Implemented behavior and remaining scope, reviewed on 2026-10-16 (the Models and Cross-session messaging rows on 2026-10-19, Direct peers and Feature flags on 2026-10-19, Agent teams on 2026-10-20). Start with the README; use the P1 status and acceptance audit for detailed evidence.
“Available” describes implemented local-core behavior. “Partial P1” means working pieces exist and the full contract still needs implementation or acceptance.
| Area | What you can use today | Status |
|---|---|---|
| Models | Provider adapters, model catalog, credentials and usage pricing; a ChatGPT Plus/Pro subscription instead of an API key (cyber providers login|logout chatgpt, a chatgpt provider on the Codex backend, an owner-only login file refreshed across processes; guide) |
Available; broader catalog work remains |
| Sessions | Durable inbox, streaming tool loops, interrupt/resume, crash recovery and compaction | Available |
| Tools | Repository inspection/editing, notebook cell editing, command execution, web tools and instruction/skill loading and durable path-triggered skill reminders with model-loaded Turn permission scopes | Available; static configured command templates also reach the public API; broader skills/commands remain |
| Project instructions | AGENTS.md, CLAUDE.md (fallback where a directory has no AGENTS.md), CONTEXT.md and CYBER.md from the global config directory and every directory from the project root to the Location; @path imports, AGENTS.override.md, 32 KiB truncation, CYBER_DISABLE_CLAUDE_MD/CYBER_DISABLE_PROJECT_CONFIG, nested files attached to read results once per Context Epoch, and the cyber doctor instructions check (guide) |
Available; .cyber/rules, .claude/CLAUDE.md, the ~/.claude/CLAUDE.md fallback, a configurable instructions.max_bytes, per-source sizes in /context and /init remain |
| Safety | Workspace trust, permission rules, protected paths, auto classification with confirmed /approve, macOS/Linux sandboxing and Windows AppContainer confinement with named profiles (deny_read), the environment policy, credential masking, Sandbox denied: reports with one-call escalation, excluded commands, sandbox.* events, cyber sandbox explain/test/run, the bypass eligibility gate (sandbox, container or --dangerously-bypass-permissions), org policy.modes.disable and the rule dry run (cyber permissions test, GET /permissions/test) |
Available; Windows enforcement awaits native acceptance, and the Windows proxy and full auto-mode controls remain partial P1 |
| File recovery | Shadow-git snapshots and conflict-aware restore preserving user edits | Available; broader rewind UI remains |
| Clients | TUI, noninteractive exec, background service, HTTP/SSE/WebSocket/stdio API and generated TypeScript SDK |
Available; complete P1 client surfaces remain |
| TUI | 18 built-in themes plus custom themes/*.json resolved to semantic tokens, truecolor/256/16-color depths, tui.color and NO_COLOR (no colors, reverse-video selection); CommonMark rendering with syntect-highlighted code blocks and Ctrl+X y copy (OSC 52 fallback); the composer, a status footer (cwd, context meter, cost, key hint) and a ▣ Agent · model · duration marker after each run; the Ctrl+P command palette; a responsive sidebar (Context, MCP, LSP, Machine stats with CPU/memory/disk bars from GET /system, Modified files, branch, connection) docked from 120 columns and a drawer below; the theme switcher; the welcome screen; the /files explorer with permission-checked previews; the Settings panel (Status, Config with persisted preferences, Usage, Stats heatmap and book comparison line); the /workflows monitor (runs with live counts and per-row nyan bars, agents by phase, child transcripts, pause/resume/stop/revision/log/script keys), with a sidebar Workflows section, a ⚙ 2 workflows footer field, aggregate run progress on the progress line and run-end notices (tui.workflow_notifications); the Nyan progress indicator above the composer (tui.spinner, at most 12 frames a second, with 16-color, NO_COLOR, reduced-motion and screen-reader fallbacks); Session recaps after 30 minutes away (tui.recap); rebindable keys in tui.keybinds. Model, tool and title text is drawn without control characters, and OSC 8 links are written only for safe URLs on known terminals |
Partial P1; the split-diff reader of diff_style and the # memory composer mode do not exist yet, and tui.statusline.command is not implemented |
| Subagents | Foreground/background children, named resume, forked context, structured results, approvals and task controls, a per-Turn agent catalogue of permitted subagents, @agent mentions and queued progress under agents.max_concurrent |
Partial P1 |
| Cross-session messaging | Sessions on one server message each other (guide): the model tools list_sessions, send_message (by ses_ ID, subagent name or exact title; message.send is allow for same-server targets and ask for @ targets) and watch_session/notify_when_idle (one idle notice, 12 h expiry); delivery through the durable inbox as an untrusted <cross_session_message> block that starts a Turn in an idle target or is promoted at the next Safe Boundary; per-Location messaging.inbound rules and a Session override (deliver, hold, refuse; cyber exec refuses unless --accept-messages); held messages released, dropped or never edited; 10 messages per sender and target a minute, 30 pending per target and messaging.max_hops (8) chain hops, all checked before any write; outcome records in both Sessions that survive a restart; messaging.enabled, managed policy.messaging.enabled and CYBER_DISABLE_MESSAGING=1; /api/v1/messaging/* routes, GET /sessions/:id/messaging, the SDK's client.messaging, cyber messages send|list, cyber stats --by origin, the TUI's received blocks, ✉ N queued · M held badge, held cards and /messages view; the three MCP serve messaging tools |
Done locally (P1); accepted by hand on the real binary 2026-10-19; the automated end-to-end suite, native Windows CI and the Relay transport (P3) remain; machines of one person reach each other over direct peers (next row) |
| Direct peers | Messaging between your own machines without an account (README): an optional second listener (peers.listen, user config only) serving only /api/v1/peer/*, TLS 1.3 with a self-signed key in <state>/peer-tls/ (plain HTTP only on loopback, for SSH tunnels), Origin requests refused, the local password not accepted; grants from cyber peers invite <name> [--scope message|attach] [--expires] [--rotate-key] with 256-bit tokens stored hashed, a one-line pairing code (URL, key fingerprint, token), 120 requests a minute per grant and revocation effective at once (open attach streams end too); cyber peers add|rm|test|list|revoke|discover, tokens in the OS keyring (owner-only file fallback with a warning, or {env:NAME} with --token-env), pinned fingerprints; X@P addresses for send_message, watch_session and list_sessions (<name>@<peer> entries, *@<peer> offline after 5 s), senders named after the grant (review@laptop) and held by default, PeerUnreachableError/PeerAuthError/PeerNotConfiguredError/PeerScopeError with no store-and-forward; held outcomes polled for 7 days across restarts (expired after), with the messaging.outcome live event; cyber attach <session>@<peer> with an attach grant and remote.attach approval; mDNS publishing (peers.mdns, cyber serve --mdns) and cyber peers discover, which never grants trust; cyber doctor rows for the listener (address, TLS, fingerprint, active grants) and remotes with file-stored tokens; the TUI's from review@laptop blocks, "from another machine" held cards, the /messages machine column and the sidebar Peers line; GET /api/v1/peers, /peers/remotes, POST /peers/grants, DELETE /peers/grants/:name, OpenAPI group peer and the SDK's client.peer/client.peers |
Implemented (P2, add-messaging-direct-peers; guide); accepted by hand on 2026-10-19 with two real cyber serve instances on one macOS host (TLS on loopback, scripted provider, pty captures of both TUIs). Partial: the keyring was mocked with --token-env (keyring covered by unit tests only), the SSH-tunnel flow, two-way pairing with a reply, a multi-host run and Linux/Windows runs remain; an attached TUI shows received messages as raw <cross_session_message> text |
| Background commands | bash/powershell background: true Jobs with a capped log, queued completion notices (notify: false to skip), background.max_jobs, process-tree task_stop, job.output.1 and JobEnded with the exit code; the monitor tool (command, WebSocket or file tail, filter, per-minute limit, until); /tasks with logs and x to stop; & cmd and Ctrl+B in the TUI; PTY Jobs (pty_start/pty_write/pty_read, ticketed WebSocket attach with replay cursors); notify and send_file; the /btw side chat (POST /sessions/{id}/side) |
P1 done locally; PTYs are Unix-only, Device push belongs to remote control |
| Skills | Five embedded instruction packages, discovered replacements, captured user commands, background reviewer tasks, and cyber review [target]/TUI /review with permission-checked target resolution (uncommitted, <base>..<head>, commit, pr <number>) and schema-validated findings sorted by severity |
Partial P1; remote https:// skill sources (background 24 h refresh, offline cache, project sources approved with cyber skills trust), command overrides and template expansion are done locally; plugin skills and commands load with <plugin>:<name> on a collision; real-model review quality (needs a live model), native Windows runs and lifecycle acceptance remain |
| Git | cyber git commit-msg and TUI /commit draft a conventional commit message for the staged diff with the small model; cyber git pr-description and /pr-description [base] draft a PR title and body for base..HEAD. The TUI prefills a reviewable git commit/gh pr create command. No co-author trailer unless git.co_author is set. Sessions that run gh pr create or git push (from bash, powershell or a ! command) are linked to the PR; cyber pr <number|url> checks it out with gh and resumes the linked Session, and cyber --from-pr opens the picker over linked Sessions |
Available (P1) |
| Worktrees | Managed startup and isolated children, setup journals, file summaries, cleanup on exit, cyber worktree list/remove/prune, DELETE /worktrees, enter_worktree/exit_worktree, worktree.* events and reviewed setup retry |
P1 done locally; unknown-effect recovery and native Windows acceptance remain |
| Cancellation | Durable admission closure, exclusive child result ownership, bounded stop reports and matched reopening | Partial P1; unknown-effect recovery, cross-process actor cancellation and exec/TUI adoption remain |
| Spending | Durable own/descendant billing, the usage step ledger, the atomic usage API with per-model, duration, code-change and Budget breakdown, the TUI Usage tab (/usage, /cost) with Budget meters, usage statistics (GET /api/v1/usage/stats: local-day activity, streaks and per-model totals) shown by the TUI Stats tab (/stats, heatmap and Models) and cyber stats, usage insights (GET /api/v1/usage/insights: subagent-heavy, long-running and large-context shares plus subagent groups) shown in the Usage tab, provider-reported plan and rate-limit windows (GET /api/v1/usage/limits, read from provider response headers, never estimated) shown as Usage tab meters, Session recaps (`GET |
POST /api/v1/sessions/:id/recap, smallmodel, cached bythrough_seq`) shown at the top of the TUI transcript, and soft Session budgets |
| Plugins | Declarative plugins (cyber-plugin.json): skills, commands, agents, hooks, .mcp.json servers and TUI themes, namespaced <plugin>:<name> on a collision; user, project (with .cyber/plugins.lock) and local scopes plus managed policy.plugins.disabled; path, git (pinned commit) and npm (--ignore-scripts) sources cached at <cache>/plugins/<name>/<version>-<digest>/ (content-addressed, shared by every scope and checkout); trust bound to name, version and content digest with a review prompt for project plugins; cyber plugins install/list/info/update/remove/enable/disable/validate, GET /api/v1/plugins, TUI /plugins and /reload-plugins; --pure/CYBER_PURE=1; plugin host processes for main (JSON-RPC 2.0 over stdio, always sandboxed with the declared network and fs.write capabilities, network never wider than the resolved sandbox network and its denylist; plugin http, prompt and mcp_tool hooks load only within the declared capabilities, and plugin command hooks run with the plugin's network, contributed tools with crash isolation, restart backoff and crash-loop disable, validated userConfig with keyring secrets, cyber plugins configure) and the @cyber-code/plugin TypeScript kit |
Partial P1; host-protocol hooks, providers, catalog transforms and session/prompt, fs.read/shell enforcement, plugin hosts on Windows, mods, marketplaces and signature verification remain |
| Hooks | Command (Unix shell, Windows PowerShell), HTTP, prompt and MCP-tool handlers; managed, global, project, local and invocation scopes with managed-only policy; exact handler trust with --trust-project-hooks for one exec run; tool and lifecycle events, context, in-process SDK handlers (client.hooks.on, scope client, run after every configured handler), continue: false, async handlers and durable receipts; CLI/TUI/API review and cyber hooks test |
Partial P1; plugin hooks run last in scope plugin; sandboxed hook scopes on Windows and the events without a producer (DirectoryAdded, FileChanged, CwdChanged) remain |
| MCP | Local approvals, shared tools/status, startup waiting, schema search and bounded reconnect; remote servers over Streamable HTTP with legacy SSE fallback, needs_auth reporting, header commands and policy-checked networking; OAuth sign-in with cyber mcp auth/logout, token refresh, scope step-up and reconnect, with credentials in the macOS Keychain or Windows Credential Manager (owner-only file on Linux); resource tools and @server:uri mentions; server prompts as /<server>:<prompt> commands; form elicitation for local and remote servers (declined when unattended, URL mode refused, never opens links); roots/list with the Location and writable roots, reconnecting when they change; tools/prompts/resources list_changed refresh with mcp.tools.changed.1; notifications/cancelled on interrupt or timeout; sampling by model_roles.small for local and remote servers when mcp.sampling.enabled; organization policy.mcp allow/deny patterns (name, command, URL) and managed servers for every Location (blocked servers report blocked by organization policy and are never contacted); annotations drive modes (destructive tools always classified in auto, open-world tools ask network when the sandbox network is off) and reach hook envelopes as tool_annotations |
Partial P1; prompt argument completion, blobs beyond 1 MiB, remote token revocation and native acceptance (including a real Keychain and Credential Manager round trip) remain |
| MCP serve | cyber mcp serve exposes Sessions to other agents as trusted local clients: a stdio bridge to the shared server or loopback Streamable HTTP at /api/v1/mcp/serve (Unix socket or local password; loopback peers and Host only). Tools create, list, read and page Sessions, send literal prompts through the user path (UserPromptSubmit hooks run) with a wait or a receipt, re-attach with cyber_prompt_wait (also after a restart) and interrupt, and list, send and read cross-session messages (as the calling Session when known, else as the MCP client mcp:<label>). Waits answer over SSE with keep-alives and progress; cancellation ends only the wait. Idempotency keys replay one effect, a global-only Mode ceiling bounds new Sessions, and sessions_per_connection, max_waits and max_running_sessions refuse before any write. A recursion guard refuses calls nested max_depth deep through Sessions and a Session driving itself or its ancestors. Approvals are never relayed |
Partial P1; unattended approval rules, the remaining depth markers (hook and PTY processes) and native acceptance remain |
| Memory | Durable project/global notes, built-in memory tool, session index updates, CLI management and local/server recovery, authenticated HTTP/SDK CRUD/recovery, TUI review/editing/deletion/recovery, /memory on|off|readonly saved to the global config (GET|PUT /api/v1/memory/settings) and applied at the next Safe Boundary, private draft/request checkpoints, request outcome lookup/record controls and durable change events |
Partial P1; legacy recovery, strengthened native recovery checks, broader client acceptance and multi-client retention remain |
| Code intelligence | Local discovery and authenticated live CLI status; LSP read warming, edit error feedback and eight navigation operations including rename preview; automatic sandboxed formatting after edits; owned services with activity-aware idle release, scoped close/reload and HTTP/SDK status; fourteen servers/twelve formatters; lsp.auto_install downloads nothing (doctor says so) |
Partial P1; native acceptance, enforced Windows launch and full diagnostic lifecycle/client controls remain |
| Browser verification | Optional (browser.enabled): cyber mcp browser install (pinned @playwright/mcp@0.0.41), health and cleanup; a browser MCP process per Session with a fresh locked profile, offered as mcp__browser__* through permissions and the per-navigation network policy, following workspace trust and digest approval; screenshot, console and network evidence with artifact hashes, the workspace content hash, observed vs not-run checks and stale reports (GET /sessions/{id}/browser/evidence); dev servers as bash background: true + ready_url Jobs with readiness timeouts and startup_failed evidence; Session archive/delete stops the browser and its dev servers |
P1 done locally; no real browser run yet (class e), pages a link or redirect opens are not network-checked |
| Migration | Read-only static source inventory and verified snapshots; Claude permissions, model aliases, fallbackModel, env, hooks and Markdown agents; Codex rules, profiles, permission profiles, environment policy, granular approvals, hooks.json, notify and a requirements.toml org-policy report; OpenCode permissions, agents, modes, commands and instructions; secret-safe provider/model and MCP conversion; cyber import --detect reports definition and session counts with read-time coverage; cyber import <tool> shows a byte diff of cyber.jsonc, asks before writing (--yes, --dry-run), writes the mapping report to .cyber/import-report-<ts>.md and annotates entries for idempotent re-import. Read in place: other tools' skills (.cyber > .agents > .claude > .opencode > .codex, compat.<tool> switches) and the project .mcp.json below cyber.jsonc, with one-time per-server approval (guide) |
Partial P1; Claude apiKeyHelper and .claude/rules, the TUI prompt for .mcp.json servers, referenced sources and keyring credential storage remain |
| Operations | Database-plus-artifact backup, verify/restore, retention, logs and diagnostics | Available; broader observability remains |
| Feature flags | The feature registry (teams, experimental, off by default): cyber features list [--json], cyber features enable|disable <name> [--scope user|project], --features a,-b (for the process it is given to: commands served by the background server, such as cyber teams list and the TUI, follow the server's configuration), CYBER_FEATURES, features.<name> (the deprecated experimental.<name> still works and warns), org policy.features.lock (a malformed policy locks every feature to its default) and GET /api/v1/features; an unknown name in any source fails with ConfigInvalidError: unknown feature "<name>" |
Available |
| Agent teams | Behind teams: team definitions from .cyber/teams/*.md (held until the checkout is trusted; the files are part of the trust digest) and ~/.config/cyber/teams/*.md, a project definition winning on a name clash, validation that names the field (runner is refused until distributed teammates exist), cyber teams definitions and GET /api/v1/team-definitions (404 FeatureDisabledError while off); durable team.* records projected into team, team_member and team_task; the team_spawn tool (team.manage, offered only while teams is on and to a lead or a Session in no team) and team starts from a definition (its body reaches the lead as a team_instructions message): teammates are root Sessions titled <team>/<name>, at most teams.max_teammates (default 6, Team size limit reached (6)), in their own worktree team-<ulid>-<name> on cyber/team-<ulid>/<name> when two or more can edit in a git checkout (a failed worktree setup removes the teammate, its checkout and branch); a teammate's Mode is bounded by the lead's at each Turn and tool call, the lead's deny rules apply to it, it cannot switch above the lead (Mode limited by the team lead (<mode>)) and cannot lead a team; the core/teams context for members; the shared task board through team_task_create|list|get|update (team.task, offered to members only): every write runs in one transaction on the lead's stream, a task starts only once its dependencies are done (Task depends on unfinished task_…), dependency cycles are refused when written, claims are atomic (Task already claimed by <name>), expected_version refuses stale edits, only the lead reassigns or cancels, and TaskCreated/TaskCompleted hooks run for team tasks with { task, team_id, member } and matcher subject team_task; team messaging: members address lead, teammate names and all (every other non-stopped member, one record and outcome each) with send_message, replies name the sender by its member name, and same-team senders are delivered unless a refuse/hold pattern matches; idle notices: when a teammate's Drain ends the lead receives <name> is idle: all assigned tasks done, <name> is idle: <last status line> or <name> is idle with task_<id> in progress: … (msgx_team_idle_…, team.member.idle.1), none while the team is stopping, recovered after a restart, then TeammateIdle hooks run (decisions logged only); member status working/waiting_input/idle/stopped with the last status line via team.member.updated.1; file ownership: in a team with a shared teammate, a shared member (the lead included) changing a path another member owns with edit, write, apply_patch or a shell write target is denied with Path owned by teammate <name> before any rule or ask (worktree members are not checked; owns globs are validated at spawn); team_merge (team.manage, leads only) merges a worktree teammate's branch into the lead's checkout through the sandboxed git: it refuses a merge, rebase, cherry-pick or revert of the lead's in progress and a detached HEAD, uncommitted tracked changes (Commit or stash your changes before merging), a branch with nothing new (Nothing to merge from <name>) and git before 2.38, decides the merge with git merge-tree --write-tree and on conflicts lists the files and changes nothing, else makes a --no-ff merge commit with hooks disabled (the merged teammate's own owns paths pass the ownership guard, another member's do not); team budgets: the definition's budget, else budgets.team (reserved enforcement refused), spent by every member since the team was created (an earlier lead's spend still counts), checked at each teammate's Turn start: the Turn over the budget does not start, team.budget.exceeded.1 is recorded once with the per-member spend, the lead (whose Turns are never blocked) receives Team budget exceeded (max_cost_usd 20.00, spent 20.10): api $8.40, …, and the team stops (reason budget); stop (cyber teams stop, POST /api/v1/teams/:id/stop): stopping while teammates finish their current Turn, queued input stays queued, then stopped; resume (cyber teams resume [--lead], POST /api/v1/teams/:id/resume) from stopped only: team.resumed.1, members idle, a teammate owning an in_progress task is told to continue it and one with queued input restarts, with its Sessions, tasks and messages intact; deleting the lead stops the team with lead_deleted and keeps its records, and a resume then needs a new lead in the team's Location; startup recovery finishes stops a restart cut off; the team routes (GET|POST /api/v1/teams, GET /api/v1/teams/:id with members' status, current task, cost and last message plus the board and spend, /tasks, /stop, /resume, the /events stream of team.* records and members' requests; FeatureDisabledError, TeamNotFoundError, TeamLimitError, TaskClaimedError and TaskDependencyError) in OpenAPI and the TypeScript SDK (client.teams), and cyber teams list|show|stop|resume (table or JSON); in the TUI, /team opens the team view (a members table with status badges, current task, cost and last message over the todo/in_progress/blocked/done board with owners, cancelled behind c, refreshed live from the team's event stream), /team start <definition>, /team stop and /team resume [team]; enter on a member opens its Session, where a typed prompt is admitted with steer to it alone, and esc returns to the lead; the sidebar has a Team section with member status dots; a teammate's permission and question requests are also routed to the lead, labelled [tests] Allow bash: docker compose up? and answered there, and teammates' idle notices are drawn as ◷ <name> is idle: … notice lines in the lead's transcript; /team says how to enable teams while they are off |
Experimental (off by default). Accepted by hand on 2026-10-20 on macOS with the real binary, cyber serve and a scripted local provider (15 scenarios, evidence). Not done: an automated end-to-end suite, Linux and Windows runs (only macOS was run), and the archive; under the default sandbox a teammate commits only through an escalation the lead approves. Distributed teammates (P3) and teammate panes (P4) are deferred |
Remaining P1 scope includes hooks/plugins/MCP (M1.3), memory/code intelligence/browser verification (M1.4), migration (M1.5), the local web client and the other P1-tagged APIs. Workflows, goals, loops, remote control, cloud runners and editor integration (ACP, VS Code) belong to later phases; the P2 Workflow runtime (M2.1) is implemented, with the /workflows TUI monitor: cyber workflows list/run/runs/show/pause/resume/stop/logs (with run --wait exit codes 0/1/4/130), the model's workflow tool behind the workflow.run permission, the sandboxed engine with real child-Session agents, default worktree isolation for concurrent writers, pause/stop/resume with durable replay across server restarts, checkpoints, run budgets, per-run usage, run results with one queued summary to the starting Session (up to 8 summaries that end together share one Turn), several runs at once (add-parallel-workflow-runs: at most workflows.max_running_runs running with the rest in a run queue dispatched oldest first, fair least-recently-granted sharing of the workflows.max_concurrent agent slots with a per-run max_concurrent share and workflows.max_concurrent_per_run, independent per-run pause/stop/resume, crash recovery that pauses interrupted runs and keeps queued ones queued, cyber workflows resume --interrupted, workflows.resume_after_restart, run summaries with live counts, filters and workflow.run.progress, cyber workflows runs --watch, the SDK's client.workflows.list()/get()), WorkflowRunStart/WorkflowRunEnd hooks, live run events on the event stream, the v1.workflow.* OpenAPI operations and the SDK's client.workflows.run() handle; the runtime was accepted end to end with the real cyber binary against a scripted local provider (fan-out under the concurrency cap, background HTTP runs, determinism guards, resume after the server is killed, budget exit 4, stop, workflow.run deny rules and Mode ceilings), and parallel runs were accepted the same way (three runs at once with fair grants, the queue, independent pause/stop/resume, kill -9 recovery, runs --watch, the TUI monitor in a pty); that acceptance is also automated (crates/cyber-cli/tests/parallel_workflows.rs against the real binary and server, crates/cyber-tui/src/screens_parallel.rs through TestBackend). ask(), direct read-only tools, prompt-cache warm-up, exec --workflow, Job (/tasks) integration, saved-Workflow listing over HTTP and reserved budgets remain (see P2 evidence). CYBER.md, Cyber Code's own instruction file, loads with AGENTS.md, CLAUDE.md and CONTEXT.md (change add-cyber-md). The capability map covers the full planned product; OpenSpec defines the contracts by phase.
Migration is available with cyber import <claude|codex|opencode|auto> [--dry-run] [--yes] [--scope project|global] [--format json]. It proposes supported permissions, models, providers, MCP servers, hooks, agents, profiles and sandbox settings as a unified diff of the real cyber.jsonc bytes, keeping comments, and writes only after confirmation or --yes. Existing native keys win; auto fills missing keys in OpenCode, Codex, Claude order. Literal credentials become {env:NAME} references named in the report rather than copied values. Every run ends with the mapping report, also saved to .cyber/import-report-<ts>.md when files are written. Inserted entries carry x-imported-from comments, so a repeated import prints nothing to do and a changed source updates only entries nobody edited (guide). JSON reports keep complete: false.