chore: merge upstream opencode v1.2.26

[anandgupta42]

What does this PR do?

Merges upstream OpenCode v1.2.21 through v1.2.26 (6 releases, 302 commits) into our fork, with all branding transforms, conflict resolution, and post-merge fixes applied.

Key upstream features & fixes included:

• Session performance: Paginated session history loading (perf(server): paginate session history)
• Session reliability: Sessions no longer lost after git init in existing project
• Edit tool: Preserves original line endings (LF/CRLF)
• Bedrock provider: Filter empty content blocks
• Azure OpenAI: Fix for non-OpenAI Azure models using completions endpoints
• Google Vertex AI: Add GOOGLE_VERTEX_LOCATION env var support
• GitLab: 1M context window support via beta header
• MCP OAuth: Fix auto-connect failing on first connection
• Security: Don't permit access to system directories
• PTY: Fix session handle leak
• Effect Schema: Branded IDs throughout (SessionID, MessageID, ProviderID, WorkspaceID, etc.)
• SAP AI: Thinking variants support
• TTY: Avoid corruption from double cleanup
• Worktrees: Read project ID from local workspace correctly
• Symlinks: Resolve in Instance cache to prevent duplicate contexts
• Java: Fix multiple jdtls LSPs eating memory in monorepos
• Config: Serialize bun installs to avoid race conditions
• Plugin auth: Use basic auth when server password exists

Post-merge fixes (our code):

• Fixed branded type errors in custom files (trajectory.ts, attach.ts, telemetry/index.ts, test files)
• Fixed @/control → @/account import rename in telemetry module
• Fixed branding leaks re-introduced by merge: USER_AGENT, brew tap (anomalyco → AltimateAI), npm package name
• Fixed branding test that was checking wrong domain

Merge tooling improvements:

• Per-file error handling in autoResolveConflicts — one failure no longer aborts all resolution
• Handle delete/add conflicts in skipFiles with git rm fallback
• Automatic cleanupSkipFiles step removes upstream-only packages after merge
• Changed stageAll() from git add -A to git add -u to avoid ENOBUFS from untracked directories
• Added --force to tag fetches to resolve local/upstream tag conflicts
• Graceful handling of already-committed merges in --continue flow

New tests (29 tests in upstream-merge-guard.test.ts):

• Installation branding: USER_AGENT prefix, brew tap, npm package name
• Root package.json integrity: no workspace globs, no sst/electron/aws-sdk
• 16 checks that deleted packages stay deleted
• OAuth/MCP branding: client_name, HTML titles
• opencode.ai domain leak scanner for all src/ files

Type of change

• Upstream merge

Issue for this PR

N/A — recurring upstream merge task

How did you verify your code works?

• bunx turbo typecheck — 4/4 packages pass
• bun test --cwd packages/opencode test/branding/ — 170/170 tests pass (including 29 new upstream merge guards)
• bun test --cwd packages/opencode — 1843 pass, 48 fail (all failures are pre-existing upstream issues, main has 591 failures)
• Manual dry-run review of all 710 upstream file changes

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[sentry]

🚧 Skipped: PR exceeds review size limit.

Please split into smaller PRs and re-run.
_{Reference ID: 11770974}

[sentry]

Bug: The CORS origin validation regex incorrectly checks for opencode.ai instead of altimate.ai, which will block all requests from the frontend.
_{Severity: CRITICAL}

Suggested Fix

Update the regular expression in the CORS origin validation function at server.ts to match altimate.ai domains. The regex should be changed from /^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/ to /^https:\/\/([a-z0-9-]+\.)*altimate\.ai$/ to align with the comment and the intended proxy target.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: packages/opencode/src/server/server.ts#L118-L119

Potential issue: The CORS origin validation uses a regular expression that incorrectly
checks for the `opencode.ai` domain. However, the server is designed to proxy requests
for a frontend hosted at `https://app.altimate.ai`. When the frontend makes a request,
its origin `https://app.altimate.ai` fails the regex test. This causes the CORS
middleware to block the request by not setting the `Access-Control-Allow-Origin` header,
preventing the frontend application from communicating with its backend server.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[sentry]

Bug: The cloudflare-workers-ai provider refactoring removes a hardcoded baseURL, introducing a risk of failure if the expected URL template placeholder is missing from external model data.
_{Severity: MEDIUM}

Suggested Fix

Verify that the api.url for cloudflare-workers-ai models in the external models.dev database contains the ${CLOUDFLARE_ACCOUNT_ID} placeholder. Alternatively, add a fallback to the previously hardcoded URL or add integration tests to validate this provider's configuration.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: packages/opencode/test/tool/fixtures/models-api.json#L20977-L20985

Potential issue: The `cloudflare-workers-ai` provider was refactored to no longer use a
hardcoded `baseURL`. The new implementation relies on a template substitution mechanism,
assuming that the `model.api.url` fetched from an external service contains a
`${CLOUDFLARE_ACCOUNT_ID}` placeholder. If this placeholder is missing from the external
data for `cloudflare-workers-ai` models, the `baseURL` will be incomplete, causing all
API requests for this provider to fail. This change introduces a regression risk as it
depends on unverified external data and lacks tests.

[sentry]

Bug: The system field from the /session/prompt API input is stored but never used when constructing the system prompt for the LLM, silently ignoring user-provided instructions.
_{Severity: MEDIUM}

Suggested Fix

The system prompt construction logic should be updated to include the system value from the user's message if it exists. Modify the array to include lastUser.system when it is available, for example: const system = [ ...(await SystemPrompt.environment(model)), ...(skills ? [skills] : []), ...(await InstructionPrompt.system()), ...(lastUser.system ? [lastUser.system] : []) ].

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: packages/opencode/src/session/prompt.ts#L655-L659

Potential issue: A functional regression has been introduced in the `/session/prompt`
endpoint. While the `system` field from the `PromptInput` is correctly received and
stored on the user message object, it is never referenced during the system prompt
construction. The logic around lines 655-659 builds the system prompt exclusively from
`SystemPrompt.environment`, `SystemPrompt.skills`, and `InstructionPrompt.system`.
Consequently, any custom system instructions provided by an API client via the `system`
field are silently ignored, altering the LLM's behavior from what the client expects.

[sentry]

Bug: The provider was renamed from altimate-code to opencode, but the custom loader only checks for the new opencode key in user configs, breaking existing setups.
_{Severity: HIGH}

Suggested Fix

Update the custom loader to check for both the old altimate-code key and the new opencode key in the user's configuration to ensure backward compatibility. For example, change the condition to check for config.provider?.["opencode"] or config.provider?.["altimate-code"]. Alternatively, implement a configuration migration step that renames the key before providers are initialized.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: packages/opencode/src/provider/provider.ts#L1056-L1080

Potential issue: The custom loader for the self-hosted provider was renamed from
`altimate-code` to `opencode`. However, the loader's check for an API key now
exclusively looks for `config.provider?.["opencode"]`. Existing users with
configurations using the old `altimate-code` key will fail this check. Consequently, the
`hasKey` check will return `false`, causing the provider to fail to load and potentially
deleting the user's configured models. This happens because no migration logic was added
to handle the old configuration key, nor is there a fallback to check for both the old
and new keys.

[sentry]

Bug: An unhandled exception inside the main session loop will bypass cleanup logic, leading to leaked process listeners and a failure to call Telemetry.shutdown().
_{Severity: MEDIUM}

Suggested Fix

Wrap the while (true) loop within a try/finally block. Move the cleanup logic, including the removal of process listeners and the call to Telemetry.shutdown(), into the finally block to ensure it executes regardless of whether an exception occurs within the loop.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: packages/opencode/src/session/prompt.ts#L753-L819

Potential issue: The `try/finally` block that previously wrapped the main `while (true)`
loop in the session prompt has been removed. The cleanup logic, including
`process.off()` for `beforeExit` and `exit` listeners and `Telemetry.shutdown()`, is now
placed sequentially after the loop. The loop contains multiple `await` calls that are
not individually wrapped in error handling. If any of these asynchronous operations
throw an unhandled exception, the function will exit prematurely, skipping the critical
cleanup logic. This will result in leaking process event listeners and failing to flush
pending telemetry events, potentially leading to data loss.