[dmoliveira]

Summary

Measure the authenticated V2 direct-shell path while a configured plugin is paused in setup. On pinned OpenCode 2.2.5 and 2.2.6, the fixture observes its benign command complete before the hook is registered, then confirms that the active hook sees and can refuse a separate synthetic command. The direct path does not perform the session-ID update observed for model-driven shell calls.

The probe uses a password-protected local server, disposable owned fixtures and bounded server cleanup. It checks that successful shell commands exited and preserves fixtures when shell settlement is uncertain. Its MEASURED result reproduces these controls; it does not mean a guard is active, apply agent-tool policy to direct user API calls, or establish external access. Document the migration implication and run the measurement in both CI matrix entries.

Validation

• Full configured pre-commit validation with a canonical macOS temporary directory
• Ruff format and lint on the added Python files
• Targeted diagnostic unit tests, including cleanup and process-group identity controls
• Real isolated OpenCode 2.2.5 and 2.2.6 direct-shell measurements