mcpx: dogfood .opencode plugin copy is stale — ops.gen.ts missing 9 operations (secrets, reload, preflight, servers_get), no drift guard #314

What is wrong

This repo dogfoods the mcpx opencode plugin: .opencode/plugin/mcpx-session.ts + .opencode/plugin/mcpx/ are a copy of the shipped plugin in pkgs/mcpx/plugin/opencode/, installed in commit 0a56e58 (2026-10-09, "install opencode plugin"). The copy was never re-synced afterwards, and its generated operation table has fallen behind /v1:

Verified on main 3e783d93 with diff -r .opencode/plugin/mcpx pkgs/mcpx/plugin/opencode/mcpx — the only differing file is ops.gen.ts:

• .opencode/plugin/mcpx/ops.gen.ts: 72 operations
• pkgs/mcpx/plugin/opencode/mcpx/ops.gen.ts: 81 operations

Missing from the dogfood copy (9 ops, with the pkgs commits that added them):

• preflight (POST /v1/preflight) and reload (POST /v1/reload) — ea15a2a (2026-10-09, hot reload)
• secrets_list, secrets_set, secrets_unset, secret_requests_list, secret_request_get, secret_request_decline — d107815 (2026-10-11, in-memory secrets)
• servers_get (GET /v1/servers/{name})

Every other file in the two trees is byte-identical (mcpx-session.ts, daemon.ts, daemon.test.ts, ceiling.test.ts, ops.test.ts), which is what makes the one stale file easy to miss.

Why it matters

• An agent working in this repo through its own .opencode plugin has no typed DaemonClient.ops methods for secrets, reload, preflight or single-server status — the exact surfaces added since the install. Calls to them fail as missing methods instead of reaching the daemon.
• Nothing catches the drift: the generation guard TestPluginOpsAreGenerated (pkgs/mcpx/internal/api/plugin_ts_test.go:13) only compares the pkgs copy (pluginOpsPath = "../../plugin/opencode/mcpx/ops.gen.ts"). No test, script or workflow compares the two trees, and mcpx.yml's trigger paths don't even include .opencode/plugin/**, so a PR that only touches the dogfood copy runs no mcpx CI.

Suggested fix

1. Regenerate/copy the current generated table into .opencode/plugin/mcpx/ops.gen.ts so both trees are identical again.
2. Add a drift guard where it belongs — at this repo's level, not inside pkgs/mcpx (that package also lives standalone in dezren39/nix, where a repo-root .opencode copy does not exist): e.g. a step in .github/workflows/mcpx.yml running diff -r pkgs/mcpx/plugin/opencode/mcpx .opencode/plugin/mcpx plus the mcpx-session.ts comparison, with .opencode/plugin/** added to that workflow's PR/push paths.

Acceptance criteria

• diff -r .opencode/plugin/mcpx pkgs/mcpx/plugin/opencode/mcpx is clean on main (both at 81 ops).
• A deliberate one-line change to either copy makes the new guard fail; removing it makes it pass.
• The pkgs generation test (go test ./internal/api -run TestPluginOpsAreGenerated) still passes, and the plugin bun tests pass against the synced copy.
• The guard does not live inside pkgs/mcpx, so the standalone mcpx copy in dezren39/nix is unaffected.