-registry-release.test.mjs",
     "src/components/open-coven-tools-update.test.ts",
     "src/lib/opencoven-tools-state.test.ts",
     "src/lib/opencoven-install-job-observer.test.ts",
@@ -472,6 +473,8 @@ export const SUITES = {
     "src/lib/slash-model.test.ts",
     "src/lib/opencode-models.test.ts",
     "src/lib/opencode-bin.test.ts",
+    "src/lib/chat-tool-events.test.ts",
+    "src/lib/opencode-compatibility.test.ts",
     "src/lib/opencode-stream.test.ts",
     "src/lib/use-runtime-model-options.test.ts",
     "src/lib/slash-skill.test.ts",
@@ -1020,6 +1023,8 @@ export const SUITES = {
     "src/app/api/chat/send/harness-routing-model-capabilities.test.ts",
     "src/app/api/chat/send/harness-routing-copilot-jsonl.test.ts",
     "src/app/api/chat/send/harness-routing-opencode.test.ts",
+    "src/app/api/chat/send/chat-send-capabilities.test.ts",
+    "src/app/api/chat/send/route-opencode.integration.test.ts",
     "src/app/api/chat/send/offline-queue.test.ts",
     "src/app/api/chat/send/first-turn-stub.test.ts",
     "src/app/api/onboarding/status/route.test.ts",
@@ -1277,6 +1282,10 @@ const STRIP_TYPES_MJS = new Set([
 // Tests whose import graph reaches the "@/..." path alias and therefore need
 // the alias-resolving loader (`scripts/test-alias-register.mjs`).
 const ALIAS_LOADER = new Set([
+  "src/lib/opencode-compatibility.test.ts",
+  "src/lib/opencode-stream.test.ts",
+  "src/app/api/chat/send/chat-send-capabilities.test.ts",
+  "src/app/api/chat/send/route-opencode.integration.test.ts",
   "src/lib/familiar-workspace-sessions.test.ts",
   "scripts/cave-home-migration-windows.test.ts",
   "src/lib/bento-dashboard.test.ts",

src-tauri/release-runtime.test.mjs

@@ -390,7 +390,7 @@ test("mobile startup remains available after native-host extraction", async () =
 
   assert.match(nativeHost, /\nmod tauri_setup;/);
   assert.doesNotMatch(nativeHost, /#\[cfg\(desktop\)\]\s*\nmod tauri_setup;/);
-  assert.match(setup, /#\[cfg_attr\(mobile, tauri::mobile_entry_point\)\]\npub fn run\(\)/);
+  assert.match(setup, /#\[cfg_attr\(mobile, tauri::mobile_entry_point\)\]\r?\npub fn run\(\)/);
 });
 
 test("Windows close watchdog helper follows extracted lifecycle tests", async () => {

src/app/api/chat/send/chat-send-capabilities.test.ts

@@ -0,0 +1,91 @@
+// @ts-nocheck
+import assert from "node:assert/strict";
+import { mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { openCodeExecutableIdentity, parseOpenCodeRunCapabilitiesHelp } from "./chat-send-capabilities.ts";
+
+const capabilities = parseOpenCodeRunCapabilitiesHelp(`
+  --structured-output <format>  Output format: text, json-v3
+  --event-stream                Emit structured lifecycle events
+  --no-color                    Disable terminal color
+  --permission <mode>           Set tool permission policy
+`, "3.0.0");
+
+assert.deepEqual(
+  capabilities.noValueOptions,
+  ["--event-stream", "--no-color"],
+  "only declared flags without a value placeholder can satisfy a signed no-value launch requirement",
+);
+assert.equal(capabilities.structuredOutputs?.[0]?.option, "--structured-output");
+assert.deepEqual(capabilities.structuredOutputs?.[0]?.values, ["json-v3"]);
+
+const valueTaking = parseOpenCodeRunCapabilitiesHelp(`
+  --format <format>             Output format: text, json
+  --event-stream MODE           Configure lifecycle frame mode
+  --no-color                    Disable terminal color
+`, "3.1.0");
+assert.deepEqual(
+  valueTaking.noValueOptions,
+  ["--no-color"],
+  "an unbracketed positional token after a flag is ambiguous and cannot be launched without a value",
+);
+
+const booleanJson = parseOpenCodeRunCapabilitiesHelp(`
+  --json                         Emit JSON events
+  --event-json-v2                Emit JSON v2 events
+  --format <format>              Output format: text
+`, "3.2.0");
+assert.deepEqual(
+  booleanJson.structuredOutputs,
+  [],
+  "a boolean JSON switch is never mis-recorded as an option that accepts the literal json value",
+);
+assert.deepEqual(
+  booleanJson.structuredSwitches,
+  [
+    { option: "--json", protocols: ["json"] },
+    { option: "--event-json-v2", protocols: ["json-v2"] },
+  ],
+  "explicit valueless JSON switches retain their independently probed launch contract",
+);
+assert.deepEqual(booleanJson.protocols, ["json", "json-v2"]);
+
+const proseOnlyJson = parseOpenCodeRunCapabilitiesHelp(`
+  --format <format>             Select an output format; use --json for JSON output
+  --json                         Emit JSON events
+`, "3.3.0");
+assert.deepEqual(
+  proseOnlyJson.structuredOutputs,
+  [],
+  "a JSON mention in a value-taking option's prose is not treated as an accepted format value",
+);
+assert.deepEqual(proseOnlyJson.protocols, ["json"], "only the independently declared boolean JSON switch contributes a protocol");
+
+const resumeCapabilities = parseOpenCodeRunCapabilitiesHelp(`
+  --format <format>             Output format: text, json
+  --resume                        Resume the most recent session
+  --session <id>                 Resume a named session
+`, "3.4.0");
+assert.equal(resumeCapabilities.session, true);
+assert.deepEqual(resumeCapabilities.valueOptions, ["--format", "--session"], "only session options with an explicit argument can receive Cave's native session id");
+
+const launcherA = await mkdtemp(path.join(tmpdir(), "cave-opencode-launch-a-"));
+const launcherB = await mkdtemp(path.join(tmpdir(), "cave-opencode-launch-b-"));
+const executable = process.platform === "win32" ? "opencode.cmd" : "opencode";
+await writeFile(path.join(launcherA, executable), "first");
+await writeFile(path.join(launcherB, executable), "second");
+const identityA = await openCodeExecutableIdentity({ PATH: launcherA });
+const identityB = await openCodeExecutableIdentity({ PATH: launcherB });
+assert.notEqual(identityA, identityB, "capability-cache identity changes when PATH resolves a different OpenCode executable");
+
+const windowsLauncher = await mkdtemp(path.join(tmpdir(), "cave-opencode-launch-windows-"));
+await writeFile(path.join(windowsLauncher, "opencode.cmd"), "shim");
+await writeFile(path.join(windowsLauncher, "opencode.exe"), "binary");
+const windowsIdentity = await openCodeExecutableIdentity(
+  { PATH: windowsLauncher, PATHEXT: ".COM;.EXE;.BAT;.CMD" },
+  "win32",
+);
+assert.match(windowsIdentity, /opencode\.exe\0/i, "Windows capability identity follows PowerShell PATHEXT precedence over a co-located cmd shim");
+
+console.log("chat-send-capabilities.test.ts: ok");