chore(oss): audit the server package and resync the SDK mirrors

Split the 657-line operation service into eor, submit, and verify
modules, add the AGENT_REVOKED and KEY_RETIRED codes the Backend already
emits, and condense every multi-line comment. Mirror Node, Python, and
Go at 2.1.0 with the deep-health 503, non-idempotent retry, rotation
grace, and path-encoding fixes. Document which routes and response
fields the self-hosted server does not provide.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

sdks/go/cmd/elydora/plugins/opencode.go

@@ -1,14 +1,17 @@
 package plugins
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
+	"regexp"
+	"strconv"
 )
 
-// OpenCodePlugin manages the Elydora audit hook for OpenCode.
-// It writes .config/opencode/plugins/elydora-audit.mjs in the home directory.
+var openCodeScriptPathPattern = regexp.MustCompile(`(?m)^const (GUARD_SCRIPT_PATH|HOOK_SCRIPT_PATH) = (".*");$`)
+
+// OpenCodePlugin writes ~/.config/opencode/plugins/elydora-audit.mjs.
 type OpenCodePlugin struct{}
 
 func (p *OpenCodePlugin) configPath() (string, error) {
@@ -59,8 +62,7 @@ func (p *OpenCodePlugin) Install(config InstallConfig) error {
 }
 
 func buildOpenCodePlugin(scriptPath, guardPath string) string {
-	return fmt.Sprintf(`// Elydora Audit Plugin for OpenCode
-// Generated by @elydora/sdk — DO NOT EDIT
+	return fmt.Sprintf(`// Elydora audit plugin for OpenCode. Generated by the Elydora CLI; do not edit.
 
 import { spawn, spawnSync } from 'node:child_process';
 
@@ -112,62 +114,72 @@ func (p *OpenCodePlugin) Uninstall(agentID string) error {
 	}
 
 	if agentID != "" {
-		scriptPath, _ := hookScriptPath(agentID)
-		if scriptPath != "" {
-			os.Remove(scriptPath)
-		}
-		gPath, _ := guardScriptPath(agentID)
-		if gPath != "" {
-			os.Remove(gPath)
+		if err := removeAgentScripts(agentID); err != nil {
+			return err
 		}
 	}
-
 	fmt.Println("Uninstalled Elydora hook for OpenCode.")
 	return nil
 }
 
+func openCodeScriptPaths(data []byte, pluginFile string) (string, string, error) {
+	paths := map[string]string{}
+	for _, match := range openCodeScriptPathPattern.FindAllSubmatch(data, -1) {
+		value, err := strconv.Unquote(string(match[2]))
+		if err != nil {
+			return "", "", fmt.Errorf(
+				"OpenCode plugin at %s has an invalid %s: %w", pluginFile, match[1], err,
+			)
+		}
+		paths[string(match[1])] = value
+	}
+	guardPath, hasGuard := paths["GUARD_SCRIPT_PATH"]
+	hookPath, hasHook := paths["HOOK_SCRIPT_PATH"]
+	if !hasGuard || !hasHook {
+		return "", "", fmt.Errorf("OpenCode plugin at %s has no Elydora script paths", pluginFile)
+	}
+	return guardPath, hookPath, nil
+}
+
 func (p *OpenCodePlugin) Status() (PluginStatus, error) {
 	pluginFile, err := p.configPath()
 	if err != nil {
 		return PluginStatus{}, err
 	}
-
 	status := PluginStatus{
 		AgentName:   "opencode",
 		DisplayName: "OpenCode",
 		ConfigPath:  pluginFile,
 	}
-
-	if _, err := os.Stat(pluginFile); err == nil {
-		status.HookConfigured = true
-
-		// Read the plugin file to extract the hook script path
-		data, readErr := os.ReadFile(pluginFile)
-		if readErr == nil {
-			content := string(data)
-			// Look for the elydora hook.js path in the plugin file content
-			if idx := strings.Index(content, ".elydora"); idx >= 0 {
-				// Extract path from the spawn('node', ['/path/to/hook.js']) pattern
-				// Pragmatic: scan ~/.elydora/*/hook.js for existence
-				home, homeErr := os.UserHomeDir()
-				if homeErr == nil {
-					entries, dirErr := os.ReadDir(filepath.Join(home, ".elydora"))
-					if dirErr == nil {
-						for _, entry := range entries {
-							if entry.IsDir() {
-								hookPath := filepath.Join(home, ".elydora", entry.Name(), "hook.js")
-								if _, statErr := os.Stat(hookPath); statErr == nil {
-									status.HookScriptExists = true
-									break
-								}
-							}
-						}
-					}
-				}
-			}
-		}
+	data, err := os.ReadFile(pluginFile)
+	if errors.Is(err, os.ErrNotExist) {
+		return status, nil
 	}
-
-	status.Installed = status.HookConfigured && status.HookScriptExists
+	if err != nil {
+		return status, fmt.Errorf("read %s: %w", pluginFile, err)
+	}
+	status.HookConfigured = true
+	guardPath, hookPath, err := openCodeScriptPaths(data, pluginFile)
+	if err != nil {
+		return status, err
+	}
+	guard, err := resolveManagedScript(guardPath, "guard.js")
+	if err != nil {
+		return status, err
+	}
+	audit, err := resolveManagedScript(hookPath, "hook.js")
+	if err != nil {
+		return status, err
+	}
+	if guard == nil || audit == nil || !sameManagedAgentID(guard.agentID, audit.agentID) {
+		return status, nil
+	}
+	status.HookScriptExists, err = managedRuntimePresent(managedRuntimeContract{
+		agentID: guard.agentID, guardPath: guard.scriptPath, auditPath: audit.scriptPath,
+	}, "opencode")
+	if err != nil {
+		return status, err
+	}
+	status.Installed = status.HookScriptExists
 	return status, nil
 }