@bybrawe/opencode-loop 0.6.2 → 0.6.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.6.3 - 2026-10-02
+
+- Fix native OpenCode 2 fresh installs on Windows/Linux by registering the exact published Loop package in plural `plugins` instead of copying a loose global `plugins/opencode-loop` directory.
+- Let OpenCode resolve `@opencode/plugin` from Loop's published production dependency graph, eliminating the reproduced `Cannot find package '@opencode/plugin'` startup failure from the 0.6.1/0.6.2 loose-install layout.
+- Automatically migrate known loose V2 Loop copies on update while preserving project Loop state, unrelated plugin registrations, JSONC comments and configured package options.
+- Add installer regressions for fresh package registration, idempotence and migration of a broken loose V2 copy.
+- Keep the dedicated OpenCode Goal 1.3.42 companion unchanged and retain explicit `--legacy-v1` as the isolated compatibility path.
+
 ## 0.6.2 - 2026-09-30
 
 - Conform the native OpenCode 2 runtime to the migration-guide location/options boundary: project scope comes only from `ctx.location.directory`; plugin `ctx.options` can no longer masquerade as project location.

package/README.md

@@ -1,10 +1,10 @@
 # OpenCode Loop
 
-## Native OpenCode 2 (0.6.2)
+## Native OpenCode 2 (0.6.3)
 
-The npm and local-file V2 entrypoints now use the official `@opencode/plugin` `Plugin.define()` contract. The local installer writes a discovered plugin package directory with the generated runtime as a supporting module, while explicit `--legacy-v1` remains a separate compatibility path.
+The npm and V2 entrypoints use the official `@opencode/plugin` `Plugin.define()` contract. The installer now registers the exact `@bybrawe/opencode-loop` package in OpenCode's plural `plugins` configuration instead of copying a loose global plugin directory. OpenCode therefore resolves `@opencode/plugin` from Loop's own production dependency graph; explicit `--legacy-v1` remains a separate compatibility path.
 
-The installer now defaults to the standalone native V2 plugin. It needs no V1 SDK or legacy command files for a local installation. Existing npm registrations migrate from `plugin` to `plugins` without dropping object options. Use `--legacy-v1` explicitly for the compatibility installation.
+The installer defaults to the native V2 package plugin. It needs no loose local V2 copy, V1 SDK, or legacy command files. Existing npm registrations migrate from `plugin` to `plugins` without dropping object options, and 0.6.1/0.6.2 loose `plugins/opencode-loop` installs are removed on update. Use `--legacy-v1` explicitly for the compatibility installation.
 
 V2 prompt admission and durable inbox/execution/compaction events own scheduling. Core-generated user-role messages never authorize a session abort. An unfinished dedicated Goal reserves its session, including paused and handed-off states; Loop does not wake or replace that Goal. Soft iteration timeouts do not abort a native model/tool/compaction turn.
 
@@ -17,32 +17,48 @@ Prompt/command timers, watch and stop conditions, verification, preflight/postru
 
 OpenCode Loop adds `/loop`, scheduled prompt/command/shell jobs, compact scheduling, verification/checkpoints, and the `opencode-loopd` background daemon.
 
-> **Current stable release: `0.6.2`.**
+> **Current stable release: `0.6.3`.**
 
 ## Install or update
 
-Recommended:
+### Recommended OpenCode 2 setup
+
+Install the dedicated Goal plugin first:
+
+```bash
+npx -y @bybrawe/opencode-goal@latest
+```
+
+Then install Loop by itself and disable Loop's older experimental Goal command files:
 
 ```bash
-npx -y @bybrawe/opencode-loop@latest
+npx -y @bybrawe/opencode-loop@latest --loop-only --without-loop-goals
 ```
 
-Run the same command again to update. Then **fully restart OpenCode** and verify:
+This is the recommended split for OpenCode 2:
+
+- **OpenCode Goal** owns `/goal`, durable outcome-driven work, evidence, verification, recovery, and semantic completion.
+- **OpenCode Loop** owns `/loop`, scheduling, repeated prompts/commands/shell work, and `opencode-loopd`.
+- `--loop-only` prevents the Loop installer from installing/updating the Goal companion.
+- `--without-loop-goals` removes only Loop's older experimental `/loop-goal*` command files; it does not remove the dedicated OpenCode Goal plugin.
+
+Run the same two commands again to update both packages. Loop 0.6.3 also migrates the earlier 0.6.1/0.6.2 loose global V2 install that could fail with `Cannot find package '@opencode/plugin'`; the update removes that loose copy and pins the published package in `plugins` instead. Then **fully restart OpenCode** and verify:
 
 ```text
+/goal status
 /loop-help
 /loop-doctor
 ```
 
-Install/update Loop and the dedicated Goals companion together:
+Convenience alternative: let the Loop installer also install/update the dedicated Goal companion:
 
 ```bash
 npx -y @bybrawe/opencode-loop@latest --with-goals --without-loop-goals
 ```
 
-`--without-loop-goals` removes only Loop's older experimental `/loop-goal*` command files. It keeps normal `/loop`, command/shell scheduling, daemon support, and the separate `/goal` plugin.
+For new OpenCode 2 installations, the explicit two-command setup above is preferred because ownership is clear and each package can be updated independently.
 
-Install only Loop and skip companion network work:
+Install only Loop without touching Goal:
 
 ```bash
 npx -y @bybrawe/opencode-loop@latest --loop-only

package/examples/OPENCODE2-0.6.3.md

@@ -0,0 +1,71 @@
+# OpenCode Loop 0.6.3
+
+OpenCode 2 installer dependency-resolution fix, paired with OpenCode Goal 1.3.42.
+
+## What changed
+
+OpenCode Loop now installs natively as an exact published package registration:
+
+```json
+{
+  "plugins": [
+    "@bybrawe/opencode-loop@0.6.3"
+  ]
+}
+```
+
+The default V2 installer no longer copies a loose global
+`~/.config/opencode/plugins/opencode-loop` package directory.
+
+This fixes the reproduced OpenCode 2.0.21 startup failure:
+
+```text
+Cannot find package '@opencode/plugin' imported from
+.../.config/opencode/plugins/opencode-loop/index.js
+```
+
+The V2 entrypoint still uses the official `@opencode/plugin`
+`Plugin.define({ id, setup })` contract. The difference is distribution:
+OpenCode now resolves the entrypoint and `@opencode/plugin` from the same
+published package dependency graph.
+
+## Upgrade behavior
+
+Running the 0.6.3 installer over 0.6.1/0.6.2 automatically:
+
+- adds or pins the exact Loop package in plural `plugins`;
+- removes known loose `plugins/opencode-loop`, `opencode-loop.ts` and
+  `opencode-loop.js` copies;
+- preserves unrelated plugin registrations and object options;
+- preserves project state under `.opencode/opencode-loop/`;
+- keeps explicit `--legacy-v1` behavior isolated.
+
+## Paired Goal release
+
+Publication remains paired with OpenCode Goal 1.3.42 from immutable source
+`1dd58abf1e7c08594c2085883e28acea3dbe0418`.
+
+## Verification
+
+The release gate runs Windows/Linux installer regressions, package smoke tests,
+exact-main CI, native V2 CI and the production Goal+Loop host pair before npm
+publication.
+
+Install or update:
+
+```sh
+npx -y @bybrawe/opencode-goal@1.3.42
+npx -y @bybrawe/opencode-loop@0.6.3 --loop-only --without-loop-goals
+```
+
+Then fully restart OpenCode and verify:
+
+```text
+/goal status
+/loop-help
+/loop-doctor
+```
+
+If OpenCode itself reports that managed service port 49374 is already in use,
+that is a host service collision rather than this plugin dependency bug. Stop or
+reconfigure the OpenCode service before testing the commands.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bybrawe/opencode-loop",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Claude Code/Codex style /loop and experimental goal mode for OpenCode: heartbeat scheduler, idle-safe loops, scheduled commands, compact scheduling, verification, checkpoints, and persistent coding goals.",
   "type": "module",
   "main": "src/plugin.js",

package/scripts/host-goal-coexistence-canary.mjs

@@ -10,6 +10,9 @@ import { fileURLToPath, pathToFileURL } from "node:url"
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const isWindows = process.platform === "win32"
+const SERVER_READY_TIMEOUT_MS = isWindows ? 60_000 : 30_000
+const API_BOOTSTRAP_TIMEOUT_MS = isWindows ? 90_000 : 30_000
+const PREWARM_TIMEOUT_MS = isWindows ? 120_000 : 60_000
 const GOAL_OBJECTIVE = "prove dedicated Goal owns continuation over Loop"
 const GOAL_PROMPT_MARKER = "Continue working toward the active OpenCode goal."
 const LOOP_PROMPT_MARKER = "AUTONOMOUS OPENCODE LOOP ITERATION"
@@ -301,28 +304,41 @@ async function main() {
   }
 
   try {
-    const prewarm = await runOpenCode(["debug", "config"], { cwd: workspace, env, timeoutMs: 60_000 })
+    const prewarm = await runOpenCode(["debug", "config"], { cwd: workspace, env, timeoutMs: PREWARM_TIMEOUT_MS })
     assert.match(prewarm.stdout, /\{[\s\S]*\}/, `OpenCode config prewarm returned no JSON\n${prewarm.stdout}\n${prewarm.stderr}`)
 
     const port = await reservePort()
     server = spawnOpenCode(["serve", "--hostname", "127.0.0.1", "--port", String(port)], { cwd: workspace, env })
     server.stdout?.on("data", (chunk) => { serverLog = appendLog(serverLog, chunk) })
     server.stderr?.on("data", (chunk) => { serverLog = appendLog(serverLog, chunk) })
-    await waitForTcp(port, server, () => serverLog)
+    await waitForTcp(port, server, () => serverLog, SERVER_READY_TIMEOUT_MS)
 
     const baseURL = `http://127.0.0.1:${port}`
     const directoryQuery = `directory=${encodeURIComponent(workspace)}`
     const api = async (pathname, init = {}) => {
       const separator = pathname.includes("?") ? "&" : "?"
-      const response = await fetch(`${baseURL}${pathname}${separator}${directoryQuery}`, {
-        ...init,
-        headers: { "content-type": "application/json", ...(init.headers ?? {}) },
-        signal: init.signal ?? AbortSignal.timeout(30_000),
-      })
-      const text = await response.text()
-      if (!response.ok) throw new Error(`HTTP ${response.status}: ${text}`)
-      if (!text) return null
-      try { return JSON.parse(text) } catch { return text }
+      const url = `${baseURL}${pathname}${separator}${directoryQuery}`
+      const ownTimeout = !init.signal
+      const timeoutMs = API_BOOTSTRAP_TIMEOUT_MS
+      try {
+        const response = await fetch(url, {
+          ...init,
+          headers: { "content-type": "application/json", ...(init.headers ?? {}) },
+          signal: init.signal ?? AbortSignal.timeout(timeoutMs),
+        })
+        const text = await response.text()
+        if (!response.ok) throw new Error(`HTTP ${response.status}: ${text}`)
+        if (!text) return null
+        try { return JSON.parse(text) } catch { return text }
+      } catch (error) {
+        const method = init.method ?? "GET"
+        const boundary = ownTimeout ? ` after ${timeoutMs}ms bootstrap timeout` : " with caller-owned signal"
+        throw new Error(
+          `OpenCode API ${method} ${pathname} failed${boundary}: ${error?.name ?? "Error"}: ${error?.message ?? error}\n`
+          + `provider=${JSON.stringify(provider.stats)}\nserver log:\n${serverLog}`,
+          { cause: error },
+        )
+      }
     }
 
     const sessionsPayload = await api("/session", { method: "GET" })

package/scripts/install-node.mjs

@@ -22,7 +22,7 @@ const installerArgs = rawInstallerArgs.filter((arg) => arg !== "--legacy-v1")
 const uninstallRequested = installerArgs.length === 1 && ["--uninstall", "uninstall", "--remove"].includes(installerArgs[0] || "")
 
 if (installerArgs.includes("--help") || installerArgs.includes("-h")) {
-  console.log(`OpenCode Loop installer/updater\n\nUsage:\n  opencode-loop\n  npx -y @bybrawe/opencode-loop@latest\n  npx -y @bybrawe/opencode-loop@latest --uninstall\n\nInstall/update defaults to native OpenCode 2: no V1 SDK or legacy command files are needed for a local install. Existing npm registrations are pinned to the exact version and migrated to plugins while retaining object options. Use --legacy-v1 to install the compatibility loader and legacy command files explicitly.\nUninstall removes Loop package registrations plus known local plugin/command/agent files while preserving project Loop state.\n\nSet OPENCODE_CONFIG_DIR to target a non-default OpenCode config directory.`)
+  console.log(`OpenCode Loop installer/updater\n\nUsage:\n  opencode-loop\n  npx -y @bybrawe/opencode-loop@latest\n  npx -y @bybrawe/opencode-loop@latest --uninstall\n\nInstall/update defaults to native OpenCode 2: the exact package version is registered in the plural plugins config so OpenCode resolves the package and its V2 runtime dependencies together. No loose local V2 plugin copy, V1 SDK, or legacy command files are needed. Existing npm registrations are pinned to the exact version and migrated to plugins while retaining object options. Use --legacy-v1 to install the compatibility loader and legacy command files explicitly.\nUninstall removes Loop package registrations plus known local plugin/command/agent files while preserving project Loop state.\n\nSet OPENCODE_CONFIG_DIR to target a non-default OpenCode config directory.`)
   process.exit(0)
 }
 
@@ -277,9 +277,13 @@ async function configurePackagePlugin() {
           }
         } else {
           const pinned = pinRegistration(own)
-          if (Array.isArray(parsed.plugin) && parsed.plugin.some(isPackageSpec)) updated = rewriteExistingPluginArray(updated, parsed.plugin.filter((entry) => !isPackageSpec(entry)), "plugin")
+          if (Array.isArray(parsed.plugin) && parsed.plugin.some(isPackageSpec)) {
+            updated = rewriteExistingPluginArray(updated, parsed.plugin.filter((entry) => !isPackageSpec(entry)), "plugin")
+          }
           const next = [...(parsed.plugins || []).filter((entry) => !isPackageSpec(entry)), pinned]
-          updated = parsed.plugins === undefined ? appendPluginProperty(updated, next, "plugins") : rewriteExistingPluginArray(updated, next, "plugins")
+          updated = parsed.plugins === undefined
+            ? appendPluginProperty(updated, next, "plugins")
+            : rewriteExistingPluginArray(updated, next, "plugins")
         }
       }
       parseJsonc(updated)
@@ -288,8 +292,35 @@ async function configurePackagePlugin() {
       if (error?.code !== "ENOENT") throw new Error(`Could not inspect ${target}: ${error.message}`)
     }
   }
+
+  // Native V2 installs are package registrations, not loose discovered copies.
+  // The published package owns @opencode/plugin as a production dependency, so
+  // OpenCode resolves the entrypoint and SDK from the same package install.
+  // This also migrates broken 0.6.1/0.6.2 loose installs on the next update.
+  if (!configured && !legacyV1) {
+    if (plans.length) {
+      const plan = plans[0]
+      const parsed = parseJsonc(plan.updated)
+      const entries = parsed.plugins || []
+      if (!Array.isArray(entries)) throw new Error("OpenCode config 'plugins' must be an array")
+      plan.updated = parsed.plugins === undefined
+        ? appendPluginProperty(plan.updated, [...entries, packageSpec], "plugins")
+        : rewriteExistingPluginArray(plan.updated, [...entries, packageSpec], "plugins")
+      parseJsonc(plan.updated)
+    } else {
+      const target = join(config, "opencode.json")
+      const updated = JSON.stringify({
+        $schema: "https://opencode.ai/config.json",
+        plugins: [packageSpec],
+      }, null, 2) + "\n"
+      plans.push({ target, source: "", updated })
+    }
+    configured = true
+  }
+
   // Validate every candidate before writing any config. Malformed later files
-  // must not leave the earlier file migrated and the plugin half-installed.
+  // must not leave an earlier file migrated and the plugin half-installed.
+  for (const plan of plans) parseJsonc(plan.updated)
   for (const plan of plans) if (plan.source !== plan.updated) await writeFile(plan.target, plan.updated, "utf8")
   return { configured, updatedFiles: plans.filter((plan) => plan.source !== plan.updated).map((plan) => plan.target) }
 }
@@ -367,14 +398,7 @@ async function installOrUpdate() {
     await copyFile(join(root, "src", "index.js"), join(pluginDir, "opencode-loop.ts"))
     await rm(join(pluginDir, "opencode-loop.js"), { force: true })
   } else {
-    // V2 local plugins use the same Plugin.define entrypoint as the npm package.
-    // Keep the generated native runtime beside it as a supporting module instead
-    // of auto-discovering that implementation object as a second plugin.
-    await rm(join(pluginDir, "opencode-loop.ts"), { force: true })
-    await rm(join(pluginDir, "opencode-loop.js"), { force: true })
-    await mkdir(nativePluginDir, { recursive: true })
-    await copyFile(join(root, "src", "v2.js"), join(nativePluginDir, "index.js"))
-    await copyFile(join(root, "src", "native.js"), join(nativePluginDir, "native.js"))
+    throw new Error("Native OpenCode 2 package registration was not created")
   }
   if (legacyV1) {
     await mkdir(commandDir, { recursive: true })
@@ -388,11 +412,11 @@ async function installOrUpdate() {
   if (packageConfig.configured) {
     const pinResult = packageConfig.updatedFiles.length ? `pinned the config entry to ${packageSpec}` : `the config entry is already pinned to ${packageSpec}`
     console.log(`OpenCode Loop is already configured as a package in ${config}; ${pinResult} and removed the duplicate local plugin copy.`)
-  } else console.log(`Installed OpenCode Loop plugin to ${legacyV1 ? join(pluginDir, "opencode-loop.ts") : nativePluginDir}`)
+  } else console.log(`Installed OpenCode Loop compatibility plugin to ${join(pluginDir, "opencode-loop.ts")}`)
   if (legacyV1) {
     console.log(`Installed ${packageName} commands to ${commandDir}`)
     console.log(`Installed ${packageName} local command agent to ${agentDir}`)
-  } else console.log("Native OpenCode 2 commands are registered by the plugin; no legacy command files or V1 SDK are needed for a local install.")
+  } else console.log("Native OpenCode 2 is registered as an exact package plugin; OpenCode resolves @opencode/plugin from the package dependency graph. No loose local plugin copy, legacy command files, or V1 SDK are needed.")
   console.log("Restart OpenCode, then run: /loop-help")
 }
 

package/scripts/native-install-test.mjs

@@ -28,22 +28,33 @@ try {
   run(fresh)
   const native = await readFile(path.join(root, "src/native.js"), "utf8")
   const v2 = await readFile(path.join(root, "src/v2.js"), "utf8")
-  assert.equal(await readFile(path.join(fresh, "plugins/opencode-loop/index.js"), "utf8"), v2)
-  assert.equal(await readFile(path.join(fresh, "plugins/opencode-loop/native.js"), "utf8"), native)
+  const readConfig = async (directory) => JSON.parse(await readFile(path.join(directory, "opencode.json"), "utf8"))
+  assert.deepEqual((await readConfig(fresh)).plugins, [spec])
   assert.match(v2, /from\s+["']@opencode\/plugin["']/)
   assert.match(v2, /Plugin\.define\s*\(/)
   assert.doesNotMatch(native, /(?:from\s*|import\s*\()["']@opencode-ai\/plugin/)
+  assert.equal(await exists(path.join(fresh, "plugins/opencode-loop")), false)
   assert.equal(await exists(path.join(fresh, "plugins/opencode-loop.ts")), false)
   assert.equal(await exists(path.join(fresh, "package.json")), false)
   assert.equal(await exists(path.join(fresh, "commands/loop.md")), false)
   assert.equal(await exists(path.join(fresh, "agents/opencode-loop-local.md")), false)
+  const freshBefore = await readFile(path.join(fresh, "opencode.json"), "utf8")
   run(fresh)
+  assert.equal(await readFile(path.join(fresh, "opencode.json"), "utf8"), freshBefore)
+  cases++
+
+  const brokenLoose = await config("broken-loose")
+  await mkdir(path.join(brokenLoose, "plugins/opencode-loop"), { recursive: true })
+  await writeFile(path.join(brokenLoose, "plugins/opencode-loop/index.js"), 'import { Plugin } from "@opencode/plugin"\nexport default Plugin.define({ id: "broken", setup() {} })\n')
+  await writeFile(path.join(brokenLoose, "plugins/opencode-loop/native.js"), "export default {}\n")
+  run(brokenLoose)
+  assert.deepEqual((await readConfig(brokenLoose)).plugins, [spec])
+  assert.equal(await exists(path.join(brokenLoose, "plugins/opencode-loop")), false, "native update must remove the old loose V2 copy that cannot resolve package dependencies")
   cases++
 
   const options = { package: "@bybrawe/opencode-loop@0.5.38", options: { quiet: true, nested: { value: "preserved" } }, enabled: true }
   const obj = await config("object", { plugins: ["other-plugin", options] })
   run(obj)
-  const readConfig = async (directory) => JSON.parse(await readFile(path.join(directory, "opencode.json"), "utf8"))
   assert.deepEqual((await readConfig(obj)).plugins, ["other-plugin", { ...options, package: spec }])
   const before = await readFile(path.join(obj, "opencode.json"), "utf8")
   run(obj)
@@ -88,8 +99,8 @@ try {
   run(upgrade)
   assert.equal(await exists(path.join(upgrade, "commands/loop.md")), false)
   assert.equal(await readFile(path.join(upgrade, "commands/loop-help.md"), "utf8"), "This is a custom user command; keep it.")
-  assert.equal(await readFile(path.join(upgrade, "plugins/opencode-loop/index.js"), "utf8"), v2)
-  assert.equal(await readFile(path.join(upgrade, "plugins/opencode-loop/native.js"), "utf8"), native)
+  assert.deepEqual((await readConfig(upgrade)).plugins, [spec])
+  assert.equal(await exists(path.join(upgrade, "plugins/opencode-loop")), false)
   assert.equal(await exists(path.join(upgrade, "plugins/opencode-loop.ts")), false)
   cases++
 

package/scripts/native-release.mjs

@@ -7,11 +7,11 @@ export function validateRelease(request, pkg, env) {
   assert.equal(env.GITHUB_REPOSITORY, "ByBrawe/opencode-loop", "wrong release repository")
   assert.equal(env.GITHUB_REF, "refs/heads/main", "npm release must come from main")
   assert.match(env.GITHUB_SHA ?? "", /^[a-f0-9]{40}$/, "immutable release SHA required")
-  assert.equal(request?.version, "0.6.2", "release version is not authorized")
+  assert.equal(request?.version, "0.6.3", "release version is not authorized")
   assert.equal(request?.name, "@bybrawe/opencode-loop")
   assert.equal(pkg.name, request.name)
   assert.equal(pkg.version, request.version)
-  assert.equal(request.predecessor, "0.6.1")
+  assert.equal(request.predecessor, "0.6.2")
   assert.equal(request.goal?.version, "1.3.42")
   assert.match(request.goal?.sha ?? "", /^[a-f0-9]{40}$/)
   return request

package/scripts/publish-workflow-test.mjs

@@ -6,6 +6,7 @@ import { validateRelease, releaseDecision, assertPublishedSource, waitForPublish
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const workflow = await readFile(path.join(repoRoot, ".github/workflows/publish-npm.yml"), "utf8")
+const nativeV2Workflow = await readFile(path.join(repoRoot, ".github/workflows/native-v2-ci.yml"), "utf8")
 assert.match(workflow, /ref:\s*\$\{\{ github\.sha \}\}/, "checkout must use the immutable trigger SHA")
 assert.doesNotMatch(workflow, /ref:\s*main\b/, "publication cannot checkout moving main")
 assert.match(workflow, /git merge-base --is-ancestor "\$GITHUB_SHA" origin\/main/)
@@ -28,6 +29,8 @@ assert.match(workflow, /native-release\.mjs verify/)
 assert.match(workflow, /node_modules\/@bybrawe\/opencode-loop\/scripts\/opencode2-loop-canary.mjs/)
 assert.match(workflow, /node_modules\/@bybrawe\/opencode-goal\/dist\/server.js/)
 assert.match(workflow, /ref: \$\{\{ steps.release.outputs.goal_sha \}\}/)
+assert.match(workflow, /npm install --no-save --legacy-peer-deps @opencode\/plugin@2\.0\.18/, "immutable Goal companion must build against its pinned OpenCode 2.0.18 plugin contract")
+assert.match(nativeV2Workflow, /npm install --no-save --legacy-peer-deps @opencode\/plugin@2\.0\.18/, "Native V2 CI must pin the immutable Goal companion to the same OpenCode 2.0.18 plugin contract")
 assert.doesNotMatch(workflow, /secrets\.NPM_TOKEN/)
 
 const publishIndex = workflow.indexOf("npm publish --access public")
@@ -41,14 +44,14 @@ const publisher = workflow.slice(workflow.indexOf("  publish:\n"), workflow.inde
 assert.doesNotMatch(publisher, /contents:\s*write/, "OIDC publisher must not gain repository mutation privileges")
 
 const sha = "a".repeat(40)
-const request = { name: "@bybrawe/opencode-loop", version: "0.6.2", predecessor: "0.6.1", goal: { version: "1.3.42", sha: "b".repeat(40) } }
+const request = { name: "@bybrawe/opencode-loop", version: "0.6.3", predecessor: "0.6.2", goal: { version: "1.3.42", sha: "b".repeat(40) } }
 const pkg = { name: request.name, version: request.version }
 const env = { GITHUB_REPOSITORY: "ByBrawe/opencode-loop", GITHUB_REF: "refs/heads/main", GITHUB_SHA: sha }
 assert.strictEqual(validateRelease(request, pkg, env), request)
 for (const change of [{ GITHUB_REPOSITORY: "someone/fork" }, { GITHUB_REF: "refs/heads/release" }, { GITHUB_SHA: "main" }]) assert.throws(() => validateRelease(request, pkg, { ...env, ...change }))
 assert.throws(() => validateRelease({ ...request, version: "9.0.0" }, pkg, env))
-assert.throws(() => validateRelease(request, { ...pkg, version: "0.6.1" }, env))
-assert.equal(releaseDecision(404, null, request, sha, "0.6.1"), true)
+assert.throws(() => validateRelease(request, { ...pkg, version: "0.6.2" }, env))
+assert.equal(releaseDecision(404, null, request, sha, "0.6.2"), true)
 for (const status of [401, 403, 429, 500, 503]) assert.throws(() => releaseDecision(status, null, request, sha, "0.6.0"))
 assert.throws(() => releaseDecision(404, null, request, sha, "0.7.0"))
 const manifest = { ...pkg, gitHead: sha }