Skip to content

Add OpenCode 2 plugin with full feature parity - #74

Merged
Dhravya merged 4 commits into
mainfrom
codex/opencode-v2
Sep 26, 2026
Merged

Dhravya merged 4 commits into
mainfrom
codex/opencode-v2

Conversation

@ishaanxgupta

@ishaanxgupta ishaanxgupta commented Aug 20, 2026 •

Copy link
Copy Markdown
Contributor

Summary

OpenCode 2 rejects the V1 root export (Plugin must export a default definition with an id and an effect or setup function), so 2.0.13 fails to load for every OpenCode 2 user. This adds an OpenCode 2 server plugin, keeps the V1 root export unchanged, and brings the V2 runtime to parity

What ships

  • opencode-supermemory/server: OpenCode 2 resolves this export automatically from "plugins": ["opencode-supermemory"]. The runtime provides direct/advisory/off recall with per-session dedupe and 3s fail-open timeouts, first-message profile context, keyword nudges, the shared supermemory tool, a read-only supermemory_recall tool that the installer auto-allows, transcript-based automatic capture with idempotent capture IDs and timeouts, native compaction enrichment plus summary capture (compactionEnabled), update checks, and activity notices.
  • opencode-supermemory/tui and opencode-supermemory/rpc: the server emits notices over plugin RPC and the TUI companion renders them as toasts, so update and recall notices never enter model context (parity with Show Supermemory activity in OpenCode #80).
  • Shared services used by both generations: tool executor, compaction prompt, activity notice formatting, and a comment-preserving JSONC editor that registers plugin (V1), plugins (V2), and the recall permission. install and status report both registrations.
  • README documents OpenCode 2 config, rollback, and local development.

@socket-security

socket-security Bot commented Aug 20, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​opencode-ai/​plugin@​1.0.191 ⏵ 1.18.3210010070 +397100
Added@​opencode/​plugin@​2.0.15991007296100
Addedjsonc-parser@​3.3.110010010087100
Added@​opentui/​core@​0.5.10951009397100
Addedsolid-js@​1.9.1510010010096100
Added@​opentui/​solid@​0.5.101001009998100

View full report

@socket-security

socket-security Bot commented Aug 20, 2026 •

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @protobufjs/float is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@opencode/plugin@2.0.15 → npm/@protobufjs/float@1.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/float@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm json-schema is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@opencode-ai/plugin@1.18.32 → npm/@opencode/plugin@2.0.15 → npm/json-schema@0.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm rimraf is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@opencode/plugin@2.0.15 → npm/rimraf@5.0.10

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rimraf@5.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@ishaanxgupta ishaanxgupta changed the title Codex/opencode v2 opencode v2 Aug 20, 2026
@FoTrix

FoTrix commented Sep 14, 2026

Copy link
Copy Markdown

Same problem here, confirming from a production install:

  • opencode v2.0.3 (latest), opencode-supermemory@2.0.13 (latest as of today), macOS, Node v24.16.0
  • opencode plugin list shows the entry with no version/source; every server start logs:
    PluginModule.LoadError: Plugin must export a default definition with an id and an effect or setup function. (cause: SchemaError(Missing key at ["default"]))
  • Root cause verified against the installed package:
    • package.json declares the V1 hook manifest "hooks": ["chat.message", "permission.ask", "event"]
    • dist/index.js exports only a named SupermemoryPlugin (V1 @opencode-ai/plugin API, ^1.0.162) and has no export default for the V2 API (@opencode/plugin)
  • Auth/CLI works fine (npx opencode-supermemory@latest login succeeds); only the plugin module is rejected.

This blocks all V2 users today — memory features are completely unavailable. I run V2 daily and can
test any branch immediately; happy to help verify the /v2 entrypoint once it's ready to merge.

@ishaanxgupta

Copy link
Copy Markdown
Contributor Author

Hi @FoTrix yes we are shipping plugin compatibility for opencode-v2 soon!

OpenCode 2 rejects the V1 root export, so 2.0.13 fails to load for every
OpenCode 2 user (#74). Ship a server plugin at `opencode-supermemory/server`
(resolved automatically by OpenCode 2), a `./tui` companion that renders
activity notices as toasts, and a shared `./rpc` contract, while keeping the
root export unchanged for OpenCode V1.

The V2 runtime mirrors main's V1 behavior: direct/advisory/off recall with
per-session dedupe and 3s fail-open timeouts, first-message profile context,
keyword nudges, the shared `supermemory` tool plus a read-only
`supermemory_recall` tool that the installer auto-allows, bounded and
idempotent automatic capture from the session transcript, native compaction
enrichment with summary capture (`compactionEnabled`), update checks, and
activity notices over plugin RPC. Recall context is re-applied on every model
call for the same prompt because OpenCode 2 hook messages are request-local.

Shared services now back both generations: the tool executor, compaction
prompt, activity notice formatting, and a comment-preserving JSONC editor that
registers `plugin`, `plugins`, and the recall permission. The installer and
`status` report both registrations.

Also fix the `src/cli.ts` typecheck failure that blocked the 2.0.14 release,
import jsonc-parser's ESM build so bundles load under Node and Bun, run tests
in the release workflow, and bump to 2.0.15.
@ishaanxgupta ishaanxgupta changed the title opencode v2 Add OpenCode 2 plugin with full feature parity Sep 23, 2026
PR #81 added the footer but was merged into graphite-base/81 instead of
main, so it never shipped. Fold it into one `./tui` module that OpenCode V1
loads through tui.jsonc (`tui()`) and OpenCode 2 loads automatically next to
the server plugin (`setup()`). Both show `◪ supermemory · running` while a
session is busy and the latest recall or save activity otherwise; OpenCode 2
also renders the server's activity notices as toasts from the same plugin.

The installer enables the V1 footer in tui.jsonc, `status` reports it, and
direct-recall parts carry recall metadata so the V1 footer can read them.
The prompt footer is rendered on the home screen too, so the extra
home.footer.status slot duplicated the footer.
@ishaanxgupta

Copy link
Copy Markdown
Contributor Author
image

@Dhravya
Dhravya merged commit dee043f into main Sep 26, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants