@bybrawe/opencode-loop 0.6.3 → 0.6.5

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.6.5 - 2026-10-02
+
+- Audit the native OpenCode 2 package contract against `@opencode/plugin@2.0.22` and pin the production SDK/runtime dependency to exact 2.0.22.
+- Preserve the exact OpenCode 2.0.18 native pair as a backwards-compatibility gate while also requiring the moving latest-host pair; the real latest gate passes on OpenCode 2.0.22.
+- Keep Ubuntu and Windows native bundle, regression, package-smoke, real-adapter, V1 peer-compatibility, and Loop+Goal coexistence gates green with the 2.0.22 dependency graph.
+- Pair the release with Goal 1.3.44, which carries the same SDK audit plus persisted execution-ownership recovery and current OpenTUI peer alignment.
+
+## 0.6.4 - 2026-10-02
+
+- Persist OpenCode 2 native plugin configuration as one canonical plural `plugins` list instead of leaving valid legacy `plugin` entries in a parallel top-level block.
+- Mirror OpenCode 2.0.21 normalization semantics: strings remain strings and valid legacy `[package, options]` tuples become native `{ package, options }` entries in order ahead of existing native registrations.
+- Preserve malformed/unrecognized legacy entries and unrelated provider/model configuration instead of deleting or rewriting user-owned settings.
+- Pin `@opencode/plugin` to exact 2.0.18 so package resolution and CI/release builds cannot drift to a newer SDK with a different peer graph.
+- Replace a 25 ms blocked-shell test race with deterministic state waiting and update Goal+Loop installer regressions for the canonical single-list configuration.
+- Remove the redundant post-publish `npm view` cache check; the retrying direct registry verifier already proves exact version, gitHead and latest tag.
+
 ## 0.6.3 - 2026-10-02
 
 - Fix native OpenCode 2 fresh installs on Windows/Linux by registering the exact published Loop package in plural `plugins` instead of copying a loose global `plugins/opencode-loop` directory.

package/README.md

@@ -1,10 +1,10 @@
 # OpenCode Loop
 
-## Native OpenCode 2 (0.6.3)
+## Native OpenCode 2 (0.6.5)
 
 The npm and V2 entrypoints use the official `@opencode/plugin` `Plugin.define()` contract. The installer now registers the exact `@bybrawe/opencode-loop` package in OpenCode's plural `plugins` configuration instead of copying a loose global plugin directory. OpenCode therefore resolves `@opencode/plugin` from Loop's own production dependency graph; explicit `--legacy-v1` remains a separate compatibility path.
 
-The installer defaults to the native V2 package plugin. It needs no loose local V2 copy, V1 SDK, or legacy command files. Existing npm registrations migrate from `plugin` to `plugins` without dropping object options, and 0.6.1/0.6.2 loose `plugins/opencode-loop` installs are removed on update. Use `--legacy-v1` explicitly for the compatibility installation.
+The installer defaults to the native V2 package plugin. It needs no loose local V2 copy, V1 SDK, or legacy command files. Valid legacy `plugin` registrations are now persisted into the single native `plugins` list using OpenCode 2.0.21's own normalization semantics, so native installs no longer leave parallel `plugin` and `plugins` blocks. Object options and entry order are preserved, malformed legacy values are left untouched, and unrelated provider/model settings are not rewritten. Existing 0.6.1/0.6.2 loose `plugins/opencode-loop` installs are still removed on update. Use `--legacy-v1` explicitly for the compatibility installation.
 
 V2 prompt admission and durable inbox/execution/compaction events own scheduling. Core-generated user-role messages never authorize a session abort. An unfinished dedicated Goal reserves its session, including paused and handed-off states; Loop does not wake or replace that Goal. Soft iteration timeouts do not abort a native model/tool/compaction turn.
 
@@ -17,7 +17,7 @@ Prompt/command timers, watch and stop conditions, verification, preflight/postru
 
 OpenCode Loop adds `/loop`, scheduled prompt/command/shell jobs, compact scheduling, verification/checkpoints, and the `opencode-loopd` background daemon.
 
-> **Current stable release: `0.6.3`.**
+> **Current stable release: `0.6.5`.**
 
 ## Install or update
 
@@ -42,7 +42,7 @@ This is the recommended split for OpenCode 2:
 - `--loop-only` prevents the Loop installer from installing/updating the Goal companion.
 - `--without-loop-goals` removes only Loop's older experimental `/loop-goal*` command files; it does not remove the dedicated OpenCode Goal plugin.
 
-Run the same two commands again to update both packages. Loop 0.6.3 also migrates the earlier 0.6.1/0.6.2 loose global V2 install that could fail with `Cannot find package '@opencode/plugin'`; the update removes that loose copy and pins the published package in `plugins` instead. Then **fully restart OpenCode** and verify:
+Run the same two commands again to update both packages. Loop 0.6.4 also canonicalizes valid legacy `plugin` entries into the native `plugins` list; earlier 0.6.1/0.6.2 loose global V2 installs are removed and replaced by the pinned published package. Then **fully restart OpenCode** and verify:
 
 ```text
 /goal status

package/examples/OPENCODE2-0.6.4.md

@@ -0,0 +1,42 @@
+# OpenCode Loop 0.6.4
+
+OpenCode 2 configuration canonicalization patch, paired with OpenCode Goal 1.3.43.
+
+## One native plugin list
+
+OpenCode 2.0.21's runtime schema uses the plural `plugins` field and its
+normalizer accepts the legacy singular `plugin` field for compatibility. Loop
+now persists the same normalization during a native V2 install.
+
+For valid legacy entries:
+
+- strings stay strings;
+- `[package, options]` tuples become `{ "package": "...", "options": { ... } }`;
+- migrated legacy entries retain their order ahead of existing native entries;
+- Loop's own registration is de-duplicated and pinned to the exact package version;
+- the old `plugin` property is removed when it becomes empty.
+
+Malformed or unrecognized legacy entries are preserved. Loop does not rewrite
+unrelated `provider`, `providers`, `model`, or other user configuration.
+
+## Deterministic runtime dependency
+
+The production `@opencode/plugin` dependency is pinned to exact 2.0.18. This
+prevents npm dependency drift from silently changing Loop's V2 runtime contract.
+
+## Upgrade
+
+```sh
+npx -y @bybrawe/opencode-goal@1.3.43
+npx -y @bybrawe/opencode-loop@0.6.4 --loop-only --without-loop-goals
+```
+
+Then fully restart OpenCode and verify:
+
+```text
+/goal status
+/loop-help
+/loop-doctor
+```
+
+The update preserves Loop project state and user-authored command files.

package/examples/OPENCODE2-0.6.5.md

@@ -0,0 +1,42 @@
+# OpenCode Loop 0.6.5
+
+OpenCode 2.0.22 SDK-contract patch, paired with OpenCode Goal 1.3.44.
+
+## OpenCode 2.0.22 runtime contract
+
+Loop's production `@opencode/plugin` dependency is pinned to exact 2.0.22. The
+lockfile carries the matching `@opencode/{ai,client,protocol,schema,util}` runtime
+closure so clean installs and release builds use the same native contract.
+
+The moving real-host gate loads Loop main and the Goal companion together on
+OpenCode 2.0.22. The exact OpenCode 2.0.18 native pair remains in CI as a
+backwards-compatibility contract rather than being replaced by the current-host
+check.
+
+## Validation
+
+The release candidate is gated by:
+
+- Ubuntu and Windows native bundle/regression/package-smoke jobs;
+- the real OpenCode 2 adapter;
+- exact OpenCode 2.0.18 Loop+Goal coexistence;
+- latest OpenCode 2.0.22 Loop+Goal coexistence;
+- OpenCode 1 peer-compatibility tests.
+
+## Upgrade
+
+```sh
+npx -y @bybrawe/opencode-goal@1.3.44
+npx -y @bybrawe/opencode-loop@0.6.5 --loop-only --without-loop-goals
+```
+
+Then fully restart OpenCode and verify:
+
+```text
+/goal status
+/loop-help
+/loop-doctor
+```
+
+Loop state, installer canonicalization, V1 compatibility, and the host-owned
+automatic compaction boundary are unchanged by this SDK patch.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bybrawe/opencode-loop",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Claude Code/Codex style /loop and experimental goal mode for OpenCode: heartbeat scheduler, idle-safe loops, scheduled commands, compact scheduling, verification, checkpoints, and persistent coding goals.",
   "type": "module",
   "main": "src/plugin.js",
@@ -75,6 +75,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@opencode/plugin": "^2.0.18"
+    "@opencode/plugin": "2.0.22"
   }
 }

package/scripts/comprehensive-test.mjs

@@ -348,12 +348,14 @@ async function testActionRoutingAndSafety() {
   try {
     await h.command("loop-shell", "0s --safe Remove-Item -Recurse ./important")
     await h.command("loop-now", "shell")
-    await delay(25)
+    const state = await waitForValue(async () => {
+      const candidate = await h.readState()
+      return candidate.jobs[0]?.paused === true && candidate.jobs[0]?.lastFailureReason === "safe_shell_blocked" ? candidate : undefined
+    }, 2_000)
     assert.equal(h.records.shells.length, 0)
-    const state = await h.readState()
-    assert.equal(state.jobs[0].paused, true, "a blocked synchronous action must pause instead of retrying forever")
-    assert.equal(state.jobs[0].failureCount, 1)
-    assert.equal(state.jobs[0].lastFailureReason, "safe_shell_blocked")
+    assert.equal(state?.jobs[0]?.paused, true, "a blocked synchronous action must pause instead of retrying forever")
+    assert.equal(state?.jobs[0]?.failureCount, 1)
+    assert.equal(state?.jobs[0]?.lastFailureReason, "safe_shell_blocked")
 
     await h.command("loop-clear")
     await h.command("loop-shell", "0s --safe rm -r -f ./important")

package/scripts/install-node.mjs

@@ -206,6 +206,53 @@ function findRootProperty(source, propertyName) {
   }
 }
 
+function removeRootProperty(source, propertyName) {
+  let index = skipTrivia(source, 0)
+  if (source[index] !== "{") throw new Error("OpenCode config must contain one root object")
+  index++
+  let previousComma
+
+  while (true) {
+    index = skipTrivia(source, index)
+    if (source[index] === "}") return source
+
+    const keyStart = index
+    const key = readJsonString(source, keyStart)
+    index = skipTrivia(source, key.end)
+    if (source[index] !== ":") throw new Error(`expected ':' after config property ${key.value}`)
+    const valueStart = skipTrivia(source, index + 1)
+    const valueEnd = skipJsonValue(source, valueStart)
+    const afterValue = skipTrivia(source, valueEnd)
+    const hadComma = source[afterValue] === ","
+
+    if (key.value === propertyName) {
+      if (hadComma) return `${source.slice(0, keyStart)}${source.slice(afterValue + 1)}`
+      if (previousComma !== undefined) return `${source.slice(0, previousComma)}${source.slice(valueEnd)}`
+      return `${source.slice(0, keyStart)}${source.slice(valueEnd)}`
+    }
+
+    if (hadComma) {
+      previousComma = afterValue
+      index = afterValue + 1
+      continue
+    }
+    if (source[afterValue] === "}") return source
+    throw new Error(`expected ',' or '}' after config property ${key.value}`)
+  }
+}
+
+function migrateLegacyPluginEntry(value) {
+  // Mirrors OpenCode 2.0.21 config normalization: strings stay strings and
+  // legacy [package, options] tuples become native { package, options } entries.
+  if (typeof value === "string") return value
+  if (Array.isArray(value)) {
+    if (value.length !== 2 || typeof value[0] !== "string" || !value[1] || typeof value[1] !== "object" || Array.isArray(value[1])) return undefined
+    return { package: value[0], options: value[1] }
+  }
+  if (value && typeof value === "object" && !Array.isArray(value) && typeof value.package === "string") return value
+  return undefined
+}
+
 function formatPluginArray(values, indent, eol) {
   if (!values.length) return "[]"
   const childIndent = `${indent}  `
@@ -263,11 +310,13 @@ async function configurePackagePlugin() {
       for (const key of ["plugin", "plugins"]) {
         if (parsed[key] !== undefined && !Array.isArray(parsed[key])) throw new Error(`OpenCode config '${key}' must be an array`)
       }
+
       let updated = source
       const own = [...(parsed.plugins || []), ...(parsed.plugin || [])].filter(isPackageSpec)
-      if (own.length) {
-        configured = true
-        if (legacyV1) {
+      if (own.length) configured = true
+
+      if (legacyV1) {
+        if (own.length) {
           for (const key of ["plugin", "plugins"]) {
             const entries = parsed[key] || []
             const matching = entries.filter(isPackageSpec)
@@ -275,17 +324,40 @@ async function configurePackagePlugin() {
             const pinned = pinRegistration(matching)
             updated = rewriteExistingPluginArray(updated, [...entries.filter((entry) => !isPackageSpec(entry)), pinned], key)
           }
-        } else {
-          const pinned = pinRegistration(own)
-          if (Array.isArray(parsed.plugin) && parsed.plugin.some(isPackageSpec)) {
-            updated = rewriteExistingPluginArray(updated, parsed.plugin.filter((entry) => !isPackageSpec(entry)), "plugin")
-          }
-          const next = [...(parsed.plugins || []).filter((entry) => !isPackageSpec(entry)), pinned]
-          updated = parsed.plugins === undefined
+        }
+      } else {
+        // Persist OpenCode 2.0.21's compatibility normalization so users do not
+        // accumulate parallel plugin/plugins blocks. Valid legacy entries move
+        // to native plugins in the same order; invalid values stay untouched.
+        const legacyEntries = parsed.plugin || []
+        const migratedLegacy = []
+        const retainedLegacy = []
+        for (const entry of legacyEntries.filter((entry) => !isPackageSpec(entry))) {
+          const migrated = migrateLegacyPluginEntry(entry)
+          if (migrated === undefined) retainedLegacy.push(entry)
+          else migratedLegacy.push(migrated)
+        }
+        if (legacyEntries.length) {
+          updated = retainedLegacy.length
+            ? rewriteExistingPluginArray(updated, retainedLegacy, "plugin")
+            : removeRootProperty(updated, "plugin")
+        }
+
+        const current = parseJsonc(updated)
+        const nativeEntries = current.plugins || []
+        if (!Array.isArray(nativeEntries)) throw new Error("OpenCode config 'plugins' must be an array")
+        const next = [
+          ...migratedLegacy,
+          ...nativeEntries.filter((entry) => !isPackageSpec(entry)),
+          ...(own.length ? [pinRegistration(own)] : []),
+        ]
+        if (migratedLegacy.length || own.length) {
+          updated = current.plugins === undefined
             ? appendPluginProperty(updated, next, "plugins")
             : rewriteExistingPluginArray(updated, next, "plugins")
         }
       }
+
       parseJsonc(updated)
       plans.push({ target, source, updated })
     } catch (error) {

package/scripts/native-guide-test.mjs

@@ -24,7 +24,10 @@ try {
   assert.deepEqual(JSON.parse(await readFile(file, "utf8")).plugin, [other, [spec, options]])
   result = run()
   assert.equal(result.status, 0, result.stderr)
-  assert.deepEqual(JSON.parse(await readFile(file, "utf8")), { plugin: [other], plugins: [{ package: spec, options }] })
+  assert.deepEqual(JSON.parse(await readFile(file, "utf8")), { plugins: [
+    { package: "other-plugin", options: { enabled: false } },
+    { package: spec, options },
+  ] })
   const migrated = await readFile(file, "utf8")
   assert.equal(run().status, 0)
   assert.equal(await readFile(file, "utf8"), migrated)

package/scripts/native-install-pair-test.mjs

@@ -47,8 +47,9 @@ try {
   run(config, ["--with-goals", "--without-loop-goals"])
   let source = await readFile(path.join(config, "opencode.json"), "utf8")
   let parsed = JSON.parse(source)
-  assert.deepEqual(parsed.plugin, ["other-plugin"])
-  assert.equal(parsed.plugins.length, 2)
+  assert.equal("plugin" in parsed, false)
+  assert.equal(parsed.plugins.length, 3)
+  assert.ok(parsed.plugins.includes("other-plugin"))
   assert.deepEqual(parsed.plugins.find((item) => item.package?.startsWith("@bybrawe/opencode-goal@")).options, options)
   assert.deepEqual(parsed.plugins.find((item) => item.package?.startsWith("@bybrawe/opencode-loop@")).options, { quiet: true })
   assert.equal(await readFile(path.join(config, "commands/goal.md"), "utf8"), "Custom Goal command\n")
@@ -66,8 +67,9 @@ try {
   assert.deepEqual((await readFile(targetLog, "utf8")).trim().split('\n').map((line) => JSON.parse(line)), ["2.0.0", "2.0.0", "1.0.0"])
   run(config, ["--uninstall"])
   parsed = JSON.parse(await readFile(path.join(config, "opencode.json"), "utf8"))
-  assert.equal(parsed.plugins.length, 1, "Loop uninstall cannot remove the companion")
-  assert.ok(parsed.plugins[0].package.startsWith("@bybrawe/opencode-goal@"))
+  assert.equal(parsed.plugins.length, 2, "Loop uninstall cannot remove the companion or unrelated plugins")
+  assert.ok(parsed.plugins.includes("other-plugin"))
+  assert.ok(parsed.plugins.some((item) => item?.package?.startsWith("@bybrawe/opencode-goal@")))
   assert.equal(await readFile(state, "utf8"), '{"evidence":"unchanged"}\n')
   console.log("Native Goal+Loop installer pair: dialect, options, idempotence, custom files and uninstall PASS")
 } finally { await rm(temp, { recursive: true, force: true }) }

package/scripts/native-install-test.mjs

@@ -64,7 +64,30 @@ try {
 
   const both = await config("both", { plugin: ["legacy-unrelated", "@bybrawe/opencode-loop@old"], plugins: [options, "native-unrelated"] })
   run(both)
-  assert.deepEqual(await readConfig(both), { plugin: ["legacy-unrelated"], plugins: ["native-unrelated", { ...options, package: spec }] })
+  assert.deepEqual(await readConfig(both), { plugins: ["legacy-unrelated", "native-unrelated", { ...options, package: spec }] })
+  cases++
+
+  const userLegacy = await config("user-legacy", {
+    $schema: "https://opencode.ai/config.json",
+    plugin: [
+      "opencode-antigravity-auth@beta",
+      "@tarquinen/opencode-dcp@latest",
+      "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git",
+    ],
+    provider: { google: { models: { demo: { name: "Demo" } } } },
+    model: "",
+  })
+  run(userLegacy)
+  const canonicalUser = await readConfig(userLegacy)
+  assert.equal("plugin" in canonicalUser, false)
+  assert.deepEqual(canonicalUser.plugins, [
+    "opencode-antigravity-auth@beta",
+    "@tarquinen/opencode-dcp@latest",
+    "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git",
+    spec,
+  ])
+  assert.deepEqual(canonicalUser.provider, { google: { models: { demo: { name: "Demo" } } } })
+  assert.equal(canonicalUser.model, "")
   cases++
 
   const jsonc = await config("jsonc", '{\r\n  // keep-before\r\n  "theme": "url://example",\r\n  "plugin": ["@bybrawe/opencode-loop@old"] // keep-after\r\n}\r\n')

package/scripts/native-release.mjs

@@ -7,12 +7,12 @@ export function validateRelease(request, pkg, env) {
   assert.equal(env.GITHUB_REPOSITORY, "ByBrawe/opencode-loop", "wrong release repository")
   assert.equal(env.GITHUB_REF, "refs/heads/main", "npm release must come from main")
   assert.match(env.GITHUB_SHA ?? "", /^[a-f0-9]{40}$/, "immutable release SHA required")
-  assert.equal(request?.version, "0.6.3", "release version is not authorized")
+  assert.equal(request?.version, "0.6.5", "release version is not authorized")
   assert.equal(request?.name, "@bybrawe/opencode-loop")
   assert.equal(pkg.name, request.name)
   assert.equal(pkg.version, request.version)
-  assert.equal(request.predecessor, "0.6.2")
-  assert.equal(request.goal?.version, "1.3.42")
+  assert.equal(request.predecessor, "0.6.4")
+  assert.equal(request.goal?.version, "1.3.44")
   assert.match(request.goal?.sha ?? "", /^[a-f0-9]{40}$/)
   return request
 }

package/scripts/publish-workflow-test.mjs

@@ -24,12 +24,12 @@ assert.match(workflow, /windows-latest/)
 assert.match(workflow, /Decide whether npm publish is needed/)
 assert.match(workflow, /steps\.npm-state\.outputs\.publish == 'true'/)
 assert.match(workflow, /for attempt in \{1\.\.60\}/)
-assert.match(workflow, /--registry=https:\/\/registry\.npmjs\.org/)
+assert.doesNotMatch(workflow, /npm view @bybrawe\/opencode-loop@latest/, "direct registry verification already checks latest; do not add a stale npm-view cache gate")
 assert.match(workflow, /native-release\.mjs verify/)
 assert.match(workflow, /node_modules\/@bybrawe\/opencode-loop\/scripts\/opencode2-loop-canary.mjs/)
 assert.match(workflow, /node_modules\/@bybrawe\/opencode-goal\/dist\/server.js/)
 assert.match(workflow, /ref: \$\{\{ steps.release.outputs.goal_sha \}\}/)
-assert.match(workflow, /npm install --no-save --legacy-peer-deps @opencode\/plugin@2\.0\.18/, "immutable Goal companion must build against its pinned OpenCode 2.0.18 plugin contract")
+assert.match(workflow, /npm install --no-save --legacy-peer-deps @opencode\/plugin@2\.0\.22/, "immutable Goal companion must build against its pinned OpenCode 2.0.22 plugin contract")
 assert.match(nativeV2Workflow, /npm install --no-save --legacy-peer-deps @opencode\/plugin@2\.0\.18/, "Native V2 CI must pin the immutable Goal companion to the same OpenCode 2.0.18 plugin contract")
 assert.doesNotMatch(workflow, /secrets\.NPM_TOKEN/)
 
@@ -44,14 +44,14 @@ const publisher = workflow.slice(workflow.indexOf("  publish:\n"), workflow.inde
 assert.doesNotMatch(publisher, /contents:\s*write/, "OIDC publisher must not gain repository mutation privileges")
 
 const sha = "a".repeat(40)
-const request = { name: "@bybrawe/opencode-loop", version: "0.6.3", predecessor: "0.6.2", goal: { version: "1.3.42", sha: "b".repeat(40) } }
+const request = { name: "@bybrawe/opencode-loop", version: "0.6.5", predecessor: "0.6.4", goal: { version: "1.3.44", sha: "b".repeat(40) } }
 const pkg = { name: request.name, version: request.version }
 const env = { GITHUB_REPOSITORY: "ByBrawe/opencode-loop", GITHUB_REF: "refs/heads/main", GITHUB_SHA: sha }
 assert.strictEqual(validateRelease(request, pkg, env), request)
 for (const change of [{ GITHUB_REPOSITORY: "someone/fork" }, { GITHUB_REF: "refs/heads/release" }, { GITHUB_SHA: "main" }]) assert.throws(() => validateRelease(request, pkg, { ...env, ...change }))
 assert.throws(() => validateRelease({ ...request, version: "9.0.0" }, pkg, env))
-assert.throws(() => validateRelease(request, { ...pkg, version: "0.6.2" }, env))
-assert.equal(releaseDecision(404, null, request, sha, "0.6.2"), true)
+assert.throws(() => validateRelease(request, { ...pkg, version: "0.6.4" }, env))
+assert.equal(releaseDecision(404, null, request, sha, "0.6.4"), true)
 for (const status of [401, 403, 429, 500, 503]) assert.throws(() => releaseDecision(status, null, request, sha, "0.6.0"))
 assert.throws(() => releaseDecision(404, null, request, sha, "0.7.0"))
 const manifest = { ...pkg, gitHead: sha }