Prepare themed picker for public npm release

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,11 +3,11 @@
 
 ## Verification
 
-- [ ] `bun test`
-- [ ] `bun run typecheck`
-- [ ] `bun run build`
+- Commands run:
+- Manual checks:
 
-## Notes
+## Impact
 
-- Hard gates affected:
-- Manual OpenCode integration:
+- User-visible behavior:
+- Compatibility, privacy, or packaging:
+- Screenshots for picker UI changes:

.github/workflows/ci.yml

@@ -79,6 +79,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
+          package-manager-cache: false
       - run: bun install --frozen-lockfile
       - run: bun run build
       - name: Exercise exact npm tarball as a Node consumer
@@ -97,6 +98,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
+          package-manager-cache: false
       - name: Install dependencies and tested OpenCode runtime
         run: |
           bun install --frozen-lockfile
@@ -106,7 +108,7 @@ jobs:
           OPENCODE_BIN: ${{ runner.temp }}/opencode-runtime/node_modules/.bin/opencode
 
   picker-build:
-    name: Picker build
+    name: Picker build (Linux x64)
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -122,6 +124,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
+          package-manager-cache: false
       - name: Install pinned Rust toolchain
         run: rustup toolchain install 1.97.1 --profile minimal --no-self-update
       - run: bun install --frozen-lockfile
@@ -130,6 +133,11 @@ jobs:
       - name: Exercise rendered picker theme and layout
         run: bun run test:picker:rendered
       - run: bun run build:picker
+      - name: Verify native Linux x64 picker
+        run: bun run check:picker-host
+        env:
+          MODEL_DISPATCH_EXPECTED_PICKER_PLATFORM: linux
+          MODEL_DISPATCH_EXPECTED_PICKER_ARCH: x64
       - run: cargo test --manifest-path picker/src-tauri/Cargo.toml --locked
       - run: bun run build
       - name: Install tested OpenCode runtime
@@ -170,6 +178,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
+          package-manager-cache: false
       - name: Install pinned Rust toolchain
         run: rustup toolchain install 1.97.1 --profile minimal --no-self-update
       - name: Verify native ARM64 toolchain
@@ -184,6 +193,11 @@ jobs:
       - run: bun install --frozen-lockfile
         working-directory: picker
       - run: bun run build:picker
+      - name: Verify native Linux ARM64 picker
+        run: bun run check:picker-host
+        env:
+          MODEL_DISPATCH_EXPECTED_PICKER_PLATFORM: linux
+          MODEL_DISPATCH_EXPECTED_PICKER_ARCH: arm64
       - name: Verify native ARM64 picker architecture and linkage
         shell: bash
         run: |
@@ -218,6 +232,55 @@ jobs:
           WEBKIT_DISABLE_COMPOSITING_MODE: "1"
           WEBKIT_DISABLE_DMABUF_RENDERER: "1"
 
+  picker-build-nonlinux:
+    name: Picker build (${{ matrix.label }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: macOS ARM64
+            platform: macos
+            arch: arm64
+            runner: macos-15
+          - label: Windows x64
+            platform: windows
+            arch: x64
+            runner: windows-2025
+          - label: Windows ARM64
+            platform: windows
+            arch: arm64
+            runner: windows-11-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal --no-self-update
+      - run: bun install --frozen-lockfile
+      - run: bun install --frozen-lockfile
+        working-directory: picker
+      - run: bun run build:picker
+      - name: Verify native picker host and architecture
+        run: bun run check:picker-host
+        env:
+          MODEL_DISPATCH_EXPECTED_PICKER_PLATFORM: ${{ matrix.platform }}
+          MODEL_DISPATCH_EXPECTED_PICKER_ARCH: ${{ matrix.arch }}
+      - run: cargo test --manifest-path picker/src-tauri/Cargo.toml --locked
+      - name: Exercise Apple notarization log policy
+        if: matrix.platform == 'macos'
+        shell: bash
+        run: bash scripts/test-apple-notary-log-validator.sh
+      - name: Exercise native picker ready protocol
+        run: bun run test:picker-ready
+
   packaging:
     name: Packaging checks
     runs-on: ubuntu-latest
@@ -231,6 +294,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
+          package-manager-cache: false
       - run: bun install --frozen-lockfile
       - run: bun run check:release-version
       - run: bun run build
@@ -241,4 +305,6 @@ jobs:
           set -euo pipefail
           pkg="$(npm pack --silent)"
           tmp="$(mktemp -d)"
-          npm install --ignore-scripts --prefix "$tmp" "./$pkg"
+          peer_version="$(node -p 'require("./package.json").devDependencies["@opencode-ai/plugin"]')"
+          npm install --ignore-scripts --no-audit --no-fund --package-lock=false \
+            --prefix "$tmp" "@opencode-ai/plugin@$peer_version" "./$pkg"

.github/workflows/compatibility.yml

@@ -0,0 +1,98 @@
+name: OpenCode compatibility
+
+on:
+  schedule:
+    - cron: "17 2 * * *"
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/compatibility.yml"
+      - "package.json"
+      - "bun.lock"
+      - "src/**"
+      - "scripts/resolve-opencode-compatibility.ts"
+      - "scripts/test-opencode-server.ts"
+  pull_request:
+    paths:
+      - ".github/workflows/compatibility.yml"
+      - "package.json"
+      - "bun.lock"
+      - "src/**"
+      - "scripts/resolve-opencode-compatibility.ts"
+      - "scripts/test-opencode-server.ts"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-compatibility-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  discover:
+    name: Resolve supported OpenCode targets
+    runs-on: ubuntu-22.04
+    outputs:
+      targets: ${{ steps.targets.outputs.targets }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - name: Resolve current and five prior minor lines
+        id: targets
+        shell: bash
+        run: |
+          set -euo pipefail
+          targets="$(bun scripts/resolve-opencode-compatibility.ts)"
+          echo "targets=$targets" >> "$GITHUB_OUTPUT"
+          echo "Testing OpenCode targets: \`$targets\`" >> "$GITHUB_STEP_SUMMARY"
+
+  compatibility:
+    name: OpenCode ${{ matrix.target.version }} (${{ matrix.target.line }})
+    needs: discover
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        target: ${{ fromJSON(needs.discover.outputs.targets) }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - run: bun install --frozen-lockfile
+      - name: Install exact OpenCode target
+        run: |
+          npm install \
+            --prefix "$RUNNER_TEMP/opencode-runtime" \
+            --package-lock=false \
+            "opencode-ai@${{ matrix.target.version }}"
+      - name: Exercise real dispatch integration
+        run: bun run test:opencode
+        env:
+          OPENCODE_BIN: ${{ runner.temp }}/opencode-runtime/node_modules/.bin/opencode
+          OPENCODE_TEST_VERSION: ${{ matrix.target.version }}
+      - name: Record compatibility result
+        if: always()
+        run: |
+          plugin_version="$(node -p "require('./package.json').version")"
+          {
+            echo "| OpenCode | opencode-model-dispatch | Target | Result |"
+            echo "| --- | --- | --- | --- |"
+            echo "| \`${{ matrix.target.version }}\` | \`$plugin_version\` | ${{ matrix.target.line }}, ${{ matrix.target.role }} | **${{ job.status }}** |"
+          } >> "$GITHUB_STEP_SUMMARY"