feat(opencode): drive turns through opencode serve with enforced permissions

[dviejokfs]

Summary

Adds a Serve turn mode to the OpenCode provider, opt-in via OpenCode::serve(), alongside the existing Run mode (opencode run --format json, unchanged, still the default). This closes the security gap flagged in the prior gap analysis: Run mode has no real permission enforcement, which is an enforcement-boundary risk, not just a UX gap.

• Serve mode spawns opencode serve on an ephemeral loopback port and drives it over HTTP + SSE.
• Permission policy translated from Fleet's PermissionMode mapping: Default/Custom → ask/ask, AcceptEdits → allow/ask, FullAccess → allow/allow, Plan → deny/deny (both categories). Empty allowed_tools → {"*":"deny"}.
• Live approvals answered through the existing InteractionHandler/ApprovalRequest/ApprovalDecision types — no new interaction types. live_questions stays false in both modes; OpenCode has no question channel.
• Extra hardening beyond Fleet's driver: a plan turn or empty allowlist also auto-rejects any permission.asked that reaches the adapter without consulting the handler at all — if one arrives, the policy didn't hold, and the turn already promised the user no such choice existed.
• Stdio MCP passthrough, persona/system-prompt prefix, and tailnet env all reuse existing LaunchContext/TurnRequest fields — no new parallel per-provider mechanism.
• Session resume via session.get, with fail-fast rejection of parentID subagent sessions.

New adapter primitive: AgentAdapter::attach()

HTTP/SSE is new territory for the adapter model — every turn-time method was sync and the runtime loop was clocked by child-stdout lines. Rather than a second turn loop or a sidecar process, AgentAdapter::attach() -> Option<ProtocolStreams> lets a provider substitute an AsyncRead/AsyncWrite pair for the child's stdout/stdin as the frame carrier. The newline-delimited frame contract, cancellation, interrupt, and interaction timeouts are all unchanged and shared with Codex — the child is still spawned/supervised/stderr-drained/killed by the runtime as before.

No new dependency: implements HTTP/1.1 + chunked-transfer SSE decoding by hand (matching the existing style in tailnet/proxy.rs) rather than pulling in a TLS client stack for loopback-only traffic.

Two runtime bugs the integration tests caught, both fixed:

1. opencode serve never exited on turn end (process.wait() hung to the turn deadline) — attached turns now terminate the child as part of normal shutdown, with a bounded reap.
2. Bridge deadlock from reader/writer sharing one duplex stream — each direction is now its own pipe.

Scoped out (deliberate)

• History import / opencode.db / snapshot import — stays in Fleet; the SDK has no sqlx dependency or ImportedTurn equivalent, and it's independent of any live server.
• Serve mode over SSH/remote transports — the bridge dials the SDK host's loopback; remote use needs port forwarding the SDK doesn't arrange. Documented on OpenCodeTurnMode::Serve.
• native_image_attachments not advertised for OpenCode: attachments are sent as file parts and still described in prompt text, since the SDK only has a host path (not a URL) and the file:// wire shape couldn't be verified against a live server. Additive, not silently dropped.

Public API surface

pub enum OpenCodeTurnMode { Run /* default */, Serve }   // #[non_exhaustive]
impl OpenCode {
    pub fn serve() -> Self;
    pub fn with_turn_mode(self, OpenCodeTurnMode) -> Self;
    pub fn turn_mode(&self) -> OpenCodeTurnMode;
}
pub struct ProtocolStreams { pub reader: TransportReader, pub writer: TransportWriter }
// AgentAdapter, both defaulted — existing adapters unaffected
async fn attach(&self, &TurnRequest, &AdapterState) -> Result<Option<ProtocolStreams>>;
fn command_for_turn(&self, &TurnRequest, &AdapterState) -> Result<CommandSpec>;

Behavior note: prepare_turn now runs before the command is built, so an adapter can pick a port first.

Testing

• cargo test --all-features: all 8 targets green (270 lib incl. +17 state machine / +6 bridge, +7 new end-to-end).
• $(command -v cargo) clippy --all-features --all-targets -- -D warnings: clean.
• cargo fmt --check: clean on touched files.
• Integration tests bind a real socket on the port the adapter reserved (no stubbing): ask→allow, ask→deny, plan-mode denial without consulting the handler, policy+MCP reaching the child env, server death mid-turn, clean cancel→session/abort→shutdown.

Rebased onto main after #13/#14 merged; verified fmt/clippy/tests again post-rebase.

🤖 Generated with Claude Code