refactor(core): simplify issuer binding

packages/client/src/effect/api/api.ts

@@ -17,7 +17,6 @@ import type { PromptInput } from "@opencode-ai/schema/prompt-input"
 import type { AgentAttachment } from "@opencode-ai/schema/prompt"
 import type { Skill } from "@opencode-ai/schema/skill"
 import type { Event } from "@opencode-ai/schema/event"
-import type { FileDiff } from "@opencode-ai/schema/file-diff"
 import type { InstructionEntry } from "@opencode-ai/schema/instruction-entry"
 import type { Schema } from "effect"
 import type { EventLog } from "@opencode-ai/schema/event-log"
@@ -37,6 +36,7 @@ import type { PtyTicket } from "@opencode-ai/schema/pty-ticket"
 import type { Reference } from "@opencode-ai/schema/reference"
 import type { Worktree } from "@opencode-ai/schema/worktree"
 import type { Vcs } from "@opencode-ai/schema/vcs"
+import type { FileDiff } from "@opencode-ai/schema/file-diff"
 import type { WebSearch } from "@opencode-ai/schema/websearch"
 import type { Config } from "@opencode-ai/schema/config"
 
@@ -360,15 +360,6 @@ export type SessionContextInput = { readonly sessionID: Session.ID }
 export type SessionContextOutput = ReadonlyArray<SessionMessage.Info>
 export type SessionContextOperation<E = never> = (input: SessionContextInput) => Effect.Effect<SessionContextOutput, E>
 
-export type SessionDiffInput = {
-  readonly sessionID: Session.ID
-  readonly messageID?: SessionMessage.ID | undefined
-  readonly to?: SessionMessage.ID | undefined
-  readonly context?: number | undefined
-}
-export type SessionDiffOutput = ReadonlyArray<FileDiff.Info>
-export type SessionDiffOperation<E = never> = (input: SessionDiffInput) => Effect.Effect<SessionDiffOutput, E>
-
 export type SessionInboxListInput = { readonly sessionID: Session.ID }
 export type SessionInboxListOutput = ReadonlyArray<SessionInbox.Info>
 export type SessionInboxListOperation<E = never> = (
@@ -1142,7 +1133,6 @@ export interface SessionApi<E = never> {
     readonly commit: SessionRevertCommitOperation<E>
   }
   readonly context: SessionContextOperation<E>
-  readonly diff: SessionDiffOperation<E>
   readonly inbox: {
     readonly list: SessionInboxListOperation<E>
     readonly cancel: SessionInboxCancelOperation<E>

packages/client/src/effect/generated/client.ts

@@ -68,8 +68,6 @@ import type {
   SessionRevertCommitOutput,
   SessionContextInput,
   SessionContextOutput,
-  SessionDiffInput,
-  SessionDiffOutput,
   SessionInboxListInput,
   SessionInboxListOutput,
   SessionInboxCancelInput,
@@ -596,17 +594,6 @@ const EndpointSessionContext = (raw: RawClient["server.session"]) => (input: Ses
     ),
   )
 
-const EndpointSessionDiff = (raw: RawClient["server.session"]) => (input: SessionDiffInput) =>
-  preserveEffect<SessionDiffOutput>()(
-    raw["session.diff"]({
-      params: { sessionID: input["sessionID"] },
-      query: { messageID: input["messageID"], to: input["to"], context: input["context"] },
-    }).pipe(
-      Effect.mapError(mapClientError),
-      Effect.map((value) => value.data),
-    ),
-  )
-
 const EndpointSessionInboxList = (raw: RawClient["server.session"]) => (input: SessionInboxListInput) =>
   preserveEffect<SessionInboxListOutput>()(
     raw["session.inbox.list"]({ params: { sessionID: input["sessionID"] } }).pipe(
@@ -757,7 +744,6 @@ const adaptGroupSession = (raw: RawClient["server.session"]) => ({
     commit: EndpointSessionRevertCommit(raw),
   },
   context: EndpointSessionContext(raw),
-  diff: EndpointSessionDiff(raw),
   inbox: {
     list: EndpointSessionInboxList(raw),
     cancel: EndpointSessionInboxCancel(raw),

packages/client/src/promise/generated/client.ts

@@ -62,8 +62,6 @@ import type {
   SessionRevertCommitOutput,
   SessionContextInput,
   SessionContextOutput,
-  SessionDiffInput,
-  SessionDiffOutput,
   SessionInboxListInput,
   SessionInboxListOutput,
   SessionInboxCancelInput,
@@ -846,18 +844,6 @@ export function make(options: ClientOptions) {
           },
           requestOptions,
         ).then((value) => value.data),
-      diff: (input: SessionDiffInput, requestOptions?: RequestOptions) =>
-        request<{ readonly data: SessionDiffOutput }>(
-          {
-            method: "GET",
-            path: `/api/session/${encodeURIComponent(input.sessionID)}/diff`,
-            query: { messageID: input["messageID"], to: input["to"], context: input["context"] },
-            successStatus: 200,
-            declaredStatuses: [400, 401, 404, 500],
-            empty: false,
-          },
-          requestOptions,
-        ).then((value) => value.data),
       inbox: {
         list: (input: SessionInboxListInput, requestOptions?: RequestOptions) =>
           request<{ readonly data: SessionInboxListOutput }>(

packages/client/src/promise/generated/types.ts

@@ -147,14 +147,6 @@ export type SessionProviderContextProvenance = {
   endpoint: string
 }
 
-export type SessionMessageIdle = {
-  id: string
-  metadata?: { [x: string]: JsonValue }
-  time: { created: number }
-  type: "idle"
-  outcome: "succeeded" | "failed" | "interrupted"
-}
-
 export type SessionActive = { type: "running" }
 
 export type SessionInboxDelivery = "steer" | "queue"
@@ -2185,7 +2177,6 @@ export type SessionMessageInfo =
   | SessionMessageShell
   | SessionMessageAssistant
   | SessionMessageCompaction
-  | SessionMessageIdle
 
 export type SessionMessageContentUpdated = {
   id: string
@@ -3131,13 +3122,6 @@ export type SessionImportInput = {
               readonly error: { readonly type: string; readonly message: string; readonly status?: number }
             }
         )
-      | {
-          readonly id: string
-          readonly metadata?: { readonly [x: string]: JsonValue }
-          readonly time: { readonly created: number }
-          readonly type: "idle"
-          readonly outcome: "succeeded" | "failed" | "interrupted"
-        }
     >
     readonly location?: { readonly directory: string; readonly workspaceID?: string } | null
   }["info"]
@@ -3429,13 +3413,6 @@ export type SessionImportInput = {
               readonly error: { readonly type: string; readonly message: string; readonly status?: number }
             }
         )
-      | {
-          readonly id: string
-          readonly metadata?: { readonly [x: string]: JsonValue }
-          readonly time: { readonly created: number }
-          readonly type: "idle"
-          readonly outcome: "succeeded" | "failed" | "interrupted"
-        }
     >
     readonly location?: { readonly directory: string; readonly workspaceID?: string } | null
   }["messages"]
@@ -3727,13 +3704,6 @@ export type SessionImportInput = {
               readonly error: { readonly type: string; readonly message: string; readonly status?: number }
             }
         )
-      | {
-          readonly id: string
-          readonly metadata?: { readonly [x: string]: JsonValue }
-          readonly time: { readonly created: number }
-          readonly type: "idle"
-          readonly outcome: "succeeded" | "failed" | "interrupted"
-        }
     >
     readonly location?: { readonly directory: string; readonly workspaceID?: string } | null
   }["location"]
@@ -4223,27 +4193,6 @@ export type SessionContextInput = { readonly sessionID: { readonly sessionID: st
 
 export type SessionContextOutput = { data: Array<SessionMessageInfo> }["data"]
 
-export type SessionDiffInput = {
-  readonly sessionID: { readonly sessionID: string }["sessionID"]
-  readonly messageID?: {
-    readonly messageID?: string | undefined
-    readonly to?: string | undefined
-    readonly context?: number | undefined
-  }["messageID"]
-  readonly to?: {
-    readonly messageID?: string | undefined
-    readonly to?: string | undefined
-    readonly context?: number | undefined
-  }["to"]
-  readonly context?: {
-    readonly messageID?: string | undefined
-    readonly to?: string | undefined
-    readonly context?: number | undefined
-  }["context"]
-}
-
-export type SessionDiffOutput = { data: Array<FileDiffInfo> }["data"]
-
 export type SessionInboxListInput = { readonly sessionID: { readonly sessionID: string }["sessionID"] }
 
 export type SessionInboxListOutput = { data: Array<SessionInboxInfo> }["data"]

packages/client/src/solid/data.ts

@@ -1032,18 +1032,6 @@ export function createData(config: CreateDataInput) {
           if (currentAssistant) currentAssistant.retry = undefined
         })
         if (event.type === "session.execution.interrupted" && event.data.reason === "shutdown") return
-        // Mirror the projected idle marker so turn boundaries match before the next message read.
-        message.insert(event.data.sessionID, {
-          id: messageIDFromEvent(event.id),
-          type: "idle",
-          outcome:
-            event.type === "session.execution.succeeded"
-              ? "succeeded"
-              : event.type === "session.execution.failed"
-                ? "failed"
-                : "interrupted",
-          time: { created: event.created },
-        })
         // An event can overtake the first read; queue a revalidation when that read is still active.
         if (!store.session.info[event.data.sessionID] && !sync.has(`session:${event.data.sessionID}`)) return
         result.session.invalidate(event.data.sessionID)

packages/core/src/git.ts

@@ -9,7 +9,6 @@ import { AppProcess } from "@opencode-ai/util/process"
 import { makeGlobalNode } from "@opencode-ai/util/effect/app-node"
 import { File } from "./file.js"
 import { KeyedMutex } from "./effect/keyed-mutex.js"
-import { VcsPatch } from "./vcs/patch.js"
 
 export class Repository extends Schema.Class<Repository>("Git.Repository")({
   worktree: AbsolutePath,
@@ -309,7 +308,7 @@ const layer = Layer.effect(
       operationName: OperationError["operation"],
       repository: Repository,
       args: string[],
-      options?: { stdin?: string; env?: Record<string, string>; maxOutputBytes?: number },
+      options?: { stdin?: string; env?: Record<string, string> },
     ) {
       const result = yield* proc
         .run(
@@ -318,7 +317,7 @@ const layer = Layer.effect(
             env: options?.env,
             extendEnv: true,
           }),
-          { stdin: options?.stdin, maxOutputBytes: options?.maxOutputBytes },
+          { stdin: options?.stdin },
         )
         .pipe(
           Effect.mapError(
@@ -332,8 +331,7 @@ const layer = Layer.effect(
           ),
         )
       const text = result.stdout.toString("utf8")
-      if (result.exitCode === 0)
-        return { text, stderr: result.stderr.toString("utf8"), truncated: result.stdoutTruncated }
+      if (result.exitCode === 0) return { text, stderr: result.stderr.toString("utf8") }
       return yield* new OperationError({
         operation: operationName,
         directory: repository.worktree,
@@ -387,7 +385,9 @@ const layer = Layer.effect(
       maximumUntrackedFileBytes?: number
     }) {
       const list = (args: string[]) =>
-        repositoryOperation("refresh", input.repository, args).pipe(Effect.map((result) => nuls(result.text)))
+        repositoryOperation("refresh", input.repository, args).pipe(
+          Effect.map((result) => result.text.split("\0").filter(Boolean)),
+        )
       const [tracked, untracked] = yield* Effect.all(
         [
           list(["diff-files", "--name-only", "-z", "--", input.scope]),
@@ -464,7 +464,13 @@ const layer = Layer.effect(
           directory: input.repository.worktree,
           message: result.stderr.toString("utf8").trim() || "Failed to check ignored paths",
         })
-      return new Set(nuls(result.stdout.toString("utf8")).map((file) => RelativePath.make(file)))
+      return new Set(
+        result.stdout
+          .toString("utf8")
+          .split("\0")
+          .filter(Boolean)
+          .map((file) => RelativePath.make(file)),
+      )
     })
 
     const writeTree = Effect.fn("Git.tree.write")(function* (repository: Repository) {
@@ -493,23 +499,19 @@ const layer = Layer.effect(
       to: TreeID
     }) {
       // Undo needs both paths of a rename, not only its destination.
-      return nuls(
-        (yield* repositoryOperation("list_files", input.repository, [
-          "diff",
-          "--name-only",
-          "--no-renames",
-          "-z",
-          input.from,
-          input.to,
-        ])).text,
-      ).map((file) => RelativePath.make(file))
+      return (yield* repositoryOperation("list_files", input.repository, [
+        "diff",
+        "--name-only",
+        "--no-renames",
+        "-z",
+        input.from,
+        input.to,
+      ])).text
+        .split("\0")
+        .filter(Boolean)
+        .map((file) => RelativePath.make(file))
     })
 
-    /**
-     * Three batched invocations over the tree pair instead of three per file. An
-     * explicit empty selection diffs nothing; an absent one diffs every changed path.
-     * Patch output is capped like VCS diffs: files past the cap get an empty patch.
-     */
     const treeDiff = Effect.fn("Git.tree.diff")(function* (input: {
       repository: Repository
       from: TreeID
@@ -517,57 +519,49 @@ const layer = Layer.effect(
       context?: number
       paths?: readonly RelativePath[]
     }) {
-      if (input.paths?.length === 0) return []
-      const args = ["--no-renames", input.from, input.to, "--", ...(input.paths ?? [])]
-      // Patch headers have no -z form: unquoted paths keep chunksByFile matching non-ASCII names.
-      const [names, numbers, patch] = yield* Effect.all(
-        [
-          repositoryOperation("diff", input.repository, ["diff", "--name-status", "-z", ...args]),
-          repositoryOperation("diff", input.repository, ["diff", "--numstat", "-z", ...args]),
-          repositoryOperation(
+      const paths = input.paths ?? (yield* treeFiles(input))
+      return yield* Effect.forEach(paths, (file) =>
+        Effect.gen(function* () {
+          const statusText = (yield* repositoryOperation("diff", input.repository, [
             "diff",
-            input.repository,
-            ["-c", "core.quotepath=false", "diff", "--no-ext-diff", `--unified=${input.context ?? 3}`, ...args],
-            { maxOutputBytes: VcsPatch.MAX_TOTAL_PATCH_BYTES },
-          ),
-        ],
-        { concurrency: 3 },
-      )
-      const statuses = nuls(names.text)
-      const files = statuses.flatMap((code, index) => {
-        const file = statuses[index + 1]
-        if (index % 2 !== 0 || !file) return []
-        return [
-          {
-            file: RelativePath.make(file),
-            status: code.startsWith("A") ? "added" : code.startsWith("D") ? "deleted" : "modified",
-          } as const,
-        ]
-      })
-      const stats = new Map(
-        nuls(numbers.text).flatMap((line) => {
-          const [additions, deletions, ...file] = line.split("\t")
-          if (!additions || !deletions || file.length === 0) return []
-          return [
-            [
-              file.join("\t"),
-              additions === "-" || deletions === "-"
-                ? { binary: true, additions: 0, deletions: 0 }
-                : { binary: false, additions: Number(additions), deletions: Number(deletions) },
-            ] as const,
-          ]
+            "--name-status",
+            "--no-renames",
+            input.from,
+            input.to,
+            "--",
+            file,
+          ])).text.trim()
+          const status = statusText.startsWith("A") ? "added" : statusText.startsWith("D") ? "deleted" : "modified"
+          const stats = (yield* repositoryOperation("diff", input.repository, [
+            "diff",
+            "--numstat",
+            "--no-renames",
+            input.from,
+            input.to,
+            "--",
+            file,
+          ])).text.split("\t")
+          const binary = stats[0] === "-" || stats[1] === "-"
+          const patch = binary
+            ? ""
+            : (yield* repositoryOperation("diff", input.repository, [
+                "diff",
+                `--unified=${input.context ?? 3}`,
+                "--no-renames",
+                input.from,
+                input.to,
+                "--",
+                file,
+              ])).text
+          return {
+            file,
+            status,
+            additions: binary ? 0 : Number(stats[0] ?? 0),
+            deletions: binary ? 0 : Number(stats[1] ?? 0),
+            patch,
+          } satisfies File.Diff
         }),
       )
-      const patches = VcsPatch.chunksByFile(patch, (index) => files[index]?.file)
-      return files.map((entry) => {
-        const stat = stats.get(entry.file)
-        return {
-          ...entry,
-          additions: stat?.additions ?? 0,
-          deletions: stat?.deletions ?? 0,
-          patch: stat?.binary ? "" : (patches.get(entry.file) ?? VcsPatch.emptyPatch(entry.file)),
-        } satisfies File.Diff
-      })
     })
 
     const hasEntry = Effect.fnUntraced(function* (repository: Repository, tree: TreeID, file: RelativePath) {
@@ -739,11 +733,6 @@ function execute(cwd: string, proc: AppProcess.Interface, args: string[]) {
     )
 }
 
-/** Split NUL-terminated git output into its records. */
-function nuls(text: string) {
-  return text.split("\0").filter(Boolean)
-}
-
 function resolvePath(cwd: string, value: string) {
   const trimmed = value.replace(/[\r\n]+$/, "")
   if (!trimmed) return cwd

packages/core/src/mcp/index.ts

@@ -292,12 +292,19 @@ export const layer = (options?: Options) =>
         // Tracks the refresh token this provider last presented, so invalidate can tell whether the SDK
         // rejected the currently-stored credential or a snapshot another connection has already rotated past.
         let presented = found.value.refresh
+        const bound = McpOAuth.issuerFromCredential(found.value)
+        let issuer: string | undefined
         const readOAuthCredential = async () => {
           const stored = await run(credentials.get(credentialID))
           return stored?.value.type === "oauth" ? stored.value : undefined
         }
         return McpOAuth.provider({
           ...base,
+          onDiscovery: async (discovery) => {
+            issuer = discovery.authorizationServerMetadata?.issuer
+            if (bound && issuer && bound !== issuer)
+              await run(Effect.logWarning("mcp oauth issuer changed", { ...fields, expected: bound, actual: issuer }))
+          },
           // Drop a credential the SDK rejected so the next connect cleanly reports needs_auth — but only if it is
           // still the stored one. Rotating servers hand out a fresh refresh token per use, so a concurrent
           // connection may have already replaced ours; deleting then would discard the newer valid credential and
@@ -332,7 +339,7 @@ export const layer = (options?: Options) =>
               const oauth = await readOAuthCredential()
               if (!oauth) return undefined
               presented = oauth.refresh
-              return McpOAuth.toTokens(oauth)
+              return McpOAuth.toTokens(oauth, issuer)
             },
             saveTokens: async (tokens) => {
               const previous = await readOAuthCredential()
@@ -341,6 +348,7 @@ export const layer = (options?: Options) =>
                 serverUrl: remote.url,
                 tokens,
                 client: previous ? McpOAuth.clientFromCredential(previous) : undefined,
+                issuer: (previous && McpOAuth.issuerFromCredential(previous)) || issuer,
               })
               presented = value.refresh
               await run(

packages/core/src/mcp/oauth.ts

@@ -5,6 +5,7 @@ import {
   discoverOAuthServerInfo,
   parseErrorResponse,
   type OAuthClientProvider,
+  type OAuthDiscoveryState,
   type OAuthServerInfo,
 } from "@modelcontextprotocol/sdk/client/auth.js"
 import type { OAuthClientInformationMixed, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js"
@@ -95,6 +96,8 @@ export interface Options {
   readonly clientMetadataUrl?: string
   /** Pre-fetched authorization server discovery so the SDK does not repeat it. */
   readonly discovery?: OAuthServerInfo
+  /** Receives the SDK's discovery result before it refreshes or authorizes. */
+  readonly onDiscovery?: (discovery: OAuthDiscoveryState) => void | Promise<void>
   /** Invoked by the SDK to drop credentials it has determined are invalid (e.g. a rejected refresh token). */
   readonly invalidate?: (scope: "all" | "client" | "tokens" | "verifier" | "discovery") => void | Promise<void>
   /** Receives the authorization URL so the caller can open a browser and capture the eventual code. */
@@ -113,6 +116,7 @@ export const provider = (options: Options): OAuthClientProvider => {
     redirectUrl: options.redirectUrl,
     ...(options.clientMetadataUrl ? { clientMetadataUrl: options.clientMetadataUrl } : {}),
     ...(options.discovery ? { discoveryState: () => options.discovery } : {}),
+    ...(options.onDiscovery ? { saveDiscoveryState: options.onDiscovery } : {}),
     clientMetadata: {
       redirect_uris: [options.redirectUrl],
       client_name: "opencode",
@@ -169,12 +173,19 @@ export const memoryStore = (): Store => {
 export const clientFromCredential = (credential: Credential.OAuth) =>
   credential.metadata?.client as OAuthClientInformationMixed | undefined
 
-/** Folds SDK tokens (plus DCR client info and the server URL) into a storable credential. */
+/** Reads the authorization server issuer recorded when the credential was obtained. */
+export const issuerFromCredential = (credential: Credential.OAuth) => {
+  const issuer = credential.metadata?.issuer
+  return typeof issuer === "string" ? issuer : undefined
+}
+
+/** Folds SDK tokens (plus client info, issuer, and the server URL) into a storable credential. */
 export const toCredential = (input: {
   readonly methodID: Integration.MethodID
   readonly serverUrl: string
   readonly tokens: OAuthTokens
   readonly client: OAuthClientInformationMixed | undefined
+  readonly issuer?: string
 }) =>
   Credential.OAuth.make({
     type: "oauth",
@@ -188,16 +199,23 @@ export const toCredential = (input: {
       tokenType: input.tokens.token_type,
       ...(input.tokens.scope ? { scope: input.tokens.scope } : {}),
       ...(input.client ? { client: input.client } : {}),
+      ...(input.issuer ? { issuer: input.issuer } : {}),
     },
   })
 
-/** Reconstructs SDK tokens from a stored credential so the connect-time provider can present them. */
-export const toTokens = (credential: Credential.OAuth): OAuthTokens => {
+/**
+ * Reconstructs SDK tokens from a stored credential so the connect-time provider can present them. The refresh
+ * token is withheld when `issuer` differs from the one recorded at login, so the SDK re-authorizes instead of
+ * sending it to an authorization server that did not issue it.
+ */
+export const toTokens = (credential: Credential.OAuth, issuer?: string): OAuthTokens => {
   const metadata = credential.metadata ?? {}
+  const bound = issuerFromCredential(credential)
+  const refresh = credential.refresh && (!bound || !issuer || bound === issuer)
   return {
     access_token: credential.access,
     token_type: typeof metadata.tokenType === "string" ? metadata.tokenType : "Bearer",
-    ...(credential.refresh ? { refresh_token: credential.refresh } : {}),
+    ...(refresh ? { refresh_token: credential.refresh } : {}),
     ...(credential.expires ? { expires_in: Math.max(0, Math.floor((credential.expires - Date.now()) / 1000)) } : {}),
     ...(typeof metadata.scope === "string" ? { scope: metadata.scope } : {}),
   }
@@ -312,7 +330,13 @@ export const authorize = (input: {
         hasRefreshToken: Boolean(tokens.refresh_token),
         expiresIn: tokens.expires_in,
       })
-      return toCredential({ methodID: input.methodID, serverUrl: input.config.url, tokens, client })
+      return toCredential({
+        methodID: input.methodID,
+        serverUrl: input.config.url,
+        tokens,
+        client,
+        issuer: discovery.authorizationServerMetadata?.issuer,
+      })
     })
 
     yield* Effect.tryPromise({

packages/core/src/session.ts

@@ -57,11 +57,8 @@ import { SessionModelTransport } from "./session/model-transport.js"
 import { llmClient } from "./effect/app-node-platform.js"
 import { Snapshot } from "./snapshot.js"
 import { Session } from "./session/session.js"
-import { SessionDiff, TurnRangeError } from "./session/diff.js"
-import { LocationServiceMap } from "./location-service-map.js"
 import { FSUtil } from "@opencode-ai/util/fs-util"
 import type { EventLog } from "@opencode-ai/schema/event-log"
-import type { FileDiff } from "@opencode-ai/schema/file-diff"
 import { Job } from "./job.js"
 import type { Command } from "./command.js"
 import { SessionEnvironment } from "./session/environment.js"
@@ -116,7 +113,6 @@ export {
 type InboxItemRef = { readonly sessionID: SessionSchema.ID; readonly inboxID: SessionMessage.ID }
 
 export { DestinationNotFoundError, DestinationNotDirectoryError, DestinationUnavailableError }
-export { TurnRangeError }
 
 export interface Interface {
   readonly list: (input?: ListInput) => Effect.Effect<{
@@ -146,13 +142,6 @@ export interface Interface {
   readonly context: (
     sessionID: SessionSchema.ID,
   ) => Effect.Effect<SessionMessage.Info[], NotFoundError | MessageDecodeError>
-  /** Structured diffs of the files changed by a turn or range of turns; see `SessionDiff.turn`. */
-  readonly diff: (input: {
-    readonly sessionID: SessionSchema.ID
-    readonly messageID?: SessionMessage.ID
-    readonly to?: SessionMessage.ID
-    readonly context?: number
-  }) => Effect.Effect<readonly FileDiff.Info[], NotFoundError | MessageNotFoundError | TurnRangeError | Snapshot.Error>
   /**
    * Durable admitted session work not yet visible in projected history,
    * ordered by admission. Includes unpromoted user and synthetic inputs and
@@ -241,7 +230,6 @@ const layer = Layer.effect(
     const moves = yield* SessionMove.Service
     const jobs = yield* Job.Service
     const environments = yield* SessionEnvironment.Service
-    const locations = yield* LocationServiceMap.Service
     const sessions = yield* Session.make()
     const isDurableSessionEvent = Schema.is(SessionEvent.Durable)
 
@@ -374,17 +362,6 @@ const layer = Layer.effect(
         yield* result.get(sessionID)
         return yield* store.context(sessionID)
       }),
-      diff: Effect.fn("Session.diff")(function* (input) {
-        const session = yield* result.get(input.sessionID)
-        const active = yield* execution.isActive(input.sessionID)
-        return yield* SessionDiff.turn(db, locations, {
-          session,
-          active,
-          messageID: input.messageID,
-          to: input.to,
-          context: input.context,
-        })
-      }),
       inbox: (sessionID) => sessions.forSession(sessionID).inbox(),
       cancelInbox: (input) => sessions.forSession(input.sessionID).cancelInbox(input.inboxID),
       steerInbox: (input) => sessions.forSession(input.sessionID).steerInbox(input.inboxID),
@@ -473,7 +450,6 @@ export const node: LayerNode.Provider<Service, never, typeof Node.tags.values.gl
     SessionInbox.node,
     SessionMove.node,
     SessionProjector.node,
-    LocationServiceMap.node,
     FSUtil.node,
     App.node,
   ],

packages/core/src/session/diff.ts

@@ -1,138 +0,0 @@
-export * as SessionDiff from "./diff.js"
-
-import { and, asc, eq, gt, inArray, lt, or, sql } from "drizzle-orm"
-import { Context, Effect, Schema } from "effect"
-import { Location } from "@opencode-ai/schema/location"
-import { Database } from "../database/database.js"
-import { LocationServiceMap } from "../location-service-map.js"
-import { Snapshot } from "../snapshot.js"
-import { PATCH_CONTEXT_LINES } from "../vcs/patch.js"
-import { MessageNotFoundError } from "./error.js"
-import { SessionMessage } from "./message.js"
-import { SessionSchema } from "./schema.js"
-import { SessionMessageTable } from "./sql.js"
-
-export class TurnRangeError extends Schema.TaggedError<TurnRangeError>()("Session.TurnRangeError", {
-  sessionID: SessionSchema.ID,
-  field: Schema.Literals(["messageID", "to"]),
-  message: Schema.String,
-}) {}
-
-const decodeLocation = Schema.decodeUnknownSync(Schema.fromJsonString(Location.Ref))
-
-/**
- * Diff the files changed by the turn containing a user message. A turn runs from
- * the first prompt after the Session was last idle until the next idle marker, so
- * prompts steered in while it was busy belong to the same turn; `to` extends the
- * range through the turn containing a later user message. Compares the range's
- * first recorded start snapshot with its last recorded end snapshot; only a step
- * still running in the active Session compares against the working copy. Like VCS
- * diffs, an omitted `context` yields full-file patches.
- *
- * A Session without any idle marker predates them, so its prompts span until the
- * next user message instead.
- *
- * Snapshot trees live in the repository of the Location that captured them, so a
- * range spanning a location switch is rejected rather than diffed wrongly.
- */
-export const turn = Effect.fn("SessionDiff.turn")(function* (
-  db: Database.Interface["db"],
-  locations: Context.Service.Shape<typeof LocationServiceMap.Service>,
-  input: {
-    readonly session: SessionSchema.Info
-    /** The process is currently executing this Session. */
-    readonly active: boolean
-    readonly messageID?: SessionMessage.ID
-    readonly to?: SessionMessage.ID
-    readonly context?: number
-  },
-) {
-  const sessionID = input.session.id
-  const rows = yield* db
-    .select({ id: SessionMessageTable.id, type: SessionMessageTable.type, seq: SessionMessageTable.seq })
-    .from(SessionMessageTable)
-    .where(
-      and(
-        eq(SessionMessageTable.session_id, sessionID),
-        or(
-          inArray(SessionMessageTable.type, ["user", "idle"]),
-          input.messageID ? eq(SessionMessageTable.id, input.messageID) : undefined,
-          input.to ? eq(SessionMessageTable.id, input.to) : undefined,
-        ),
-      ),
-    )
-    .orderBy(asc(SessionMessageTable.seq))
-    .all()
-    .pipe(Effect.orDie)
-  const users = rows.filter((row) => row.type === "user")
-  const markers = rows.filter((row) => row.type === "idle")
-  const resolve = Effect.fn(function* (field: "messageID" | "to", id: SessionMessage.ID) {
-    const row = rows.find((row) => row.id === id)
-    if (!row) return yield* new MessageNotFoundError({ sessionID, messageID: id })
-    if (row.type !== "user")
-      return yield* new TurnRangeError({ sessionID, field, message: `Message ${id} is not a user message` })
-    return row
-  })
-  const anchor = input.messageID ? yield* resolve("messageID", input.messageID) : users[users.length - 1]
-  if (!anchor) return []
-  const last = input.to ? yield* resolve("to", input.to) : anchor
-  if (last.seq < anchor.seq)
-    return yield* new TurnRangeError({ sessionID, field: "to", message: `Message ${last.id} precedes ${anchor.id}` })
-  // Without any marker, history predates idle markers and a prompt's turn ends at the next prompt.
-  const legacy = markers.length === 0
-  // The turn opens with the first prompt after the previous idle marker; the anchor itself is the latest candidate.
-  const opened = markers.findLast((row) => row.seq < anchor.seq)?.seq ?? -1
-  const start = legacy ? anchor.seq : (users.find((row) => row.seq > opened)?.seq ?? anchor.seq)
-  const end = legacy ? users.find((row) => row.seq > last.seq)?.seq : markers.find((row) => row.seq > last.seq)?.seq
-  const steps = yield* db
-    .select({
-      seq: SessionMessageTable.seq,
-      start: sql<string | null>`json_extract(${SessionMessageTable.data}, '$.snapshot.start')`,
-      end: sql<string | null>`json_extract(${SessionMessageTable.data}, '$.snapshot.end')`,
-      completed: sql<number | null>`json_extract(${SessionMessageTable.data}, '$.time.completed')`,
-    })
-    .from(SessionMessageTable)
-    .where(
-      and(
-        eq(SessionMessageTable.session_id, sessionID),
-        eq(SessionMessageTable.type, "assistant"),
-        gt(SessionMessageTable.seq, start),
-        end === undefined ? undefined : lt(SessionMessageTable.seq, end),
-      ),
-    )
-    .orderBy(asc(SessionMessageTable.seq))
-    .all()
-    .pipe(Effect.orDie)
-  const first = steps[0]
-  const final = steps[steps.length - 1]
-  const from = steps.find((step) => step.start)?.start
-  if (!first || !final || !from) return []
-  const switches = yield* db
-    .select({
-      seq: SessionMessageTable.seq,
-      location: sql<string>`json_extract(${SessionMessageTable.data}, '$.location')`,
-      previous: sql<string | null>`json_extract(${SessionMessageTable.data}, '$.previous.location')`,
-    })
-    .from(SessionMessageTable)
-    .where(and(eq(SessionMessageTable.session_id, sessionID), eq(SessionMessageTable.type, "location-switched")))
-    .orderBy(asc(SessionMessageTable.seq))
-    .all()
-    .pipe(Effect.orDie)
-  if (switches.some((row) => row.seq > first.seq && row.seq < final.seq))
-    return yield* new TurnRangeError({ sessionID, field: "to", message: "Turn range spans a location change" })
-  const before = switches.findLast((row) => row.seq < first.seq)?.location
-  const after = switches.find((row) => row.seq > first.seq)?.previous
-  const location = before ? decodeLocation(before) : after ? decodeLocation(after) : input.session.location
-  const recorded = steps.findLast((step) => step.end)?.end
-  return yield* Effect.gen(function* () {
-    const snapshot = yield* Snapshot.Service
-    const running = input.active && final.completed === null
-    const to = running ? ((yield* snapshot.capture()) ?? recorded) : recorded
-    if (!to) return []
-    return yield* snapshot.diff({
-      from: Snapshot.ID.make(from),
-      to: Snapshot.ID.make(to),
-      context: input.context ?? PATCH_CONTEXT_LINES,
-    })
-  }).pipe(Effect.provide(locations.get(location)))
-})

packages/core/src/session/message-updater.ts

@@ -60,21 +60,6 @@ export function update(adapter: Adapter, event: SessionEvent.DurableEvent) {
     )
   })
 
-  const idle = (outcome: SessionMessage.Idle["outcome"]) =>
-    clearCurrentRetry.pipe(
-      Effect.andThen(
-        adapter.appendMessage(
-          SessionMessage.Idle.make({
-            id: SessionMessage.ID.fromEvent(event.id),
-            type: "idle",
-            outcome,
-            metadata: event.metadata,
-            time: { created },
-          }),
-        ),
-      ),
-    )
-
   const project = pipe(
     Match.type<SessionEvent.DurableEvent>(),
     Match.discriminatorsExhaustive("type")({
@@ -138,11 +123,9 @@ export function update(adapter: Adapter, event: SessionEvent.DurableEvent) {
       "session.inbox.cancelled": () => Effect.void,
       "session.inbox.delivery.changed": () => Effect.void,
       "session.execution.started": () => Effect.void,
-      "session.execution.succeeded": () => idle("succeeded"),
-      "session.execution.failed": () => idle("failed"),
-      // Shutdown keeps the execution claim and the resumed drain continues the turn.
-      "session.execution.interrupted": (event) =>
-        event.data.reason === "shutdown" ? clearCurrentRetry : idle("interrupted"),
+      "session.execution.succeeded": () => clearCurrentRetry,
+      "session.execution.failed": () => clearCurrentRetry,
+      "session.execution.interrupted": () => clearCurrentRetry,
       "session.instructions.updated": (event) => {
         if (event.data.text === undefined) return Effect.void
         return adapter.appendMessage(

packages/core/src/session/runner/to-llm-message.ts

@@ -226,7 +226,6 @@ function toLLMMessage(message: SessionMessage.Info, model: Model.Ref, providerMe
   switch (message.type) {
     case "agent-switched":
     case "model-switched":
-    case "idle":
       return []
     case "location-switched":
       return [

packages/core/src/snapshot.ts

@@ -131,55 +131,38 @@ const layer = Layer.effect(
       )
     })
 
-    const comparison = Effect.fnUntraced(function* (operation: "files" | "diff", input: CompareInput) {
+    const compare = Effect.fnUntraced(function* (operation: "files" | "diff", input: CompareInput) {
       const repo = yield* repository.pipe(Effect.mapError((cause) => failure(operation, cause)))
-      return {
-        source: repo.source,
+      const comparison = {
         repository: repo.snapshotRepository,
         from: Git.TreeID.make(input.from),
         to: Git.TreeID.make(input.to),
       }
-    })
-
-    // Snapshots track every scoped file; the source repository's ignore rules decide what callers see.
-    const ignored = Effect.fnUntraced(function* (
-      operation: "files" | "diff",
-      source: Git.Repository,
-      paths: readonly RelativePath[],
-    ) {
-      return yield* git.index
-        .ignored({ repository: source, paths })
+      const files = yield* git.tree.files(comparison).pipe(Effect.mapError((cause) => failure(operation, cause)))
+      const ignored = yield* git.index
+        .ignored({ repository: repo.source, paths: files })
         .pipe(Effect.mapError((cause) => failure(operation, cause)))
+      return {
+        input: comparison,
+        files,
+        ignored,
+      }
     })
 
     const files = Effect.fn("Snapshot.files")(function* (input: CompareInput) {
-      const compared = yield* comparison("files", input)
-      const changed = yield* git.tree
-        .files({ repository: compared.repository, from: compared.from, to: compared.to })
-        .pipe(Effect.mapError((cause) => failure("files", cause)))
-      const skipped = yield* ignored("files", compared.source, changed)
-      return changed.filter((file) => !skipped.has(file))
+      const comparison = yield* compare("files", input)
+      return comparison.files.filter((file) => !comparison.ignored.has(file))
     })
 
     const diff = Effect.fn("Snapshot.diff")(function* (input: DiffInput) {
-      if (input.paths?.length === 0) return []
-      const compared = yield* comparison("diff", input)
-      // Only an explicit selection becomes a pathspec; ignored paths are dropped from the result instead.
-      const diffs = yield* git.tree
+      const comparison = yield* compare("diff", input)
+      return yield* git.tree
         .diff({
-          repository: compared.repository,
-          from: compared.from,
-          to: compared.to,
+          ...comparison.input,
           context: input.context,
-          paths: input.paths,
+          paths: (input.paths ?? comparison.files).filter((file) => !comparison.ignored.has(file)),
         })
         .pipe(Effect.mapError((cause) => failure("diff", cause)))
-      const skipped = yield* ignored(
-        "diff",
-        compared.source,
-        diffs.map((file) => RelativePath.make(file.file)),
-      )
-      return diffs.filter((file) => !skipped.has(RelativePath.make(file.file)))
     })
 
     const plan = Effect.fnUntraced(function* (worktree: AbsolutePath, input: RestoreInput) {

packages/core/src/v1/config/permission.ts

@@ -25,7 +25,7 @@ const InputObject = Schema.StructWithRest(
     task: Schema.optional(Rule),
     external_directory: Schema.optional(Rule),
     question: Schema.optional(Action),
-    webfetch: Schema.optional(Rule),
+    webfetch: Schema.optional(Action),
     websearch: Schema.optional(Action),
     lsp: Schema.optional(Rule),
     doom_loop: Schema.optional(Action),

packages/core/test/config/config.test.ts

@@ -1342,7 +1342,6 @@ describe("Config", () => {
                   bash: "ask",
                   edit: { "*.md": "allow", "*": "deny" },
                   question: "deny",
-                  webfetch: { "*": "ask", "https://en.wikipedia.org/*": "allow" },
                 },
                 agent: {
                   reviewer: {
@@ -1421,8 +1420,6 @@ describe("Config", () => {
               { action: "edit", resource: "*.md", effect: "allow" },
               { action: "edit", resource: "*", effect: "deny" },
               { action: "question", resource: "*", effect: "deny" },
-              { action: "webfetch", resource: "*", effect: "ask" },
-              { action: "webfetch", resource: "https://en.wikipedia.org/*", effect: "allow" },
             ])
             expect(documents[0]?.info.agents?.reviewer).toMatchObject({
               system: "Review changes.",

packages/core/test/git.test.ts

@@ -6,7 +6,6 @@ import { Effect } from "effect"
 import { LayerNode } from "@opencode-ai/util/effect/layer-node"
 import { Git } from "@opencode-ai/core/git"
 import { AbsolutePath, RelativePath } from "@opencode-ai/core/schema"
-import { VcsPatch } from "@opencode-ai/core/vcs/patch"
 import { branch, commit, initRepo, read, withRemote } from "./fixture/git"
 import { tmpdir } from "./fixture/tmpdir"
 import { testEffect } from "./lib/effect"
@@ -197,42 +196,6 @@ describe("Git trees", () => {
     }),
   )
 
-  it.live("caps batched tree patches, keeps per-file stats past the cap, and matches non-ASCII names", () =>
-    Effect.gen(function* () {
-      const root = yield* Effect.acquireRelease(
-        Effect.promise(() => tmpdir()),
-        (dir) => Effect.promise(() => dir[Symbol.asyncDispose]()),
-      )
-      yield* Effect.promise(() => initRepo(root.path))
-      const git = yield* Git.Service
-      const repository = yield* git.repo.discover(AbsolutePath.make(root.path))
-      if (!repository) throw new Error("Repository not found")
-      const before = yield* git.tree.capture({ repository, scopes: [RelativePath.make(".")] })
-      const lines = Math.ceil(VcsPatch.MAX_TOTAL_PATCH_BYTES / 80) + 1
-      yield* Effect.promise(async () => {
-        await Bun.write(path.join(root.path, "a-small.txt"), "small\n")
-        await Bun.write(path.join(root.path, "b-large.txt"), `${"x".repeat(79)}\n`.repeat(lines))
-        await Bun.write(path.join(root.path, "c-binary.bin"), new Uint8Array([0, 1, 2, 3]))
-        await Bun.write(path.join(root.path, "a-caf\u00e9.txt"), "caf\u00e9\n")
-      })
-      const after = yield* git.tree.capture({ repository, scopes: [RelativePath.make(".")] })
-
-      const diffs = yield* git.tree.diff({ repository, from: before, to: after, context: 0 })
-      expect(diffs.map((item) => [item.file, item.status, item.additions, item.deletions])).toEqual([
-        ["a-caf\u00e9.txt", "added", 1, 0],
-        ["a-small.txt", "added", 1, 0],
-        ["b-large.txt", "added", lines, 0],
-        ["c-binary.bin", "added", 0, 0],
-      ])
-      // Patch headers are not NUL-delimited; a quoted (octal-escaped) header would orphan this chunk.
-      expect(diffs[0]?.patch).toContain("+caf\u00e9\n")
-      expect(diffs[1]?.patch).toContain("+small\n")
-      expect(diffs[2]?.patch).toBe(VcsPatch.emptyPatch("b-large.txt"))
-      expect(diffs[3]?.patch).toBe("")
-      expect(yield* git.tree.diff({ repository, from: before, to: after, paths: [] })).toEqual([])
-    }),
-  )
-
   it.live("captures, compares, previews, and restores scoped trees", () =>
     Effect.gen(function* () {
       const root = yield* Effect.acquireRelease(

packages/core/test/mcp-oauth.test.ts

@@ -118,6 +118,53 @@ describe("MCP OAuth", () => {
     expect(tokenRequests[0]?.get("refresh_token")).toBe("refresh")
   })
 
+  test("withholds the refresh token when the authorization server issuer changed", async () => {
+    const tokenRequests: unknown[] = []
+    const server = Bun.serve({
+      port: 0,
+      async fetch(request) {
+        const url = new URL(request.url)
+        if (url.pathname === "/.well-known/oauth-authorization-server")
+          return Response.json({
+            issuer: "https://other.example.com",
+            authorization_endpoint: `${url.origin}/authorize`,
+            token_endpoint: `${url.origin}/token`,
+            response_types_supported: ["code"],
+          })
+        if (request.method === "POST" && url.pathname === "/token") {
+          tokenRequests.push(await request.text())
+          return Response.json({ access_token: "next", token_type: "Bearer" })
+        }
+        return new Response(null, { status: 404 })
+      },
+    })
+    const credential = Credential.OAuth.make({
+      type: "oauth",
+      methodID: Integration.MethodID.make("oauth"),
+      access: "expired",
+      refresh: "refresh",
+      expires: Date.now() - 1000,
+      metadata: { serverUrl: server.url.href, tokenType: "Bearer", issuer: server.url.origin },
+    })
+    let issuer: string | undefined
+    const store = McpOAuth.memoryStore()
+    const oauthProvider = McpOAuth.provider({
+      redirectUrl: "http://127.0.0.1/callback",
+      client: { id: "client" },
+      onDiscovery: (discovery) => {
+        issuer = discovery.authorizationServerMetadata?.issuer
+      },
+      onRedirect: () => undefined,
+      store: { ...store, tokens: async () => McpOAuth.toTokens(credential, issuer) },
+    })
+
+    const result = await auth(oauthProvider, { serverUrl: server.url.href }).finally(() => server.stop(true))
+
+    expect(result).toBe("REDIRECT")
+    expect(tokenRequests).toHaveLength(0)
+    expect(McpOAuth.toTokens(credential, server.url.origin).refresh_token).toBe("refresh")
+  })
+
   test("shares concurrent refreshes for the same token", async () => {
     let requests = 0
     const pending = Promise.withResolvers<void>()
@@ -228,6 +275,7 @@ describe("MCP OAuth", () => {
       expect(registrations).toHaveLength(0)
       expect(tokenRequests[0]?.get("client_id")).toBe(McpOAuth.CLIENT_METADATA_URL)
       expect(McpOAuth.clientFromCredential(credential)).toEqual({ client_id: McpOAuth.CLIENT_METADATA_URL })
+      expect(McpOAuth.issuerFromCredential(credential)).toBe(server.url.origin)
     })
 
     test("registers dynamically when the server does not accept public clients", async () => {

packages/core/test/session-diff.test.ts

@@ -1,198 +0,0 @@
-import { $ } from "bun"
-import { describe, expect } from "bun:test"
-import fs from "fs/promises"
-import path from "path"
-import { Effect } from "effect"
-import { Agent } from "@opencode-ai/core/agent"
-import { Bus } from "@opencode-ai/core/bus"
-import { Database } from "@opencode-ai/core/database/database"
-import { AppNodeBuilder } from "@opencode-ai/core/effect/app-node-builder"
-import { LocationServiceMap } from "@opencode-ai/core/location-service-map"
-import { Model } from "@opencode-ai/core/model"
-import { Plugin } from "@opencode-ai/core/plugin"
-import { Provider } from "@opencode-ai/core/provider"
-import { AbsolutePath } from "@opencode-ai/core/schema"
-import { Session } from "@opencode-ai/core/session"
-import { SessionDiff } from "@opencode-ai/core/session/diff"
-import { SessionEvent } from "@opencode-ai/core/session/event"
-import { SessionExecution } from "@opencode-ai/core/session/execution"
-import { SessionInbox } from "@opencode-ai/core/session/inbox"
-import { SessionMessage } from "@opencode-ai/core/session/message"
-import { SessionProjector } from "@opencode-ai/core/session/projector"
-import { Snapshot } from "@opencode-ai/core/snapshot"
-import { Money } from "@opencode-ai/schema/money"
-import { LayerNode } from "@opencode-ai/util/effect/layer-node"
-import { Global } from "@opencode-ai/util/global"
-import { tempGlobalLayer } from "./fixture/global"
-import { offlineModels } from "./fixture/models"
-import { tmpdirScoped } from "./fixture/tmpdir"
-import { testEffect } from "./lib/effect"
-
-const it = testEffect(
-  AppNodeBuilder.build(
-    LayerNode.group([Database.node, Bus.node, SessionProjector.node, Session.node, LocationServiceMap.node]),
-    [Global.node.replace(tempGlobalLayer), SessionExecution.node.replace(SessionExecution.noopLayer), offlineModels],
-  ),
-)
-
-const summarize = (file: { file: string; status: string; additions: number; deletions: number }) => [
-  file.file,
-  file.status,
-  file.additions,
-  file.deletions,
-]
-
-describe("Session.diff", () => {
-  it.live(
-    "diffs the busy period containing a user message and ranges across later turns",
-    () =>
-      Effect.gen(function* () {
-        const tmp = yield* tmpdirScoped()
-        const directory = path.join(tmp.path, "project")
-        const write = (name: string, content: string) => () => Bun.write(path.join(directory, name), content)
-        yield* Effect.promise(async () => {
-          await fs.mkdir(directory)
-          await write("first.txt", "first\n")()
-          await write("second.txt", "second\n")()
-          await write("manual.txt", "manual\n")()
-          await $`git init -q`.cwd(directory).quiet()
-          await $`git -c core.fsmonitor=false add .`.cwd(directory).quiet()
-        })
-        const sessions = yield* Session.Service
-        const database = yield* Database.Service
-        const bus = yield* Bus.Service
-        const locations = yield* LocationServiceMap.Service
-        const created = yield* sessions.create({ location: { directory: AbsolutePath.make(directory) } })
-        const diff = (input?: { messageID?: SessionMessage.ID; to?: SessionMessage.ID }) =>
-          sessions
-            .diff({ sessionID: created.id, context: 0, ...input })
-            .pipe(Effect.map((files) => files.map(summarize)))
-        expect(yield* diff()).toEqual([])
-
-        yield* Effect.gen(function* () {
-          const plugins = yield* Plugin.Service
-          yield* plugins.awaitActivation
-          const snapshot = yield* Snapshot.Service
-          const usage = {
-            cost: Money.USD.zero,
-            tokens: { input: 0, output: 0, reasoning: 0, cache: { read: 0, write: 0 } },
-          }
-          const prompt = Effect.fn(function* (text: string) {
-            const admitted = yield* sessions.prompt({ sessionID: created.id, text, resume: false })
-            yield* SessionInbox.promote(database.db, bus, created.id, "steer")
-            return admitted.id
-          })
-          const step = Effect.fn(function* (edit: () => Promise<unknown>, end: "recorded" | "unrecorded" | "running") {
-            const before = yield* snapshot.capture()
-            if (!before) throw new Error("Start snapshot missing")
-            const assistantMessageID = SessionMessage.ID.create()
-            yield* bus.publish(SessionEvent.Step.Started, {
-              sessionID: created.id,
-              assistantMessageID,
-              agent: Agent.defaultID,
-              model: { id: Model.ID.make("test-model"), providerID: Provider.ID.make("test-provider") },
-              snapshot: before,
-            })
-            yield* Effect.promise(edit)
-            if (end === "running") return assistantMessageID
-            const after = end === "recorded" ? yield* snapshot.capture() : undefined
-            yield* bus.publish(SessionEvent.Step.Ended, {
-              sessionID: created.id,
-              assistantMessageID,
-              finish: "stop",
-              ...usage,
-              snapshot: after,
-              files: after && before ? yield* snapshot.files({ from: before, to: after }) : undefined,
-            })
-            return assistantMessageID
-          })
-
-          const idle = (outcome: "succeeded" | "failed") =>
-            outcome === "succeeded"
-              ? bus.publish(SessionEvent.Execution.Succeeded, { sessionID: created.id })
-              : bus.publish(SessionEvent.Execution.Failed, {
-                  sessionID: created.id,
-                  error: { type: "unknown", message: "failed" },
-                })
-
-          // Before any idle marker exists, a prompt's turn ends at the next prompt.
-          const first = yield* prompt("Edit the first file")
-          const firstStep = yield* step(write("first.txt", "first edited\n"), "recorded")
-          // Edits made while idle are not a turn's work, but a range spanning them still sees them.
-          yield* Effect.promise(write("manual.txt", "manual edited\n"))
-          const second = yield* prompt("Edit the second file")
-          yield* step(write("second.txt", "second edited\n"), "recorded")
-          expect(yield* diff()).toEqual([["second.txt", "modified", 1, 1]])
-          expect(yield* diff({ messageID: first })).toEqual([["first.txt", "modified", 1, 1]])
-
-          // Once markers exist, a turn spans a whole busy period, steers included; earlier history merges into the first one.
-          yield* idle("succeeded")
-          const third = yield* prompt("Add a third file")
-          yield* step(write("third.txt", "third\n"), "recorded")
-          const steer = yield* prompt("Also add a fourth file")
-          yield* step(write("fourth.txt", "fourth\n"), "recorded")
-          yield* idle("failed")
-          const busy = [
-            ["fourth.txt", "added", 1, 0],
-            ["third.txt", "added", 1, 0],
-          ]
-          expect(yield* diff()).toEqual(busy)
-          expect(yield* diff({ messageID: steer })).toEqual(busy)
-          expect(yield* diff({ messageID: second })).toEqual([
-            ["first.txt", "modified", 1, 1],
-            ["manual.txt", "modified", 1, 1],
-            ["second.txt", "modified", 1, 1],
-          ])
-          expect(yield* diff({ messageID: first, to: third })).toEqual([
-            ["first.txt", "modified", 1, 1],
-            ["fourth.txt", "added", 1, 0],
-            ["manual.txt", "modified", 1, 1],
-            ["second.txt", "modified", 1, 1],
-            ["third.txt", "added", 1, 0],
-          ])
-          const full = yield* sessions.diff({ sessionID: created.id, messageID: first })
-          expect(full[0]?.patch).toContain("-first\n+first edited\n")
-          expect(yield* diff({ messageID: steer, to: second }).pipe(Effect.flip)).toMatchObject({
-            _tag: "Session.TurnRangeError",
-            field: "to",
-          })
-          expect(yield* diff({ messageID: firstStep }).pipe(Effect.flip)).toMatchObject({
-            _tag: "Session.TurnRangeError",
-            field: "messageID",
-          })
-          expect(yield* diff({ messageID: SessionMessage.ID.create() }).pipe(Effect.flip)).toMatchObject({
-            _tag: "Session.MessageNotFoundError",
-          })
-
-          // A completed step without an end snapshot falls back to the last recorded end.
-          yield* prompt("Edit both files again")
-          yield* step(write("first.txt", "first edited twice\n"), "recorded")
-          yield* step(write("second.txt", "second edited twice\n"), "unrecorded")
-          yield* idle("succeeded")
-          expect(yield* diff()).toEqual([["first.txt", "modified", 1, 1]])
-
-          // Only a step still running in the active session compares against the working copy.
-          yield* prompt("Delete the manual file")
-          yield* step(() => fs.rm(path.join(directory, "manual.txt")), "running")
-          expect(yield* diff()).toEqual([])
-          const session = yield* sessions.get(created.id)
-          const live = yield* SessionDiff.turn(database.db, locations, { session, active: true, context: 0 })
-          expect(live.map(summarize)).toEqual([["manual.txt", "deleted", 0, 1]])
-
-          // Reverting removes later history, markers included; a fork keeps the copied turns.
-          yield* sessions.revert.stage({ sessionID: created.id, messageID: steer, files: false })
-          yield* sessions.revert.commit(created.id)
-          expect(yield* diff()).toEqual([["third.txt", "added", 1, 0]])
-          expect(yield* diff({ messageID: steer }).pipe(Effect.flip)).toMatchObject({
-            _tag: "Session.MessageNotFoundError",
-          })
-          const forked = yield* sessions.fork({ sessionID: created.id, boundary: { type: "through" } })
-          expect((yield* sessions.diff({ sessionID: forked.id, context: 0 })).map(summarize)).toEqual([
-            ["third.txt", "added", 1, 0],
-          ])
-        }).pipe(Effect.provide(LocationServiceMap.Service.get(created.location)))
-      }),
-    // Real Location/plugin startup and Git snapshots can exceed five seconds under CI load.
-    { timeout: 30_000 },
-  )
-})

packages/core/test/session-execution.test.ts

@@ -561,9 +561,7 @@ describe("SessionRestart background recovery", () => {
         expect(yield* restarted.pendingBackground).toEqual([])
         expect(yield* SessionInbox.list(database.db, sessionID)).toHaveLength(delivered ? 0 : 1)
         yield* SessionInbox.promote(database.db, bus, sessionID, "steer")
-        // Recovery ends a busy period, so an idle marker follows the notification.
-        const messages = (yield* sessions.messages({ sessionID })).filter((message) => message.type !== "idle")
-        expect(messages).toMatchObject([
+        expect(yield* sessions.messages({ sessionID })).toMatchObject([
           {
             id: background.notificationID,
             type: "synthetic",
@@ -571,6 +569,7 @@ describe("SessionRestart background recovery", () => {
             metadata: { state: "completed" },
           },
         ])
+        expect(yield* sessions.messages({ sessionID })).toHaveLength(1)
       }),
     )
   }

packages/protocol/openapi.json

@@ -1621,7 +1621,14 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                  "anyOf": [
+                    {
+                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                    },
+                    {
+                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                    }
+                  ]
                 }
               }
             }
@@ -3242,152 +3249,6 @@
         "summary": "Get session context"
       }
     },
-    "/api/session/{sessionID}/diff": {
-      "get": {
-        "tags": ["session"],
-        "operationId": "v2.session.diff",
-        "parameters": [
-          {
-            "name": "sessionID",
-            "in": "path",
-            "schema": {
-              "type": "string",
-              "pattern": "^ses"
-            },
-            "required": true
-          },
-          {
-            "name": "messageID",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "pattern": "^msg_"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "User message whose turn to diff. Defaults to the turn of the newest user message."
-            },
-            "required": false
-          },
-          {
-            "name": "to",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "pattern": "^msg_"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Later user message whose turn ends the range. Defaults to the turn of `messageID` alone."
-            },
-            "required": false
-          },
-          {
-            "name": "context",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Unchanged lines around each hunk. Omit for full-file patches."
-            },
-            "required": false
-          }
-        ],
-        "security": [],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "data": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/FileDiff.Info"
-                      }
-                    }
-                  },
-                  "required": ["data"],
-                  "additionalProperties": false
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "InvalidRequestError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/InvalidRequestErrorEncoded"
-                    },
-                    {
-                      "$ref": "#/components/schemas/InvalidRequestErrorEncoded"
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "UnauthorizedError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/UnauthorizedErrorEncoded"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "MessageNotFoundError | SessionNotFoundError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/MessageNotFoundErrorEncoded"
-                    },
-                    {
-                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "500": {
-            "description": "UnknownError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/UnknownErrorEncoded"
-                }
-              }
-            }
-          }
-        },
-        "description": "Structured per-file diffs of the files a turn changed. A turn runs from the first prompt after the session was last idle until its next idle marker, so prompts steered in while it was busy belong to the same turn; `to` extends the range through a later turn. Compares the range's first recorded snapshot with its last; a step still running in the active session compares against the working copy. Ranges that span a location change are rejected. In sessions without any idle marker, a prompt's turn spans until the next user message.",
-        "summary": "Diff session turns"
-      }
-    },
     "/api/session/{sessionID}/inbox": {
       "get": {
         "tags": ["session"],
@@ -18625,38 +18486,6 @@
         "required": ["type", "id", "time", "status", "reason", "summary", "recent"],
         "additionalProperties": false
       },
-      "Session.Message.Idle": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "pattern": "^msg_"
-          },
-          "metadata": {
-            "type": "object"
-          },
-          "time": {
-            "type": "object",
-            "properties": {
-              "created": {
-                "type": "number"
-              }
-            },
-            "required": ["created"],
-            "additionalProperties": false
-          },
-          "type": {
-            "type": "string",
-            "enum": ["idle"]
-          },
-          "outcome": {
-            "type": "string",
-            "enum": ["succeeded", "failed", "interrupted"]
-          }
-        },
-        "required": ["id", "time", "type", "outcome"],
-        "additionalProperties": false
-      },
       "Session.Message.Info": {
         "anyOf": [
           {
@@ -18688,9 +18517,6 @@
           },
           {
             "$ref": "#/components/schemas/Session.Message.Compaction"
-          },
-          {
-            "$ref": "#/components/schemas/Session.Message.Idle"
           }
         ]
       },

packages/protocol/src/groups/session.ts

@@ -30,7 +30,6 @@ import { Model } from "@opencode-ai/schema/model"
 import { Location } from "@opencode-ai/schema/location"
 import { SessionEvent } from "@opencode-ai/schema/session-event"
 import { EventLog } from "@opencode-ai/schema/event-log"
-import { FileDiff } from "@opencode-ai/schema/file-diff"
 
 const ParentIDFilter = Schema.Union([
   Session.ID,
@@ -522,31 +521,6 @@ export const makeSessionGroup = <I extends HttpApiMiddleware.AnyId, S>(sessionLo
         }),
       ),
     )
-    .add(
-      HttpApiEndpoint.get("session.diff", "/api/session/:sessionID/diff", {
-        params: { sessionID: Session.ID },
-        query: Schema.Struct({
-          messageID: Schema.optional(SessionMessage.ID).annotate({
-            description: "User message whose turn to diff. Defaults to the turn of the newest user message.",
-          }),
-          to: Schema.optional(SessionMessage.ID).annotate({
-            description: "Later user message whose turn ends the range. Defaults to the turn of `messageID` alone.",
-          }),
-          context: Schema.NumberFromString.pipe(Schema.decodeTo(NonNegativeInt), Schema.optional).annotate({
-            description: "Unchanged lines around each hunk. Omit for full-file patches.",
-          }),
-        }),
-        success: Schema.Struct({ data: Schema.Array(FileDiff.Info) }),
-        error: [InvalidRequestError, MessageNotFoundError, SessionNotFoundError, UnknownError],
-      }).annotateMerge(
-        OpenApi.annotations({
-          identifier: "v2.session.diff",
-          summary: "Diff session turns",
-          description:
-            "Structured per-file diffs of the files a turn changed. A turn runs from the first prompt after the session was last idle until its next idle marker, so prompts steered in while it was busy belong to the same turn; `to` extends the range through a later turn. Compares the range's first recorded snapshot with its last; a step still running in the active session compares against the working copy. Ranges that span a location change are rejected. In sessions without any idle marker, a prompt's turn spans until the next user message.",
-        }),
-      ),
-    )
     .add(
       HttpApiEndpoint.get("session.inbox.list", "/api/session/:sessionID/inbox", {
         params: { sessionID: Session.ID },

packages/schema/src/session-message.ts

@@ -272,18 +272,6 @@ export const Compaction = Schema.Union([CompactionRunning, CompactionCompleted,
 )
 export type Compaction = CompactionRunning | CompactionCompleted | CompactionFailed
 
-/**
- * Marks the Session going idle: every step since the previous marker belongs to
- * one turn, including prompts steered in while it was busy. A shutdown does not
- * record one, since the resumed execution continues the same turn.
- */
-export interface Idle extends Schema.Schema.Type<typeof Idle> {}
-export const Idle = Schema.Struct({
-  ...Base,
-  type: Schema.tag("idle"),
-  outcome: Schema.Literals(["succeeded", "failed", "interrupted"]),
-}).annotate({ identifier: "Session.Message.Idle" })
-
 export const Info = Schema.Union([
   AgentSelected,
   ModelSelected,
@@ -295,7 +283,6 @@ export const Info = Schema.Union([
   Shell,
   Assistant,
   Compaction,
-  Idle,
 ]).annotate({ identifier: "Session.Message.Info" })
 export type Info =
   | AgentSelected
@@ -308,5 +295,4 @@ export type Info =
   | Shell
   | Assistant
   | Compaction
-  | Idle
 export type Type = Info["type"]

packages/server/src/handlers/session-error.ts

@@ -1,6 +1,5 @@
 import { Session } from "@opencode-ai/core/session"
-import type { Snapshot } from "@opencode-ai/core/snapshot"
-import { MessageNotFoundError, SessionNotFoundError, UnknownError } from "@opencode-ai/protocol/errors"
+import { SessionNotFoundError, UnknownError } from "@opencode-ai/protocol/errors"
 import { Effect } from "effect"
 
 export function missingSession(error: Session.NotFoundError) {
@@ -10,14 +9,6 @@ export function missingSession(error: Session.NotFoundError) {
   })
 }
 
-export function missingMessage(error: Session.MessageNotFoundError) {
-  return new MessageNotFoundError({
-    sessionID: error.sessionID,
-    messageID: error.messageID,
-    message: `Message not found: ${error.messageID}`,
-  })
-}
-
 export function failedMessageDecode(error: Session.MessageDecodeError) {
   const ref = `err_${crypto.randomUUID().slice(0, 8)}`
   return Effect.logError("failed to decode session message").pipe(
@@ -27,16 +18,3 @@ export function failedMessageDecode(error: Session.MessageDecodeError) {
     ),
   )
 }
-
-/** Snapshot repositories are host state clients cannot repair, so surface only a log reference. */
-export function failedSnapshot(operation: string, sessionID: Session.ID) {
-  return (error: Snapshot.Error) => {
-    const ref = `err_${crypto.randomUUID().slice(0, 8)}`
-    return Effect.logError(`failed to ${operation}`, { cause: error }).pipe(
-      Effect.annotateLogs({ ref, sessionID }),
-      Effect.andThen(
-        Effect.fail(new UnknownError({ message: "Unexpected server error. Check server logs for details.", ref })),
-      ),
-    )
-  }
-}

packages/server/src/handlers/session.ts

@@ -17,9 +17,10 @@ import {
   ServiceUnavailableError,
   SessionBusyError,
   SkillNotFoundError,
+  UnknownError,
 } from "@opencode-ai/protocol/errors"
 import { AbsolutePath } from "@opencode-ai/core/schema"
-import { failedMessageDecode, failedSnapshot, missingMessage, missingSession } from "./session-error"
+import { failedMessageDecode, missingSession } from "./session-error"
 
 const DefaultSessionsLimit = 50
 
@@ -211,7 +212,15 @@ export const SessionHandler = HttpApiBuilder.group(Api, "server.session", (handl
           return {
             data: yield* session.fork({ sessionID: ctx.params.sessionID, boundary: ctx.payload.boundary }).pipe(
               Effect.catchTag("Session.NotFoundError", missingSession),
-              Effect.catchTag("Session.MessageNotFoundError", missingMessage),
+              Effect.catchTag(
+                "Session.MessageNotFoundError",
+                (error) =>
+                  new MessageNotFoundError({
+                    sessionID: error.sessionID,
+                    messageID: error.messageID,
+                    message: `Message not found: ${error.messageID}`,
+                  }),
+              ),
               Effect.catchTag(
                 "Session.ForkEmptyError",
                 (error) => new InvalidRequestError({ message: error.message, kind: "empty_session" }),
@@ -439,14 +448,32 @@ export const SessionHandler = HttpApiBuilder.group(Api, "server.session", (handl
             files: ctx.payload.files,
           })
           return {
-            data: yield* session.revert
-              .stage({ ...ctx.params, ...ctx.payload })
-              .pipe(
-                Effect.catchTag("Session.NotFoundError", missingSession),
-                Effect.catchTag("Session.MessageNotFoundError", missingMessage),
-                Effect.catchTag("Session.BusyError", busySession),
-                Effect.catchTag("Snapshot.Error", failedSnapshot("stage session revert", ctx.params.sessionID)),
+            data: yield* session.revert.stage({ ...ctx.params, ...ctx.payload }).pipe(
+              Effect.catchTag("Session.NotFoundError", missingSession),
+              Effect.catchTag(
+                "Session.MessageNotFoundError",
+                (error) =>
+                  new MessageNotFoundError({
+                    sessionID: error.sessionID,
+                    messageID: error.messageID,
+                    message: `Message not found: ${error.messageID}`,
+                  }),
               ),
+              Effect.catchTag("Session.BusyError", busySession),
+              Effect.catchTag("Snapshot.Error", (error) => {
+                const ref = `err_${crypto.randomUUID().slice(0, 8)}`
+                return Effect.logError("failed to stage session revert", { cause: error }).pipe(
+                  Effect.andThen(
+                    Effect.fail(
+                      new UnknownError({
+                        message: "Unexpected server error. Check server logs for details.",
+                        ref,
+                      }),
+                    ),
+                  ),
+                )
+              }),
+            ),
           }
         }),
       )
@@ -454,13 +481,23 @@ export const SessionHandler = HttpApiBuilder.group(Api, "server.session", (handl
         "session.revert.clear",
         Effect.fn(function* (ctx) {
           yield* Effect.log("session.revert.clear", { sessionID: ctx.params.sessionID })
-          yield* session.revert
-            .clear(ctx.params.sessionID)
-            .pipe(
-              Effect.catchTag("Session.NotFoundError", missingSession),
-              Effect.catchTag("Session.BusyError", busySession),
-              Effect.catchTag("Snapshot.Error", failedSnapshot("clear session revert", ctx.params.sessionID)),
-            )
+          yield* session.revert.clear(ctx.params.sessionID).pipe(
+            Effect.catchTag("Session.NotFoundError", missingSession),
+            Effect.catchTag("Session.BusyError", busySession),
+            Effect.catchTag("Snapshot.Error", (error) => {
+              const ref = `err_${crypto.randomUUID().slice(0, 8)}`
+              return Effect.logError("failed to clear session revert", { cause: error }).pipe(
+                Effect.andThen(
+                  Effect.fail(
+                    new UnknownError({
+                      message: "Unexpected server error. Check server logs for details.",
+                      ref,
+                    }),
+                  ),
+                ),
+              )
+            }),
+          )
           return HttpApiSchema.NoContent.make()
         }),
       )
@@ -490,22 +527,6 @@ export const SessionHandler = HttpApiBuilder.group(Api, "server.session", (handl
           }
         }),
       )
-      .handle(
-        "session.diff",
-        Effect.fn(function* (ctx) {
-          return {
-            data: yield* session.diff({ sessionID: ctx.params.sessionID, ...ctx.query }).pipe(
-              Effect.catchTag("Session.NotFoundError", missingSession),
-              Effect.catchTag("Session.MessageNotFoundError", missingMessage),
-              Effect.catchTag(
-                "Session.TurnRangeError",
-                (error) => new InvalidRequestError({ message: error.message, field: error.field }),
-              ),
-              Effect.catchTag("Snapshot.Error", failedSnapshot("diff session turn", ctx.params.sessionID)),
-            ),
-          }
-        }),
-      )
       .handle(
         "session.inbox.list",
         Effect.fn(function* (ctx) {
@@ -621,7 +642,15 @@ export const SessionHandler = HttpApiBuilder.group(Api, "server.session", (handl
         Effect.fn(function* (ctx) {
           const message = yield* session.updateMessage({ ...ctx.params, content: ctx.payload.content }).pipe(
             Effect.catchTag("Session.NotFoundError", missingSession),
-            Effect.catchTag("Session.MessageNotFoundError", missingMessage),
+            Effect.catchTag(
+              "Session.MessageNotFoundError",
+              (error) =>
+                new MessageNotFoundError({
+                  sessionID: error.sessionID,
+                  messageID: error.messageID,
+                  message: `Message not found: ${error.messageID}`,
+                }),
+            ),
             Effect.catchTag("Session.BusyError", busySession),
             Effect.catchTag(
               "Session.MessageNotAssistantError",

packages/server/test/session-diff.test.ts

@@ -1,98 +0,0 @@
-import { expect, setDefaultTimeout } from "bun:test"
-import { Agent } from "@opencode-ai/core/agent"
-import { Bus } from "@opencode-ai/core/bus"
-import { Model } from "@opencode-ai/core/model"
-import { Provider } from "@opencode-ai/core/provider"
-import { Session } from "@opencode-ai/core/session"
-import { SessionEvent } from "@opencode-ai/core/session/event"
-import { SessionExecution } from "@opencode-ai/core/session/execution"
-import { SessionMessage } from "@opencode-ai/core/session/message"
-import { Money } from "@opencode-ai/schema/money"
-import { makeGlobalNode } from "@opencode-ai/util/effect/app-node"
-import { Effect, Layer } from "effect"
-import { tmpdir } from "../../core/test/fixture/tmpdir"
-import { it } from "../../core/test/lib/effect"
-import { ServerFetch } from "../src/fetch"
-
-setDefaultTimeout(30_000)
-
-it.live("serves turn diffs by user message with range validation", () =>
-  Effect.gen(function* () {
-    const tmp = yield* Effect.acquireDisposable(Effect.promise(() => tmpdir("opencode-session-diff-")))
-    const ids = { user: SessionMessage.ID.create(), assistant: SessionMessage.ID.create() }
-    // Deliver the prompt and one step the way the runner would, without a model.
-    const execution = Layer.effect(
-      SessionExecution.Service,
-      Effect.gen(function* () {
-        const bus = yield* Bus.Service
-        return SessionExecution.Service.of({
-          active: Effect.succeed(new Set()),
-          isActive: () => Effect.succeed(false),
-          resume: () => Effect.void,
-          wake: (sessionID) =>
-            Effect.gen(function* () {
-              yield* bus.publish(SessionEvent.InboxDelivered, { sessionID, inboxID: ids.user })
-              yield* bus.publish(SessionEvent.Step.Started, {
-                sessionID,
-                assistantMessageID: ids.assistant,
-                agent: Agent.defaultID,
-                model: { id: Model.ID.make("model"), providerID: Provider.ID.make("provider") },
-              })
-              yield* bus.publish(SessionEvent.Step.Ended, {
-                sessionID,
-                assistantMessageID: ids.assistant,
-                finish: "stop",
-                cost: Money.USD.zero,
-                tokens: { input: 0, output: 0, reasoning: 0, cache: { read: 0, write: 0 } },
-              })
-            }),
-          interrupt: () => Effect.succeed(false),
-          awaitIdle: () => Effect.void,
-        })
-      }),
-    )
-    const handler = yield* ServerFetch.make(
-      {
-        app: { version: "test-version" },
-        database: { path: ":memory:" },
-        fs: { filewatcher: false },
-        models: { fetch: false },
-      },
-      {
-        overrides: [
-          SessionExecution.node.replace(
-            makeGlobalNode({ service: SessionExecution.Service, layer: execution, deps: [Bus.node] }),
-          ),
-        ],
-      },
-    )
-    const request = (path: string, body?: unknown) =>
-      Effect.promise(async () => {
-        const response = await handler(
-          new Request(`http://opencode.local${path}`, {
-            method: body === undefined ? "GET" : "POST",
-            headers: body === undefined ? undefined : { "content-type": "application/json" },
-            body: body === undefined ? undefined : JSON.stringify(body),
-          }),
-        )
-        return { status: response.status, body: (await response.json()) as Record<string, unknown> }
-      })
-    const created = yield* request("/api/session", { location: { directory: tmp.path } })
-    const sessionID = Session.ID.make((created.body.data as { id: string }).id)
-    const diff = (query = "") => request(`/api/session/${sessionID}/diff${query}`)
-
-    expect(yield* diff()).toEqual({ status: 200, body: { data: [] } })
-    expect((yield* request(`/api/session/${sessionID}/prompt`, { id: ids.user, text: "prompt" })).status).toBe(200)
-    // Not a git repository, so steps record no snapshots and the turn has no diff.
-    expect(yield* diff(`?messageID=${ids.user}&context=3`)).toEqual({ status: 200, body: { data: [] } })
-    expect(yield* diff(`?messageID=${ids.assistant}`)).toMatchObject({
-      status: 400,
-      body: { _tag: "InvalidRequestError", field: "messageID" },
-    })
-    expect(yield* diff(`?messageID=${SessionMessage.ID.create()}`)).toMatchObject({
-      status: 404,
-      body: { _tag: "MessageNotFoundError" },
-    })
-    expect((yield* request(`/api/session/${Session.ID.create()}/diff`)).status).toBe(404)
-  }),
-)

packages/session-ui/src/timeline/projection.ts

@@ -16,7 +16,7 @@ export { TimelineRow, type PartGroup, type PartRef, type TimelineRowMap }
 
 export type ReasoningMode = "hidden" | "compact" | "full"
 
-type Notice = Exclude<SessionMessageInfo, { type: "user" | "assistant" | "shell" | "idle" }>
+type Notice = Exclude<SessionMessageInfo, { type: "user" | "assistant" | "shell" }>
 type Entry = { type: "assistant"; message: SessionMessageAssistant } | { type: "notice"; message: Notice }
 type Content = SessionMessageAssistant["content"][number]
 type GroupRow = Extract<TimelineRow.TimelineRow, { _tag: "AssistantPart" }>
@@ -765,8 +765,7 @@ function record(value: unknown): value is Record<string, unknown> {
 }
 
 function isNotice(message: SessionMessageInfo): message is Notice {
-  if (message.type === "user" || message.type === "assistant" || message.type === "shell" || message.type === "idle")
-    return false
+  if (message.type === "user" || message.type === "assistant" || message.type === "shell") return false
   if (message.type !== "synthetic") return true
   return !!message.description?.trim() || timelineNoticeRequired(message)
 }

packages/tui/src/routes/session/rows.ts

@@ -171,18 +171,8 @@ export function createSessionRows(sessionID: Accessor<string>, onSynced?: (sessi
   const appendPart = (ref: PartRef, part: AppendPart) =>
     setRows(
       produce((draft) => {
-        if (!hasPart(draft, ref)) {
-          append(draft, ref, part, queuedStart(draft))
-          return
-        }
-        if (part.type !== "reasoning" || part.time?.completed === undefined) return
-        const row = draft.find(
-          (row) =>
-            row.type === "group" &&
-            row.kind === "reasoning" &&
-            row.refs.some((item) => item.messageID === ref.messageID && item.partID === ref.partID),
-        )
-        if (row?.type === "group" && row.kind === "reasoning") row.completed = true
+        if (hasPart(draft, ref)) return
+        append(draft, ref, part, queuedStart(draft))
       }),
     )
 
@@ -260,7 +250,7 @@ export function createSessionRows(sessionID: Accessor<string>, onSynced?: (sessi
       if (event.data.sessionID === sessionID() && event.data.text.trim())
         appendPart(
           { messageID: event.data.assistantMessageID, partID: `reasoning:${event.data.ordinal}` },
-          { type: "reasoning", time: { completed: event.created } },
+          { type: "reasoning" },
         )
     }),
     data.on("session.tool.input.started", (event) => {
@@ -305,7 +295,6 @@ export function reduceSessionRows(messages: SessionMessageInfo[], inputs = new S
     ...messages.filter(isInput),
   ].reduce<SessionRow[]>((rows, message) => {
     if (message.type !== "assistant") {
-      if (message.type === "idle") return rows
       if (message.type === "synthetic" && !message.description?.trim()) return rows
       if (message.type === "compaction" && message.status === "completed" && usage) usage.previousTurnCache = undefined
       if (!pending.has(message.id)) completePrevious(rows)
@@ -448,26 +437,17 @@ export function resolvePart(message: SessionMessageAssistant, partID: string) {
   return message.content.filter((part) => part.type === match[1])[ordinal]
 }
 
-type AppendPart =
-  | { type: "text" }
-  | { type: "reasoning"; time?: { completed?: number } }
-  | { type: "tool"; name: string }
+type AppendPart = { type: "text" } | { type: "reasoning" } | { type: "tool"; name: string }
 
 function append(rows: SessionRow[], ref: PartRef, part: AppendPart, index = rows.length) {
   if (part.type === "reasoning") {
     const previous = rows[index - 1]
     if (previous?.type === "group" && previous.kind === "reasoning") {
       previous.refs.push(ref)
-      previous.completed &&= part.time?.completed !== undefined
       return
     }
     completePrevious(rows, index)
-    rows.splice(index, 0, {
-      type: "group",
-      kind: "reasoning",
-      refs: [ref],
-      completed: part.time?.completed !== undefined,
-    })
+    rows.splice(index, 0, { type: "group", kind: "reasoning", refs: [ref], completed: false })
     return
   }
   if (part.type === "tool" && exploration(part.name)) {

packages/web/src/content/docs/permissions.mdx

@@ -83,10 +83,6 @@ For most permissions, you can use an object to apply different actions based on
     "edit": {
       "*": "deny",
       "packages/web/src/content/docs/*.mdx": "allow"
-    },
-    "webfetch": {
-      "*": "ask",
-      "https://en.wikipedia.org/*": "allow"
     }
   }
 }
@@ -163,7 +159,7 @@ OpenCode permissions are keyed by tool name, plus a couple of safety guards:
 - `lsp` — running LSP queries (currently non-granular)
 - `question` — asking the user questions during execution
 - `webfetch` — fetching a URL (matches the URL)
-- `websearch` — web search
+- `websearch` — web search (matches the query)
 - `external_directory` — triggered when a tool touches paths outside the project working directory
 - `doom_loop` — triggered when the same tool call repeats 3 times with identical input
 

packages/www/openapi.json

@@ -1621,7 +1621,14 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                  "anyOf": [
+                    {
+                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                    },
+                    {
+                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                    }
+                  ]
                 }
               }
             }
@@ -3242,152 +3249,6 @@
         "summary": "Get session context"
       }
     },
-    "/api/session/{sessionID}/diff": {
-      "get": {
-        "tags": ["session"],
-        "operationId": "v2.session.diff",
-        "parameters": [
-          {
-            "name": "sessionID",
-            "in": "path",
-            "schema": {
-              "type": "string",
-              "pattern": "^ses"
-            },
-            "required": true
-          },
-          {
-            "name": "messageID",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "pattern": "^msg_"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "User message whose turn to diff. Defaults to the turn of the newest user message."
-            },
-            "required": false
-          },
-          {
-            "name": "to",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "pattern": "^msg_"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Later user message whose turn ends the range. Defaults to the turn of `messageID` alone."
-            },
-            "required": false
-          },
-          {
-            "name": "context",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Unchanged lines around each hunk. Omit for full-file patches."
-            },
-            "required": false
-          }
-        ],
-        "security": [],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "data": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/FileDiff.Info"
-                      }
-                    }
-                  },
-                  "required": ["data"],
-                  "additionalProperties": false
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "InvalidRequestError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/InvalidRequestErrorEncoded"
-                    },
-                    {
-                      "$ref": "#/components/schemas/InvalidRequestErrorEncoded"
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "UnauthorizedError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/UnauthorizedErrorEncoded"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "MessageNotFoundError | SessionNotFoundError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/MessageNotFoundErrorEncoded"
-                    },
-                    {
-                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "500": {
-            "description": "UnknownError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/UnknownErrorEncoded"
-                }
-              }
-            }
-          }
-        },
-        "description": "Structured per-file diffs of the files a turn changed. A turn runs from the first prompt after the session was last idle until its next idle marker, so prompts steered in while it was busy belong to the same turn; `to` extends the range through a later turn. Compares the range's first recorded snapshot with its last; a step still running in the active session compares against the working copy. Ranges that span a location change are rejected. In sessions without any idle marker, a prompt's turn spans until the next user message.",
-        "summary": "Diff session turns"
-      }
-    },
     "/api/session/{sessionID}/inbox": {
       "get": {
         "tags": ["session"],
@@ -18625,38 +18486,6 @@
         "required": ["type", "id", "time", "status", "reason", "summary", "recent"],
         "additionalProperties": false
       },
-      "Session.Message.Idle": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "pattern": "^msg_"
-          },
-          "metadata": {
-            "type": "object"
-          },
-          "time": {
-            "type": "object",
-            "properties": {
-              "created": {
-                "type": "number"
-              }
-            },
-            "required": ["created"],
-            "additionalProperties": false
-          },
-          "type": {
-            "type": "string",
-            "enum": ["idle"]
-          },
-          "outcome": {
-            "type": "string",
-            "enum": ["succeeded", "failed", "interrupted"]
-          }
-        },
-        "required": ["id", "time", "type", "outcome"],
-        "additionalProperties": false
-      },
       "Session.Message.Info": {
         "anyOf": [
           {
@@ -18688,9 +18517,6 @@
           },
           {
             "$ref": "#/components/schemas/Session.Message.Compaction"
-          },
-          {
-            "$ref": "#/components/schemas/Session.Message.Idle"
           }
         ]
       },

packages/www/public/openapi.json

@@ -1621,7 +1621,14 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                  "anyOf": [
+                    {
+                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                    },
+                    {
+                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
+                    }
+                  ]
                 }
               }
             }
@@ -3242,152 +3249,6 @@
         "summary": "Get session context"
       }
     },
-    "/api/session/{sessionID}/diff": {
-      "get": {
-        "tags": ["session"],
-        "operationId": "v2.session.diff",
-        "parameters": [
-          {
-            "name": "sessionID",
-            "in": "path",
-            "schema": {
-              "type": "string",
-              "pattern": "^ses"
-            },
-            "required": true
-          },
-          {
-            "name": "messageID",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "pattern": "^msg_"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "User message whose turn to diff. Defaults to the turn of the newest user message."
-            },
-            "required": false
-          },
-          {
-            "name": "to",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string",
-                  "pattern": "^msg_"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Later user message whose turn ends the range. Defaults to the turn of `messageID` alone."
-            },
-            "required": false
-          },
-          {
-            "name": "context",
-            "in": "query",
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string"
-                },
-                {
-                  "type": "null"
-                }
-              ],
-              "description": "Unchanged lines around each hunk. Omit for full-file patches."
-            },
-            "required": false
-          }
-        ],
-        "security": [],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "data": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/FileDiff.Info"
-                      }
-                    }
-                  },
-                  "required": ["data"],
-                  "additionalProperties": false
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "InvalidRequestError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/InvalidRequestErrorEncoded"
-                    },
-                    {
-                      "$ref": "#/components/schemas/InvalidRequestErrorEncoded"
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "UnauthorizedError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/UnauthorizedErrorEncoded"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "MessageNotFoundError | SessionNotFoundError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/MessageNotFoundErrorEncoded"
-                    },
-                    {
-                      "$ref": "#/components/schemas/SessionNotFoundErrorEncoded"
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "500": {
-            "description": "UnknownError",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/UnknownErrorEncoded"
-                }
-              }
-            }
-          }
-        },
-        "description": "Structured per-file diffs of the files a turn changed. A turn runs from the first prompt after the session was last idle until its next idle marker, so prompts steered in while it was busy belong to the same turn; `to` extends the range through a later turn. Compares the range's first recorded snapshot with its last; a step still running in the active session compares against the working copy. Ranges that span a location change are rejected. In sessions without any idle marker, a prompt's turn spans until the next user message.",
-        "summary": "Diff session turns"
-      }
-    },
     "/api/session/{sessionID}/inbox": {
       "get": {
         "tags": ["session"],
@@ -18625,38 +18486,6 @@
         "required": ["type", "id", "time", "status", "reason", "summary", "recent"],
         "additionalProperties": false
       },
-      "Session.Message.Idle": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "pattern": "^msg_"
-          },
-          "metadata": {
-            "type": "object"
-          },
-          "time": {
-            "type": "object",
-            "properties": {
-              "created": {
-                "type": "number"
-              }
-            },
-            "required": ["created"],
-            "additionalProperties": false
-          },
-          "type": {
-            "type": "string",
-            "enum": ["idle"]
-          },
-          "outcome": {
-            "type": "string",
-            "enum": ["succeeded", "failed", "interrupted"]
-          }
-        },
-        "required": ["id", "time", "type", "outcome"],
-        "additionalProperties": false
-      },
       "Session.Message.Info": {
         "anyOf": [
           {
@@ -18688,9 +18517,6 @@
           },
           {
             "$ref": "#/components/schemas/Session.Message.Compaction"
-          },
-          {
-            "$ref": "#/components/schemas/Session.Message.Idle"
           }
         ]
       },