Skip to content

chore(release): pending release v0.43.2#630

Merged
marcusrbrown merged 12 commits into
releasefrom
next
May 17, 2026
Merged

chore(release): pending release v0.43.2#630
marcusrbrown merged 12 commits into
releasefrom
next

Conversation

marcusrbrown and others added 12 commits May 12, 2026 11:49
fix(agent): restore opencode assistant output
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
…detection blocking rebases (#618)

The 'branch' execution mode runs post-upgrade tasks after the branch is pushed,
creating additional commits that Renovate's edit detection interprets as manual
modifications. This causes PRs to be marked as 'PR Edited (Blocked)' in the
Dependency Dashboard, which stops automatic rebasing when they fall behind main.

Changing to 'update' execution mode ensures tasks run during the update phase
before the branch is created, producing a single commit that Renovate fully
controls. This prevents false 'edited' detection and allows automatic rebasing
to work as expected.
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
…tted only text (#621)

* fix(agent): render fallback tool execution lines when live stream emitted only text

OpenCode v1.14.48 publishes 858 message.part.updated events per agent run
but only emits final tool parts with status 'completed' through the
post-completion message fetch, not the live SSE stream. PR #616 restored
final assistant text output via the same fetch but suppressed all
fallback rendering (text and tool) when any visible output streamed
live, so tool execution lines never reached CI logs.

Track text and tool rendering independently in ActivityTracker via
textOutputEmitted and toolOutputEmitted. FallbackRenderOptions splits
renderVisibleOutput into renderText/renderTools so the fallback pass
backfills whichever side the live stream missed, without re-rendering
the other.

* build(deps): update dependency @opencode-ai/sdk to v1.14.48

* chore: add vitest config exclude and clonedeps bookkeeping

Excludes .slim/clonedeps/repos/ from vitest test collection so cloned
dependency source repos do not trip workspace test scans. Adds the
clonedeps manifest, ignore-file entries, and an AGENTS.md cross-reference
pointing at the local OpenCode source for future inspection.

* fix(agent): route SSE event subscription to the prompt's workspace instance

The Fro Bot CI logs were missing all visible tool execution lines
(`| Bash …`, `| Read …`) because `client.event.subscribe()` was called
without a `directory` query param while `client.session.prompt()` passed
one. The server routes each HTTP request to a per-directory workspace
instance with its own Bus singleton, so the subscription resolved to
the server's default-cwd instance and never saw the publishes coming
from the actual prompt's instance.

The SSE stream therefore only yielded the initial `server.connected`
event and then idled, even though the server log shows dozens of
`message.part.updated` publishes per run. Passing `directory` on both
calls keeps subscription and publish on the same bus.

Fix call sites in apps/action and packages/runtime; existing tests use
mock streams and pass through unchanged. Verified against OpenCode
v1.14.48 server source: `Bus` is per-instance via `InstanceState`, and
the `WorkspaceRoutingQuery` middleware on `/event` selects the instance
by `directory` query param or falls back to `process.cwd()`.

* fix(deps): pin OpenCode to 1.14.41 to restore SSE tool streaming

OpenCode 1.14.42+ regressed the /event SSE stream so that SyncEvent
publishes (`message.part.updated`, `message.updated`, `session.next.*`)
no longer reach `bus.subscribeAll()` subscribers, even though server-side
publish logs show them publishing. BusEvent publishes (`session.status`,
`session.diff`, `session.idle`, `message.part.delta`) continue to work,
which is why text deltas survived but tool execution lines disappeared
from the harness output.

Verified by running a minimal SSE consumer against `opencode serve` at
each release: 1.14.41 delivers all 10 expected `message.part.updated`
events for a one-tool session, while 1.14.42 through 1.15.1 deliver zero
despite identical server-side publish counts. The break is exact at the
1.14.41 -> 1.14.42 boundary.

- DEFAULT_OPENCODE_VERSION pinned to 1.14.41 in packages/runtime
- @opencode-ai/sdk pinned to 1.14.41 to match the server version
- Renovate allowedVersions guard prevents upgrades past 1.14.41 until
  upstream restores the SyncEvent bus delivery contract

---------

Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
PR #621 pinned OpenCode to 1.14.41, which restored live SSE delivery
of SyncEvent publishes that carry tool-call state. The visible fallback
renderer added in PR #616 to work around the 1.14.42+ regression is now
dead code for its primary purpose.

Keep the post-idle artifact reconciliation pass since it still protects
against races where v2.session.wait() resolves before the SSE consumer
drains the last tool-success event — `prsCreated`, `commitsCreated`,
and comment URLs need to land in the downstream result regardless.

- Delete the 1500ms stability window and 250ms polling loop in
  readCompletedAssistantMessageParts; replace with a single one-shot read
- Delete the visible-rendering body of renderFallbackMessageParts; rename
  to detectArtifactsFromMessageParts and make it pure (no console writes)
- Drop ActivityTracker.fallbackMessageParts, textOutputEmitted,
  toolOutputEmitted (no remaining consumers after the renderer is gone)
- Drop the session-poll write that cached parts onto activityTracker
- Rename mergeEventStreamAndFallbackResults to mergeArtifactResults
- Remove tests that asserted visible fallback rendering and stability
  timing; keep all artifact-merge and live-stream tests
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
…ions (#622)

Three Dependabot alerts on the default branch resolve with pnpm.overrides
bumps:

- fast-uri >=3.1.2 (GHSA-v39h-62p7-jpjc, GHSA-q3j6-qgpj-74h6, dev) —
  host confusion and path traversal via percent-encoded sequences,
  pulled in by ajv via @bfra.me/eslint-config.
- fast-xml-builder >=1.1.7 (GHSA-5wm8-gmm8-39j9, GHSA-45c6-75p6-83cc,
  runtime, bundled into dist) — attribute-value quote bypass and a
  Comment regex bypass, pulled in by @aws-sdk/client-s3 via
  fast-xml-parser.
- ip-address >=10.1.1 (GHSA-v2v4-37r5-5v8g, dev) — XSS in
  Address6 HTML-emitting methods, pulled in by generate-license-file
  via socks/socks-proxy-agent.

Same override pattern already in use for fast-xml-parser. dist/ rebuilt
to reflect the new fast-xml-builder@1.2.0 in the bundled AWS SDK
output.
@marcusrbrown marcusrbrown requested a review from fro-bot as a code owner May 17, 2026 05:31
@marcusrbrown marcusrbrown merged commit a8ed6e5 into release May 17, 2026
1 check passed
@marcusrbrown marcusrbrown deleted the next branch May 17, 2026 05:32
@fro-bot
Copy link
Copy Markdown
Owner

fro-bot commented May 17, 2026

Rebased all 5 Renovate PRs onto current main after the filter-branch rewrite.

One-line status per PR:


@fro-bot fro-bot mentioned this pull request May 17, 2026
46 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants