Inside OpenCode V2

Submits prompts and decides whether requested tool actions may proceed.

Accepts prompts and approval decisions, then calls the appropriate transport layer.

Composes the generated Effect Client, Core and Server; custom fetch dispatches through the same HTTP router without a network hop.

Encodes current /api requests, returns decoded admission receipts and exposes SSE events to the caller.

Validates current contracts and dispatches prompt admission, session reads/controls and Location-scoped approval replies.

• Stores the event journal, prompt inbox, Session/message projections, context epochs and saved approval rules.
• Active drains and pending approval waits are not durable workflow ownership.

Provides working-tree files, ambient instructions and command execution. Permission checks are not a shell sandbox, and host side effects are not atomic with tool-result persistence.

Resolve resources, enforce their own permission policy, then read/edit files, spawn host processes or call web tools.

Builds and refreshes workspace and agent context; required initial context must be available before a pending prompt is promoted.

Commits durable events with derived Session state and broadcasts live updates.

Serializes each Session's drains, coalesces work notifications and settles ownership when a drain completes.

• Admits normalized prompts with exact-retry reconciliation.
• Keeps inputs pending until promotion into visible history.
• Steer is default; queue waits until current continuation would end.

Resolves model/auth and lowers canonical requests onto supported native provider routes, returning normalized events for one provider turn. The runner—not an AI SDK tool loop—owns continuation.

• Evaluates configured rules and saved project approvals.
• Holds pending requests in Location-local memory.
• Resolves once, always or reject decisions.

Builds model turns, runs local tools, records outcomes and exits when there is no continuation or eligible pending input.

• Admits prompts durably and exposes Session reads/control
• Model orchestration belongs to the runner.

Maintains event-derived Session/message views and reloads them for placement, history reads and provider-turn continuation.

• Captures Location or application tool registrations.
• Validates calls and bounds model-facing output.
• Authorization belongs to each executor, not the registry.