fix(harness): move base to OpenCode 1.18.18

.github/renovate.json5

@@ -185,7 +185,7 @@
       // patch releases, so moves past the validated release must be deliberate and
       // reviewed. Raise after validating a newer release.
       matchPackageNames: ['@opencode-ai/sdk', 'anomalyco/opencode'],
-      allowedVersions: '<=1.18.14',
+      allowedVersions: '<=1.18.18',
     },
     {
       // Cap Bun at 1.3.14. The build gate requires an exact match with upstream

.slim/clonedeps.json

@@ -1,21 +1,21 @@
 {
   "version": "1.0.0",
-  "updatedAt": "2026-08-08T00:00:00.000Z",
+  "updatedAt": "2026-08-14T19:24:00.000Z",
   "dependencies": [
     {
       "name": "opencode (server)",
-      "resolvedVersion": "1.18.14",
+      "resolvedVersion": "1.18.18",
       "repoUrl": "https://github.com/anomalyco/opencode.git",
-      "ref": "v1.18.14",
+      "ref": "v1.18.18",
       "path": ".slim/clonedeps/repos/anomalyco__opencode",
       "packagePath": "packages/opencode",
       "reason": "OpenCode server source — owns session/prompt machinery and publishes message.part.updated bus events. Pinned to the harness base_version so source checks reflect what we ship."
     },
     {
       "name": "@opencode-ai/sdk",
-      "resolvedVersion": "1.18.14",
+      "resolvedVersion": "1.18.18",
       "repoUrl": "https://github.com/anomalyco/opencode.git",
-      "ref": "v1.18.14",
+      "ref": "v1.18.18",
       "path": ".slim/clonedeps/repos/anomalyco__opencode",
       "packagePath": "packages/sdk/js",
       "reason": "OpenCode SDK source for inspecting SSE subscription contract and error/status payload shapes."

AGENTS.md

@@ -102,5 +102,5 @@ Read-only dependency source repositories are available under `.slim/clonedeps/re
 
 Both are pinned to the `base_version` in `packages/harness/harness.config.json`, so what you read is what the harness ships. Re-pin them when that base moves — a source check against a stale clone can be confidently wrong.
 
-- `.slim/clonedeps/repos/anomalyco__opencode/packages/opencode/` — `anomalyco/opencode` at `v1.18.14`; OpenCode server source. Read `src/session/{prompt,message,message-v2,processor}.ts` to understand how `message.part.updated` bus events transition through the tool-part lifecycle (pending → running → completed) the Fro Bot harness consumes, and `src/session/{status,run-state}.ts` for how session status is written and cleared.
-- `.slim/clonedeps/repos/anomalyco__opencode/packages/sdk/js/` — `@opencode-ai/sdk` at `v1.18.14`; thin HTTP + SSE client over the server. Useful for confirming event shapes pass through unchanged, verifying our `processEventStream` consumer matches the SSE subscription contract, and checking error/status payload shapes in `src/v2/gen/types.gen.ts`.
+- `.slim/clonedeps/repos/anomalyco__opencode/packages/opencode/` — `anomalyco/opencode` at `v1.18.18`; OpenCode server source. Read `src/session/{prompt,message,message-v2,processor}.ts` to understand how `message.part.updated` bus events transition through the tool-part lifecycle (pending → running → completed) the Fro Bot harness consumes, and `src/session/{status,run-state}.ts` for how session status is written and cleared.
+- `.slim/clonedeps/repos/anomalyco__opencode/packages/sdk/js/` — `@opencode-ai/sdk` at `v1.18.18`; thin HTTP + SSE client over the server. Useful for confirming event shapes pass through unchanged, verifying our `processEventStream` consumer matches the SSE subscription contract, and checking error/status payload shapes in `src/v2/gen/types.gen.ts`.

docs/reference/carry-ledger.md

@@ -22,7 +22,7 @@ No carry has an in-repo record of the upstream version that would contain it, so
 
 - **Capability:** Populates `session.summary.diffs` at the session level. Stock builds compute per-message summaries but never fold them into the session-level row.
 - **Surface:** Both, and load-bearing for headed/local consumers.
-- **Upstream status:** Open. Verified absent from stock through 1.18.14.
+- **Upstream status:** Open. Verified absent from stock through 1.18.18.
 - **Evidence it is still needed:** A downstream consumer (Space Bus) reads the aggregate summary as its preferred tier. Without this carry it falls back to fetching every message and aggregating per-turn diffs client-side.
 - **Removal condition:** Stock exposes the aggregate fold — not merely a `summary.diffs` field in the schema, which stock already has while leaving it unpopulated. Verify the value is written, not just typed.
 

packages/harness/harness.config.json

@@ -1,7 +1,7 @@
 {
   "release_repo": "anomalyco/opencode",
   "source_repo": "https://github.com/anomalyco/opencode.git",
-  "base_version": "1.18.14",
+  "base_version": "1.18.18",
   "integrationRefs": [
     "https://github.com/anomalyco/opencode/pull/19961",
     "https://github.com/anomalyco/opencode/pull/31859",

packages/harness/src/cli.test.ts

@@ -13,7 +13,7 @@ describe('getProvenance', () => {
     const p = getProvenance()
 
     // #then
-    expect(p.baseVersion).toBe('1.18.14')
+    expect(p.baseVersion).toBe('1.18.18')
     expect(Array.isArray(p.integrationRefs)).toBe(true)
     expect(p.integrationCommit).toBeNull()
     expect(p.buildSha).toBe('dev')