fix: add idle-timeout Instance disposal for serve mode memory fix

Keep TUI instances alive during active sessions by wrapping tui() inside
Instance.provide() in both thread.ts and attach.ts. This prevents the
idle timer from firing while the TUI is running — the ref stays > 0 for
the entire session and only drops to 0 when the user exits.

Also fix verbose permission ruleset serialization in evaluate() log and
add a regression test for the idle-timeout lifecycle invariant.

Author: sjawhar

packages/opencode/src/cli/cmd/tui/attach.ts

@@ -78,8 +78,6 @@ export const AttachCommand = cmd({
           sessionID: args.session,
           fork: args.fork,
         },
-        directory,
-        headers,
       })
     } finally {
       unguard?.()

packages/opencode/src/cli/cmd/tui/thread.ts

@@ -169,11 +169,6 @@ export const TuiThreadCommand = cmd({
       }
 
       const prompt = await input(args.prompt)
-      const config = await Instance.provide({
-        directory: cwd,
-        fn: () => TuiConfig.get(),
-      })
-
       const network = await resolveNetworkOptions(args)
       const external =
         process.argv.includes("--port") ||
@@ -183,46 +178,53 @@ export const TuiThreadCommand = cmd({
         network.port !== 0 ||
         network.hostname !== "127.0.0.1"
 
-      const transport = external
-        ? {
-            url: (await client.call("server", network)).url,
-            fetch: undefined,
-            events: undefined,
-          }
-        : {
-            url: "http://opencode.internal",
-            fetch: createWorkerFetch(client),
-            events: createEventSource(client),
+      await Instance.provide({
+        directory: cwd,
+        fn: async () => {
+          const config = await TuiConfig.get()
+
+          const transport = external
+            ? {
+                url: (await client.call("server", network)).url,
+                fetch: undefined,
+                events: undefined,
+              }
+            : {
+                url: "http://opencode.internal",
+                fetch: createWorkerFetch(client),
+                events: createEventSource(client),
+              }
+
+          setTimeout(() => {
+            client.call("checkUpgrade", { directory: cwd }).catch(() => {})
+          }, 1000).unref?.()
+
+          try {
+            await tui({
+              url: transport.url,
+              async onSnapshot() {
+                const tui = writeHeapSnapshot("tui.heapsnapshot")
+                const server = await client.call("snapshot", undefined)
+                return [tui, server]
+              },
+              config,
+              directory: cwd,
+              fetch: transport.fetch,
+              events: transport.events,
+              args: {
+                continue: args.continue,
+                sessionID: args.session,
+                agent: args.agent,
+                model: args.model,
+                prompt,
+                fork: args.fork,
+              },
+            })
+          } finally {
+            await stop()
           }
-
-      setTimeout(() => {
-        client.call("checkUpgrade", { directory: cwd }).catch(() => {})
-      }, 1000).unref?.()
-
-      try {
-        await tui({
-          url: transport.url,
-          async onSnapshot() {
-            const tui = writeHeapSnapshot("tui.heapsnapshot")
-            const server = await client.call("snapshot", undefined)
-            return [tui, server]
-          },
-          config,
-          directory: cwd,
-          fetch: transport.fetch,
-          events: transport.events,
-          args: {
-            continue: args.continue,
-            sessionID: args.session,
-            agent: args.agent,
-            model: args.model,
-            prompt,
-            fork: args.fork,
-          },
-        })
-      } finally {
-        await stop()
-      }
+        },
+      })
     } finally {
       unguard?.()
     }