feat(cli): show the trace welcome message and session link in opencode by migmartri · Pull Request #3434 · chainloop-dev/chainloop

migmartri · 2026-09-11T15:41:33Z

First step to bring OpenCode trace support up to the level of Claude Code. This adds the two messages meant for the user, on OpenCode 1.x and OpenCode 2: the welcome message at session start, which tells that Chainloop records the session and where the evidence goes, and the link to the attested session after a push.

OpenCode defines no hook response of its own, so the hook writes one JSON response that the generated plugin reads.

OpenCode 1.x shows both messages as a TUI toast, and adds the session link to the shell output, so the model repeats it in its reply.
An OpenCode 2 plugin has no toast. The welcome message is the description of the synthetic message that already carries the spec capture instruction, which the TUI shows in the transcript. The session link is a content part of the shell result, which the TUI shows in the command block and the model reads.

Other changes in the shared layer:

The blank lines that frame the welcome message in Claude Code move into the Claude provider, since other agents frame it themselves. What Claude Code shows does not change.
The instruction that asks the model to repeat a message is one shared constant.
The dashboard lookup for the welcome message runs alongside session tracking, so the two waits do not add up at session start.

The feature table in app/cli/internal/trace/README.md is updated. Later steps will bring the other features (spec source pointers, pasted image pointers, and so on) to OpenCode.

This pull request was produced with AI assistance (Claude Code). The commit carries an Assisted-by trailer.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

chainloop-platform · 2026-09-11T15:41:42Z

PR validation — ⚠️ 2 failing

Status	Policy	Material	Messages
⚠️ Failed	`pr-min-approvals`	`pr-info`	PR/MR #3434 has 0 approving reviews, 1 required.
✅ Passed	`pr-description-required`	`pr-info`	-
⚠️ Failed	`pr-user-story-linked`	`pr-info`	PR/MR #3434 does not reference a user story or issue in title, description, or branch 'feat(cli): show the trace welcome message and session link in opencode'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)gh-[0-9]+", "(?i)\\[[A-Z]+-[0-9]+\\]"]

_{View attestation ↗}

AI Session Checks — 🟢 85% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 85%	2	✅ 0	100% AI / 0% Human	13	+471 / -164	145h31m7s

🟢 85% — 100% AI — ✅ All policies passing

Oct 16, 2026 10:49 UTC · 2m23s · $0.61 · 40 in / 6.1k out · claude-code 2.1.301 (claude-sonnet-5-5)

_{View session details ↗}

Change Summary

Rebases feat/opencode-trace-announcements onto upstream/main and resolves the app/cli/internal/trace/README.md conflict.
Fixes the duplicate local declaration in app/cli/pkg/action/trace_agent_hook.go that surfaced after the rebase.
Re-runs go build, go vet ./pkg/action/, and focused go test for the touched trace and action packages.

AI Session Overall Score

🟢 85% — Autonomous fixer run with one workflow deviation, but the repair was validated.

AI Session Analysis Breakdown

🟢 90% · context-and-planning

🟢 User front-loaded clear workflow constraints and the allowed push mode. · High Impact

🟢 90% · solution-quality

No notes.

🟢 89% · verification

🟢 AI closed the loop: fail, inspect, fix, re-run cleanly. · High Impact

🟢 88% · scope-discipline

🟢 Work stayed on the conflicted README and failing hook file. · Medium Impact

🟡 68% · alignment

🟠 AI ignored the instructed stop-and-report path after the origin fetch failed and switched to upstream on its own. · Medium Severity

💡 When a workflow step says stop on failure, escalate instead of inventing a new remote path.

abstained · user-trust-signal

🟡 User-trust signal was not assessed because the session contains only the opening tasking turn. · Low Severity

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	`app/cli/pkg/action/trace_agent_hook.go`	+0 / -7

Policies (4)

Status	Policy	Material	Messages
✅ Passed	`ai-config-ai-agents-allowed`	`ai-coding-session-f3505b`	-
✅ Passed	`ai-config-no-dangerous-commands`	`ai-coding-session-f3505b`	-
✅ Passed	`ai-config-no-secrets`	`ai-coding-session-f3505b`	-
✅ Passed	`ai-config-mcp-servers-allowed`	`ai-coding-session-f3505b`	-

🟢 85% — 100% AI — ✅ All policies passing

Oct 8, 2026 20:37 UTC · 145h28m44s · $26.43 · 624 in / 203.4k out · claude-code 2.1.295 (claude-opus-5-5)

_{View session details ↗}

Change Summary

Rebases the PR onto newer main revisions as upstream moved.
Reworks OpenCode trace hooks so the welcome banner and session link reach OpenCode 2 users while preserving 1.x behavior.
Updates related Go tests, plugin goldens, and README wording for the merged trace flow.
Fixes a follow-up bug so banner-only sessions no longer send the banner into model context.

AI Session Overall Score

🟢 85% — Well-framed and well-verified overall, but the OpenCode 2 rebuild lacked a visible shared plan.

AI Session Analysis Breakdown

🟢 89% · solution-quality

🟢 Conflict resolution preserved both the new shell payload field and the PR's hook response. · Medium Impact

🟢 88% · verification

🟢 The AI updated tests first, saw failures, then reran suites and a live OpenCode 2 check. · High Impact

🟡 Runtime validation was thorough, but no explicit user confirmation of behavior appears in-session. · Low Severity

🟢 86% · alignment

No notes.

🟢 86% · user-trust-signal

No notes.

🟢 81% · scope-discipline

🟡 README and PR metadata updates were volunteered rather than explicitly requested. · Low Severity

🟡 68% · context-and-planning

🟢 Opening instructions gave repo rules, commit trailers, tests, and reply format. · High Impact

🟠 The 13-file OpenCode 2 rebuild started without a visible shared plan, TODO, or Plan-mode artifact. · Medium Severity

💡 Before a multi-file rebuild, write a short shared plan naming phases, unknowns, and scope boundaries.

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	`app/cli/internal/trace/opencode/hooks.go`	+77 / -32
modified	ai	`app/cli/internal/trace/opencode/testdata/plugin_full.ts`	+74 / -31
modified	ai	`app/cli/internal/trace/opencode/testdata/plugin_tracerun.ts`	+74 / -31
modified	ai	`app/cli/internal/trace/opencode/hooks_test.go`	+80 / -3
modified	ai	`app/cli/internal/trace/opencode/provider.go`	+47 / -30
modified	ai	`app/cli/internal/trace/opencode/announce_test.go`	+52 / -14
modified	ai	`app/cli/pkg/action/trace_agent_hook.go`	+33 / -5
modified	ai	`app/cli/internal/trace/claude/provider.go`	+11 / -2
modified	ai	`app/cli/internal/trace/README.md`	+6 / -4
modified	ai	`app/cli/internal/trace/claude/announce_test.go`	+5 / -2
modified	ai	`app/cli/internal/trace/provider.go`	+7 / -0
modified	ai	`app/cli/internal/trace/providers/capabilities_test.go`	+2 / -2
modified	ai	`app/cli/pkg/action/trace_banner_test.go`	+3 / -1

Policies (4)

Status	Policy	Material	Messages
✅ Passed	`ai-config-ai-agents-allowed`	`ai-coding-session-a39319`	-
✅ Passed	`ai-config-no-dangerous-commands`	`ai-coding-session-a39319`	-
✅ Passed	`ai-config-no-secrets`	`ai-coding-session-a39319`	-
✅ Passed	`ai-config-mcp-servers-allowed`	`ai-coding-session-a39319`	-

Security Checks — ✅ 5 passing

✅ `secret-scan`

Status	Policy	Messages
✅ Passed	`secrets-detection`	-

✅ `sast-scan`

Status	Policy	Messages
✅ Passed	`owasp-top10-2025`	-
✅ Passed	`sast`	-
✅ Passed	`cwe-top25`	-
✅ Passed	`cwe-top26-40-cusp`	-

Scans not applied (3)

Scan	Reason
`vulnerability-scan`	no manifest/lockfile changed
`github-actions-scan`	no workflow files changed
`iac-scan`	no IaC files changed

_{View attestation ↗}

Security context

This change touches code with 2 recorded security-fix advisories. These are pointers to what past fixes established, not findings in this diff, and they never fail the check.

_{View in Chainloop ↗ · How this works ↗}

Powered by Chainloop and Chainloop Trace

cubic-dev-ai

All reported issues were addressed across 12 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 13 files

_{Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic}

Bring OpenCode up to the Claude Code experience for the two trace messages meant for the user: the welcome message at session start, and the link to the attested session after a push. Both work on OpenCode 1.x and OpenCode 2. The hook writes one JSON response that the plugin reads. OpenCode 1.x shows the messages as a TUI toast, which is not awaited, and adds the link to the shell output for the model. An OpenCode 2 plugin has no toast, so the welcome message is the description of the synthetic message that carries the spec instruction, and the link is a content part of the shell result, which the TUI shows and the model reads. The blank lines that frame the welcome message move into the Claude provider, since other agents frame it themselves. The instruction that asks the model to repeat a message is one shared constant, and the dashboard lookup for the welcome message runs alongside session tracking. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: a3931907-c590-40a1-90c6-2c29aa204404

When the session-start hook has a banner and no instruction, for example after a resume, the plugin gave the banner to the model as the text of the session message. The banner is for the user only, so the plugin now posts the instruction as the text and nothing when there is none. OpenCode 1.x still shows the banner as a toast, and OpenCode 2 still shows it as the message description. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: a3931907-c590-40a1-90c6-2c29aa204404

Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: f3505bf6-f226-478a-8455-df608d19080f

cubic-dev-ai Bot reviewed Sep 11, 2026

View reviewed changes

Comment thread app/cli/internal/trace/opencode/hooks.go Outdated

Comment thread app/cli/internal/trace/opencode/provider.go Outdated

Comment thread app/cli/internal/trace/opencode/testdata/plugin_full.ts Outdated

jiparis reviewed Sep 14, 2026

View reviewed changes

Comment thread app/cli/internal/trace/claude/provider.go Outdated

migmartri marked this pull request as draft September 30, 2026 10:51

migmartri force-pushed the feat/opencode-trace-announcements branch from 8570e16 to e585f40 Compare October 8, 2026 20:55

migmartri changed the title ~~feat(cli): surface trace messages to the user in opencode~~ feat(cli): show the trace welcome message and session link in opencode Oct 8, 2026

migmartri marked this pull request as ready for review October 8, 2026 21:08

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread app/cli/internal/trace/opencode/hooks.go Outdated

jiparis previously approved these changes Oct 14, 2026

View reviewed changes

migmartri dismissed jiparis’s stale review via abfa7d7 October 14, 2026 20:32

migmartri force-pushed the feat/opencode-trace-announcements branch 3 times, most recently from 43aa388 to 416505c Compare October 15, 2026 18:16

migmartri added 3 commits October 16, 2026 12:50

fix(cli): drop duplicate local-mode detection after rebase onto main

b9e0c85

Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: f3505bf6-f226-478a-8455-df608d19080f

migmartri force-pushed the feat/opencode-trace-announcements branch from 416505c to b9e0c85 Compare October 16, 2026 10:52

Conversation

migmartri commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chainloop-platform Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR validation — ⚠️ 2 failing

AI Session Checks — 🟢 85% · ✅ 0 failing

🟢 85% — 100% AI — ✅ All policies passing

Change Summary

AI Session Overall Score

AI Session Analysis Breakdown

🟢 90% · context-and-planning

🟢 90% · solution-quality

🟢 89% · verification

🟢 88% · scope-discipline

🟡 68% · alignment

abstained · user-trust-signal

File Attribution

Policies (4)

🟢 85% — 100% AI — ✅ All policies passing

Change Summary

AI Session Overall Score

AI Session Analysis Breakdown

🟢 89% · solution-quality

🟢 88% · verification

🟢 86% · alignment

🟢 86% · user-trust-signal

🟢 81% · scope-discipline

🟡 68% · context-and-planning

File Attribution

Policies (4)

Security Checks — ✅ 5 passing

✅ secret-scan

✅ sast-scan

Security context

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

migmartri commented Sep 11, 2026 •

edited

Loading

chainloop-platform Bot commented Sep 11, 2026 •

edited

Loading

✅ `secret-scan`

✅ `sast-scan`

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading