# Runtime checks — verified against real OpenCode v2

Environment: Windows 11, `opencode v2.0.29`, `@opencode/plugin@2.0.29`, 2026-10-14.
Method: `scripts/smoke.ts` boots `opencode serve` (private server, Basic auth user `opencode`,
password printed on stdout) in a temp fixture and asserts against the HTTP API. Result: **PASS**.

## Verified

- **Registry install by package name (1.10, 2026-10-14)**: `@haylan/opencode-pocock@0.1.0`
  published to the Gitea npm registry by the dispatched `release` workflow (run 5684, success;
  tag `v0.1.0` created, package linked to repo). Anonymous registry reads work (HTTP 200 without
  auth). A clean fixture with `"plugins": ["@haylan/opencode-pocock"]` + scope registry in
  `~/.npmrc` loads the plugin: `/api/plugin` shows
  `source {type:"package", target:"@haylan/opencode-pocock", version:"0.1.0"}`,
  `state.status "active"`; skills inject from the bun cache path
  (`~/.cache/opencode/npm/@haylan/opencode-pocock@latest/.../skills/...`); `npx -y
@haylan/opencode-pocock init` installs the three agents (modes decode correctly).
  Id collisions with a pre-existing global `~/.agents/skills` Matt Pocock install resolve to the
  file-based copy (expected; a clean machine gets all 31 from the package).
- **Plugin loads and activates** from a local directory entry (`plugins: ["<abs path>/dist"]`);
  `GET /api/plugin` shows `haylan.pocock` with `state.status: "active"`.
  - A **file** entry (`file://.../dist/index.js`) is IGNORED — local plugin entries must be
    directories with a root `index`/`server` file (confirms fastcrw research). npm-name entries
    resolve through `exports` (to be re-verified after first registry publish, TODO 1.10).
- **Skill injection works**: all 31 manifest skills registered (`GET /api/skill`); the 16
  user-invoked ones carry `autoinvoke: false`. The API **omits `autoinvoke` when true** (default).
- **DMI honored natively**: file-loaded skills with upstream `disable-model-invocation: true`
  (e.g. a global `~/.agents/skills` install) show `autoinvoke: false` without our plugin.
- **ID collisions**: when the same skill id also exists as a file-based skill (global install), the
  file-based entry is what `/api/skill` reports; plugin injection coexists without errors.
  (`pr`, absent from the tester's global install, was served from our package path.)
- **Injected content must have frontmatter stripped** to match file-based loading
  (`markdown.content`); the plugin does this since 2026-10-14.
- **Agent markdown with V2-native frontmatter decodes correctly** from `.opencode/agents/`:
  `pocock` (primary), `pocock-worker` / `pocock-reviewer` (subagent), descriptions intact, and the
  full `permissions` array survived decoding in order — verified on `pocock-worker`:
  `skill * deny` + `tdd/codebase-design/diagnosing-bugs allow`, `subagent * deny`, and all
  git/gh/glab shell denies present.
- **Default permission floor** (v2.0.29): agents start with `{action:"*",resource:"*",effect:"allow"}`
  plus specific rules, among them `external_directory /tmp` and `/tmp/*` **allow** — the
  `/tmp/pocock-workers` worktree root needs no extra user config on this build (README still
  documents the rule for other setups/subagents).
- **Injected skills do NOT become slash commands** (`GET /api/command` shows none for them;
  `Skill.Info` has no `slash` field). User-invoked steps are started via conversation with `pocock`
  (propose → yes → load) or by any agent explicitly loading the skill. File-based installs (global
  `~/.agents/skills`, or a `skills: [...]` directory source) keep slash behavior.
- **Server API**: prefix `/api/*`, Basic auth (`opencode` + printed password); SPA HTML answers
  unknown non-/api paths with 200 — assert JSON, not status. `POST /api/location/reload` exists.
  Plugin loading is lazy (appears seconds after boot); `/openapi.json` requires auth.

## Known environment quirks (tester machine, not product issues)

- Windows: `server.kill()` under `shell:true` only kills `cmd.exe`; smoke uses
  `taskkill /PID <pid> /T /F`. Temp fixture deletion can lag behind handle release (EPERM warning);
  harmless, retried on next run.
- The user's global `~/.agents/skills` already contains most Matt Pocock skills — smoke assertions
  are written to tolerate id collisions (presence + flags, not source path).