Add first-class OpenCode runner support

[CleanDev-Fix]

Summary

• add opencode as a first-class managed runner
• support Windows npm shim launch through cmd.exe /d /s /c opencode.cmd
• use the existing managed-run stdin prompt path for OpenCode runs
• add OpenCode readiness checks for agent create and doctor
• add OpenCode-safe telemetry runner classification
• keep .env.example readable while real env and secret paths remain protected
• avoid persisting live API key values in auth-store idempotency records
• make the instruction-file mode restore test platform-safe on Windows

Local Verification

• node --test test\runner-execution-policy.test.ts test\setup-doctor.test.ts test\agent-management.test.ts test\agent-auth-store.test.ts
• npm run typecheck
• npm run build
• git diff --check

Notes

This was verified from a Windows local AgentRail/OpenCode pilot using @agentrail-core/cli@0.1.9 and opencode-ai@1.15.13.

OpenCode is treated as partial policy coverage because this adapter does not claim AgentRail-provided OS sandboxing.

[oxnw]

Thanks for this, and also for testing it from a real Windows/OpenCode setup. This is a really useful first contribution.

I found two things that I'd say need fixing before a merge:

1. OpenCode currently passes AgentRail’s default strict runner policy, but the plan launches it with --dangerously-skip-permissions and only partial filesystem/network/command enforcement. That seems weaker than our Cursor path, which blocks strict mode unless an external sandbox is configured. I think OpenCode should either require advisory/external-sandbox mode for now, or we need a stronger enforcement story before it passes strict.
2. The init help now advertises --repo-map-profiler-runner opencode, but repoMapProfilerLaunchCommand() does not handle opencode, so it silently falls through to the Codex launch command. That means a user selecting OpenCode for repo-map profiling would actually run Codex.

Also, one existing test now fails because the help text changed but the assertion wasn’t updated:
node --test test/setup-wizard.test.ts test/repo-map-profiler.test.ts

The rest looks promising. The targeted tests, typecheck, build, and diff check all passed locally for me. Once those points are fixed, I’d be happy to take another look.

[CleanDev-Fix]

Thanks again for the detailed review. I pushed the follow-up commit a6a1f81 addressing the three points:

• OpenCode no longer passes the default strict policy directly; strict mode now requires an external sandbox wrapper, while advisory mode remains allowed.
• repoMapProfilerLaunchCommand() now handles opencode explicitly instead of falling through to Codex.
• The init help assertion was updated for the expanded repo-map profiler runner list.

Fresh local verification on Windows:

• node --test test/setup-wizard.test.ts test/repo-map-profiler.test.ts passed: 32 tests.
• node --test test/runner-execution-policy.test.ts test/setup-doctor.test.ts test/agent-management.test.ts test/agent-auth-store.test.ts passed: 53 tests.
• npm run typecheck passed.
• npm run build passed.
• git diff --check passed.

I think this should be ready for another look.

[CleanDev-Fix]

Hi @oxnw, following up on a6a1f81, which addresses the strict-mode sandbox requirement, the OpenCode repo-map profiler launch path, and the setup help test. The focused 85-test set, typecheck, build, and git diff --check all pass. When you have a chance, would you be willing to take another look? Happy to address anything else that is still blocking.