feat(cli): show the trace welcome message and session link in opencode

[migmartri]

First step to bring OpenCode trace support up to the level of Claude Code. This adds the two messages meant for the user, on OpenCode 1.x and OpenCode 2: the welcome message at session start, which tells that Chainloop records the session and where the evidence goes, and the link to the attested session after a push.

OpenCode defines no hook response of its own, so the hook writes one JSON response that the generated plugin reads.

• OpenCode 1.x shows both messages as a TUI toast, and adds the session link to the shell output, so the model repeats it in its reply.
• An OpenCode 2 plugin has no toast. The welcome message is the description of the synthetic message that already carries the spec capture instruction, which the TUI shows in the transcript. The session link is a content part of the shell result, which the TUI shows in the command block and the model reads.

Other changes in the shared layer:

• The blank lines that frame the welcome message in Claude Code move into the Claude provider, since other agents frame it themselves. What Claude Code shows does not change.
• The instruction that asks the model to repeat a message is one shared constant.
• The dashboard lookup for the welcome message runs alongside session tracking, so the two waits do not add up at session start.

The feature table in app/cli/internal/trace/README.md is updated. Later steps will bring the other features (spec source pointers, pasted image pointers, and so on) to OpenCode.

This pull request was produced with AI assistance (Claude Code). The commit carries an Assisted-by trailer.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[chainloop-platform]

PR validation — ⚠️ 2 failing

Status	Policy	Material	Messages
⚠️ Failed	pr-min-approvals	pr-info	PR/MR #3434 has 0 approving reviews, 1 required.
✅ Passed	pr-description-required	pr-info	-
⚠️ Failed	pr-user-story-linked	pr-info	PR/MR #3434 does not reference a user story or issue in title, description, or branch 'feat(cli): show the trace welcome message and session link in opencode'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)gh-[0-9]+", "(?i)\\[[A-Z]+-[0-9]+\\]"]

_{View attestation ↗}

AI Session Checks — 🟡 60% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 60%	1	✅ 0	100% AI / 0% Human	13	+463 / -159	145h28m7s

🟡 60% — 100% AI — ✅ All policies passing

Oct 8, 2026 20:37 UTC · 145h28m7s · $26.29 · 620 in / 202.5k out · claude-code 2.1.295 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Rebuilds the trace integration on top of main so OpenCode 2 shows the welcome banner and session-link relay.
• Updates the trace providers, hook response shape, tests, and generated OpenCode plugin goldens.
• Revises the trace README and later fixes banner-only sessions so user-only banner text stays out of model context.

AI Session Overall Score

🟡 60% — Strong validation, but the OpenCode 2 rework was under-planned for its scope.

AI Session Analysis Breakdown

🟢 95% · verification

🟢 The AI repeatedly drove failing Go tests to green and exercised OpenCode 2 live. · High Impact

🟢 90% · solution-quality

🟢 Compatibility unknowns were investigated empirically before the provider and hook redesign landed. · High Impact

🟢 84% · alignment

No notes.

🟡 68% · scope-discipline

🟢 The later cubic follow-up stayed narrowly scoped to the opencode trace files. · Medium Impact

🟠 README and PR-metadata updates were volunteered beyond the rebase-and-compatibility follow-up. · Medium Severity

💡 Ask before adding docs or PR-metadata cleanup that is not needed for the requested fix.

🟡 67% · user-trust-signal

🟠 Autopilot had to halt the session after an unapproved rebase and force-push beyond the earlier review-fix scope. · Medium Severity

💡 When a follow-up broadens into branch-history changes, pause for approval before pushing so collaborators do not have to halt the run.

🔴 35% · context-and-planning

🔴 The OpenCode 2 rework started from a terse rebase request and no shared plan, despite spanning many files. · High Severity

💡 When scope jumps to a multi-file rebuild, write a short shared plan before editing and update it as the task shifts.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	app/cli/internal/trace/opencode/hooks.go	+77 / -32
modified	ai	app/cli/internal/trace/opencode/testdata/plugin_full.ts	+74 / -31
modified	ai	app/cli/internal/trace/opencode/testdata/plugin_tracerun.ts	+74 / -31
modified	ai	app/cli/internal/trace/opencode/hooks_test.go	+80 / -3
modified	ai	app/cli/internal/trace/opencode/provider.go	+47 / -30
modified	ai	app/cli/internal/trace/opencode/announce_test.go	+52 / -14
modified	ai	app/cli/pkg/action/trace_agent_hook.go	+25 / -7
modified	ai	app/cli/internal/trace/claude/provider.go	+11 / -2
modified	ai	app/cli/internal/trace/README.md	+6 / -4
modified	ai	app/cli/internal/trace/claude/announce_test.go	+5 / -2
modified	ai	app/cli/internal/trace/provider.go	+7 / -0
modified	ai	app/cli/internal/trace/providers/capabilities_test.go	+2 / -2
modified	ai	app/cli/pkg/action/trace_banner_test.go	+3 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-a39319	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-a39319	-
✅ Passed	ai-config-no-secrets	ai-coding-session-a39319	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-a39319	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

This change touches code with 2 recorded security-fix advisories. These are pointers to what past fixes established, not findings in this diff, and they never fail the check.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 12 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 13 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>