Skip to content

feat(core): gate scheduled prompts with shell checks - #60137

Merged
kitlangton merged 2 commits into
devfrom
schedules-shell-checks
Oct 29, 2026
Merged

kitlangton merged 2 commits into
devfrom
schedules-shell-checks

Conversation

@kitlangton

@kitlangton kitlangton commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

Schedules can now run a shell check before waking a session: wait once with until ("wake me when CI passes") or gate a recurring schedule with if, without spending a model call on quiet polls.
Builds on #59401 and #59457. Everything stays behind experimental.schedules, and plain prompt schedules behave the same.

💡 Why
Waiting on a build, pull request check, or remote branch with a plain repeating schedule spends a full model call on every tick just to learn nothing changed.

🆕 Now you can

  • Wait once for a shell condition with until: { run: "gh pr checks 123" } (when defaults to every 30 seconds, ends.after defaults to 24 hours). If the check already passes at creation, schedule_create finishes immediately with its output instead of queuing a wake.
  • Gate a recurring schedule with if: { run: "...", changes: true } (or is / matches, down to a 15-second interval). Quiet checks record checked and leave ends.times untouched so times counts wakes, not silent polls.
  • Trust unattended execution: schedule_create scans subcommands and external directories up front, prompts at most once (without saving a project-wide grant), rechecks live deny rules on every tick, pauses after 3 failed checks (waking once with the error), and wakes with expired if an until deadline passes without matching.

🚦 How it ships
Off by default behind experimental.schedules, same as #59401 and #59457.

  schedule due
+   -> has `if` or `until`? run shell check with narrow unattended rules (no model call)
+      -> quiet (`wake: false`) -> save state, keep `ends.times`, advance (or wake `expired` at deadline)
+      -> 3 check errors in a row -> pause and wake once with the error
    -> wake -> send idempotent prompt `msg_<schedule>_<run>` with check output appended

📊 Proof: 40 core schedule and tool tests (8 new shell-check suites covering immediate t=0 match, default 30s/24h until, expired deadline wake, changes baseline seeding and wake-only ends.times, is/matches, one-time approval + revoked permission 3-strike pause, Plugin.awaitActivation + missing directory auto-pause, and input validation), 108 permission tests, 41 client tests, and 1 end-to-end server test (including immediate match and 403 on stateless HTTP ask).

↩️ Undo: revert isn't enough on its own once a database runs this build, because migration 20261029061045_schedule_checks adds nullable check and state plus checks and failures columns to schedule. Older builds ignore the extra columns unless experimental.schedules is turned on.

👀 Read: packages/core/src/schedule/check.ts (authorize and runShell) and fire in packages/core/src/schedule.ts. Creation runs without save so approving a check never writes a project-wide allow, and each tick re-evaluates permissions with Permission.Unattended after live deny rules. The rest is routine (schema, OpenAPI, generated client).

Planned feature · no user reports · not measured

Checks run
  • bun run script/test.ts test/schedule.test.ts test/tool-schedule.test.ts test/permission.test.ts (core): 148 pass, 0 fail
  • bun test test/schedule.test.ts (server): 1 pass, 0 fail
  • bun test test/promise.test.ts (client): 41 pass, 0 fail
  • bun typecheck in core, server, protocol and client: 0 errors
  • bun run script/migration.ts --check (core) and bun run check:generated (protocol): pass
  • oxlint, ast-grep Effect patterns on changed files, and bun script/sdk-docs.ts: 0 errors

Added by the opencode bot (AI-generated).

Public API: adds optional if/until to schedule create (makes when optional), adds lastOutput/if/until to Schedule.Info and checked/expired outcomes (additive; clients that match every outcome need the new values)

@opencodejr opencodejr Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shell-gated schedules mostly work as described. The core schedule, tool and permission tests pass (148), the server schedule test passes, and the core type check is clean. One creation-time behaviour should change before merge (see the inline comment): a check whose condition isn't met yet can be rejected at creation, and whether that happens depends on when. I confirmed this with a temporary test using the PR's fake shell.

The tests could also be smaller. The new suites rebuild a large part of the location layer (a fake spawner, Agent, Permission and FileAccess) and add about 340 lines to schedule.test.ts. Cutting them down to the main cases (immediate match, poll then wake, expired deadline, changes baseline, 3-failure pause) would make them easier to maintain.

Public API:

  • HTTP POST schedule and schedule_create: when changes from required to optional. New optional if and until ({ run, is?, matches?, changes? }). Creation can now return 403 when a check needs approval.
  • Schedule.Info: adds if, until and lastOutput.
  • Schedule.Outcome: adds "checked" and "expired".
  • Core: exports Permission.Unattended.
  • Database: migration adds the check, state, checks and failures columns.

These are additions, so existing callers keep working. Two exceptions: clients that switch over every Outcome need the two new values, and TypeScript code that reads Request.when or CreateInput.when must now handle undefined.

),
),
)
const shouldSeed =

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When a check uses is, matches or changes, a non-zero exit counts as a check error. Here, that error at creation makes create fail with InvalidError (line 657). Whether the check runs at creation depends on when, so the same check gives different results. With a command exiting 1 and if: { run, is: "up" }, every: "1 minute" is rejected but a cron is accepted.

The until case hurts most, since its job is to wait for a condition that isn't true yet. For example, until: { run: "curl -sf …", is: "ready" } can't be created while the service is down. Could a failed seed count as "not yet" (like a quiet tick), with creation rejecting only syntax and permission problems? Running the check at creation for if + every without changes doesn't seem needed either.

@opencodejr opencodejr Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new commit fixes the creation problem from my last review. A failed shell check when a schedule is created now counts as "not yet" instead of rejecting it, and if + every no longer runs the check at creation, so every and cron behave the same. Permission and syntax problems are still rejected earlier, during authorization. Core schedule and tool tests pass (40) and the core type check is clean. Nothing new to raise. The public API is unchanged since the last review.

@kitlangton
kitlangton force-pushed the schedules-shell-checks branch from 2f21615 to 64d6f83 Compare October 29, 2026 16:58

@opencodejr opencodejr Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This push is a rebase onto the latest dev: the only difference is that the schedule-checks migration was renamed to 20261029165540_schedule_checks and now comes after session_time_busy. The fix for my earlier point (a failed check at creation counts as "not yet") carries over unchanged. Core schedule, tool and permission tests (148) and the server schedule test pass, and the core type check is clean. Nothing new to raise; the public API is unchanged since the last review.

@kitlangton
kitlangton merged commit c784d17 into dev Oct 29, 2026
20 checks passed
@kitlangton
kitlangton deleted the schedules-shell-checks branch October 29, 2026 17:10
@amrkmn amrkmn mentioned this pull request Oct 30, 2026
1 task
divyanshusingh2903 added a commit to divyanshusingh2903/forge that referenced this pull request Nov 4, 2026
* fix(core): have agents ask before generating an image nobody asked for (anomalyco#60256)

* release: v2.2.1 (anomalyco#60113)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: LukeParkerDev <[email protected]>

* feat(core): turn experimental_image_generate on by default (anomalyco#60258)

* feat(app): open the worktree picker from the new session branch (anomalyco#60263)

* feat(app): redesign the todo pill and share the composer pill styling (anomalyco#59979)

* fix: type the Go and ChatGPT usage limits (anomalyco#57897)

Co-authored-by: Aiden Cline <[email protected]>

* chore(core): use @opencode/pty 0.3.3 (anomalyco#60276)

* fix: show the Go usage limit's reset time, Go page link and a composer tray (anomalyco#60284)

Co-authored-by: Kit Langton <[email protected]>
Co-authored-by: Aiden Cline <[email protected]>

* fix(tui): preserve captured attachments and source paths (anomalyco#60222)

* perf(app): keep each tab's timeline when switching directories (anomalyco#59168)

* fix(tui): prevent truncateMiddle overflow at small widths (anomalyco#60287)

* fix(core): reject persistent terminals with a missing cwd (anomalyco#60300)

* feat(core): gate scheduled prompts with shell checks (anomalyco#60137)

* fix(session-ui): name a pending steer's model only when it changes (anomalyco#59310)

Co-authored-by: vimtor <[email protected]>

* feat: link live system status from site footers (anomalyco#60223)

* feat(go): add Go Teams plan and limits to /go (anomalyco#60308)

* fix(tui): match the empty dialog search cursor to the highlighted row (anomalyco#60310)

* feat(core): integration.connect and integration.use policies (anomalyco#60315)

* fix(core): send execute progress at most every 100 ms (anomalyco#60120)

* fix(core): keep permission reasons and feedback in MCP tool failures (anomalyco#60102)

* release: v2.2.2 (anomalyco#60337)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Aiden Cline <[email protected]>

* fix(app): keep question options and submit controls reachable on mobile (anomalyco#60335)

* fix(tui): resolve default cursor style across config reloads (anomalyco#60302)

* fix(console): polish Go plan cards and audience switch (anomalyco#60345)

* fix(tui): keep # in file search base when not followed by a line range (anomalyco#60336)

* feat(core): add Code Mode checks with static tool scanning to schedules (anomalyco#60140)

* refactor(core): finish moving shell permission checks off tree-sitter (anomalyco#60332)

* fix(core): fail schedule creation when a code check throws and pause invalid checks immediately (anomalyco#60349)

* feat(tui): load stored images by reference, like desktop (anomalyco#60116)

* fix(tui): highlight PHP code blocks without opening tag (anomalyco#60359)

* fix(app): keep inbox scroll position when opening a session (anomalyco#60356)

* chore(console): move console and stats to released solid-start (anomalyco#60077)

* feat(app): add question notifications and sounds (anomalyco#60358)

Co-authored-by: Sayuri Nekomiya <[email protected]>

* fix(core): remove a session's terminals when it is deleted (anomalyco#60322)

* fix(app): preserve command selection under a stationary pointer (anomalyco#60368)

* fix(app): preserve simultaneous request notifications (anomalyco#60378)

* feat(app): allow selecting question answer text (anomalyco#60372)

* chore(release): announce releases in Discord again (anomalyco#60371)

* feat(process-daemon): rename terminals (anomalyco#60324)

* chore(process-daemon): release 0.4.0 (anomalyco#60325)

* feat(app): group added projects in settings (anomalyco#60221)

* refactor(client): share the persistent pty protocol (anomalyco#60323)

* fix(core): check redirects, PowerShell method calls, and dynamic directory changes (anomalyco#60376)

* test(app): mock persistent pty routes (anomalyco#60327)

* fix(console): use default OG image on /go (anomalyco#60397)

Co-authored-by: adamdotdevin <[email protected]>

* fix(core): run dynamic provider npm fallback after external sdk hooks (anomalyco#60380)

* fix(ai): accept typed tools in loop (anomalyco#60390)

* feat(tui): mark the selected composer suggestion under new designs (anomalyco#60393)

Co-authored-by: jlongster <[email protected]>

* feat(ai): type OpenRouter options on the Responses route (anomalyco#60044)

* fix(ai): don't send filename with file_url on Responses (anomalyco#60382)

* fix(app): tidy the Extensions submenus (anomalyco#59468)

* chore(release): require notes for stable releases and remove old changelog tools (anomalyco#60429)

* fix(core): show Code Mode programs the same failure text as direct calls (anomalyco#60109)

* fix(app): ⌘W closes the side panel when nothing in it is left to close (anomalyco#59002)

* fix(app): keep the mobile drawer open while a session loads (anomalyco#59427)

* fix(codemode): preserve null in text encoding (anomalyco#57639)

* fix(app): keep the @ menu's highlight and Enter on current results (anomalyco#59434)

* refactor(ai): one tool() for both clients (anomalyco#60407)

* fix(ai): keep polling queued generations through unknown statuses (anomalyco#59988)

* fix(codemode): copy extension results without trusting their own methods (anomalyco#58031)

* fix(desktop): prevent main bundle require collision (anomalyco#60430)

* fix(app): stabilize side-panel click targets across reactive updates (anomalyco#60436)

* fix(core): preserve plugin-supplied model variants (anomalyco#60097)

* fix(app): give focus back when ⌘W closes the side panel's last New tab (anomalyco#60435)

* fix(app): feather the sidebar list's scroll edges (anomalyco#59467)

* feat(app): page the timeline from the composer (anomalyco#59426)

* fix(cli): allow blob frames and objects in web UI CSP (anomalyco#60453)

* fix(ai): keep tools with a throwing execute runnable (anomalyco#60431)

* fix(app): derive model reasoning capability from variants and compatibility (anomalyco#60457)

* fix(desktop): sign zip data descriptors in debug log export (anomalyco#60456)

* fix(app): match own server loopback port before treating http servers as local (anomalyco#60460)

* feat(desktop): spellcheck toggle and system-language dictionaries (anomalyco#59129)

Co-authored-by: Brendonovich <[email protected]>

* fix(app): insert consecutive dropped file mentions in composer (anomalyco#60463)

* fix(app): render inline content for built-in skills (anomalyco#60464)

* fix(desktop): retain renderer permissions across shared-session windows (anomalyco#60458)

* fix(client): evict missing sessions on 404 instead of retrying or toasting (anomalyco#60459)

* fix(app): keep project avatars on busy session rows (anomalyco#60384)

Co-authored-by: iamdavidhill <[email protected]>

* fix(app): keep sidebar search muted on hover and show its shortcut (anomalyco#60046)

Co-authored-by: iamdavidhill <[email protected]>

* fix(desktop): ship the Icon Composer app icon on macOS (anomalyco#60020)

Co-authored-by: iamdavidhill <[email protected]>

* fix(app): tidy the pairing dialog's layout (anomalyco#59659)

Co-authored-by: iamdavidhill <[email protected]>

* fix(ai): match the Promise client to the Effect API (anomalyco#60465)

* chore(tui): use OpenTUI 0.8.0 (anomalyco#60385)

* feat(app): fit the session header at narrow timeline widths (anomalyco#59512)

Co-authored-by: iamdavidhill <[email protected]>
Co-authored-by: Luke Parker <[email protected]>

* fix(app): match the Context tab's close button to other side panel tabs (anomalyco#59511)

Co-authored-by: iamdavidhill <[email protected]>

* fix(app): remove context tab indicator tooltip (anomalyco#59505)

Co-authored-by: iamdavidhill <[email protected]>
Co-authored-by: Luke Parker <[email protected]>

* fix(app): show the review icon on the files changed tab (anomalyco#58358)

Co-authored-by: iamdavidhill <[email protected]>
Co-authored-by: Luke Parker <[email protected]>

* fix(app): size the agent menu to its options (anomalyco#60026)

Co-authored-by: iamdavidhill <[email protected]>

* fix(app,gui-plugins): port renderer UUID generation to HTTP-safe uuid() (anomalyco#60462)

* fix(app): fade home project list edges on scroll (anomalyco#52358)

* feat(app): copy version from about settings (anomalyco#52356)

* fix(app): tighten tab preview spacing and wrap paths between folders (anomalyco#60467)

* fix(app): never hide every server from Home (anomalyco#60454)

Co-authored-by: Brendonovich <[email protected]>

* feat(ai): keep partial output on errors (anomalyco#60477)

* fix(cli): report usage for steps that end after run goes idle (anomalyco#60475)

* fix(core): keep inner tool progress from replacing execute's call rows (anomalyco#60480)

* fix(app): align queue row action buttons (anomalyco#60485)

* fix(app): stop the ResizeObserver loop error while timeline rows grow (anomalyco#60481)

* fix(session-ui): compare timeline rows without Effect structural hashing (anomalyco#60489)

* refactor(ai): move speech, transcription, video and realtime to experimental (anomalyco#60484)

* fix(app): stop scrolling toward an end that page zoom cannot reach (anomalyco#60488)

* fix(app): make the session details popover match menus (anomalyco#60494)

* fix(desktop): restore maximized windows on their saved display (anomalyco#60482)

* feat(app): split new session project and worktree triggers (anomalyco#60486)

* fix(core): apply webfetch permissions to Code Mode fetch (anomalyco#59954)

* fix(ui): remove select dropdown animation (anomalyco#60499)

* fix(desktop): describe macOS folder access in the app bundle (anomalyco#60503)

* fix(app): keep models with unknown release dates visible (anomalyco#60496)

* fix(app): keep settings nav scroll inside the list (anomalyco#60504)

* feat(core): add Claude Agent provider (anomalyco#58782)

* fix(session-ui): compute highlight styles once per subtree in Chromium (anomalyco#60513)

* docs(go): raise DeepSeek V4.1 Flash limits to $100/$200/$105 (anomalyco#60515)

Co-authored-by: MrMushrooooom <[email protected]>

* docs(go): revert DeepSeek V4.1 Flash limits to $80/$160/$85 (anomalyco#60532)

Co-authored-by: MrMushrooooom <[email protected]>

* fix(ui): watch the toast portal instead of the whole page (anomalyco#60537)

* fix(session-ui): relabel code copy buttons only when the language changes (anomalyco#60538)

* fix(app): stop :has() rules restyling every ancestor on DOM insertion (anomalyco#60521)

* fix(session-ui): send and render only the markdown blocks a delta changed (anomalyco#60562)

* fix(session-ui): allocate less per streamed markdown delta (anomalyco#60549)

* release: v2.2.3 (anomalyco#60564)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* fix(tui): span vertical session tab pulse across full tab width (anomalyco#60338)

* test(tui): drop PHP highlighting test (anomalyco#60408)

* fix(app): simplify the session location popover (anomalyco#60492)

* fix(session-ui): stop re-checking the timeline projection on every streamed delta (anomalyco#60577)

* fix(session-ui): copy user messages from the actions menu (anomalyco#60576)

* fix(core): drop Claude Code's /login hint from login errors (anomalyco#60592)

* feat(app): guide Claude Agent setup before connecting (anomalyco#60603)

* feat(app): add base branch picker shortcut (anomalyco#60579)

* feat(core): add experimental artifacts with pluggable providers (anomalyco#60351)

* feat(core): rename persistent terminals (anomalyco#60329)

* fix(tui): add right padding to edit and patch diffs (anomalyco#60614)

Co-authored-by: Tarquinen <[email protected]>

* fix(app): list commands above sessions in command palette search (anomalyco#60616)

Co-authored-by: jlongster <[email protected]>

* fix(tui): keep plugin-set prompt cursor styles (anomalyco#60599)

Co-authored-by: Tarquinen <[email protected]>

* chore(core): use @opencode/pty 0.4.0 (anomalyco#60387)

* feat(core,server): enable schedules by default and run loop in opencode serve (anomalyco#60478)

* docs(go): raise DeepSeek V4.1 Flash limits to $100/$200/$105 (anomalyco#60625)

Co-authored-by: MrMushrooooom <[email protected]>

* refactor(ai): one ai object for Promise and Effect (anomalyco#60516)

* chore(release): leave AI package changes out of the changelog (anomalyco#60631)

* Update CHANGELOG.md to remove breaking changes

Removed breaking changes section regarding `@opencode/ai` and updated the changelog with new features and fixes.

* Update CHANGELOG with new features and breaking changes

Added breaking changes section and updated features.

* refactor(core): store background job markers in a SQLite job table (anomalyco#60491)

* feat(app): move the desktop terminal to persistent PTYs (anomalyco#60346)

* fix(cli): keep loopback requests off environment proxies (anomalyco#60441)

Co-authored-by: r266-tech <[email protected]>
Co-authored-by: pj.reid <[email protected]>

* fix(core): allow local config to override Console-supplied providers

Reverts the lock from anomalyco#60315 that ignored user, project and remote overrides on providers the Console supplies. It also blocked harmless overrides such as model limits, names and variants (anomalyco#60597) and internal gateways.

* fix(app): keep terminal tab clicks and renames on the right tab (anomalyco#60645)

* chore: update nix node_modules hashes (anomalyco#60187)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* fix(core): keep schedules off unless experimental.schedules is enabled

Restores the opt-in default from before anomalyco#60478. The schedule loop still runs in every server process and keeps its leader election; it only fires schedules in locations that enable the flag.

* feat(ui): add flat input surfaces and compact sizing (anomalyco#60598)

* fix(app): add top inset to recently closed menu search (anomalyco#60652)

* fix(core): cap compaction's prompt size at the context window (anomalyco#60660)

* release: v2.2.4 (anomalyco#60664)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* fix(ai): stop demoting unsigned and interrupted reasoning to text (anomalyco#60498)

* feat(core): accept a percentage for compaction.buffer (anomalyco#60647)

* fix(app,tui): hide MCP integrations from the connect menu (anomalyco#60675)

* fix(core): keep MCP quiet while a location shuts down (anomalyco#60668)

* feat(app): send quotes directly from the comment popup (anomalyco#60640)

* fix(core): run calls to a bash tool as shell (anomalyco#60687)

* fix(stats): scroll dense charts to latest data in Safari (anomalyco#57459)

* fix(core): show the closest lines when edit misses oldString (anomalyco#60689)

* fix(ci): fail desktop publish when an R2 upload fails (anomalyco#60696)

* fix(core): say which folder is missing when read misses (anomalyco#60688)

* fix(ai): recognize LiteLLM context overflow errors (anomalyco#60692)

* fix(core): frame MCP stdio messages without the SDK read buffer (anomalyco#60694)

* feat(app): add worktree picker shortcuts and toggle shell mode (anomalyco#60713)

* chore: refresh docs and provider ordering (anomalyco#60731)

* release: v2.2.5

* refactor(tui): drop the full-screen TUI and keep only what cli imports

Forge's interface is the desktop app, and the opencode binary only hosts its
server. packages/tui keeps the modules cli still imports (config, mini, form,
plugin discovery, editor, model preference, spinner, logo) as an internal
library and loses its root entry. The default command now prints a pointer to
the desktop app, `opencode mini` and `opencode run`.

Removes the TUI dev harness, update preflight, the dev:vite scripts, and the
tests for deleted files.

* chore(desktop): rebrand to Forge and port the release setup

Names, app IDs (io.github.divyanshusingh2903.forge), the forge:// scheme,
window and app titles, desktop icons, the macOS Icon Composer art, favicons,
the terracotta accent, and the FORGE wordmark (home, splash, About, connect).
Publishing points at the Forge GitHub releases. Adds forge.json, the
forge-release workflow (builds the server for each target, then the app),
the version and update-manifest scripts, NOTICE and a README that lists what
is not ported yet.

Removes the OpenCode-shaped lodger, pin board and brick breaker on the home
screen, and the legacy OpenCode Linux launcher.

* feat(desktop): draw Linux window controls on the tab bar

Linux hides the native title bar and uses Electron's title bar overlay, as
Windows does, so minimize, maximize and close sit on the same bar as the tabs.
The tab bar, top inset, header drag areas and splash follow the Windows overlay
sizing, and the overlay refreshes with zoom and theme changes.

* feat(app): add persistent projects sidebar with pinned and collapsible sessions

A resizable, collapsible Projects sidebar in the shell for the horizontal-tabs
layout on every route. Each project lists its sessions (remembered open or
closed, eight at a time), sessions can be pinned into a Pinned section that
shows each session's project icon, and only the session on screen is
highlighted. Home drops its own Projects column while the sidebar is showing.
Adds the pin icons, English strings, and a per-project session index on the
Home sessions controller.

* feat(app): give the projects sidebar its own open setting

The top-tabs Projects sidebar had shared the side-tabs sidebar's open state,
so hiding one hid the other after a layout switch. It now saves projectRailOpen
separately, and the sidebar toggle acts on whichever sidebar the layout has.

* chore(app): use the Forge name in app strings

Replaces OpenCode with Forge where the text names the app: settings
descriptions, the About page and its website link, project and workspace
hints, error and pairing messages, and the voice assistant label, in every
locale. OpenCode's own services (Go, Console, Free), the opencode command and
file names, and the trademark attribution keep their names.

* feat(app): float the hidden Projects sidebar on hover

Resting on the window's start edge or the show button peeks the hidden rail over the content, reusing the vertical-tabs sidebar peek. Its header button docks it, and leaving it hides it again.

* feat(core): add permission modes and Plan mode

Sessions carry a Forge permission mode (Manual, Accept edits, Auto) in their
metadata, applied by a permission hook that only ever turns asks into allows.

Plan mode replaces upstream's Plan agent with Forge's v1 workflow: the plan
agent may edit only plan files under .opencode/plans, follows the v1 plan
prompt and format, and presents the plan with present_plan. Accepting switches
to Build in the chosen mode; revising carries the user's feedback. Build can
suggest Plan with plan_enter, and a prompt that asks for a plan is nudged to it.

* feat(app): add mode picker, plan dock and plan review tab

The composer's agent picker becomes one mode list (Manual, Accept edits, Auto,
Plan) that Mod+. cycles, and the auto-approve setting picks a new session's
starting mode.

A Plan tab in the side region shows the plan file live with a section outline,
opens when a plan is presented, and lets the user quote parts of it. The plan
dock answers plan forms with numbered shortcuts; quotes and their comments join
a revision. Plan files stay out of Review changes, and the session header shows
while a plan is being written or reviewed.

* feat(app): add built-in MCPs with their own header button

Ship GitHub, GitLab, Linear, Notion, Sentry and Jira as built-in remote
MCPs with brand icons, a dedicated MCP button next to the context icon in
the session header, and an MCPs settings tab. GitHub signs in with an
access token sent as a Bearer header or a pre-registered OAuth app, since
it has no dynamic client registration. MCP on/off choices are saved and
apply in every project, open session and after restarts.

* feat(app): show hover cards for issue and PR links

Add a link preview endpoint on v2 core and server that resolves GitHub,
GitLab, Linear and Jira issues, PRs, merge requests, releases and projects
through the gh and glab CLIs or the connected MCPs, and show a hover card
with state, author and activity for those links in session messages.

* feat(app): sign in to the GitHub MCP with the GitHub CLI

Add a GitHub CLI sign-in method to the GitHub MCP that reuses the token
from `gh auth token`, or runs `gh auth login --web` first and shows its
one-time code in the sign-in dialog. The new tab is the dialog's default;
the access token and OAuth app options remain.

* feat(app): add launcher buttons to the session header

Show Review, Browser and Terminal as icon buttons in the session header
through a new `header` flag on side region launchers, rename the plan
button to Review Plan, and show context usage against the model's
window, e.g. 20K / 200K.

* feat(app): add session options menu to sidebar sessions

Give sidebar sessions a three-dots menu with Rename, Export and Delete,
shared with the session title menu. While either menu is open, R, E and
D choose an item directly, and each item shows its letter. Rename edits
the sidebar title in place.

* fix(core): use the GitHub MCP token for GitHub link previews

Pass the GitHub MCP's saved access token to `gh api` as GH_TOKEN, so
previews work where gh has no login of its own, such as under a separate
XDG config directory. Report a CLI that is not signed in as unavailable
rather than forbidden, so the preview retries after sign-in.

* fix(core): show GitLab issue previews through the GitLab MCP

Recognise GitLab's /-/work_items/N issue links, and resolve GitLab issues
and merge requests through the connected GitLab MCP's get_work_item and
get_merge_request tools, falling back to glab. Map work items' uppercase
states, camelCase dates and label widgets onto the preview card.

* feat(app): show hover cards for Notion links

* feat(app): add git staging, commit and remote actions to the review panel

- Add a core GitActions service and /api/git routes for state, stage, unstage,
  discard, commit, generated commit messages, fetch, push, pull and stashes,
  ported from v1
- Watch the index, refs, config and working tree and send git.changed so the
  panel follows changes made outside Forge
- Show changes as a compact tree with staging checkboxes on files and folders
  in every mode, scoped to the listed files outside Uncommitted
- Port v1's remote and stash dialogs and git translations
- Count unpushed commits on branches without an upstream and offer
  Push and set upstream
- Add the outline split button variant from v1

* feat(app): lead the session header with context usage

* fix(desktop): show Forge name and icon in notifications

* feat(app): expand every timeline action by default

Default the timeline to the Everything preset. A Compact preset saved before this default is read once as unchosen, since v2 saved its defaults with any other setting change; a later Compact choice stays.

* feat(app): show the Forge mark while a session loads

Keep the startup splash's mark over the timeline until history loads and a cold timeline reveals its rows, then fade it out.

* feat(core): add local auto memory

Port Forge's v1 local memory onto v2. Each repository gets a memory folder
under the data directory, keyed by the Git common directory so worktrees share
it. Its guidance and bounded MEMORY.md index load as the forge/memory
Instruction Source, so a saved note reaches the session as an instructions
update. The forge.memory plugin approves the folder for every agent and keeps
subagents read-only. `memory: false` turns it off and keeps existing notes.

* feat(app): break down context usage by part

Add a session.usage endpoint that describes the next model request: the
system prompt, tools, MCP and Code Mode tools, skills, instruction files,
memory and messages, each estimated from its text and scaled to the
provider's latest count, plus the input window and the auto-compact
threshold. The Context tab shows it as a colour-coded bar and legend with
the auto-compact buffer and free space, above OpenCode's existing stats.
The System Prompt section now shows the assembled prompt part by part
instead of the last instruction update.

* fix(app): keep the thinking level picker visible

* feat(app): show question dock shortcuts on its buttons

* docs: update maintaining, agents and contributing guides for v2

* feat(session-ui): show web search results as cards and direct tool responses

* feat(core): let tools describe their Code Mode call rows

* feat(app): show browser actions and screenshots readably in the timeline

* fix(app): retire the app-side auto-approver

The client answered every permission request itself while the auto-approve
setting was on, whatever mode the session was in, and hid the approval cards.
Modes already settle requests on the server, so the setting now only picks the
mode new sessions start in, and Mod+Shift+A switches the current session
between Auto and Manual.

* fix(desktop): update ad-hoc macOS builds from the release page

Squirrel.Mac rejects updates for builds without a Developer ID signature, so
those builds now report a download and open the latest release instead. The
update check sends a Forge user agent, and What's New no longer reads
OpenCode's changelog.

* fix(core): ask before shell commands and file edits by default

Upstream agents allow every action, so Manual mode had nothing to ask about.
The asks follow each agent's base allow-all rule, so agent rules and config
still override them.

* feat(app): ask before browser actions outside Auto mode

Each browser call now checks permission when it runs, with its operation as
the resource. Attaching the pane allows reads and asks for everything that
acts, and drops the allow-all grant earlier versions left behind. Approval
cards and timeline rows name the element, URL or tab a call works on.

* feat(app): number the permission dock's choices

* fix(app): show the Forge mark while a session opens

* fix(desktop): stamp release builds with the full Forge version

The update manifests carry v<opencode>-v<forge>, but the app took only the
OpenCode half, so every install would read the latest release as a different
version. v1 stamped the full version the same way.

* ci: run checks on GitHub-hosted runners for main, including macOS

* ci: run e2e tests on macOS

* fix: repair unit tests that broke in CI

* style: add the blank lines the anti-slop lint asks for

* ci: add macOS e2e summary job and drop the TUI simulation build check

* test(app): align e2e specs with Forge's timeline, project rail and mocks

* test(sdk): run the lazy-provisioning shell test in Auto mode

* test(app): expect the thinking picker to stay visible

* test(core): count the GitActions repository probe in the boot git-spawn budget

* test(core): expect Forge's plan tools in the Location tool list

* test(core): keep Forge's memory guidance out of the recorded runner prompt

* test(core): compare git-actions file contents with normalized line endings

* test(server): create the schedule test session in Auto mode

* test(app): point the branding specs at Forge's title, site link and changelog

* test(app): update composer specs for /agent and the always-visible thinking picker

* test(app): open MCPs from Forge's header button and settings tab

* test(app): drop MCP from the mobile details drawer specs

* test(app): move MCP expectations from the details menu to the header popover

* test(app): fit the session header spec to Forge's menu keys and breakpoints

* test(app): find review changes by Forge's staging rows and mirror the diff in git state

* test(app): expect Forge's context usage text and header width

* test(app): fit settings search specs to the MCPs page and the narrower empty state

* test(app): move the settings MCP specs to the MCPs page and clear the rail's resize handle

* test(app): widen the nested-session header test for Forge's header

* ci: install the pinned ripgrep for the Linux and macOS unit tests

* test(app): drop the focus-into-list steps the Skills list can't take

* test(core): keep Forge's memory guidance out of the session runner prompts

* chore: clear the anti-slop lint findings in Forge's changed files

* ci: lint v2-port's changes against the upstream release it was ported from

* chore(protocol): regenerate the OpenAPI document

* fix(core): keep the plan file path slash-separated on Windows

* ci: install the pinned ripgrep on Windows too

* test(app): retry Escape until the MCP popover closes in the RTL spec

* test(core): expect the plan file's native absolute path in the reminder

* test(app): give the large review list time to render on slow runners

* test(app): give the all-locales dictionary check time on slow Windows runners

* test(server): give the artifacts API test time on slow Windows runners

* ci: give macOS a current bash and fewer e2e workers

* test(cli): wait longer for a managed service on slow runners

* test(cli): give the upgrade help test room on slow runners

* test(app): press and expect the platform modifier in e2e specs

* test(app): use the literal Control binding where the app has no mod shortcut

* test(app): press the literal Control bindings for tab cycling and new terminal

* test(server): give the VCS 503 test room to boot the location on slow runners

* test(app): use macOS shortcuts for document edges, file browser and zoom in e2e

* test(app): scroll regions with Home and End on macOS in touch-scroll e2e

* test: give SDK bundling room on macOS and skip the missing Ctrl+Home check there

* test(server): give slow location and OAuth fallback tests room on macOS

---------

Co-authored-by: Aiden Cline <[email protected]>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: LukeParkerDev <[email protected]>
Co-authored-by: Dax <[email protected]>
Co-authored-by: Aarav Sareen <[email protected]>
Co-authored-by: Kit Langton <[email protected]>
Co-authored-by: Aiden Cline <[email protected]>
Co-authored-by: James Long <[email protected]>
Co-authored-by: OpeOginni <[email protected]>
Co-authored-by: Filip <[email protected]>
Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
Co-authored-by: vimtor <[email protected]>
Co-authored-by: Adam <[email protected]>
Co-authored-by: David Hill <[email protected]>
Co-authored-by: usrnk1 <[email protected]>
Co-authored-by: Sayuri Nekomiya <[email protected]>
Co-authored-by: adamdotdevin <[email protected]>
Co-authored-by: jlongster <[email protected]>
Co-authored-by: xjh <[email protected]>
Co-authored-by: Brendonovich <[email protected]>
Co-authored-by: iamdavidhill <[email protected]>
Co-authored-by: Simon Klee <[email protected]>
Co-authored-by: frank <[email protected]>
Co-authored-by: DS <[email protected]>
Co-authored-by: MrMushrooooom <[email protected]>
Co-authored-by: Tarquinen <[email protected]>
Co-authored-by: r266-tech <[email protected]>
Co-authored-by: pj.reid <[email protected]>
Co-authored-by: Dax Raad <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant