Bootstrap OpenCodeHighEnd 0.1.0 (OpenCode 2 overlay)

.github/workflows/ci.yml

@@ -0,0 +1,143 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    env:
+      OPENCODE_DISABLE_CLAUDE_CODE: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Shell syntax
+        run: |
+          bash -n install.sh uninstall.sh restore.sh opencode-he bin/opencode-chromium-cdp \
+            scripts/make-release-artifacts.sh scripts/verify-release-artifacts.sh
+      - name: Compileall
+        run: python3 -m compileall -q lib tests
+      - name: Unit and installer tests
+        run: python3 -m unittest discover -s tests -v
+      - name: Product isolation scan
+        run: python3 tests/test_isolation.py
+
+  shellcheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install shellcheck
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
+      - name: Shellcheck
+        run: |
+          shellcheck -x install.sh uninstall.sh restore.sh opencode-he bin/opencode-chromium-cdp \
+            scripts/make-release-artifacts.sh scripts/verify-release-artifacts.sh
+
+  gitleaks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: gitleaks
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  semgrep:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: semgrep
+        run: |
+          python3 -m pip install --quiet semgrep
+          semgrep --config .semgrep.yml --error lib tests
+
+  ocr-integration:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install OCR stack
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq poppler-utils tesseract-ocr tesseract-ocr-eng tesseract-ocr-ind
+          python3 -m pip install --quiet Pillow pypdf
+      - name: Real OCR integration
+        env:
+          SMARTDOC_OCR_INTEGRATION: "1"
+        run: |
+          python3 -m unittest tests.test_smartdoc_ocr_integration -v
+          python3 -m lib.cli smartdoc doctor --json
+
+  browser-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+      - name: Install pinned Chromium snapshot
+        id: chromium
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
+        with:
+          chrome-version: "1692935"
+          install-dependencies: true
+      - name: ScrollCraft browser lifecycle and interaction smoke
+        env:
+          OPENCODE_CHROMIUM_BIN: ${{ steps.chromium.outputs.chrome-path }}
+          OPENCODE_CHROMIUM_NO_SANDBOX: "1"
+        run: node tests/scroll_craft_browser_smoke.mjs
+
+  release-artifact:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Build release artifacts from explicit HEAD
+        run: |
+          ./scripts/make-release-artifacts.sh --sha "$(git rev-parse HEAD)" --allow-untagged
+      - name: Verify release artifacts
+        run: |
+          ./scripts/verify-release-artifacts.sh dist "$(git rev-parse HEAD)"
+      - name: Reproducible second build
+        run: |
+          first="$(sha256sum dist/SHA256SUMS)"
+          ./scripts/make-release-artifacts.sh --sha "$(git rev-parse HEAD)" --allow-untagged
+          second="$(sha256sum dist/SHA256SUMS)"
+          test "$first" = "$second"
+          (cd dist && sha256sum -c SHA256SUMS)
+      - name: Extract smoke
+        run: |
+          VER="$(tr -d '[:space:]' < VERSION)"
+          python3 -m lib.release smoke-extract dist --dest "$RUNNER_TEMP/ocbf-extract" --version "$VER"
+          python3 -m compileall -q "$RUNNER_TEMP/ocbf-extract/OpenCodeHighEnd-v${VER}/lib"

.gitignore

@@ -0,0 +1,34 @@
+.env
+.env.*
+!.env.example
+
+*.log
+*.token
+*.secret
+
+.cache/
+tmp/
+dist/
+build/
+node_modules/
+
+backups/
+
+/Design/
+/Design-bank.tgz
+/SmartDoc/
+
+auth.json
+credentials.json
+
+__pycache__/
+*.pyc
+.pytest_cache/
+.DS_Store
+
+# local install/test debris
+.home-fixture/
+.scratch/
+demos/
+*.mp4
+*.webm

.semgrep.yml

@@ -0,0 +1,11 @@
+rules:
+  - id: ocbf-no-shell-true
+    patterns:
+      - pattern: subprocess.$F(..., shell=True, ...)
+    message: subprocess shell=True is forbidden in OpenCodeHighEnd
+    languages: [python]
+    severity: ERROR
+    paths:
+      include:
+        - lib
+        - tests

CHANGELOG.md

@@ -0,0 +1,17 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.0 — 2026-09-18
+
+First OpenCodeHighEnd release. New product on OpenCode 2. Not OpenCodeBestFriend 1.8.6, not Claude Code, not GrokBuild.
+
+- Catalog inherited frozen from OpenCodeBestFriend 1.8.6 (`67142e4` / PR #29): **62** names (47 model-invoked, 15 manual slash commands).
+- Native V2 config: `skills` is an array; MCP lives under `mcp.servers`; every server has `type`; `disabled` replaces V1 `enabled`.
+- Installer fails closed on OpenCode 1.x. Gate is major `>= 2`.
+- New identity: CLI `opencode-he`, overlay `~/.config/opencode/highend`, share `~/.local/share/opencode-highend`, AGENTS markers `OPENCODEHIGHEND:BEGIN/END`.
+- V1 plugins are not copied. `lsp` is not ported. Design Bank / Design V2 / SmartDoc remain user data, never git media.
+- Legacy V1 plugins (`impeccable-live-poll.ts`) quarantined to `~/.local/share/opencode-highend/quarantine/plugins/`; doctor reports `V1_PLUGIN_LEFTOVER`.
+- FOREIGN_ON_DEMAND MCP stay enable-gated: serena, stitch, reticle, ui-skills, markitdown; exa is never added/removed/overwritten.
+- Retired twins stay retired: `ask-matt`, `grilling`, `wait-what`, `matt-implement`.
+- Dropped deprecated `GROK_*` env aliases. Runtime paths never use GrokBuild, `~/.grok`, or `~/.claude`.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenCodeHighEnd contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.