Add change summary and bundle opencode

.gitignore

@@ -48,5 +48,8 @@ docker-compose.override.yml
 # Chat application data (sessions, workspaces, uploads)
 chat/.data/
 
+# Bundled opencode repo git metadata
+opencode/.git/
+
 # Reserved filename causing Git issues
 nul

CHANGES_SINCE_BACKUP.md

@@ -0,0 +1,37 @@
+# Changes Since Backup Commit (74e578279624c6045ca440a3459ebfa1f8d54191)
+
+This document summarizes notable changes and improvements in the upstream shopify-ai repository since the backup commit.
+
+## Scope
+- Compared source: /home/web/data/repo-b (current main: ed35a94ad09fd38f0b6049ab40b77fc9520787a5).
+- Baseline: commit 74e578279624c6045ca440a3459ebfa1f8d54191.
+- Excluded: runtime data in .data/.opencode-chat and ai logs files.
+
+## High-level summary
+- Net change size: 3191 files changed, 405,292 insertions, 11,414 deletions.
+- Major areas touched: chat server/core, builder UI, PluginCompass CLI/core, AI SDK providers (Chutes/NVIDIA/OpenRouter), security tooling/tests, mobile and Windows apps, CI workflows, and extensive documentation.
+
+## Notable areas of change
+- Chat server and message handling: large updates in chat/server.js and chat/server-message-handlers.js with supporting test coverage for builder initialization, streaming tool calls, and workspace path consistency.
+- Builder UI and admin UX: extensive changes in chat/public/* (builder.html/js, settings, admin pages, tools test page) plus CSS improvements, model selector behavior, and streaming UX fixes.
+- PluginCompass CLI/core: significant additions in chat/plugincompass-cli.js and chat/plugincompass-core.js, expanded tool definitions and prompt files, and fixes for model routing, output continuity, and tooling validation.
+- AI SDK provider integration: substantial updates to chat/providers/ai-sdk-providers.js and chat/providers/index.js for Chutes, NVIDIA, OpenRouter and related routing/streaming fixes, backed by focused test scripts.
+- Security hardening: new validation, sanitization, and security test suites under chat/security/* and a large prompt injection security plan document.
+- Mobile and desktop apps: new/expanded Capacitor mobile app under chat/mobile-app and a reworked Windows/Tauri app under chat/windows-app, plus workflows for Android/iOS/Windows builds.
+- CI and build tooling: added/updated GitHub Actions workflows, Dockerfile/docker-compose tweaks, and numerous ops/deployment/testing documents.
+- Documentation overhaul: many guides moved into .md guides/ and new docs added for fixes, deployment, verification, and technical details.
+
+## Representative file groups
+- Server: chat/server.js, chat/server-message-handlers.js
+- Providers: chat/providers/ai-sdk-providers.js, chat/providers/index.js
+- CLI/core: chat/plugincompass-cli.js, chat/plugincompass-core.js
+- UI: chat/public/builder.js, chat/public/settings.html, chat/public/admin*.html
+- Security: chat/security/*
+- Mobile app: chat/mobile-app/*
+- Windows app: chat/windows-app/*
+- CI: .github/workflows/android-app.yml, ios-app.yml, windows-app.yml
+- Docs: .md guides/*, DEPLOYMENT.md, PRE_DEPLOYMENT_TESTING.md, PROMPT_INJECTION_SECURITY_PLAN.md
+
+## Commit range (reference)
+- Range: 74e578279624c6045ca440a3459ebfa1f8d54191..ed35a94ad09fd38f0b6049ab40b77fc9520787a5
+- See git log in /home/web/data/repo-b for a full commit list.

Dockerfile

@@ -89,8 +89,9 @@ RUN ARCH="${TARGETARCH:-}" && \
     "https://github.com/tsl0922/ttyd/releases/download/${TTYD_VERSION}/ttyd.${TTYD_ARCH}" \
     && chmod +x /usr/local/bin/ttyd
 
-# Install SST OpenCode (non-interactive install, with npm fallback)
-RUN curl -fsSL https://opencode.ai/install | bash -s -- -y \
+# Install OpenCode from bundled anomalyco/opencode source
+COPY opencode /opt/opencode-src
+RUN bash /opt/opencode-src/install --no-modify-path \
     && ln -sf /root/.opencode/bin/opencode /usr/local/bin/opencode
 
 # Removed Gemini CLI - not needed for Shopify AI App Builder