chore(sync): merge upstream v2 through v2.0.28

[shuv1337]

Summary

Syncs integration-v2 (cacea1fc5014feca6d51a88b2faa4ab5fc5b4f0d, v2.0.26-shuv.1) with upstream OpenCode V2 through v2.0.28 (c5aabae288de2614c94eb00446bd07b10097f179, sync release versions for v2.0.28 [skip ci]), bumping the Shuvcode CLI version to 2.0.28-shuv.1.

Upstream V2 Topology Note

Upstream promoted v2 into dev in 5caf1f9f6f5f30e13fc50a788ad953d97ae3748f (chore: promote v2 to dev), after which upstream/v2 stopped at 4617210822bdbb31e5749751afbfb4584ccedac8 (2.0.26) and V2 releases v2.0.27 and v2.0.28 were cut from upstream/dev. Following the pattern of PRs #436, #443, and #444, this PR merges the v2.0.28 version-sync commit c5aabae288de2614c94eb00446bd07b10097f179 (8059cdcbdf17bd4b7d48e934f18275288b8eaab4..c5aabae288de2614c94eb00446bd07b10097f179, 199 upstream commits).

---

Pre-Sync Unmerged Fork Branch Inventory & Dispositions

Refreshed origin (git fetch --prune origin) and inventoried all unmerged local and origin/* branches against origin/integration-v2 (cacea1fc50):

1. Intentionally open and preserved across sync:
   • native-supervisor / origin/native-supervisor (ed2dc35d8d) — Open Draft PR feat(cli): add native supervisor and Herdr integration #440 (feat(cli): add native supervisor and Herdr integration), left untouched.
2. Already landed by equivalent changes on integration-v2 (squash/rebased PRs):
   • origin/fm/sc-i438-tab-popover (5b2723ef6f) → landed in PR fix(app): keep session tab preview from intercepting clicks #442 (a8a159aa54)
   • origin/fm/sc-folderswitch-quarantine (3da9fdf501) → landed in PR test(app): quarantine FolderSwitch tab e2e test #439 (9fad47dec6), superseded by fix(app): keep session tab preview from intercepting clicks #442
   • origin/fm/sc-i407-toolcall-recovery (61651d75f8) → landed in PR fix(core): recover confirmed subagent calls after provider stream close #437 (456a5790f7)
   • origin/fm/sc-i412-run-admission (7e2bd6aedf) → landed in PR fix(cli): bound run setup RPCs and report startup progress #434 (db0f805566)
   • origin/fm/sc-i411-watcher-flake (c8a5cbf4be) → landed in PR test(core): await native acquisition in HEAD watcher cases #433 (6883f0feaf)
   • origin/fm/sc-e2e-timeline (3d7273b616) → landed in PR fix(app): preserve timeline anchors on scroll idle #432 (22f4fbcae4)
   • origin/fm/sc-cursor-378 (2d4cd45cbe) → landed in PR fix(core): inherit parent agent model in model-less subagents #431 (03eb8442fc)
   • origin/sc-cursor-377 (39cb05ca46) → landed in PR fix(script): fail closed on jj channel lookup and read unimported git refs #430 (07e7edce6e)
   • origin/sc-permission-fixes (2c238b4e4d) → landed in PR fix(core): cancel orphaned permission asks and auto-approve across session families #429 (a2900440aa)
   • origin/cursor/standalone-global-flag-1969 (e6fc678dff) → landed in PR fix(cli): accept --server and --standalone as global flags #428 (3c0cfc61af)
   • origin/cursor/antigravity-quota-errors-c5e1 (96f7b1ef54) → landed in PR fix(antigravity): surface Google 429 quota exhaustion instead of retrying it #427 (a7e864f739)
   • origin/cursor/core-test-node-a8d0 (191692e23e) → landed in PR fix(core): run isolated tests with a real node #426 (5af48e1f30)
   • origin/cursor/legacy-health-probe-5e6a (9af74452a1) → landed in PR fix(cli): continue explicit --server after legacy health 404 #424 (16080e2524)
   • origin/cursor/jj-pr-review-149d (31bd5f1c03) → landed in PR fix(core): let /review resolve PRs in JJ-only checkouts #423 (c23bd83075)
   • origin/cursor/persist-session-log-5c6b (da1bfd2401) → landed in PR fix(cli): persist durable session events for serve #422 (6486b53f3c)
   • origin/cursor/client-test-contract-de6d (831fe3b1e9) → landed in PR test(client): reconcile stale public contract expectations #421 (97f9afcadf)
   • origin/fm/sc-ci-reenable (44a1ae04b3) → landed in PR fix: re-enable test and typecheck CI on integration-v2 #420 (14e5282146)
   • origin/cursor/tui-probe-404-7466 (bf73a23ee1) → landed in PR fix(tui): return 404 for probe GET / on test servers #418 (02a1bc3d4b)
   • origin/cursor/host-deploy-channel-5f72 (c6d698e3c4) → landed in PR docs: require OPENCODE_CHANNEL on host deploys #414 (f647e1414f)
   • origin/fm/sc-373-jev (b5edd530a9) → landed in PR feat(core): add experimental jev.systemOne session tool #397 (35e9f9ab29)
   • origin/cursor/cli-test-env-a867 (7fd2dc72d4) → landed in PR fix(cli): strip session OPENCODE_* from spawned test CLIs #396 (bd1326113a)
   • origin/cursor/dependency-inspection-a7f4 (f68aadf246) → landed in PR docs: note how to inspect isolated workspace deps #395 (91ccc8f216)
   • origin/cursor/large-pr-diff-87a3 (a3481b293d) → landed in PR docs: review pull requests over 300 files locally #394 (14e2f96f5b)
   • origin/fm/sc-363-prompt-keys (404b425c46) → landed in PR fix(server): reject unknown keys in session.prompt body #393 (3dad5485da)
   • origin/cursor/remote-port-probes-4afe (f81a4dafa9) → landed in PR docs: use connect checks for remote port probes #392 (b1d2ca9669)
   • origin/cursor/live-service-binary-8c38 (ef9c484fb1) → landed in PR fix(dev): discover the live service with shuvcode #390 (964d98aa54)
   • origin/cursor/pre-sync-checklist-b97e (9c9de3c3f9) → landed in PR docs: check unmerged fork branches before upstream sync #389 (eaf119f6ba)
   • origin/cursor/ab-check-git-ad5d (e5a026b4f2) → landed in PR docs: copy HEAD with git show for A/B checks #388 (d339652759)
   • origin/cursor/whitespace-check-docs-bdca (2670377335) → landed in PR docs: point whitespace checks at git diff --check #387 (d98cfaa457)
   • origin/fm/sc-362-agent-model (22fed3b3f3) → landed in PR fix(core): honor agent model when resolving session model #378 (b37e61ebd7)
   • origin/fm/sc-361-jj-channel (728164a792) → landed in PR fix(script): resolve build channel under jj and detached HEAD #377 (ccadb8fada)
   • Closed draft PRs fix(util): keep stdin error listeners through EPIPE teardown #425 (origin/cursor/stdin-epipe-listener-968d) and fix(ci): run test and typecheck on integration-v2 pushes #415 (origin/cursor/ci-integration-v2-61f7) were superseded by fix: re-enable test and typecheck CI on integration-v2 #420 and chore(ci): run full test suite only for releases #441.
3. Obsolete work with recorded decision (left untouched):
   • Pre-rewrite (2026-09-15 L0 cutover) V2 branches, backups, and legacy V1 refs.
   • No missing fixes required reconciliation prior to sync.

---

Conflict Resolutions & Regenerations

• GitHub Workflows & Postinstall: Kept fork's .github/workflows/{publish,test,typecheck,notify-discord}.yml; omitted upstream-only deployment/nix workflows (check.yml, deploy*.yml, nix*.yml) and packages/cli/script/postinstall.mjs.
• Effect 4.0.1 Upgrade (1aae67e853):
  • Updated packages/cli/src/commands/commands.ts and packages/cli/src/services/server-flags.ts to effect/cli (Flag.Boolean, Flag.String, Argument.String, GlobalFlag.Setting, etc.) while preserving fork global --standalone / --server flags (connectionFlags: "unsupported" on non-client commands) and shuvcode CLI descriptions.
  • Updated packages/cli/src/services/updater.ts, packages/cli/test/updater-install.test.ts, packages/ai/test/provider/mistral-chat.test.ts, and packages/core/test/tool-jev.test.ts imports from effect/unstable/{process,http} to effect/{process,http}.
• Remote Pairing Consent & ShuvTunnel (packages/cli/src/commands/handlers/pair.ts, packages/cli/src/services/service-config.ts):
  • Integrated upstream's first-run pair --remote consent prompt and --yes (-y) flag with Shuvcode / shuvcode pair wording and ShuvTunnel RemoteTunnel.route(), preserving remoteAccepted: true in disableRemote().
• Updater & Retained Image (packages/cli/src/services/updater.ts, packages/cli/src/services/retained-image.ts):
  • Kept fork's shuvcode / shuvcode-node npm-only updater and RetainedImage.installed().
• Subagent Observer Lifetime & Confirmed Tool Call Recovery (packages/core/src/session/subagent-job.ts, packages/core/src/session/execution/restart.ts):
  • Combined upstream #54072 (SubagentJob.Service / SubagentJob.node / SubagentJob.layer with global context preservation) with fork PR fix(core): recover confirmed subagent calls after provider stream close #437's start(recovery: Recovery, notificationID?: SessionMessage.ID) signature and updated packages/core/test/fixture/subagent-recovery-process.ts and packages/core/test/session-execution.test.ts.
• Database Migrations & Client Generation:
  • Reconciled packages/core/schema.json (prevIds: ["a53f1d1d-f214-4983-940c-77625e2cb3f2"], id: "5067fae0-90ff-4601-82d7-dd050ea9dc8f") with both subagent_operation and project.time_archived, and regenerated packages/core/src/database/migration.gen.ts (bun script/migration.ts).
  • Regenerated client and OpenAPI specs (bun run generate in packages/client) and updated bun.lock.

---

Validation

• bun run check (45 packages typecheck + lint + sdk-docs)
• git diff --check
• Focused package tests in packages/cli, packages/core, packages/ai, packages/tui, and packages/script

Made with Cursor

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​number-flow@​0.6.2
	npm/​@​opentunnel/​client@​0.2.0 ⏵ 0.4.0				+2
	npm/​@​effect/​sql-sqlite-bun@​4.0.0-rc.112 ⏵ 4.0.1	+1		+4
	npm/​@​effect/​platform-node@​4.0.0-rc.112 ⏵ 4.0.1			+4
	npm/​@​effect/​platform-node-shared@​4.0.0-rc.112 ⏵ 4.0.1			+4	+1
	npm/​@​effect/​opentelemetry@​4.0.0-rc.112 ⏵ 4.0.1	+1		+4
	npm/​bun-pty@​0.4.9 ⏵ 0.4.11	+1		+1	+1
	npm/​effect@​4.0.0-rc.112 ⏵ 4.0.1			+3	+2

View full report

[shuv1337]

Reviewed b74f65f57261b682f37161f9fb30ae0603f74f37 against base cacea1fc5014feca6d51a88b2faa4ab5fc5b4f0d in detached, isolated worktrees. This is a focused review of the 1,604-file sync: merge conflict resolutions, fork identity, config/provider behavior, database migration, and subagent recovery.

Findings

1. [P2] Keep machine-wide configuration in the Shuvcode namespace. packages/core/src/config/discovery.ts:29–38 introduces default discovery under /etc/opencode, /Library/Application Support/opencode, and the ai.opencode.managed MDM profile. These defaults are enabled for ordinary config loading, despite Global.app === "shuvcode" and the fork's explicit removal of OpenCode-path fallbacks. On a machine with upstream OpenCode configuration, upgrading Shuvcode now imports that other application's defaults/plugins and potentially its highest-priority file policies. Use fork-specific system-directory/profile identities (keeping opencode.json as the format filename), and add a fork-isolation test. Direct execution confirms the new helper returns OpenCode paths while Global.app is Shuvcode; existing tests currently assert those upstream paths.

2. [P2] Regenerate the checked-in OpenAPI documents from the merged schema. packages/protocol/openapi.json:14060–14072 drops the fork's experimental.jev property even though the runtime schema and generated TypeScript client retain it. The documents also omit the new Provider.Encoding schema and provider/model encoding fields. All three checked-in copies (packages/protocol/openapi.json, services/www/openapi.json, services/www/public/openapi.json) are identical and stale, leaving spec-generated consumers with an inaccurate API contract. bun script/generate-openapi.ts --check fails on this head and passes on the base; generating into a separate review artifact confirms exactly these omissions. Regenerate all copies and include the freshness check in verification.

3. [P3] Recognize fork release versions in the highlights gate. packages/tui/src/util/highlights.ts:41–45 accepts only bare x.y.z, whereas publishable Shuvcode versions must be x.y.z-shuv.N. Consequently, even when a release embeds highlights, automatic display and seen-version recording never happen for fork releases. Directly calling decide with history and one highlight returns "show" for 2.0.28 after 2.0.26, but "none" for 2.0.28-shuv.1 after 2.0.26-shuv.1. Handle fork release ordering, including same-upstream shuv.N increments, and cover it in the highlights tests.

Verification

• Passed: frozen-lockfile dependency installation with lifecycle scripts disabled; canonical bun run check (lint/docs and all 41 executed typecheck tasks); database migration/schema/registry freshness check.
• Passed focused tests: Core config/migration/project/provider/session-execution/subagent-lifetime selection: 387 pass, 1 skip after rerunning sandbox-blocked cases with filesystem-watcher and temporary loopback access. Additional process-death recovery, subagent tools, Jev, variants, and edit tests: 74 pass. AI provider/encoding/schema tests: 341 pass. CLI pairing/retained-image/updater tests: 26 pass, 7 platform-specific skips. Highlights tests: 4 pass; these do not cover fork version strings.
• Failed: OpenAPI freshness check, as above. git diff --check reports whitespace in the imported Figma skill and changelog font license; not treated as runtime findings.
• Verification limit: CLI server-flags.test.ts has 25 failures because its child CLI, launched from a temporary cwd, cannot resolve react/jsx-dev-runtime. The corresponding help smoke test and direct child invocation fail with the same import error on the base commit, so this is not established as a regression from this PR. Full test suites, live provider calls, built binaries, Windows behavior, and live service/tunnel/TUI operation were not validated. No shared service was restarted and no source fixes were made.