sync: upstream v1.14.31 (21f8027 on dev)

212 upstream commits across v1.14.27-v1.14.31. Brings the fork up to the
latest release point on upstream/dev as of 2026-05-01.

Conflicts:
- .github/workflows/{deploy,publish}.yml: kept our deletions (PR #14).
- bun.lock: regenerated via bun install.
- packages/opencode/package.json: kept @browser-use/browsercode-core name,
  bumped to 1.14.31.
- packages/opencode/src/agent/agent.ts: kept our browser-sessions whitelist,
  took upstream's new Global.Path.tmp whitelist addition.
- packages/opencode/src/config/config.ts: kept bcode.json/bcode.jsonc filenames
  + bcode.sh schema URL; adopted upstream's mergeConfig helper pattern,
  retiring the mergeDeep(pipe(...)) chain.
- packages/opencode/src/session/session.ts: kept .bcode/plans path; adopted
  upstream's new plan(input, instance: InstanceContext) signature.
- packages/opencode/src/installation/index.ts: substantial upstream restructure
  (Service.of({...}) -> result: Interface = {...} with self-referential method
  calls). Took upstream verbatim as base, re-applied 5 BrowserCode divergences:
  USER_AGENT prefix, https://bcode.sh/install URL, .bcode/bin execPath check,
  BCODE_UPGRADE_DISABLED const, early-return guards in latest/upgrade.

Yellow-zone audit (7 files touched by upstream): customizations preserved.

Verification: bun install clean, bun run typecheck 5/5 passed in 7s.

Author: bcode

.github/VOUCHED.td

@@ -12,9 +12,13 @@ adamdotdevin
 ariane-emory
 -atharvau AI review spamming literally every PR
 -borealbytes
+-carycooper777
 -danieljoshuanazareth
 -danieljoshuanazareth
+-davidbernat looks to be a clawdbot that spams team and sends super weird emails, doesnt appear to be a real person
+dmtrkovalenko
 edemaine
+fahreddinozcan
 -florianleibert
 fwang
 iamdavidhill
@@ -31,6 +35,6 @@ rubdos
 shantur
 simonklee
 -spider-yamet clawdbot/llm psychosis, spam pinging the team
+-terisuke
 thdxr
 -toastythebot
--davidbernat looks to be a clawdbot that spams team and sends super weird emails, doesnt appear to be a real person

.opencode/skills/effect/SKILL.md

@@ -28,3 +28,11 @@ Use the current Effect v4 / effect-smol source, not memory or older Effect v2/v3
 - In tests, prefer the repo's existing Effect test helpers and live tests for filesystem, git, child process, locks, or timing behavior.
 - Do not introduce `any`, non-null assertions, unchecked casts, or older Effect APIs just to satisfy types.
 - Do not answer from memory. Verify against `.opencode/references/effect-smol` or nearby code first.
+
+## Testing Patterns
+
+- Use `testEffect(...)` from `packages/opencode/test/lib/effect.ts` for tests that exercise Effect services, layers, runtime context, scoped resources, or platform integrations.
+- Use `it.live(...)` for filesystem, git repositories, HTTP servers, sockets, child processes, locks, real time, and other live platform behavior.
+- Run tests from package directories such as `packages/opencode`; never run package tests from the repo root.
+- Prefer explicit test layers over ad hoc managed runtimes. Keep dependency provisioning visible in the test file.
+- Use scoped fixtures and finalizers for resources that must be cleaned up, including temporary directories, flags, databases, fibers, servers, and global state.

UPSTREAM.md

@@ -74,6 +74,8 @@ Each upstream has its own append-only table. Add a row every time you pull.
 | 2026-04-20 | — (initial) | `3e8abac6` | user | Mirror push after fork creation. Tagged `baseline/pre-rename`. |
 | 2026-04-23 | `3e8abac6` | `eb7555d3c` | bcode | Merged upstream release point for v1.14.22 (`sync release versions for v1.14.22` on `dev`). Conflicts: `packages/opencode/package.json` (kept `@browser-use/browsercode-core`, took version bump to 1.14.22), `bun.lock` (took upstream, regenerated via `bun install`). No Yellow-zone files touched by upstream in this window. |
 | 2026-05-01 | `eb7555d3c` | `bad732c26` | bcode | Merged upstream release point for v1.14.25 (`sync release versions for v1.14.25` on `dev`). 73 upstream commits. **Targeted v1.14.25 instead of latest (v1.14.31, 357 commits)** because v1.14.26 introduces a sweeping refactor — `packages/shared` → `packages/core` rename (PR #24309) + Global module move (`packages/opencode/src/global/index.ts` + `packages/shared/src/global.ts` → `packages/core/src/global.ts`) — that needs design discussion before adoption. Splitting into two syncs keeps each one mechanical. Conflicts: `packages/opencode/package.json` (kept `@browser-use/browsercode-core` name, took version bump to 1.14.25), `bun.lock` (took upstream, regenerated via `bun install`), `.github/workflows/publish.yml` (deleted by us per PR #14, upstream modified — kept our deletion). Yellow-zone audit (4 files: `cli/cmd/tui/app.tsx`, `config/config.ts`, `installation/index.ts`, `session/session.ts`): all auto-merged cleanly, BrowserCode customizations (USER_AGENT, `bcode.sh` URLs, `.bcode` paths, BCODE_UPGRADE_DISABLED block, doc-string overrides) verified present. **Notable upstream change pulled in:** PR #23244 — tool framework + all 18 built-in tools migrated from Zod to Effect Schema. Required adapting our Level-1 `packages/bcode-browser/src/browser-execute.ts` (`z.object` → `Schema.Struct`, `z.infer` → `Schema.Schema.Type`) and Level-2 adapter `packages/opencode/src/tool/browser-execute.ts` (drop `z` import, use `Schema.Schema.Type` for args). Filtered typecheck: 5/5 passed. Next sync should target v1.14.26+ with the shared→core rename as a documented integration step. |
+| 2026-05-01 | `bad732c26` | `af3998c8a` | bcode | Merged upstream release point for v1.14.26 (`sync release versions for v1.14.26` on `dev`). 72 upstream commits. **`packages/shared` → `packages/core` refactor.** PR #24309 renamed the directory + npm package (`@opencode-ai/shared` → `@opencode-ai/core`), purely mechanical (166 files, 218/218 lines, all import-string swaps). Five followup commits relocated modules into the new `packages/core/`: Global (from both `packages/opencode/src/global/index.ts` and `packages/shared/src/global.ts` consolidated into `packages/core/src/global.ts`), cross-spawn-spawner, npm service, and effect/util siblings (logger, runtime, observability, memo-map, log, opencode-process). BrowserCode integration: ported single-string divergence `app = "bcode"` from both deleted Global files into the new `packages/core/src/global.ts`; **dropped CACHE_VERSION cache-bust mechanism verbatim with upstream** — confirmed unused for BrowserCode (never bumped, no consumer depends on the wipe; investigated upstream/dev to confirm intentional removal); updated `browser-execute.ts` import `@/global` → `@opencode-ai/core/global` and trimmed CACHE_VERSION reference from comment. Conflicts: `.github/workflows/review.yml` (kept our deletion), `bun.lock` (regenerated), `packages/opencode/package.json` (kept name, bumped to 1.14.26), `packages/opencode/src/agent/agent.ts` (hunk 1 auto-merged: kept browser-sessions whitelist + took upstream's `_ctx`→`ctx` rename; hunk 2 resolved by keeping `.bcode/plans` and adopting upstream's `ctx.worktree`), `packages/opencode/src/global/index.ts` + `packages/shared/src/global.ts` (deleted with upstream). Filtered typecheck: 5/5 passed. |
+| 2026-05-01 | `af3998c8a` | `21f8027ef` | bcode | Merged upstream release point for v1.14.31 (`sync release versions for v1.14.31` on `dev`). 212 upstream commits across v1.14.27–v1.14.31. Conflicts: `.github/workflows/{deploy,publish}.yml` (kept our deletions per PR #14), `bun.lock` (regenerated), `packages/opencode/package.json` (kept name, bumped to 1.14.31), `packages/opencode/src/agent/agent.ts` (kept browser-sessions whitelist + took upstream's new `Global.Path.tmp` whitelist addition — both go in the same `whitelistedDirs` array), `packages/opencode/src/config/config.ts` (kept `bcode.json/bcode.jsonc` filenames + `bcode.sh` config schema URL; adopted upstream's `mergeConfig` helper pattern, retiring `mergeDeep(pipe(...))` chain), `packages/opencode/src/session/session.ts` (kept `.bcode/plans` rename; adopted upstream's new `(input, instance: InstanceContext)` signature using `instance.project`/`instance.worktree`), `packages/opencode/src/installation/index.ts` (substantial restructure — upstream switched from explicit `Service.of({...})` to `result: Interface = {...}` pattern with self-referential method calls; took upstream verbatim as the base, then re-applied 5 BrowserCode divergences: USER_AGENT prefix, `https://bcode.sh/install` URL, `.bcode/bin` execPath check, BCODE_UPGRADE_DISABLED const, early-return guards in `latest`/`upgrade`/`info`). Yellow-zone audit (7 files: `cli/cmd/tui/app.tsx`, `agent.ts`, `config.ts`, `installation/index.ts`, `session.ts`, `index.ts`, `core/src/global.ts`): customizations preserved (`scriptName("bcode")`, banner, USER_AGENT, `bcode.sh`, `.bcode` paths, `app = "bcode"`). Filtered typecheck: 5/5 passed. PR #29 (v1.14.25) supersedes — close in favor of this PR which covers the same window plus three additional release points. |
 
 ### browser-use/browser-harness → `packages/bcode-browser/harness/`