Repository navigation
Conversation
PR validation —
|
| Status | Policy | Material | Messages |
|---|---|---|---|
pr-min-approvals |
pr-info |
PR/MR #3434 has 0 approving reviews, 1 required. | |
| ✅ Passed | pr-description-required |
pr-info |
- |
pr-user-story-linked |
pr-info |
PR/MR #3434 does not reference a user story or issue in title, description, or branch 'feat(cli): show the trace welcome message and session link in opencode'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)gh-[0-9]+", "(?i)\\[[A-Z]+-[0-9]+\\]"] |
AI Session Checks — 🟡 80% · ✅ 0 failing
| Avg score | Sessions | Failing policies | Attribution | Files | Lines | Total Duration |
|---|---|---|---|---|---|---|
| 🟡 80% | 1 | ✅ 0 | 100% AI / 0% Human | 13 | +471 / -164 | 145h28m44s |
🟡 80% — 100% AI — ✅ All policies passing
-
Oct 8, 2026 20:37 UTC · 145h28m44s · $26.43 · 624 in / 203.4k out · claude-code 2.1.295 (claude-opus-5-5)
Change Summary
-
- Rebuilds the trace welcome message and session-link flow for OpenCode 2.
- Fixes the banner-only path so user-facing banner text stays out of model context.
- Rebases the PR twice onto main and resolves README and plugin-template conflicts, regenerating OpenCode goldens.
AI Session Overall Score
-
🟡 80% — Verified rewrite with some scope and workflow drift during follow-up handling.
AI Session Analysis Breakdown
-
🟢 92% · verification
-
🟢 AI updated tests first and reran the affected Go suites to green. · High Impact
🟢 89% · solution-quality
-
🟢 AI investigated live OpenCode 2 behavior before rewriting the provider path. · High Impact
🟡 72% · alignment
-
🟠 After the force-push, three PR-thread replies still cited obsolete commit 8570e16 until follow-up replies fixed them. · Medium Severity
💡 When you rewrite branch history, re-check every PR reply that names a commit before reporting completion.
🟡 70% · scope-discipline
-
🟠 AI-originated scope expansion bundled README and PR metadata updates alongside the requested compatibility follow-up. · Medium Severity
💡 When compatibility work uncovers docs or PR cleanup, surface that expansion and get approval before bundling it.
🟡 70% · user-trust-signal
-
🟠 Autopilot had to pause further pushes and ask why the branch had been rebased and force-pushed beyond expectations. · Medium Severity
💡 When you need to rewrite branch history mid-follow-up, pause and confirm that workflow change before pushing.
🟡 68% · context-and-planning
-
🟢 The opening task provided exact review comments, workflow rules, and commit constraints. · High Impact
🟠 The OpenCode 2 compatibility rewrite spanned many files without a visible plan, TODO list, or shared step breakdown. · Medium Severity
💡 For a rebase-plus-compatibility rewrite, publish a short plan before editing so later scope stays anchored.
-
File Attribution
████████████████████100% AI / 0% HumanStatus Attribution File Lines modified ai app/cli/internal/trace/opencode/hooks.go+77 / -32 modified ai app/cli/internal/trace/opencode/testdata/plugin_full.ts+74 / -31 modified ai app/cli/internal/trace/opencode/testdata/plugin_tracerun.ts+74 / -31 modified ai app/cli/internal/trace/opencode/hooks_test.go+80 / -3 modified ai app/cli/internal/trace/opencode/provider.go+47 / -30 modified ai app/cli/internal/trace/opencode/announce_test.go+52 / -14 modified ai app/cli/pkg/action/trace_agent_hook.go+33 / -12 modified ai app/cli/internal/trace/claude/provider.go+11 / -2 modified ai app/cli/internal/trace/README.md+6 / -4 modified ai app/cli/internal/trace/claude/announce_test.go+5 / -2 modified ai app/cli/internal/trace/provider.go+7 / -0 modified ai app/cli/internal/trace/providers/capabilities_test.go+2 / -2 modified ai app/cli/pkg/action/trace_banner_test.go+3 / -1
Policies (4)
Status Policy Material Messages ✅ Passed ai-config-ai-agents-allowedai-coding-session-a39319- ✅ Passed ai-config-no-dangerous-commandsai-coding-session-a39319- ✅ Passed ai-config-no-secretsai-coding-session-a39319- ✅ Passed ai-config-mcp-servers-allowedai-coding-session-a39319- -
Security Checks — ✅ 5 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
Scans not applied (3)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Security context
This change touches code with 2 recorded security-fix advisories. These are pointers to what past fixes established, not findings in this diff, and they never fail the check.
View in Chainloop ↗ · How this works ↗
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 12 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
8570e16 to
e585f40
Compare
migmartri
changed the title
There was a problem hiding this comment.
All reported issues were addressed across 13 files
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
abfa7d7 to
43aa388
Compare
Bring OpenCode up to the Claude Code experience for the two trace messages meant for the user: the welcome message at session start, and the link to the attested session after a push. Both work on OpenCode 1.x and OpenCode 2. The hook writes one JSON response that the plugin reads. OpenCode 1.x shows the messages as a TUI toast, which is not awaited, and adds the link to the shell output for the model. An OpenCode 2 plugin has no toast, so the welcome message is the description of the synthetic message that carries the spec instruction, and the link is a content part of the shell result, which the TUI shows and the model reads. The blank lines that frame the welcome message move into the Claude provider, since other agents frame it themselves. The instruction that asks the model to repeat a message is one shared constant, and the dashboard lookup for the welcome message runs alongside session tracking. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: a3931907-c590-40a1-90c6-2c29aa204404
When the session-start hook has a banner and no instruction, for example after a resume, the plugin gave the banner to the model as the text of the session message. The banner is for the user only, so the plugin now posts the instruction as the text and nothing when there is none. OpenCode 1.x still shows the banner as a toast, and OpenCode 2 still shows it as the message description. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: a3931907-c590-40a1-90c6-2c29aa204404
43aa388 to
416505c
Compare
2 participants
First step to bring OpenCode trace support up to the level of Claude Code. This adds the two messages meant for the user, on OpenCode 1.x and OpenCode 2: the welcome message at session start, which tells that Chainloop records the session and where the evidence goes, and the link to the attested session after a push.
OpenCode defines no hook response of its own, so the hook writes one JSON response that the generated plugin reads.
Other changes in the shared layer:
The feature table in
app/cli/internal/trace/README.mdis updated. Later steps will bring the other features (spec source pointers, pasted image pointers, and so on) to OpenCode.This pull request was produced with AI assistance (Claude Code). The commit carries an
Assisted-bytrailer.🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri