feat(runner)!: drive opencode 2.x through @opencode/client

.github/dependabot.yml

@@ -13,8 +13,8 @@ updates:
       # Bump by hand once @cloudflare/vitest-plugin's peer range includes the new major.
       - dependency-name: vitest
         update-types: ["version-update:semver-major"]
-      # The flake's opencode-sdk check pins the SDK to nixpkgs' opencode; bump both together.
-      - dependency-name: "@opencode-ai/sdk"
+      # The flake's opencode-client check pins the client to nixpkgs' opencode; bump both together.
+      - dependency-name: "@opencode/client"
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -38,6 +38,3 @@ updates:
         patterns: ["quest-pinned"]
       nix:
         patterns: ["*"]
-    ignore:
-      # Pinned to the last nixpkgs with opencode 1.x until /quest/m0/opencode-sdk.md removes it.
-      - dependency-name: nixpkgs-opencode

README.md

@@ -1250,10 +1250,13 @@ install dependencies; an untrusted one's reach no network host. npm's registry
 also accepts publishes, so a prompt-injected agent holding someone's npm token
 could publish the checkout there. The agent's file tools stay in the checkout
 (opencode's may also use the private temporary directory, and its read tool
-the output it saved), WebFetch is off, and nothing the checkout configures is
-loaded: not its `.claude` settings, hooks, and MCP servers, nor its
-`opencode.json` and `.opencode` plugins, tools, and MCP servers, and opencode's
-language servers and formatters are off. The CLI itself, Claude Code or
+the output it saved), WebFetch and opencode's web search are off, and nothing
+the checkout configures is loaded: not its `.claude` settings, hooks, and MCP
+servers, nor its `opencode.json` and `.opencode` plugins, tools, and MCP
+servers, and opencode's language servers and formatters are off. An opencode
+job refuses to run if opencode loaded any config besides the runner's and the
+account's, such as a machine's managed `/etc/opencode`, which would outrank
+the runner's. The CLI itself, Claude Code or
 `opencode serve`, runs outside the sandbox and outside the devShell, and its
 commands start from a minimal environment, so its login, the opencode server's
 password, and the kix tools' token stay out of their reach. This is an OS

flake.nix

@@ -3,10 +3,6 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    # Temporary: opencode 1.19.0, matching the @opencode-ai/sdk pin, from the
-    # nixpkgs before opencode 2. /quest/m0/opencode-sdk.md migrates the runner
-    # to opencode 2 and removes this input.
-    nixpkgs-opencode.url = "github:NixOS/nixpkgs/f20cd90e28fe0403873f473b29e42662cd86e8c4";
     flake-utils.url = "github:numtide/flake-utils";
     # A reviewed quest for the dev shell's merge driver, so local merges resolve
     # link lists without running the checkout's own, possibly unreviewed, code.
@@ -23,7 +19,6 @@
     {
       self,
       nixpkgs,
-      nixpkgs-opencode,
       flake-utils,
       quest-pinned,
       ...
@@ -43,7 +38,7 @@
             # Claude Code is unfree; the runner package pins it so adapters run a tested version.
             config.allowUnfreePredicate = pkg: nixpkgs.lib.getName pkg == "claude-code";
           };
-          opencode = nixpkgs-opencode.legacyPackages.${system}.opencode;
+          inherit (pkgs) opencode;
           sandboxRuntime = pkgs.callPackage ./nix/sandbox-runtime.nix { };
           quest = pkgs.callPackage ./nix/package.nix { };
           questPinned = pkgs.callPackage "${quest-pinned}/nix/package.nix" { };
@@ -75,8 +70,8 @@
           manifest = pkgs.lib.importJSON ./package.json;
           # package.json's packageManager pins Bun for CI runners without Nix.
           bunVersion = pkgs.lib.removePrefix "bun@" manifest.packageManager;
-          # The runner drives the pinned opencode through the SDK of the same release.
-          opencodeSdk = manifest.dependencies."@opencode-ai/sdk";
+          # The runner drives the pinned opencode through the client of the same release.
+          opencodeClient = manifest.dependencies."@opencode/client";
         in
         {
           packages = {
@@ -125,9 +120,9 @@
               fi
               touch "$out"
             '';
-            opencode-sdk = pkgs.runCommand "opencode-sdk" { } ''
-              if [ "${opencode.version}" != "${opencodeSdk}" ]; then
-                echo "package.json pins @opencode-ai/sdk ${opencodeSdk}, but the runner pins opencode ${opencode.version}" >&2
+            opencode-client = pkgs.runCommand "opencode-client" { } ''
+              if [ "${opencode.version}" != "${opencodeClient}" ]; then
+                echo "package.json pins @opencode/client ${opencodeClient}, but the runner pins opencode ${opencode.version}" >&2
                 exit 1
               fi
               touch "$out"

package.json

@@ -26,7 +26,7 @@
 		"fix": "prettier --write ."
 	},
 	"dependencies": {
-		"@opencode-ai/sdk": "1.19.0",
+		"@opencode/client": "2.1.1",
 		"commander": "15.0.0",
 		"mdast-util-from-markdown": "2.1.0",
 		"mdast-util-gfm-strikethrough": "2.0.1",

quest/m0/README.md

@@ -105,4 +105,3 @@ ownership-manifest design:
 - [Remote control worktrees](/quest/m0/worktree-routes.md) - live-check `claude remote-control --spawn worktree` against the hooks, from a session spawned on claude.ai
 - [Session checkouts released](/quest/m0/session-checkouts.md) - a Claude session's own checkout is released when the session ends and reclaimed on resume
 - [claude rm upstream report](/quest/m0/claude-rm-upstream.md) - waiting on approval: ask Claude Code to run `WorktreeRemove` instead of advising an unlock
-- [opencode 2.x](/quest/m0/opencode-sdk.md) - the runner drives the opencode 2.x binary through `@opencode/client`, removing the interim 1.19.0 pin

quest/m0/kix/sandbox/README.md

@@ -68,9 +68,12 @@ Shipped in [moq-dev/quest#212](https://github.com/moq-dev/quest/pull/212)
   from source (`nix/sandbox-runtime.nix`), and the runner refuses an opencode
   account when srt lets commands make Unix sockets
   ([moq-dev/quest#465](https://github.com/moq-dev/quest/pull/465)).
-  opencode 1.19 still imports the plugins a checkout's own `opencode.json`
-  or `.opencode/` names, even with project config disabled, so the runner
-  keeps the agent from creating them and refuses a checkout that holds them.
+  Besides disabling project config, the runner keeps the agent from creating
+  a checkout's own `opencode.json` or `.opencode/` and refuses a checkout
+  that holds them. Before each turn it refuses to run if opencode loaded any
+  config but the runner's and the account's, since a machine's managed
+  `/etc/opencode` loads above the runner's and could replace the sandboxed
+  `shell`.
   `test/live/runner-sandbox.test.ts` checks that boundary with the pinned
   opencode and srt and a scripted model. It runs in `just runner-sandbox`
   and a nightly GitHub-hosted workflow (`.github/workflows/sandbox.yml`),

quest/m0/kix/sandbox/opencode-data.md

@@ -78,7 +78,3 @@ Implementation guidance:
 - Extend `test/live/runner-sandbox.test.ts` with a second job, in the same
   repository, that tries to read the first job's saved tool output and shell
   capture.
-
-## Required
-
-- [opencode 2.x](/quest/m0/opencode-sdk.md) - this builds on its client and job plugin