sync: upstream v1.14.39 (773078e81 on dev)#37
Merged
Alezander9 merged 179 commits intomainfrom May 6, 2026
Merged
Conversation
…prompts Agents can now create temporary files in the global tmp directory without triggering external_directory permission prompts. This enables agents to freely use temporary storage for intermediate files during builds and other operations.
… without installed packages (#25354)
…ovider (#21114) Co-authored-by: Aiden Cline <aidenpcline@gmail.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
6 issues found across 853 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="packages/desktop/scripts/copy-bundles.ts">
<violation number="1" location="packages/desktop/scripts/copy-bundles.ts:12">
P1: The copy command recursively includes the destination directory (`dist/bundles`) in its own source glob, which can make the script fail with a self-copy error.</violation>
</file>
<file name="packages/console/app/src/routes/zen/util/provider/openai.ts">
<violation number="1" location="packages/console/app/src/routes/zen/util/provider/openai.ts:21">
P2: OpenAI request body no longer includes `safety_identifier`, so workspace identity is dropped for safety attribution.</violation>
</file>
<file name="packages/app/src/pages/session/terminal-panel.tsx">
<violation number="1" location="packages/app/src/pages/session/terminal-panel.tsx:152">
P1: Recovery can get permanently disabled after one failed clone attempt because the `recovered` flag is never cleared on clone failure.</violation>
</file>
<file name="packages/opencode/migration/20260427172553_slow_nightmare/migration.sql">
<violation number="1" location="packages/opencode/migration/20260427172553_slow_nightmare/migration.sql:17">
P1: This migration drops `session_entry` without copying existing rows into `session_message`, causing data loss for all existing session messages.</violation>
</file>
<file name="packages/console/app/src/routes/zen/util/handler.ts">
<violation number="1" location="packages/console/app/src/routes/zen/util/handler.ts:160">
P1: Missing null guard before recursive call — `typeof null === "object"` is true in JS, so a `null` value in `payloadModifier` will crash with `TypeError: Cannot convert undefined or null to object` when `Object.entries(null)` is called.</violation>
<violation number="2" location="packages/console/app/src/routes/zen/util/handler.ts:926">
P2: `cacheWrite1hCost` is missing from the new microcents metrics. The deprecated metrics track both `cache_write_5m` and `cache_write_1h` separately, but the new `"cost.cache_write.microcents"` only reports the 5m cost. If `cacheWrite1hCost` is nonzero while `cacheWrite5mCost` is zero/undefined, this metric will show `undefined` instead of the actual cache write cost.</violation>
</file>
Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.
On a pro plan you can use ultrareview for larger PRs.
Fix all with cubic.
|
|
||
| await $`mkdir -p ${BUNDLES_OUT_DIR}` | ||
| await $`cp -r ${BUNDLE_DIR}/*/OpenCode* ${BUNDLES_OUT_DIR}` | ||
| await $`cp -r ${BUNDLE_DIR}/* ${BUNDLES_OUT_DIR}` |
There was a problem hiding this comment.
P1: The copy command recursively includes the destination directory (dist/bundles) in its own source glob, which can make the script fail with a self-copy error.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop/scripts/copy-bundles.ts, line 12:
<comment>The copy command recursively includes the destination directory (`dist/bundles`) in its own source glob, which can make the script fail with a self-copy error.</comment>
<file context>
@@ -5,8 +5,8 @@ import { RUST_TARGET } from "./utils"
await $`mkdir -p ${BUNDLES_OUT_DIR}`
-await $`cp -r ${BUNDLE_DIR}/*/OpenCode* ${BUNDLES_OUT_DIR}`
+await $`cp -r ${BUNDLE_DIR}/* ${BUNDLES_OUT_DIR}`
</file context>
| const recoverTerminal = (key: string, id: string, clone: (id: string) => Promise<void>) => { | ||
| if (store.recovered[key]) return | ||
| setStore("recovered", key, true) | ||
| void clone(id) |
There was a problem hiding this comment.
P1: Recovery can get permanently disabled after one failed clone attempt because the recovered flag is never cleared on clone failure.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/app/src/pages/session/terminal-panel.tsx, line 152:
<comment>Recovery can get permanently disabled after one failed clone attempt because the `recovered` flag is never cleared on clone failure.</comment>
<file context>
@@ -145,6 +146,21 @@ export function TerminalPanel() {
+ const recoverTerminal = (key: string, id: string, clone: (id: string) => Promise<void>) => {
+ if (store.recovered[key]) return
+ setStore("recovered", key, true)
+ void clone(id)
+ }
+
</file context>
Suggested change
| void clone(id) | |
| void clone(id).finally(() => setStore("recovered", key, false)) |
| CREATE INDEX `session_message_session_idx` ON `session_message` (`session_id`);--> statement-breakpoint | ||
| CREATE INDEX `session_message_session_type_idx` ON `session_message` (`session_id`,`type`);--> statement-breakpoint | ||
| CREATE INDEX `session_message_time_created_idx` ON `session_message` (`time_created`);--> statement-breakpoint | ||
| DROP TABLE `session_entry`; |
There was a problem hiding this comment.
P1: This migration drops session_entry without copying existing rows into session_message, causing data loss for all existing session messages.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/opencode/migration/20260427172553_slow_nightmare/migration.sql, line 17:
<comment>This migration drops `session_entry` without copying existing rows into `session_message`, causing data loss for all existing session messages.</comment>
<file context>
@@ -0,0 +1,17 @@
+CREATE INDEX `session_message_session_idx` ON `session_message` (`session_id`);--> statement-breakpoint
+CREATE INDEX `session_message_session_type_idx` ON `session_message` (`session_id`,`type`);--> statement-breakpoint
+CREATE INDEX `session_message_time_created_idx` ON `session_message` (`time_created`);--> statement-breakpoint
+DROP TABLE `session_entry`;
\ No newline at end of file
</file context>
| Object.fromEntries( | ||
| Object.entries(obj).flatMap(([k, v]) => { | ||
| if (Array.isArray(v)) return [[k, v]] | ||
| if (typeof v === "object") return [[k, replacer(v)]] |
There was a problem hiding this comment.
P1: Missing null guard before recursive call — typeof null === "object" is true in JS, so a null value in payloadModifier will crash with TypeError: Cannot convert undefined or null to object when Object.entries(null) is called.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/console/app/src/routes/zen/util/handler.ts, line 160:
<comment>Missing null guard before recursive call — `typeof null === "object"` is true in JS, so a `null` value in `payloadModifier` will crash with `TypeError: Cannot convert undefined or null to object` when `Object.entries(null)` is called.</comment>
<file context>
@@ -141,20 +141,36 @@ export async function handler(
+ Object.fromEntries(
+ Object.entries(obj).flatMap(([k, v]) => {
+ if (Array.isArray(v)) return [[k, v]]
+ if (typeof v === "object") return [[k, replacer(v)]]
+ if (typeof v === "string") {
+ if (v === "$ip") return [[k, ip]]
</file context>
Suggested change
| if (typeof v === "object") return [[k, replacer(v)]] | |
| if (v != null && typeof v === "object") return [[k, replacer(v)]] |
| ...body, | ||
| ...(workspaceID ? { safety_identifier: workspaceID } : {}), | ||
| }), | ||
| modifyBody: (body: Record<string, any>) => body, |
There was a problem hiding this comment.
P2: OpenAI request body no longer includes safety_identifier, so workspace identity is dropped for safety attribution.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/console/app/src/routes/zen/util/provider/openai.ts, line 21:
<comment>OpenAI request body no longer includes `safety_identifier`, so workspace identity is dropped for safety attribution.</comment>
<file context>
@@ -18,10 +18,7 @@ export const openaiHelper: ProviderHelper = ({ workspaceID }) => ({
- ...body,
- ...(workspaceID ? { safety_identifier: workspaceID } : {}),
- }),
+ modifyBody: (body: Record<string, any>) => body,
createBinaryStreamDecoder: () => undefined,
streamSeparator: "\n\n",
</file context>
Suggested change
| modifyBody: (body: Record<string, any>) => body, | |
| modifyBody: (body: Record<string, any>) => ({ | |
| ...body, | |
| ...(workspaceID ? { safety_identifier: workspaceID } : {}), | |
| }), |
| "cost.output.microcents": centsToMicroCents(outputCost), | ||
| "cost.reasoning.microcents": reasoningCost ? centsToMicroCents(reasoningCost) : undefined, | ||
| "cost.cache_read.microcents": cacheReadCost ? centsToMicroCents(cacheReadCost) : undefined, | ||
| "cost.cache_write.microcents": cacheWrite5mCost ? centsToMicroCents(cacheWrite5mCost) : undefined, |
There was a problem hiding this comment.
P2: cacheWrite1hCost is missing from the new microcents metrics. The deprecated metrics track both cache_write_5m and cache_write_1h separately, but the new "cost.cache_write.microcents" only reports the 5m cost. If cacheWrite1hCost is nonzero while cacheWrite5mCost is zero/undefined, this metric will show undefined instead of the actual cache write cost.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/console/app/src/routes/zen/util/handler.ts, line 926:
<comment>`cacheWrite1hCost` is missing from the new microcents metrics. The deprecated metrics track both `cache_write_5m` and `cache_write_1h` separately, but the new `"cost.cache_write.microcents"` only reports the 5m cost. If `cacheWrite1hCost` is nonzero while `cacheWrite5mCost` is zero/undefined, this metric will show `undefined` instead of the actual cache write cost.</comment>
<file context>
@@ -904,6 +919,13 @@ export async function handler(
+ "cost.output.microcents": centsToMicroCents(outputCost),
+ "cost.reasoning.microcents": reasoningCost ? centsToMicroCents(reasoningCost) : undefined,
+ "cost.cache_read.microcents": cacheReadCost ? centsToMicroCents(cacheReadCost) : undefined,
+ "cost.cache_write.microcents": cacheWrite5mCost ? centsToMicroCents(cacheWrite5mCost) : undefined,
+ "cost.total.microcents": centsToMicroCents(totalCostInCent),
+ // deprecated - remove after May 20, 2026
</file context>
Suggested change
| "cost.cache_write.microcents": cacheWrite5mCost ? centsToMicroCents(cacheWrite5mCost) : undefined, | |
| "cost.cache_write_5m.microcents": cacheWrite5mCost ? centsToMicroCents(cacheWrite5mCost) : undefined, | |
| "cost.cache_write_1h.microcents": cacheWrite1hCost ? centsToMicroCents(cacheWrite1hCost) : undefined, |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings
anomalyco/opencodeup to v1.14.39 (773078e81ondev). 178 upstream commits since21f8027ef.Conflicts resolved
.github/workflows/publish.ymlbun.lockgit checkout --theirs, regenerated viabun installREADME.mdpackages/opencode/package.json@browser-use/browsercode-core, took upstream version1.14.39packages/opencode/src/cli/cmd/agent.tsInstance.worktree→ctx.worktree,AppRuntime.runPromise(Agent.Service.use(...))→Effect.runPromise(agentSvc.generate(...))); flipped post-merge.opencode→.bcode(one site)packages/opencode/src/cli/cmd/{run,serve,web}.tsEffect.fn("Cli.<name>")(function* (args) {...})handler shape +instance: false/directory:fields; kept ourbcodebrand strings indescribe:packages/opencode/src/cli/cmd/tui/routes/session/index.tsxShellTool+ShellIDimports (PR #20039 renamedtool/bash.{ts,txt}→tool/shell.{ts,txt}); kept ourBrowserExecuteToolimport. Auto-merge handled the<Match>/<Shell>rewriteVerification
bun install: cleanbun run typecheck: 5/5 passed in 13.8sYellow-zone audit
Upstream touched 9 Yellow-zone files in this window:
packages/core/src/global.ts—app = "bcode"preservedpackages/opencode/script/build.ts—bcode-<target>asset naming preservedpackages/opencode/src/cli/cmd/tui/app.tsx—BrowserCodetitle +BC | <session>prefix preservedpackages/opencode/src/cli/cmd/tui/routes/session/index.tsx—BrowserExecuterenderer preservedpackages/opencode/src/config/config.ts—bcode.json/bcode.jsonc/.bcode/,bcode.shschema URLs preservedpackages/opencode/src/plugin/index.ts— internal-plugins list intact (LaminarPlugin not yet onmain, no regression)packages/opencode/src/provider/provider.ts— attribution headershttps://bcode.sh/,X-Title: bcode,X-Source: bcodepreservedpackages/opencode/src/session/session.ts—.bcode/plansrename preservedpackages/opencode/src/storage/db.ts—bcode.dbfilename preservedAll customizations verified post-merge.
Notable upstream changes pulled in
bashtool renamed toshellwith shell-aware prompts (bash, pwsh+powershell, cmd). New sub-packagetool/shell/{id,prompt}.ts. Match predicate moves from string literal"bash"toShellID.ToolID.cli/cmd/{run,serve,web,agent}.tsswitch fromasync (args) => {...}toEffect.fn(...)handlers; framework-managed instance/directory loading via newinstance:anddirectory:fields.desktop-electron→desktop). Not a package we ship.@opencode-ai/core.git log 21f8027ef..773078e81 --onelinefor the full list.Workflow re-deletions
All 30 inherited workflows re-deleted per
opencode-sync.mdstep 3a. Final state:release.yml+typecheck.yml.