sync: upstream v1.17.8 (8716c4309 on dev)

[Alezander9]

Summary

Brings anomalyco/opencode up to v1.17.8 (8716c4309 on dev). 157 upstream commits since 6c6ed68b5 (v1.17.0), spanning v1.17.1–v1.17.8. Patch-level window — no sweeping directory-rename refactors.

Main upstream themes pulled in:

• MCP hardening — client roots support (#32230), structured output (#32074), OAuth callback lifecycle + idle-shutdown (#32245), typed tool-error results (#32244), catalog/prompt/resource timeouts, expired-session recovery (#32088).
• v2 session API endpoints (#31822), project-copies refactor for v2 (#31943).
• integration-credentials simplification (#31968), build server from layer nodes (#32086), raw-filesystem content serving (#31911).
• Broad stats/app/web/tui churn + generated SDK/API updates.

Conflicts resolved

File	Resolution
bun.lock	Took upstream, regenerated via bun install against our workspace.
packages/opencode/package.json	Kept @browser-use/browsercode-core name, took version 1.17.8.
packages/core/src/plugin/skill/customize-opencode.md	Re-deleted (modify/delete; we don't ship this skill).
packages/opencode/src/agent/agent.ts	Kept BrowserCode whitelist globs (browser-sessions, agent-workspace, browser-skills) + adopted upstream's new referenceDirs whitelist — both feed whitelistedDirs.
packages/opencode/src/mcp/index.ts	Adopted upstream's new createClient(directory) helper at both call sites; moved the BrowserCode name: "bcode" client identity into that single helper (divergence reduced from two new Client calls to one line; gains upstream client-roots capability).
packages/opencode/test/session/snapshot-tool-race.test.ts	Took upstream's new LayerNode graph wiring (our makeHttp helper was the old upstream style).
packages/opencode/test/tool/registry.test.ts	Took upstream's LayerNode wiring (our registryLayer helper was the old style). FetchUse is satisfied by ToolRegistry.node's own layer, not test wiring.

Step 3a (re-delete upstream-only workflows): no-op this window — no .github/workflows modify/delete, nothing reintroduced.

Verification

• bun install: clean.
• filtered bun run typecheck: 13/13 packages passed (~15s).
• Ran packages/opencode/test/tool/registry.test.ts locally: 12/12 pass — confirms FetchUse resolves through ToolRegistry.node under upstream's LayerNode wiring (validates the test-file resolution above).
• packages/opencode/test/session/snapshot-tool-race.test.ts fails on a local Windows shell/path artifact (upstream test uses Unix echo 'x' > <path> with a backslash Windows path passed to a bash-style shell) — not a sync regression; agent CI is Linux.

Yellow-zone audit

Upstream touched 9 BrowserCode-modified files this window; all customizations verified preserved/re-applied:

• core/src/v1/config/config.ts — fetch_use config option preserved alongside upstream's new references/deprecated-reference fields.
• config/config.ts — bcode config filenames + bcode.sh schema URL.
• agent.ts, mcp/index.ts — resolved by hand (see conflicts).
• plugin/index.ts — Laminar plugin + pluginShutdownHooks.
• provider/provider.ts — bcode attribution headers (X-BILLING-INVOKE-ORIGIN stays removed per fork policy; confirmed not a new upstream addition).
• tui/app.tsx — BrowserCode terminal titles + docs.open browsercode link.
• tui/routes/session/index.tsx — browser_execute TUI display component.
• AGENTS.md — kept BrowserCode fork guidance + upstream notes (no stray markers).

UPSTREAM.md sync log updated with this row.

---

Summary by cubic

Sync to upstream v1.17.8 to pull MCP hardening, v2 session APIs, and several app UX improvements. Updates our forked customizations, resolves conflicts, and bumps the app to 1.17.8.

• New Features

  • MCP: client roots, structured output, OAuth idle-shutdown, prompt/resource timeouts, and expired-session recovery.
  • App: new directory picker (v2) using @pierre/trees, /new-session draft flow and tabs, titlebar tab fades, and visibility settings on web.
  • Prompt input: forwards desktop image attachment sourcePath to the model.
  • Tests: new smoke test to keep the visible message fixed while prepending history; improved mock server (message delay, SSE retry).

• Refactors

  • Server/API: adopt v2 session endpoints; test wiring moved to LayerNode.
  • Reactivity: contexts now use reactive accessors (serverSDK(), serverSync(), sdk()); SDKProvider returns a memoized directory-scoped SDK.
  • Events: coalesce adjacent message.part.delta events; initialize text delta accumulation from the current part text.
  • Config: move to references in opencode.jsonc (keeps deprecated reference compatibility).
  • UI/Settings: provider dialogs and settings updated to new sync access; small fixes across header, terminal, and status UI.
  • Docs: add branch naming guidance in AGENTS.md.
  • Dependencies: add @tanstack/solid-virtual; upgrade shiki to 4.x, @pierre/diffs to 1.2.10, and opentui-spinner to 0.0.7; regenerate bun.lock and Nix hashes.

^{Written for commit 7675d76. Summary will update on new commits.}