feat(core): add command registry (#30624)

packages/server/src/api.ts

@@ -0,0 +1,39 @@
+import { HttpApi, OpenApi } from "effect/unstable/httpapi"
+import { SchemaErrorMiddleware } from "./middleware/schema-error"
+import { MessageGroup } from "./groups/v2/message"
+import { ModelGroup } from "./groups/v2/model"
+import { ProviderGroup } from "./groups/v2/provider"
+import { SessionGroup } from "./groups/v2/session"
+import { PermissionGroup, PermissionSavedGroup, SessionPermissionGroup } from "./groups/v2/permission"
+import { FileSystemGroup } from "./groups/v2/fs"
+import { CommandGroup } from "./groups/v2/command"
+import { SkillGroup } from "./groups/v2/skill"
+import { EventGroup } from "./groups/v2/event"
+import { AgentGroup } from "./groups/v2/agent"
+import { HealthGroup } from "./groups/v2/health"
+import { QuestionGroup, SessionQuestionGroup } from "./groups/v2/question"
+
+export const V2Api = HttpApi.make("v2")
+  .add(HealthGroup)
+  .add(AgentGroup)
+  .add(SessionGroup)
+  .add(MessageGroup)
+  .add(ModelGroup)
+  .add(ProviderGroup)
+  .add(PermissionGroup)
+  .add(SessionPermissionGroup)
+  .add(PermissionSavedGroup)
+  .add(FileSystemGroup)
+  .add(CommandGroup)
+  .add(SkillGroup)
+  .add(EventGroup)
+  .add(QuestionGroup)
+  .add(SessionQuestionGroup)
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "opencode experimental HttpApi",
+      version: "0.0.1",
+      description: "Experimental HttpApi surface for selected instance routes.",
+    }),
+  )
+  .middleware(SchemaErrorMiddleware)

packages/server/src/auth.ts

@@ -0,0 +1,63 @@
+export * as ServerAuth from "./auth"
+
+import { Config as EffectConfig, Context, Effect, Layer, Option, Redacted } from "effect"
+
+export type Credentials = {
+  password?: string
+  username?: string
+}
+
+export type DecodedCredentials = {
+  readonly username: string
+  readonly password: Redacted.Redacted
+}
+
+export type Info = {
+  readonly password: Option.Option<string>
+  readonly username: string
+}
+
+export class Config extends Context.Service<Config, Info>()("@opencode/ServerAuthConfig") {
+  static layer(input: Info) {
+    return Layer.succeed(this, this.of(input))
+  }
+
+  static get defaultLayer() {
+    return Layer.effect(
+      this,
+      Effect.gen(function* () {
+        return Config.of(
+          yield* EffectConfig.all({
+            password: EffectConfig.string("OPENCODE_SERVER_PASSWORD").pipe(EffectConfig.option),
+            username: EffectConfig.string("OPENCODE_SERVER_USERNAME").pipe(EffectConfig.withDefault("opencode")),
+          }),
+        )
+      }),
+    )
+  }
+}
+
+export function required(config: Info) {
+  return Option.isSome(config.password) && config.password.value !== ""
+}
+
+export function authorized(credentials: DecodedCredentials, config: Info) {
+  return (
+    Option.isSome(config.password) &&
+    credentials.username === config.username &&
+    Redacted.value(credentials.password) === config.password.value
+  )
+}
+
+export function header(credentials?: Credentials) {
+  const password = credentials?.password ?? process.env.OPENCODE_SERVER_PASSWORD
+  if (!password) return undefined
+
+  return `Basic ${Buffer.from(`${credentials?.username ?? process.env.OPENCODE_SERVER_USERNAME ?? "opencode"}:${password}`).toString("base64")}`
+}
+
+export function headers(credentials?: Credentials) {
+  const authorization = header(credentials)
+  if (!authorization) return undefined
+  return { Authorization: authorization }
+}

packages/server/src/errors.ts

@@ -0,0 +1,86 @@
+import { Schema } from "effect"
+
+export class InvalidRequestError extends Schema.TaggedErrorClass<InvalidRequestError>()(
+  "InvalidRequestError",
+  {
+    message: Schema.String,
+    kind: Schema.optional(Schema.String),
+    field: Schema.optional(Schema.String),
+  },
+  { httpApiStatus: 400 },
+) {}
+
+export class UnauthorizedError extends Schema.TaggedErrorClass<UnauthorizedError>()(
+  "UnauthorizedError",
+  { message: Schema.String },
+  { httpApiStatus: 401 },
+) {}
+
+export class ConflictError extends Schema.TaggedErrorClass<ConflictError>()(
+  "ConflictError",
+  {
+    message: Schema.String,
+    resource: Schema.optional(Schema.String),
+  },
+  { httpApiStatus: 409 },
+) {}
+
+export class ServiceUnavailableError extends Schema.TaggedErrorClass<ServiceUnavailableError>()(
+  "ServiceUnavailableError",
+  {
+    message: Schema.String,
+    service: Schema.optional(Schema.String),
+  },
+  { httpApiStatus: 503 },
+) {}
+
+export class UnknownError extends Schema.TaggedErrorClass<UnknownError>()(
+  "UnknownError",
+  {
+    message: Schema.String,
+    ref: Schema.optional(Schema.String),
+  },
+  { httpApiStatus: 500 },
+) {}
+
+export class ProviderNotFoundError extends Schema.TaggedErrorClass<ProviderNotFoundError>()(
+  "ProviderNotFoundError",
+  {
+    providerID: Schema.String,
+    message: Schema.String,
+  },
+  { httpApiStatus: 404 },
+) {}
+
+export class SessionNotFoundError extends Schema.TaggedErrorClass<SessionNotFoundError>()(
+  "SessionNotFoundError",
+  {
+    sessionID: Schema.String,
+    message: Schema.String,
+  },
+  { httpApiStatus: 404 },
+) {}
+
+export class InvalidCursorError extends Schema.TaggedErrorClass<InvalidCursorError>()(
+  "InvalidCursorError",
+  { message: Schema.String },
+  { httpApiStatus: 400 },
+) {}
+
+export class PermissionNotFoundError extends Schema.TaggedErrorClass<PermissionNotFoundError>()(
+  "PermissionNotFoundError",
+  {
+    requestID: Schema.String,
+    message: Schema.String,
+  },
+  { httpApiStatus: 404 },
+) {}
+
+export class QuestionNotFoundError extends Schema.TaggedErrorClass<QuestionNotFoundError>()(
+  "QuestionNotFoundError",
+  {
+    requestID: Schema.String,
+    message: Schema.String,
+  },
+  { httpApiStatus: 404 },
+) {}

packages/server/src/groups/v2/agent.ts

@@ -0,0 +1,24 @@
+import { AgentV2 } from "@opencode-ai/core/agent"
+import { Location } from "@opencode-ai/core/location"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+export const AgentGroup = HttpApiGroup.make("v2.agent")
+  .add(
+    HttpApiEndpoint.get("agents", "/api/agent", {
+      query: LocationQuery,
+      success: Location.response(Schema.Array(AgentV2.Info)),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.agent.list",
+          summary: "List v2 agents",
+          description: "Retrieve currently registered v2 agents.",
+        }),
+      ),
+  )
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)

packages/server/src/groups/v2/command.ts

@@ -0,0 +1,30 @@
+import { CommandV2 } from "@opencode-ai/core/command"
+import { Location } from "@opencode-ai/core/location"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+export const CommandGroup = HttpApiGroup.make("v2.command")
+  .add(
+    HttpApiEndpoint.get("commands", "/api/command", {
+      query: LocationQuery,
+      success: Location.response(Schema.Array(CommandV2.Info)),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.command.list",
+          summary: "List v2 commands",
+          description: "Retrieve currently registered v2 commands.",
+        }),
+      ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "v2 commands",
+      description: "Experimental v2 command routes.",
+    }),
+  )
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)

packages/server/src/groups/v2/event.ts

@@ -0,0 +1,36 @@
+import { EventV2 } from "@opencode-ai/core/event"
+import { Location } from "@opencode-ai/core/location"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/unstable/httpapi"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+const Event = Schema.Struct({
+  id: EventV2.ID,
+  type: Schema.String,
+  location: Location.Info.pipe(Schema.optional),
+  metadata: Schema.Record(Schema.String, Schema.Unknown).pipe(Schema.optional),
+  version: Schema.Number.pipe(Schema.optional),
+  data: Schema.Unknown,
+})
+
+export const EventGroup = HttpApiGroup.make("v2.event")
+  .add(
+    HttpApiEndpoint.get("events", "/api/event", {
+      query: LocationQuery,
+      success: Schema.String.pipe(HttpApiSchema.asText({ contentType: "text/event-stream" })),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.event.subscribe",
+          summary: "Subscribe to v2 events",
+          description: "Subscribe to native EventV2 payloads for a location.",
+        }),
+      ),
+  )
+  .annotateMerge(OpenApi.annotations({ title: "v2 events", description: "Experimental v2 event stream route." }))
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)
+
+export type Event = typeof Event.Type

packages/server/src/groups/v2/fs.ts

@@ -0,0 +1,57 @@
+import { FileSystem } from "@opencode-ai/core/filesystem"
+import { Location } from "@opencode-ai/core/location"
+import { RelativePath } from "@opencode-ai/core/schema"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+const ReadQuery = Schema.Struct({
+  ...LocationQuery.fields,
+  path: RelativePath,
+  reference: Schema.String.pipe(Schema.optional),
+})
+
+const ListQuery = Schema.Struct({
+  ...LocationQuery.fields,
+  path: RelativePath.pipe(Schema.optional),
+  reference: Schema.String.pipe(Schema.optional),
+})
+
+export const FileSystemGroup = HttpApiGroup.make("v2.fs")
+  .add(
+    HttpApiEndpoint.get("read", "/api/fs/read", {
+      query: ReadQuery,
+      success: Location.response(FileSystem.Content),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.fs.read",
+          summary: "Read file",
+          description: "Read one file relative to the requested location.",
+        }),
+      ),
+  )
+  .add(
+    HttpApiEndpoint.get("list", "/api/fs/list", {
+      query: ListQuery,
+      success: Location.response(Schema.Array(FileSystem.Entry)),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.fs.list",
+          summary: "List directory",
+          description: "List direct children of one directory relative to the requested location.",
+        }),
+      ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "v2 filesystem",
+      description: "Experimental v2 location-scoped filesystem routes.",
+    }),
+  )
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)

packages/server/src/groups/v2/health.ts

@@ -0,0 +1,17 @@
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { V2Authorization } from "../../middleware/authorization"
+
+export const HealthGroup = HttpApiGroup.make("v2.health")
+  .add(
+    HttpApiEndpoint.get("health", "/api/health", {
+      success: Schema.Struct({ healthy: Schema.Literal(true) }),
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.health.get",
+        summary: "Check v2 server health",
+        description: "Check whether the v2 API server is ready to accept requests.",
+      }),
+    ),
+  )
+  .middleware(V2Authorization)

packages/server/src/groups/v2/location.ts

@@ -0,0 +1,95 @@
+import { Catalog } from "@opencode-ai/core/catalog"
+import { AgentV2 } from "@opencode-ai/core/agent"
+import { CommandV2 } from "@opencode-ai/core/command"
+import { Location } from "@opencode-ai/core/location"
+import { LocationServiceMap } from "@opencode-ai/core/location-layer"
+import { FileSystem } from "@opencode-ai/core/filesystem"
+import { PermissionV2 } from "@opencode-ai/core/permission"
+import { ProjectReference } from "@opencode-ai/core/project-reference"
+import { SkillV2 } from "@opencode-ai/core/skill"
+import { AbsolutePath } from "@opencode-ai/core/schema"
+import { PluginBoot } from "@opencode-ai/core/plugin/boot"
+import { WorkspaceV2 } from "@opencode-ai/core/workspace"
+import { QuestionV2 } from "@opencode-ai/core/question"
+import { Effect, Layer, Schema } from "effect"
+import { HttpServerRequest } from "effect/unstable/http"
+import { HttpApiMiddleware, OpenApi } from "effect/unstable/httpapi"
+
+export const LocationQuery = Schema.Struct({
+  location: Schema.optional(
+    Schema.Struct({
+      directory: Schema.optional(Schema.String),
+      workspace: Schema.optional(Schema.String),
+    }),
+  ),
+}).annotate({ identifier: "V2LocationQuery" })
+
+export const locationQueryOpenApi = OpenApi.annotations({
+  transform: (operation) => {
+    const parameters = operation.parameters
+    if (!Array.isArray(parameters)) return operation
+    return {
+      ...operation,
+      parameters: parameters.map((parameter) =>
+        parameter?.name === "location" && parameter?.in === "query"
+          ? { ...parameter, style: "deepObject", explode: true }
+          : parameter,
+      ),
+    }
+  },
+})
+
+export function response<A, E, R>(data: Effect.Effect<A, E, R>) {
+  return Effect.gen(function* () {
+    const location = yield* Location.Service
+    return {
+      location: new Location.Info({
+        directory: location.directory,
+        workspaceID: location.workspaceID,
+        project: location.project,
+      }),
+      data: yield* data,
+    }
+  })
+}
+
+export class V2LocationMiddleware extends HttpApiMiddleware.Service<
+  V2LocationMiddleware,
+  {
+    provides:
+      | Catalog.Service
+      | AgentV2.Service
+      | CommandV2.Service
+      | Location.Service
+      | PluginBoot.Service
+      | PermissionV2.Service
+      | ProjectReference.Service
+      | FileSystem.Service
+      | SkillV2.Service
+      | QuestionV2.Service
+  }
+>()("@opencode/ExperimentalHttpApiV2Location") {}
+
+function ref(request: HttpServerRequest.HttpServerRequest): Location.Ref {
+  const query = new URL(request.url, "http://localhost").searchParams
+  const workspaceID = query.get("location[workspace]") || request.headers["x-opencode-workspace"]
+  return {
+    directory: AbsolutePath.make(
+      query.get("location[directory]") || request.headers["x-opencode-directory"] || process.cwd(),
+    ),
+    workspaceID: workspaceID ? WorkspaceV2.ID.make(workspaceID) : undefined,
+  }
+}
+
+export const layer = Layer.effect(
+  V2LocationMiddleware,
+  Effect.gen(function* () {
+    const locations = yield* LocationServiceMap
+    return V2LocationMiddleware.of((effect) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest
+        return yield* effect.pipe(Effect.provide(locations.get(ref(request))))
+      }),
+    )
+  }),
+)

packages/server/src/groups/v2/message.ts

@@ -0,0 +1,53 @@
+import { SessionV2 } from "@opencode-ai/core/session"
+import { SessionMessage } from "@opencode-ai/core/session/message"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { InvalidCursorError, SessionNotFoundError, UnknownError } from "../../errors"
+import { V2Authorization } from "../../middleware/authorization"
+
+export const MessagesQuery = Schema.Struct({
+  limit: Schema.optional(
+    Schema.NumberFromString.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(200)),
+  ).annotate({
+    description: "Maximum number of messages to return. When omitted, the endpoint returns its default page size.",
+  }),
+  order: Schema.optional(Schema.Union([Schema.Literal("asc"), Schema.Literal("desc")])).annotate({
+    description: "Message order for the first page. Use desc for newest first or asc for oldest first.",
+  }),
+  cursor: Schema.optional(
+    Schema.String.annotate({
+      description:
+        "Opaque pagination cursor returned as cursor.previous or cursor.next in the previous response. Do not combine with order.",
+    }),
+  ),
+}).annotate({ identifier: "V2SessionMessagesQuery" })
+
+export const MessageGroup = HttpApiGroup.make("v2.message")
+  .add(
+    HttpApiEndpoint.get("messages", "/api/session/:sessionID/message", {
+      params: { sessionID: SessionV2.ID },
+      query: MessagesQuery,
+      success: Schema.Struct({
+        data: Schema.Array(SessionMessage.Message),
+        cursor: Schema.Struct({
+          previous: Schema.String.pipe(Schema.optional),
+          next: Schema.String.pipe(Schema.optional),
+        }),
+      }).annotate({ identifier: "V2SessionMessagesResponse" }),
+      error: [InvalidCursorError, SessionNotFoundError, UnknownError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.messages",
+        summary: "Get v2 session messages",
+        description:
+          "Retrieve projected v2 messages for a session. Items keep the requested order across pages; use cursor.next or cursor.previous to move through the ordered timeline.",
+      }),
+    ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "v2 messages",
+      description: "Experimental v2 message routes.",
+    }),
+  )
+  .middleware(V2Authorization)

packages/server/src/groups/v2/model.ts

@@ -0,0 +1,32 @@
+import { ModelV2 } from "@opencode-ai/core/model"
+import { Location } from "@opencode-ai/core/location"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { ServiceUnavailableError } from "../../errors"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+export const ModelGroup = HttpApiGroup.make("v2.model")
+  .add(
+    HttpApiEndpoint.get("models", "/api/model", {
+      query: LocationQuery,
+      success: Location.response(Schema.Array(ModelV2.Info)),
+      error: ServiceUnavailableError,
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.model.list",
+          summary: "List v2 models",
+          description: "Retrieve available v2 models ordered by release date.",
+        }),
+      ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "v2 models",
+      description: "Experimental v2 model routes.",
+    }),
+  )
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)

packages/server/src/groups/v2/permission.ts

@@ -0,0 +1,95 @@
+import { PermissionV2 } from "@opencode-ai/core/permission"
+import { Location } from "@opencode-ai/core/location"
+import { PermissionSaved } from "@opencode-ai/core/permission/saved"
+import { ProjectV2 } from "@opencode-ai/core/project"
+import { SessionV2 } from "@opencode-ai/core/session"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/unstable/httpapi"
+import { PermissionNotFoundError, SessionNotFoundError } from "../../errors"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+export const PermissionGroup = HttpApiGroup.make("v2.permission")
+  .add(
+    HttpApiEndpoint.get("permissionRequests", "/api/permission/request", {
+      query: LocationQuery,
+      success: Location.response(Schema.Array(PermissionV2.Request)),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.permission.request.list",
+          summary: "List pending permission requests",
+          description: "Retrieve pending permission requests for a location.",
+        }),
+      ),
+  )
+  .annotateMerge(OpenApi.annotations({ title: "v2 permissions", description: "Experimental v2 permission routes." }))
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)
+
+export const SessionPermissionGroup = HttpApiGroup.make("v2.session.permission")
+  .add(
+    HttpApiEndpoint.get("sessionPermissionRequests", "/api/session/:sessionID/permission/request", {
+      params: { sessionID: SessionV2.ID },
+      success: Schema.Struct({ data: Schema.Array(PermissionV2.Request) }),
+      error: SessionNotFoundError,
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.permission.list",
+        summary: "List session permission requests",
+        description: "Retrieve pending permission requests owned by a session.",
+      }),
+    ),
+  )
+  .add(
+    HttpApiEndpoint.post("permissionRequestReply", "/api/session/:sessionID/permission/request/:requestID/reply", {
+      params: { sessionID: SessionV2.ID, requestID: PermissionV2.ID },
+      payload: Schema.Struct({
+        reply: PermissionV2.Reply,
+        message: Schema.String.pipe(Schema.optional),
+      }),
+      success: HttpApiSchema.NoContent,
+      error: [SessionNotFoundError, PermissionNotFoundError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.permission.reply",
+        summary: "Reply to pending permission request",
+        description: "Respond to a pending permission request owned by a session.",
+      }),
+    ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({ title: "v2 session permissions", description: "Experimental v2 session permission routes." }),
+  )
+  .middleware(V2Authorization)
+
+export const PermissionSavedGroup = HttpApiGroup.make("v2.permission.saved")
+  .add(
+    HttpApiEndpoint.get("savedPermissions", "/api/permission/saved", {
+      query: Schema.Struct({ projectID: ProjectV2.ID.pipe(Schema.optional) }),
+      success: Schema.Struct({ data: Schema.Array(PermissionSaved.Info) }),
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.permission.saved.list",
+        summary: "List saved permissions",
+        description: "Retrieve saved permissions, optionally filtered by project.",
+      }),
+    ),
+  )
+  .add(
+    HttpApiEndpoint.delete("removeSavedPermission", "/api/permission/saved/:id", {
+      params: { id: PermissionSaved.ID },
+      success: HttpApiSchema.NoContent,
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.permission.saved.remove",
+        summary: "Remove saved permission",
+        description: "Remove a saved permission by ID.",
+      }),
+    ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({ title: "v2 saved permissions", description: "Experimental v2 saved permission routes." }),
+  )
+  .middleware(V2Authorization)

packages/server/src/groups/v2/provider.ts

@@ -0,0 +1,49 @@
+import { ProviderV2 } from "@opencode-ai/core/provider"
+import { Location } from "@opencode-ai/core/location"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { ProviderNotFoundError, ServiceUnavailableError } from "../../errors"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+export const ProviderGroup = HttpApiGroup.make("v2.provider")
+  .add(
+    HttpApiEndpoint.get("providers", "/api/provider", {
+      query: LocationQuery,
+      success: Location.response(Schema.Array(ProviderV2.Info)),
+      error: ServiceUnavailableError,
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.provider.list",
+          summary: "List v2 providers",
+          description: "Retrieve active v2 AI providers so clients can show provider availability and configuration.",
+        }),
+      ),
+  )
+  .add(
+    HttpApiEndpoint.get("provider", "/api/provider/:providerID", {
+      params: { providerID: ProviderV2.ID },
+      query: LocationQuery,
+      success: Location.response(ProviderV2.Info),
+      error: [ProviderNotFoundError, ServiceUnavailableError],
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.provider.get",
+          summary: "Get v2 provider",
+          description:
+            "Retrieve a single v2 AI provider so clients can inspect its availability and endpoint settings.",
+        }),
+      ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "v2 providers",
+      description: "Experimental v2 provider routes.",
+    }),
+  )
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)

packages/server/src/groups/v2/question.ts

@@ -0,0 +1,60 @@
+import { QuestionV2 } from "@opencode-ai/core/question"
+import { Location } from "@opencode-ai/core/location"
+import { SessionV2 } from "@opencode-ai/core/session"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/unstable/httpapi"
+import { QuestionNotFoundError, SessionNotFoundError } from "../../errors"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+export const QuestionGroup = HttpApiGroup.make("v2.question")
+  .add(
+    HttpApiEndpoint.get("questionRequests", "/api/question/request", {
+      query: LocationQuery,
+      success: Location.response(Schema.Array(QuestionV2.Request)),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.question.request.list",
+          summary: "List pending question requests",
+          description: "Retrieve pending question requests for a location.",
+        }),
+      ),
+  )
+  .annotateMerge(OpenApi.annotations({ title: "v2 questions", description: "Experimental v2 question routes." }))
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)
+
+export const SessionQuestionGroup = HttpApiGroup.make("v2.session.question")
+  .add(
+    HttpApiEndpoint.post("questionRequestReply", "/api/session/:sessionID/question/request/:requestID/reply", {
+      params: { sessionID: SessionV2.ID, requestID: QuestionV2.ID },
+      payload: QuestionV2.Reply,
+      success: HttpApiSchema.NoContent,
+      error: [SessionNotFoundError, QuestionNotFoundError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.question.reply",
+        summary: "Reply to pending question request",
+        description: "Answer a pending question request owned by a session.",
+      }),
+    ),
+  )
+  .add(
+    HttpApiEndpoint.post("questionRequestReject", "/api/session/:sessionID/question/request/:requestID/reject", {
+      params: { sessionID: SessionV2.ID, requestID: QuestionV2.ID },
+      success: HttpApiSchema.NoContent,
+      error: [SessionNotFoundError, QuestionNotFoundError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.question.reject",
+        summary: "Reject pending question request",
+        description: "Reject a pending question request owned by a session.",
+      }),
+    ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({ title: "v2 session questions", description: "Experimental v2 session question routes." }),
+  )
+  .middleware(V2Authorization)

packages/server/src/groups/v2/session.ts

@@ -0,0 +1,172 @@
+import { SessionMessage } from "@opencode-ai/core/session/message"
+import { SessionInput } from "@opencode-ai/core/session/input"
+import { Prompt } from "@opencode-ai/core/session/prompt"
+import { SessionV2 } from "@opencode-ai/core/session"
+import { ProjectV2 } from "@opencode-ai/core/project"
+import { AbsolutePath, PositiveInt, RelativePath, withStatics } from "@opencode-ai/core/schema"
+import { WorkspaceV2 } from "@opencode-ai/core/workspace"
+import { Schema, Struct } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/unstable/httpapi"
+import {
+  ConflictError,
+  InvalidCursorError,
+  InvalidRequestError,
+  ServiceUnavailableError,
+  SessionNotFoundError,
+  UnknownError,
+} from "../../errors"
+import { V2Authorization } from "../../middleware/authorization"
+
+const SessionsQueryFields = {
+  workspace: WorkspaceV2.ID.pipe(Schema.optional),
+  limit: Schema.NumberFromString.pipe(Schema.decodeTo(PositiveInt), Schema.optional).annotate({
+    description: "Maximum number of sessions to return. Defaults to the newest 50 sessions.",
+  }),
+  order: Schema.optional(Schema.Union([Schema.Literal("asc"), Schema.Literal("desc")])).annotate({
+    description: "Session order for the first page. Use desc for newest first or asc for oldest first.",
+  }),
+  search: Schema.optional(Schema.String),
+}
+
+const SessionsDirectoryQuery = Schema.Struct({
+  ...SessionsQueryFields,
+  directory: AbsolutePath,
+})
+
+const SessionsProjectQuery = Schema.Struct({
+  ...SessionsQueryFields,
+  project: ProjectV2.ID,
+  subpath: RelativePath.pipe(Schema.optional),
+})
+
+const SessionsAllQuery = Schema.Struct(SessionsQueryFields)
+
+const withCursor = <Fields extends Schema.Struct.Fields>(schema: Schema.Struct<Fields>) =>
+  schema.mapFields((fields) => ({
+    ...Struct.omit(fields, ["limit"]),
+    anchor: SessionV2.ListAnchor,
+  }))
+
+const SessionsCursorInput = Schema.Union([
+  withCursor(SessionsDirectoryQuery),
+  withCursor(SessionsProjectQuery),
+  withCursor(SessionsAllQuery),
+])
+const SessionsCursorJson = Schema.fromJsonString(SessionsCursorInput)
+const encodeSessionsCursor = Schema.encodeSync(SessionsCursorJson)
+const decodeSessionsCursor = Schema.decodeUnknownEffect(SessionsCursorJson)
+
+export const SessionsCursor = Schema.String.pipe(
+  Schema.brand("V2SessionsCursor"),
+  withStatics((schema) => {
+    const make = schema.make
+    return {
+      make: (input: typeof SessionsCursorInput.Type) =>
+        make(Buffer.from(encodeSessionsCursor(input)).toString("base64url")),
+      parse: (input: string) => decodeSessionsCursor(Buffer.from(input, "base64url").toString("utf8")),
+    }
+  }),
+)
+export type SessionsCursor = typeof SessionsCursor.Type
+
+const SessionsCursorQuery = Schema.Struct({
+  cursor: SessionsCursor.annotate({
+    description: "Opaque pagination cursor returned as cursor.previous or cursor.next in the previous response.",
+  }),
+  limit: SessionsQueryFields.limit,
+})
+
+export const SessionsQuery = Schema.Struct({
+  ...SessionsQueryFields,
+  directory: AbsolutePath.pipe(Schema.optional),
+  project: ProjectV2.ID.pipe(Schema.optional),
+  subpath: RelativePath.pipe(Schema.optional),
+  cursor: SessionsCursorQuery.fields.cursor.pipe(Schema.optional),
+}).annotate({ identifier: "V2SessionsQuery" })
+
+export const SessionGroup = HttpApiGroup.make("v2.session")
+  .add(
+    HttpApiEndpoint.get("sessions", "/api/session", {
+      query: SessionsQuery,
+      success: Schema.Struct({
+        data: Schema.Array(SessionV2.Info),
+        cursor: Schema.Struct({
+          previous: SessionsCursor.pipe(Schema.optional),
+          next: SessionsCursor.pipe(Schema.optional),
+        }),
+      }).annotate({ identifier: "V2SessionsResponse" }),
+      error: [InvalidCursorError, InvalidRequestError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.list",
+        summary: "List v2 sessions",
+        description:
+          "Retrieve sessions in the requested order. Items keep that order across pages; use cursor.next or cursor.previous to move through the ordered list.",
+      }),
+    ),
+  )
+  .add(
+    HttpApiEndpoint.post("prompt", "/api/session/:sessionID/prompt", {
+      params: { sessionID: SessionV2.ID },
+      payload: Schema.Struct({
+        id: SessionMessage.ID.pipe(Schema.optional),
+        prompt: Prompt,
+        delivery: SessionInput.Delivery.pipe(Schema.optional),
+        resume: Schema.Boolean.pipe(Schema.optional),
+      }),
+      success: Schema.Struct({ data: SessionMessage.User }),
+      error: [ConflictError, SessionNotFoundError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.prompt",
+        summary: "Send v2 message",
+        description: "Durably admit one v2 session input and schedule agent-loop execution unless resume is false.",
+      }),
+    ),
+  )
+  .add(
+    HttpApiEndpoint.post("compact", "/api/session/:sessionID/compact", {
+      params: { sessionID: SessionV2.ID },
+      success: HttpApiSchema.NoContent,
+      error: [SessionNotFoundError, ServiceUnavailableError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.compact",
+        summary: "Compact v2 session",
+        description: "Compact a v2 session conversation.",
+      }),
+    ),
+  )
+  .add(
+    HttpApiEndpoint.post("wait", "/api/session/:sessionID/wait", {
+      params: { sessionID: SessionV2.ID },
+      success: HttpApiSchema.NoContent,
+      error: [SessionNotFoundError, ServiceUnavailableError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.wait",
+        summary: "Wait for v2 session",
+        description: "Wait for a v2 session agent loop to become idle.",
+      }),
+    ),
+  )
+  .add(
+    HttpApiEndpoint.get("context", "/api/session/:sessionID/context", {
+      params: { sessionID: SessionV2.ID },
+      success: Schema.Struct({ data: Schema.Array(SessionMessage.Message) }),
+      error: [SessionNotFoundError, UnknownError],
+    }).annotateMerge(
+      OpenApi.annotations({
+        identifier: "v2.session.context",
+        summary: "Get v2 session context",
+        description: "Retrieve the active context messages for a v2 session (all messages after the last compaction).",
+      }),
+    ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "v2",
+      description: "Experimental v2 routes.",
+    }),
+  )
+  .middleware(V2Authorization)

packages/server/src/groups/v2/skill.ts

@@ -0,0 +1,30 @@
+import { SkillV2 } from "@opencode-ai/core/skill"
+import { Location } from "@opencode-ai/core/location"
+import { Schema } from "effect"
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { V2Authorization } from "../../middleware/authorization"
+import { LocationQuery, locationQueryOpenApi, V2LocationMiddleware } from "./location"
+
+export const SkillGroup = HttpApiGroup.make("v2.skill")
+  .add(
+    HttpApiEndpoint.get("skills", "/api/skill", {
+      query: LocationQuery,
+      success: Location.response(Schema.Array(SkillV2.Info)),
+    })
+      .annotateMerge(locationQueryOpenApi)
+      .annotateMerge(
+        OpenApi.annotations({
+          identifier: "v2.skill.list",
+          summary: "List v2 skills",
+          description: "Retrieve currently registered v2 skills.",
+        }),
+      ),
+  )
+  .annotateMerge(
+    OpenApi.annotations({
+      title: "v2 skills",
+      description: "Experimental v2 skill routes.",
+    }),
+  )
+  .middleware(V2LocationMiddleware)
+  .middleware(V2Authorization)

packages/server/src/handlers.ts

@@ -0,0 +1,57 @@
+import { SessionV2 } from "@opencode-ai/core/session"
+import { LocationServiceMap } from "@opencode-ai/core/location-layer"
+import { PermissionSaved } from "@opencode-ai/core/permission/saved"
+import { Layer } from "effect"
+import { layer as v2LocationLayer } from "./groups/v2/location"
+import { messageHandlers } from "./handlers/v2/message"
+import { modelHandlers } from "./handlers/v2/model"
+import { providerHandlers } from "./handlers/v2/provider"
+import { sessionHandlers } from "./handlers/v2/session"
+import { permissionHandlers, savedPermissionHandlers, sessionPermissionHandlers } from "./handlers/v2/permission"
+import { fileSystemHandlers } from "./handlers/v2/fs"
+import { commandHandlers } from "./handlers/v2/command"
+import { skillHandlers } from "./handlers/v2/skill"
+import { eventHandlers } from "./handlers/v2/event"
+import { agentHandlers } from "./handlers/v2/agent"
+import { healthHandlers } from "./handlers/v2/health"
+import { questionHandlers, sessionQuestionHandlers } from "./handlers/v2/question"
+import { Database } from "@opencode-ai/core/database/database"
+import { EventV2 } from "@opencode-ai/core/event"
+import { ProjectV2 } from "@opencode-ai/core/project"
+import * as SessionExecutionLocal from "@opencode-ai/core/session/execution/local"
+import { SessionProjector } from "@opencode-ai/core/session/projector"
+import { SessionStore } from "@opencode-ai/core/session/store"
+
+const routedSessions = SessionV2.layer.pipe(
+  Layer.provide(SessionProjector.layer),
+  Layer.provide(SessionExecutionLocal.layer),
+  Layer.provide(LocationServiceMap.layer),
+  Layer.provide(SessionStore.layer),
+  Layer.provide(EventV2.layer),
+  Layer.provide(Database.defaultLayer),
+  Layer.provide(ProjectV2.defaultLayer),
+  Layer.orDie,
+)
+
+export const v2Handlers = Layer.mergeAll(
+  healthHandlers,
+  agentHandlers,
+  sessionHandlers,
+  messageHandlers,
+  modelHandlers,
+  providerHandlers,
+  permissionHandlers,
+  sessionPermissionHandlers,
+  savedPermissionHandlers,
+  fileSystemHandlers,
+  commandHandlers,
+  skillHandlers,
+  eventHandlers,
+  questionHandlers,
+  sessionQuestionHandlers,
+).pipe(
+  Layer.provide(v2LocationLayer),
+  Layer.provide(LocationServiceMap.layer),
+  Layer.provide(PermissionSaved.layer),
+  Layer.provide(routedSessions),
+)

packages/server/src/handlers/v2/agent.ts

@@ -0,0 +1,15 @@
+import { AgentV2 } from "@opencode-ai/core/agent"
+import { PluginBoot } from "@opencode-ai/core/plugin/boot"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { response } from "../../groups/v2/location"
+
+export const agentHandlers = HttpApiBuilder.group(V2Api, "v2.agent", (handlers) =>
+  handlers.handle("agents", () =>
+    Effect.gen(function* () {
+      yield* PluginBoot.Service.use((plugin) => plugin.wait())
+      return yield* response(AgentV2.Service.use((agent) => agent.all()))
+    }),
+  ),
+)

packages/server/src/handlers/v2/command.ts

@@ -0,0 +1,9 @@
+import { CommandV2 } from "@opencode-ai/core/command"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { response } from "../../groups/v2/location"
+
+export const commandHandlers = HttpApiBuilder.group(V2Api, "v2.command", (handlers) =>
+  handlers.handle("commands", () => response(CommandV2.Service.use((command) => command.list()))),
+)

packages/server/src/handlers/v2/event.ts

@@ -0,0 +1,61 @@
+import { EventV2 } from "@opencode-ai/core/event"
+import { Location } from "@opencode-ai/core/location"
+import { Effect, Stream } from "effect"
+import { HttpServerResponse } from "effect/unstable/http"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import * as Sse from "effect/unstable/encoding/Sse"
+import { V2Api } from "../../api"
+
+function eventData(data: unknown): Sse.Event {
+  return {
+    _tag: "Event",
+    event: "message",
+    id: undefined,
+    data: JSON.stringify(data),
+  }
+}
+
+export const eventHandlers = HttpApiBuilder.group(V2Api, "v2.event", (handlers) =>
+  Effect.gen(function* () {
+    const events = yield* EventV2.Service
+    return handlers.handleRaw("events", () =>
+      Effect.gen(function* () {
+        const location = yield* Location.Service
+        const connected = {
+          id: EventV2.ID.create(),
+          type: "server.connected",
+          location: new Location.Info({
+            directory: location.directory,
+            workspaceID: location.workspaceID,
+            project: location.project,
+          }),
+          data: {},
+        }
+        return HttpServerResponse.stream(
+          Stream.make(connected).pipe(
+            Stream.concat(
+              events.all().pipe(
+                Stream.filter(
+                  (event) =>
+                    event.location?.directory === location.directory &&
+                    event.location.workspaceID === location.workspaceID,
+                ),
+              ),
+            ),
+            Stream.map(eventData),
+            Stream.pipeThroughChannel(Sse.encode()),
+            Stream.encodeText,
+          ),
+          {
+            contentType: "text/event-stream",
+            headers: {
+              "Cache-Control": "no-cache, no-transform",
+              "X-Accel-Buffering": "no",
+              "X-Content-Type-Options": "nosniff",
+            },
+          },
+        )
+      }),
+    )
+  }),
+)

packages/server/src/handlers/v2/fs.ts

@@ -0,0 +1,13 @@
+import { FileSystem } from "@opencode-ai/core/filesystem"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { response } from "../../groups/v2/location"
+
+export const fileSystemHandlers = HttpApiBuilder.group(V2Api, "v2.fs", (handlers) =>
+  Effect.gen(function* () {
+    return handlers
+      .handle("read", (ctx) => response(FileSystem.Service.use((fs) => fs.read(ctx.query))))
+      .handle("list", (ctx) => response(FileSystem.Service.use((fs) => fs.list(ctx.query))))
+  }),
+)

packages/server/src/handlers/v2/health.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+
+export const healthHandlers = HttpApiBuilder.group(V2Api, "v2.health", (handlers) =>
+  handlers.handle("health", () => Effect.succeed({ healthy: true as const })),
+)

packages/server/src/handlers/v2/message.ts

@@ -0,0 +1,84 @@
+import { SessionMessage } from "@opencode-ai/core/session/message"
+import { SessionV2 } from "@opencode-ai/core/session"
+import { Effect, Schema } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { InvalidCursorError, SessionNotFoundError, UnknownError } from "../../errors"
+
+const DefaultMessagesLimit = 50
+
+const Cursor = Schema.Struct({
+  id: SessionMessage.ID,
+  order: Schema.Union([Schema.Literal("asc"), Schema.Literal("desc")]),
+  direction: Schema.Union([Schema.Literal("previous"), Schema.Literal("next")]),
+})
+
+const decodeCursor = Schema.decodeUnknownSync(Cursor)
+
+const cursor = {
+  encode(message: SessionMessage.Message, order: "asc" | "desc", direction: "previous" | "next") {
+    return Buffer.from(JSON.stringify({ id: message.id, order, direction })).toString("base64url")
+  },
+  decode(input: string) {
+    return decodeCursor(JSON.parse(Buffer.from(input, "base64url").toString("utf8")))
+  },
+}
+
+export const messageHandlers = HttpApiBuilder.group(V2Api, "v2.message", (handlers) =>
+  Effect.gen(function* () {
+    const session = yield* SessionV2.Service
+
+    return handlers.handle(
+      "messages",
+      Effect.fn(function* (ctx) {
+        if (ctx.query.cursor && ctx.query.order !== undefined)
+          return yield* new InvalidCursorError({ message: "Cursor cannot be combined with order" })
+        const decoded = yield* Effect.try({
+          try: () => (ctx.query.cursor ? cursor.decode(ctx.query.cursor) : undefined),
+          catch: () => new InvalidCursorError({ message: "Invalid cursor" }),
+        })
+        const order = decoded?.order ?? ctx.query.order ?? "desc"
+        const messages = yield* session
+          .messages({
+            sessionID: ctx.params.sessionID,
+            limit: ctx.query.limit ?? DefaultMessagesLimit,
+            order,
+            cursor: decoded ? { id: decoded.id, direction: decoded.direction } : undefined,
+          })
+          .pipe(
+            Effect.catchTag("Session.NotFoundError", (error) =>
+              Effect.fail(
+                new SessionNotFoundError({
+                  sessionID: error.sessionID,
+                  message: `Session not found: ${error.sessionID}`,
+                }),
+              ),
+            ),
+            Effect.catchTag("Session.MessageDecodeError", (error) => {
+              const ref = `err_${crypto.randomUUID().slice(0, 8)}`
+              return Effect.logError("failed to decode v2 session message").pipe(
+                Effect.annotateLogs({ ref, sessionID: error.sessionID, messageID: error.messageID }),
+                Effect.andThen(
+                  Effect.fail(
+                    new UnknownError({
+                      message: "Unexpected server error. Check server logs for details.",
+                      ref,
+                    }),
+                  ),
+                ),
+              )
+            }),
+          )
+        const first = messages[0]
+        const last = messages.at(-1)
+        return {
+          data: messages,
+          cursor: {
+            previous: first ? cursor.encode(first, order, "previous") : undefined,
+            next: last ? cursor.encode(last, order, "next") : undefined,
+          },
+        }
+      }),
+    )
+  }),
+)

packages/server/src/handlers/v2/model.ts

@@ -0,0 +1,26 @@
+import { Catalog } from "@opencode-ai/core/catalog"
+import { PluginBoot } from "@opencode-ai/core/plugin/boot"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { ServiceUnavailableError } from "../../errors"
+import { response } from "../../groups/v2/location"
+
+const catalogUnavailable = new ServiceUnavailableError({
+  message: "Model catalog is unavailable",
+  service: "catalog",
+})
+
+export const modelHandlers = HttpApiBuilder.group(V2Api, "v2.model", (handlers) =>
+  Effect.gen(function* () {
+    return handlers.handle(
+      "models",
+      Effect.fn(function* () {
+        const catalog = yield* Catalog.Service
+        const pluginBoot = yield* PluginBoot.Service
+        yield* pluginBoot.wait().pipe(Effect.catchDefect(() => Effect.fail(catalogUnavailable)))
+        return yield* response(catalog.model.available())
+      }),
+    )
+  }),
+)

packages/server/src/handlers/v2/permission.ts

@@ -0,0 +1,106 @@
+import { Database } from "@opencode-ai/core/database/database"
+import { LocationServiceMap } from "@opencode-ai/core/location-layer"
+import { PermissionV2 } from "@opencode-ai/core/permission"
+import { PermissionSaved } from "@opencode-ai/core/permission/saved"
+import { AbsolutePath } from "@opencode-ai/core/schema"
+import { SessionTable } from "@opencode-ai/core/session/sql"
+import { eq } from "drizzle-orm"
+import { Effect } from "effect"
+import { HttpApiBuilder, HttpApiSchema } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { PermissionNotFoundError, SessionNotFoundError } from "../../errors"
+import { response } from "../../groups/v2/location"
+
+function missingRequest(id: PermissionV2.ID) {
+  return new PermissionNotFoundError({ requestID: id, message: `Permission request not found: ${id}` })
+}
+
+export const permissionHandlers = HttpApiBuilder.group(V2Api, "v2.permission", (handlers) =>
+  Effect.gen(function* () {
+    return handlers.handle(
+      "permissionRequests",
+      Effect.fn(function* () {
+        return yield* response((yield* PermissionV2.Service).list())
+      }),
+    )
+  }),
+)
+
+export const sessionPermissionHandlers = HttpApiBuilder.group(V2Api, "v2.session.permission", (handlers) =>
+  Effect.gen(function* () {
+    const { db } = yield* Database.Service
+    const locations = yield* LocationServiceMap
+
+    const withSessionPermission = Effect.fnUntraced(function* <A, E>(
+      sessionID: Parameters<PermissionV2.Interface["forSession"]>[0],
+      use: (permission: PermissionV2.Interface) => Effect.Effect<A, E>,
+    ) {
+      const row = yield* db
+        .select({ directory: SessionTable.directory, workspaceID: SessionTable.workspace_id })
+        .from(SessionTable)
+        .where(eq(SessionTable.id, sessionID))
+        .get()
+        .pipe(Effect.orDie)
+      if (!row)
+        return yield* new SessionNotFoundError({
+          sessionID,
+          message: `Session not found: ${sessionID}`,
+        })
+
+      return yield* Effect.gen(function* () {
+        return yield* use(yield* PermissionV2.Service)
+      }).pipe(
+        Effect.scoped,
+        Effect.provide(
+          locations.get({ directory: AbsolutePath.make(row.directory), workspaceID: row.workspaceID ?? undefined }),
+        ),
+      )
+    })
+
+    return handlers
+      .handle(
+        "sessionPermissionRequests",
+        Effect.fn(function* (ctx) {
+          return yield* withSessionPermission(ctx.params.sessionID, (permission) =>
+            permission.forSession(ctx.params.sessionID).pipe(Effect.map((data) => ({ data }))),
+          )
+        }),
+      )
+      .handle(
+        "permissionRequestReply",
+        Effect.fn(function* (ctx) {
+          yield* withSessionPermission(ctx.params.sessionID, (permission) =>
+            Effect.gen(function* () {
+              const request = yield* permission.get(ctx.params.requestID)
+              if (!request || request.sessionID !== ctx.params.sessionID)
+                return yield* missingRequest(ctx.params.requestID)
+              yield* permission
+                .reply({ requestID: ctx.params.requestID, reply: ctx.payload.reply, message: ctx.payload.message })
+                .pipe(Effect.catchTag("PermissionV2.NotFoundError", () => missingRequest(ctx.params.requestID)))
+            }),
+          )
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+  }),
+)
+
+export const savedPermissionHandlers = HttpApiBuilder.group(V2Api, "v2.permission.saved", (handlers) =>
+  Effect.gen(function* () {
+    const saved = yield* PermissionSaved.Service
+    return handlers
+      .handle(
+        "savedPermissions",
+        Effect.fn(function* (ctx) {
+          return { data: yield* saved.list({ projectID: ctx.query.projectID }) }
+        }),
+      )
+      .handle(
+        "removeSavedPermission",
+        Effect.fn(function* (ctx) {
+          yield* saved.remove(ctx.params.id)
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+  }),
+)

packages/server/src/handlers/v2/provider.ts

@@ -0,0 +1,46 @@
+import { Catalog } from "@opencode-ai/core/catalog"
+import { PluginBoot } from "@opencode-ai/core/plugin/boot"
+import { ProviderV2 } from "@opencode-ai/core/provider"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { ProviderNotFoundError, ServiceUnavailableError } from "../../errors"
+import { response } from "../../groups/v2/location"
+
+const catalogUnavailable = new ServiceUnavailableError({
+  message: "Provider catalog is unavailable",
+  service: "catalog",
+})
+
+export const providerHandlers = HttpApiBuilder.group(V2Api, "v2.provider", (handlers) =>
+  Effect.gen(function* () {
+    return handlers
+      .handle(
+        "providers",
+        Effect.fn(function* () {
+          const catalog = yield* Catalog.Service
+          const pluginBoot = yield* PluginBoot.Service
+          yield* pluginBoot.wait().pipe(Effect.catchDefect(() => Effect.fail(catalogUnavailable)))
+          return yield* response(catalog.provider.available())
+        }),
+      )
+      .handle(
+        "provider",
+        Effect.fn(function* (ctx) {
+          const catalog = yield* Catalog.Service
+          const pluginBoot = yield* PluginBoot.Service
+          yield* pluginBoot.wait().pipe(Effect.catchDefect(() => Effect.fail(catalogUnavailable)))
+          return yield* response(catalog.provider.get(ctx.params.providerID)).pipe(
+            Effect.catchTag("CatalogV2.ProviderNotFound", (error) =>
+              Effect.fail(
+                new ProviderNotFoundError({
+                  providerID: error.providerID,
+                  message: `Provider not found: ${error.providerID}`,
+                }),
+              ),
+            ),
+          )
+        }),
+      )
+  }),
+)

packages/server/src/handlers/v2/question.ts

@@ -0,0 +1,97 @@
+import { Database } from "@opencode-ai/core/database/database"
+import { LocationServiceMap } from "@opencode-ai/core/location-layer"
+import { QuestionV2 } from "@opencode-ai/core/question"
+import { AbsolutePath } from "@opencode-ai/core/schema"
+import { SessionTable } from "@opencode-ai/core/session/sql"
+import { eq } from "drizzle-orm"
+import { Effect } from "effect"
+import { HttpApiBuilder, HttpApiSchema } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { QuestionNotFoundError, SessionNotFoundError } from "../../errors"
+import { response } from "../../groups/v2/location"
+
+function missingRequest(id: QuestionV2.ID) {
+  return new QuestionNotFoundError({ requestID: id, message: `Question request not found: ${id}` })
+}
+
+export const questionHandlers = HttpApiBuilder.group(V2Api, "v2.question", (handlers) =>
+  Effect.gen(function* () {
+    return handlers.handle(
+      "questionRequests",
+      Effect.fn(function* () {
+        return yield* response((yield* QuestionV2.Service).list())
+      }),
+    )
+  }),
+)
+
+export const sessionQuestionHandlers = HttpApiBuilder.group(V2Api, "v2.session.question", (handlers) =>
+  Effect.gen(function* () {
+    const { db } = yield* Database.Service
+    const locations = yield* LocationServiceMap
+
+    const withSessionQuestion = Effect.fnUntraced(function* <A, E>(
+      sessionID: QuestionV2.Request["sessionID"],
+      use: (question: QuestionV2.Interface) => Effect.Effect<A, E>,
+    ) {
+      const row = yield* db
+        .select({ directory: SessionTable.directory, workspaceID: SessionTable.workspace_id })
+        .from(SessionTable)
+        .where(eq(SessionTable.id, sessionID))
+        .get()
+        .pipe(Effect.orDie)
+      if (!row)
+        return yield* new SessionNotFoundError({
+          sessionID,
+          message: `Session not found: ${sessionID}`,
+        })
+
+      return yield* Effect.gen(function* () {
+        return yield* use(yield* QuestionV2.Service)
+      }).pipe(
+        Effect.scoped,
+        Effect.provide(
+          locations.get({ directory: AbsolutePath.make(row.directory), workspaceID: row.workspaceID ?? undefined }),
+        ),
+      )
+    })
+
+    const withOwnedQuestion = Effect.fnUntraced(function* <A, E>(
+      sessionID: QuestionV2.Request["sessionID"],
+      requestID: QuestionV2.ID,
+      use: (question: QuestionV2.Interface) => Effect.Effect<A, E>,
+    ) {
+      return yield* withSessionQuestion(sessionID, (question) =>
+        Effect.gen(function* () {
+          const request = (yield* question.list()).find((request) => request.id === requestID)
+          if (!request || request.sessionID !== sessionID) return yield* missingRequest(requestID)
+          return yield* use(question)
+        }),
+      )
+    })
+
+    return handlers
+      .handle(
+        "questionRequestReply",
+        Effect.fn(function* (ctx) {
+          yield* withOwnedQuestion(ctx.params.sessionID, ctx.params.requestID, (question) =>
+            question
+              .reply({ requestID: ctx.params.requestID, answers: ctx.payload.answers })
+              .pipe(Effect.catchTag("QuestionV2.NotFoundError", () => missingRequest(ctx.params.requestID))),
+          )
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+      .handle(
+        "questionRequestReject",
+        Effect.fn(function* (ctx) {
+          yield* withOwnedQuestion(ctx.params.sessionID, ctx.params.requestID, (question) =>
+            question
+              .reject(ctx.params.requestID)
+              .pipe(Effect.catchTag("QuestionV2.NotFoundError", () => missingRequest(ctx.params.requestID))),
+          )
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+  }),
+)

packages/server/src/handlers/v2/session.ts

@@ -0,0 +1,177 @@
+import { SessionV2 } from "@opencode-ai/core/session"
+import { DateTime, Effect } from "effect"
+import { HttpApiBuilder, HttpApiSchema } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { SessionsCursor } from "../../groups/v2/session"
+import {
+  ConflictError,
+  InvalidCursorError,
+  ServiceUnavailableError,
+  SessionNotFoundError,
+  UnknownError,
+} from "../../errors"
+
+const DefaultSessionsLimit = 50
+
+export const sessionHandlers = HttpApiBuilder.group(V2Api, "v2.session", (handlers) =>
+  Effect.gen(function* () {
+    const session = yield* SessionV2.Service
+
+    return handlers
+      .handle(
+        "sessions",
+        Effect.fn(function* (ctx) {
+          const query =
+            ctx.query.cursor !== undefined
+              ? yield* SessionsCursor.parse(ctx.query.cursor).pipe(
+                  Effect.mapError(() => new InvalidCursorError({ message: "Invalid cursor" })),
+                )
+              : ctx.query
+          const sessions = yield* session.list({
+            ...query,
+            workspaceID: query.workspace,
+            limit: ctx.query.limit ?? DefaultSessionsLimit,
+          })
+          const first = sessions[0]
+          const last = sessions.at(-1)
+          return {
+            data: sessions,
+            cursor: {
+              previous: first
+                ? SessionsCursor.make({
+                    ...query,
+                    anchor: {
+                      id: first.id,
+                      time: DateTime.toEpochMillis(first.time.created),
+                      direction: "previous",
+                    },
+                  })
+                : undefined,
+              next: last
+                ? SessionsCursor.make({
+                    ...query,
+                    anchor: {
+                      id: last.id,
+                      time: DateTime.toEpochMillis(last.time.created),
+                      direction: "next",
+                    },
+                  })
+                : undefined,
+            },
+          }
+        }),
+      )
+      .handle(
+        "prompt",
+        Effect.fn(function* (ctx) {
+          return {
+            data: yield* session
+              .prompt({
+                sessionID: ctx.params.sessionID,
+                id: ctx.payload.id,
+                prompt: ctx.payload.prompt,
+                delivery: ctx.payload.delivery,
+                resume: ctx.payload.resume,
+              })
+              .pipe(
+                Effect.catchTag("Session.NotFoundError", (error) =>
+                  Effect.fail(
+                    new SessionNotFoundError({
+                      sessionID: error.sessionID,
+                      message: `Session not found: ${error.sessionID}`,
+                    }),
+                  ),
+                ),
+                Effect.catchTag("Session.PromptConflictError", (error) =>
+                  Effect.fail(
+                    new ConflictError({
+                      message: `Prompt message ID conflicts with an existing durable record: ${error.messageID}`,
+                      resource: error.messageID,
+                    }),
+                  ),
+                ),
+              ),
+          }
+        }),
+      )
+      .handle(
+        "compact",
+        Effect.fn(function* (ctx) {
+          yield* session.compact({ sessionID: ctx.params.sessionID }).pipe(
+            Effect.catchTag("Session.NotFoundError", (error) =>
+              Effect.fail(
+                new SessionNotFoundError({
+                  sessionID: error.sessionID,
+                  message: `Session not found: ${error.sessionID}`,
+                }),
+              ),
+            ),
+            Effect.catchTag("Session.OperationUnavailableError", (error) =>
+              Effect.fail(
+                new ServiceUnavailableError({
+                  message: `V2 session ${error.operation} is not available yet`,
+                  service: `v2.session.${error.operation}`,
+                }),
+              ),
+            ),
+          )
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+      .handle(
+        "wait",
+        Effect.fn(function* (ctx) {
+          yield* session.wait(ctx.params.sessionID).pipe(
+            Effect.catchTag("Session.NotFoundError", (error) =>
+              Effect.fail(
+                new SessionNotFoundError({
+                  sessionID: error.sessionID,
+                  message: `Session not found: ${error.sessionID}`,
+                }),
+              ),
+            ),
+            Effect.catchTag("Session.OperationUnavailableError", (error) =>
+              Effect.fail(
+                new ServiceUnavailableError({
+                  message: `V2 session ${error.operation} is not available yet`,
+                  service: `v2.session.${error.operation}`,
+                }),
+              ),
+            ),
+          )
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+      .handle(
+        "context",
+        Effect.fn(function* (ctx) {
+          return {
+            data: yield* session.context(ctx.params.sessionID).pipe(
+              Effect.catchTag("Session.NotFoundError", (error) =>
+                Effect.fail(
+                  new SessionNotFoundError({
+                    sessionID: error.sessionID,
+                    message: `Session not found: ${error.sessionID}`,
+                  }),
+                ),
+              ),
+              Effect.catchTag("Session.MessageDecodeError", (error) => {
+                const ref = `err_${crypto.randomUUID().slice(0, 8)}`
+                return Effect.logError("failed to decode v2 session message").pipe(
+                  Effect.annotateLogs({ ref, sessionID: error.sessionID, messageID: error.messageID }),
+                  Effect.andThen(
+                    Effect.fail(
+                      new UnknownError({
+                        message: "Unexpected server error. Check server logs for details.",
+                        ref,
+                      }),
+                    ),
+                  ),
+                )
+              }),
+            ),
+          }
+        }),
+      )
+  }),
+)

packages/server/src/handlers/v2/skill.ts

@@ -0,0 +1,8 @@
+import { SkillV2 } from "@opencode-ai/core/skill"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { V2Api } from "../../api"
+import { response } from "../../groups/v2/location"
+
+export const skillHandlers = HttpApiBuilder.group(V2Api, "v2.skill", (handlers) =>
+  handlers.handle("skills", () => response(SkillV2.Service.use((skill) => skill.list()))),
+)

packages/server/src/middleware/authorization.ts

@@ -0,0 +1,60 @@
+import { ServerAuth } from "../auth"
+import { UnauthorizedError } from "../errors"
+import { Effect, Encoding, Layer, Redacted } from "effect"
+import { HttpEffect, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { HttpApiMiddleware } from "effect/unstable/httpapi"
+
+const AUTH_TOKEN_QUERY = "auth_token"
+const WWW_AUTHENTICATE = 'Basic realm="Secure Area"'
+
+export class V2Authorization extends HttpApiMiddleware.Service<V2Authorization>()(
+  "@opencode/ExperimentalHttpApiV2Authorization",
+  {
+    error: UnauthorizedError,
+  },
+) {}
+
+function emptyCredential() {
+  return { username: "", password: Redacted.make("") }
+}
+
+function decodeCredential(input: string) {
+  return Effect.fromResult(Encoding.decodeBase64String(input)).pipe(
+    Effect.match({
+      onFailure: emptyCredential,
+      onSuccess: (header) => {
+        const separator = header.indexOf(":")
+        if (separator === -1) return emptyCredential()
+        return { username: header.slice(0, separator), password: Redacted.make(header.slice(separator + 1)) }
+      },
+    }),
+  )
+}
+
+function credentialFromRequest(request: HttpServerRequest.HttpServerRequest) {
+  const url = new URL(request.url, "http://localhost")
+  const token = url.searchParams.get(AUTH_TOKEN_QUERY)
+  if (token) return decodeCredential(token)
+  const match = /^Basic\s+(.+)$/i.exec(request.headers.authorization ?? "")
+  if (match) return decodeCredential(match[1])
+  return Effect.succeed(emptyCredential())
+}
+
+export const v2AuthorizationLayer = Layer.effect(
+  V2Authorization,
+  Effect.gen(function* () {
+    const config = yield* ServerAuth.Config
+    if (!ServerAuth.required(config)) return V2Authorization.of((effect) => effect)
+    return V2Authorization.of((effect) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest
+        const credential = yield* credentialFromRequest(request)
+        if (ServerAuth.authorized(credential, config)) return yield* effect
+        yield* HttpEffect.appendPreResponseHandler((_request, response) =>
+          Effect.succeed(HttpServerResponse.setHeader(response, "www-authenticate", WWW_AUTHENTICATE)),
+        )
+        return yield* new UnauthorizedError({ message: "Authentication required" })
+      }),
+    )
+  }),
+)

packages/server/src/middleware/schema-error.ts

@@ -0,0 +1,23 @@
+import * as Log from "@opencode-ai/core/util/log"
+import { Effect } from "effect"
+import { HttpApiMiddleware } from "effect/unstable/httpapi"
+import { InvalidRequestError } from "../errors"
+
+const log = Log.create({ service: "server" })
+const REASON_LIMIT = 1024
+
+function truncateReason(reason: string) {
+  if (reason.length <= REASON_LIMIT) return reason
+  return reason.slice(0, REASON_LIMIT) + `... (${reason.length - REASON_LIMIT} more chars)`
+}
+
+export class SchemaErrorMiddleware extends HttpApiMiddleware.Service<SchemaErrorMiddleware>()(
+  "@opencode/HttpApiSchemaError",
+  { error: InvalidRequestError },
+) {}
+
+export const schemaErrorLayer = HttpApiMiddleware.layerSchemaErrorTransform(SchemaErrorMiddleware, (error) => {
+  const reason = truncateReason(error.cause.message)
+  log.warn("schema rejection", { kind: error.kind, reason })
+  return Effect.fail(new InvalidRequestError({ message: reason, kind: error.kind }))
+})

packages/server/src/routes.ts

@@ -0,0 +1,36 @@
+import { Database } from "@opencode-ai/core/database/database"
+import { EventV2 } from "@opencode-ai/core/event"
+import { LocationServiceMap } from "@opencode-ai/core/location-layer"
+import { PermissionSaved } from "@opencode-ai/core/permission/saved"
+import { SessionV2 } from "@opencode-ai/core/session"
+import { FetchHttpClient, HttpRouter, HttpServer } from "effect/unstable/http"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { Layer, Option } from "effect"
+import { V2Api } from "./api"
+import { ServerAuth } from "./auth"
+import { v2Handlers } from "./handlers"
+import { v2AuthorizationLayer } from "./middleware/authorization"
+import { schemaErrorLayer } from "./middleware/schema-error"
+
+export function createRoutes(password?: string) {
+  return HttpApiBuilder.layer(V2Api).pipe(
+  Layer.provide(v2Handlers),
+  Layer.provide(v2AuthorizationLayer),
+  Layer.provide(schemaErrorLayer),
+  Layer.provide(
+    password
+      ? ServerAuth.Config.layer({ username: "opencode", password: Option.some(password) })
+      : ServerAuth.Config.defaultLayer,
+  ),
+  Layer.provide(LocationServiceMap.layer),
+  Layer.provide(PermissionSaved.layer),
+  Layer.provide(SessionV2.defaultLayer),
+  Layer.provide(Database.defaultLayer),
+  Layer.provide(EventV2.defaultLayer),
+  Layer.provide(FetchHttpClient.layer),
+  )
+}
+
+export const routes = createRoutes()
+
+export const webHandler = () => HttpRouter.toWebHandler(routes.pipe(Layer.provide(HttpServer.layerServices)), { disableLogger: true })