feat: SSH loopback forwarding and native manual compaction for Codex and OpenCode

[dviejokfs]

Why

Temps Fleet is moving every turn — local, remote daemon and SSH, for every harness — onto this SDK so it can delete its own legacy drivers and Bun sidecar. Two gaps blocked that:

• OpenCode::serve() could not run on an SshTransport: the client talks to the server on the SDK host's loopback, and the transport never forwarded the port.
• RuntimeHandle::compact only worked for Claude, so Fleet still compacted Codex and OpenCode sessions through its legacy drivers.

What

• CommandSpec::loopback_ports — loopback ports a provider process serves that the SDK host must reach. SshTransport::spawn adds -L 127.0.0.1:<port>:127.0.0.1:<port> for each (with ExitOnForwardFailure=yes, so a failed forward fails the connection instead of leaving the client unable to reach the server). opencode serve declares its port. Local execution ignores the field.
• Manual compaction for Codex and OpenCode. On a /compact invocation:
  • Codex (app-server mode) sends thread/compact/start once the thread is open instead of turn/start, and finishes on thread/compacted (or the contextCompaction item / turn/completed).
  • OpenCode (serve mode) posts /session/{id}/summarize with the pinned {providerID, modelID} instead of a message; the existing compaction-part / session.compacted / session.idle handling reports the lifecycle. Without a pinned model the turn fails with InvalidRequest { field: "model" }.
  • Both emit CompactionStarted/Completed with CompactionTrigger::Manual.
• TurnCapabilities::manual_compaction (serde-defaulted) — Claude, Codex app-server and OpenCode serve set it; RuntimeDriverCapabilities::manual_compaction follows it instead of provider == Claude.
• is_manual_compaction_prompt moves from the Claude adapter to providers so all adapters detect the invocation the same way.

Follow-up fixes on this branch

• Retained Codex compaction never finished. thread/compact/start answers with an empty result, so a retained connection had no turn id for the compaction and dropped all of its frames as uncorrelated. A manual compaction now adopts the turn id from turn/started.
• A manual compaction no longer emits the "completed without a text response" warning.

Testing

• Unit tests: Codex compacts the opened thread instead of starting a turn; OpenCode summarizes with its model (and refuses without one); SshTransport forwards ports before the destination, only when requested.
• Integration (tests/codex_app_server.rs): the fixture app server now plays thread/compact/start exactly as codex app-server 0.159 does (captured from the real binary: empty result, turn/started, contextCompaction item started/completed, turn/completed, no thread/compacted). Covered one-shot and on a retained connection after a normal turn — the retained case reproduced the hang before the fix.
• cargo fmt --check, cargo clippy --all-targets --all-features -D warnings, cargo test --locked --all-features all pass.
• End to end in Temps Fleet (linked to this branch): /compact on a Codex conversation with a retained app server completes and shrinks the context (7% → 2%); Claude turns run over SshTransport against a Docker sshd. OpenCode over SSH and OpenCode compaction are covered by unit tests only (no working OpenCode login on the test machine).

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds SSH port forwarding and compaction support across multiple providers.

The PR appears safe to merge based on the reviewed changes.

Summary

The PR adds SSH loopback forwarding and native manual compaction for Codex app-server and OpenCode serve. The follow-up changes authenticate the OpenCode HTTP bridge, reject unsupported compaction instructions, correlate retained Codex compaction events, and narrow suppression of empty-response warnings.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Caller[Runtime caller] --> Runtime[Runtime]
  Runtime -->|compact| Adapter{Provider adapter}
  Adapter -->|thread/compact/start| Codex[Codex app-server]
  Adapter -->|authenticated summarize| OpenCode[OpenCode serve]
  Runtime -->|spawn with loopback ports| SSH[SSH transport]
  SSH -->|loopback forward| OpenCode
  Codex -->|compaction events| Runtime
  OpenCode -->|compaction events| Runtime

Loading

_{Reviews (4) · Last reviewed commit: "fix: authenticate opencode serve and har..."}