feat(team): integrate Team V3 into desktop, TUI, mobile and CLI

.github/workflows/ci-model-intelligence.yml

@@ -0,0 +1,115 @@
+name: ci-model-intelligence
+
+on:
+  push:
+    paths:
+      - "packages/opencode/src/model-intelligence/**"
+      - "packages/opencode/test/model-intelligence/**"
+      - "packages/opencode/migration/**"
+      - "packages/opencode/script/build-notices.ts"
+      - "THIRD_PARTY_NOTICES.md"
+  pull_request:
+    paths:
+      - "packages/opencode/src/model-intelligence/**"
+      - "packages/opencode/test/model-intelligence/**"
+
+jobs:
+  schema-and-snapshot:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Stub generated models snapshot
+        # models.ts imports this build-time artifact, which is intentionally
+        # gitignored and generated by script/build.ts for real builds.
+        run: |
+          mkdir -p packages/opencode/src/provider
+          printf '// @ts-nocheck\n// CI stub for typecheck only - see script/build.ts for the real generator\nexport const snapshot = {}\n' > packages/opencode/src/provider/models-snapshot.js
+          printf '// CI stub for typecheck only - see script/build.ts for the real generator\nexport declare const snapshot: Record<string, unknown>\n' > packages/opencode/src/provider/models-snapshot.d.ts
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Typecheck model-intelligence
+        run: cd packages/opencode && bun run typecheck
+
+      - name: Unit tests (model-intelligence)
+        run: cd packages/opencode && bun test --timeout 180000 test/model-intelligence/
+
+      - name: Verify no cross-imports
+        run: |
+          if grep -rE "from ['\"].*(collective|multi-model|team)" packages/opencode/src/model-intelligence/; then
+            echo "ERROR: cross-import detected from model-intelligence to forbidden directories"
+            exit 1
+          fi
+
+      - name: Lint no second registry
+        run: |
+          if grep -rE "export const (REGISTRY|MODEL_REGISTRY|PROVIDER_REGISTRY)" packages/opencode/src/team/ packages/opencode/src/collective/ 2>/dev/null; then
+            echo "ERROR: second registry definition detected"
+            exit 1
+          fi
+
+      - name: Build THIRD_PARTY_NOTICES.md
+        run: |
+          if [ ! -f packages/opencode/model-intelligence-snapshot.json ]; then
+            echo "No model-intelligence snapshot committed; skipping notices regeneration."
+            exit 0
+          fi
+          cd packages/opencode
+          bun run script/build-notices.ts
+
+      - name: Verify notices unchanged
+        run: |
+          if [ ! -f packages/opencode/model-intelligence-snapshot.json ]; then
+            echo "No model-intelligence snapshot committed; skipping notices verification."
+            exit 0
+          fi
+          if ! git diff --exit-code THIRD_PARTY_NOTICES.md; then
+            echo "ERROR: THIRD_PARTY_NOTICES.md differs from committed version"
+            echo "Regenerate via: cd packages/opencode && bun run script/build-notices.ts"
+            exit 1
+          fi
+
+  license-upstream:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check upstream license unchanged
+        run: |
+          expected_license="MIT"
+          actual_license=$(curl -sSL -H "User-Agent: opencode-ci" \
+            "https://github.com/ghapi/repos/anomalyco/models.dev/license" \
+            | jq -r '.license.spdx_id // empty')
+          if [ "$actual_license" != "$expected_license" ]; then
+            echo "ERROR: upstream license changed: was '$expected_license', now '$actual_license'"
+            echo "Manual review required before continuing ingestion."
+            exit 1
+          fi
+          echo "Upstream license verified: $actual_license"
+
+  snapshot-freshness:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check snapshot age
+        run: |
+          snapshot_age_days=7
+          snapshot_generated_at=$(jq -r '.generatedAtUTC' packages/opencode/model-intelligence-snapshot.json 2>/dev/null || echo "")
+          if [ -z "$snapshot_generated_at" ]; then
+            echo "No snapshot found; CI will produce one in next sync."
+            exit 0
+          fi
+          snapshot_epoch=$(date -d "$snapshot_generated_at" +%s 2>/dev/null || echo "0")
+          now_epoch=$(date +%s)
+          age_days=$(( (now_epoch - snapshot_epoch) / 86400 ))
+          if [ "$age_days" -gt "$snapshot_age_days" ]; then
+            echo "WARN: snapshot is $age_days days old (threshold $snapshot_age_days)"
+            echo "Consider running registry sync."
+          fi

.husky/_/.gitignore

@@ -0,0 +1,5 @@
+# Ignore everything in this directory except the .gitignore itself.
+# This is a generated directory used by husky (git hooks).
+# It is created by `bun install` and should never be committed.
+*
+!.gitignore

.husky/pre-commit

@@ -11,3 +11,15 @@ bunx biome check --changed --no-errors-on-unmatched .
 if command -v shellcheck >/dev/null 2>&1; then
   git diff --cached --name-only --diff-filter=ACM | grep '\.sh$' | xargs -r shellcheck
 fi
+
+# 3. TEAM-G01: lease validate (skip if no lease is present)
+# A worker holding a lease MUST validate it is still ACTIVE before commit.
+# The lease id is read from .team/active_lease (if present); absent means
+# "not under a lease" and the check is skipped (fail-open: this is a CI gate
+# for workers, the integration gate is team:preintegrate-check on dev/Team).
+if [ -f .team/active_lease ]; then
+  LEASE_ID="$(cat .team/active_lease)"
+  WORKER_ID="$(cat .team/active_worker 2>/dev/null || echo unknown)"
+  bun run team validate --lease-id "$LEASE_ID" --worker "$WORKER_ID" --git-root "$(pwd)"
+  bun run team precommit-check --lease-id "$LEASE_ID" --git-root "$(pwd)" >/dev/null
+fi

.husky/pre-push

@@ -18,3 +18,28 @@ if (process.versions.bun !== expectedBunVersion) {
 }
 '
 bun run typecheck
+
+# TEAM-G01: integration gate. If a push targets a protected branch (main, dev,
+# opti-ui, Team-build-opti-ui, Team), refuse unless the worker holds an
+# authorized lease and patch-id is stable.
+PROTECTED_BRANCHES='^(main|dev|opti-ui|Team-build-opti-ui|Team)$'
+while read -r LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do
+  BRANCH="${REMOTE_REF#refs/heads/}"
+  if echo "$BRANCH" | grep -E "$PROTECTED_BRANCHES" >/dev/null 2>&1; then
+    echo "Refusing push to protected branch: $BRANCH" >&2
+    echo "All pushes to protected branches must go through a temporary push-ref" >&2
+    echo "and be cherry-picked by MM1, not pushed directly. TEAM-G01 enforces this." >&2
+    exit 2
+  fi
+done
+
+# If a worker holds a lease, run preintegrate-check (scope + patch-id).
+if [ -f .team/active_lease ]; then
+  LEASE_ID="$(cat .team/active_lease)"
+  WORKER_ID="$(cat .team/active_worker 2>/dev/null || echo unknown)"
+  BASE_SHA="$(cat .team/base_sha 2>/dev/null || echo )"
+  if [ -n "$BASE_SHA" ]; then
+    bun run team validate --lease-id "$LEASE_ID" --worker "$WORKER_ID" >/dev/null
+    bun run team preintegrate-check --lease-id "$LEASE_ID" --base "$BASE_SHA" --git-root "$(pwd)" >/dev/null
+  fi
+fi

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,26 @@
+# THIRD_PARTY_NOTICES
+
+Generated by `script/build-notices.ts` at 2026-07-21T00:00:00Z
+
+This file is auto-generated from the model-intelligence registry snapshot.
+Do not edit manually. Regenerate via `bun run build-notices`.
+
+Source registry snapshot is bundled with this release.
+
+## MIT
+
+### catalog:models.dev:api.json
+
+- License: MIT
+- Copyright: Copyright (c) 2025 models.dev
+- License file: https://github.com/anomalyco/models.dev/blob/main/LICENSE
+- Confidence: official
+- URL: https://models.dev/api.json
+
+---
+
+## Verification
+
+```bash
+bun run build-notices && git diff --exit-code THIRD_PARTY_NOTICES.md
+```