feat(opencode): complete DeepCode CLI lifecycle

.github/actions/setup-bun/action.yml

@@ -8,6 +8,17 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Initialize setup diagnostics
+      shell: bash
+      run: |
+        PACKAGE_MANAGER=$(node -p "require('./package.json').packageManager" 2>/dev/null || true)
+        {
+          echo "runner_os=$RUNNER_OS"
+          echo "runner_arch=$RUNNER_ARCH"
+          echo "node=$(node --version 2>/dev/null || true)"
+          echo "package_manager=$PACKAGE_MANAGER"
+        } > setup-bun.log
+
     # node-gyp@latest (invoked via bunx for native install scripts) requires Node >=22;
     # some runner images ship an older system Node on PATH
     - name: Setup Node
@@ -26,7 +37,9 @@ runs:
             Linux)   OS=linux ;;
             Windows) OS=windows ;;
           esac
-          echo "url=https://github.com/oven-sh/bun/releases/download/bun-v${V}/bun-${OS}-x64-baseline.zip" >> "$GITHUB_OUTPUT"
+          URL="https://github.com/oven-sh/bun/releases/download/bun-v${V}/bun-${OS}-x64-baseline.zip"
+          echo "url=$URL" >> "$GITHUB_OUTPUT"
+          echo "bun_download_url=$URL" >> setup-bun.log
         fi
 
     - name: Setup Bun
@@ -35,10 +48,19 @@ runs:
         bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
         bun-download-url: ${{ steps.bun-url.outputs.url }}
 
+    - name: Record Bun version
+      shell: bash
+      run: |
+        echo "bun=$(bun --version)" >> setup-bun.log
+        echo "bun_revision=$(bun --revision 2>/dev/null || true)" >> setup-bun.log
+
     - name: Get cache directory
       id: cache
       shell: bash
-      run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
+      run: |
+        DIR=$(bun pm cache)
+        echo "dir=$DIR" >> "$GITHUB_OUTPUT"
+        echo "bun_cache=$DIR" >> setup-bun.log
 
     - name: Restore Bun dependencies
       id: bun-cache
@@ -55,14 +77,19 @@ runs:
 
     - name: Install dependencies
       run: |
-        # Workaround for patched peer variants
-        # e.g. ./patches/ for standard-openapi
-        # https://github.com/oven-sh/bun/issues/28147
-        if [ "$RUNNER_OS" = "Windows" ]; then
-          bun install --linker hoisted ${{ inputs.install-flags }}
-        else
-          bun install ${{ inputs.install-flags }}
-        fi
+        set -o pipefail
+        {
+          echo "== bun install =="
+          # Workaround for patched peer variants, for example ./patches/standard-openapi.
+          if [ "$RUNNER_OS" = "Windows" ]; then
+            bun install --linker hoisted ${{ inputs.install-flags }}
+          else
+            bun install ${{ inputs.install-flags }}
+          fi
+          echo "== repository diff after install =="
+          git status --short
+          git diff -- bun.lock package.json packages/opencode/package.json
+        } 2>&1 | tee -a setup-bun.log
       shell: bash
 
     - name: Save Bun dependencies

.github/workflows/test.yml

@@ -85,25 +85,25 @@ jobs:
         env:
           DEEPCODE_EXPERIMENTAL_DISABLE_FILEWATCHER: ${{ runner.os == 'Windows' && 'true' || 'false' }}
 
-      - name: Run S1-02-D installation lifecycle tests
+      - name: Run installation lifecycle tests
         working-directory: packages/opencode
         run: |
           set -o pipefail
           bun test test/installation --timeout 30000 2>&1 | tee installation-${{ matrix.settings.name }}.log
 
-      - name: Run S1-02-E Core isolation tests
+      - name: Run Core isolation tests
         working-directory: packages/core
         run: |
           set -o pipefail
           bun test test/global.test.ts test/config.test.ts --timeout 30000 2>&1 | tee boundary-core-${{ matrix.settings.name }}.log
 
-      - name: Run S1-02-E full config and permission regression
+      - name: Run full config and permission regression
         working-directory: packages/opencode
         run: |
           set -o pipefail
           bun test test/config test/effect/runtime-flags-deepcode.test.ts test/permission --timeout 30000 2>&1 | tee boundary-opencode-${{ matrix.settings.name }}.log
 
-      - name: Capture S1-02-E OpenCode string inventory
+      - name: Capture OpenCode string inventory
         if: runner.os == 'Linux' && always()
         run: |
           status=0
@@ -113,14 +113,15 @@ jobs:
           fi
           cat opencode-boundary-audit.log
 
-      - name: Upload unit and boundary logs
+      - name: Upload unit, boundary, and setup logs
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: unit-${{ matrix.settings.name }}-${{ github.run_attempt }}
           if-no-files-found: error
           retention-days: 7
           path: |
+            setup-bun.log
             unit-${{ matrix.settings.name }}.log
             packages/opencode/installation-${{ matrix.settings.name }}.log
             packages/core/boundary-core-${{ matrix.settings.name }}.log
@@ -208,13 +209,14 @@ jobs:
           CI: true
         timeout-minutes: 30
 
-      - name: Upload Playwright artifacts
+      - name: Upload Playwright and setup artifacts
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-${{ matrix.settings.name }}-${{ github.run_attempt }}
-          if-no-files-found: ignore
+          if-no-files-found: error
           retention-days: 7
           path: |
+            setup-bun.log
             packages/app/e2e/test-results
             packages/app/e2e/playwright-report

.github/workflows/typecheck.yml

@@ -7,17 +7,28 @@ on:
     branches: [develop, master]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          show-progress: false
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
 
-      - name: Run S1-02 package typechecks
+      - name: Verify generated dependency metadata is clean
+        shell: bash
+        run: |
+          set -euo pipefail
+          git diff --exit-code -- bun.lock package.json packages/opencode/package.json packages/opencode/bin/deepcode packages/opencode/script/install.sh
+
+      - name: Run package typechecks
         run: |
           set -euo pipefail
           {
@@ -27,11 +38,13 @@ jobs:
             bun --cwd packages/opencode typecheck
           } 2>&1 | tee typecheck.log
 
-      - name: Upload typecheck log
+      - name: Upload typecheck and setup evidence
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: typecheck-${{ github.run_attempt }}
           if-no-files-found: error
           retention-days: 7
-          path: typecheck.log
+          path: |
+            setup-bun.log
+            typecheck.log