@node9/proxy 1.24.2 → 1.25.0

package/dist/cli.js

@@ -6463,6 +6463,122 @@ var init_mcp_pin = __esm({
   }
 });
 
+// src/setup-opencode-shim.ts
+function renderOpencodeShim(input) {
+  const { node9Argv, version: version2 } = input;
+  return `// Auto-generated by \`node9 init\`. Do not edit \u2014 re-run init to upgrade.
+// NODE9_SHIM_VERSION = "${version2}"
+//
+// node9 protection shim for Opencode. Wires three hooks against the
+// agent's plugin API and shells out to the node9 CLI for verdicts.
+//
+// Block by throwing from a hook handler; Opencode's plugin trigger
+// (packages/opencode/src/plugin/index.ts:273) propagates the error and
+// halts the tool call.
+
+const { spawnSync } = require("node:child_process");
+
+// argv prefix for invoking the node9 CLI. argv[0] is the executable
+// (either the npm-installed wrapper script or the node binary); the
+// remaining entries (if any) are passed as the leading args before
+// the subcommand name (e.g. ["/path/to/dist/cli.js"] for dev mode).
+const NODE9_ARGV = ${JSON.stringify(node9Argv)};
+const HOOK_TIMEOUT_MS = 30000;
+const LOG_TIMEOUT_MS = 5000;
+
+function parseReason(stdout) {
+  // node9 check emits {decision, reason, message} JSON on stdout when
+  // blocking. Fall back to a generic string if anything goes wrong.
+  try {
+    const v = JSON.parse(stdout || "");
+    return v && (v.reason || v.message);
+  } catch (e) {
+    return null;
+  }
+}
+
+function extractPromptText(parts) {
+  // chat.message gives us parts: Part[]. We only DLP-scan text parts
+  // (image / tool_use parts can't contain pasted secrets in any form
+  // node9's scanner currently recognizes).
+  if (!Array.isArray(parts)) return "";
+  return parts
+    .filter((p) => p && p.type === "text")
+    .map((p) => (p && p.text) || "")
+    .join("\\n");
+}
+
+module.exports = {
+  id: "node9",
+  server: async (input) => ({
+    "tool.execute.before": async (ctx, mutable) => {
+      const payload = {
+        hook_event_name: "PreToolUse",
+        tool_name: ctx.tool,
+        tool_input: mutable.args,
+        session_id: ctx.sessionID,
+        cwd: input.directory,
+        meta: { agent: "Opencode" },
+      };
+      const r = spawnSync(NODE9_ARGV[0], [...NODE9_ARGV.slice(1), "check"], {
+        input: JSON.stringify(payload),
+        encoding: "utf-8",
+        timeout: HOOK_TIMEOUT_MS,
+      });
+      if (r.status === 0) return;
+      const reason = parseReason(r.stdout) || "blocked by node9";
+      throw new Error("[node9] " + reason);
+    },
+
+    "tool.execute.after": async (ctx) => {
+      // Fire-and-forget audit log \u2014 failures here must NEVER throw,
+      // or we'd retroactively "block" a tool call that already ran.
+      const payload = {
+        hook_event_name: "PostToolUse",
+        tool_name: ctx.tool,
+        session_id: ctx.sessionID,
+        cwd: input.directory,
+        meta: { agent: "Opencode" },
+      };
+      try {
+        spawnSync(NODE9_ARGV[0], [...NODE9_ARGV.slice(1), "log"], {
+          input: JSON.stringify(payload),
+          encoding: "utf-8",
+          timeout: LOG_TIMEOUT_MS,
+        });
+      } catch (e) {
+        // Swallow: audit log gaps are preferable to crashing the agent.
+      }
+    },
+
+    "chat.message": async (ctx, mutable) => {
+      const prompt = extractPromptText(mutable.parts);
+      if (!prompt) return;
+      const payload = {
+        hook_event_name: "UserPromptSubmit",
+        prompt,
+        session_id: ctx.sessionID,
+        meta: { agent: "Opencode" },
+      };
+      const r = spawnSync(NODE9_ARGV[0], [...NODE9_ARGV.slice(1), "check"], {
+        input: JSON.stringify(payload),
+        encoding: "utf-8",
+        timeout: HOOK_TIMEOUT_MS,
+      });
+      if (r.status === 0) return;
+      const reason = parseReason(r.stdout) || "prompt blocked";
+      throw new Error("[node9] " + reason);
+    },
+  }),
+};
+`;
+}
+var init_setup_opencode_shim = __esm({
+  "src/setup-opencode-shim.ts"() {
+    "use strict";
+  }
+});
+
 // src/setup.ts
 function hasNode9McpServer(servers) {
   const entry = servers["node9"];
@@ -6498,6 +6614,13 @@ function isStaleHookCommand(command) {
   }
   return false;
 }
+function isLegacyHookFormat(command) {
+  if (!command) return false;
+  return command.includes("\\");
+}
+function needsRewrite(command) {
+  return isStaleHookCommand(command) || isLegacyHookFormat(command);
+}
 function readJson(filePath) {
   try {
     if (import_fs13.default.existsSync(filePath)) {
@@ -6670,7 +6793,7 @@ async function setupClaude() {
       for (const h of matcher.hooks) {
         const cmd = h.command ?? "";
         const isNode9 = cmd.includes("node9 check") || cmd.includes("cli.js check");
-        if (isNode9 && isStaleHookCommand(cmd)) {
+        if (isNode9 && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           console.log(import_chalk.default.yellow("  \u{1F527} PreToolUse hook repaired (stale path \u2192 current binary)"));
           hooksChanged = true;
@@ -6696,7 +6819,7 @@ async function setupClaude() {
       for (const h of matcher.hooks) {
         const cmd = h.command ?? "";
         const isNode9 = cmd.includes("node9 log") || cmd.includes("cli.js log");
-        if (isNode9 && isStaleHookCommand(cmd)) {
+        if (isNode9 && needsRewrite(cmd)) {
           h.command = fullPathCommand("log");
           console.log(import_chalk.default.yellow("  \u{1F527} PostToolUse hook repaired (stale path \u2192 current binary)"));
           hooksChanged = true;
@@ -6721,7 +6844,7 @@ async function setupClaude() {
     for (const matcher of settings.hooks.UserPromptSubmit) {
       for (const h of matcher.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           console.log(
             import_chalk.default.yellow("  \u{1F527} UserPromptSubmit hook repaired (stale path \u2192 current binary)")
@@ -6933,7 +7056,8 @@ function detectAgents(homeDir2 = import_os12.default.homedir()) {
     codex: exists(import_path15.default.join(homeDir2, ".codex")),
     windsurf: exists(import_path15.default.join(homeDir2, ".codeium", "windsurf")),
     vscode: exists(import_path15.default.join(homeDir2, ".vscode")),
-    claudeDesktop: desktopPath !== null && exists(import_path15.default.dirname(desktopPath))
+    claudeDesktop: desktopPath !== null && exists(import_path15.default.dirname(desktopPath)),
+    opencode: exists(import_path15.default.join(homeDir2, ".config", "opencode"))
   };
 }
 async function setupCursor() {
@@ -7040,7 +7164,7 @@ async function setupCodex() {
     } else {
       for (const h of existing.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           hooksChanged = true;
         }
@@ -7060,7 +7184,7 @@ async function setupCodex() {
     for (const m of hooksFile.hooks.UserPromptSubmit) {
       for (const h of m.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           hooksChanged = true;
         }
@@ -7081,7 +7205,7 @@ async function setupCodex() {
     for (const m of hooksFile.hooks.PostToolUse) {
       for (const h of m.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("log");
           hooksChanged = true;
         }
@@ -7566,6 +7690,127 @@ function teardownClaudeDesktop() {
     console.log(import_chalk.default.blue("  \u2139\uFE0F  No Node9-wrapped MCP servers found in Claude Desktop config"));
   }
 }
+function node9ArgvForShim() {
+  if (process.env.NODE9_TESTING === "1") return ["node9"];
+  const nodeExec = process.execPath;
+  const cliScript = process.argv[1];
+  if (cliScript && cliScript.endsWith(".js")) return [nodeExec, cliScript];
+  return [cliScript];
+}
+function node9Version() {
+  try {
+    const pkg = JSON.parse(
+      import_fs13.default.readFileSync(import_path15.default.join(__dirname, "..", "package.json"), "utf-8")
+    );
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function setupOpencode() {
+  seedMcpPinsIfMissing();
+  const homeDir2 = import_os12.default.homedir();
+  const configDir = import_path15.default.join(homeDir2, ".config", "opencode");
+  const pluginsDir = import_path15.default.join(configDir, "plugins");
+  const configPath = import_path15.default.join(configDir, "opencode.json");
+  const pluginPath = import_path15.default.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  try {
+    import_fs13.default.mkdirSync(pluginsDir, { recursive: true });
+  } catch (err2) {
+    const code = err2.code;
+    if (code !== "EEXIST") {
+      console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Could not create ${pluginsDir}: ${code ?? String(err2)}`));
+      return;
+    }
+  }
+  const shimContent = renderOpencodeShim({
+    node9Argv: node9ArgvForShim(),
+    version: node9Version()
+  });
+  let pluginChanged = false;
+  const existingShim = (() => {
+    try {
+      return import_fs13.default.readFileSync(pluginPath, "utf-8");
+    } catch {
+      return null;
+    }
+  })();
+  if (existingShim !== shimContent) {
+    import_fs13.default.writeFileSync(pluginPath, shimContent);
+    pluginChanged = true;
+    if (existingShim) {
+      console.log(import_chalk.default.yellow("  \u{1F527} Opencode plugin shim updated to current version"));
+    } else {
+      console.log(
+        import_chalk.default.green("  \u2705 Opencode plugin installed \u2192 tool.execute.before / after, chat.message")
+      );
+    }
+  }
+  const config = readJson(configPath) ?? {};
+  const mcp = config.mcp ?? {};
+  let configChanged = false;
+  const desiredCommand = [...node9ArgvForShim(), "mcp-server"];
+  const desiredEntry = {
+    type: "local",
+    command: desiredCommand,
+    enabled: true
+  };
+  const existing = mcp["node9"];
+  const entryMatches = existing && existing.type === "local" && Array.isArray(existing.command) && existing.command.length === desiredCommand.length && existing.command.every((c, i) => c === desiredCommand[i]) && existing.enabled !== false;
+  if (!entryMatches) {
+    mcp["node9"] = desiredEntry;
+    config.mcp = mcp;
+    configChanged = true;
+    if (existing) {
+      console.log(import_chalk.default.yellow("  \u{1F527} Opencode MCP entry updated (node9)"));
+    } else {
+      console.log(import_chalk.default.green("  \u2705 node9 MCP server added   \u2192 node9 mcp-server"));
+    }
+  }
+  if (configChanged) writeJson(configPath, config);
+  if (pluginChanged || configChanged) {
+    console.log(import_chalk.default.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Opencode!"));
+    console.log(import_chalk.default.gray("    Restart Opencode for changes to take effect."));
+    printDaemonTip();
+  } else {
+    console.log(import_chalk.default.blue("  \u2139\uFE0F  Node9 is already fully configured for Opencode."));
+  }
+}
+function teardownOpencode() {
+  const homeDir2 = import_os12.default.homedir();
+  const configDir = import_path15.default.join(homeDir2, ".config", "opencode");
+  const pluginsDir = import_path15.default.join(configDir, "plugins");
+  const configPath = import_path15.default.join(configDir, "opencode.json");
+  const pluginPath = import_path15.default.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  try {
+    if (import_fs13.default.existsSync(pluginPath)) {
+      import_fs13.default.unlinkSync(pluginPath);
+      console.log(import_chalk.default.green("  \u2705 Removed node9 plugin from ~/.config/opencode/plugins/"));
+    }
+  } catch (err2) {
+    console.log(import_chalk.default.yellow(`  \u26A0\uFE0F  Could not remove ${pluginPath}: ${String(err2)}`));
+  }
+  const config = readJson(configPath);
+  if (!config) {
+    console.log(import_chalk.default.blue("  \u2139\uFE0F  ~/.config/opencode/opencode.json not found \u2014 nothing to remove"));
+    return;
+  }
+  const mcp = config.mcp ?? {};
+  let changed = false;
+  if (mcp["node9"]) {
+    delete mcp["node9"];
+    changed = true;
+    console.log(
+      import_chalk.default.green("  \u2705 Removed node9 MCP server entry from ~/.config/opencode/opencode.json")
+    );
+  }
+  if (changed) {
+    config.mcp = mcp;
+    writeJson(configPath, config);
+  } else {
+    console.log(import_chalk.default.blue("  \u2139\uFE0F  No node9 entries found in ~/.config/opencode/opencode.json"));
+  }
+}
 function getAgentsStatus(homeDir2 = import_os12.default.homedir()) {
   const detected = detectAgents(homeDir2);
   const claudeWired = (() => {
@@ -7648,10 +7893,30 @@ function getAgentsStatus(homeDir2 = import_os12.default.homedir()) {
         return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
       })(),
       mode: detected.claudeDesktop ? "mcp" : null
+    },
+    {
+      name: "opencode",
+      label: "Opencode",
+      installed: detected.opencode,
+      wired: (() => {
+        const pluginPath = import_path15.default.join(
+          homeDir2,
+          ".config",
+          "opencode",
+          "plugins",
+          OPENCODE_PLUGIN_NAME
+        );
+        if (import_fs13.default.existsSync(pluginPath)) return true;
+        const cfg = readJson(
+          import_path15.default.join(homeDir2, ".config", "opencode", "opencode.json")
+        );
+        return !!cfg?.mcp?.["node9"];
+      })(),
+      mode: detected.opencode ? "hooks" : null
     }
   ];
 }
-var import_fs13, import_path15, import_os12, import_chalk, import_prompts, import_smol_toml, NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS;
+var import_fs13, import_path15, import_os12, import_chalk, import_prompts, import_smol_toml, NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
@@ -7662,8 +7927,10 @@ var init_setup = __esm({
     import_prompts = require("@inquirer/prompts");
     import_smol_toml = require("smol-toml");
     init_mcp_pin();
+    init_setup_opencode_shim();
     NODE9_MCP_SERVER_ENTRY = { command: "node9", args: ["mcp-server"] };
     CODEX_PRE_TOOL_MATCHERS = ["^Bash$", "^apply_patch$", "^mcp__.*"];
+    OPENCODE_PLUGIN_NAME = "node9.js";
   }
 });
 
@@ -15965,6 +16232,11 @@ function sanitize2(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
 function detectAiAgent(payload) {
+  const meta = payload.meta;
+  if (meta && typeof meta === "object") {
+    const tagged = meta.agent;
+    if (typeof tagged === "string" && tagged.length > 0) return tagged;
+  }
   if (payload.turn_id !== void 0) {
     return "Codex";
   }
@@ -18603,6 +18875,7 @@ function registerInitCommand(program2) {
         else if (agent === "windsurf") await setupWindsurf();
         else if (agent === "vscode") await setupVSCode();
         else if (agent === "claudeDesktop") await setupClaudeDesktop();
+        else if (agent === "opencode") await setupOpencode();
         console.log("");
       }
       if ((process.platform === "darwin" || process.platform === "linux") && process.stdout.isTTY) {
@@ -20362,7 +20635,8 @@ var SETUP_FN = {
   codex: setupCodex,
   windsurf: setupWindsurf,
   vscode: setupVSCode,
-  claudeDesktop: setupClaudeDesktop
+  claudeDesktop: setupClaudeDesktop,
+  opencode: setupOpencode
 };
 var TEARDOWN_FN = {
   claude: teardownClaude,
@@ -20371,7 +20645,8 @@ var TEARDOWN_FN = {
   codex: teardownCodex,
   windsurf: teardownWindsurf,
   vscode: teardownVSCode,
-  claudeDesktop: teardownClaudeDesktop
+  claudeDesktop: teardownClaudeDesktop,
+  opencode: teardownOpencode
 };
 var AGENT_NAMES = Object.keys(SETUP_FN);
 function registerAgentsCommand(program2) {

package/dist/cli.mjs

@@ -6438,6 +6438,122 @@ var init_mcp_pin = __esm({
   }
 });
 
+// src/setup-opencode-shim.ts
+function renderOpencodeShim(input) {
+  const { node9Argv, version: version2 } = input;
+  return `// Auto-generated by \`node9 init\`. Do not edit \u2014 re-run init to upgrade.
+// NODE9_SHIM_VERSION = "${version2}"
+//
+// node9 protection shim for Opencode. Wires three hooks against the
+// agent's plugin API and shells out to the node9 CLI for verdicts.
+//
+// Block by throwing from a hook handler; Opencode's plugin trigger
+// (packages/opencode/src/plugin/index.ts:273) propagates the error and
+// halts the tool call.
+
+const { spawnSync } = require("node:child_process");
+
+// argv prefix for invoking the node9 CLI. argv[0] is the executable
+// (either the npm-installed wrapper script or the node binary); the
+// remaining entries (if any) are passed as the leading args before
+// the subcommand name (e.g. ["/path/to/dist/cli.js"] for dev mode).
+const NODE9_ARGV = ${JSON.stringify(node9Argv)};
+const HOOK_TIMEOUT_MS = 30000;
+const LOG_TIMEOUT_MS = 5000;
+
+function parseReason(stdout) {
+  // node9 check emits {decision, reason, message} JSON on stdout when
+  // blocking. Fall back to a generic string if anything goes wrong.
+  try {
+    const v = JSON.parse(stdout || "");
+    return v && (v.reason || v.message);
+  } catch (e) {
+    return null;
+  }
+}
+
+function extractPromptText(parts) {
+  // chat.message gives us parts: Part[]. We only DLP-scan text parts
+  // (image / tool_use parts can't contain pasted secrets in any form
+  // node9's scanner currently recognizes).
+  if (!Array.isArray(parts)) return "";
+  return parts
+    .filter((p) => p && p.type === "text")
+    .map((p) => (p && p.text) || "")
+    .join("\\n");
+}
+
+module.exports = {
+  id: "node9",
+  server: async (input) => ({
+    "tool.execute.before": async (ctx, mutable) => {
+      const payload = {
+        hook_event_name: "PreToolUse",
+        tool_name: ctx.tool,
+        tool_input: mutable.args,
+        session_id: ctx.sessionID,
+        cwd: input.directory,
+        meta: { agent: "Opencode" },
+      };
+      const r = spawnSync(NODE9_ARGV[0], [...NODE9_ARGV.slice(1), "check"], {
+        input: JSON.stringify(payload),
+        encoding: "utf-8",
+        timeout: HOOK_TIMEOUT_MS,
+      });
+      if (r.status === 0) return;
+      const reason = parseReason(r.stdout) || "blocked by node9";
+      throw new Error("[node9] " + reason);
+    },
+
+    "tool.execute.after": async (ctx) => {
+      // Fire-and-forget audit log \u2014 failures here must NEVER throw,
+      // or we'd retroactively "block" a tool call that already ran.
+      const payload = {
+        hook_event_name: "PostToolUse",
+        tool_name: ctx.tool,
+        session_id: ctx.sessionID,
+        cwd: input.directory,
+        meta: { agent: "Opencode" },
+      };
+      try {
+        spawnSync(NODE9_ARGV[0], [...NODE9_ARGV.slice(1), "log"], {
+          input: JSON.stringify(payload),
+          encoding: "utf-8",
+          timeout: LOG_TIMEOUT_MS,
+        });
+      } catch (e) {
+        // Swallow: audit log gaps are preferable to crashing the agent.
+      }
+    },
+
+    "chat.message": async (ctx, mutable) => {
+      const prompt = extractPromptText(mutable.parts);
+      if (!prompt) return;
+      const payload = {
+        hook_event_name: "UserPromptSubmit",
+        prompt,
+        session_id: ctx.sessionID,
+        meta: { agent: "Opencode" },
+      };
+      const r = spawnSync(NODE9_ARGV[0], [...NODE9_ARGV.slice(1), "check"], {
+        input: JSON.stringify(payload),
+        encoding: "utf-8",
+        timeout: HOOK_TIMEOUT_MS,
+      });
+      if (r.status === 0) return;
+      const reason = parseReason(r.stdout) || "prompt blocked";
+      throw new Error("[node9] " + reason);
+    },
+  }),
+};
+`;
+}
+var init_setup_opencode_shim = __esm({
+  "src/setup-opencode-shim.ts"() {
+    "use strict";
+  }
+});
+
 // src/setup.ts
 import fs13 from "fs";
 import path15 from "path";
@@ -6479,6 +6595,13 @@ function isStaleHookCommand(command) {
   }
   return false;
 }
+function isLegacyHookFormat(command) {
+  if (!command) return false;
+  return command.includes("\\");
+}
+function needsRewrite(command) {
+  return isStaleHookCommand(command) || isLegacyHookFormat(command);
+}
 function readJson(filePath) {
   try {
     if (fs13.existsSync(filePath)) {
@@ -6651,7 +6774,7 @@ async function setupClaude() {
       for (const h of matcher.hooks) {
         const cmd = h.command ?? "";
         const isNode9 = cmd.includes("node9 check") || cmd.includes("cli.js check");
-        if (isNode9 && isStaleHookCommand(cmd)) {
+        if (isNode9 && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           console.log(chalk.yellow("  \u{1F527} PreToolUse hook repaired (stale path \u2192 current binary)"));
           hooksChanged = true;
@@ -6677,7 +6800,7 @@ async function setupClaude() {
       for (const h of matcher.hooks) {
         const cmd = h.command ?? "";
         const isNode9 = cmd.includes("node9 log") || cmd.includes("cli.js log");
-        if (isNode9 && isStaleHookCommand(cmd)) {
+        if (isNode9 && needsRewrite(cmd)) {
           h.command = fullPathCommand("log");
           console.log(chalk.yellow("  \u{1F527} PostToolUse hook repaired (stale path \u2192 current binary)"));
           hooksChanged = true;
@@ -6702,7 +6825,7 @@ async function setupClaude() {
     for (const matcher of settings.hooks.UserPromptSubmit) {
       for (const h of matcher.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           console.log(
             chalk.yellow("  \u{1F527} UserPromptSubmit hook repaired (stale path \u2192 current binary)")
@@ -6914,7 +7037,8 @@ function detectAgents(homeDir2 = os12.homedir()) {
     codex: exists(path15.join(homeDir2, ".codex")),
     windsurf: exists(path15.join(homeDir2, ".codeium", "windsurf")),
     vscode: exists(path15.join(homeDir2, ".vscode")),
-    claudeDesktop: desktopPath !== null && exists(path15.dirname(desktopPath))
+    claudeDesktop: desktopPath !== null && exists(path15.dirname(desktopPath)),
+    opencode: exists(path15.join(homeDir2, ".config", "opencode"))
   };
 }
 async function setupCursor() {
@@ -7021,7 +7145,7 @@ async function setupCodex() {
     } else {
       for (const h of existing.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           hooksChanged = true;
         }
@@ -7041,7 +7165,7 @@ async function setupCodex() {
     for (const m of hooksFile.hooks.UserPromptSubmit) {
       for (const h of m.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("check");
           hooksChanged = true;
         }
@@ -7062,7 +7186,7 @@ async function setupCodex() {
     for (const m of hooksFile.hooks.PostToolUse) {
       for (const h of m.hooks) {
         const cmd = h.command ?? "";
-        if (isNode9Hook(cmd) && isStaleHookCommand(cmd)) {
+        if (isNode9Hook(cmd) && needsRewrite(cmd)) {
           h.command = fullPathCommand("log");
           hooksChanged = true;
         }
@@ -7547,6 +7671,127 @@ function teardownClaudeDesktop() {
     console.log(chalk.blue("  \u2139\uFE0F  No Node9-wrapped MCP servers found in Claude Desktop config"));
   }
 }
+function node9ArgvForShim() {
+  if (process.env.NODE9_TESTING === "1") return ["node9"];
+  const nodeExec = process.execPath;
+  const cliScript = process.argv[1];
+  if (cliScript && cliScript.endsWith(".js")) return [nodeExec, cliScript];
+  return [cliScript];
+}
+function node9Version() {
+  try {
+    const pkg = JSON.parse(
+      fs13.readFileSync(path15.join(__dirname, "..", "package.json"), "utf-8")
+    );
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function setupOpencode() {
+  seedMcpPinsIfMissing();
+  const homeDir2 = os12.homedir();
+  const configDir = path15.join(homeDir2, ".config", "opencode");
+  const pluginsDir = path15.join(configDir, "plugins");
+  const configPath = path15.join(configDir, "opencode.json");
+  const pluginPath = path15.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  try {
+    fs13.mkdirSync(pluginsDir, { recursive: true });
+  } catch (err2) {
+    const code = err2.code;
+    if (code !== "EEXIST") {
+      console.log(chalk.yellow(`  \u26A0\uFE0F  Could not create ${pluginsDir}: ${code ?? String(err2)}`));
+      return;
+    }
+  }
+  const shimContent = renderOpencodeShim({
+    node9Argv: node9ArgvForShim(),
+    version: node9Version()
+  });
+  let pluginChanged = false;
+  const existingShim = (() => {
+    try {
+      return fs13.readFileSync(pluginPath, "utf-8");
+    } catch {
+      return null;
+    }
+  })();
+  if (existingShim !== shimContent) {
+    fs13.writeFileSync(pluginPath, shimContent);
+    pluginChanged = true;
+    if (existingShim) {
+      console.log(chalk.yellow("  \u{1F527} Opencode plugin shim updated to current version"));
+    } else {
+      console.log(
+        chalk.green("  \u2705 Opencode plugin installed \u2192 tool.execute.before / after, chat.message")
+      );
+    }
+  }
+  const config = readJson(configPath) ?? {};
+  const mcp = config.mcp ?? {};
+  let configChanged = false;
+  const desiredCommand = [...node9ArgvForShim(), "mcp-server"];
+  const desiredEntry = {
+    type: "local",
+    command: desiredCommand,
+    enabled: true
+  };
+  const existing = mcp["node9"];
+  const entryMatches = existing && existing.type === "local" && Array.isArray(existing.command) && existing.command.length === desiredCommand.length && existing.command.every((c, i) => c === desiredCommand[i]) && existing.enabled !== false;
+  if (!entryMatches) {
+    mcp["node9"] = desiredEntry;
+    config.mcp = mcp;
+    configChanged = true;
+    if (existing) {
+      console.log(chalk.yellow("  \u{1F527} Opencode MCP entry updated (node9)"));
+    } else {
+      console.log(chalk.green("  \u2705 node9 MCP server added   \u2192 node9 mcp-server"));
+    }
+  }
+  if (configChanged) writeJson(configPath, config);
+  if (pluginChanged || configChanged) {
+    console.log(chalk.green.bold("\u{1F6E1}\uFE0F  Node9 is now protecting Opencode!"));
+    console.log(chalk.gray("    Restart Opencode for changes to take effect."));
+    printDaemonTip();
+  } else {
+    console.log(chalk.blue("  \u2139\uFE0F  Node9 is already fully configured for Opencode."));
+  }
+}
+function teardownOpencode() {
+  const homeDir2 = os12.homedir();
+  const configDir = path15.join(homeDir2, ".config", "opencode");
+  const pluginsDir = path15.join(configDir, "plugins");
+  const configPath = path15.join(configDir, "opencode.json");
+  const pluginPath = path15.join(pluginsDir, OPENCODE_PLUGIN_NAME);
+  try {
+    if (fs13.existsSync(pluginPath)) {
+      fs13.unlinkSync(pluginPath);
+      console.log(chalk.green("  \u2705 Removed node9 plugin from ~/.config/opencode/plugins/"));
+    }
+  } catch (err2) {
+    console.log(chalk.yellow(`  \u26A0\uFE0F  Could not remove ${pluginPath}: ${String(err2)}`));
+  }
+  const config = readJson(configPath);
+  if (!config) {
+    console.log(chalk.blue("  \u2139\uFE0F  ~/.config/opencode/opencode.json not found \u2014 nothing to remove"));
+    return;
+  }
+  const mcp = config.mcp ?? {};
+  let changed = false;
+  if (mcp["node9"]) {
+    delete mcp["node9"];
+    changed = true;
+    console.log(
+      chalk.green("  \u2705 Removed node9 MCP server entry from ~/.config/opencode/opencode.json")
+    );
+  }
+  if (changed) {
+    config.mcp = mcp;
+    writeJson(configPath, config);
+  } else {
+    console.log(chalk.blue("  \u2139\uFE0F  No node9 entries found in ~/.config/opencode/opencode.json"));
+  }
+}
 function getAgentsStatus(homeDir2 = os12.homedir()) {
   const detected = detectAgents(homeDir2);
   const claudeWired = (() => {
@@ -7629,16 +7874,38 @@ function getAgentsStatus(homeDir2 = os12.homedir()) {
         return !!(cfg?.mcpServers && hasNode9McpServer(cfg.mcpServers));
       })(),
       mode: detected.claudeDesktop ? "mcp" : null
+    },
+    {
+      name: "opencode",
+      label: "Opencode",
+      installed: detected.opencode,
+      wired: (() => {
+        const pluginPath = path15.join(
+          homeDir2,
+          ".config",
+          "opencode",
+          "plugins",
+          OPENCODE_PLUGIN_NAME
+        );
+        if (fs13.existsSync(pluginPath)) return true;
+        const cfg = readJson(
+          path15.join(homeDir2, ".config", "opencode", "opencode.json")
+        );
+        return !!cfg?.mcp?.["node9"];
+      })(),
+      mode: detected.opencode ? "hooks" : null
     }
   ];
 }
-var NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS;
+var NODE9_MCP_SERVER_ENTRY, CODEX_PRE_TOOL_MATCHERS, OPENCODE_PLUGIN_NAME;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
     init_mcp_pin();
+    init_setup_opencode_shim();
     NODE9_MCP_SERVER_ENTRY = { command: "node9", args: ["mcp-server"] };
     CODEX_PRE_TOOL_MATCHERS = ["^Bash$", "^apply_patch$", "^mcp__.*"];
+    OPENCODE_PLUGIN_NAME = "node9.js";
   }
 });
 
@@ -15937,6 +16204,11 @@ function sanitize2(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
 function detectAiAgent(payload) {
+  const meta = payload.meta;
+  if (meta && typeof meta === "object") {
+    const tagged = meta.agent;
+    if (typeof tagged === "string" && tagged.length > 0) return tagged;
+  }
   if (payload.turn_id !== void 0) {
     return "Codex";
   }
@@ -18575,6 +18847,7 @@ function registerInitCommand(program2) {
         else if (agent === "windsurf") await setupWindsurf();
         else if (agent === "vscode") await setupVSCode();
         else if (agent === "claudeDesktop") await setupClaudeDesktop();
+        else if (agent === "opencode") await setupOpencode();
         console.log("");
       }
       if ((process.platform === "darwin" || process.platform === "linux") && process.stdout.isTTY) {
@@ -20334,7 +20607,8 @@ var SETUP_FN = {
   codex: setupCodex,
   windsurf: setupWindsurf,
   vscode: setupVSCode,
-  claudeDesktop: setupClaudeDesktop
+  claudeDesktop: setupClaudeDesktop,
+  opencode: setupOpencode
 };
 var TEARDOWN_FN = {
   claude: teardownClaude,
@@ -20343,7 +20617,8 @@ var TEARDOWN_FN = {
   codex: teardownCodex,
   windsurf: teardownWindsurf,
   vscode: teardownVSCode,
-  claudeDesktop: teardownClaudeDesktop
+  claudeDesktop: teardownClaudeDesktop,
+  opencode: teardownOpencode
 };
 var AGENT_NAMES = Object.keys(SETUP_FN);
 function registerAgentsCommand(program2) {

package/dist/dashboard.mjs

@@ -3340,6 +3340,13 @@ var init_mcp_pin = __esm({
   }
 });
 
+// src/setup-opencode-shim.ts
+var init_setup_opencode_shim = __esm({
+  "src/setup-opencode-shim.ts"() {
+    "use strict";
+  }
+});
+
 // src/setup.ts
 import chalk2 from "chalk";
 import { confirm } from "@inquirer/prompts";
@@ -3348,6 +3355,7 @@ var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
     init_mcp_pin();
+    init_setup_opencode_shim();
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.24.2",
+  "version": "1.25.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",