fix: address review findings across telemetry, consent, branding, and quantum

Telemetry (integration.ts, collector.ts, index.ts):
- Remove process.once SIGTERM/beforeExit handlers that crash outside
  Instance context; rely on Instance.state disposal for flush
- Move recordedUserMessages to TelemetryState (cleared per session)
  to prevent unbounded Set growth across sessions
- Remove dead assistantToUser map and dead PartUpdated text branch
- Use info.parentID for turn start time lookup instead of fragile
  insertion-order heuristic on turnStartTimes map
- Fix exported finalizeTurn() to actually call collector.finalizeTurn()
- Cache consentTier/dataLevel from initialize() to avoid redundant
  getConsentStatus() call in startSession()
- Remove duplicate retry/recordRetry export from Telemetry namespace

Consent dialog (dialog-telemetry-consent.tsx, app.tsx):
- Use DialogTelemetryConsent.show() API instead of raw dialog.replace()
  to properly wire onResult and onClose callbacks
- Default tier to 'paid' (genuine opt-out) until actual tier detection
  is implemented; 'free' forced all users into required telemetry
- Add double-fire guard on handleSelect to prevent duplicate KV writes
- Fix Esc handler: free tier forces accept, paid tier declines
- Fix unsafe 'as boolean' cast on KV value with === true check
- Add consentShown guard to prevent re-show on rebootstrap cycles
- Remove unnecessary spread in <For> component

Branding (apply.ts, schema.ts, brand.json):
- Rewrite non-exclusive models.ts get() replacement to use actual
  upstream scope variables (filepath, Bun.file, data macro, refresh)
  instead of nonexistent readCache/writeCache/url
- Add match-failure assertions to all regex transforms so upstream
  refactors produce loud build errors instead of silent failures
- Remove unused 'default' field from ModelsSchema and brand.json

Quantum (client.ts, tools.ts):
- Add Zod schemas for QuantumDevice, QuantumJob, JobResult with
  runtime .parse() validation on all API responses
- Add pricingAvailable flag to CostEstimate; warn when pricing is
  unavailable instead of silently returning 0
- Add ctx.ask() permission gate to quantum_cancel_job (destructive op)
- Thread ctx.abort signal through all tool execute -> client calls
- Add 30s default timeout via AbortSignal.timeout on all fetch calls
- Cache resolveAuth() result for 5s to avoid repeated disk reads
- Truncate error response bodies to 500 chars
- Normalize job status with .toUpperCase() for consistent comparison
- Wrap getResult() in try/catch for TOCTOU race after status check
- Fix pricing display from '$' prefix to 'credits' suffix

Author: Kenny-Heitritter

branding/apply.ts

@@ -363,50 +363,63 @@ const PURPLE = RGBA.fromHex("#9370DB")`,
 
       if (config.models.exclusive) {
         // Exclusive mode: only branded models, no models.dev fetch
-        return content.replace(
+        const result = content.replace(
           /export async function get\(\) \{[\s\S]*?\n  \}/,
           `export async function get() {
     // Branding: embedded models (exclusive mode, no external fetch)
     return ${JSON.stringify(modelsJson)} as Record<string, Provider>
   }`,
         )
+        if (result === content) {
+          throw new Error("models.ts branding transform failed: get() regex did not match (exclusive mode)")
+        }
+        return result
       }
 
       // Default mode: prepend branded models, then merge models.dev data
       // This ensures qBraid models appear first and are the defaults,
       // while all upstream providers (Anthropic, OpenAI, Copilot, Codex, etc.)
       // remain available.
+      //
+      // The replacement body references variables from the original models.ts scope:
+      //   - filepath (const, path to cache file)
+      //   - data (Bun macro import for bundled snapshot)
+      //   - refresh() (background fetch to update cache)
       const brandedModelsStr = JSON.stringify(modelsJson)
-      return content.replace(
+      const result = content.replace(
         /export async function get\(\) \{[\s\S]*?\n  \}/,
         `export async function get() {
     // Branding: qBraid models prepended as defaults
     const branded = ${brandedModelsStr} as Record<string, Provider>
 
-    // Fetch upstream models from models.dev (or cache)
+    // Kick off background cache refresh
+    refresh()
+
+    // Try cached models first, then macro bundle, then live fetch
     let upstream: Record<string, Provider> = {}
     try {
-      const cached = await readCache()
+      const file = Bun.file(filepath)
+      const cached = await file.json().catch(() => undefined)
       if (cached) {
-        upstream = cached
+        upstream = cached as Record<string, Provider>
+      } else if (typeof data === "function") {
+        upstream = JSON.parse(await data()) as Record<string, Provider>
       } else {
-        const response = await fetch(url)
-        if (response.ok) {
-          upstream = await response.json() as Record<string, Provider>
-          await writeCache(upstream)
-        }
+        const json = await fetch("https://models.dev/api.json").then((x) => x.text())
+        upstream = JSON.parse(json) as Record<string, Provider>
       }
-    } catch (e) {
-      // Fall back to bundled snapshot if fetch fails
-      try {
-        upstream = (await import("./models-snapshot")).default as Record<string, Provider>
-      } catch {}
+    } catch {
+      // All upstream sources failed — branded models only
     }
 
-    // Merge: branded providers first, then upstream (branded wins on conflict)
+    // Merge: branded providers win on conflict
     return { ...upstream, ...branded }
   }`,
       )
+      if (result === content) {
+        throw new Error("models.ts branding transform failed: get() regex did not match. Has the upstream function signature changed?")
+      }
+      return result
     },
   },
 
@@ -431,10 +444,14 @@ const PURPLE = RGBA.fromHex("#9370DB")`,
     transform: (content, config) => {
       if (!config.models?.exclusive) return content
 
-      return content.replace(
+      const result = content.replace(
         /const BUILTIN = \["[^"]*"(?:,\s*"[^"]*")*\]/,
         "const BUILTIN: string[] = [] // Cleared by branding - no external plugins",
       )
+      if (result === content) {
+        throw new Error("plugin/index.ts branding transform failed: BUILTIN regex did not match")
+      }
+      return result
     },
   },
 
@@ -446,12 +463,16 @@ const PURPLE = RGBA.fromHex("#9370DB")`,
     transform: (content, config) => {
       if (!config.models?.exclusive) return content
 
-      return content.replace(
+      const result = content.replace(
         /const CUSTOM_LOADERS: Record<string, CustomLoader> = \{[\s\S]*?\n  \}(?=\n\n  export const Model)/,
         `const CUSTOM_LOADERS: Record<string, CustomLoader> = {
     // All custom loaders removed by branding (exclusive mode)
   }`,
       )
+      if (result === content) {
+        throw new Error("provider.ts branding transform failed: CUSTOM_LOADERS regex did not match")
+      }
+      return result
     },
   },
 

branding/qbraid/brand.json

@@ -29,7 +29,6 @@
     }
   },
   "models": {
-    "default": true,
     "exclusive": false,
     "removeProviders": ["opencode"],
     "source": "./models.json"

branding/schema.ts

@@ -45,10 +45,9 @@ export const ModelsSchema = z.object({
     .optional(),
   /** Provider IDs to completely remove */
   removeProviders: z.array(z.string()).optional(),
-  /** If true, only use the providers defined in this config (locks out all others) */
+  /** If true, only use the providers defined in this config (locks out all others).
+   *  When false/unset, branded models are prepended as defaults but upstream providers remain available. */
   exclusive: z.boolean().optional(),
-  /** If true, branded models are prepended as defaults but upstream providers remain available */
-  default: z.boolean().optional(),
 })
 
 /**

packages/opencode/src/cli/cmd/tui/app.tsx

@@ -277,26 +277,25 @@ function App() {
   // --- First-run telemetry consent dialog ---
   // Fires once when sync is complete and user hasn't seen the consent dialog yet.
   // Must fire *before* the provider connect dialog so consent is captured first.
+  let consentShown = false
   createEffect(
     on(
       () => sync.status === "complete" && kv.get(KV_TELEMETRY_CONSENT_SHOWN) === undefined,
       (needsConsent, prev) => {
-        if (!needsConsent || prev) return
+        if (!needsConsent || prev || consentShown) return
+        consentShown = true
 
         // Load any existing consent value into the telemetry module
         const existing = kv.get(KV_TELEMETRY_ENABLED)
         if (existing !== undefined) {
-          Telemetry.loadConsent(existing as boolean)
-          // Already consented in a previous session, skip dialog
+          Telemetry.loadConsent(existing === true)
           kv.set(KV_TELEMETRY_CONSENT_SHOWN, true)
           return
         }
 
-        // Show the consent dialog. Free tier = informational only.
-        // TODO: Determine actual tier from auth/consent service. Default to "free".
-        dialog.replace(() => (
-          <DialogTelemetryConsent tier="free" onResult={() => {}} />
-        ))
+        // Default to "paid" tier (gives genuine opt-out) until we can
+        // determine the actual tier from the auth/consent service.
+        DialogTelemetryConsent.show(dialog, "paid")
       },
     ),
   )

packages/opencode/src/cli/cmd/tui/component/dialog-telemetry-consent.tsx

@@ -63,7 +63,10 @@ export function DialogTelemetryConsent(props: DialogTelemetryConsentProps) {
     decline: "No Thanks",
   }
 
+  let handled = false
   const handleSelect = (key: string) => {
+    if (handled) return
+    handled = true
     const accepted = key === "understand" || key === "enable"
     kv.set(KV_TELEMETRY_CONSENT_SHOWN, true)
     kv.set(KV_TELEMETRY_ENABLED, accepted)
@@ -97,7 +100,7 @@ export function DialogTelemetryConsent(props: DialogTelemetryConsentProps) {
         <text fg={theme.textMuted}>{message()}</text>
       </box>
       <box flexDirection="row" justifyContent="flex-end" paddingBottom={1} gap={1}>
-        <For each={[...buttons()]}>
+        <For each={buttons() as readonly string[]}>
           {(key) => (
             <box
               paddingLeft={2}
@@ -131,8 +134,8 @@ DialogTelemetryConsent.show = (
           onResult={(accepted) => resolve(accepted)}
         />
       ),
-      // If user presses Esc on paid tier, treat as decline
-      () => resolve(false),
+      // Esc handler: free tier = accept (required), paid tier = decline
+      () => resolve(tier === "free"),
     )
   })
 }