fix(desktop): constrain renderer navigation

Co-authored-by: Aiden Cline <rekram1-node@users.noreply.github.com>

packages/core/src/config/normalize.ts

@@ -41,7 +41,7 @@ export type Result =
   | { readonly type: "rejected"; readonly diagnostics: readonly Diagnostic[] }
 
 const options = { errors: "all", onExcessProperty: "ignore", propertyOrder: "original" } as const
-const unsupportedTopLevel = ["logLevel", "server", "small_model", "subagent_depth", "layout"] as const
+const unsupportedTopLevel = ["logLevel", "server", "subagent_depth", "layout"] as const
 const unsupportedExperimental = [
   "disable_paste_summary",
   "batch_tool",
@@ -113,6 +113,23 @@ export function normalize(input: unknown): Result {
   const legacyAgents = mapValues(decodeMap(input.agent, ConfigAgentV1.Info, ["agent"], diagnostics), (value) =>
     canonical(ConfigAgent.Info, ConfigMigrateV1.migrateAgent(value)),
   )
+  const legacySmallModel = own(input, "small_model")
+    ? decodeValue(Schema.String, input.small_model, ["small_model"], diagnostics)
+    : undefined
+  const migratedSmallModel = legacySmallModel
+    ? ConfigMigrateV1.migrate({ small_model: legacySmallModel }).agents?.title?.model
+    : undefined
+  if (legacySmallModel && !migratedSmallModel)
+    diagnostics.push({
+      kind: "unsupported",
+      path: ["small_model"],
+      message: "omitted unsupported legacy model reference",
+    })
+  if (migratedSmallModel)
+    legacyAgents.title = {
+      model: migratedSmallModel,
+      ...legacyAgents.title,
+    }
   const modeAgents = mapValues(decodeMap(input.mode, ConfigAgentV1.Info, ["mode"], diagnostics), (value) =>
     canonical(ConfigAgent.Info, ConfigMigrateV1.migrateAgent({ ...value, mode: "primary" })),
   )

packages/core/src/file-mutation.ts

@@ -7,7 +7,7 @@ import { FSUtil } from "@opencode-ai/util/fs-util"
 import { Bom } from "@opencode-ai/util/bom"
 
 export interface Target {
-  readonly canonical: string
+  readonly absolute: string
   readonly resource: string
 }
 
@@ -37,7 +37,7 @@ export interface Interface {
 export class Service extends Context.Service<Service, Interface>()("@opencode/FileMutation") {}
 
 /**
- * Serialize file changes by canonical target. Conditional writes compare and
+ * Serialize file changes by absolute target. Conditional writes compare and
  * write under the same process-local lock so cooperating OpenCode mutations do
  * not overwrite changes made from the same stale content.
  */
@@ -49,11 +49,11 @@ const layer = Layer.effect(
     const withTargetLock =
       (target: Target) =>
       <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-        locks.withLock(target.canonical)(Effect.uninterruptible(effect))
+        locks.withLock(target.absolute)(Effect.uninterruptible(effect))
 
     const writeResult = (target: Target, existed: boolean): WriteResult => ({
       operation: "write",
-      target: target.canonical,
+      target: target.absolute,
       resource: target.resource,
       existed,
     })
@@ -61,8 +61,8 @@ const layer = Layer.effect(
     const write = Effect.fn("FileMutation.write")((input: WriteInput) =>
       withTargetLock(input.target)(
         Effect.gen(function* () {
-          const existed = yield* fs.exists(input.target.canonical)
-          yield* fs.writeWithDirs(input.target.canonical, input.content)
+          const existed = yield* fs.exists(input.target.absolute)
+          yield* fs.writeWithDirs(input.target.absolute, input.content)
           return writeResult(input.target, existed)
         }),
       ),
@@ -73,10 +73,10 @@ const layer = Layer.effect(
         Effect.gen(function* () {
           const next = Bom.split(input.content)
           const current = yield* fs
-            .readFile(input.target.canonical)
+            .readFile(input.target.absolute)
             .pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)))
           yield* fs.writeWithDirs(
-            input.target.canonical,
+            input.target.absolute,
             Bom.join(next.text, Boolean(current && Bom.has(current)) || next.bom),
           )
           return writeResult(input.target, current !== undefined)

packages/core/src/location-mutation.ts

@@ -23,14 +23,9 @@ export const ResolveInput = Schema.Struct({
 })
 export type ResolveInput = typeof ResolveInput.Type
 
-export class PathError extends Schema.TaggedErrorClass<PathError>()("LocationMutation.PathError", {
-  path: Schema.String,
-  reason: Schema.Literal("non_directory_ancestor"),
-}) {}
-
 export interface ExternalDirectoryAuthorization {
   readonly action: "external_directory"
-  /** Canonical existing directory used as the external approval boundary. */
+  /** Lexical directory used as the external approval boundary. */
   readonly directory: string
   /** `external_directory` permission resource. */
   readonly resource: string
@@ -44,9 +39,9 @@ export const externalDirectoryPermission = (input: ExternalDirectoryAuthorizatio
 })
 
 export interface Target {
-  /** Canonical existing path, or missing path below a canonical directory. */
-  readonly canonical: string
-  /** Permission resource: Location-relative for internal paths, canonical for external paths. */
+  /** Absolute lexical path. */
+  readonly absolute: string
+  /** Permission resource: Location-relative for internal paths, absolute for external paths. */
   readonly resource: string
   readonly externalDirectory?: ExternalDirectoryAuthorization
 }
@@ -57,25 +52,11 @@ export interface Interface {
    * from the Location. Paths outside it require separate `external_directory`
    * approval. This does not approve the mutation.
    */
-  readonly resolve: (input: ResolveInput) => Effect.Effect<Target, PathError | FSUtil.Error>
+  readonly resolve: (input: ResolveInput) => Effect.Effect<Target, FSUtil.Error>
 }
 
 export class Service extends Context.Service<Service, Interface>()("@opencode/LocationMutation") {}
 
-interface ResolvedPath {
-  readonly canonical: string
-  readonly type?:
-    | "File"
-    | "Directory"
-    | "SymbolicLink"
-    | "BlockDevice"
-    | "CharacterDevice"
-    | "FIFO"
-    | "Socket"
-    | "Unknown"
-  readonly directory: string
-}
-
 const slash = (value: string) => value.replaceAll("\\", "/")
 
 const layer = Layer.effect(
@@ -84,65 +65,33 @@ const layer = Layer.effect(
     const fs = yield* FSUtil.Service
     const location = yield* Location.Service
 
-    function notFound<A>(effect: Effect.Effect<A, FSUtil.Error>) {
-      return effect.pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)))
-    }
-
-    const resolvePath = Effect.fnUntraced(function* (absolute: string) {
-      const existing = yield* notFound(fs.realPath(absolute))
-      if (existing !== undefined) {
-        const info = yield* fs.stat(existing)
-        return {
-          canonical: existing,
-          type: info.type,
-          directory: info.type === "Directory" ? existing : path.dirname(existing),
-        } satisfies ResolvedPath
-      }
-
-      let anchor = path.dirname(absolute)
-      while (true) {
-        const canonical = yield* notFound(fs.realPath(anchor))
-        if (canonical !== undefined) {
-          const info = yield* fs.stat(canonical)
-          if (info.type !== "Directory") {
-            return yield* new PathError({ path: absolute, reason: "non_directory_ancestor" })
-          }
-          return {
-            canonical: path.resolve(canonical, path.relative(anchor, absolute)),
-            directory: canonical,
-          } satisfies ResolvedPath
-        }
-        const parent = path.dirname(anchor)
-        if (parent === anchor) return yield* new PathError({ path: absolute, reason: "non_directory_ancestor" })
-        anchor = parent
-      }
-    })
-
     const resolve = Effect.fn("LocationMutation.resolve")(function* (input: ResolveInput) {
       const absolute = path.resolve(location.directory, input.path)
-      // External access follows the requested path boundary. Symlinks reached through an
-      // internal path intentionally retain internal permission semantics after canonicalization.
-      const lexicallyInternal = FSUtil.contains(location.directory, absolute)
-
-      const resolved = yield* resolvePath(absolute)
-      const external = !lexicallyInternal
-      const resource = external ? slash(resolved.canonical) : slash(path.relative(location.directory, absolute) || ".")
-      const externalDirectory =
-        input.kind === "directory" && resolved.type === "Directory" ? resolved.canonical : resolved.directory
+      if (FSUtil.contains(location.directory, absolute)) {
+        return {
+          absolute,
+          resource: slash(path.relative(location.directory, absolute) || "."),
+        } satisfies Target
+      }
+      const type =
+        input.kind === "directory"
+          ? "Directory"
+          : (yield* fs
+              .stat(absolute)
+              .pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined))))?.type
+      const externalDirectory = type === "Directory" ? absolute : path.dirname(absolute)
       const externalResource = slash(path.join(externalDirectory, "*"))
       return {
-        canonical: resolved.canonical,
-        resource,
-        externalDirectory: external
-          ? {
-              action: "external_directory",
-              directory: externalDirectory,
-              resource: externalResource,
-              save: slash(
-                path.join((yield* Project.root(fs, AbsolutePath.make(externalDirectory))) ?? externalDirectory, "*"),
-              ),
-            }
-          : undefined,
+        absolute,
+        resource: slash(absolute),
+        externalDirectory: {
+          action: "external_directory",
+          directory: externalDirectory,
+          resource: externalResource,
+          save: slash(
+            path.join((yield* Project.root(fs, AbsolutePath.make(externalDirectory))) ?? externalDirectory, "*"),
+          ),
+        },
       } satisfies Target
     })
 

packages/core/src/tool/plugin/edit.ts

@@ -116,124 +116,120 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-              name,
-              options: { codemode: false, permission: "edit" },
-              description:
-                "Edit the contents of a file by finding and replacing exact text. When editing text from Read output, preserve the exact indentation (tabs or spaces) and omit the line-number prefix, such as `1: `. Never include the prefix in oldString or newString. The edit fails if oldString is not found. By default, oldString must identify a UNIQUE location. Multiple matches FAIL unless replaceAll is true. Add more surrounding context to disambiguate, or set replaceAll to true to replace every occurrence. Use replaceAll when the change should apply to every occurrence, such as renaming a variable.",
-              input: Input,
-              output: Output,
-              execute: (input, context) => {
-                return Effect.gen(function* () {
-                  const permissionSource = {
-                    type: "tool" as const,
-                    messageID: context.messageID,
-                    id: context.id,
-                  }
-                  if (input.oldString === input.newString) {
-                    return yield* new ToolFailure({
-                      message: "No changes to apply: oldString and newString are identical.",
-                    })
-                  }
-                  if (input.oldString === "") {
-                    return yield* new ToolFailure({
-                      message: "oldString must not be empty. Use write to create or overwrite a file.",
-                    })
-                  }
+        draft.add({
+          name,
+          options: { codemode: false, permission: "edit" },
+          description:
+            "Edit the contents of a file by finding and replacing exact text. When editing text from Read output, preserve the exact indentation (tabs or spaces) and omit the line-number prefix, such as `1: `. Never include the prefix in oldString or newString. The edit fails if oldString is not found. By default, oldString must identify a UNIQUE location. Multiple matches FAIL unless replaceAll is true. Add more surrounding context to disambiguate, or set replaceAll to true to replace every occurrence. Use replaceAll when the change should apply to every occurrence, such as renaming a variable.",
+          input: Input,
+          output: Output,
+          execute: (input, context) => {
+            return Effect.gen(function* () {
+              const permissionSource = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              if (input.oldString === input.newString) {
+                return yield* new ToolFailure({
+                  message: "No changes to apply: oldString and newString are identical.",
+                })
+              }
+              if (input.oldString === "") {
+                return yield* new ToolFailure({
+                  message: "oldString must not be empty. Use write to create or overwrite a file.",
+                })
+              }
 
-                  const target = yield* mutation.resolve({ path: input.path, kind: "file" })
-                  const external = target.externalDirectory
-                  if (external) {
-                    yield* permission.assert({
-                      ...LocationMutation.externalDirectoryPermission(external),
-                      sessionID: context.sessionID,
-                      agent: context.agent,
-                      source: permissionSource,
-                    })
-                  }
+              const target = yield* mutation.resolve({ path: input.path, kind: "file" })
+              const external = target.externalDirectory
+              if (external) {
+                yield* permission.assert({
+                  ...LocationMutation.externalDirectoryPermission(external),
+                  sessionID: context.sessionID,
+                  agent: context.agent,
+                  source: permissionSource,
+                })
+              }
 
-                  const info = yield* fs.stat(target.canonical).pipe(
-                    Effect.catchReason("PlatformError", "NotFound", () =>
-                      Effect.fail(new ToolFailure({ message: `File not found: ${input.path}` })),
-                    ),
-                  )
-                  if (info.type === "Directory") {
-                    return yield* new ToolFailure({ message: `Path is a directory, not a file: ${input.path}` })
-                  }
-                  const original = yield* Bom.readFile(fs, target.canonical)
-                  const source = original.text
-                  const ending = source.includes(crlf) ? crlf : "\n"
-                  const oldString = input.oldString.replaceAll(crlf, "\n").replaceAll("\n", ending)
-                  const newString = input.newString.replaceAll(crlf, "\n").replaceAll("\n", ending)
-                  const exact = findOccurrences(source, oldString)
-                  // These one-to-one mappings preserve offsets into the original source.
-                  const unicode =
-                    exact.length > 0 ? [] : findOccurrences(normalizeForMatch(source), normalizeForMatch(oldString))
-                  const trailing =
-                    exact.length > 0 || unicode.length > 0
-                      ? []
-                      : findLineOccurrences(source, oldString)
-                  const matches = exact.length > 0 ? exact : unicode.length > 0 ? unicode : trailing
-                  const replacements = matches.length
-                  const replaced = (input.replaceAll === true ? matches : matches.slice(0, 1))
-                    .toReversed()
-                    .reduce(
-                      (content, match) =>
-                        `${content.slice(0, match.start)}${newString}${content.slice(match.end)}`,
-                      source,
-                    )
-                  const preview =
-                    replacements > 0 && (replacements === 1 || input.replaceAll === true)
-                      ? fileDiff(target.resource, source, replaced)
-                      : undefined
-                  yield* permission.assert({
-                    action: "edit",
-                    resources: [target.resource],
-                    save: ["*"],
-                    metadata: preview ? { files: [preview] } : undefined,
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source: permissionSource,
-                  })
-                  if (replacements === 0) {
-                    return yield* new ToolFailure({
-                      message: `Could not find oldString in ${input.path}. It must match exactly, including whitespace and indentation.`,
-                    })
-                  }
-                  if (replacements > 1 && input.replaceAll !== true) {
-                    return yield* new ToolFailure({
-                      message: `Found ${replacements} matches for oldString, but expected exactly one. Add more surrounding context to make oldString unique, or set replaceAll to true to replace every occurrence.`,
-                    })
-                  }
-                  const replacementBom = replaced.startsWith("\uFEFF")
-                  const result = yield* files.write({
-                    target,
-                    content: Bom.join(replaced, original.bom || replacementBom),
-                  })
-                  const bom = original.bom || replacementBom
-                  const formatted = (yield* formatter.file(target.canonical))
-                    ? yield* Bom.syncFile(fs, target.canonical, bom)
-                    : (yield* Bom.readFile(fs, target.canonical)).text
-                  return {
-                    files: [fileDiff(result.resource, source, formatted)],
-                    replacements,
-                  } satisfies Output
-                }).pipe(
-                  Effect.map((output) => ({
-                    output,
-                    content: `Edited ${output.files[0]?.file} (${output.replacements} replacement${output.replacements === 1 ? "" : "s"})`,
-                    metadata: { files: output.files },
-                  })),
-                  Effect.mapError((error) =>
-                    error instanceof ToolFailure
-                      ? error
-                      : new ToolFailure({ message: `Unable to edit ${input.path}`, error }),
+              const info = yield* fs
+                .stat(target.absolute)
+                .pipe(
+                  Effect.catchReason("PlatformError", "NotFound", () =>
+                    Effect.fail(new ToolFailure({ message: `File not found: ${input.path}` })),
                   ),
                 )
-              },
-            }),
-        ),
+              if (info.type === "Directory") {
+                return yield* new ToolFailure({ message: `Path is a directory, not a file: ${input.path}` })
+              }
+              const original = yield* Bom.readFile(fs, target.absolute)
+              const source = original.text
+              const ending = source.includes(crlf) ? crlf : "\n"
+              const oldString = input.oldString.replaceAll(crlf, "\n").replaceAll("\n", ending)
+              const newString = input.newString.replaceAll(crlf, "\n").replaceAll("\n", ending)
+              const exact = findOccurrences(source, oldString)
+              // These one-to-one mappings preserve offsets into the original source.
+              const unicode =
+                exact.length > 0 ? [] : findOccurrences(normalizeForMatch(source), normalizeForMatch(oldString))
+              const trailing = exact.length > 0 || unicode.length > 0 ? [] : findLineOccurrences(source, oldString)
+              const matches = exact.length > 0 ? exact : unicode.length > 0 ? unicode : trailing
+              const replacements = matches.length
+              const replaced = (input.replaceAll === true ? matches : matches.slice(0, 1))
+                .toReversed()
+                .reduce(
+                  (content, match) => `${content.slice(0, match.start)}${newString}${content.slice(match.end)}`,
+                  source,
+                )
+              const preview =
+                replacements > 0 && (replacements === 1 || input.replaceAll === true)
+                  ? fileDiff(target.resource, source, replaced)
+                  : undefined
+              yield* permission.assert({
+                action: "edit",
+                resources: [target.resource],
+                save: ["*"],
+                metadata: preview ? { files: [preview] } : undefined,
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source: permissionSource,
+              })
+              if (replacements === 0) {
+                return yield* new ToolFailure({
+                  message: `Could not find oldString in ${input.path}. It must match exactly, including whitespace and indentation.`,
+                })
+              }
+              if (replacements > 1 && input.replaceAll !== true) {
+                return yield* new ToolFailure({
+                  message: `Found ${replacements} matches for oldString, but expected exactly one. Add more surrounding context to make oldString unique, or set replaceAll to true to replace every occurrence.`,
+                })
+              }
+              const replacementBom = replaced.startsWith("\uFEFF")
+              const result = yield* files.write({
+                target,
+                content: Bom.join(replaced, original.bom || replacementBom),
+              })
+              const bom = original.bom || replacementBom
+              const formatted = (yield* formatter.file(target.absolute))
+                ? yield* Bom.syncFile(fs, target.absolute, bom)
+                : (yield* Bom.readFile(fs, target.absolute)).text
+              return {
+                files: [fileDiff(result.resource, source, formatted)],
+                replacements,
+              } satisfies Output
+            }).pipe(
+              Effect.map((output) => ({
+                output,
+                content: `Edited ${output.files[0]?.file} (${output.replacements} replacement${output.replacements === 1 ? "" : "s"})`,
+                metadata: { files: output.files },
+              })),
+              Effect.mapError((error) =>
+                error instanceof ToolFailure
+                  ? error
+                  : new ToolFailure({ message: `Unable to edit ${input.path}`, error }),
+              ),
+            )
+          },
+        }),
       )
       .pipe(Effect.orDie)
   }),

packages/core/src/tool/plugin/glob.ts

@@ -50,96 +50,93 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-            name,
-            options: { codemode: false },
-            description:
-              'Search file paths using a glob pattern (examples: "**/*.ts", "src/**/*.tsx").',
-            input: Input,
-            output: Output,
-            execute: (input, context) =>
-              Effect.gen(function* () {
-                const searchPath = input.path === "undefined" || input.path === "null" ? undefined : input.path
-                const source = { type: "tool" as const, messageID: context.messageID, id: context.id }
-                const target = yield* mutation.resolve({ path: searchPath ?? ".", kind: "directory" })
-                const external = target.externalDirectory
-                if (external)
-                  yield* permission.assert({
-                    ...LocationMutation.externalDirectoryPermission(external),
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
+        draft.add({
+          name,
+          options: { codemode: false },
+          description: 'Search file paths using a glob pattern (examples: "**/*.ts", "src/**/*.tsx").',
+          input: Input,
+          output: Output,
+          execute: (input, context) =>
+            Effect.gen(function* () {
+              const searchPath = input.path === "undefined" || input.path === "null" ? undefined : input.path
+              const source = { type: "tool" as const, messageID: context.messageID, id: context.id }
+              const target = yield* mutation.resolve({ path: searchPath ?? ".", kind: "directory" })
+              const external = target.externalDirectory
+              if (external)
                 yield* permission.assert({
-                  action: name,
-                  resources: [input.pattern],
-                  save: ["*"],
-                  metadata: {
-                    root: searchPath ?? ".",
-                    path: searchPath,
-                    limit: input.limit,
-                  },
+                  ...LocationMutation.externalDirectoryPermission(external),
                   sessionID: context.sessionID,
                   agent: context.agent,
                   source,
                 })
-                const info = yield* fs
-                  .stat(target.canonical)
-                  .pipe(
-                    Effect.catchReason("PlatformError", "NotFound", () =>
-                      Effect.fail(new ToolFailure({ message: `Search path does not exist: ${searchPath ?? "."}` })),
-                    ),
-                  )
-                if (info.type !== "Directory")
-                  return yield* Effect.fail(
-                    new ToolFailure({ message: `Search path is not a directory: ${searchPath ?? "."}` }),
-                  )
-                const root = path.resolve(location.directory, searchPath ?? ".")
-                const limit = input.limit ?? FileSystem.DEFAULT_SEARCH_LIMIT
-                const entries = yield* ripgrep
-                  .glob({
-                    cwd: target.canonical,
-                    pattern: input.pattern,
-                    limit: limit + 1,
-                  })
-                  .pipe(
-                    Effect.timeoutOrElse({
-                      duration: FileSystem.DEFAULT_SEARCH_TIMEOUT_MS,
-                      orElse: () =>
-                        Effect.fail(
-                          new ToolFailure({
-                            message: `Search timed out after ${FileSystem.DEFAULT_SEARCH_TIMEOUT_MS / 1_000} seconds. Consider using a more specific path or pattern.`,
-                          }),
-                        ),
-                    }),
-                    Effect.map((result) =>
-                      result.map((entry) =>
-                        FileSystem.Entry.make({
-                          ...entry,
-                          path: RelativePath.make(path.relative(location.directory, path.resolve(root, entry.path))),
+              yield* permission.assert({
+                action: name,
+                resources: [input.pattern],
+                save: ["*"],
+                metadata: {
+                  root: searchPath ?? ".",
+                  path: searchPath,
+                  limit: input.limit,
+                },
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+              const info = yield* fs
+                .stat(target.absolute)
+                .pipe(
+                  Effect.catchReason("PlatformError", "NotFound", () =>
+                    Effect.fail(new ToolFailure({ message: `Search path does not exist: ${searchPath ?? "."}` })),
+                  ),
+                )
+              if (info.type !== "Directory")
+                return yield* Effect.fail(
+                  new ToolFailure({ message: `Search path is not a directory: ${searchPath ?? "."}` }),
+                )
+              const root = path.resolve(location.directory, searchPath ?? ".")
+              const limit = input.limit ?? FileSystem.DEFAULT_SEARCH_LIMIT
+              const entries = yield* ripgrep
+                .glob({
+                  cwd: target.absolute,
+                  pattern: input.pattern,
+                  limit: limit + 1,
+                })
+                .pipe(
+                  Effect.timeoutOrElse({
+                    duration: FileSystem.DEFAULT_SEARCH_TIMEOUT_MS,
+                    orElse: () =>
+                      Effect.fail(
+                        new ToolFailure({
+                          message: `Search timed out after ${FileSystem.DEFAULT_SEARCH_TIMEOUT_MS / 1_000} seconds. Consider using a more specific path or pattern.`,
                         }),
                       ),
+                  }),
+                  Effect.map((result) =>
+                    result.map((entry) =>
+                      FileSystem.Entry.make({
+                        ...entry,
+                        path: RelativePath.make(path.relative(location.directory, path.resolve(root, entry.path))),
+                      }),
                     ),
-                  )
-                return { entries: entries.slice(0, limit), truncated: entries.length > limit }
-              }).pipe(
-                Effect.map((result) => ({
-                  output: result.entries,
-                  content: toModelContent(
-                    result.entries.map((entry) => ({ ...entry, path: path.resolve(location.directory, entry.path) })),
-                    result.truncated,
                   ),
-                  metadata: { count: result.entries.length, truncated: result.truncated },
-                })),
-                Effect.mapError((error) =>
-                  error instanceof ToolFailure
-                    ? error
-                    : new ToolFailure({ message: `Unable to find files matching ${input.pattern}`, error }),
+                )
+              return { entries: entries.slice(0, limit), truncated: entries.length > limit }
+            }).pipe(
+              Effect.map((result) => ({
+                output: result.entries,
+                content: toModelContent(
+                  result.entries.map((entry) => ({ ...entry, path: path.resolve(location.directory, entry.path) })),
+                  result.truncated,
                 ),
+                metadata: { count: result.entries.length, truncated: result.truncated },
+              })),
+              Effect.mapError((error) =>
+                error instanceof ToolFailure
+                  ? error
+                  : new ToolFailure({ message: `Unable to find files matching ${input.pattern}`, error }),
               ),
-          }),
-        ),
+            ),
+        }),
       )
       .pipe(Effect.orDie)
   }),

packages/core/src/tool/plugin/patch.ts

@@ -58,7 +58,7 @@ type Prepared =
     })
 
 interface Target {
-  readonly canonical: string
+  readonly absolute: string
   readonly resource: string
   readonly externalDirectory?: {
     readonly directory: string
@@ -76,267 +76,256 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-              name,
-              options: { codemode: false, permission: "edit" },
-              description: DESCRIPTION,
-              input: Input,
-              output: Output,
-              execute: (input, context) => {
-                const applied: Array<typeof Applied.Type> = []
-                const fail = (operation: string, error: unknown) => {
-                  const completed = applied.map((item) => item.resource).join(", ")
-                  return new ToolFailure({
-                    message: `${operation}: ${errorMessage(error)}${completed ? `. Completed before failure: ${completed}` : ""}`,
-                  })
-                }
-                return Effect.gen(function* () {
-                  const source = {
-                    type: "tool" as const,
-                    messageID: context.messageID,
-                    id: context.id,
+        draft.add({
+          name,
+          options: { codemode: false, permission: "edit" },
+          description: DESCRIPTION,
+          input: Input,
+          output: Output,
+          execute: (input, context) => {
+            const applied: Array<typeof Applied.Type> = []
+            const fail = (operation: string, error: unknown) => {
+              const completed = applied.map((item) => item.resource).join(", ")
+              return new ToolFailure({
+                message: `${operation}: ${errorMessage(error)}${completed ? `. Completed before failure: ${completed}` : ""}`,
+              })
+            }
+            return Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              if (!input.patchText) return yield* new ToolFailure({ message: "patchText is required" })
+              const hunks = yield* Effect.fromResult(Patch.parse(input.patchText)).pipe(
+                Effect.mapError((error) => new ToolFailure({ message: `patch verification failed: ${error.message}` })),
+              )
+              if (hunks.length === 0) {
+                return yield* new ToolFailure({ message: "patch rejected: empty patch" })
+              }
+              const prepared: Prepared[] = []
+              const targets: Target[] = []
+              const updates = new Map<string, string>()
+              for (const hunk of hunks) {
+                yield* Effect.gen(function* () {
+                  const target = resolveTarget(location, hunk.path)
+                  targets.push(target)
+                  if (target.externalDirectory) {
+                    yield* permission.assert({
+                      action: "external_directory",
+                      resources: [target.externalDirectory.resource],
+                      save: [target.externalDirectory.resource],
+                      metadata: {
+                        filepath: target.absolute,
+                        parentDir: target.externalDirectory.directory,
+                      },
+                      sessionID: context.sessionID,
+                      agent: context.agent,
+                      source,
+                    })
                   }
-                  if (!input.patchText) return yield* new ToolFailure({ message: "patchText is required" })
-                  const hunks = yield* Effect.fromResult(Patch.parse(input.patchText)).pipe(
-                    Effect.mapError(
-                      (error) => new ToolFailure({ message: `patch verification failed: ${error.message}` }),
-                    ),
-                  )
-                  if (hunks.length === 0) {
-                    return yield* new ToolFailure({ message: "patch rejected: empty patch" })
+                  if (hunk.type === "add") {
+                    prepared.push({
+                      ...hunk,
+                      target,
+                      before: "",
+                      after: Bom.split(
+                        hunk.contents.endsWith("\n") || hunk.contents === "" ? hunk.contents : `${hunk.contents}\n`,
+                      ).text,
+                    })
+                    return
                   }
-                  const prepared: Prepared[] = []
-                  const targets: Target[] = []
-                  const updates = new Map<string, string>()
-                  for (const hunk of hunks) {
-                    yield* Effect.gen(function* () {
-                      const target = resolveTarget(location, hunk.path)
-                      targets.push(target)
-                      if (target.externalDirectory) {
-                        yield* permission.assert({
-                          action: "external_directory",
-                          resources: [target.externalDirectory.resource],
-                          save: [target.externalDirectory.resource],
-                          metadata: {
-                            filepath: target.canonical,
-                            parentDir: target.externalDirectory.directory,
-                          },
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      }
-                      if (hunk.type === "add") {
-                        prepared.push({
-                          ...hunk,
-                          target,
-                          before: "",
-                          after: Bom.split(
-                            hunk.contents.endsWith("\n") || hunk.contents === ""
-                              ? hunk.contents
-                              : `${hunk.contents}\n`,
-                          ).text,
-                        })
-                        return
-                      }
-                      if (hunk.type === "delete") {
-                        const content = yield* Bom.readFile(fs, target.canonical).pipe(
-                          Effect.mapError(
-                            (error) =>
-                              new ToolFailure({
-                                message: `patch verification failed: Failed to delete ${target.resource}: ${errorMessage(error)}`,
-                              }),
-                          ),
-                        )
-                        prepared.push({ ...hunk, target, before: content.text, after: "" })
-                        return
-                      }
-                      const previous = updates.get(target.canonical)
-                      const original =
-                        previous ??
-                        (yield* Effect.gen(function* () {
-                          const stats = yield* fs.stat(target.canonical).pipe(
-                            Effect.mapError(
-                              (error) =>
-                                new ToolFailure({
-                                  message: `patch verification failed: Failed to read file to update ${target.canonical}: ${errorMessage(error)}`,
-                                }),
-                            ),
-                          )
-                          if (stats.type === "Directory") {
-                            return yield* new ToolFailure({
-                              message: `patch verification failed: Failed to read file to update ${target.canonical}: path is a directory`,
-                            })
-                          }
-                          const content = yield* Bom.readFile(fs, target.canonical).pipe(
-                            Effect.mapError(
-                              (error) =>
-                                new ToolFailure({
-                                  message: `patch verification failed: Failed to read file to update ${target.canonical}: ${errorMessage(error)}`,
-                                }),
-                            ),
-                          )
-                          return Bom.join(content.text, content.bom)
-                        }))
-                      const before = Bom.split(original).text
-                      const update = yield* Effect.try({
-                        try: () => Patch.derive(hunk.path, hunk.chunks, original),
-                        catch: (error) =>
-                          new ToolFailure({ message: `patch verification failed: ${errorMessage(error)}` }),
-                      })
-                      const moveTarget = hunk.movePath ? resolveTarget(location, hunk.movePath) : undefined
-                      if (moveTarget) targets.push(moveTarget)
-                      if (moveTarget?.externalDirectory) {
-                        yield* permission.assert({
-                          action: "external_directory",
-                          resources: [moveTarget.externalDirectory.resource],
-                          save: [moveTarget.externalDirectory.resource],
-                          metadata: {
-                            filepath: moveTarget.canonical,
-                            parentDir: moveTarget.externalDirectory.directory,
-                          },
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      }
-                      prepared.push({
-                        ...hunk,
-                        target,
-                        content: Patch.joinBom(update.content, update.bom),
-                        before,
-                        after: update.content,
-                        moveTarget,
-                      })
-                      if (!moveTarget) updates.set(target.canonical, Patch.joinBom(update.content, update.bom))
-                    }).pipe(
-                      Effect.mapError((error) =>
-                        error instanceof ToolFailure
-                          ? error
-                          : new ToolFailure({ message: `Unable to prepare patch at ${hunk.path}`, error }),
+                  if (hunk.type === "delete") {
+                    const content = yield* Bom.readFile(fs, target.absolute).pipe(
+                      Effect.mapError(
+                        (error) =>
+                          new ToolFailure({
+                            message: `patch verification failed: Failed to delete ${target.resource}: ${errorMessage(error)}`,
+                          }),
                       ),
                     )
+                    prepared.push({ ...hunk, target, before: content.text, after: "" })
+                    return
                   }
-
-                  const patchFiles = prepared.map((change) => patchFile(change))
-                  yield* permission.assert({
-                    action: "edit",
-                    resources: [...new Set(targets.map((target) => target.resource))],
-                    save: ["*"],
-                    metadata: {
-                      filepath: targets.map((target) => target.resource).join(", "),
-                      diff: patchFiles.map((file) => `${file.patch}\n`).join(""),
-                      files: patchFiles,
-                    },
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
-
-                  yield* Effect.forEach(
-                    prepared,
-                    (change) =>
-                      Effect.gen(function* () {
-                        if (change.type === "add") {
-                          yield* fs
-                            .writeWithDirs(
-                              change.target.canonical,
-                              change.contents.endsWith("\n") || change.contents === ""
-                                ? change.contents
-                                : `${change.contents}\n`,
-                            )
-                            .pipe(
-                              Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)),
-                            )
-                          applied.push({
-                            type: change.type,
-                            resource: change.target.resource,
-                            target: change.target.canonical,
-                          })
-                          return
-                        }
-                        if (change.type === "delete") {
-                          yield* fs
-                            .remove(change.target.canonical)
-                            .pipe(
-                              Effect.mapError((error) => fail(`Failed to delete ${change.target.resource}`, error)),
-                            )
-                          applied.push({
-                            type: change.type,
-                            resource: change.target.resource,
-                            target: change.target.canonical,
-                          })
-                          return
-                        }
-                        if (change.moveTarget) {
-                          const moveTarget = change.moveTarget
-                          yield* fs
-                            .writeWithDirs(moveTarget.canonical, change.content)
-                            .pipe(Effect.mapError((error) => fail(`Failed to write ${moveTarget.resource}`, error)))
-                          yield* fs.remove(change.target.canonical).pipe(
-                            Effect.mapError((error) =>
-                              fail(`Wrote ${moveTarget.resource} but failed to remove ${change.target.resource}`, error),
-                            ),
-                          )
-                          applied.push({
-                            type: change.type,
-                            resource: change.moveTarget.resource,
-                            target: change.moveTarget.canonical,
-                          })
-                          return
-                        }
-                        yield* fs
-                          .writeWithDirs(change.target.canonical, change.content)
-                          .pipe(Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)))
-                        applied.push({
-                          type: change.type,
-                          resource: change.target.resource,
-                          target: change.target.canonical,
+                  const previous = updates.get(target.absolute)
+                  const original =
+                    previous ??
+                    (yield* Effect.gen(function* () {
+                      const stats = yield* fs.stat(target.absolute).pipe(
+                        Effect.mapError(
+                          (error) =>
+                            new ToolFailure({
+                              message: `patch verification failed: Failed to read file to update ${target.absolute}: ${errorMessage(error)}`,
+                            }),
+                        ),
+                      )
+                      if (stats.type === "Directory") {
+                        return yield* new ToolFailure({
+                          message: `patch verification failed: Failed to read file to update ${target.absolute}: path is a directory`,
                         })
-                      }),
-                    { discard: true },
-                  )
-                  const formatted = new Map<string, string>()
-                  yield* Effect.forEach(
-                    [...new Set(applied.filter((item) => item.type !== "delete").map((item) => item.target))],
-                    (target) =>
-                      Effect.gen(function* () {
-                        const current = yield* Bom.readFile(fs, target).pipe(
-                          Effect.mapError((error) => fail(`Failed to read ${target}`, error)),
-                        )
-                        formatted.set(
-                          target,
-                          (yield* formatter.file(target))
-                            ? yield* Bom.syncFile(fs, target, current.bom).pipe(
-                                Effect.mapError((error) => fail(`Failed to sync ${target}`, error)),
-                              )
-                            : current.text,
-                        )
-                      }),
-                    { discard: true },
-                  )
-                  const files = yield* Effect.forEach(prepared, (change) => {
-                    if (change.type === "delete") return Effect.succeed(patchFile(change))
-                    const target = change.type === "update" && change.moveTarget ? change.moveTarget : change.target
-                    return Effect.succeed(patchFile(change, formatted.get(target.canonical)))
+                      }
+                      const content = yield* Bom.readFile(fs, target.absolute).pipe(
+                        Effect.mapError(
+                          (error) =>
+                            new ToolFailure({
+                              message: `patch verification failed: Failed to read file to update ${target.absolute}: ${errorMessage(error)}`,
+                            }),
+                        ),
+                      )
+                      return Bom.join(content.text, content.bom)
+                    }))
+                  const before = Bom.split(original).text
+                  const update = yield* Effect.try({
+                    try: () => Patch.derive(hunk.path, hunk.chunks, original),
+                    catch: (error) => new ToolFailure({ message: `patch verification failed: ${errorMessage(error)}` }),
                   })
-                  return { applied, files }
+                  const moveTarget = hunk.movePath ? resolveTarget(location, hunk.movePath) : undefined
+                  if (moveTarget) targets.push(moveTarget)
+                  if (moveTarget?.externalDirectory) {
+                    yield* permission.assert({
+                      action: "external_directory",
+                      resources: [moveTarget.externalDirectory.resource],
+                      save: [moveTarget.externalDirectory.resource],
+                      metadata: {
+                        filepath: moveTarget.absolute,
+                        parentDir: moveTarget.externalDirectory.directory,
+                      },
+                      sessionID: context.sessionID,
+                      agent: context.agent,
+                      source,
+                    })
+                  }
+                  prepared.push({
+                    ...hunk,
+                    target,
+                    content: Patch.joinBom(update.content, update.bom),
+                    before,
+                    after: update.content,
+                    moveTarget,
+                  })
+                  if (!moveTarget) updates.set(target.absolute, Patch.joinBom(update.content, update.bom))
                 }).pipe(
-                  Effect.map((output) => ({
-                    output,
-                    content: toModelOutput(output),
-                    metadata: { files: output.files },
-                  })),
                   Effect.mapError((error) =>
                     error instanceof ToolFailure
                       ? error
-                      : new ToolFailure({ message: "Unable to apply patch", error }),
+                      : new ToolFailure({ message: `Unable to prepare patch at ${hunk.path}`, error }),
                   ),
                 )
-              },
-            }),
-        ),
+              }
+
+              const patchFiles = prepared.map((change) => patchFile(change))
+              yield* permission.assert({
+                action: "edit",
+                resources: [...new Set(targets.map((target) => target.resource))],
+                save: ["*"],
+                metadata: {
+                  filepath: targets.map((target) => target.resource).join(", "),
+                  diff: patchFiles.map((file) => `${file.patch}\n`).join(""),
+                  files: patchFiles,
+                },
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+
+              yield* Effect.forEach(
+                prepared,
+                (change) =>
+                  Effect.gen(function* () {
+                    if (change.type === "add") {
+                      yield* fs
+                        .writeWithDirs(
+                          change.target.absolute,
+                          change.contents.endsWith("\n") || change.contents === ""
+                            ? change.contents
+                            : `${change.contents}\n`,
+                        )
+                        .pipe(Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)))
+                      applied.push({
+                        type: change.type,
+                        resource: change.target.resource,
+                        target: change.target.absolute,
+                      })
+                      return
+                    }
+                    if (change.type === "delete") {
+                      yield* fs
+                        .remove(change.target.absolute)
+                        .pipe(Effect.mapError((error) => fail(`Failed to delete ${change.target.resource}`, error)))
+                      applied.push({
+                        type: change.type,
+                        resource: change.target.resource,
+                        target: change.target.absolute,
+                      })
+                      return
+                    }
+                    if (change.moveTarget) {
+                      const moveTarget = change.moveTarget
+                      yield* fs
+                        .writeWithDirs(moveTarget.absolute, change.content)
+                        .pipe(Effect.mapError((error) => fail(`Failed to write ${moveTarget.resource}`, error)))
+                      yield* fs
+                        .remove(change.target.absolute)
+                        .pipe(
+                          Effect.mapError((error) =>
+                            fail(`Wrote ${moveTarget.resource} but failed to remove ${change.target.resource}`, error),
+                          ),
+                        )
+                      applied.push({
+                        type: change.type,
+                        resource: change.moveTarget.resource,
+                        target: change.moveTarget.absolute,
+                      })
+                      return
+                    }
+                    yield* fs
+                      .writeWithDirs(change.target.absolute, change.content)
+                      .pipe(Effect.mapError((error) => fail(`Failed to write ${change.target.resource}`, error)))
+                    applied.push({
+                      type: change.type,
+                      resource: change.target.resource,
+                      target: change.target.absolute,
+                    })
+                  }),
+                { discard: true },
+              )
+              const formatted = new Map<string, string>()
+              yield* Effect.forEach(
+                [...new Set(applied.filter((item) => item.type !== "delete").map((item) => item.target))],
+                (target) =>
+                  Effect.gen(function* () {
+                    const current = yield* Bom.readFile(fs, target).pipe(
+                      Effect.mapError((error) => fail(`Failed to read ${target}`, error)),
+                    )
+                    formatted.set(
+                      target,
+                      (yield* formatter.file(target))
+                        ? yield* Bom.syncFile(fs, target, current.bom).pipe(
+                            Effect.mapError((error) => fail(`Failed to sync ${target}`, error)),
+                          )
+                        : current.text,
+                    )
+                  }),
+                { discard: true },
+              )
+              const files = yield* Effect.forEach(prepared, (change) => {
+                if (change.type === "delete") return Effect.succeed(patchFile(change))
+                const target = change.type === "update" && change.moveTarget ? change.moveTarget : change.target
+                return Effect.succeed(patchFile(change, formatted.get(target.absolute)))
+              })
+              return { applied, files }
+            }).pipe(
+              Effect.map((output) => ({
+                output,
+                content: toModelOutput(output),
+                metadata: { files: output.files },
+              })),
+              Effect.mapError((error) =>
+                error instanceof ToolFailure ? error : new ToolFailure({ message: "Unable to apply patch", error }),
+              ),
+            )
+          },
+        }),
       )
       .pipe(Effect.orDie)
 
@@ -365,9 +354,7 @@ function errorMessage(error: unknown) {
 
 function patchFile(change: Prepared, after = change.after): typeof FileDiff.Info.Type {
   const target = (change.type === "update" ? change.moveTarget : undefined)?.resource ?? change.target.resource
-  const patch = trimDiff(
-    createTwoFilesPatch(change.target.canonical, change.target.canonical, change.before, after),
-  )
+  const patch = trimDiff(createTwoFilesPatch(change.target.absolute, change.target.absolute, change.before, after))
   const counts =
     change.type === "delete"
       ? { additions: 0, deletions: change.before.split("\n").length }
@@ -416,22 +403,22 @@ function trimDiff(diff: string) {
 }
 
 function resolveTarget(location: Location.Interface, value: string): Target {
-  const canonical =
+  const absolute =
     process.platform === "win32"
       ? FSUtil.normalizePath(path.resolve(location.directory, value))
       : path.resolve(location.directory, value)
   const projectRoot = path.parse(location.project.directory).root
   const external =
-    !FSUtil.contains(location.directory, canonical) &&
-    (location.project.directory === projectRoot || !FSUtil.contains(location.project.directory, canonical))
-  const directory = path.dirname(canonical)
+    !FSUtil.contains(location.directory, absolute) &&
+    (location.project.directory === projectRoot || !FSUtil.contains(location.project.directory, absolute))
+  const directory = path.dirname(absolute)
   const resource =
     process.platform === "win32"
       ? FSUtil.normalizePathPattern(path.join(directory, "*"))
       : path.join(directory, "*").replaceAll("\\", "/")
   return {
-    canonical,
-    resource: path.relative(location.project.directory, canonical).replaceAll("\\", "/") || ".",
+    absolute,
+    resource: path.relative(location.project.directory, absolute).replaceAll("\\", "/") || ".",
     externalDirectory: external ? { directory, resource } : undefined,
   }
 }

packages/core/src/tool/plugin/read.ts

@@ -25,11 +25,7 @@ const LocationInput = Schema.Struct({
   }),
 })
 export const Input = LocationInput
-const Output = Schema.Union([
-  ReadToolFileSystem.FileContent,
-  ReadToolFileSystem.TextPage,
-  ReadToolFileSystem.ListPage,
-])
+const Output = Schema.Union([ReadToolFileSystem.FileContent, ReadToolFileSystem.TextPage, ReadToolFileSystem.ListPage])
 
 export const Plugin = {
   id: "opencode.tool.read",
@@ -43,105 +39,102 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-            name,
-            options: { codemode: false },
-            description:
-              "Read the contents of a file or directory. Supports text files, images, and PDFs. Images and PDFs are presented directly to the model. Each text line is prefixed by its 1-based line number as <line>: <content>. The prefix is for reference and is not part of the file content. Directory entries are returned one per line. Use offset and limit to read large files or directories in sections. Prefer one larger read over many small slices, and use grep to find specific content in large files.",
-            input: Input,
-            output: Output,
-            execute: (input, context) => {
-              return Effect.gen(function* () {
-                const source = {
-                  type: "tool" as const,
-                  messageID: context.messageID,
-                  id: context.id,
-                }
-                const target = yield* mutation.resolve({ path: input.path, kind: "directory" })
-                const external = target.externalDirectory
-                if (external)
-                  yield* permission.assert({
-                    ...LocationMutation.externalDirectoryPermission(external),
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
-                const resource = target.resource
-                const absolute = AbsolutePath.make(target.canonical)
+        draft.add({
+          name,
+          options: { codemode: false },
+          description:
+            "Read the contents of a file or directory. Supports text files, images, and PDFs. Images and PDFs are presented directly to the model. Each text line is prefixed by its 1-based line number as <line>: <content>. The prefix is for reference and is not part of the file content. Directory entries are returned one per line. Use offset and limit to read large files or directories in sections. Prefer one larger read over many small slices, and use grep to find specific content in large files.",
+          input: Input,
+          output: Output,
+          execute: (input, context) => {
+            return Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              const target = yield* mutation.resolve({ path: input.path })
+              const external = target.externalDirectory
+              if (external)
                 yield* permission.assert({
-                  action: name,
-                  resources: [resource],
-                  save: ["*"],
+                  ...LocationMutation.externalDirectoryPermission(external),
                   sessionID: context.sessionID,
                   agent: context.agent,
                   source,
                 })
-                const type = yield* reader.inspect(absolute).pipe(
-                  Effect.catchReason("PlatformError", "NotFound", () => missing(input.path, target.canonical)),
+              const resource = target.resource
+              const absolute = AbsolutePath.make(target.absolute)
+              yield* permission.assert({
+                action: name,
+                resources: [resource],
+                save: ["*"],
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+              const type = yield* reader
+                .inspect(absolute)
+                .pipe(Effect.catchReason("PlatformError", "NotFound", () => missing(input.path, target.absolute)))
+              const content =
+                type === "directory"
+                  ? yield* reader.list(absolute, { offset: input.offset, limit: input.limit })
+                  : yield* reader.read(absolute, resource, {
+                      offset: input.offset,
+                      limit: input.limit,
+                    })
+              // After a successful read, discover nearby AGENTS.md walking up to the Location
+              // root exclusive and inject them as durable synthetic instructions. For a
+              // directory listing the walk starts at the directory itself (so its own AGENTS.md
+              // is discovered); for a file it starts at the file's dirname. External reads are
+              // skipped, and discovery failures never fail the read.
+              yield* Effect.gen(function* () {
+                if (target.externalDirectory !== undefined) return
+                const resolved = yield* fs.resolve(target.absolute)
+                const root = yield* fs.resolve(location.directory)
+                // up() searches its stop directory, so the Location-root AGENTS.md (already
+                // supplied by core initial instructions) is dropped by the dirname filter.
+                const discovered = yield* fs.up({
+                  targets: [FILENAME],
+                  start: type === "directory" ? resolved : dirname(resolved),
+                  stop: root,
+                })
+                const candidates = (yield* Effect.forEach(discovered, fs.resolve)).filter(
+                  (file) => dirname(file) !== root,
                 )
-                const content =
-                  type === "directory"
-                    ? yield* reader.list(absolute, { offset: input.offset, limit: input.limit })
-                    : yield* reader.read(absolute, resource, {
-                        offset: input.offset,
-                        limit: input.limit,
-                      })
-                // After a successful read, discover nearby AGENTS.md walking up to the Location
-                // root exclusive and inject them as durable synthetic instructions. For a
-                // directory listing the walk starts at the directory itself (so its own AGENTS.md
-                // is discovered); for a file it starts at the file's dirname. External reads are
-                // skipped, and discovery failures never fail the read.
-                yield* Effect.gen(function* () {
-                  if (target.externalDirectory !== undefined) return
-                  const resolved = yield* fs.resolve(target.canonical)
-                  const root = yield* fs.resolve(location.directory)
-                  // up() searches its stop directory, so the Location-root AGENTS.md (already
-                  // supplied by core initial instructions) is dropped by the dirname filter.
-                  const discovered = yield* fs.up({
-                    targets: [FILENAME],
-                    start: type === "directory" ? resolved : dirname(resolved),
-                    stop: root,
-                  })
-                  const candidates = (yield* Effect.forEach(discovered, fs.resolve)).filter(
-                    (file) => dirname(file) !== root,
-                  )
-                  if (candidates.length === 0) return
-                  yield* sessionInstructions.load({ sessionID: context.sessionID, paths: candidates })
-                }).pipe(
-                  Effect.catch(() => Effect.void),
-                  Effect.catchDefect(() => Effect.void),
-                )
-                if (content.type === "file" && content.encoding === "base64" && !SUPPORTED_MEDIA_MIMES.has(content.mime))
-                  return yield* Effect.fail(new ReadToolFileSystem.BinaryFileError({ resource }))
-                return content
+                if (candidates.length === 0) return
+                yield* sessionInstructions.load({ sessionID: context.sessionID, paths: candidates })
               }).pipe(
-                Effect.map((output) => ({
-                  output,
-                  content: toModelContent(input.path, input.offset, output),
-                })),
-                Effect.mapError((error) => {
-                  if (error instanceof ToolFailure) return error
-                  const message =
-                    error instanceof ReadToolFileSystem.BinaryFileError ||
-                    error instanceof ReadToolFileSystem.MediaIngestLimitError ||
-                    error instanceof ReadToolFileSystem.MalformedUtf8Error ||
-                    error instanceof ReadToolFileSystem.OffsetOutOfRangeError ||
-                    error instanceof ReadToolFileSystem.PathKindError
-                      ? error.message
-                      : `Unable to read ${input.path}`
-                  return new ToolFailure({ message, error })
-                }),
+                Effect.catch(() => Effect.void),
+                Effect.catchDefect(() => Effect.void),
               )
-            },
-          }),
-        ),
+              if (content.type === "file" && content.encoding === "base64" && !SUPPORTED_MEDIA_MIMES.has(content.mime))
+                return yield* Effect.fail(new ReadToolFileSystem.BinaryFileError({ resource }))
+              return content
+            }).pipe(
+              Effect.map((output) => ({
+                output,
+                content: toModelContent(input.path, input.offset, output),
+              })),
+              Effect.mapError((error) => {
+                if (error instanceof ToolFailure) return error
+                const message =
+                  error instanceof ReadToolFileSystem.BinaryFileError ||
+                  error instanceof ReadToolFileSystem.MediaIngestLimitError ||
+                  error instanceof ReadToolFileSystem.OffsetOutOfRangeError ||
+                  error instanceof ReadToolFileSystem.PathKindError
+                    ? error.message
+                    : `Unable to read ${input.path}`
+                return new ToolFailure({ message, error })
+              }),
+            )
+          },
+        }),
       )
       .pipe(Effect.orDie)
 
-    const missing = Effect.fn("ReadTool.missing")(function* (input: string, canonical: string) {
+    const missing = Effect.fn("ReadTool.missing")(function* (input: string, absolute: string) {
       const base = basename(input).toLowerCase()
-      const suggestions = yield* fs.readDirectory(dirname(canonical)).pipe(
+      const suggestions = yield* fs.readDirectory(dirname(absolute)).pipe(
         Effect.map((entries) =>
           entries
             .filter((entry) => {

packages/core/src/tool/plugin/shell.ts

@@ -122,174 +122,176 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-            name,
-            options: { codemode: false },
-            description: description(),
-            input: Input,
-            output: Output,
-            execute: (input, context) =>
-              Effect.gen(function* () {
-                const source = {
-                  type: "tool" as const,
-                  messageID: context.messageID,
-                  id: context.id,
-                }
-                const timeout = input.background === true ? (input.timeout ?? 0) : (input.timeout ?? DEFAULT_TIMEOUT_MS)
-                let finalTimeout = timeout
-                const info = yield* shell.create(
-                  {
-                    command: input.command,
-                    cwd: input.workdir,
-                    timeout,
-                    metadata: { sessionID: context.sessionID },
-                  },
-                  (invocation) =>
-                    Effect.gen(function* () {
-                      const target = yield* mutation.resolve({ path: invocation.cwd, kind: "directory" })
-                      const parsed = yield* ShellParse.scan(invocation.command, invocation.shell, target.canonical)
-                      const directories = yield* Effect.forEach(parsed.directories, (directory) =>
-                        mutation.resolve({ path: path.resolve(target.canonical, directory), kind: "directory" }),
+        draft.add({
+          name,
+          options: { codemode: false },
+          description: description(),
+          input: Input,
+          output: Output,
+          execute: (input, context) =>
+            Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              const timeout = input.background === true ? (input.timeout ?? 0) : (input.timeout ?? DEFAULT_TIMEOUT_MS)
+              let finalTimeout = timeout
+              const info = yield* shell.create(
+                {
+                  command: input.command,
+                  cwd: input.workdir,
+                  timeout,
+                  metadata: { sessionID: context.sessionID },
+                },
+                (invocation) =>
+                  Effect.gen(function* () {
+                    const target = yield* mutation.resolve({ path: invocation.cwd, kind: "directory" })
+                    const parsed = yield* ShellParse.scan(invocation.command, invocation.shell, target.absolute)
+                    const directories = yield* Effect.forEach(parsed.directories, (directory) =>
+                      mutation.resolve({ path: path.resolve(target.absolute, directory), kind: "directory" }),
+                    )
+                    invocation.cwd = target.absolute
+                    finalTimeout = invocation.timeout
+                    const external = [target, ...directories]
+                      .map((item) => item.externalDirectory)
+                      .filter((item) => item !== undefined)
+                      .filter(
+                        (item, index, items) => items.findIndex((other) => other.resource === item.resource) === index,
                       )
-                      invocation.cwd = target.canonical
-                      finalTimeout = invocation.timeout
-                      const external = [target, ...directories]
-                        .map((item) => item.externalDirectory)
-                        .filter((item) => item !== undefined)
-                        .filter((item, index, items) => items.findIndex((other) => other.resource === item.resource) === index)
-                      if (external.length > 0)
-                        yield* permission.assert({
-                          action: "external_directory",
-                          resources: external.map((item) => item.resource),
-                          save: external.map((item) => item.save),
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      if (parsed.commands.length > 0)
-                        yield* permission.assert({
-                          action: name,
-                          resources: parsed.commands.map((command) => command.resource),
-                          save: parsed.commands.map((command) => command.save),
-                          sessionID: context.sessionID,
-                          agent: context.agent,
-                          source,
-                        })
-                      const workdir = yield* fsUtil.stat(target.canonical).pipe(
+                    if (external.length > 0)
+                      yield* permission.assert({
+                        action: "external_directory",
+                        resources: external.map((item) => item.resource),
+                        save: external.map((item) => item.save),
+                        sessionID: context.sessionID,
+                        agent: context.agent,
+                        source,
+                      })
+                    if (parsed.commands.length > 0)
+                      yield* permission.assert({
+                        action: name,
+                        resources: parsed.commands.map((command) => command.resource),
+                        save: parsed.commands.map((command) => command.save),
+                        sessionID: context.sessionID,
+                        agent: context.agent,
+                        source,
+                      })
+                    const workdir = yield* fsUtil
+                      .stat(target.absolute)
+                      .pipe(
                         Effect.catchReason("PlatformError", "NotFound", () =>
-                          Effect.fail(new Error(`Working directory does not exist: ${target.canonical}`)),
+                          Effect.fail(new Error(`Working directory does not exist: ${target.absolute}`)),
                         ),
                       )
-                      if (workdir.type !== "Directory")
-                        return yield* Effect.fail(new Error(`Working directory is not a directory: ${target.canonical}`))
-                    }),
-                )
-                yield* context.progress({ shellID: info.id })
+                    if (workdir.type !== "Directory")
+                      return yield* Effect.fail(new Error(`Working directory is not a directory: ${target.absolute}`))
+                  }),
+              )
+              yield* context.progress({ shellID: info.id })
 
-                const captureShell = Effect.fn("ShellTool.captureShell")(function* () {
-                  const latest = yield* shell.output(info.id, { cursor: Number.MAX_SAFE_INTEGER })
-                  const truncated = latest.size > MAX_CAPTURE_BYTES
-                  const page = yield* shell.output(info.id, {
-                    cursor: Math.max(0, latest.size - MAX_CAPTURE_BYTES),
-                    limit: MAX_CAPTURE_BYTES,
-                  })
-                  const notice = truncated ? `\n\n[output truncated; full output saved to: ${info.file}]` : ""
-                  return {
-                    output: `${page.output || "(no output)"}${notice}`,
-                    truncated,
-                  }
+              const captureShell = Effect.fn("ShellTool.captureShell")(function* () {
+                const latest = yield* shell.output(info.id, { cursor: Number.MAX_SAFE_INTEGER })
+                const truncated = latest.size > MAX_CAPTURE_BYTES
+                const page = yield* shell.output(info.id, {
+                  cursor: Math.max(0, latest.size - MAX_CAPTURE_BYTES),
+                  limit: MAX_CAPTURE_BYTES,
                 })
+                const notice = truncated ? `\n\n[output truncated; full output saved to: ${info.file}]` : ""
+                return {
+                  output: `${page.output || "(no output)"}${notice}`,
+                  truncated,
+                }
+              })
 
-                const settleShell = Effect.fn("ShellTool.settleShell")(function* () {
-                  const final = yield* shell.wait(info.id)
-                  const capture = yield* captureShell()
-
-                  // `exit` is optionalKey in the Output schema; a present-but-undefined key
-                  // fails output encoding, so omit it when the process has no exit code.
-                  if (final.status === "timeout") {
-                    return {
-                      ...(final.exit !== undefined ? { exit: final.exit } : {}),
-                      output: `${capture.output}\n\nCommand exceeded timeout of ${finalTimeout} ms. Retry with a larger timeout if the command is expected to take longer.`,
-                      truncated: capture.truncated,
-                      timeout: true,
-                      status: "completed" as const,
-                    }
-                  }
+              const settleShell = Effect.fn("ShellTool.settleShell")(function* () {
+                const final = yield* shell.wait(info.id)
+                const capture = yield* captureShell()
 
+                // `exit` is optionalKey in the Output schema; a present-but-undefined key
+                // fails output encoding, so omit it when the process has no exit code.
+                if (final.status === "timeout") {
                   return {
                     ...(final.exit !== undefined ? { exit: final.exit } : {}),
-                    output: capture.output,
+                    output: `${capture.output}\n\nCommand exceeded timeout of ${finalTimeout} ms. Retry with a larger timeout if the command is expected to take longer.`,
                     truncated: capture.truncated,
+                    timeout: true,
                     status: "completed" as const,
                   }
-                })
-
-                const settled = yield* Deferred.make<Output>()
-                const run = settleShell().pipe(
-                  Effect.tap((output) => Deferred.succeed(settled, output)),
-                  Effect.map((output) => output.output),
-                  Effect.onInterrupt(() => shell.remove(info.id).pipe(Effect.ignore)),
-                )
-                const job = yield* runtime.job.start({
-                  id: context.id,
-                  type: name,
-                  title: info.command,
-                  metadata: { sessionID: context.sessionID, shellID: info.id },
-                  run,
-                })
-
-                if (input.background === true) {
-                  yield* runtime.job.background(job.id)
-                  yield* notifyWhenDone(context.sessionID, context.id, info.command)
-                  return {
-                    output: BACKGROUND_STARTED,
-                    shellID: info.id,
-                    truncated: false,
-                    status: "running" as const,
-                  }
                 }
 
-                const result = yield* runtime.job.block({ id: job.id, sessionID: context.sessionID }).pipe(
-                  Effect.onInterrupt(() => runtime.job.cancel(job.id).pipe(Effect.ignore)),
-                )
-                if (result?.type === "backgrounded") {
-                  yield* shell.timeout(info.id, 0)
-                  yield* notifyWhenDone(context.sessionID, context.id, info.command)
-                  return {
-                    output: BACKGROUND_STARTED,
-                    shellID: info.id,
-                    truncated: false,
-                    status: "running" as const,
-                  }
+                return {
+                  ...(final.exit !== undefined ? { exit: final.exit } : {}),
+                  output: capture.output,
+                  truncated: capture.truncated,
+                  status: "completed" as const,
                 }
-                if (result?.info.status === "error")
-                  return yield* Effect.fail(new Error(result.info.error ?? "Command failed"))
-                if (result?.info.status === "cancelled") return yield* Effect.fail(new Error("Command cancelled"))
+              })
 
-                return yield* Deferred.await(settled)
-              }).pipe(
-                Effect.map((output) => {
-                  const content: Array<Content> = [{ type: "text", text: output.output }]
-                  const model = modelOutput(output)
-                  if (model) content.push({ type: "text", text: model })
-                  return {
-                    output,
-                    content,
-                    metadata: {
-                      truncated: output.truncated,
-                      ...("exit" in output && output.exit !== undefined ? { exit: output.exit } : {}),
-                      ...("shellID" in output && output.shellID !== undefined ? { shellID: output.shellID } : {}),
-                      ...("timeout" in output && output.timeout !== undefined ? { timeout: output.timeout } : {}),
-                    },
-                  }
-                }),
-                Effect.mapError(
-                  (error) => new ToolFailure({ message: `Unable to execute command: ${input.command}`, error }),
-                ),
+              const settled = yield* Deferred.make<Output>()
+              const run = settleShell().pipe(
+                Effect.tap((output) => Deferred.succeed(settled, output)),
+                Effect.map((output) => output.output),
+                Effect.onInterrupt(() => shell.remove(info.id).pipe(Effect.ignore)),
+              )
+              const job = yield* runtime.job.start({
+                id: context.id,
+                type: name,
+                title: info.command,
+                metadata: { sessionID: context.sessionID, shellID: info.id },
+                run,
+              })
+
+              if (input.background === true) {
+                yield* runtime.job.background(job.id)
+                yield* notifyWhenDone(context.sessionID, context.id, info.command)
+                return {
+                  output: BACKGROUND_STARTED,
+                  shellID: info.id,
+                  truncated: false,
+                  status: "running" as const,
+                }
+              }
+
+              const result = yield* runtime.job
+                .block({ id: job.id, sessionID: context.sessionID })
+                .pipe(Effect.onInterrupt(() => runtime.job.cancel(job.id).pipe(Effect.ignore)))
+              if (result?.type === "backgrounded") {
+                yield* shell.timeout(info.id, 0)
+                yield* notifyWhenDone(context.sessionID, context.id, info.command)
+                return {
+                  output: BACKGROUND_STARTED,
+                  shellID: info.id,
+                  truncated: false,
+                  status: "running" as const,
+                }
+              }
+              if (result?.info.status === "error")
+                return yield* Effect.fail(new Error(result.info.error ?? "Command failed"))
+              if (result?.info.status === "cancelled") return yield* Effect.fail(new Error("Command cancelled"))
+
+              return yield* Deferred.await(settled)
+            }).pipe(
+              Effect.map((output) => {
+                const content: Array<Content> = [{ type: "text", text: output.output }]
+                const model = modelOutput(output)
+                if (model) content.push({ type: "text", text: model })
+                return {
+                  output,
+                  content,
+                  metadata: {
+                    truncated: output.truncated,
+                    ...("exit" in output && output.exit !== undefined ? { exit: output.exit } : {}),
+                    ...("shellID" in output && output.shellID !== undefined ? { shellID: output.shellID } : {}),
+                    ...("timeout" in output && output.timeout !== undefined ? { timeout: output.timeout } : {}),
+                  },
+                }
+              }),
+              Effect.mapError(
+                (error) => new ToolFailure({ message: `Unable to execute command: ${input.command}`, error }),
               ),
-          }),
-        ),
+            ),
+        }),
       )
       .pipe(Effect.orDie)
 

packages/core/src/tool/plugin/write.ts

@@ -54,59 +54,52 @@ export const Plugin = {
 
     yield* ctx.tool
       .transform((draft) =>
-        draft.add(
-          ({
-              name,
-              options: { codemode: false, permission: "edit" },
-              description:
-                "Writes a file to the local filesystem, overwriting if one exists.\n\nMissing parent directories are created automatically.\n\nUse this tool to create new files or overwrite existing files. For partial changes, use the edit tool instead.",
-              input: Input,
-              output: Output,
-              execute: (input, context) =>
-                Effect.gen(function* () {
-                  const source = {
-                    type: "tool" as const,
-                    messageID: context.messageID,
-                    id: context.id,
-                  }
-                  const target = yield* mutation.resolve({ path: input.path, kind: "file" })
-                  const external = target.externalDirectory
-                  if (external)
-                    yield* permission.assert({
-                      ...LocationMutation.externalDirectoryPermission(external),
-                      sessionID: context.sessionID,
-                      agent: context.agent,
-                      source,
-                    })
-                  const current = yield* Bom.readFile(fs, target.canonical).pipe(
-                    Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)),
-                  )
-                  const next = Bom.split(input.content)
-                  const preview = fileDiff(
-                    target.resource,
-                    current?.text ?? "",
-                    next.text,
-                    current ? "modified" : "added",
-                  )
-                  yield* permission.assert({
-                    action: "edit",
-                    resources: [target.resource],
-                    save: ["*"],
-                    metadata: { files: [preview] },
-                    sessionID: context.sessionID,
-                    agent: context.agent,
-                    source,
-                  })
-                  const result = yield* files.writeTextPreservingBom({ target, content: input.content })
-                  const bom = (yield* Bom.readFile(fs, target.canonical)).bom
-                  if (yield* formatter.file(target.canonical)) yield* Bom.syncFile(fs, target.canonical, bom)
-                  return result
-                }).pipe(
-                  Effect.map((output) => ({ output, content: toModelOutput(output) })),
-                  Effect.mapError((error) => new ToolFailure({ message: `Unable to write ${input.path}`, error })),
-                ),
-            }),
-        ),
+        draft.add({
+          name,
+          options: { codemode: false, permission: "edit" },
+          description:
+            "Writes a file to the local filesystem, overwriting if one exists.\n\nMissing parent directories are created automatically.\n\nUse this tool to create new files or overwrite existing files. For partial changes, use the edit tool instead.",
+          input: Input,
+          output: Output,
+          execute: (input, context) =>
+            Effect.gen(function* () {
+              const source = {
+                type: "tool" as const,
+                messageID: context.messageID,
+                id: context.id,
+              }
+              const target = yield* mutation.resolve({ path: input.path, kind: "file" })
+              const external = target.externalDirectory
+              if (external)
+                yield* permission.assert({
+                  ...LocationMutation.externalDirectoryPermission(external),
+                  sessionID: context.sessionID,
+                  agent: context.agent,
+                  source,
+                })
+              const current = yield* Bom.readFile(fs, target.absolute).pipe(
+                Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(undefined)),
+              )
+              const next = Bom.split(input.content)
+              const preview = fileDiff(target.resource, current?.text ?? "", next.text, current ? "modified" : "added")
+              yield* permission.assert({
+                action: "edit",
+                resources: [target.resource],
+                save: ["*"],
+                metadata: { files: [preview] },
+                sessionID: context.sessionID,
+                agent: context.agent,
+                source,
+              })
+              const result = yield* files.writeTextPreservingBom({ target, content: input.content })
+              const bom = (yield* Bom.readFile(fs, target.absolute)).bom
+              if (yield* formatter.file(target.absolute)) yield* Bom.syncFile(fs, target.absolute, bom)
+              return result
+            }).pipe(
+              Effect.map((output) => ({ output, content: toModelOutput(output) })),
+              Effect.mapError((error) => new ToolFailure({ message: `Unable to write ${input.path}`, error })),
+            ),
+        }),
       )
       .pipe(Effect.orDie)
   }),

packages/core/src/tool/read-filesystem.ts

@@ -34,14 +34,6 @@ export class MediaIngestLimitError extends Schema.TaggedErrorClass<MediaIngestLi
   }
 }
 
-export class MalformedUtf8Error extends Schema.TaggedErrorClass<MalformedUtf8Error>()("ReadTool.MalformedUtf8Error", {
-  resource: Schema.String,
-}) {
-  override get message() {
-    return `File is not valid UTF-8: ${this.resource}`
-  }
-}
-
 export class OffsetOutOfRangeError extends Schema.TaggedErrorClass<OffsetOutOfRangeError>()(
   "ReadTool.OffsetOutOfRangeError",
   { offset: Schema.Number },
@@ -61,13 +53,7 @@ export class PathKindError extends Schema.TaggedErrorClass<PathKindError>()("Rea
 }
 
 export type InspectError = FSUtil.Error | PathKindError
-export type ReadError =
-  | FSUtil.Error
-  | BinaryFileError
-  | MediaIngestLimitError
-  | MalformedUtf8Error
-  | OffsetOutOfRangeError
-  | PathKindError
+export type ReadError = FSUtil.Error | BinaryFileError | MediaIngestLimitError | OffsetOutOfRangeError | PathKindError
 
 export const PageInput = Schema.Struct({
   offset: Schema.optionalKey(NonNegativeInt),
@@ -90,9 +76,15 @@ export class TextPage extends Schema.Class<TextPage>("ReadTool.TextPage")({
   next: Schema.optionalKey(PositiveInt),
 }) {}
 
+export interface ListEntry extends Schema.Schema.Type<typeof ListEntry> {}
+export const ListEntry = Schema.Struct({
+  path: RelativePath,
+  type: Schema.Literals(["file", "directory", "symlink"]),
+}).annotate({ identifier: "ReadTool.ListEntry" })
+
 export class ListPage extends Schema.Class<ListPage>("ReadTool.ListPage")({
   type: Schema.Literal("list-page"),
-  entries: Schema.Array(FileSystem.Entry),
+  entries: Schema.Array(ListEntry),
   truncated: Schema.Boolean,
   next: Schema.optionalKey(PositiveInt),
 }) {}
@@ -109,36 +101,6 @@ export interface Interface {
 
 export class Service extends Context.Service<Service, Interface>()("@opencode/ReadToolFileSystem") {}
 
-const extensions = new Set([
-  ".zip",
-  ".tar",
-  ".gz",
-  ".exe",
-  ".dll",
-  ".so",
-  ".class",
-  ".jar",
-  ".war",
-  ".7z",
-  ".doc",
-  ".docx",
-  ".xls",
-  ".xlsx",
-  ".ppt",
-  ".pptx",
-  ".odt",
-  ".ods",
-  ".odp",
-  ".bin",
-  ".dat",
-  ".obj",
-  ".o",
-  ".a",
-  ".lib",
-  ".wasm",
-  ".pyc",
-  ".pyo",
-])
 const startsWith = (bytes: Uint8Array, prefix: number[]) => prefix.every((value, index) => bytes[index] === value)
 const mediaMime = (bytes: Uint8Array) => {
   if (startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) return "image/png"
@@ -148,8 +110,7 @@ const mediaMime = (bytes: Uint8Array) => {
     return "image/webp"
   if (startsWith(bytes, [0x25, 0x50, 0x44, 0x46, 0x2d])) return "application/pdf"
 }
-const binary = (resource: string, bytes: Uint8Array) => {
-  if (extensions.has(path.extname(resource).toLowerCase())) return true
+const binary = (bytes: Uint8Array) => {
   if (bytes.length === 0) return false
   let nonPrintable = 0
   for (const byte of bytes) {
@@ -158,16 +119,9 @@ const binary = (resource: string, bytes: Uint8Array) => {
   }
   return nonPrintable / bytes.length > 0.3
 }
-const decodeUtf8 = (resource: string, decoder: TextDecoder, bytes?: Uint8Array) =>
-  Effect.try({
-    try: () => decoder.decode(bytes, { stream: bytes !== undefined }),
-    catch: (error) => {
-      if (error instanceof TypeError) return new MalformedUtf8Error({ resource })
-      throw error
-    },
-  })
+const decodeUtf8 = (decoder: TextDecoder, bytes?: Uint8Array) => decoder.decode(bytes, { stream: bytes !== undefined })
 const decodeChunk = (resource: string, decoder: TextDecoder, bytes: Uint8Array) =>
-  bytes.includes(0) ? Effect.fail(new BinaryFileError({ resource })) : decodeUtf8(resource, decoder, bytes)
+  bytes.includes(0) ? Effect.fail(new BinaryFileError({ resource })) : Effect.succeed(decodeUtf8(decoder, bytes))
 
 export const inspect = Effect.fn("ReadTool.inspect")(function* (fs: FSUtil.Interface, input: string) {
   const info = yield* fs.stat(input)
@@ -218,19 +172,17 @@ export const read = Effect.fn("ReadTool.read")(function* (
           mime,
         }
       }
-      if (extensions.has(path.extname(resource).toLowerCase()))
-        return yield* Effect.fail(new BinaryFileError({ resource }))
       const paged = info.size > MAX_READ_BYTES || page.offset !== undefined || page.limit !== undefined
       if (!paged) {
-        if (binary(resource, first)) return yield* Effect.fail(new BinaryFileError({ resource }))
-        const decoder = new TextDecoder("utf-8", { fatal: true })
-        const text = [yield* decodeUtf8(resource, decoder, first)]
+        if (binary(first)) return yield* Effect.fail(new BinaryFileError({ resource }))
+        const decoder = new TextDecoder()
+        const text = [decodeUtf8(decoder, first)]
         while (true) {
           const chunk = yield* file.readAlloc(64 * 1024)
           if (Option.isNone(chunk)) break
           text.push(yield* decodeChunk(resource, decoder, chunk.value))
         }
-        text.push(yield* decodeUtf8(resource, decoder))
+        text.push(decodeUtf8(decoder))
         return {
           type: "file" as const,
           uri: pathToFileURL(real).href,
@@ -243,7 +195,7 @@ export const read = Effect.fn("ReadTool.read")(function* (
       const offset = page.offset || 1
       const limit = Math.min(page.limit || MAX_READ_LINES, MAX_READ_LINES)
       const lines: string[] = []
-      const decoder = new TextDecoder("utf-8", { fatal: true })
+      const decoder = new TextDecoder()
       let pending = ""
       let discard = false
       let line = 1
@@ -301,8 +253,8 @@ export const read = Effect.fn("ReadTool.read")(function* (
           const newline = chunk.indexOf(10, start)
           const end = newline === -1 ? chunk.length : newline + 1
           const segment = chunk.subarray(start, end)
-          if (binary(resource, segment)) return yield* Effect.fail(new BinaryFileError({ resource }))
-          if (!consume(yield* decodeUtf8(resource, decoder, segment))) return false
+          if (binary(segment)) return yield* Effect.fail(new BinaryFileError({ resource }))
+          if (!consume(decodeUtf8(decoder, segment))) return false
           start = end
         }
         return true
@@ -314,7 +266,7 @@ export const read = Effect.fn("ReadTool.read")(function* (
         done = !(yield* consumeChunk(chunk.value))
       }
       if (!done) {
-        const tail = yield* decodeUtf8(resource, decoder)
+        const tail = decodeUtf8(decoder)
         if (!discard) pending += tail
         if (pending) append(pending.endsWith("\r") ? pending.slice(0, -1) : pending)
       }
@@ -336,26 +288,26 @@ export const list = Effect.fn("ReadTool.list")(function* (fs: FSUtil.Interface,
   const items = yield* fs.readDirectoryEntries(real)
   const offset = page.offset || 1
   const limit = Math.min(page.limit || MAX_READ_LINES, MAX_READ_LINES)
-  const entries = yield* Effect.forEach(
-    items,
-    (item) =>
-      Effect.gen(function* () {
-        const absolute = path.join(real, item.name)
-        const target = yield* fs.realPath(absolute).pipe(Effect.catch(() => Effect.void))
-        if (!target || !FSUtil.contains(real, target)) return
-        const info = yield* fs.stat(target).pipe(Effect.catch(() => Effect.void))
-        const type = info?.type === "Directory" ? "directory" : info?.type === "File" ? "file" : undefined
-        if (!type) return
-        return FileSystem.Entry.make({
-          path: RelativePath.make(item.name + (type === "directory" ? path.sep : "")),
-          type,
-        })
-      }),
-    { concurrency: 16 },
-  )
-  const visible = entries
-    .filter((item): item is FileSystem.Entry => item !== undefined)
-    .sort((a, b) => (a.type === b.type ? a.path.localeCompare(b.path) : a.type === "directory" ? -1 : 1))
+  const visible = items
+    .flatMap((item) =>
+      item.type === "other"
+        ? []
+        : [
+            ListEntry.make({
+              path: RelativePath.make(item.name + (item.type === "directory" ? path.sep : "")),
+              type: item.type,
+            }),
+          ],
+    )
+    .sort((a, b) =>
+      a.type === "directory"
+        ? b.type === "directory"
+          ? a.path.localeCompare(b.path)
+          : -1
+        : b.type === "directory"
+          ? 1
+          : a.path.localeCompare(b.path),
+    )
   const selected = visible.slice(offset - 1, offset - 1 + limit)
   const truncated = offset - 1 + selected.length < visible.length
   return new ListPage({

packages/core/src/v1/config/migrate.ts

@@ -119,8 +119,16 @@ function agents(info: typeof ConfigV1.Info.Type) {
     ...Object.entries(info.agent ?? {}),
     ...Object.entries(info.mode ?? {}).map(([name, agent]) => [name, { ...agent, mode: "primary" as const }] as const),
   ]
-  if (!entries.length) return undefined
-  return Object.fromEntries(entries.flatMap(([name, agent]) => (agent ? [[name, migrateAgent(agent)]] : [])))
+  const result = Object.fromEntries(entries.flatMap(([name, agent]) => (agent ? [[name, migrateAgent(agent)]] : [])))
+  const small = modelSelection(info.small_model)
+  if (!small) return entries.length ? result : undefined
+  return {
+    ...result,
+    title: {
+      model: small,
+      ...result.title,
+    },
+  }
 }
 
 export function migrateAgent(info: ConfigAgentV1.Info) {

packages/core/test/agent.test.ts

@@ -126,6 +126,7 @@ describe("Agent", () => {
 
       yield* agent.transform((editor) => editor.update(id, () => {}))
       const info = yield* agent.get(id)
+      expect(info?.mode).toBe("primary")
       expect(info?.permissions.slice(0, Agent.Info.default(id).permissions.length)).toEqual(
         Agent.Info.default(id).permissions,
       )

packages/core/test/config/config.test.ts

@@ -512,6 +512,20 @@ describe("Config", () => {
     }),
   )
 
+  it.effect("migrates the v1 small model to the title agent", () =>
+    Effect.sync(() => {
+      expect(
+        ConfigMigrateV1.migrate({
+          small_model: "anthropic/claude-haiku-4-5",
+          agent: { title: { prompt: "Custom title prompt" } },
+        }).agents?.title,
+      ).toEqual({
+        model: { providerID: "anthropic", model: "claude-haiku-4-5" },
+        system: "Custom title prompt",
+      })
+    }),
+  )
+
   it.effect("migrates v1 provider lists to policies", () =>
     Effect.sync(() => {
       expect(

packages/core/test/config/normalization.test.ts

@@ -149,6 +149,28 @@ describe("ConfigNormalize", () => {
     expect(() => Schema.decodeUnknownSync(Info)(result.encoded)).not.toThrow()
   })
 
+  test("migrates the legacy small model to the title agent", () => {
+    const result = normalized({
+      small_model: "anthropic/claude-haiku-4-5",
+      agent: { title: { prompt: "Custom title prompt" } },
+    })
+    expect(result.encoded.agents).toEqual({
+      title: {
+        model: { providerID: "anthropic", model: "claude-haiku-4-5" },
+        system: "Custom title prompt",
+      },
+    })
+    expect(result.diagnostics).toEqual([])
+  })
+
+  test("omits an invalid legacy small model without exposing its value", () => {
+    const secret = "do-not-log-this-value"
+    const result = normalized({ small_model: secret })
+    expect(result.encoded.agents).toBeUndefined()
+    expect(result.diagnostics.map((item) => [item.kind, item.path])).toEqual([["unsupported", ["small_model"]]])
+    expect(JSON.stringify(result.diagnostics)).not.toContain(secret)
+  })
+
   test("recovers malformed named entries and retains a valid legacy collision", () => {
     const result = normalized({
       command: { fallback: { template: "legacy" } },
@@ -390,7 +412,6 @@ describe("ConfigNormalize", () => {
     const secret = "do-not-log-this-value"
     const result = normalized({
       logLevel: "DEBUG",
-      small_model: secret,
       agent: { reviewer: { name: secret, prompt: "review" } },
       provider: {
         custom: {
@@ -409,7 +430,6 @@ describe("ConfigNormalize", () => {
     })
     expect(result.diagnostics.filter((item) => item.kind === "unsupported").map((item) => item.path)).toEqual([
       ["logLevel"],
-      ["small_model"],
       ["agent", "reviewer", "name"],
       ["provider", "custom", "id"],
       ["provider", "custom", "whitelist"],

packages/core/test/file-mutation.test.ts

@@ -43,7 +43,7 @@ describe("FileMutation", () => {
 
         expect(yield* (yield* FileMutation.Service).write({ target, content: "after" })).toEqual({
           operation: "write",
-          target: target.canonical,
+          target: target.absolute,
           resource: "hello.txt",
           existed: true,
         })
@@ -62,11 +62,11 @@ describe("FileMutation", () => {
 
         expect(result).toEqual({
           operation: "write",
-          target: target.canonical,
+          target: target.absolute,
           resource: "src/nested/hello.txt",
           existed: false,
         })
-        expect(yield* Effect.promise(() => fs.readFile(result.target, "utf8"))).toBe("hello")
+        expect(yield* Effect.promise(() => fs.readFile(target.absolute, "utf8"))).toBe("hello")
       }).pipe(provide(directory)),
     ),
   )
@@ -84,7 +84,7 @@ describe("FileMutation", () => {
         yield* files.writeTextPreservingBom({ target: created, content: "\uFEFF\uFEFF\uFEFFcreated" })
 
         expect(yield* Effect.promise(() => fs.readFile(preservedPath, "utf8"))).toBe("\uFEFFafter")
-        expect(yield* Effect.promise(() => fs.readFile(created.canonical, "utf8"))).toBe("\uFEFFcreated")
+        expect(yield* Effect.promise(() => fs.readFile(created.absolute, "utf8"))).toBe("\uFEFFcreated")
       }).pipe(provide(directory)),
     ),
   )
@@ -99,7 +99,7 @@ describe("FileMutation", () => {
 
           expect(result).toEqual({
             operation: "write",
-            target: target.canonical,
+            target: target.absolute,
             resource: target.resource,
             existed: false,
           })
@@ -109,7 +109,7 @@ describe("FileMutation", () => {
     ),
   )
 
-  it.live("serializes concurrent writes to the same canonical target", () =>
+  it.live("serializes concurrent writes to the same absolute target", () =>
     withTmp((directory) =>
       Effect.gen(function* () {
         const targetPath = path.join(directory, "shared.txt")
@@ -152,7 +152,7 @@ describe("FileMutation", () => {
     ),
   )
 
-  it.live("allows distinct canonical targets to proceed independently", () =>
+  it.live("allows distinct absolute targets to proceed independently", () =>
     withTmp((directory) =>
       Effect.gen(function* () {
         const firstStarted = yield* Deferred.make<void>()

packages/core/test/location-mutation.test.ts

@@ -37,7 +37,7 @@ describe("LocationMutation", () => {
         const target = yield* (yield* LocationMutation.Service).resolve({ path: "hello.txt" })
 
         expect(target).toMatchObject({
-          canonical: yield* Effect.promise(() => fs.realpath(targetPath)),
+          absolute: targetPath,
           resource: "hello.txt",
         })
         expect(target.externalDirectory).toBeUndefined()
@@ -50,10 +50,8 @@ describe("LocationMutation", () => {
       Effect.gen(function* () {
         yield* Effect.promise(() => fs.mkdir(path.join(directory, "src")))
         const target = yield* (yield* LocationMutation.Service).resolve({ path: path.join("src", "new.txt") })
-        const root = yield* Effect.promise(() => fs.realpath(directory))
-
         expect(target).toMatchObject({
-          canonical: path.join(root, "src", "new.txt"),
+          absolute: path.join(directory, "src", "new.txt"),
           resource: "src/new.txt",
         })
       }).pipe(provide(directory)),
@@ -64,9 +62,9 @@ describe("LocationMutation", () => {
     withTmp((directory) =>
       Effect.gen(function* () {
         const target = yield* (yield* LocationMutation.Service).resolve({ path: "../outside.txt" })
-        const root = yield* Effect.promise(() => fs.realpath(path.dirname(directory)))
+        const root = path.dirname(directory)
         expect(target).toMatchObject({
-          canonical: path.join(root, "outside.txt"),
+          absolute: path.join(root, "outside.txt"),
           resource: path.join(root, "outside.txt").replaceAll("\\", "/"),
         })
         expect(target.externalDirectory).toMatchObject({
@@ -77,7 +75,7 @@ describe("LocationMutation", () => {
     ),
   )
 
-  it.live("authorizes a prospective target below an external symlink by its in-location path", () =>
+  it.live("resolves a prospective target below an external symlink lexically", () =>
     withTmp((directory) => {
       const outside = `${directory}-outside`
       return Effect.gen(function* () {
@@ -88,7 +86,7 @@ describe("LocationMutation", () => {
         })
         const target = yield* (yield* LocationMutation.Service).resolve({ path: path.join("escape", "new.txt") })
         expect(target).toMatchObject({
-          canonical: path.join(yield* Effect.promise(() => fs.realpath(outside)), "new.txt"),
+          absolute: path.join(directory, "escape", "new.txt"),
           resource: "escape/new.txt",
         })
         expect(target.externalDirectory).toBeUndefined()
@@ -107,7 +105,7 @@ describe("LocationMutation", () => {
         })
 
         expect(yield* (yield* LocationMutation.Service).resolve({ path: "linked/new.txt" })).toMatchObject({
-          canonical: path.join(yield* Effect.promise(() => fs.realpath(directory)), "actual", "new.txt"),
+          absolute: path.join(directory, "linked", "new.txt"),
           resource: "linked/new.txt",
         })
       }).pipe(provide(directory)),
@@ -120,7 +118,7 @@ describe("LocationMutation", () => {
         const targetPath = path.join(directory, "new.txt")
         const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
         expect(target).toMatchObject({
-          canonical: path.join(yield* Effect.promise(() => fs.realpath(directory)), "new.txt"),
+          absolute: targetPath,
           resource: "new.txt",
         })
         expect(target.externalDirectory).toBeUndefined()
@@ -134,9 +132,9 @@ describe("LocationMutation", () => {
         Effect.gen(function* () {
           const targetPath = path.join(outside, "new.txt")
           const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
-          const root = yield* Effect.promise(() => fs.realpath(outside))
+          const root = outside
           expect(target).toMatchObject({
-            canonical: path.join(root, "new.txt"),
+            absolute: path.join(root, "new.txt"),
             resource: path.join(root, "new.txt").replaceAll("\\", "/"),
           })
           expect(target.externalDirectory).toMatchObject({
@@ -155,24 +153,23 @@ describe("LocationMutation", () => {
           const targetPath = path.join(outside, "existing.txt")
           yield* Effect.promise(() => fs.writeFile(targetPath, "existing"))
           const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
-          const root = yield* Effect.promise(() => fs.realpath(outside))
-          expect(target).toMatchObject({ canonical: path.join(root, "existing.txt") })
-          expect(target.externalDirectory?.directory).toBe(root)
+          expect(target).toMatchObject({ absolute: targetPath })
+          expect(target.externalDirectory?.directory).toBe(outside)
         }).pipe(provide(directory)),
       ),
     ),
   )
 
-  it.live("anchors prospective external descendants at their stable existing directory", () =>
+  it.live("authorizes prospective external descendants at their lexical parent", () =>
     withTmp((directory) =>
       withTmp((outside) =>
         Effect.gen(function* () {
           const targetPath = path.join(outside, "new", "nested", "file.txt")
           const target = yield* (yield* LocationMutation.Service).resolve({ path: targetPath })
-          const root = yield* Effect.promise(() => fs.realpath(outside))
+          const parent = path.dirname(targetPath)
           expect(target.externalDirectory).toMatchObject({
-            directory: root,
-            resource: path.join(root, "*").replaceAll("\\", "/"),
+            directory: parent,
+            resource: path.join(parent, "*").replaceAll("\\", "/"),
           })
         }).pipe(provide(directory)),
       ),

packages/core/test/tool-read-filesystem.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect } from "bun:test"
+import fs from "fs/promises"
 import path from "path"
 import { Effect, FileSystem } from "effect"
 import { LayerNodePlatform } from "@opencode-ai/util/effect/app-node-platform"
@@ -50,22 +51,53 @@ describe("ReadToolFileSystem", () => {
     }),
   )
 
-  it.effect("reports binary and malformed UTF-8 content as typed errors", () =>
+  it.effect("reads malformed UTF-8 lossily and still rejects null-byte binary content", () =>
     Effect.gen(function* () {
       const { fs, files, directory } = yield* fixture
       const binary = path.join(directory, "archive.dat")
       const malformed = path.join(directory, "malformed.txt")
       yield* files.writeFile(binary, Uint8Array.of(0, 1, 2, 3))
-      const malformedContent = new Uint8Array(64 * 1024 + 1).fill(97)
-      malformedContent[64 * 1024] = 0x80
-      yield* files.writeFile(malformed, malformedContent)
+      yield* files.writeFile(malformed, Uint8Array.of(0x68, 0x69, 0x80))
 
       const binaryError = yield* ReadToolFileSystem.read(fs, binary, "archive.dat").pipe(Effect.flip)
-      const malformedError = yield* ReadToolFileSystem.read(fs, malformed, "malformed.txt").pipe(Effect.flip)
+      const malformedResult = yield* ReadToolFileSystem.read(fs, malformed, "malformed.txt")
 
       expect(binaryError).toBeInstanceOf(ReadToolFileSystem.BinaryFileError)
       expect(binaryError.message).toBe("Cannot read binary file: archive.dat")
-      expect(malformedError).toBeInstanceOf(ReadToolFileSystem.MalformedUtf8Error)
+      expect(malformedResult).toMatchObject({ type: "file", content: "hi\uFFFD", encoding: "utf8" })
+    }),
+  )
+
+  it.effect("reads text despite a binary-associated extension", () =>
+    Effect.gen(function* () {
+      const { fs, files, directory } = yield* fixture
+      const file = path.join(directory, "notes.docx")
+      yield* files.writeFileString(file, "plain text")
+
+      const result = yield* ReadToolFileSystem.read(fs, file, "notes.docx")
+
+      expect(result).toMatchObject({ type: "file", content: "plain text", encoding: "utf8" })
+    }),
+  )
+
+  it.effect("lists unresolved symlinks, including broken and escaping links", () =>
+    Effect.gen(function* () {
+      if (process.platform === "win32") return
+      const { fs: service, files, directory } = yield* fixture
+      const outside = yield* files.makeTempDirectoryScoped()
+      yield* files.makeDirectory(path.join(directory, "folder"))
+      yield* files.writeFileString(path.join(directory, "file.txt"), "hello")
+      yield* Effect.promise(() => fs.symlink(path.join(outside, "target.txt"), path.join(directory, "escape")))
+      yield* Effect.promise(() => fs.symlink(path.join(directory, "missing.txt"), path.join(directory, "broken")))
+
+      const result = yield* ReadToolFileSystem.list(service, directory)
+
+      expect(result.entries.map((entry) => ({ ...entry, path: String(entry.path) }))).toEqual([
+        { path: `folder${path.sep}`, type: "directory" },
+        { path: "broken", type: "symlink" },
+        { path: "escape", type: "symlink" },
+        { path: "file.txt", type: "file" },
+      ])
     }),
   )
 

packages/core/test/tool-read.test.ts

@@ -148,13 +148,13 @@ const mutation = Layer.succeed(
   LocationMutation.Service,
   LocationMutation.Service.of({
     resolve: (input) => {
-      const canonical = path.resolve(process.cwd(), input.path)
-      const external = path.isAbsolute(input.path) && !FSUtil.contains(process.cwd(), canonical)
-      const resource = external ? canonical.replaceAll("\\", "/") : path.relative(process.cwd(), canonical) || "."
-      const directory = path.dirname(canonical)
+      const absolute = path.resolve(process.cwd(), input.path)
+      const external = path.isAbsolute(input.path) && !FSUtil.contains(process.cwd(), absolute)
+      const resource = external ? absolute.replaceAll("\\", "/") : path.relative(process.cwd(), absolute) || "."
+      const directory = path.dirname(absolute)
       const externalResource = path.join(directory, "*").replaceAll("\\", "/")
       return Effect.succeed({
-        canonical,
+        absolute,
         resource,
         externalDirectory: external
           ? {
@@ -621,10 +621,6 @@ describe("ReadTool", () => {
     Effect.gen(function* () {
       const registry = yield* Tool.Service
       for (const [error, message] of [
-        [
-          new ReadToolFileSystem.MalformedUtf8Error({ resource: "invalid.txt" }),
-          "File is not valid UTF-8: invalid.txt",
-        ],
         [new ReadToolFileSystem.OffsetOutOfRangeError({ offset: 10 }), "Offset 10 is out of range"],
         [
           new ReadToolFileSystem.PathKindError({ resource: "socket", expected: "a file" }),
@@ -721,16 +717,19 @@ describe("ReadTool", () => {
       const registry = yield* Tool.Service
 
       const result = yield* executeTool(registry, {
-          sessionID,
-          ...toolIdentity,
-          call: {
-            type: "tool-call",
-            id: "call-read-directory",
-            name: "read",
-            input: { path: "src", offset: 2, limit: 10 },
-          },
-        })
-      expect(result).toMatchObject({ status: "completed", output: { entries: listResult.entries, truncated: true, next: 4 } })
+        sessionID,
+        ...toolIdentity,
+        call: {
+          type: "tool-call",
+          id: "call-read-directory",
+          name: "read",
+          input: { path: "src", offset: 2, limit: 10 },
+        },
+      })
+      expect(result).toMatchObject({
+        status: "completed",
+        output: { entries: listResult.entries, truncated: true, next: 4 },
+      })
       if (result.status !== "completed") return
       expect(result.content).toEqual([
         {

packages/core/test/tool-write.test.ts

@@ -90,13 +90,7 @@ const withTool = <A, E, R>(directory: string, body: (registry: Tool.Interface) =
   }).pipe(
     Effect.provide(
       AppNodeBuilder.build(
-        LayerNode.group([
-          Tool.node,
-          Tool.node,
-          LocationMutation.node,
-          FileMutation.node,
-          writeToolNode,
-        ]),
+        LayerNode.group([Tool.node, Tool.node, LocationMutation.node, FileMutation.node, writeToolNode]),
         [
           [FSUtil.node, filesystem],
           [Location.node, activeLocation],
@@ -230,7 +224,10 @@ describe("WriteTool", () => {
         const deduplicated = path.join(tmp.path, "deduplicated.txt")
         formatFile = (target) =>
           Effect.promise(async () => {
-            await fs.writeFile(target, `\uFEFF\uFEFF\uFEFF${(await fs.readFile(target, "utf8")).replace(/^\uFEFF+/, "")}`)
+            await fs.writeFile(
+              target,
+              `\uFEFF\uFEFF\uFEFF${(await fs.readFile(target, "utf8")).replace(/^\uFEFF+/, "")}`,
+            )
             return true
           })
         return Effect.promise(() =>
@@ -323,24 +320,22 @@ describe("WriteTool", () => {
         ).pipe(
           Effect.andThen((settled) =>
             Effect.gen(function* () {
-              const canonicalTarget = path.join(yield* Effect.promise(() => fs.realpath(outside.path)), "external.txt")
+              const absoluteTarget = target
               expect(assertions.map((input) => input.action)).toEqual(["external_directory", "edit"])
               expect(assertions[0]).toMatchObject({
-                resources: [
-                  path.join(yield* Effect.promise(() => fs.realpath(outside.path)), "*").replaceAll("\\", "/"),
-                ],
+                resources: [path.join(outside.path, "*").replaceAll("\\", "/")],
               })
-              expect(assertions[1]).toMatchObject({ resources: [canonicalTarget.replaceAll("\\", "/")], save: ["*"] })
+              expect(assertions[1]).toMatchObject({ resources: [absoluteTarget.replaceAll("\\", "/")], save: ["*"] })
               expect(settled).toMatchObject({
                 status: "completed",
                 output: {
-                  target: canonicalTarget,
-                  resource: canonicalTarget.replaceAll("\\", "/"),
+                  target: absoluteTarget,
+                  resource: absoluteTarget.replaceAll("\\", "/"),
                   existed: false,
                 },
               })
               expect(yield* Effect.promise(() => fs.readFile(target, "utf8"))).toBe("external")
-              expect(writes).toEqual([canonicalTarget])
+              expect(writes).toEqual([absoluteTarget])
             }),
           ),
         )
@@ -368,12 +363,10 @@ describe("WriteTool", () => {
           ),
           Effect.andThen(
             Effect.gen(function* () {
-              const canonicalRepo = yield* Effect.promise(() => fs.realpath(repo))
-              const canonicalNested = yield* Effect.promise(() => fs.realpath(nested))
               expect(assertions[0]).toMatchObject({
                 action: "external_directory",
-                resources: [path.join(canonicalNested, "*").replaceAll("\\", "/")],
-                save: [path.join(canonicalRepo, "*").replaceAll("\\", "/")],
+                resources: [path.join(nested, "*").replaceAll("\\", "/")],
+                save: [path.join(repo, "*").replaceAll("\\", "/")],
               })
             }),
           ),

packages/desktop/src/main/external-url.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, test } from "bun:test"
+import { isSafeExternalUrl } from "./external-url"
+
+describe("external URL policy", () => {
+  test.each(["https://opencode.ai", "http://127.0.0.1:4096", "mailto:hello@opencode.ai"])("allows %s", (url) =>
+    expect(isSafeExternalUrl(url)).toBe(true),
+  )
+
+  test.each(["file:///tmp/test", "javascript:alert(1)", "data:text/html,test", "vscode://file/tmp/test", "nope"])(
+    "rejects %s",
+    (url) => expect(isSafeExternalUrl(url)).toBe(false),
+  )
+
+  test("rejects non-string values", () => {
+    expect(isSafeExternalUrl(null)).toBe(false)
+    expect(isSafeExternalUrl({ toString: () => "https://opencode.ai" })).toBe(false)
+  })
+})

packages/desktop/src/main/external-url.ts

@@ -0,0 +1,6 @@
+const protocols = new Set(["http:", "https:", "mailto:"])
+
+export function isSafeExternalUrl(value: unknown) {
+  if (typeof value !== "string" || !URL.canParse(value)) return false
+  return protocols.has(new URL(value).protocol)
+}

packages/desktop/src/main/ipc.ts

@@ -8,6 +8,7 @@ import type { DesktopMenuAction } from "@opencode-ai/app/desktop-menu"
 import type { FatalRendererError, ServerReadyData, TitlebarTheme } from "../preload/types"
 import { runDesktopMenuAction } from "./desktop-menu-actions"
 import { setForceFocus } from "./debug"
+import { isSafeExternalUrl } from "./external-url"
 import { assertAttachmentBudget, createPickedFileAuthorizations } from "./attachment-picker"
 import { getStore, removeStoreFileIfEmpty } from "./store"
 import { getPinchZoomEnabled, getWindowID, setPinchZoomEnabled, setTitlebar, updateTitlebar } from "./windows"
@@ -178,6 +179,7 @@ export function registerIpcHandlers(deps: Deps) {
   )
 
   ipcMain.on("open-link", (_event: IpcMainEvent, url: string) => {
+    if (!isSafeExternalUrl(url)) return
     void shell.openExternal(url)
   })
 

packages/desktop/src/main/windows.ts

@@ -220,6 +220,11 @@ export function createMainWindow(id: string = randomUUID()) {
   state.manage(win)
   registerWindow(win, id)
   wireFullscreen(win)
+  win.webContents.on("will-frame-navigate", (event) => {
+    if (isRendererUrl(event.url)) return
+    event.preventDefault()
+  })
+  win.webContents.setWindowOpenHandler(() => ({ action: "deny" }))
   loadWindow(win, "index.html")
   wireZoom(win)
 

packages/schema/src/agent.ts

@@ -41,7 +41,7 @@ export const Info = Schema.Struct({
           id,
           name: Name.make(id),
           request: { settings: {}, headers: {}, body: {} },
-          mode: "all",
+          mode: "primary",
           hidden: false,
           permissions: [
             { action: "*", resource: "*", effect: "allow" },

packages/tui/src/context/data.tsx

@@ -15,6 +15,7 @@ import type {
   ModelInfo,
   PermissionSavedInfo,
   PermissionRequest,
+  PermissionReplyInput,
   Project,
   ProviderInfo,
   ReferenceInfo,
@@ -31,6 +32,7 @@ import type {
   OpenCodeEvent,
   WebSearchProvider,
 } from "@opencode-ai/client"
+import { isPermissionNotFoundError } from "@opencode-ai/client"
 import type { Plugin } from "@opencode-ai/plugin/tui"
 import { createStore, produce, reconcile } from "solid-js/store"
 import { createSimpleContext } from "./helper"
@@ -176,6 +178,17 @@ export const { use: useData, provider: DataProvider } = createSimpleContext({
       )
     }
 
+    function removePermission(sessionID: string, requestID: string) {
+      const requests = store.session.permission[sessionID]
+      if (!requests?.some((request) => request.id === requestID)) return
+      setStore(
+        "session",
+        "permission",
+        sessionID,
+        requests.filter((request) => request.id !== requestID),
+      )
+    }
+
     const message = {
       update(sessionID: string, fn: (messages: SessionMessageInfo[], index: Map<string, number>) => void) {
         setStore(
@@ -840,14 +853,7 @@ export const { use: useData, provider: DataProvider } = createSimpleContext({
           ])
           break
         case "permission.replied":
-          setStore(
-            "session",
-            "permission",
-            event.data.sessionID,
-            (store.session.permission[event.data.sessionID] ?? []).filter(
-              (request) => request.id !== event.data.requestID,
-            ),
-          )
+          removePermission(event.data.sessionID, event.data.requestID)
           break
         case "form.created":
           if (store.session.form[event.data.form.sessionID]?.some((form) => form.id === event.data.form.id)) break
@@ -1036,6 +1042,12 @@ export const { use: useData, provider: DataProvider } = createSimpleContext({
           invalidate(sessionID: string) {
             sync.invalidate(`session.permission:${sessionID}`)
           },
+          async reply(input: PermissionReplyInput) {
+            await client.api.permission.reply(input).catch((error: unknown) => {
+              if (!isPermissionNotFoundError(error)) throw error
+            })
+            removePermission(input.sessionID, input.requestID)
+          },
         },
         form: {
           list(sessionID: string, ref?: LocationRef) {

packages/tui/src/routes/session/index.tsx

@@ -227,7 +227,7 @@ export function Session() {
     permissions().forEach((request) => {
       if (autoApproved.has(request.id)) return
       autoApproved.add(request.id)
-      void client.api.permission
+      void data.session.permission
         .reply({
           sessionID: request.sessionID,
           reply: "once",

packages/tui/src/routes/session/permission.tsx

@@ -3,8 +3,7 @@ import { createMemo, For, Match, Show, Switch } from "solid-js"
 import { Portal, useRenderer, useTerminalDimensions, type JSX } from "@opentui/solid"
 import type { TextareaRenderable } from "@opentui/core"
 import { useTheme, useThemes } from "../../context/theme"
-import type { PermissionRequest } from "@opencode-ai/client"
-import { useClient } from "../../context/client"
+import type { PermissionReply, PermissionRequest } from "@opencode-ai/client"
 import { SplitBorder } from "../../ui/border"
 import { useData } from "../../context/data"
 import { filetype } from "../../util/filetype"
@@ -15,6 +14,7 @@ import { Keymap } from "../../context/keymap"
 import { usePathFormatter } from "../../context/path-format"
 import { SimulationSemantics } from "../../simulation/semantics"
 import { PatchDiff } from "../../component/patch-diff"
+import { useToast } from "../../ui/toast"
 
 type PermissionStage = "permission" | "always" | "reject"
 
@@ -110,8 +110,8 @@ function EditBody(props: { file?: string; diff?: string; patch?: string }) {
 }
 
 export function PermissionPrompt(props: { request: PermissionRequest; directory?: string }) {
-  const client = useClient()
   const data = useData()
+  const toast = useToast()
   const [store, setStore] = createStore({
     stage: "permission" as PermissionStage,
   })
@@ -132,6 +132,12 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
 
   const theme = useTheme()
 
+  function reply(value: PermissionReply, message?: string) {
+    void data.session.permission
+      .reply({ sessionID: props.request.sessionID, requestID: props.request.id, reply: value, message })
+      .catch((error: unknown) => toast.error(error))
+  }
+
   return (
     <Switch>
       <Match when={store.stage === "always"}>
@@ -151,11 +157,7 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
           onSelect={(option) => {
             setStore("stage", "permission")
             if (option === "cancel") return
-            void client.api.permission.reply({
-              sessionID: props.request.sessionID,
-              reply: "always",
-              requestID: props.request.id,
-            })
+            reply("always")
           }}
         />
       </Match>
@@ -164,12 +166,7 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
           action={props.request.action}
           instance={props.request.id}
           onConfirm={(message) => {
-            void client.api.permission.reply({
-              sessionID: props.request.sessionID,
-              reply: "reject",
-              requestID: props.request.id,
-              message: message || undefined,
-            })
+            reply("reject", message || undefined)
           }}
           onCancel={() => {
             setStore("stage", "permission")
@@ -265,18 +262,10 @@ export function PermissionPrompt(props: { request: PermissionRequest; directory?
                     setStore("stage", "reject")
                     return
                   }
-                  void client.api.permission.reply({
-                    sessionID: props.request.sessionID,
-                    reply: "reject",
-                    requestID: props.request.id,
-                  })
+                  reply("reject")
                   return
                 }
-                void client.api.permission.reply({
-                  sessionID: props.request.sessionID,
-                  reply: "once",
-                  requestID: props.request.id,
-                })
+                reply("once")
               }}
             />
           )

packages/tui/test/cli/tui/data.test.tsx

@@ -2067,6 +2067,64 @@ test("reconciles active session permissions when the event stream reconnects", a
   }
 })
 
+test("dismisses a permission that expired before its reply", async () => {
+  const events = createEventStream()
+  const request = { id: "per_stale", sessionID: "ses_active", action: "read", resources: ["old.txt"] }
+  let replies = 0
+  const calls = createFetch((url, init) => {
+    if (url.pathname === "/api/session/ses_active/permission/per_stale/reply" && init.method === "POST") {
+      replies++
+      return json(
+        {
+          _tag: "PermissionNotFoundError",
+          requestID: request.id,
+          message: `Permission request not found: ${request.id}`,
+        },
+        { status: 404 },
+      )
+    }
+  }, events)
+  let data!: ReturnType<typeof useData>
+
+  function Probe() {
+    data = useData()
+    return <box />
+  }
+
+  const app = await testRender(() => (
+    <TestTuiContexts>
+      <ClientProvider api={createApi(calls.fetch)}>
+        <ProjectProvider>
+          <DataProvider>
+            <Probe />
+          </DataProvider>
+        </ProjectProvider>
+      </ClientProvider>
+    </TestTuiContexts>
+  ))
+
+  try {
+    emitEvent(events, {
+      id: "evt_permission_asked_stale",
+      created: 0,
+      type: "permission.asked",
+      data: request,
+    })
+    await wait(() => data.session.permission.list(request.sessionID)?.length === 1)
+
+    await data.session.permission.reply({
+      sessionID: request.sessionID,
+      requestID: request.id,
+      reply: "once",
+    })
+
+    expect(replies).toBe(1)
+    expect(data.session.permission.list(request.sessionID)).toEqual([])
+  } finally {
+    app.renderer.destroy()
+  }
+})
+
 test("adds, dismisses, and refreshes form requests", async () => {
   const events = createEventStream()
   const calls = createFetch((url) => {

packages/www/content/docs/(Configure)/agents.mdx

@@ -46,9 +46,9 @@ An agent's `mode` controls where it can run:
 
 | Mode | Behavior |
 | --- | --- |
-| `primary` | Can be selected as the main agent for a session. It cannot be launched as a subagent. |
+| `primary` | Can be selected as the main agent for a session. It cannot be launched as a subagent. This is the default for a custom agent when `mode` is omitted. |
 | `subagent` | Can run in a child session through the `subagent` tool, but cannot be selected as the main agent. |
-| `all` | Can be used either way. This is the default for a custom agent when `mode` is omitted. |
+| `all` | Can be used either way. |
 
 In the TUI, press <kbd>Tab</kbd> and <kbd>Shift</kbd>+<kbd>Tab</kbd> to cycle
 through visible primary and `all` agents, or use `/agents` to choose one.

packages/www/content/docs/migrate-v1.mdx

@@ -419,6 +419,8 @@ The V1 provider filters do not have one-to-one native V2 config fields, but thei
 
 - `enabled_providers` becomes an internal deny-by-default provider policy followed by allows for the listed providers.
 - `disabled_providers` becomes internal deny policies for the listed providers.
+- `small_model` becomes the `model` selection for the built-in `title` agent. Native V2 configuration should use
+  `agents.title.model` instead.
 
 You may keep these fields in V1 syntax. OpenCode normalizes them without warning.
 
@@ -430,7 +432,6 @@ they are not mistaken for active configuration:
 - `logLevel`: use `OPENCODE_LOG_LEVEL` when starting OpenCode.
 - `server`: use the V2 service and explicit server options; the server API is an intentional breaking change.
 - `layout`: remove it; V1 already treated it as deprecated and always used stretch layout.
-- `small_model`: V2 selects models for internal maintenance agents without a separate top-level field.
 - Top-level `subagent_depth`: use `experimental.subagent_depth` instead.
 - `compaction.tail_turns` and `compaction.prune`: V2 uses `compaction.keep.tokens` and checkpoint-based compaction instead.
 - Agent `name` inside V1 JSON configuration.