Release hardening: upstream compatibility, workspace isolation, and multi-server workflows

[theblazehen]

Summary

This release-scale branch hardens P4OC across workspace ownership, server lifecycle, upstream protocol compatibility, security, persistence, accessibility, and multi-server workflows.

The upstream baseline is OpenCode v1.18.3 at c69abee0c73253aebae65e87e4e1b9bfa8c38021. All 65 HTTP operations supported by the Android client were aligned with the pinned method, normalized path, and query contracts. This remains a deliberate Android product subset; it does not claim support for all 188 upstream operations or all 89 event variants.

Workspace and lifecycle

• Make workspace identity tab- and server-owned through exact workspace keys.
• Reject ambiguous restored tabs instead of guessing directory ownership.
• Apply exact server-generation ownership across repositories, SSE, terminals, settings, and notifications.
• Prevent stale events, hydration, and callbacks from mutating replacement connections.
• Bound persisted tab, chat, terminal, session, and settings state.

Upstream compatibility

• Correct PTY, session diff, MCP, config, file-search, message, and DTO contracts.
• Make public legacy question endpoints primary, with narrowly classified endpoint-unavailable v2 fallback.
• Add scoped handling for project.updated, project.directories.updated, models-dev.refreshed, catalog.updated, mcp.tools.changed, installation.update-available, and global.disposed.
• Coalesce refresh bursts and preserve visible state on transient background refresh failure.

Security and reliability

• Prevent authenticated redirect following and cross-origin credential/body replay.
• Restrict credentialed cleartext use and exact-origin WebSocket authentication.
• Exclude credentials from backup/device transfer and recover corrupt encrypted preferences/DataStore state.
• Sanitize release logging, network errors, SSE payloads, terminal content, and notifications.
• Harden OFISH framing, path and symlink checks, mode preservation, transfer bounds, cancellation, and transactional abort cleanup.

Product workflows and accessibility

• Restructure Home into a multi-server workspace launcher and pin start-work actions to exact workspace identity.
• Improve permission, question, draft, attachment, pending-attention, and empty-session behavior.
• Capability-gate file editing and make save/upload recovery explicit.
• Improve terminal persistence, reconnection, and bounded TalkBack output.
• Improve model, provider, agent, project, session, and settings recovery states.
• Add truthful selection/toggle/tab semantics, localized accessibility labels, and measured minimum touch targets.

Intentional exclusions

• Unpublished session.next.* events and APIs.
• TUI-only events.
• Unsupported integration, reference, plugin, workspace, and worktree control-plane surfaces.

Verification

Post-event integrated gate:

• 726 JVM tests; 0 failures, errors, or skips.
• Detekt passed.
• Debug Android-test Kotlin compilation passed.
• Evidence: /home/jasmin/.omp/agent/sessions/-Projects-android-opencode_android/2026-07-17T16-56-22-312Z_019f7101-f828-7000-8acb-85c3c6cf84f9/1449.bash-original.log.

Earlier full release/device gate, before the final stable-event additions:

• JVM tests and Detekt passed.
• GitHub-release lint passed.
• Debug and GitHub-release assemblies passed.
• 11 connected instrumentation tests passed.
• Samsung SM-A155F / Android 16 install, launcher, and 100-event Monkey smoke passed with an empty cleared crash buffer.
• Evidence: /home/jasmin/.omp/agent/sessions/-Projects-android-opencode_android/2026-07-17T16-56-22-312Z_019f7101-f828-7000-8acb-85c3c6cf84f9/1386.bash-original.log.

Reviewer guide

The complete origin/main...HEAD range spans workspace/lifecycle authority, network/API/events/security, Home/navigation, chat/files/terminal, accessibility/localization, and their regression tests. Review the full branch range rather than only the final commit.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Melloss]

LGTM