fix(core): prefer specific permission rules

2026-05-21 23:32:55 +05:30
46 changed files with 2350 additions and 863 deletions
@@ -278,7 +278,6 @@ new sst.cloudflare.x.SolidStart("Console", {
    //VITE_API_URL: gateway.url.apply((url) => url!),
    VITE_AUTH_URL: auth.url.apply((url) => url!),
    VITE_STRIPE_PUBLISHABLE_KEY: STRIPE_PUBLISHABLE_KEY.value,
-    PLACEHOLDER: "keepalive",
  },
  transform: {
    server: {
@@ -348,8 +348,8 @@ export const dict = {
    "Free models include Big Pickle plus promotional models available at the time, with a quota of 200 requests/day. Go includes GLM-5.1, GLM-5, Kimi K2.5, Kimi K2.6, MiMo-V2.5-Pro, MiMo-V2.5, Qwen3.5 Plus, Qwen3.6 Plus, MiniMax M2.5, MiniMax M2.7, DeepSeek V4 Pro, and DeepSeek V4 Flash with higher request quotas enforced across rolling windows (5-hour, weekly, and monthly), roughly equivalent to $12 per 5 hours, $30 per week, and $60 per month (actual request counts vary by model and usage).",

  "zen.api.error.rateLimitExceeded": "Rate limit exceeded. Please try again later.",
-  "zen.api.error.modelNotSupported": "Model {{model}} is not supported",
-  "zen.api.error.modelFormatNotSupported": "Model {{model}} is not supported for format {{format}}",
+  "zen.api.error.modelNotSupported": "Model {{model}} not supported",
+  "zen.api.error.modelFormatNotSupported": "Model {{model}} not supported for format {{format}}",
  "zen.api.error.noProviderAvailable": "No provider available",
  "zen.api.error.providerNotSupported": "Provider {{provider}} not supported",
  "zen.api.error.missingApiKey": "Missing API key.",
@@ -1,19 +0,0 @@
-import { createHash } from "crypto"
-import { ZenData } from "@opencode-ai/console-core/model.js"
-
-export async function GET() {
-  const zenData = ZenData.list("full")
-  return new Response(
-    JSON.stringify({
-      hash: createHash("sha1").update(JSON.stringify(zenData)).digest("hex"),
-      timestamp: Date.now(),
-      check1: "alpha-di-k2.6" in zenData.models,
-      check2: "qwen3.6-plus-free" in zenData.models,
-    }),
-    {
-      headers: {
-        "Content-Type": "application/json",
-      },
-    },
-  )
-}
@@ -4,7 +4,304 @@
 /* deno-fmt-ignore-file */
 /* biome-ignore-all lint: auto-generated */

-/// <reference path="../../../sst-env.d.ts" />
+import "sst"
+declare module "sst" {
+  export interface Resource {
+    "ADMIN_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AUTH_API_URL": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "AWS_SES_ACCESS_KEY_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AWS_SES_SECRET_ACCESS_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_API_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_DEFAULT_ACCOUNT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Console": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_BOT_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_CHANNEL_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Database": {
+      "database": string
+      "host": string
+      "password": string
+      "port": number
+      "type": "sst.sst.Linkable"
+      "username": string
+    }
+    "EMAILOCTOPUS_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_PRIVATE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_ID_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_SECRET_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GOOGLE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HONEYCOMB_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HoneycombWebhookSecret": {
+      "type": "random.index/randomPassword.RandomPassword"
+      "value": string
+    }
+    "R2AccessKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "R2SecretKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_INSTANCE_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_PUBLISHABLE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_SECRET_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_WEBHOOK_SECRET": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "Teams": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "Web": {
+      "type": "sst.cloudflare.Astro"
+      "url": string
+    }
+    "WebApp": {
+      "type": "sst.cloudflare.StaticSite"
+      "url": string
+    }
+    "ZEN_BLACK_PRICE": {
+      "plan100": string
+      "plan20": string
+      "plan200": string
+      "product": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_LIMITS": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_LITE_PRICE": {
+      "firstMonth100Coupon": string
+      "firstMonth50Coupon": string
+      "price": string
+      "priceInr": number
+      "product": string
+      "sixMonths100Coupon": string
+      "threeMonths100Coupon": string
+      "twelveMonths100Coupon": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_MODELS1": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS10": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS11": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS12": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS13": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS14": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS15": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS16": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS17": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS18": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS19": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS2": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS20": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS21": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS22": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS23": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS24": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS25": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS26": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS27": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS28": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS29": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS3": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS30": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS4": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS5": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS6": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS7": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS8": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS9": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_SESSION_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+  }
+}
+// cloudflare 
+import * as cloudflare from "@cloudflare/workers-types";
+declare module "sst" {
+  export interface Resource {
+    "Api": cloudflare.Service
+    "AuthApi": cloudflare.Service
+    "AuthStorage": cloudflare.KVNamespace
+    "Bucket": cloudflare.R2Bucket
+    "EnterpriseStorage": cloudflare.R2Bucket
+    "LogProcessor": cloudflare.Service
+    "Stat": cloudflare.Service
+    "ZenData": cloudflare.R2Bucket
+    "ZenDataNew": cloudflare.R2Bucket
+  }
+}

 import "sst"
 export {}
@@ -4,7 +4,304 @@
 /* deno-fmt-ignore-file */
 /* biome-ignore-all lint: auto-generated */

-/// <reference path="../../../sst-env.d.ts" />
+import "sst"
+declare module "sst" {
+  export interface Resource {
+    "ADMIN_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AUTH_API_URL": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "AWS_SES_ACCESS_KEY_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AWS_SES_SECRET_ACCESS_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_API_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_DEFAULT_ACCOUNT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Console": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_BOT_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_CHANNEL_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Database": {
+      "database": string
+      "host": string
+      "password": string
+      "port": number
+      "type": "sst.sst.Linkable"
+      "username": string
+    }
+    "EMAILOCTOPUS_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_PRIVATE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_ID_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_SECRET_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GOOGLE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HONEYCOMB_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HoneycombWebhookSecret": {
+      "type": "random.index/randomPassword.RandomPassword"
+      "value": string
+    }
+    "R2AccessKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "R2SecretKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_INSTANCE_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_PUBLISHABLE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_SECRET_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_WEBHOOK_SECRET": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "Teams": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "Web": {
+      "type": "sst.cloudflare.Astro"
+      "url": string
+    }
+    "WebApp": {
+      "type": "sst.cloudflare.StaticSite"
+      "url": string
+    }
+    "ZEN_BLACK_PRICE": {
+      "plan100": string
+      "plan20": string
+      "plan200": string
+      "product": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_LIMITS": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_LITE_PRICE": {
+      "firstMonth100Coupon": string
+      "firstMonth50Coupon": string
+      "price": string
+      "priceInr": number
+      "product": string
+      "sixMonths100Coupon": string
+      "threeMonths100Coupon": string
+      "twelveMonths100Coupon": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_MODELS1": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS10": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS11": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS12": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS13": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS14": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS15": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS16": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS17": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS18": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS19": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS2": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS20": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS21": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS22": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS23": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS24": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS25": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS26": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS27": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS28": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS29": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS3": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS30": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS4": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS5": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS6": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS7": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS8": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS9": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_SESSION_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+  }
+}
+// cloudflare 
+import * as cloudflare from "@cloudflare/workers-types";
+declare module "sst" {
+  export interface Resource {
+    "Api": cloudflare.Service
+    "AuthApi": cloudflare.Service
+    "AuthStorage": cloudflare.KVNamespace
+    "Bucket": cloudflare.R2Bucket
+    "EnterpriseStorage": cloudflare.R2Bucket
+    "LogProcessor": cloudflare.Service
+    "Stat": cloudflare.Service
+    "ZenData": cloudflare.R2Bucket
+    "ZenDataNew": cloudflare.R2Bucket
+  }
+}

 import "sst"
 export {}
@@ -5,12 +5,9 @@ export const Resource = new Proxy(
  {},
  {
    get(_target, prop: string) {
-      console.log(`111 ${prop}`)
-      if (`SST_RESOURCE_${prop}` in env) {
-        console.log(`222 ${prop}`)
+      if (prop in env) {
        // @ts-expect-error
-        const value = env[`SST_RESOURCE_${prop}`]
-        console.log(`333 ${value}`)
+        const value = env[prop]
        return typeof value === "string" ? JSON.parse(value) : value
      } else if (prop === "App") {
        // @ts-expect-error
@@ -4,7 +4,304 @@
 /* deno-fmt-ignore-file */
 /* biome-ignore-all lint: auto-generated */

-/// <reference path="../../../sst-env.d.ts" />
+import "sst"
+declare module "sst" {
+  export interface Resource {
+    "ADMIN_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AUTH_API_URL": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "AWS_SES_ACCESS_KEY_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AWS_SES_SECRET_ACCESS_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_API_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_DEFAULT_ACCOUNT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Console": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_BOT_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_CHANNEL_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Database": {
+      "database": string
+      "host": string
+      "password": string
+      "port": number
+      "type": "sst.sst.Linkable"
+      "username": string
+    }
+    "EMAILOCTOPUS_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_PRIVATE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_ID_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_SECRET_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GOOGLE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HONEYCOMB_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HoneycombWebhookSecret": {
+      "type": "random.index/randomPassword.RandomPassword"
+      "value": string
+    }
+    "R2AccessKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "R2SecretKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_INSTANCE_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_PUBLISHABLE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_SECRET_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_WEBHOOK_SECRET": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "Teams": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "Web": {
+      "type": "sst.cloudflare.Astro"
+      "url": string
+    }
+    "WebApp": {
+      "type": "sst.cloudflare.StaticSite"
+      "url": string
+    }
+    "ZEN_BLACK_PRICE": {
+      "plan100": string
+      "plan20": string
+      "plan200": string
+      "product": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_LIMITS": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_LITE_PRICE": {
+      "firstMonth100Coupon": string
+      "firstMonth50Coupon": string
+      "price": string
+      "priceInr": number
+      "product": string
+      "sixMonths100Coupon": string
+      "threeMonths100Coupon": string
+      "twelveMonths100Coupon": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_MODELS1": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS10": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS11": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS12": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS13": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS14": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS15": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS16": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS17": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS18": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS19": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS2": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS20": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS21": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS22": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS23": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS24": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS25": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS26": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS27": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS28": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS29": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS3": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS30": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS4": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS5": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS6": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS7": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS8": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS9": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_SESSION_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+  }
+}
+// cloudflare 
+import * as cloudflare from "@cloudflare/workers-types";
+declare module "sst" {
+  export interface Resource {
+    "Api": cloudflare.Service
+    "AuthApi": cloudflare.Service
+    "AuthStorage": cloudflare.KVNamespace
+    "Bucket": cloudflare.R2Bucket
+    "EnterpriseStorage": cloudflare.R2Bucket
+    "LogProcessor": cloudflare.Service
+    "Stat": cloudflare.Service
+    "ZenData": cloudflare.R2Bucket
+    "ZenDataNew": cloudflare.R2Bucket
+  }
+}

 import "sst"
 export {}
@@ -19,15 +19,7 @@ export type Ruleset = typeof Ruleset.Type
 const EDIT_TOOLS = ["edit", "write", "apply_patch"]

 export function evaluate(permission: string, pattern: string, ...rulesets: Ruleset[]): Rule {
-  return (
-    rulesets
-      .flat()
-      .findLast((rule) => Wildcard.match(permission, rule.permission) && Wildcard.match(pattern, rule.pattern)) ?? {
-      action: "ask",
-      permission,
-      pattern: "*",
-    }
-  )
+  return select(permission, pattern, rulesets.flat())?.rule ?? { action: "ask", permission, pattern: "*" }
 }

 export function merge(...rulesets: Ruleset[]): Ruleset {
@@ -38,8 +30,52 @@ export function disabled(tools: string[], ruleset: Ruleset): Set<string> {
  return new Set(
    tools.filter((tool) => {
      const permission = EDIT_TOOLS.includes(tool) ? "edit" : tool
-      const rule = ruleset.findLast((rule) => Wildcard.match(permission, rule.permission))
-      return rule?.pattern === "*" && rule.action === "deny"
+      if (
+        ruleset.some(
+          (rule) => Wildcard.match(permission, rule.permission) && rule.pattern !== "*" && rule.action !== "deny",
+        )
+      ) {
+        return false
+      }
+      return evaluate(permission, "*", ruleset).action === "deny"
    }),
  )
 }
+
+function select(permission: string, pattern: string, ruleset: Ruleset) {
+  return ruleset.reduce<Selected | undefined>((best, rule, index) => {
+    if (!Wildcard.match(permission, rule.permission) || !Wildcard.match(pattern, rule.pattern)) return best
+    const next = { rule, index, permission: specificity(rule.permission), pattern: specificity(rule.pattern) }
+    if (!best) return next
+    return compare(next, best) >= 0 ? next : best
+  }, undefined)
+}
+
+type Selected = {
+  rule: Rule
+  index: number
+  permission: Specificity
+  pattern: Specificity
+}
+
+type Specificity = {
+  wildcard: number
+  literal: number
+}
+
+function specificity(pattern: string): Specificity {
+  return {
+    wildcard: [...pattern.matchAll(/[?*]/g)].length,
+    literal: pattern.replace(/[?*]/g, "").length,
+  }
+}
+
+function compare(a: Selected, b: Selected) {
+  return (
+    b.permission.wildcard - a.permission.wildcard ||
+    a.permission.literal - b.permission.literal ||
+    b.pattern.wildcard - a.pattern.wildcard ||
+    a.pattern.literal - b.pattern.literal ||
+    a.index - b.index
+  )
+}
@@ -4,7 +4,304 @@
 /* deno-fmt-ignore-file */
 /* biome-ignore-all lint: auto-generated */

-/// <reference path="../../sst-env.d.ts" />
+import "sst"
+declare module "sst" {
+  export interface Resource {
+    "ADMIN_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AUTH_API_URL": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "AWS_SES_ACCESS_KEY_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AWS_SES_SECRET_ACCESS_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_API_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_DEFAULT_ACCOUNT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Console": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_BOT_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_CHANNEL_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Database": {
+      "database": string
+      "host": string
+      "password": string
+      "port": number
+      "type": "sst.sst.Linkable"
+      "username": string
+    }
+    "EMAILOCTOPUS_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_PRIVATE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_ID_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_SECRET_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GOOGLE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HONEYCOMB_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HoneycombWebhookSecret": {
+      "type": "random.index/randomPassword.RandomPassword"
+      "value": string
+    }
+    "R2AccessKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "R2SecretKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_INSTANCE_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_PUBLISHABLE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_SECRET_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_WEBHOOK_SECRET": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "Teams": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "Web": {
+      "type": "sst.cloudflare.Astro"
+      "url": string
+    }
+    "WebApp": {
+      "type": "sst.cloudflare.StaticSite"
+      "url": string
+    }
+    "ZEN_BLACK_PRICE": {
+      "plan100": string
+      "plan20": string
+      "plan200": string
+      "product": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_LIMITS": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_LITE_PRICE": {
+      "firstMonth100Coupon": string
+      "firstMonth50Coupon": string
+      "price": string
+      "priceInr": number
+      "product": string
+      "sixMonths100Coupon": string
+      "threeMonths100Coupon": string
+      "twelveMonths100Coupon": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_MODELS1": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS10": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS11": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS12": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS13": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS14": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS15": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS16": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS17": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS18": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS19": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS2": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS20": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS21": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS22": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS23": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS24": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS25": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS26": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS27": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS28": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS29": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS3": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS30": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS4": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS5": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS6": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS7": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS8": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS9": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_SESSION_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+  }
+}
+// cloudflare 
+import * as cloudflare from "@cloudflare/workers-types";
+declare module "sst" {
+  export interface Resource {
+    "Api": cloudflare.Service
+    "AuthApi": cloudflare.Service
+    "AuthStorage": cloudflare.KVNamespace
+    "Bucket": cloudflare.R2Bucket
+    "EnterpriseStorage": cloudflare.R2Bucket
+    "LogProcessor": cloudflare.Service
+    "Stat": cloudflare.Service
+    "ZenData": cloudflare.R2Bucket
+    "ZenDataNew": cloudflare.R2Bucket
+  }
+}

 import "sst"
 export {}
@@ -4,7 +4,304 @@
 /* deno-fmt-ignore-file */
 /* biome-ignore-all lint: auto-generated */

-/// <reference path="../../sst-env.d.ts" />
+import "sst"
+declare module "sst" {
+  export interface Resource {
+    "ADMIN_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AUTH_API_URL": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "AWS_SES_ACCESS_KEY_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "AWS_SES_SECRET_ACCESS_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_API_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "CLOUDFLARE_DEFAULT_ACCOUNT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Console": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "DISCORD_INCIDENT_WEBHOOK_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_BOT_TOKEN": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "DISCORD_SUPPORT_CHANNEL_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "Database": {
+      "database": string
+      "host": string
+      "password": string
+      "port": number
+      "type": "sst.sst.Linkable"
+      "username": string
+    }
+    "EMAILOCTOPUS_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "FEISHU_APP_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_APP_PRIVATE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_ID_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GITHUB_CLIENT_SECRET_CONSOLE": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "GOOGLE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HONEYCOMB_API_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "HoneycombWebhookSecret": {
+      "type": "random.index/randomPassword.RandomPassword"
+      "value": string
+    }
+    "R2AccessKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "R2SecretKey": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_ID": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_CLIENT_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "SALESFORCE_INSTANCE_URL": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_PUBLISHABLE_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_SECRET_KEY": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "STRIPE_WEBHOOK_SECRET": {
+      "type": "sst.sst.Linkable"
+      "value": string
+    }
+    "Teams": {
+      "type": "sst.cloudflare.SolidStart"
+      "url": string
+    }
+    "Web": {
+      "type": "sst.cloudflare.Astro"
+      "url": string
+    }
+    "WebApp": {
+      "type": "sst.cloudflare.StaticSite"
+      "url": string
+    }
+    "ZEN_BLACK_PRICE": {
+      "plan100": string
+      "plan20": string
+      "plan200": string
+      "product": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_LIMITS": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_LITE_PRICE": {
+      "firstMonth100Coupon": string
+      "firstMonth50Coupon": string
+      "price": string
+      "priceInr": number
+      "product": string
+      "sixMonths100Coupon": string
+      "threeMonths100Coupon": string
+      "twelveMonths100Coupon": string
+      "type": "sst.sst.Linkable"
+    }
+    "ZEN_MODELS1": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS10": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS11": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS12": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS13": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS14": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS15": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS16": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS17": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS18": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS19": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS2": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS20": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS21": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS22": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS23": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS24": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS25": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS26": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS27": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS28": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS29": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS3": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS30": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS4": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS5": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS6": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS7": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS8": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_MODELS9": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+    "ZEN_SESSION_SECRET": {
+      "type": "sst.sst.Secret"
+      "value": string
+    }
+  }
+}
+// cloudflare 
+import * as cloudflare from "@cloudflare/workers-types";
+declare module "sst" {
+  export interface Resource {
+    "Api": cloudflare.Service
+    "AuthApi": cloudflare.Service
+    "AuthStorage": cloudflare.KVNamespace
+    "Bucket": cloudflare.R2Bucket
+    "EnterpriseStorage": cloudflare.R2Bucket
+    "LogProcessor": cloudflare.Service
+    "Stat": cloudflare.Service
+    "ZenData": cloudflare.R2Bucket
+    "ZenDataNew": cloudflare.R2Bucket
+  }
+}

 import "sst"
 export {}
@@ -34,10 +34,10 @@ const AUTOCOMPLETE_ROWS = FOOTER_MENU_ROWS
 const AUTOCOMPLETE_BOTTOM_ROWS = 1

 export const TEXTAREA_MIN_ROWS = 1
-const TEXTAREA_MAX_ROWS = 6
+export const TEXTAREA_MAX_ROWS = 6
 export const PROMPT_MAX_ROWS = TEXTAREA_MAX_ROWS + AUTOCOMPLETE_ROWS - 1 + AUTOCOMPLETE_BOTTOM_ROWS

-const HINT_BREAKPOINTS = {
+export const HINT_BREAKPOINTS = {
  send: 50,
  newline: 66,
  history: 80,
@@ -96,6 +96,8 @@ type RunFooterViewProps = {
  onSubagentSelect?: (sessionID: string | undefined) => void
 }

+export { TEXTAREA_MIN_ROWS, TEXTAREA_MAX_ROWS } from "./footer.prompt"
+
 export function RunFooterView(props: RunFooterViewProps) {
  const term = useTerminalDimensions()
  const active = createMemo<FooterView>(() => props.view?.() ?? { type: "prompt" })
@@ -27,7 +27,7 @@ function todoColor(theme: RunTheme, status: string) {
  return status === "in_progress" ? theme.footer.warning : theme.block.muted
 }

-function entryGroupKey(commit: StreamCommit): string | undefined {
+export function entryGroupKey(commit: StreamCommit): string | undefined {
  if (!commit.partID) {
    return undefined
  }
@@ -49,7 +49,7 @@ export function sameEntryGroup(left: StreamCommit | undefined, right: StreamComm
  return Boolean(current && next && current === next)
 }

-function entryLayout(commit: StreamCommit, body: RunEntryBody = entryBody(commit)): EntryLayout {
+export function entryLayout(commit: StreamCommit, body: RunEntryBody = entryBody(commit)): EntryLayout {
  if (commit.kind === "tool") {
    if (body.type === "structured" || body.type === "markdown") {
      return "block"
@@ -5,6 +5,8 @@ import { useDialog } from "@tui/ui/dialog"
 import { useSync } from "@tui/context/sync"
 import { For, Match, Switch, Show, createMemo } from "solid-js"

+export type DialogStatusProps = {}
+
 export function DialogStatus() {
  const sync = useSync()
  const { theme } = useTheme()
@@ -49,7 +49,7 @@ export function recentConnectedWorkspaces<WorkspaceInfo extends { id: string; ti
  return { recent, hasMore: recent.length < workspaces.length }
 }

-function warpReminderText(dir: string) {
+export function warpReminderText(dir: string) {
  return `<system-reminder>The user has changed the current working directory to "${dir}". This is still the same project but at a possibly new location; take this into account when working with any files from now on.</system-reminder>`
 }

@@ -169,7 +169,7 @@ export async function confirmWorkspaceFileChanges(input: {
  return fileChangeChoice === "yes"
 }

-function DialogWorkspaceSelect(props: {
+export function DialogWorkspaceSelect(props: {
  adapters?: Adapter[]
  onSelect: (selection: WorkspaceSelection) => Promise<void> | void
 }) {
@@ -878,3 +878,8 @@ export function Logo(props: { shape?: LogoShape; ink?: RGBA; idle?: boolean } =
  )
 }

+export function GoLogo() {
+  const { theme } = useTheme()
+  const base = tint(theme.background, theme.text, 0.62)
+  return <Logo shape={go} ink={base} idle />
+}
@@ -15,7 +15,7 @@ import { useSDK } from "./sdk"
 import { RGBA } from "@opentui/core"
 import { Filesystem } from "@/util/filesystem"

-function parseModel(model: string) {
+export function parseModel(model: string) {
  const [providerID, ...rest] = model.split("/")
  return {
    providerID: providerID,
@@ -2,18 +2,18 @@ import { createStore, reconcile } from "solid-js/store"
 import { createSimpleContext } from "./helper"
 import type { PromptInfo } from "../component/prompt/history"

-type HomeRoute = {
+export type HomeRoute = {
  type: "home"
  prompt?: PromptInfo
 }

-type SessionRoute = {
+export type SessionRoute = {
  type: "session"
  sessionID: string
  prompt?: PromptInfo
 }

-type PluginRoute = {
+export type PluginRoute = {
  type: "plugin"
  id: string
  data?: Record<string, unknown>
@@ -44,6 +44,8 @@ export const { use: useRoute, provider: RouteProvider } = createSimpleContext({
  },
 })

+export type RouteContext = ReturnType<typeof useRoute>
+
 export function useRouteData<T extends Route["type"]>(type: T) {
  const route = useRoute()
  return route.data as Extract<Route, { type: typeof type }>
@@ -518,7 +518,7 @@ export function tint(base: RGBA, overlay: RGBA, alpha: number): RGBA {
  return RGBA.fromInts(Math.round(r * 255), Math.round(g * 255), Math.round(b * 255))
 }

-function generateSystem(colors: TerminalColors, mode: "dark" | "light"): ThemeJson {
+export function generateSystem(colors: TerminalColors, mode: "dark" | "light"): ThemeJson {
  const bg = RGBA.fromHex(colors.defaultBackground ?? colors.palette[0]!)
  const fg = RGBA.fromHex(colors.defaultForeground ?? colors.palette[7]!)
  const transparent = RGBA.fromValues(bg.r, bg.g, bg.b, 0)
@@ -7,7 +7,7 @@ import { buildFileTree, flattenFileTree, type FileTreeItem } from "./diff-viewer
 const FILE_TREE_WIDTH = 32
 const FILE_TREE_HORIZONTAL_PADDING = 2

-type DiffViewerFileTreeTheme = {
+export type DiffViewerFileTreeTheme = {
  readonly background: ColorInput
  readonly backgroundPanel: ColorInput
  readonly backgroundElement: ColorInput
@@ -11,7 +11,7 @@ import type { TuiConfig } from "./config/tui"
 import { useTuiConfig } from "./context/tui-config"
 import { TuiKeybind } from "./config/keybind"

-const LEADER_TOKEN = "leader"
+export const LEADER_TOKEN = "leader"
 export const OPENCODE_BASE_MODE = "base"
 export const COMMAND_PALETTE_COMMAND = "command.palette.show"

@@ -38,7 +38,7 @@ function isVisiblePaletteCommand(command: Command) {
  return command.hidden !== true && command.name !== COMMAND_PALETTE_COMMAND
 }

-function createOpencodeModeStack(keymap: OpenTuiKeymap) {
+export function createOpencodeModeStack(keymap: OpenTuiKeymap) {
  keymap.setData(OPENCODE_MODE_KEY, OPENCODE_BASE_MODE)

  const offFields = keymap.registerLayerFields({
@@ -5,7 +5,7 @@ import { isRecord } from "@/util/record"
 type RuntimeSlotMap = TuiSlotMap<Record<string, object>>

 type Slot = <Name extends string>(props: TuiSlotProps<Name>) => JSX.Element | null
-type HostSlotPlugin<Slots extends Record<string, object> = {}> = SolidPlugin<TuiSlotMap<Slots>, TuiSlotContext>
+export type HostSlotPlugin<Slots extends Record<string, object> = {}> = SolidPlugin<TuiSlotMap<Slots>, TuiSlotContext>

 export type HostPluginApi = TuiPluginApi
 export type HostSlots = {
@@ -14,7 +14,7 @@ export type DialogConfirmProps = {
  label?: string
 }

-type DialogConfirmResult = boolean | undefined
+export type DialogConfirmResult = boolean | undefined

 export function DialogConfirm(props: DialogConfirmProps) {
  const dialog = useDialog()
@@ -8,7 +8,7 @@ import { Schema } from "effect"
 import { TuiEvent } from "../event"

 type ToastInput = Schema.Codec.Encoded<typeof TuiEvent.ToastShow.properties>
-type ToastOptions = Schema.Schema.Type<typeof TuiEvent.ToastShow.properties>
+export type ToastOptions = Schema.Schema.Type<typeof TuiEvent.ToastShow.properties>

 const decodeToastOptions = Schema.decodeUnknownSync(TuiEvent.ToastShow.properties)

@@ -84,7 +84,7 @@ function init() {
  return toast
 }

-type ToastContext = ReturnType<typeof init>
+export type ToastContext = ReturnType<typeof init>

 const ctx = createContext<ToastContext>()

@@ -19,7 +19,6 @@ import type { ConsoleState } from "./console-state"
 import { AppFileSystem } from "@opencode-ai/core/filesystem"
 import { InstanceState } from "@/effect/instance-state"
 import { Context, Duration, Effect, Exit, Fiber, Layer, Option, Schema } from "effect"
-import { FetchHttpClient, HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http"
 import { EffectFlock } from "@opencode-ai/core/util/effect-flock"
 import { containsPath, type InstanceContext } from "../project/instance-context"
 import { NonNegativeInt, PositiveInt, type DeepMutable } from "@opencode-ai/core/schema"
@@ -42,7 +41,6 @@ import { ConfigServer } from "./server"
 import { ConfigSkills } from "./skills"
 import { ConfigVariable } from "./variable"
 import { Npm } from "@opencode-ai/core/npm"
-import { withTransientReadRetry } from "@/util/effect-http-client"

 const log = Log.create({ service: "config" })

@@ -72,20 +70,14 @@ function normalizeLoadedConfig(data: unknown, source: string) {
  return copy
 }

-async function substituteWellKnownRemoteConfig(input: {
-  value: unknown
-  dir: string
-  source: string
-  env: Record<string, string>
-}) {
-  if (!isRecord(input.value) || typeof input.value.url !== "string") return undefined
+async function substituteWellKnownRemoteConfig(input: { value: unknown; dir: string; source: string }) {
+  if (!isRecord(input.value) || typeof input.value.url !== "string") return

  const url = await ConfigVariable.substitute({
    text: input.value.url,
    type: "virtual",
    dir: input.dir,
    source: input.source,
-    env: input.env,
  })
  const headers = isRecord(input.value.headers)
    ? Object.fromEntries(
@@ -99,7 +91,6 @@ async function substituteWellKnownRemoteConfig(input: {
                type: "virtual",
                dir: input.dir,
                source: input.source,
-                env: input.env,
              }),
            ]),
        ),
@@ -109,11 +100,6 @@ async function substituteWellKnownRemoteConfig(input: {
  return { url, headers }
 }

-const WellKnownConfig = Schema.Struct({
-  config: Schema.optional(Schema.Json),
-  remote_config: Schema.optional(Schema.Json),
-})
-
 async function resolveLoadedPlugins<T extends { plugin?: ConfigPlugin.Spec[] }>(config: T, filepath: string) {
  if (!config.plugin) return config
  for (let i = 0; i < config.plugin.length; i++) {
@@ -317,7 +303,7 @@ export type Info = DeepMutable<Schema.Schema.Type<typeof Info>> & {
 type State = {
  config: Info
  directories: string[]
-  deps: Fiber.Fiber<void>[]
+  deps: Fiber.Fiber<void, never>[]
  consoleState: ConsoleState
 }

@@ -386,38 +372,17 @@ export const layer = Layer.effect(
    const accountSvc = yield* Account.Service
    const env = yield* Env.Service
    const npmSvc = yield* Npm.Service
-    const http = yield* HttpClient.HttpClient

    const readConfigFile = (filepath: string) => fs.readFileStringSafe(filepath).pipe(Effect.orDie)

-    const fetchRemoteJson = Effect.fnUntraced(function* <S extends Schema.Top>(
-      url: string,
-      headers: Record<string, string> | undefined,
-      schema: S,
-    ) {
-      const response = yield* HttpClient.filterStatusOk(withTransientReadRetry(http))
-        .execute(
-          HttpClientRequest.get(url).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setHeaders(headers ?? {})),
-        )
-        .pipe(
-          Effect.catch((error) => Effect.die(new Error(`failed to fetch remote config from ${url}: ${String(error)}`))),
-        )
-      return yield* HttpClientResponse.schemaBodyJson(schema)(response).pipe(
-        Effect.catch((error) => Effect.die(new Error(`failed to decode remote config from ${url}: ${String(error)}`))),
-      )
-    })
-
    const loadConfig = Effect.fnUntraced(function* (
      text: string,
      options: { path: string } | { dir: string; source: string },
-      env?: Record<string, string>,
    ) {
      const source = "path" in options ? options.path : options.source
      const expanded = yield* Effect.promise(() =>
        ConfigVariable.substitute(
-          "path" in options
-            ? { text, type: "path", path: options.path, env }
-            : { text, type: "virtual", ...options, env },
+          "path" in options ? { text, type: "path", path: options.path } : { text, type: "virtual", ...options },
        ),
      )
      const parsed = ConfigParse.jsonc(expanded, source)
@@ -433,14 +398,14 @@ export const layer = Layer.effect(
      return data
    })

-    const loadFile = Effect.fnUntraced(function* (filepath: string, env?: Record<string, string>) {
+    const loadFile = Effect.fnUntraced(function* (filepath: string) {
      log.info("loading", { path: filepath })
      const text = yield* readConfigFile(filepath)
      if (!text) return {} as Info
-      return yield* loadConfig(text, { path: filepath }, env)
+      return yield* loadConfig(text, { path: filepath })
    })

-    const loadGlobal = Effect.fnUntraced(function* (env?: Record<string, string>) {
+    const loadGlobal = Effect.fnUntraced(function* () {
      let result: Info = {}
      // Seed the default global config with the schema for editor completion, but avoid writing when the user
      // explicitly routes config through env-provided paths or content.
@@ -452,9 +417,9 @@ export const layer = Layer.effect(
            .pipe(Effect.catch(() => Effect.void))
        }
      }
-      result = mergeConfig(result, yield* loadFile(path.join(Global.Path.config, "config.json"), env))
-      result = mergeConfig(result, yield* loadFile(path.join(Global.Path.config, "opencode.json"), env))
-      result = mergeConfig(result, yield* loadFile(path.join(Global.Path.config, "opencode.jsonc"), env))
+      result = mergeConfig(result, yield* loadFile(path.join(Global.Path.config, "config.json")))
+      result = mergeConfig(result, yield* loadFile(path.join(Global.Path.config, "opencode.json")))
+      result = mergeConfig(result, yield* loadFile(path.join(Global.Path.config, "opencode.jsonc")))

      const legacy = path.join(Global.Path.config, "config")
      if (existsSync(legacy)) {
@@ -512,7 +477,6 @@ export const layer = Layer.effect(
        const auth = yield* authSvc.all().pipe(Effect.orDie)

        let result: Info = {}
-        const authEnv: Record<string, string> = {}
        const consoleManagedProviders = new Set<string>()
        let activeOrgName: string | undefined

@@ -552,56 +516,56 @@ export const layer = Layer.effect(
        for (const [key, value] of Object.entries(auth)) {
          if (value.type === "wellknown") {
            const url = key.replace(/\/+$/, "")
-            authEnv[value.key] = value.token
-            const wellknownURL = `${url}/.well-known/opencode`
-            log.debug("fetching remote config", { url: wellknownURL })
-            const wellknown = yield* fetchRemoteJson(wellknownURL, undefined, WellKnownConfig)
+            process.env[value.key] = value.token
+            log.debug("fetching remote config", { url: `${url}/.well-known/opencode` })
+            const response = yield* Effect.promise(() => fetch(`${url}/.well-known/opencode`))
+            if (!response.ok) {
+              throw new Error(`failed to fetch remote config from ${url}: ${response.status}`)
+            }
+            const wellknown = (yield* Effect.promise(() => response.json())) as {
+              config?: Record<string, unknown>
+              remote_config?: unknown
+            }
            const remote = yield* Effect.promise(() =>
              substituteWellKnownRemoteConfig({
                value: wellknown.remote_config,
                dir: url,
-                source: wellknownURL,
-                env: authEnv,
+                source: `${url}/.well-known/opencode`,
              }),
            )
            const fetchedConfig = remote
-              ? yield* Effect.gen(function* () {
+              ? ((yield* Effect.promise(async () => {
                  log.debug("fetching remote config", { url: remote.url })
-                  const data = yield* fetchRemoteJson(remote.url, remote.headers, Schema.Json)
-                  if (isRecord(data) && isRecord(data.config)) return data.config
-                  if (isRecord(data)) return data
-                  return yield* Effect.die(
-                    new Error(`failed to decode remote config from ${remote.url}: expected object`),
-                  )
-                })
+                  const response = await fetch(remote.url, { headers: remote.headers })
+                  if (!response.ok)
+                    throw new Error(`failed to fetch remote config from ${remote.url}: ${response.status}`)
+                  const data = await response.json()
+                  return isRecord(data) && isRecord(data.config) ? data.config : data
+                })) as Record<string, unknown>)
              : {}
-            const remoteConfig = mergeConfig(isRecord(wellknown.config) ? wellknown.config : {}, fetchedConfig)
+            const remoteConfig = mergeConfig(wellknown.config ?? {}, fetchedConfig as Info)
            if (!remoteConfig.$schema) remoteConfig.$schema = "https://opencode.ai/config.json"
-            const source = wellknownURL
-            const next = yield* loadConfig(
-              JSON.stringify(remoteConfig),
-              {
-                dir: path.dirname(source),
-                source,
-              },
-              authEnv,
-            )
+            const source = `${url}/.well-known/opencode`
+            const next = yield* loadConfig(JSON.stringify(remoteConfig), {
+              dir: path.dirname(source),
+              source,
+            })
            yield* merge(source, next, "global")
            log.debug("loaded remote config from well-known", { url })
          }
        }

-        const global = Object.keys(authEnv).length ? yield* loadGlobal(authEnv) : yield* getGlobal()
+        const global = yield* getGlobal()
        yield* merge(Global.Path.config, global, "global")

        if (Flag.OPENCODE_CONFIG) {
-          yield* merge(Flag.OPENCODE_CONFIG, yield* loadFile(Flag.OPENCODE_CONFIG, authEnv))
+          yield* merge(Flag.OPENCODE_CONFIG, yield* loadFile(Flag.OPENCODE_CONFIG))
          log.debug("loaded custom config", { path: Flag.OPENCODE_CONFIG })
        }

        if (!Flag.OPENCODE_DISABLE_PROJECT_CONFIG) {
          for (const file of yield* ConfigPaths.files("opencode", ctx.directory, ctx.worktree).pipe(Effect.orDie)) {
-            yield* merge(file, yield* loadFile(file, authEnv), "local")
+            yield* merge(file, yield* loadFile(file), "local")
          }
        }

@@ -615,14 +579,14 @@ export const layer = Layer.effect(
          log.debug("loading config from OPENCODE_CONFIG_DIR", { path: Flag.OPENCODE_CONFIG_DIR })
        }

-        const deps: Fiber.Fiber<void>[] = []
+        const deps: Fiber.Fiber<void, never>[] = []

        for (const dir of directories) {
          if (dir.endsWith(".opencode") || dir === Flag.OPENCODE_CONFIG_DIR) {
            for (const file of ["opencode.json", "opencode.jsonc"]) {
              const source = path.join(dir, file)
              log.debug(`loading config from ${source}`)
-              yield* merge(source, yield* loadFile(source, authEnv))
+              yield* merge(source, yield* loadFile(source))
              result.agent ??= {}
              result.mode ??= {}
              result.plugin ??= []
@@ -871,7 +835,6 @@ export const defaultLayer = layer.pipe(
  Layer.provide(Auth.defaultLayer),
  Layer.provide(Account.defaultLayer),
  Layer.provide(Npm.defaultLayer),
-  Layer.provide(FetchHttpClient.layer),
 )

 export * as Config from "./config"
@@ -19,7 +19,6 @@ type ParseSource =
 type SubstituteInput = ParseSource & {
  text: string
  missing?: "error" | "empty"
-  env?: Record<string, string>
 }

 function source(input: ParseSource) {
@@ -34,7 +33,7 @@ function dir(input: ParseSource) {
 export async function substitute(input: SubstituteInput) {
  const missing = input.missing ?? "error"
  let text = input.text.replace(/\{env:([^}]+)\}/g, (_, varName) => {
-    return (input.env?.[varName] ?? process.env[varName]) || ""
+    return process.env[varName] || ""
  })

  const fileMatches = Array.from(text.matchAll(/\{file:[^}]+\}/g))
@@ -47,7 +46,7 @@ export async function substitute(input: SubstituteInput) {

  for (const match of fileMatches) {
    const token = match[0]
-    const index = match.index
+    const index = match.index!
    out += text.slice(cursor, index)

    const lineStart = text.lastIndexOf("\n", index - 1) + 1
@@ -131,7 +131,7 @@ function proxyRemote(
    const response = yield* HttpApiProxy.http(client, proxyURL, target.headers, request)
    const sync = Fence.parse(new Headers(response.headers))
    if (sync) {
-      const syncFailure = yield* Fence.wait(
+      const syncFailure = yield* Fence.waitEffect(
        workspace.id,
        sync,
        request.source instanceof Request ? request.source.signal : undefined,
@@ -4,6 +4,7 @@ import { EventSequenceTable } from "@/sync/event.sql"
 import { Workspace } from "@/control-plane/workspace"
 import type { WorkspaceID } from "@/control-plane/schema"
 import * as Log from "@opencode-ai/core/util/log"
+import { AppRuntime } from "@/effect/app-runtime"
 import { Effect } from "effect"

 export const HEADER = "x-opencode-sync"
@@ -19,7 +20,7 @@ export function load(ids?: string[]) {
    return db.select().from(EventSequenceTable).where(inArray(EventSequenceTable.aggregate_id, ids)).all()
  })

-  return Object.fromEntries(rows.map((row) => [row.aggregate_id, row.seq]))
+  return Object.fromEntries(rows.map((row) => [row.aggregate_id, row.seq])) as State
 }

 export function diff(prev: State, next: State) {
@@ -30,14 +31,15 @@ export function diff(prev: State, next: State) {
      .filter(([id, seq]) => {
        return (prev[id] ?? -1) !== seq
      }),
-  )
+  ) as State
 }

-export function parse(headers: Headers): State | undefined {
+export function parse(headers: Headers) {
  const raw = headers.get(HEADER)
  if (!raw) return

  let data
+
  try {
    data = JSON.parse(raw)
  } catch {
@@ -47,13 +49,13 @@ export function parse(headers: Headers): State | undefined {
  if (!data || typeof data !== "object") return

  return Object.fromEntries(
-    Object.entries(data).filter((entry): entry is [string, number] => {
-      return typeof entry[0] === "string" && Number.isInteger(entry[1])
+    Object.entries(data).filter(([id, seq]) => {
+      return typeof id === "string" && Number.isInteger(seq)
    }),
-  )
+  ) as State
 }

-export function wait(workspaceID: WorkspaceID, state: State, signal?: AbortSignal) {
+export function waitEffect(workspaceID: WorkspaceID, state: State, signal?: AbortSignal) {
  return Effect.gen(function* () {
    log.info("waiting for state", {
      workspaceID,
@@ -66,3 +68,7 @@ export function wait(workspaceID: WorkspaceID, state: State, signal?: AbortSigna
    })
  })
 }
+
+export async function wait(workspaceID: WorkspaceID, state: State, signal?: AbortSignal) {
+  await AppRuntime.runPromise(waitEffect(workspaceID, state, signal))
+}
@@ -1,7 +1,6 @@
 import { expect } from "bun:test"
 import { AppFileSystem } from "@opencode-ai/core/filesystem"
 import { Effect, Layer } from "effect"
-import { FetchHttpClient } from "effect/unstable/http"
 import path from "path"
 import { pathToFileURL } from "url"
 import { Agent } from "../../src/agent/agent"
@@ -30,7 +29,6 @@ const configLayer = Config.layer.pipe(
  Layer.provide(AuthTest.empty),
  Layer.provide(AccountTest.empty),
  Layer.provide(NpmTest.noop),
-  Layer.provide(FetchHttpClient.layer),
 )
 const pluginLayer = Plugin.layer.pipe(
  Layer.provide(Bus.layer),
@@ -9,7 +9,7 @@ import { SDKProvider, type EventSource } from "../../../../src/cli/cmd/tui/conte
 import { SyncProvider, useSync } from "../../../../src/cli/cmd/tui/context/sync"
 import type { GlobalEvent } from "@opencode-ai/sdk/v2"

-const worktree = "/tmp/opencode"
+export const worktree = "/tmp/opencode"
 export const directory = `${worktree}/packages/opencode`

 export async function wait(fn: () => boolean, timeout = 2000) {
@@ -27,7 +27,11 @@ export function json(data: unknown, init?: ResponseInit) {
  })
 }

-function createEventSource() {
+export function eventSource(): EventSource {
+  return { subscribe: async () => () => {} }
+}
+
+export function createEventSource() {
  let fn: ((event: GlobalEvent) => void) | undefined

  return {
@@ -48,7 +52,7 @@ function createEventSource() {

 type FetchHandler = (url: URL) => Response | Promise<Response> | undefined

-function createFetch(override?: FetchHandler) {
+export function createFetch(override?: FetchHandler) {
  const session = [] as URL[]
  const fetch = (async (input: RequestInfo | URL) => {
    const url = new URL(input instanceof Request ? input.url : String(input))
@@ -11,7 +11,7 @@ type ResolvedInput = Omit<TuiConfig.Resolved, "attention" | "keybinds" | "leader
  leader_timeout?: number
 }

-function createTuiResolvedKeybinds(input: Partial<TuiKeybind.Keybinds> = {}): TuiConfig.Resolved["keybinds"] {
+export function createTuiResolvedKeybinds(input: Partial<TuiKeybind.Keybinds> = {}): TuiConfig.Resolved["keybinds"] {
  const keybinds = TuiKeybind.Keybinds.parse(input)
  return createBindingLookup(TuiKeybind.toBindingConfig(keybinds), {
    commandMap: TuiKeybind.CommandMap,
@@ -31,7 +31,7 @@ import { it } from "./effect"
 const opencodeRoot = path.resolve(import.meta.dir, "../../")
 const cliEntry = path.join(opencodeRoot, "src/index.ts")

-const testModelID = "test/test-model"
+export const testModelID = "test/test-model"

 // Wrap a Bun subprocess pipe (or any ReadableStream<Uint8Array>) as a Stream.
 // Centralizes the `evaluate` + `onError` boilerplate and tags errors with the
@@ -177,7 +177,7 @@ export type CliFixture = {
 // up the tmpdir on scope exit. TestLLMServer.layer is provided internally so
 // the caller doesn't need to wire it up — the fixture's lifetime is tied to
 // the surrounding Scope.
-function withCliFixture<A, E>(
+export function withCliFixture<A, E>(
  fn: (input: CliFixture) => Effect.Effect<A, E, Scope.Scope | HttpClient.HttpClient>,
 ): Effect.Effect<A, E | unknown, Scope.Scope> {
  return Effect.gen(function* () {
@@ -449,7 +449,7 @@ function fail(item: HttpError) {
  })
 }

-class Reply {
+export class Reply {
  #head: unknown[] = [role()]
  #tail: unknown[] = []
  #usage: Usage | undefined
@@ -557,7 +557,7 @@ export function reply() {
  return new Reply()
 }

-function httpError(status: number, body: unknown): Item {
+export function httpError(status: number, body: unknown): Item {
  return {
    type: "http-error",
    status,
@@ -21,16 +21,25 @@ const REAL_TMP = fs.realpathSync(TMP)
 * snapshots captured on macOS/Linux contain LF, so a Windows run without
 * this step always diffs.
 */
-function stripCrlf(text: string): string {
+export function stripCrlf(text: string): string {
  return text.replaceAll("\r\n", "\n")
 }

+/**
+ * Converts Windows-style `\` separators to POSIX `/` so paths render
+ * identically across OSes. Use for path strings you want stable in a
+ * snapshot, not for filesystem operations.
+ */
+export function toPosixPath(p: string): string {
+  return p.replaceAll("\\", "/")
+}
+
 /**
 * Strips both the OS-level `os.tmpdir()` and its realpath form (macOS
 * `/var/folders` → `/private/var/folders`) from text, replacing each
 * occurrence with `marker` (default `<TMPDIR>`).
 */
-function withTmpdirStripped(text: string, marker = "<TMPDIR>"): string {
+export function withTmpdirStripped(text: string, marker = "<TMPDIR>"): string {
  return text.replaceAll(REAL_TMP, marker).replaceAll(TMP, marker)
 }

@@ -55,7 +55,7 @@ describe("Permission.evaluate for permission.task", () => {
    expect(Permission.evaluate("task", "code-reviewer", globalRuleset).action).toBe("ask")
  })

-  test("later rules take precedence (last match wins)", () => {
+  test("more specific rules take precedence", () => {
    const ruleset = createRuleset({
      "orchestrator-*": "deny",
      "orchestrator-fast": "allow",
@@ -73,8 +73,9 @@ describe("Permission.evaluate for permission.task", () => {

 describe("Permission.disabled for task tool", () => {
  // Note: The `disabled` function checks if a TOOL should be completely removed from the tool list.
-  // It only disables a tool when there's a rule with `pattern: "*"` and `action: "deny"`.
-  // It does NOT evaluate complex subagent patterns - those are handled at runtime by `evaluate`.
+  // It only disables a tool when every possible call is denied. Specific allow
+  // or ask patterns keep the tool available; runtime evaluation handles the
+  // individual subagent patterns.
  const createRuleset = (rules: Record<string, "allow" | "deny" | "ask">): Permission.Ruleset =>
    Object.entries(rules).map(([pattern, action]) => ({
      permission: "task",
@@ -82,26 +83,22 @@ describe("Permission.disabled for task tool", () => {
      action,
    }))

-  test("task tool is disabled when global deny pattern exists (even with specific allows)", () => {
-    // When "*": "deny" exists, the task tool is disabled because the disabled() function
-    // only checks for wildcard deny patterns - it doesn't consider that specific subagents might be allowed
+  test("task tool is not disabled when global deny has specific allows", () => {
    const ruleset = createRuleset({
      "orchestrator-*": "allow",
      "*": "deny",
    })
    const disabled = Permission.disabled(["task", "bash", "read"], ruleset)
-    // The task tool IS disabled because there's a pattern: "*" with action: "deny"
-    expect(disabled.has("task")).toBe(true)
+    expect(disabled.has("task")).toBe(false)
  })

-  test("task tool is disabled when global deny pattern exists (even with ask overrides)", () => {
+  test("task tool is not disabled when global deny has specific asks", () => {
    const ruleset = createRuleset({
      "orchestrator-*": "ask",
      "*": "deny",
    })
    const disabled = Permission.disabled(["task"], ruleset)
-    // The task tool IS disabled because there's a pattern: "*" with action: "deny"
-    expect(disabled.has("task")).toBe(true)
+    expect(disabled.has("task")).toBe(false)
  })

  test("task tool is disabled when global deny pattern exists", () => {
@@ -111,14 +108,12 @@ describe("Permission.disabled for task tool", () => {
  })

  test("task tool is NOT disabled when only specific patterns are denied (no wildcard)", () => {
-    // The disabled() function only disables tools when pattern: "*" && action: "deny"
-    // Specific subagent denies don't disable the task tool - those are handled at runtime
+    // Specific subagent denies don't disable the task tool - those are handled at runtime.
    const ruleset = createRuleset({
      "orchestrator-*": "deny",
      general: "deny",
    })
    const disabled = Permission.disabled(["task"], ruleset)
-    // The task tool is NOT disabled because no rule has pattern: "*" with action: "deny"
    expect(disabled.has("task")).toBe(false)
  })

@@ -127,16 +122,12 @@ describe("Permission.disabled for task tool", () => {
    expect(disabled.has("task")).toBe(false)
  })

-  test("task tool is NOT disabled when last wildcard pattern is allow", () => {
-    // Last matching rule wins - if wildcard allow comes after wildcard deny, tool is enabled
+  test("task tool is NOT disabled when wildcard deny has a specific allow", () => {
    const ruleset = createRuleset({
      "*": "deny",
      "orchestrator-coder": "allow",
    })
    const disabled = Permission.disabled(["task"], ruleset)
-    // The disabled() function uses findLast and checks if the last matching rule
-    // has pattern: "*" and action: "deny". In this case, the last rule matching
-    // "task" permission has pattern "orchestrator-coder", not "*", so not disabled
    expect(disabled.has("task")).toBe(false)
  })
 })
@@ -234,8 +225,7 @@ describe("permission.task with real config files", () => {
        const disabled = Permission.disabled(["bash", "edit", "task"], ruleset)
        expect(disabled.has("bash")).toBe(false)
        expect(disabled.has("edit")).toBe(false)
-        // task is NOT disabled because disabled() uses findLast, and the last rule
-        // matching "task" permission is {pattern: "general", action: "allow"}, not pattern: "*"
+        // task is NOT disabled because the specific allow leaves at least one subagent available.
        expect(disabled.has("task")).toBe(false)
      }),
    {
@@ -254,21 +244,18 @@ describe("permission.task with real config files", () => {
  )

  it.instance(
-    "task tool disabled when global deny comes last in config",
+    "specific task allows beat global deny regardless of order",
    () =>
      Effect.gen(function* () {
        const config = yield* load
        const ruleset = Permission.fromConfig(config.permission ?? {})

-        // Last matching rule wins - "*" deny is last, so all agents are denied
-        expect(Permission.evaluate("task", "general", ruleset).action).toBe("deny")
-        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
+        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
+        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("allow")
        expect(Permission.evaluate("task", "unknown", ruleset).action).toBe("deny")

-        // Since "*": "deny" is the last rule, disabled() finds it with findLast
-        // and sees pattern: "*" with action: "deny", so task is disabled
        const disabled = Permission.disabled(["task"], ruleset)
-        expect(disabled.has("task")).toBe(true)
+        expect(disabled.has("task")).toBe(false)
      }),
    {
      git: true,
@@ -285,20 +272,17 @@ describe("permission.task with real config files", () => {
  )

  it.instance(
-    "task tool NOT disabled when specific allow comes last in config",
+    "task tool NOT disabled when global deny has a specific allow",
    () =>
      Effect.gen(function* () {
        const config = yield* load
        const ruleset = Permission.fromConfig(config.permission ?? {})

-        // Evaluate uses findLast - "general" allow comes after "*" deny
        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
        // Other agents still denied by the earlier "*" deny
        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")

-        // disabled() uses findLast and checks if the last rule has pattern: "*" with action: "deny"
-        // In this case, the last rule is {pattern: "general", action: "allow"}, not pattern: "*"
-        // So the task tool is NOT disabled (even though most subagents are denied)
+        // The task tool remains available because the specific allow leaves one subagent callable.
        const disabled = Permission.disabled(["task"], ruleset)
        expect(disabled.has("task")).toBe(false)
      }),
@@ -129,9 +129,8 @@ test("fromConfig - does not expand tilde in middle of path", () => {
  expect(result).toEqual([{ permission: "external_directory", pattern: "/some/~/path", action: "allow" }])
 })

-// Permission precedence follows config insertion order. `evaluate()` uses the
-// last matching rule, so later config entries intentionally override earlier
-// entries even when a wildcard appears after a specific permission.
+// Permission precedence follows specificity. Later config entries only override
+// earlier entries when the matching rules are equally specific.

 test("fromConfig - preserves top-level config key order", () => {
  const wildcardFirst = Permission.fromConfig({ "*": "deny", bash: "allow" })
@@ -141,7 +140,7 @@ test("fromConfig - preserves top-level config key order", () => {
  expect(specificFirst.map((r) => r.permission)).toEqual(["bash", "*"])

  expect(Permission.evaluate("bash", "ls", wildcardFirst).action).toBe("allow")
-  expect(Permission.evaluate("bash", "ls", specificFirst).action).toBe("deny")
+  expect(Permission.evaluate("bash", "ls", specificFirst).action).toBe("allow")
 })

 test("fromConfig - wildcard acts as fallback when it appears before specifics", () => {
@@ -288,7 +287,7 @@ test("evaluate - wildcard pattern match", () => {
  expect(result.action).toBe("allow")
 })

-test("evaluate - last matching rule wins", () => {
+test("evaluate - more specific pattern wins over wildcard", () => {
  const result = Permission.evaluate("bash", "rm", [
    { permission: "bash", pattern: "*", action: "allow" },
    { permission: "bash", pattern: "rm", action: "deny" },
@@ -296,12 +295,12 @@ test("evaluate - last matching rule wins", () => {
  expect(result.action).toBe("deny")
 })

-test("evaluate - last matching rule wins (wildcard after specific)", () => {
+test("evaluate - specific pattern wins when wildcard appears later", () => {
  const result = Permission.evaluate("bash", "rm", [
    { permission: "bash", pattern: "rm", action: "deny" },
    { permission: "bash", pattern: "*", action: "allow" },
  ])
-  expect(result.action).toBe("allow")
+  expect(result.action).toBe("deny")
 })

 test("evaluate - glob pattern match", () => {
@@ -309,7 +308,7 @@ test("evaluate - glob pattern match", () => {
  expect(result.action).toBe("allow")
 })

-test("evaluate - last matching glob wins", () => {
+test("evaluate - more specific glob wins", () => {
  const result = Permission.evaluate("edit", "src/components/Button.tsx", [
    { permission: "edit", pattern: "src/*", action: "deny" },
    { permission: "edit", pattern: "src/components/*", action: "allow" },
@@ -317,12 +316,12 @@ test("evaluate - last matching glob wins", () => {
  expect(result.action).toBe("allow")
 })

-test("evaluate - order matters for specificity", () => {
+test("evaluate - specific glob wins when broader glob appears later", () => {
  const result = Permission.evaluate("edit", "src/components/Button.tsx", [
    { permission: "edit", pattern: "src/components/*", action: "allow" },
    { permission: "edit", pattern: "src/*", action: "deny" },
  ])
-  expect(result.action).toBe("deny")
+  expect(result.action).toBe("allow")
 })

 test("evaluate - unknown permission returns ask", () => {
@@ -373,12 +372,12 @@ test("evaluate - exact match at end wins over earlier wildcard", () => {
  expect(result.action).toBe("deny")
 })

-test("evaluate - wildcard at end overrides earlier exact match", () => {
+test("evaluate - earlier exact match wins over wildcard at end", () => {
  const result = Permission.evaluate("bash", "/bin/rm", [
    { permission: "bash", pattern: "/bin/rm", action: "deny" },
    { permission: "bash", pattern: "*", action: "allow" },
  ])
-  expect(result.action).toBe("allow")
+  expect(result.action).toBe("deny")
 })

 // wildcard permission tests
@@ -433,12 +432,32 @@ test("evaluate - wildcard permission fallback for unknown tool", () => {
  expect(result.action).toBe("ask")
 })

-test("evaluate - later wildcard permission can override earlier specific permission", () => {
+test("evaluate - specific permission wins over later wildcard permission", () => {
  const result = Permission.evaluate("bash", "rm", [
    { permission: "bash", pattern: "*", action: "allow" },
    { permission: "*", pattern: "*", action: "deny" },
  ])
-  expect(result.action).toBe("deny")
+  expect(result.action).toBe("allow")
+})
+
+test("evaluate - bash deny beats wildcard ask regardless of order", () => {
+  const wildcardFirst = Permission.fromConfig({
+    bash: {
+      "*": "ask",
+      "git checkout": "deny",
+      "git checkout *": "deny",
+    },
+  })
+  const wildcardLast = Permission.fromConfig({
+    bash: {
+      "git checkout": "deny",
+      "git checkout *": "deny",
+      "*": "ask",
+    },
+  })
+
+  expect(Permission.evaluate("bash", "git checkout -- backend/db/schema.py", wildcardFirst).action).toBe("deny")
+  expect(Permission.evaluate("bash", "git checkout -- backend/db/schema.py", wildcardLast).action).toBe("deny")
 })

 test("evaluate - merges multiple rulesets", () => {
@@ -1,11 +1,12 @@
 import { describe, expect } from "bun:test"
-import { Effect, Layer } from "effect"
-import { FetchHttpClient } from "effect/unstable/http"
+import { Effect, Layer, Option } from "effect"
 import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner"
 import { AppFileSystem } from "@opencode-ai/core/filesystem"
 import { EffectFlock } from "@opencode-ai/core/util/effect-flock"
 import path from "path"
 import { pathToFileURL } from "url"
+import { Account } from "../../src/account/account"
+import { Auth } from "../../src/auth"
 import { Bus } from "../../src/bus"
 import { Config } from "../../src/config/config"
 import { Env } from "../../src/env"
@@ -14,18 +15,22 @@ import { Plugin } from "../../src/plugin/index"
 import { ModelID, ProviderID } from "../../src/provider/schema"
 import { provideTmpdirInstance } from "../fixture/fixture"
 import { testEffect } from "../lib/effect"
-import { AccountTest } from "../fake/account"
-import { AuthTest } from "../fake/auth"
 import { NpmTest } from "../fake/npm"

+const emptyAccount = Layer.mock(Account.Service)({
+  active: () => Effect.succeed(Option.none()),
+  activeOrg: () => Effect.succeed(Option.none()),
+})
+const emptyAuth = Layer.mock(Auth.Service)({
+  all: () => Effect.succeed({}),
+})
 const configLayer = Config.layer.pipe(
  Layer.provide(EffectFlock.defaultLayer),
  Layer.provide(AppFileSystem.defaultLayer),
  Layer.provide(Env.defaultLayer),
-  Layer.provide(AuthTest.empty),
-  Layer.provide(AccountTest.empty),
+  Layer.provide(emptyAuth),
+  Layer.provide(emptyAccount),
  Layer.provide(NpmTest.noop),
-  Layer.provide(FetchHttpClient.layer),
 )
 const it = testEffect(
  Layer.mergeAll(
@@ -1,11 +1,12 @@
 import { afterEach, describe, expect } from "bun:test"
-import { Effect, Layer } from "effect"
+import { Effect, Layer, Option } from "effect"
 import { FetchHttpClient } from "effect/unstable/http"
 import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner"
 import { AppFileSystem } from "@opencode-ai/core/filesystem"
 import { EffectFlock } from "@opencode-ai/core/util/effect-flock"
 import path from "path"
 import { pathToFileURL } from "url"
+import { Account } from "../../src/account/account"
 import { Auth } from "../../src/auth"
 import { Bus } from "../../src/bus"
 import { Config } from "../../src/config/config"
@@ -23,18 +24,22 @@ import { SessionPrompt } from "../../src/session/prompt"
 import { SyncEvent } from "../../src/sync"
 import { disposeAllInstances, provideTmpdirInstance } from "../fixture/fixture"
 import { testEffect } from "../lib/effect"
-import { AccountTest } from "../fake/account"
-import { AuthTest } from "../fake/auth"
 import { NpmTest } from "../fake/npm"

+const emptyAccount = Layer.mock(Account.Service)({
+  active: () => Effect.succeed(Option.none()),
+  activeOrg: () => Effect.succeed(Option.none()),
+})
+const emptyAuth = Layer.mock(Auth.Service)({
+  all: () => Effect.succeed({}),
+})
 const configLayer = Config.layer.pipe(
  Layer.provide(EffectFlock.defaultLayer),
  Layer.provide(AppFileSystem.defaultLayer),
  Layer.provide(Env.defaultLayer),
-  Layer.provide(AuthTest.empty),
-  Layer.provide(AccountTest.empty),
+  Layer.provide(emptyAuth),
+  Layer.provide(emptyAccount),
  Layer.provide(NpmTest.noop),
-  Layer.provide(FetchHttpClient.layer),
 )
 const pluginLayer = Plugin.layer.pipe(
  Layer.provide(Bus.layer),
@@ -11,6 +11,7 @@ import type {
  RequestSpec,
  ScenarioContext,
  SeededContext,
+  TodoScenario,
 } from "./types"

 class ScenarioBuilder<S = undefined> {
@@ -185,6 +186,14 @@ export const http = {
  ticketBypass: routes("ticket-bypass"),
 }

+export const pending = (method: Method, path: string, name: string, reason: string): TodoScenario => ({
+  kind: "todo",
+  method,
+  path,
+  name,
+  reason,
+})
+
 export function route(template: string, params: Record<string, string>) {
  return Object.entries(params).reduce(
    (next, [key, value]) => next.replaceAll(`{${key}}`, value).replaceAll(`:${key}`, value),
@@ -55,7 +55,7 @@ export function parseOptions(args: string[]): Options {
  }
 }

-function matches(options: Options, scenario: Scenario) {
+export function matches(options: Options, scenario: Scenario) {
  if (!options.include) return true
  return (
    scenario.name.includes(options.include) ||
@@ -6,7 +6,7 @@ import type { MessageV2 } from "../../../src/session/message-v2"
 import type { SessionID } from "../../../src/session/schema"

 export const OpenApiMethods = ["get", "post", "put", "delete", "patch"] as const
-const Methods = ["GET", "POST", "PUT", "DELETE", "PATCH"] as const
+export const Methods = ["GET", "POST", "PUT", "DELETE", "PATCH"] as const

 export type Method = (typeof Methods)[number]
 export type OpenApiMethod = (typeof OpenApiMethods)[number]
@@ -1,14 +1,13 @@
 import { describe, expect, test } from "bun:test"
 import { ToolFailure } from "@opencode-ai/llm"
 import { LLMClient, RequestExecutor, WebSocketExecutor } from "@opencode-ai/llm/route"
-import { jsonSchema, tool, type ModelMessage, type Tool } from "ai"
+import { jsonSchema, tool, type ModelMessage } from "ai"
 import { Effect, Layer, Stream } from "effect"
 import { LLMNative } from "@/session/llm/native-request"
 import { LLMNativeRuntime } from "@/session/llm/native-runtime"
 import type { Provider } from "@/provider/provider"
 import { ModelID, ProviderID } from "@/provider/schema"
 import { OAUTH_DUMMY_KEY } from "@/auth"
-import { testEffect } from "../lib/effect"

 const baseModel: Provider.Model = {
  id: ModelID.make("gpt-5-mini"),
@@ -70,10 +69,6 @@ const providerInfo: Provider.Info = {
  models: {},
 }

-const it = testEffect(
-  LLMClient.layer.pipe(Layer.provide(Layer.mergeAll(RequestExecutor.defaultLayer, WebSocketExecutor.layer))),
-)
-
 function responsesStream(chunks: unknown[]) {
  return new Response(chunks.map((chunk) => `data: ${JSON.stringify(chunk)}`).join("\n\n") + "\n\n", {
    status: 200,
@@ -81,72 +76,6 @@ function responsesStream(chunks: unknown[]) {
  })
 }

-type NativeRequestInput = Parameters<typeof LLMNative.request>[0]
-
-const sessionText = (text: string) => ({ type: "text" as const, text })
-
-const sessionOpenAIReasoning = (
-  text: string,
-  options: {
-    readonly storedAs: "providerMetadata" | "providerOptions"
-    readonly itemId: string
-    readonly encryptedContent: string | null
-  },
-) => {
-  const metadata = {
-    openai: { itemId: options.itemId, reasoningEncryptedContent: options.encryptedContent },
-  }
-  if (options.storedAs === "providerMetadata")
-    return Object.assign({ type: "reasoning" as const, text }, { providerMetadata: metadata })
-  return Object.assign({ type: "reasoning" as const, text }, { providerOptions: metadata })
-}
-
-type SessionAssistantPart = ReturnType<typeof sessionText> | ReturnType<typeof sessionOpenAIReasoning>
-
-const storedSession = {
-  user: (content: string): ModelMessage => ({ role: "user", content }),
-  assistant: (content: SessionAssistantPart[]): ModelMessage => ({ role: "assistant", content }),
-  text: sessionText,
-  openaiReasoning: sessionOpenAIReasoning,
-}
-
-const openAIResponses = {
-  user: (text: string) => ({ role: "user", content: [{ type: "input_text", text }] }),
-  assistant: (text: string) => ({ role: "assistant", content: [{ type: "output_text", text }] }),
-  openaiReasoning: (text: string, options: { readonly itemId: string; readonly encryptedContent: string }) => ({
-    type: "reasoning",
-    id: options.itemId,
-    encrypted_content: options.encryptedContent,
-    summary: [{ type: "summary_text", text }],
-  }),
-}
-
-const prepareNativeRequest = (input: NativeRequestInput) => LLMClient.prepare(LLMNative.request(input))
-
-const expectOpenAIResponsesRequest = (input: {
-  readonly history: NativeRequestInput["messages"]
-  readonly providerOptions?: NativeRequestInput["providerOptions"]
-  readonly maxOutputTokens?: NativeRequestInput["maxOutputTokens"]
-  readonly headers?: NativeRequestInput["headers"]
-  readonly expectedBody: unknown
-}) =>
-  Effect.gen(function* () {
-    expect(
-      yield* prepareNativeRequest({
-        model: baseModel,
-        apiKey: "test-openai-key",
-        messages: input.history,
-        providerOptions: input.providerOptions,
-        maxOutputTokens: input.maxOutputTokens,
-        headers: input.headers,
-      }),
-    ).toMatchObject({
-      route: "openai-responses",
-      protocol: "openai-responses",
-      body: input.expectedBody,
-    })
-  })
-
 describe("session.llm-native.request", () => {
  test("maps normalized stream inputs to a native LLM request", () => {
    const messages: ModelMessage[] = [
@@ -497,163 +426,122 @@ describe("session.llm-native.request", () => {
    })
  })

-  it.effect("native tool wrapper converts thrown errors into typed ToolFailure", () =>
-    Effect.gen(function* () {
-      const wrapped = LLMNativeRuntime.nativeTools(
-        {
-          explode: {
-            description: "always throws",
-            inputSchema: jsonSchema({ type: "object" }),
-            execute: async () => {
-              throw new Error("boom")
-            },
-          } satisfies Tool,
-        },
-        { messages: [] as ModelMessage[], abort: new AbortController().signal },
-      )
+  test("native tool wrapper converts thrown errors into typed ToolFailure", async () => {
+    const wrapped = LLMNativeRuntime.nativeTools(
+      {
+        explode: {
+          description: "always throws",
+          inputSchema: jsonSchema({ type: "object" }),
+          execute: async () => {
+            throw new Error("boom")
+          },
+        } as any,
+      },
+      { messages: [] as ModelMessage[], abort: new AbortController().signal },
+    )

-      const failure = yield* Effect.flip(wrapped.explode.execute({}, { id: "call-1", name: "explode" }))
-      expect(failure).toBeInstanceOf(ToolFailure)
-      expect(failure.message).toBe("boom")
-    }),
-  )
+    const failure = await Effect.runPromise(
+      Effect.flip(wrapped.explode!.execute!({}, { id: "call-1", name: "explode" })),
+    )
+    expect(failure).toBeInstanceOf(ToolFailure)
+    expect((failure as ToolFailure).message).toBe("boom")
+  })

-  it.effect("native tool wrapper raises ToolFailure when the source tool has no execute handler", () =>
-    Effect.gen(function* () {
-      // The AI SDK Tool shape allows execute to be omitted (e.g., client-side / MCP tools).
-      // The native runtime owns execution, so encountering such a tool here means upstream
-      // wiring is wrong; we want a typed failure, not a silent skip or unhandled exception.
-      const wrapped = LLMNativeRuntime.nativeTools(
-        { incomplete: { description: "no execute", inputSchema: jsonSchema({ type: "object" }) } satisfies Tool },
-        { messages: [] as ModelMessage[], abort: new AbortController().signal },
-      )
+  test("native tool wrapper raises ToolFailure when the source tool has no execute handler", async () => {
+    // The AI SDK Tool shape allows execute to be omitted (e.g., client-side / MCP tools).
+    // The native runtime owns execution, so encountering such a tool here means upstream
+    // wiring is wrong; we want a typed failure, not a silent skip or unhandled exception.
+    const wrapped = LLMNativeRuntime.nativeTools(
+      { incomplete: { description: "no execute", inputSchema: jsonSchema({ type: "object" }) } as any },
+      { messages: [] as ModelMessage[], abort: new AbortController().signal },
+    )

-      const failure = yield* Effect.flip(wrapped.incomplete.execute({}, { id: "call-1", name: "incomplete" }))
-      expect(failure).toBeInstanceOf(ToolFailure)
-      expect(failure.message).toContain("incomplete")
-    }),
-  )
+    const failure = await Effect.runPromise(
+      Effect.flip(wrapped.incomplete!.execute!({}, { id: "call-1", name: "incomplete" })),
+    )
+    expect(failure).toBeInstanceOf(ToolFailure)
+    expect((failure as ToolFailure).message).toContain("incomplete")
+  })

-  it.effect("compiles through the native OpenAI Responses route", () =>
-    expectOpenAIResponsesRequest({
-      history: [storedSession.user("hello")],
-      providerOptions: { openai: { store: false, instructions: "You are concise." } },
-      maxOutputTokens: 512,
-      headers: { "x-request": "request-header" },
-      expectedBody: {
+  test("compiles through the native OpenAI Responses route", async () => {
+    const prepared = await Effect.runPromise(
+      LLMClient.prepare(
+        LLMNative.request({
+          model: baseModel,
+          apiKey: "test-openai-key",
+          messages: [{ role: "user", content: "hello" }],
+          providerOptions: { openai: { store: false, instructions: "You are concise." } },
+          maxOutputTokens: 512,
+          headers: { "x-request": "request-header" },
+        }),
+      ).pipe(
+        Effect.provide(LLMClient.layer),
+        Effect.provide(Layer.mergeAll(RequestExecutor.defaultLayer, WebSocketExecutor.layer)),
+      ),
+    )
+
+    expect(prepared).toMatchObject({
+      route: "openai-responses",
+      protocol: "openai-responses",
+      body: {
        model: "gpt-5-mini",
        instructions: "You are concise.",
-        input: [openAIResponses.user("hello")],
+        input: [{ role: "user", content: [{ type: "input_text", text: "hello" }] }],
        max_output_tokens: 512,
        store: false,
        stream: true,
      },
-    }),
-  )
+    })
+  })

-  it.effect("omits non-persisted OpenAI reasoning ids without encrypted state", () =>
-    expectOpenAIResponsesRequest({
-      history: [
-        storedSession.user("What changed?"),
-        storedSession.assistant([
-          storedSession.openaiReasoning("Checked the previous diff.", {
-            storedAs: "providerOptions",
-            itemId: "rs_1",
-            encryptedContent: null,
-          }),
-          storedSession.text("The parser changed."),
-        ]),
-        storedSession.user("Summarize it."),
-      ],
-      providerOptions: { openai: { store: false } },
-      expectedBody: {
-        input: [
-          openAIResponses.user("What changed?"),
-          openAIResponses.assistant("The parser changed."),
-          openAIResponses.user("Summarize it."),
-        ],
-        store: false,
+  test("uses provider fetch override for native OpenAI OAuth requests", async () => {
+    const captures: Array<{ url: string; body: unknown }> = []
+    const customFetch = (async (input, init) => {
+      const request = input instanceof Request ? input : new Request(input, init)
+      captures.push({ url: request.url, body: await request.clone().json() })
+      return responsesStream([
+        { type: "response.output_text.delta", item_id: "msg_1", delta: "Hello" },
+        { type: "response.completed", response: { usage: { input_tokens: 1, output_tokens: 1 } } },
+      ])
+    }) as typeof fetch
+
+    const events = await Effect.runPromise(
+      Effect.gen(function* () {
+        const llmClient = yield* LLMClient.Service
+        const native = LLMNativeRuntime.stream({
+          model: baseModel,
+          provider: { ...providerInfo, options: { apiKey: OAUTH_DUMMY_KEY, fetch: customFetch } },
+          auth: { type: "oauth", refresh: "refresh", access: "access", expires: Date.now() + 60_000 },
+          llmClient,
+          messages: [{ role: "user", content: "hello" }],
+          tools: {},
+          providerOptions: { instructions: "You are concise." },
+          headers: {},
+          abort: new AbortController().signal,
+        })
+        expect(native.type).toBe("supported")
+        if (native.type === "unsupported") return []
+        return yield* native.stream.pipe(Stream.runCollect)
+      }).pipe(
+        Effect.provide(LLMClient.layer),
+        Effect.provide(Layer.mergeAll(RequestExecutor.defaultLayer, WebSocketExecutor.layer)),
+      ),
+    )
+
+    expect(captures).toHaveLength(1)
+    expect(captures[0]).toMatchObject({
+      url: "https://api.openai.com/v1/responses",
+      body: {
+        model: "gpt-5-mini",
+        instructions: "You are concise.",
+        input: [{ role: "user", content: [{ type: "input_text", text: "hello" }] }],
      },
-    }),
-  )
-
-  it.effect("preserves encrypted OpenAI reasoning state through native request lowering", () =>
-    expectOpenAIResponsesRequest({
-      history: [
-        storedSession.user("What changed?"),
-        storedSession.assistant([
-          storedSession.openaiReasoning("Checked the previous diff.", {
-            storedAs: "providerMetadata",
-            itemId: "rs_1",
-            encryptedContent: "encrypted-state",
-          }),
-          storedSession.text("The parser changed."),
-        ]),
-        storedSession.user("Summarize it."),
-      ],
-      providerOptions: { openai: { store: false, includeEncryptedReasoning: true } },
-      expectedBody: {
-        input: [
-          openAIResponses.user("What changed?"),
-          openAIResponses.openaiReasoning("Checked the previous diff.", {
-            itemId: "rs_1",
-            encryptedContent: "encrypted-state",
-          }),
-          openAIResponses.assistant("The parser changed."),
-          openAIResponses.user("Summarize it."),
-        ],
-        include: ["reasoning.encrypted_content"],
-        store: false,
-      },
-    }),
-  )
-
-  it.effect("uses provider fetch override for native OpenAI OAuth requests", () =>
-    Effect.gen(function* () {
-      const captures: Array<{ url: string; body: unknown }> = []
-      const customFetch = Object.assign(
-        async (input: Parameters<typeof fetch>[0], init: Parameters<typeof fetch>[1]) => {
-          const request = input instanceof Request ? input : new Request(input, init)
-          captures.push({ url: request.url, body: await request.clone().json() })
-          return responsesStream([
-            { type: "response.output_text.delta", item_id: "msg_1", delta: "Hello" },
-            { type: "response.completed", response: { usage: { input_tokens: 1, output_tokens: 1 } } },
-          ])
-        },
-        { preconnect: () => undefined },
-      ) satisfies typeof fetch
-
-      const llmClient = yield* LLMClient.Service
-      const native = LLMNativeRuntime.stream({
-        model: baseModel,
-        provider: { ...providerInfo, options: { apiKey: OAUTH_DUMMY_KEY, fetch: customFetch } },
-        auth: { type: "oauth", refresh: "refresh", access: "access", expires: Date.now() + 60_000 },
-        llmClient,
-        messages: [{ role: "user", content: "hello" }],
-        tools: {},
-        providerOptions: { instructions: "You are concise." },
-        headers: {},
-        abort: new AbortController().signal,
-      })
-      expect(native.type).toBe("supported")
-      if (native.type === "unsupported") throw new Error(native.reason)
-      const events = Array.from(yield* native.stream.pipe(Stream.runCollect))
-
-      expect(captures).toHaveLength(1)
-      expect(captures[0]).toMatchObject({
-        url: "https://api.openai.com/v1/responses",
-        body: {
-          model: "gpt-5-mini",
-          instructions: "You are concise.",
-          input: [{ role: "user", content: [{ type: "input_text", text: "hello" }] }],
-        },
-      })
-      expect(events).toEqual(
-        expect.arrayContaining([
-          expect.objectContaining({ type: "text-delta", text: "Hello" }),
-          expect.objectContaining({ type: "finish" }),
-        ]),
-      )
-    }),
-  )
+    })
+    expect(events).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ type: "text-delta", text: "Hello" }),
+        expect.objectContaining({ type: "finish" }),
+      ]),
+    )
+  })
 })
@@ -535,7 +535,7 @@ This can take a glob pattern.
 ```

 And you can also use the `*` wildcard to manage permissions for all commands.
-Since the last matching rule takes precedence, put the `*` wildcard first and specific rules after.
+The most specific matching rule takes precedence, so specific command rules beat the `*` wildcard regardless of order.

 ```json title="opencode.json" {8}
 {
@@ -622,7 +622,7 @@ Control which subagents an agent can invoke via the Task tool with `permission.t
 When set to `deny`, the subagent is removed from the Task tool description entirely, so the model won't attempt to invoke it.

 :::tip
-Rules are evaluated in order, and the **last matching rule wins**. In the example above, `orchestrator-planner` matches both `*` (deny) and `orchestrator-*` (allow), but since `orchestrator-*` comes after `*`, the result is `allow`.
+Rules are evaluated by specificity. In the example above, `orchestrator-planner` matches both `*` (deny) and `orchestrator-*` (allow), but `orchestrator-*` is more specific, so the result is `allow`.
 :::

 :::tip
@@ -68,7 +68,7 @@ For most permissions, you can use an object to apply different actions based on
 }
 ```

-Rules are evaluated by pattern match, with the **last matching rule winning**. A common pattern is to put the catch-all `"*"` rule first, and more specific rules after it.
+Rules are evaluated by pattern match, with the **most specific matching rule winning**. If two matching rules are equally specific, the later rule wins.

 ### Wildcards

@@ -22,10 +22,22 @@ declare module "sst" {
      "type": "sst.sst.Secret"
      "value": string
    }
-    "Api": import("@cloudflare/workers-types").Service
-    "AuthApi": import("@cloudflare/workers-types").Service
-    "AuthStorage": import("@cloudflare/workers-types").KVNamespace
-    "Bucket": import("@cloudflare/workers-types").R2Bucket
+    "Api": {
+      "type": "sst.cloudflare.Worker"
+      "url": string
+    }
+    "AuthApi": {
+      "type": "sst.cloudflare.Worker"
+      "url": string
+    }
+    "AuthStorage": {
+      "namespaceId": string
+      "type": "sst.cloudflare.Kv"
+    }
+    "Bucket": {
+      "name": string
+      "type": "sst.cloudflare.Bucket"
+    }
    "CLOUDFLARE_API_TOKEN": {
      "type": "sst.sst.Secret"
      "value": string
@@ -62,7 +74,10 @@ declare module "sst" {
      "type": "sst.sst.Secret"
      "value": string
    }
-    "EnterpriseStorage": import("@cloudflare/workers-types").R2Bucket
+    "EnterpriseStorage": {
+      "name": string
+      "type": "sst.cloudflare.Bucket"
+    }
    "FEISHU_APP_ID": {
      "type": "sst.sst.Secret"
      "value": string
@@ -99,7 +114,9 @@ declare module "sst" {
      "type": "random.index/randomPassword.RandomPassword"
      "value": string
    }
-    "LogProcessor": import("@cloudflare/workers-types").Service
+    "LogProcessor": {
+      "type": "sst.cloudflare.Worker"
+    }
    "R2AccessKey": {
      "type": "sst.sst.Secret"
      "value": string
@@ -132,7 +149,10 @@ declare module "sst" {
      "type": "sst.sst.Linkable"
      "value": string
    }
-    "Stat": import("@cloudflare/workers-types").Service
+    "Stat": {
+      "type": "sst.cloudflare.Worker"
+      "url": string
+    }
    "Teams": {
      "type": "sst.cloudflare.SolidStart"
      "url": string
@@ -291,10 +311,17 @@ declare module "sst" {
      "type": "sst.sst.Secret"
      "value": string
    }
-    "ZenData": import("@cloudflare/workers-types").R2Bucket
-    "ZenDataNew": import("@cloudflare/workers-types").R2Bucket
+    "ZenData": {
+      "name": string
+      "type": "sst.cloudflare.Bucket"
+    }
+    "ZenDataNew": {
+      "name": string
+      "type": "sst.cloudflare.Bucket"
+    }
  }
 }
+/// <reference path="sst-env.d.ts" />

 import "sst"
 export {}