opencode v2

[ishaanxgupta]

Summary

• ship a new opencode-supermemory/v2 entrypoint while keeping the existing V1 root export unchanged
• implement the OpenCode 2 context hook, search-only recall helper, message cache, automatic capture, native compaction events, event dedupe, and non-blocking cleanup

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​opencode-ai/​plugin@​1.0.191 ⏵ 0.0.0-beta-17728	-1		+5
	jsonc-parser@​3.3.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm json-schema is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@opencode-ai/plugin@0.0.0-beta-17728 → npm/json-schema@0.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rimraf is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@opencode-ai/plugin@0.0.0-beta-17728 → npm/rimraf@5.0.10 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rimraf@5.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[FoTrix]

Same problem here, confirming from a production install:

• opencode v2.0.3 (latest), opencode-supermemory@2.0.13 (latest as of today), macOS, Node v24.16.0
• opencode plugin list shows the entry with no version/source; every server start logs:
  PluginModule.LoadError: Plugin must export a default definition with an id and an effect or setup function. (cause: SchemaError(Missing key at ["default"]))
• Root cause verified against the installed package:
  • package.json declares the V1 hook manifest "hooks": ["chat.message", "permission.ask", "event"]
  • dist/index.js exports only a named SupermemoryPlugin (V1 @opencode-ai/plugin API, ^1.0.162) and has no export default for the V2 API (@opencode/plugin)
• Auth/CLI works fine (npx opencode-supermemory@latest login succeeds); only the plugin module is rejected.

This blocks all V2 users today — memory features are completely unavailable. I run V2 daily and can
test any branch immediately; happy to help verify the /v2 entrypoint once it's ready to merge.