Coding agent

Providers and authority

Each conversation selects a configured provider and can use personal or shared credentials according to Warden's capability policy. OpenCode can edit files and run commands, so agent.run remains a high-authority capability executing as the Warden OS user.

Hostile-output model

Prompts, model text, provider JSON, tool descriptions and restored sessions are untrusted display data. They cannot add a Warden capability or bypass the server's workspace resolution. Provider events are depth-, collection- and string-bounded, and credential-shaped fields are redacted before reaching the browser. A visually convincing model message is not proof that a privileged operation occurred; server authorization and audit remain authoritative.

Durable account-owned conversations

Conversation snapshots live in SQLite under the current Warden account. They retain workspace, title, provider/model, state, OpenCode session identity and ordered transcript events. Open and archived conversations reload after authentication and remain shared between the dedicated Agent view and Editor's integrated Agent pane.

Earlier browser-local sessions are imported once when the account has no server conversations. Browser storage remains a UI cache; the server is authoritative afterward.

Run evidence and recovery

Every invocation records its prompt, state, timing, tokens, estimated cost, errors and OpenCode session identity. If a headless OpenCode run omits final output or accounting, Warden exports its isolated session to recover the missing information. Export output is capped at 8 MiB and provider-session identifiers are validated before use.

Visible execution

Assistant text, tools, commands, completion and errors stream into both Agent surfaces. Conservative Markdown highlighting preserves literal syntax, while tool events keep separate semantic states. Copy session returns the original conversation and trace.

Workspace and lifecycle

The workspace chooser is confined to Warden's configured filesystem root. Use the session menu for a fresh conversation in the same workspace, a different workspace, archive or restoration. Each conversation has its own OpenCode data directory under Warden's private configuration directory.