feat(server): OpenCode 2 native steering, fork and rollback

[juliusmarminge]

OpenCode 2 sessions steered by interrupt-and-restart and couldn't fork or roll back. Layer 7 of the OpenCode 2 stack adds native steering, fork, and rollback through OpenCode's staged revert.

Restacked on layer 6 (#14474). Layer 6 treats any execution OpenCode starts on its own as a subagent's follow-up. So revert.clear's empty execution is now swallowed before that check, or it would have offered a spurious continuation turn (an adapter test fails without this). Continuation turns get their own turn id (<session>:wake:<attempt>), and fork and rollback skip them. Rollback is refused while background work is pending.

Review fixes. Each has an adapter test that fails without its fix.

• A rollback after a Stop that timed out asks the server whether that run is still going, and refuses while it is.
• A stranded steer whose inbox cancel failed is cancelled again before the next prompt.
• The snapshot a rollback returns lists only the provider turns it kept.
• T3's prompt and steer ids now include the OpenCode session id. OpenCode answers a message id reused in another session with a 409, and two T3 databases on one external server can repeat thread ids and run ordinals.
• A fork whose target thread runs in another worktree is moved there when it is made, since its first turn starts without a resume.
• Starting a turn and rolling back share a per-session gate, so a turn sent during a rollback waits for the cut.
• A fork of a session with a running turn is refused, as on 1.x, under the same gate.
• A rollback of a session this runtime hasn't loaded yet asks the server whether it runs, and its snapshot keeps the recorded turns up to the target.
• Fork and rollback share one busy check: a running turn, a follow-up OpenCode runs on its own, or a run on the server this runtime doesn't own. Revert stage and commit are bounded, so a hung server can't block later turns.

What changed

All of it is in OpenCode2AdapterV2.ts. Orchestration and the UI are unchanged.

• Steering (supportsActiveSteering: true). A message steered into a running turn goes out as session.prompt{delivery: "steer"}. OpenCode reads it at the running execution's next step boundary, so the steer joins that turn: one provider turn, one terminal.
  • The prompt id is derived from T3's message id, so a retried steer effect lands on the same inbox item. OpenCode answers a repeated id with the item it already has (checked live on 2.0.18).
  • If the execution ends before reading the steer, OpenCode wakes the session into another execution for it. The turn stays open until that one ends.
  • A Stop leaves undelivered steers in OpenCode's inbox, where the next prompt would deliver them first. The next turn cancels them with session.inbox.cancel.
• Queue. Queueing stays app-owned, as it is for every provider in V2. Queued, cancelled, edited and reordered runs never reach an adapter; a queued run calls startTurn after the previous turn's terminal. So OpenCode's delivery: "queue" is not used, a cancelled queued message never reaches OpenCode, and inbox.update has no V2 counterpart: it changes the delivery mode, while V2's edit changes the text.
• Turn boundaries. Prompts now go out under T3-chosen ids (msg_t3_turn_<attempt>). Each provider turn's nativeTurnRef is therefore the user message it prompted with, which is where fork and rollback cut.
• Fork (canForkThread, canForkFromTurn). session.fork{before} cuts at the next turn's prompt, provided it is still in the session. The fork gets the target thread's rules. canForkFromSubagentThread stays false while subagents are denied (layer 6).
• Rollback (canRollbackThread, providerCanRollbackConversation, providerRollbackReturnsSnapshot):
  • Rollback is revert.stage{files: false} followed by revert.commit. T3's own checkpoint stays authoritative for files, and a "rewind without files" must not touch them.
  • If the stage or commit fails or is interrupted, the adapter clears the stage, because OpenCode commits a staged revert on the next prompt. It also skips the spurious empty execution that clear runs.
  • If the clear fails too, it is retried before the next prompt.
  • Turns recorded before this layer have no message id, so a cut behind one of them is refused with a clear error.

Verification

• Replay fixtures from the spike recordings, run through the whole orchestrator:
  • opencode2_inbox (from inbox.ndjson): a steer into a running shell turn plus two queued messages, one of them cancelled.
  • opencode2_revert (from revert.ndjson): two write turns, then a rollback to the first.
  • The fork scenario in OpenCode2OrchestratorV2.integration.test.ts (from fork.ndjson): a real thread.fork from the first of two turns.
  • All three fail against layer 5's adapter.
• OpenCode2OrchestratorV2.integration.test.ts also gains an orchestrator test showing a cancelled queued message is never prompted.
• An adapter test covers a failed commit whose clear also fails. A real server can't fail on demand, so this one is not a replay. It checks that the stage is cleared before the next prompt.
• Live runs on 2.0.18 through the real driver (OPENCODE2_MODEL=openrouter/deepseek/deepseek-v4-flash); the whole live file passes (4 tests). The new live test:
  • steers a running shell turn, and the steer lands in that run with one attempt;
  • queues two messages, which run as their own turns;
  • forks from the first turn; the fork doesn't know the later turns;
  • rolls back the source to the first turn: reverted.txt goes back from BETA to ALPHA, and OpenCode's session is left with the first user message plus the new one.
• Tests run inside unshare -U -p:
  • vp test run on OpenCode2AdapterV2.test.ts, OpenCodeAdapterV2.test.ts, OpenCode2OrchestratorV2.integration.test.ts, OrchestratorReplayFixtures.integration.test.ts and processGroup.test.ts: 194 passed.
  • After the review fixes and the restack onto V2 5eae8ff: OpenCode2AdapterV2.test.ts plus OpenCode2OrchestratorV2.integration.test.ts give 71 passed, and OrchestratorReplayFixtures.integration.test.ts gives 111 passed.
• Checks:
  • tsc --noEmit -p apps/server exits 0;
  • vp lint on touched files: one pre-existing warning in shared.ts;
  • vp run knip:check is clean.
• Not run: repo-wide checks.

Model: Claude Opus 5.5 (Claude Code)

🤖 Generated with Claude Code

---

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds substantial OpenCode runtime capabilities for steering, forking, rollback, and nested background execution, with complex state and history-concurrency behavior. An unresolved Medium-severity replay concern also affects the new continuation path.

No code changes detected at 0637907. Prior analysis still applies.

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.7 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	1	—	8	✅

Baseline: unavailable · PR result: 0637907 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.