v1.17.9 merge: v2 architecture follow-ups (packages/cli, server, core, v2 TUI) — not shipped in #964 #977

v1.17.9 merge — v2 architecture follow-ups (not shipped in PR #964)

PR #964 brings in OpenCode v1.17.9, which introduces a v2 architecture across new workspaces (packages/cli, packages/server, packages/core, the standalone v2 SDK, and v2-mode packages/tui hydration). These packages are not wired into the shipped @altimateai/altimate-code binary, which runs on the legacy Hono server + packages/opencode. The Codex reviewer raised the items below against that v2 code.

Tracking them here so the merge can land; they become actionable if/when we adopt the v2 runtime. Branding-related ones (Altimate CORS origins, .altimate-code config discovery, Altimate global paths) are tagged so they're not lost in that adoption.

Source: review threads on PR #964 (resolved there with a pointer to this issue).

packages/core (22)

• P1 packages/core/src/plugin/agent.ts:114 — Restore bash safety rules for V2 agents
• P1 packages/core/src/tool/read.ts:57 — Require external-directory approval for absolute reads
• P1 packages/core/src/tool/read.ts:58 — Gate absolute reads with external-directory policy
• P1 packages/core/src/tool/write.ts:78 — Gate V2 mutations with sensitive_write
• P2 packages/core/src/config.ts:182 — Discover .altimate-code config directories
• P2 packages/core/src/config.ts:182 — Discover the branded project config directory
• P2 packages/core/src/config.ts:204 — Load inline config supplied by SDK helpers
• P2 packages/core/src/database/migration.ts:215 — Recheck migration ownership inside each transaction
• P2 packages/core/src/global.ts:0 — Use Altimate global storage paths
• P2 packages/core/src/global.ts:0 — Use the fork's global app directory
• P2 packages/core/src/instruction-context.ts:55 — Load configured instruction sources
• P2 packages/core/src/project/copy.ts:179 — Seed v2 project roots before creating copies
• P2 packages/core/src/project/copy.ts:196 — Constrain project-copy names to the destination
• P2 packages/core/src/session.ts:207 — Record project directories when creating sessions
• P2 packages/core/src/session.ts:268 — Apply subpath filters when listing project sessions
• P2 packages/core/src/session.ts:268 — Apply the subpath filter when listing sessions
• P2 packages/core/src/session/projector.ts:425 — Roll v2 step usage into session totals
• P2 packages/core/src/session/runner/llm.ts:183 — Wait for plugin boot before selecting the runner agent
• P2 packages/core/src/state.ts:63 — Publish update events after committing rebuilt state
• P2 packages/core/src/tool/application-tools.ts:53 — Release public tool registrations with the scope
• P2 packages/core/src/tool/bash.ts:142 — Enforce external-directory approvals for bash arguments
• P2 packages/core/src/tool/builtins.ts:27 — Register a V2 task tool for subagents

packages/server (18)

• P1 packages/server/src/handlers.ts:51 — Wire SessionV2 to local execution
• P1 packages/server/src/handlers.ts:52 — Wire SessionV2 to the local executor
• P2 packages/server/src/cors.ts:3 — Allow Altimate hosted origins
• P2 packages/server/src/cors.ts:3 — Allow the branded web origin in CORS
• P2 packages/server/src/groups/event.ts:20 — Type SSE events as Event payloads
• P2 packages/server/src/groups/fs.ts:22 — Add a real path parameter for fs.read
• P2 packages/server/src/groups/fs.ts:22 — Expose the file path in the fs.read contract
• P2 packages/server/src/handlers/command.ts:8 — Wait for plugin boot before listing commands
• P2 packages/server/src/handlers/command.ts:8 — Wait for plugin boot before returning commands
• P2 packages/server/src/handlers/integration.ts:26 — Wait for plugin boot before listing integrations
• P2 packages/server/src/handlers/model.ts:22 — Only advertise models the runner can execute
• P2 packages/server/src/handlers/pty.ts:118 — Declare the PTY token header for SDK callers
• P2 packages/server/src/handlers/reference.ts:7 — Wait for plugin boot before listing references
• P2 packages/server/src/handlers/reference.ts:7 — Wait for reference plugins before listing references
• P2 packages/server/src/handlers/session.ts:73 — Honor client directory when creating sessions
• P2 packages/server/src/handlers/session.ts:73 — Honor request location when creating sessions
• P2 packages/server/src/handlers/skill.ts:7 — Wait for plugin boot before listing skills
• P2 packages/server/src/handlers/skill.ts:7 — Wait for skill plugins before listing skills

packages/cli (14)

• P1 packages/cli/src/commands/handlers/serve.ts:19 — Return an authenticated client from SDK server helper
• P1 packages/cli/src/tui.ts:23 — Don't mask provider hydration as empty
• P1 packages/cli/src/tui.ts:23 — Populate legacy bootstrap data from V2 APIs
• P1 packages/cli/src/tui.ts:8 — Pass the active cwd into the TUI client
• P2 packages/cli/package.json:8 — Add the opencode bin alias
• P2 packages/cli/package.json:8 — Expose the command that SDK helpers spawn
• P2 packages/cli/src/commands/commands.ts:8 — Declare TUI launch arguments on the root command
• P2 packages/cli/src/commands/handlers/serve.ts:19 — Expose serve credentials to SDK clients
• P2 packages/cli/src/commands/handlers/serve.ts:20 — Keep serve output compatible with SDK startup
• P2 packages/cli/src/commands/handlers/serve.ts:21 — Emit the startup line the SDK waits for
• P2 packages/cli/src/tui.ts:10 — Forward parsed CLI args into the TUI
• P2 packages/cli/src/tui.ts:10 — Pass the current directory into the TUI
• P2 packages/cli/src/tui.ts:15 — Load built-in TUI plugins in the v2 launcher
• P2 packages/cli/src/tui.ts:7 — Load the user's TUI configuration

packages/tui (21)

• P1 packages/tui/src/component/prompt/index.tsx:1089 — Send prompts through the V2 session route
• P1 packages/tui/src/component/prompt/index.tsx:1089 — Submit prompts through the v2 prompt endpoint
• P1 packages/tui/src/component/prompt/index.tsx:994 — Create new sessions through the v2 endpoint
• P1 packages/tui/src/context/project.tsx:42 — Bootstrap the TUI from implemented location routes
• P1 packages/tui/src/context/project.tsx:42 — Hydrate project state through implemented v2 APIs
• P1 packages/tui/src/context/sdk.tsx:139 — Subscribe to the v2 event stream
• P1 packages/tui/src/context/sync.tsx:709 — Hydrate open sessions through v2 APIs
• P1 packages/tui/src/context/sync.tsx:709 — Hydrate sessions through implemented V2 routes
• P1 packages/tui/src/routes/session/permission.tsx:432 — Reply to permissions through the v2 session endpoint
• P2 packages/tui/src/component/dialog-move-session.tsx:81 — Use an implemented route for project directories
• P2 packages/tui/src/component/dialog-provider.tsx:397 — Connect providers through v2 integration routes
• P2 packages/tui/src/component/dialog-session-list.tsx:250 — Route session deletion through a v2 endpoint
• P2 packages/tui/src/component/prompt/index.tsx:412 — Interrupt sessions through an implemented V2 route
• P2 packages/tui/src/component/prompt/move.tsx:131 — Move sessions through an implemented endpoint
• P2 packages/tui/src/component/prompt/move.tsx:36 — Create project copies without legacy generate-name
• P2 packages/tui/src/component/prompt/move.tsx:39 — Route copy-name generation to an implemented endpoint
• P2 packages/tui/src/context/sdk.tsx:142 — Subscribe to the V2 event stream
• P2 packages/tui/src/routes/session/index.tsx:584 — Compact sessions through the V2 session API
• P2 packages/tui/src/routes/session/permission.tsx:429 — Reply to V2 permission requests via the session API
• P2 packages/tui/src/routes/session/question.tsx:51 — Route question replies through the V2 session API
• P2 packages/tui/src/routes/session/question.tsx:54 — Answer questions through the v2 session endpoint

packages/sdk (1)

• P2 packages/sdk/js/src/v2/client.ts:37 — Only add location query fields where declared

package.json (2)

• P2 package.json:21 — Add new workspaces to the CI path filter
• P2 package.json:21 — Add new workspaces to the TS CI filter

Filed during PR #964 final review. Shipped-path findings from the same review were fixed in c44e0a967a (plugin non-function export guard; fff-bun patch re-key) or dispositioned as by-design (ACP YOLO opt-in; legacy-tool agent threading).