OpenCode

On 20 October 2026, OpenCode 2.1.0 removed session.compacted from its public events. Older conversations remain readable without a database migration, while SDK and plugin integrations need updating. Before replacing your own agent loop with OpenCode, test the client and server together.

Install today: stable CLI V2 2.1.4 with npm install -g @opencode/cli@2.1.4. Desktop remains beta; CLI beta/dev builds are separate.

Client-hosted MCP is experimental, background summaries are opt-in, and the newer MCP protocol requires explicit configuration. Before upgrading an integration, test its changed SDK/plugin contracts. V1 migrants must preserve data, move essential CLAUDE.md fallback instructions to AGENTS.md, and supply their own compiler/lint/type checks. Restart the application after updating.

Avoid treating Plan or worktrees as a sandbox, installing the malicious third-party packages listed below, or using V1 worktree removal pending resolution.

Where it stands, 2026-10-24

OpenCode is a coding agent you can run directly or embed in another application: its SDK embeds its server without a network listener, and its network clients share an execution host. You own tool effects, client upgrades and final review.

Channel. Install stable V2 2.1.4, published on 23 October 2026, with npm install -g @opencode/cli@2.1.4. To stay on V1 for compatibility, use npm install -g opencode-ai@1.19.4. Both provide opencode: check which executable your terminal or editor launches and which server is running. At the 24 October read, GitHub Latest still selected V1.19.4; choose V2 by its package record and source tag.

Choose desktop and previews separately. At the separately timed 24 October reads, desktop latest advertised 2.1.4, but the product remains BETA. Its beta channel advertised 0.0.0-beta-21770. npm selected dev 0.0.0-dev-21769 and beta 0.0.0-beta-19507. Choose a build from its own channel’s version record.

What upgrading changes

Port the integration before upgrading its server. Provider replay fields now live under native, and credential setup answers under metadata. Test a saved conversation, tool call/result, compaction and provider switch on the installed client/server pair. Native compaction replay requires the same provider and model; switching falls back to original messages. Count that extra context when comparing costs.

Prepare V1 instructions and checks before migrating. V2 translates supported V1 configuration in memory, replaces global tui.json with cli.json, requires plugin ports, drops the CLAUDE.md fallback and does not run LSP diagnostics. Preserve V1 data, move essential rules to AGENTS.md, and run the project’s compiler, lint or typecheck. In 2.0.30, configured instruction files, globs and URLs began loading; OPENCODE_DISABLE_CLAUDE_CODE_SKILLS began excluding .claude skill roots. Test one instruction and one excluded skill after migration.

What to check before admitting tools

Treat a malicious-package match as a compromised host. Advisories cover all versions of seven third-party @beloved-lenora/ packages: opencode-shared-rpc, opencode-shell-guard, opencode-btw, opencode-stats, opencode-goal, opencode-todo and opencode-orchestrator. An eighth names specific opencode-skills-collection versions that can expose the machine and its keys. Check exact package names and versions. If they match, follow host-compromise handling and rotate keys from a separate clean computer. Removing the package alone may leave other malware behind.

Set containment before delegating. Base permissions broadly allow actions; Plan denies edit-tool actions outside its plan directory without denying shell. Custom child agents use their own permissions, so inspect each child’s rules. Enforce required filesystem, process and network limits separately through a container, VM or host policy: OpenCode supplies no sandbox.

Audit what scripted tools can change. MCP Code Mode is enabled by default. Nested read/edit/shell and MCP calls retain checks, while plugin tools enforce the permissions they assert. Session rename/move and worktree create/list request no built-in permission action; removal checks edit. Review the destination before moving a session.

Treat Always allow as project configuration. Approvals persist per project and configured denies precede saved allows. Policy can deny the result, with global and connected Console policy following project policy. Review saved grants and test an intended denial across direct tools, Code Mode, MCP and custom child agents on the installed versions. Admitted plugins run setup code when they load; decide which code to admit before trusting its permission assertions.

Who can reach the host and its credentials

Pair only clients that should control the execution host. Managed and foreground CLI servers generate or require passwords; OpenTunnel pairing reaches that server. Password rotation revokes browser sessions, while lower-level embeddings can omit password configuration. Set authentication explicitly for custom network embeddings.

Check the editor’s executable and directory grants. opencode acp starts a private server and persists additional-directory grants on the session. Pin the launched binary, test resume and approval delivery, and review those grants before reusing the session elsewhere.

Choose the execution host and who holds credentials together. V2 stores saved credentials in server SQLite, in a JSON-valued text column. Protect the data directory and credential exports. Optional Console routing holds upstream keys in its hosted gateway. To invalidate the key, revoke it at its upstream provider.

Pin the model route when data terms matter. Documented retention varies by model and service. When only free OpenCode models are available, default selection has preferred Big Pickle since 2.0.31. Use OPENCODE_DISABLE_FREE_MODELS=1 to exclude free OpenCode and Go models from defaults and fallbacks when those models are unsuitable.

What to test and maintain

Retest the human-input form that never arrived. In 2.1.4, MCP callbacks retain the context needed to deliver forms, and desktop/web render them. Upgrade both ends and test submission and rejection. An undelivered form can leave an MCP request waiting.

Keep client-hosted MCP in a pilot. 2.1.4 adds an experimental client helper and WebSocket endpoint. Pin both ends and test disconnect, reconnect and authorization before depending on local tools in a remote session. The newer MCP protocol remains an explicit configuration choice.

Try background summaries with a token budget. In 2.1.4, experimental.background_compaction: true is opt-in, holds speculative summaries in memory, spends tokens even when they go unused, and loses them on restart. Compaction can still wait for unfinished work. Compare stalls, total spend, lost constraints and completed work on one long task. This is a latency experiment. Keep a separate plan for recovering the job.

Restart the running application after updating. V2.1.3 and V1.19.4 bundle Bun 1.4.4, with runtime security fixes. Updating system Bun leaves the compiled application runtime in place. Retest long TUI calls and background jobs after V2.1.0’s TUI request repair and V2.1.2’s active-location protection.

Use reviewed files for conversation handoffs. V1.19.1 discontinued sharing and existing links; local unshare only clears metadata. V2.0.31 removed hidden compaction replay context from sanitized exports. Regenerate support exports on the current version and inspect them before sending.

Recheck Go limits before budgeting a run. The 21 October 2026 documentation change reduces Step 5 Preview allowances from $60 to $15 for Go and $240 to $60 for Go Plus. Check your workspace’s live model entitlement. The documentation does not establish when an account’s limits changed.

What is unresolved

• The net integration saving. Record a migration, then run fixed-task trials to see whether the reusable SDK saves more work than setup, recovery and review consume. Log exact versions, model, completion tests, human minutes and total inference spend.
• The reported Console incident. OpenCode said on 17 October 2026 that a breach tied to a large-scale distillation attack affected 1.4% of Console users, a subset with external providers linked, and that those users were notified by email. Beyond that notice, require a technical postmortem, affected-key criteria and upstream revocation guidance before acting. Gateway docs establish custody of linked keys; the mechanism and affected keys remain unconfirmed. Keep this inquiry separate from the third-party package advisories above.
• Remaining dependency exposure. 2.1.4 removes nested Seroval 1.3.2, but root 1.5.6 remains. A separate advisory covers CPU/memory exhaustion through malicious JSON in versions through 1.6.2. Inventory installed dependencies and audit reachable inputs to determine which deployed services are exposed.
• V1 destructive removal. CVE-2026-88624 describes directory deletion in V1.18.26; 1.19.4 still recursively cleans an existing directory absent from git’s worktree list. Gate removal pending a versioned reproduction and fixed-release mapping. V2 instead requires a stored worktree with a strategy; the V1 report does not establish an exposed V2 path.