Repository navigation
feat(harness): add OpenCode 2.x generation - #176
Open
cubeorgdev[bot] wants to merge 10 commits into
Open
cubeorgdev[bot] wants to merge 10 commits into
cubeorgdev[bot] wants to merge 10 commits into
Conversation
Register opencode-v2_0_0 for [2.0.0, ∞) with its own operation set and close 1.x at 2.0.0; the opencode-v1 alias moves to the newest generation. - Install and repair are package-aware: layout detection recognizes both opencode-ai and @opencode/cli, repair stays inside the installed generation, and a repair that would switch packages returns manual uninstall/install guidance instead of running. - 2.x launches with --standalone so the private server inherits Blue's environment, renders native v2 config without OPENCODE_CONFIG_DIR (which replaces the user's global config dir in 2.x), references managed plugins and skills by path, and inlines package agents. - New v2 session plugin on the v2 plugin API; uploads on session.execution.* and writes the native `session export`. - Resume uses each generation's native import (2.x `session import`, 409 treated as a collision) and refuses bundles recorded on the other generation before invoking OpenCode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lock @opencode/cli@2.2.5 (opencode-v2_0_0); matrix samples may name their own package so 1.x samples keep installing opencode-ai. The fixture package gains a 2.x plugin variant, the fake agent accepts the 2.x restore commands, and slim MCP assertions accept both config shapes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
This pull request was created from a Blocks session. View in dashboard | View on desktop
|
Contributor
Author
|
Test from the |
opencode-ai 1.x prints nothing, not `[]`, for `session list --format json` on a home with no sessions, so restore failed to decode the list. Treat whitespace-only output as an empty list; other non-JSON output still fails the collision check closed. The e2e fake agent now mirrors the 1.x behavior. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`runtime.join("plugins/tool")` renders a literal `/` on Windows while the
writer produces `\\`, so the expectation never matched there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Test from the |
Trivy's image scan blocks on fixable high/critical advisories in the dashboard runtime: next 16.3.4 (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr, GHSA-vcvr-r3jv-pc5j, CVE-2026-94482, CVE-2026-94483), sharp 0.35.4 (GHSA-wq5f-xc86-pv6w) and source-map-js 1.2.1 (CVE-2026-93749). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Test from the |
…USTSEC advisories Clears RUSTSEC-2026-0346/0347/0348/0349 (rustls 0.23.46), -0382 (rustls-webpki 0.103.16), -0381 (webpki-roots 1.0.11) and -0385 (ctutils 0.4.8) reported by the cargo-deny advisories gate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Test from the |
cargo-deny reports the AsyncFd I/O-safety unsoundness as an error, which fails the advisories gate even though it is not a vulnerability finding. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Test from the |
…cies Moves @modelcontextprotocol/sdk, body-parser, brace-expansion, fast-uri, proxy-addr, systeminformation, undici and zod to patched releases without changing package.json ranges. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GHSA-965c-763c-88jm needs the Magic Link plugin and GHSA-r4xp-prcw-77qf needs the OAuth Proxy plugin; the dashboard enables neither. GHSA-44jh-23m7-hpcf affects the Drizzle adapter, which the dashboard does not use. Patched better-auth drops the account.issuer column that the control-api schema declares NOT NULL, so the upgrade needs its own migration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Test from the |
Contributor
Author
|
Test from the |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
opencode-v2_0_0for OpenCode>=2.0.0(@opencode/cli) and closes 1.x at2.0.0. Today a 2.x install is either blocked, with a repair hint that downgrades toopencode-ai, or launched ungoverned when unverified versions are allowed.Fixes #177
What changes
opencode-aiand@opencode/cliitself; it prints the uninstall and install commands instead.--standalone, because the shared background service never sees Blue's environment. It gets native v2 config (permissions[],providers,mcp.servers,policies) and noOPENCODE_CONFIG_DIR, which in 2.x replaces~/.config/opencodeinstead of adding to it. Managed plugins and skills are referenced by absolute path. Package agents are inlined into the config, since no key points at an agent directory.session.execution.*, because 2.2 never emitssession.statusorsession.idle, and writes theopencode session exportoutput.blue runre-exports after exit because the private server can cut the last export short.session import, which exits 0 on a 409, so that case is handled as a collision. Bundles recorded on the other generation are refused before OpenCode runs, because 2.x cannot import 1.x exports.@opencode/cli@2.2.5, and matrix samples can name their own package so the 1.x samples (now including 1.18.25) keepopencode-ai. The fixture package gains a 2.x plugin variant, so its sha256 changed in all five pins.Verified against a live 2.2.5 binary
governed/*models are listed, andbuildends with the managedquestiondeny.session-start, export, thensession-upload.session importreturns the ID, and a second import collides.Known limitation: OpenCode 2 ranks
policiesfrom the user's own config files aboveOPENCODE_CONFIG_CONTENT. A user can therefore add their ownprovider.useallow and re-enable another provider in gateway mode. This is documented.cargo fmt,clippy --all-targetsandcargo test --workspace(491 tests) pass, as do the e2e-native helper tests. The draft-gated E2E workflows have not run yet.Fixes from the local v1/v2 E2E run
opencode-ai1.x prints nothing (not[]) forsession list --format json. Empty output now means no sessions. This bug is also on main. The e2e fake agent now behaves like 1.x here.package_components_are_referenced_by_absolute_directorywas in the test's expected path, not the writer.🤖 Generated with Claude Code