chore(sync): merge upstream v2 through v2.2.4

.github/release/plan-release.sh

@@ -3,7 +3,7 @@
 # (INPUT_BUMP, INPUT_VERSION) only, and writes them to $GITHUB_OUTPUT. Nothing here reads repository files.
 #
 #   push or dispatch on dev           -> dev      0.0.0-dev-<run>     npm tag dev, desktop
-#   dispatch on dev with bump/version -> latest   x.y.z               npm tag latest, releasers only
+#   dispatch on dev with bump/version -> latest   x.y.z               npm tag latest, releasers only, notes required
 #   push or dispatch on beta          -> beta     0.0.0-beta-<run>    desktop only
 #   pull_request                      -> pr       0.0.0-pr-<run>      everything, dry run
 #
@@ -22,6 +22,10 @@ case "$GITHUB_EVENT_NAME:$GITHUB_REF:$versioned" in
   *) die "$GITHUB_EVENT_NAME on $GITHUB_REF cannot publish (versioned: $versioned)" ;;
 esac
 
+if [ "$channel" = latest ] && [ -z "${INPUT_RELEASE_NOTES//[[:space:]]/}" ]; then
+  die "Stable releases need release notes; generate them with ./script/release.ts --print"
+fi
+
 if [ "$channel" = latest ]; then
   actor=${GITHUB_TRIGGERING_ACTOR:-${GITHUB_ACTOR:-}}
   [ -n "$actor" ] || die "Stable releases can only be started by releasers; the triggering actor is unknown"

.github/release/publish-discord.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# publish-discord.sh: announces the v<version> release in Discord with OPENCODE_RELEASE_NOTES (DISCORD_WEBHOOK).
+# Discord caps an embed description at 4096 characters, so longer notes are cut and link to the GitHub release.
+. "$(dirname "$0")/lib.sh"
+
+tag="v$OPENCODE_VERSION"
+payload=$(jq -n --arg tag "$tag" --arg notes "${OPENCODE_RELEASE_NOTES:-}" \
+  --arg url "https://github.com/$GITHUB_REPOSITORY/releases/tag/$tag" '
+  ($notes | if length > 4000 then .[:4000] + "\n\n[Full release notes](\($url))" else . end) as $description |
+  {
+    allowed_mentions: {parse: []},
+    embeds: [{title: "OpenCode V2 \($tag)", url: $url, description: $description, color: 2829099}]
+  }')
+echo "$payload" | jq .
+if dry_run; then exit 0; fi
+
+test -n "${DISCORD_WEBHOOK:-}" || die "DISCORD_WEBHOOK is not set"
+curl -fsS --retry 3 -H "Content-Type: application/json" -d "$payload" "$DISCORD_WEBHOOK"

.github/release/tag-release.sh

@@ -7,7 +7,8 @@
 . "$(dirname "$0")/lib.sh"
 
 tag="v$OPENCODE_VERSION"
-git ls-files -z -- '*package.json' bun.lock | xargs -0 sed -i -E "s/\"version\": \"[^\"]+\"/\"version\": \"$OPENCODE_VERSION\"/g"
+# @opencode/pty is versioned separately, by process-daemon-v<version> tags.
+git ls-files -z -- '*package.json' bun.lock ':!packages/process-daemon/**' | xargs -0 sed -i -E "s/\"version\": \"[^\"]+\"/\"version\": \"$OPENCODE_VERSION\"/g"
 
 if [ -n "${OPENCODE_RELEASE_NOTES:-}" ] && ! grep -qF -x "## $tag" CHANGELOG.md && ! grep -qF "## $tag " CHANGELOG.md; then
   notes=$(mktemp)

.gitignore

@@ -31,7 +31,6 @@ target
 
 # Local dev files
 opencode-dev
-UPCOMING_CHANGELOG.md
 RELEASE_REVIEW.md
 logs/
 *.bun-build

.gitleaks.toml

@@ -12,4 +12,7 @@ paths = [
   '''^packages/http\-recorder/test/http\.test\.ts$''',
   '''^packages/http\-recorder/test/redaction\.test\.ts$''',
   '''^packages/session\-ui/src/components/tool\-count\-summary\.tsx$''',
+  # Upstream v2.2.3 Claude Agent HTTP fixtures: generic-api-key matches
+  # api_message_id + literal REDACTED (not credentials).
+  '''^packages/core/test/plugin/provider/claude\-agent/fixtures/recordings/.*\.jsonl$''',
 ]