8000 opencode: 1.19.4 -> 2.2.5 (CLI moved to packages/cli; triage pkgscan FP) by bryan-minimal · Pull Request #1264 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

opencode: 1.19.4 -> 2.2.5 (CLI moved to packages/cli; triage pkgscan FP) - #1264

Merged
bryan-minimal merged 1 commit into
mainfrom
opencode-fix-cli-pkg
Nov 2, 2026
Merged

opencode: 1.19.4 -> 2.2.5 (CLI moved to packages/cli; triage pkgscan FP)#1264
bryan-minimal merged 1 commit into
mainfrom
opencode-fix-cli-pkg

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Nov 2, 2026
Copy link
Copy Markdown
Member

Why the bot could not bump this

pkgmgr has tried opencode 1.19.4 -> 2.2.5 since 2026-10-31 and aborted each time. Runner execution pkgmgr-runner-tskh4:

2026-10-31T05:36:12Z updater: build.sh references `packages/opencode`, present in the OLD source tree but absent from the NEW one
2026-10-31T05:36:13Z update: ABORT — Critical pkgscan finding, refusing to open PR.
2026-10-31T05:36:30Z update_outcome action=failed reason="pkgscan Critical — needs --allow-critical-pkgscan to publish" to=2.2.5

Since then auto-fix has skipped it as in-flight, because the failed action state parks it.

There are two separate problems, and this PR fixes both.

1. pkgscan Critical (false positive)

I re-ran pkgmgr pkgscan diff opencode --old 1.19.4 --new 2.2.5 in the production runner image (pkgmgr:0b705d3-sc2e851aa, Cloud Build 2cfb3f5b). It found exactly three Criticals, all the same thing:

file line category pattern
packages/gui-plugins/src/browser/policy.test.ts 35, 36, 37 CredentialAccess .aws/credentials

Those lines are the negative cases of the GUI browser plugin's file-root sandbox test:

expect(fileURLWithin("file:///home/me/.aws/credentials", roots)).toBe(false)
expect(fileURLWithin("file:///home/me/repo/../.aws/credentials", roots)).toBe(false)
expect(fileURLWithin("file:///home/me/repo/out/%2e%2e/%2e%2e/.aws/credentials", roots)).toBe(false)

The file is a bun:test file, added in anomalyco/opencode#55246, and it is not in the CLI binary. It is recorded in pkgscan-allow.toml, pinned to the file's sha256 (03b90443…). That regrades the finding to Medium; it does not hide it. Every other finding in the diff is Info. The 10-31 run was 6.3h after the release, so the recency signal was Medium and was not the cause.

2. build.sh: the CLI moved

In opencode 2.x the CLI moved from packages/opencode to packages/cli, and script/build.ts now writes dist/cli-<os>-<arch>/bin/opencode. The old build.sh would have failed on cd packages/opencode. This PR follows upstream's nix/opencode.nix at v2.2.5, which runs the same bun --bun ./script/build.ts --single --skip-install in packages/cli and installs dist/cli-*/bin/opencode. Config and data paths (~/.config/opencode, ~/.local/share/opencode) are unchanged.

Review notes

  • This is a major version bump. On GitHub and on npm opencode-ai, the release marked "latest" is still 1.19.5. 2.x ships as @opencode/cli (latest = 2.2.5), and it is what upstream's README now tells users to install. 2.x drops the completion subcommand (it is now --completions). If we would rather stay on 1.x for now, close this PR and bump to 1.19.5 instead. The bot will keep offering 2.x either way.
  • sha256 04621edf6c47c2c7a36982ef39914d482c16977708fbd7b779f49f928bdc4fba is the GitHub tag archive for v2.2.5. The same download path reproduces the 1.19.4 pin byte-for-byte.
  • I have not built this locally. The build-bot / /build is the first real build.

🤖 Generated with Claude Code

@bryan-minimal @claude
opencode: 1.19.4 -> 2.2.5 (CLI moved to packages/cli; triage pkgscan FP)
427c78a 
The nightly bump has failed since 10-31 for two reasons:

- pkgscan gate: Critical CredentialAccess `.aws/credentials` in
  packages/gui-plugins/src/browser/policy.test.ts:35-37. These are the
  negative cases of a sandbox test (fileURLWithin must refuse the path,
  also via ../ and %2e%2e traversal). Recorded in pkgscan-allow.toml,
  pinned to the file's sha256.
- opencode 2.x moved the CLI from packages/opencode to packages/cli and
  build.ts now writes dist/cli-<os>-<arch>/, so build.sh would fail on
  `cd packages/opencode`. Follows upstream's nix/opencode.nix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal requested a review from a team as a code owner November 2, 2026 17:33
@coderabbitai
coderabbitai Bot commented Nov 2, 2026
Copy link
Copy Markdown
Contributor

Warning

Review limit reached

  • Run on-demand review

This review includes 3 billable files and costs up to $0.75.

  • Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 9 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 75 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

Run configuration
Commits

Reviewing files that changed from the base of the PR and between 4613142 and 427c78a.

Files selected for processing: 3
  • packages/opencode/build.ncl
  • packages/opencode/build.sh
  • packages/opencode/pkgscan-allow.toml
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

mitodrummer
mitodrummer approved these changes Nov 2, 2026
View reviewed changes
@mitodrummer mitodrummer left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The v2.2.5 tag archive hashes to 04621edf…4fba. packages/gui-plugins/src/browser/policy.test.ts hashes to the pinned 03b90443…4691, and lines 35-37 are the negative cases of a bun:test sandbox test. That test came in with #55246, and nothing in packages/cli imports it. The build change matches upstream: nix/opencode.nix at v2.2.5 runs the same build.ts in packages/cli, and build.ts names its output dir cli--. The build bot rebuilt opencode, and the smoketest passed on amd64 and arm64. This approval takes the 2.x line: upstream's GitHub release marked latest is still v1.19.5, so don't merge this if you want to stay on 1.x.

@mitodrummer mitodrummer mentioned this pull request Nov 2, 2026
Open
@bryan-minimal
bryan-minimal added this pull request to the merge queue Nov 2, 2026
Merged via the queue into main with commit dc569c2 Nov 2, 2026
13 checks passed
@bryan-minimal
bryan-minimal deleted the opencode-fix-cli-pkg branch November 2, 2026 22:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mitodrummer mitodrummer mitodrummer approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bryan-minimal @mitodrummer
0