feat(cli): hybrid opencode 1.x + 2.x event plugin

[kanfil]

Problem

V1-only generated plugin does not run on opencode 2.x — all lifecycle event injection lost.

Change

Single hybrid file (id adlc-skills-events): V1 server() returns the existing hook map verbatim; V2 setup() registers session/tool/event hooks. Same dispatcher either way. V1 floor >= 1.18.29.

Verification

• 2 new RED-to-GREEN tests; suite 326/326 green
• Generated file typechecks vs @opencode/plugin@2.0.27 (V2 region strict-clean)
• Live v2.0.27 run fired session_start through setup()

Residuals

• V1 runtime unexercised (no 1.x binary on host); V1 path logic-identical to shipped template
• graphify.js plugin still V1-era (separate file, out of scope)

[kanfil]

factory-review: PR #30 — no blocking findings, merge-ready with 3 advisory nits

Reviewed revision: head d675f2e, base f4c6859, merge-base f4c6859 (exact-head detached checkout). Policy: default template (no REVIEW.md in repo — see nit 3). Zero prior threads, so nothing to deduplicate.

Passes

• bugs — all hook bodies wrapped fail-open try/catch (V1 preserved, V2 mirrors); ?./??= guards on ctx.location, event.system; caches keyed per skill as before. One robustness nit below.
• security — skill names JSON-serialized into TS literals (S1 pattern kept in new lines); no secrets/auth surfaces; zero new runtime deps. One defense-in-depth nit below.
• spec-compliance — matches accepted ADR ADR-opencode-hybrid-plugin: hybrid default export, id adlc-skills-events, path unchanged, V1 bodies logic-identical, V2 mapping per vendor table; README + docs/events-schema.md updated consistently. PR body claims verified (suite 326/326 witnessed; V2 typecheck + live session_start probe on v2.0.27 per linked evidence).
• quality — see nits.

💬 Nit 1: event.subscribe() loop has no abort/cleanup

src/events.mjs (buildOpenCodeV2Setup): the for await (... ctx.event.subscribe()) loop runs without a signal and setup() returns no cleanup, so a plugin reload can strand an extra runner (duplicate nudge processing). Vendor guide pattern is subscribe({ signal }) + return () => controller.abort(). Suggest adopting it in a follow-up; harmless at steady state.

💬 Nit 2: h.timeout interpolated raw into generated TS

${h.timeout} is emitted uncoerced in both old and new template lines. A non-numeric manifest timeout would generate broken TS. Pre-existing pattern (not introduced here), and a malicious skills repo already has full script-execution trust — but Number(h.timeout) || 60 at resolveEvents time would close it cheaply. Follow-up material.

💬 Nit 3: no REVIEW.md policy-as-code in repo

Reviewed against the default template. Recommend adding a REVIEW.md so future reviews run against pinned passes/severities.

No Important findings — nothing here blocks merge. Human code-owner approval still required (this review never approves or merges).

[kanfil]

factory-review: PR #30 — no blocking findings, merge-ready with 3 advisory nits

Reviewed revision: head d675f2e, base f4c6859, merge-base f4c6859 (exact-head detached checkout). Policy: default template (no REVIEW.md in repo — see nit 3). Zero prior threads, so nothing to deduplicate.

Passes

• bugs — all hook bodies wrapped fail-open try/catch (V1 preserved, V2 mirrors); ?./??= guards on ctx.location, event.system; caches keyed per skill as before. One robustness nit below.
• security — skill names JSON-serialized into TS literals (S1 pattern kept in new lines); no secrets/auth surfaces; zero new runtime deps. One defense-in-depth nit below.
• spec-compliance — matches accepted ADR ADR-opencode-hybrid-plugin: hybrid default export, id adlc-skills-events, path unchanged, V1 bodies logic-identical, V2 mapping per vendor table; README + docs/events-schema.md updated consistently. PR body claims verified (suite 326/326 witnessed; V2 typecheck + live session_start probe on v2.0.27 per linked evidence).
• quality — see nits.

💬 Nit 1: event.subscribe() loop has no abort/cleanup

src/events.mjs (buildOpenCodeV2Setup): the for await (... ctx.event.subscribe()) loop runs without a signal and setup() returns no cleanup, so a plugin reload can strand an extra runner (duplicate nudge processing). Vendor guide pattern is subscribe({ signal }) + return () => controller.abort(). Suggest adopting it in a follow-up; harmless at steady state.

💬 Nit 2: h.timeout interpolated raw into generated TS

${h.timeout} is emitted uncoerced in both old and new template lines. A non-numeric manifest timeout would generate broken TS. Pre-existing pattern (not introduced here), and a malicious skills repo already has full script-execution trust — but Number(h.timeout) || 60 at resolveEvents time would close it cheaply. Follow-up material.

💬 Nit 3: no REVIEW.md policy-as-code in repo

Reviewed against the default template. Recommend adding a REVIEW.md so future reviews run against pinned passes/severities.

No Important findings — nothing here blocks merge. Human code-owner approval still required (this review never approves or merges).