opencode-codeops 1.11.0 → 2.0.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to CodeOps are recorded here.
 
+## 2.0.1 — 2026-10-06
+
+### Fixes
+
+- installer: read plugins from the v2 configuration source list
+
+## 2.0.0 — 2026-10-06
+
+### Breaking Changes
+
+- port plugin to the OpenCode 2 plugin API
+
+### Fixes
+
+- docs: use a placeholder version in the plugin CLI example
+
 ## 1.11.0 — 2026-10-04
 
 ### Features

package/README.md

@@ -46,8 +46,8 @@ npx -y opencode-codeops@latest update    # alias of install
 ```
 
 `install`/`update` writes the skills and subagents onto the filesystem (OpenCode discovers those
-only from disk), then registers the plugin in the OpenCode config by calling OpenCode's own
-`opencode plugin` command, so standards injection and `CODEOPS_PLUGIN_ROOT` are enabled. Restart
+only from disk), then registers the plugin in the OpenCode config by calling OpenCode 2's own
+`opencode plugin add` command, so standards injection and `CODEOPS_PLUGIN_ROOT` are enabled. Restart
 OpenCode after installing for the plugin to load. Pass `--no-plugin` to manage the config yourself.
 
 The installer also places the shared `_shared/` and `references/` documents beside the installed
@@ -56,16 +56,18 @@ them resolve at their installed location. An existing directory with either name
 with `--force`.
 
 The scope is auto-detected: inside a CodeOps project (a git repo with `.opencode/` or
-`codeops/.codeops.yml`) it installs into `./.opencode`, and registers the plugin in the project
+`codeops/.codeops.yml`) it installs into `./.opencode` and registers the plugin in the project
 config; anywhere else it installs globally into `~/.config/opencode` and the global config. Pass
-`--project` or `--global` to force one.
+`--project` or `--global` to force one. OpenCode 2's CLI manages package plugins globally, so a
+project-scope install registers the plugin globally with a note while the skills and agents stay
+project-scoped.
 
-If you prefer to register the plugin manually instead, add it to your `opencode.json`:
+If you prefer to register the plugin manually instead, add it to your `opencode.jsonc`:
 
 ```json
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugin": ["opencode-codeops"]
+  "plugins": ["opencode-codeops"]
 }
 ```
 
@@ -92,23 +94,26 @@ npx -y opencode-codeops@latest uninstall
 `status` reports the installed skills and agents versions and the configured plugin entry, so a
 mismatch is visible. Use `--dry-run` to preview an install; a same-named file the package does not
 own is skipped with a warning, and `--force` replaces it. `uninstall` removes the skills and
-subagents but leaves the plugin entry in your config; remove `opencode-codeops` from the `plugin`
+subagents but leaves the plugin entry in your config; remove `opencode-codeops` from the `plugins`
 array by hand to fully disable it.
 
 ### Local development
 
-Symlink the plugin into your OpenCode plugin directory and link the installed files to a checkout,
-so edits are picked up without reinstalling. Pass `--no-plugin` so the checkout is not overwritten
-by a registered npm plugin:
+OpenCode 2's `opencode plugin add` accepts npm or Git package specifiers only, so a checkout is
+loaded through a local plugin file. Place a one-line re-export in a plugin directory and link the
+installed files to the checkout so edits are picked up without reinstalling:
 
 ```bash
-# Plugin (project or global plugin directory)
-ln -s /path/to/opencode-codeops/plugin/index.ts ~/.config/opencode/plugins/codeops.ts
+# Plugin — project scope (use ~/.config/opencode/plugins/ for every project)
+mkdir -p .opencode/plugins
+printf 'export { default } from "%s/plugin/index.ts"\n' "$PWD" > .opencode/plugins/codeops.ts
 
 # Skills and agents — link instead of copy
-node /path/to/opencode-codeops/bin/index.mjs install --link --global --no-plugin
+node bin/index.mjs install --link --global --no-plugin
 ```
 
+Pass `--no-plugin` so the checkout entry is not overwritten by a registered npm plugin.
+
 ## Setup
 
 After installing the plugin and the files, initialize CodeOps in your project:
@@ -128,7 +133,8 @@ git commit -m "chore: initialize CodeOps"
 
 ## What the plugin does automatically
 
-On every OpenCode session start and after every compaction, the plugin injects:
+The plugin adds the CodeOps standards to every model request as system instructions, and also to
+every compaction summary, so they are always active:
 - `standards/coding-standards.md` — coding quality, security, testing, and working-style rules
 - `standards/output-style.md` — how to report findings, format tables, and recommend next steps
 
@@ -136,17 +142,24 @@ These standards are active without any user action. They do not need to be copie
 
 The plugin also warns (non-blocking) if any tool attempts to edit `codeops/.codeops.yml` directly — that file is managed exclusively by the `setup-codeops` skill — and if the installed skills version differs from the plugin version, so a stale install is visible.
 
-Every session also gets a workspace-hygiene guard: the plugin exports `CODEOPS_TMPDIR`, a per-session scratch directory under the OS temp directory. Skills and agents put temporary files there and delete them when the run completes; the plugin removes the directory when the session is deleted and sweeps directories abandoned by interrupted runs at session start, so CodeOps does not accumulate scratch data. The full protocol is in `_shared/workspace-hygiene.md`.
+Every session also gets a workspace-hygiene guard: the plugin exports `CODEOPS_TMPDIR`, a scratch
+directory under the OS temp directory that belongs to the running OpenCode plugin instance. Skills
+and agents put temporary files there and delete them when the run completes; the plugin removes the
+directory when it unloads and sweeps directories abandoned by interrupted runs at startup, so
+CodeOps does not accumulate scratch data. Because OpenCode 2 does not expose a session id to shell
+hooks, concurrent sessions served by one instance share this directory. The full protocol is in
+`_shared/workspace-hygiene.md`.
 
 ## Agent model configuration
 
 All CodeOps subagents inherit the model of the primary agent that invoked them. No provider-specific configuration is required out of the box.
 
-To pin specific models per role, use the `setup-routing` skill or add overrides directly in `opencode.json`:
+To pin specific models per role, use the `setup-routing` skill or add overrides directly in
+`opencode.jsonc`:
 
 ```json
 {
-  "agent": {
+  "agents": {
     "demanding-executor": { "model": "anthropic/claude-opus-4-5" },
     "executor":           { "model": "anthropic/claude-haiku-4" }
   }
@@ -204,7 +217,8 @@ updates the index.
 
 ## Requirements
 
-- OpenCode (current)
+- OpenCode 2.0+ (this release uses the OpenCode 2 plugin API; on OpenCode 1, use
+  `opencode-codeops@1`)
 - Bash
 - Python 3.8+
 - Git

package/_shared/reasoning-effort.md

@@ -17,13 +17,15 @@ contract consumed by the plugin and the skills. It is advisory by design and nev
 | `max` | Adversarial or high-risk analysis where a missed detail is costly | Thorough preflight, complex or sensitive phases |
 
 The four levels are the complete suggestion vocabulary. A level is applied through the model's
-own variant record: the exact variant when it exists, otherwise the nearest exposed level on the
-provider scale, with ties resolving to the higher level. `none` stays exact-match only, because
-mapping it to a reasoning level would enable reasoning the caller disabled. When no variant can
-be chosen — or when the model exposes no variants and does not report reasoning support — the
-request is left unchanged, and it never raises a provider error. Routing policy is project
-configuration, not a suggestion: `routing.roles.<agent>.reasoning` may name any value from the
-provider enum (`none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`).
+own variant options: the exact variant when it exists, otherwise the nearest exposed level on the
+provider scale, with ties resolving to the higher level. On OpenCode 2 the plugin reads those
+options from the registered model's `variants` collection and merges the chosen entry's settings
+into the request. `none` stays exact-match only, because mapping it to a reasoning level would
+enable reasoning the caller disabled. When no variant can be chosen — the model exposes no
+matching variant — the request is left unchanged, and it never raises a provider error. Routing
+policy is project configuration, not a suggestion:
+`routing.roles.<agent>.reasoning` may name any value from the provider enum (`none`, `minimal`,
+`low`, `medium`, `high`, `xhigh`, `max`).
 
 The deepseek flash model in this environment exposes `low`, `high`, and `max`, so a `medium`
 suggestion resolves to `high` there. Confirm the active model's set by enabling
@@ -127,10 +129,12 @@ invalid `=<level>` is an argument error.
 Semantics:
 
 1. Announce `Auto-effort active — reasoning <level> applied for this run`.
-2. Record the level for the session run through `scripts/codeops_effort.py`.
+2. Record the level for the run in the runtime scratch directory through
+   `scripts/codeops_effort.py`. When one runtime serves more than one concurrent session, the
+   most recently recorded level applies to all of them.
 3. Clear it at run completion, before the final summary.
 4. Run-scoped: the level applies from the point it is set until cleared or the session ends.
-5. Fail-open: when the session temp directory is unavailable or the helper fails, print an
+5. Fail-open: when the runtime scratch directory is unavailable or the helper fails, print an
    advise-only note and continue; the skill never blocks.
 6. Never a gate: effort affects cost and latency only. No readiness check, verification step,
    reviewer requirement, or finding gate may read it.
@@ -142,10 +146,10 @@ forces that level for the whole run, including every dispatch marker composed du
 
 Set `CODEOPS_EFFORT_TRACE=1` (or `true`) in the environment that starts OpenCode to record what
 the plugin does. One content-free JSON line is appended per marker capture and per request to
-`reasoning-effort-trace.jsonl` inside the session's scratch directory. Lines carry only a
-timestamp, event name, message id, agent name, level, source, chosen variant, and applied flag —
-never prompt text or file content. The trace lives with the rest of the session scratch and is
-removed with it. Tracing is off by default and never affects a request.
+`reasoning-effort-trace.jsonl` inside the runtime's scratch directory. Lines carry only a
+timestamp, session id, event name, message id, agent name, level, source, chosen variant, and
+applied flag — never prompt text or file content. The trace lives with the rest of the runtime
+scratch and is removed with it. Tracing is off by default and never affects a request.
 
 ## Suggestion-only guarantee
 

package/_shared/workspace-hygiene.md

@@ -15,13 +15,17 @@ outputs are deliverables — not temporary artifacts — and they are never dele
 
 ## Where temporary artifacts live
 
-1. `$CODEOPS_TMPDIR` when the CodeOps plugin exports it (one directory per session). Use it for
-   every scratch file.
+1. `$CODEOPS_TMPDIR` when the CodeOps plugin exports it (one directory per OpenCode runtime).
+   Use it for every scratch file.
 2. Otherwise, the operating system's temp directory.
 3. Never inside the repository. A repository path is durable space; scratch does not belong there.
 
 Create subdirectories under the temp root lazily, only when the task needs them.
 
+OpenCode 2 does not expose a session identifier to shell hooks, so the plugin owns one scratch
+directory per runtime instead of one per session. Sessions served by the same runtime share it;
+keep scratch file names specific to the run to avoid collisions.
+
 ## Lifecycle
 
 1. **Create lazily** — write a temporary file only when the task needs it.
@@ -47,7 +51,7 @@ Create subdirectories under the temp root lazily, only when the task needs them.
 
 ## Automatic safety net
 
-The CodeOps plugin exports `$CODEOPS_TMPDIR` for each session and removes that session's directory
-when the session is deleted. At session start it also removes CodeOps temp directories older than
-seven days, so an interrupted run cannot leak storage forever. The safety net is a fallback, not a
-substitute: the run itself still performs the cleanup pass above.
+The CodeOps plugin exports `$CODEOPS_TMPDIR` for each runtime and removes that runtime's
+directory when the plugin unloads. At startup it also removes CodeOps temp directories older
+than seven days, so an interrupted run cannot leak storage forever. The safety net is a
+fallback, not a substitute: the run itself still performs the cleanup pass above.

package/bin/index.mjs

@@ -135,11 +135,17 @@ async function runCombined(command, rest, io) {
     const result = registerPlugin({ scope, version, cwd, run: io.run })
     if (result.ok) {
       console.log(`Plugin: registered ${result.spec} in the ${scope} OpenCode config.`)
+      if (scope === "project" && result.dialect === "add") {
+        console.log(
+          "Note: the OpenCode 2 CLI manages package plugins globally; " +
+            "skills and agents remain project-scoped."
+        )
+      }
       console.log("Restart OpenCode to load the plugin.")
     } else {
       console.log(
         `Plugin: not registered (${result.reason}). ` +
-          `Add "${PLUGIN_NAME}" to the "plugin" array in your opencode.json.`
+          `Add "${PLUGIN_NAME}" to the "plugins" array in your opencode.jsonc.`
       )
     }
   }

package/bin/lib/opencode-plugin.mjs

@@ -2,13 +2,16 @@
 /**
  * Registers (or inspects) the CodeOps plugin in OpenCode's own config.
  *
- * OpenCode ships a command that installs a plugin and updates the config
- * safely, including JSON/JSONC formatting and version replacement:
+ * OpenCode 2 ships a command that installs a plugin and updates the config
+ * safely, including JSON/JSONC formatting and version replacement. Two CLI
+ * shapes exist across releases:
  *
- *   opencode plugin <module> [--global] [--force]
+ *   opencode plugin add <module>        (OpenCode 2 subcommand form)
+ *   opencode plugin <module> [--global] (older form; still used by some builds)
  *
- * The installer delegates to that command instead of editing `opencode.json`
- * itself, so it never has to parse JSONC or risk clobbering a user's config.
+ * The installer probes the installed CLI once and uses the shape it accepts.
+ * This CodeOps version requires OpenCode 2; running it against OpenCode 1
+ * fails with a direct pointer to the 1.x line, because the plugin API changed.
  * All calls are best-effort: if the `opencode` executable is missing or the
  * command fails, the caller still completes the file install and tells the user
  * how to register the plugin manually.
@@ -21,6 +24,9 @@ import { spawnSync } from "node:child_process"
 /** The npm package name of the plugin. */
 export const PLUGIN_NAME = "opencode-codeops"
 
+/** The OpenCode major version this package requires. */
+export const REQUIRED_OPENCODE_MAJOR = 2
+
 /**
  * Runs a command and normalizes the result.
  *
@@ -39,37 +45,84 @@ export function defaultRun(command, args, options = {}) {
   }
 }
 
+/**
+ * Extract the OpenCode major version from `opencode --version` output.
+ *
+ * @param versionText - Raw version output
+ * @returns The major version, or `undefined` when no semver is present
+ *
+ * @example
+ * parseOpenCodeMajor("2.0.24") // 2
+ */
+export function parseOpenCodeMajor(versionText) {
+  const match = /(\d+)\.\d+\.\d+/.exec(String(versionText ?? ""))
+  return match ? Number(match[1]) : undefined
+}
+
 /**
  * Builds the arguments for `opencode plugin`.
  *
  * @param details - Plugin registration inputs
- * @param details.scope - `"global"` adds `--global`; `"project"` omits it
+ * @param details.scope - `"global"` adds `--global` when the CLI supports it
  * @param details.version - Exact version to pin, or `undefined` for the bare name
+ * @param details.dialect - `"add"` for `plugin add <spec>`, `"positional"` otherwise
+ * @param details.supportsGlobal - Whether the chosen dialect accepts `--global`
  * @returns Arguments after the `opencode` executable
+ *
  * @example
- * buildPluginArgs({ scope: "global", version: "1.0.0" })
- * // ["plugin", "opencode-codeops@1.0.0", "--global", "--force"]
+ * buildPluginArgs({ scope: "global", version: "1.2.3", dialect: "add", supportsGlobal: true })
+ * // ["plugin", "add", "opencode-codeops@1.2.3", "--global"]
  */
-export function buildPluginArgs({ scope, version }) {
+export function buildPluginArgs({ scope, version, dialect = "positional", supportsGlobal = true }) {
   const module = version ? `${PLUGIN_NAME}@${version}` : PLUGIN_NAME
+  const global = scope === "global" && supportsGlobal
+
+  if (dialect === "add") {
+    const args = ["plugin", "add", module]
+    if (global) args.push("--global")
+    return args
+  }
+
   const args = ["plugin", module]
-  if (scope === "global") args.push("--global")
+  if (global) args.push("--global")
   args.push("--force")
   return args
 }
 
+/**
+ * Detect which `opencode plugin` shape the installed CLI accepts.
+ *
+ * The subcommand form answers `opencode plugin add --help`; older builds treat
+ * `add` as a module name and fail. The help text also tells whether the
+ * subcommand accepts an explicit `--global` flag.
+ *
+ * @param details - Detection inputs
+ * @param details.cwd - Working directory
+ * @param details.run - Command runner, injectable for tests
+ * @returns The dialect and whether it supports `--global`
+ */
+export function detectPluginDialect({ cwd, run = defaultRun }) {
+  const help = run("opencode", ["plugin", "add", "--help"], { cwd })
+  if (!help.error && help.status === 0) {
+    const text = `${help.stdout}\n${help.stderr}`
+    return { dialect: "add", supportsGlobal: /--global\b/.test(text) }
+  }
+  return { dialect: "positional", supportsGlobal: true }
+}
+
 /**
  * Registers the plugin in the OpenCode config.
  *
- * Tries the exact version first so plugin and files stay in sync; if the CLI
- * rejects the versioned spec, falls back to the bare package name. Never throws.
+ * Requires OpenCode 2. Tries the exact version first so plugin and files stay
+ * in sync; if the CLI rejects the versioned spec, falls back to the bare
+ * package name. Never throws.
  *
  * @param details - Registration inputs
  * @param details.scope - `"global"` or `"project"`
  * @param details.version - Version to pin
  * @param details.cwd - Working directory (used for project scope)
  * @param details.run - Command runner, injectable for tests
- * @returns Whether registration succeeded, the spec used, and a reason on failure
+ * @returns Whether registration succeeded, the spec used, the dialect, and a reason on failure
  */
 export function registerPlugin({ scope, version, cwd, run = defaultRun }) {
   try {
@@ -78,38 +131,108 @@ export function registerPlugin({ scope, version, cwd, run = defaultRun }) {
       return { ok: false, spec: null, reason: "opencode CLI not found on PATH" }
     }
 
-    const pinned = run("opencode", buildPluginArgs({ scope, version }), { cwd })
-    if (!pinned.error && pinned.status === 0) {
-      return { ok: true, spec: `${PLUGIN_NAME}@${version}` }
+    const major = parseOpenCodeMajor(probe.stdout)
+    if (major !== undefined && major < REQUIRED_OPENCODE_MAJOR) {
+      return {
+        ok: false,
+        spec: null,
+        reason:
+          `OpenCode ${REQUIRED_OPENCODE_MAJOR} is required (found ${probe.stdout.trim()}); ` +
+          "on OpenCode 1, use opencode-codeops@1",
+      }
     }
 
-    const bare = run("opencode", buildPluginArgs({ scope, version: null }), { cwd })
-    if (!bare.error && bare.status === 0) {
-      return { ok: true, spec: PLUGIN_NAME }
+    const { dialect, supportsGlobal } = detectPluginDialect({ cwd, run })
+    let lastMessage = "opencode plugin command failed"
+
+    for (const candidate of [version, null]) {
+      const args = buildPluginArgs({ scope, version: candidate, dialect, supportsGlobal })
+      const result = run("opencode", args, { cwd })
+      if (!result.error && result.status === 0) {
+        return {
+          ok: true,
+          spec: candidate ? `${PLUGIN_NAME}@${candidate}` : PLUGIN_NAME,
+          dialect,
+        }
+      }
+      const message = (result.stderr || result.stdout || "").trim()
+      lastMessage = message.split("\n").pop() || lastMessage
     }
 
-    const message = (bare.stderr || bare.stdout || pinned.stderr || pinned.stdout || "").trim()
-    return { ok: false, spec: null, reason: message.split("\n").pop() || "opencode plugin failed" }
+    return { ok: false, spec: null, reason: lastMessage }
   } catch (caught) {
     return { ok: false, spec: null, reason: caught.message }
   }
 }
 
 /**
- * Reads the resolved `plugin` list from OpenCode's effective config.
+ * Normalize one configured plugin entry to its package spec.
+ *
+ * OpenCode accepts plain spec strings, `[spec, options]` tuples, and
+ * `{ package, options }` objects across versions, so the status readout must
+ * understand all three.
+ *
+ * @param item - Raw config entry
+ * @returns The spec string, or `undefined` when the entry is unusable
+ */
+function entrySpec(item) {
+  if (typeof item === "string") return item
+  if (Array.isArray(item) && typeof item[0] === "string") return item[0]
+  if (item && typeof item === "object" && typeof item.package === "string") {
+    return item.package
+  }
+  return undefined
+}
+
+/**
+ * Normalize the plugin entries from one configuration document.
+ *
+ * A document's `info` may carry the native `plugins` array or the legacy
+ * singular `plugin` array; both are read so mixed configurations are reported
+ * correctly.
+ *
+ * @param info - Configuration document info object
+ * @returns The document's plugin spec strings
+ */
+function documentPlugins(info) {
+  if (!info || typeof info !== "object") return []
+  const raw = Array.isArray(info.plugins)
+    ? info.plugins
+    : Array.isArray(info.plugin)
+      ? info.plugin
+      : []
+  return raw.map(entrySpec).filter((spec) => typeof spec === "string")
+}
+
+/**
+ * Reads the resolved plugin list from OpenCode's effective config.
+ *
+ * OpenCode 2 prints the list of configuration sources, each with its document
+ * under `info`; OpenCode 1 printed one resolved config object. Both shapes are
+ * understood, and the legacy `plugin` key is read as a fallback so mixed
+ * configurations are reported correctly.
  *
  * @param details - Inspection inputs
  * @param details.cwd - Working directory
  * @param details.run - Command runner, injectable for tests
- * @returns The plugin entries, or `undefined` when the config cannot be read
+ * @returns The plugin spec strings, or `undefined` when the config cannot be read
  */
 export function readConfiguredPlugin({ cwd, run = defaultRun } = {}) {
   try {
     const result = run("opencode", ["debug", "config"], { cwd })
     if (result.error || result.status !== 0) return undefined
 
-    const config = JSON.parse(result.stdout)
-    return Array.isArray(config.plugin) ? config.plugin : []
+    const parsed = JSON.parse(result.stdout)
+    const sources = Array.isArray(parsed) ? parsed : [parsed]
+    const specs = []
+    for (const source of sources) {
+      if (source && typeof source === "object" && "info" in source) {
+        specs.push(...documentPlugins(source.info))
+      }
+    }
+    if (specs.length > 0) return specs
+
+    return documentPlugins(parsed)
   } catch {
     return undefined
   }

package/bin/lib/reasoning-effort.d.mts

@@ -81,6 +81,11 @@ export declare function extractModelVariants(
   model: unknown
 ): Record<string, unknown> | undefined
 
+/** Normalize a host variant collection (v2 array or v1 record) into a record. */
+export declare function normalizeModelVariants(
+  variants: unknown
+): Record<string, unknown>
+
 /** Check whether a model advertises reasoning support. */
 export declare function modelSupportsReasoning(model: unknown): boolean
 

package/bin/lib/reasoning-effort.mjs

@@ -406,6 +406,44 @@ export function applyEffort(options, level, model) {
   return { ...options, reasoningEffort: level }
 }
 
+/**
+ * Normalize a host model's variant collection into a keyed record.
+ *
+ * OpenCode 2 exposes model variants as an array of entries shaped
+ * `{ id, settings }`, while {@link applyEffort} consumes a record keyed by
+ * variant id. This adapter bridges the two without changing the core logic.
+ * A record input is passed through unchanged, so v1-style callers and tests
+ * keep working. Malformed entries — non-objects, missing ids, non-object
+ * settings — are skipped; anything that is not an array or plain object yields
+ * an empty record.
+ *
+ * @param variants - Variant collection from the host (any shape)
+ * @returns A record mapping variant id to its settings object
+ *
+ * @example
+ * normalizeModelVariants([{ id: "high", settings: { reasoningEffort: "high" } }])
+ * // { high: { reasoningEffort: "high" } }
+ */
+export function normalizeModelVariants(variants) {
+  if (isPlainObject(variants)) return { ...variants }
+  if (!Array.isArray(variants)) return {}
+
+  const record = {}
+  for (const entry of variants) {
+    if (!isPlainObject(entry)) continue
+    const id = entry.id
+    if (typeof id !== "string" || id.length === 0) continue
+    const settings = isPlainObject(entry.settings) ? entry.settings : {}
+    Object.defineProperty(record, id, {
+      value: settings,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
+  }
+  return record
+}
+
 /**
  * Recursively merge plain objects into a new object.
  *

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "opencode-codeops",
-  "version": "1.11.0",
+  "version": "2.0.1",
   "description": "Specification-first engineering for complex systems — CodeOps plugin for OpenCode",
   "type": "module",
   "engines": {
-    "node": ">=18"
+    "node": ">=18",
+    "opencode": ">=2 <3"
   },
   "main": "./plugin/index.ts",
   "exports": {
-    ".": "./plugin/index.ts"
+    ".": "./plugin/index.ts",
+    "./server": "./plugin/index.ts"
   },
   "bin": {
     "opencode-codeops": "bin/index.mjs"
@@ -62,11 +64,10 @@
   "bugs": {
     "url": "https://github.com/blendsdk/opencode-codeops/issues"
   },
-  "peerDependencies": {
-    "@opencode-ai/plugin": "^1.18.30"
+  "dependencies": {
+    "@opencode/plugin": "^2.0.24"
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "1.18.30",
     "@types/node": "^22.20.2",
     "typescript": "^5.0.0"
   }

package/plugin/index.ts

@@ -1,7 +1,8 @@
-import type { Plugin } from "@opencode-ai/plugin"
+import { Plugin } from "@opencode/plugin"
+import { randomUUID } from "node:crypto"
 import { readFileSync } from "node:fs"
 import { homedir } from "node:os"
-import { join, dirname } from "node:path"
+import { dirname, join } from "node:path"
 import { fileURLToPath } from "node:url"
 
 import {
@@ -17,7 +18,7 @@ import {
   isEffortLevel,
   isEffortTraceEnabled,
   isRoutingReasoning,
-  modelSupportsReasoning,
+  normalizeModelVariants,
   readRoutingReasoning,
   readSessionEffort,
   resolveEffort,
@@ -52,7 +53,8 @@ function readPackageVersion(): string {
 }
 
 // ---------------------------------------------------------------------------
-// Load standards at startup (once). Both files are injected into every session.
+// Load standards at startup (once). Both files are injected into every request
+// as system instructions, so they also survive context compaction.
 // ---------------------------------------------------------------------------
 const codingStandards = readFileSync(
   join(PACKAGE_ROOT, "standards", "coding-standards.md"),
@@ -65,50 +67,49 @@ const outputStyle = readFileSync(
 const standardsText = `${codingStandards}\n\n${outputStyle}`
 
 // ---------------------------------------------------------------------------
-// Workspace hygiene — the plugin owns one temp directory per session (exported
-// as CODEOPS_TMPDIR) and sweeps directories abandoned by earlier interrupted
-// runs. The sweep runs at most once per plugin process, so spawning many child
-// sessions does not repeat the directory walk.
+// OpenCode 2 does not expose a session identifier to shell hooks, so the plugin
+// owns one scratch directory per plugin runtime instead of one per session.
+// Skills and subagents still receive it as CODEOPS_TMPDIR and delete their own
+// scratch; the plugin removes the runtime directory on unload and sweeps
+// directories abandoned by earlier runs. Two sessions served by the same
+// runtime share this directory; see _shared/workspace-hygiene.md.
 // ---------------------------------------------------------------------------
-let sweptStaleTmpDirs = false
+const runtimeID = `runtime-${randomUUID()}`
+
+/** Heading prefixed to the standards block injected into compaction summaries. */
+const STANDARDS_HEADING = "## CodeOps Standards (always active)"
 
 /**
- * Sweep temp directories abandoned by earlier interrupted runs, once per
- * process. Cleanup is best effort: a failure must never block a session.
+ * Check whether a value is a plain object (not an array, class instance, or
+ * `null`). Used to read unknown hook payloads without unsafe casts.
+ *
+ * @param value - Value to inspect
+ * @returns True for `{}`-shaped objects
  */
-function sweepStaleTmpDirsOnce(): void {
-  if (sweptStaleTmpDirs) return
-  sweptStaleTmpDirs = true
-  try {
-    cleanStaleTmpDirs()
-  } catch {
-    // Best effort only.
-  }
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
 }
 
-// ---------------------------------------------------------------------------
-// Helper — inject standards into a session without triggering an AI reply.
-// Uses client.session.prompt with noReply: true (confirmed from OpenCode SDK).
-// ---------------------------------------------------------------------------
-async function injectStandards(
-  client: Parameters<Plugin>[0]["client"],
-  sessionId: string
-): Promise<void> {
-  await client.session.prompt({
-    path: { id: sessionId },
-    body: {
-      noReply: true,
-      parts: [{ type: "text", text: standardsText }],
-    },
-  })
+/**
+ * Log one content-free warning. Logging is best effort: a failed log must never
+ * break a request.
+ *
+ * @param message - Warning text that never contains prompt or file content
+ */
+function warnContentFree(message: string): void {
+  console.warn(`CodeOps: ${message}`)
 }
 
-// ---------------------------------------------------------------------------
-// Helper — read the version recorded in an installed skills marker, if any.
-// The marker (`.opencode-codeops.json`) is written by the skills installer.
-// Its absence means the skills are not managed — for example a development
-// symlink — so there is no version to compare against.
-// ---------------------------------------------------------------------------
+/**
+ * Read the version recorded in an installed skills marker, if any.
+ *
+ * The marker (`.opencode-codeops.json`) is written by the skills installer.
+ * Its absence means the skills are not managed — for example a development
+ * symlink — so there is no version to compare against.
+ *
+ * @param skillsDir - Directory that may hold the installer marker
+ * @returns The recorded version, or `undefined`
+ */
 function installedSkillsVersion(skillsDir: string): string | undefined {
   try {
     const marker = JSON.parse(
@@ -120,16 +121,15 @@ function installedSkillsVersion(skillsDir: string): string | undefined {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Helper — warn (non-blocking) when the installed skills were written by a
-// different CodeOps version than this plugin. The plugin and the files are
-// installed by separate commands, so their versions can drift; a mismatch
-// usually means the skills need `npx opencode-codeops update` again.
-// ---------------------------------------------------------------------------
-async function warnOnVersionSkew(
-  client: Parameters<Plugin>[0]["client"],
-  directory: string
-): Promise<void> {
+/**
+ * Warn (non-blocking) when the installed skills were written by a different
+ * CodeOps version than this plugin. The plugin and the files are installed by
+ * separate commands, so their versions can drift; a mismatch usually means the
+ * skills need `npx opencode-codeops update` again.
+ *
+ * @param directory - Project directory whose local skills should be checked
+ */
+function warnOnVersionSkew(directory: string): void {
   const skillsDirs = [
     join(homedir(), ".config", "opencode", "skills"),
     join(directory, ".opencode", "skills"),
@@ -139,38 +139,21 @@ async function warnOnVersionSkew(
     const installed = installedSkillsVersion(skillsDir)
     if (!installed || installed === packageVersion) continue
 
-    await client.app.log({
-      body: {
-        service: "codeops",
-        level: "warn",
-        message:
-          `CodeOps skills at ${skillsDir} are version ${installed}, ` +
-          `but the plugin is version ${packageVersion}. ` +
-          `Run \`npx opencode-codeops@${packageVersion} update\` to match them.`,
-      },
-    })
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Helper — log one content-free warning. Logging is best effort: a failed log
-// must never break a request.
-// ---------------------------------------------------------------------------
-async function warnContentFree(
-  client: Parameters<Plugin>[0]["client"],
-  message: string
-): Promise<void> {
-  try {
-    await client.app.log({ body: { service: "codeops", level: "warn", message } })
-  } catch {
-    // Best effort only.
+    warnContentFree(
+      `CodeOps skills at ${skillsDir} are version ${installed}, ` +
+        `but the plugin is version ${packageVersion}. ` +
+        `Run \`npx opencode-codeops@${packageVersion} update\` to match them.`
+    )
   }
 }
 
-// ---------------------------------------------------------------------------
-// Helper — read the project routing config fresh on every request, so an edit
-// applies without restarting the session. Any failure means "no routing".
-// ---------------------------------------------------------------------------
+/**
+ * Read the project routing config fresh on every request, so an edit applies
+ * without restarting the session. Any failure means "no routing".
+ *
+ * @param directory - Project directory holding `codeops/codeops.json`
+ * @returns The parsed config, or an empty object
+ */
 function readRoutingConfig(directory: string): unknown {
   try {
     return JSON.parse(readFileSync(join(directory, "codeops", "codeops.json"), "utf8"))
@@ -179,149 +162,139 @@ function readRoutingConfig(directory: string): unknown {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Helper — append one content-free trace line when the optional
-// CODEOPS_EFFORT_TRACE switch is on. Tracing is diagnostic only: it never
-// affects a request and swallows its own failures.
-// ---------------------------------------------------------------------------
+/**
+ * Append one content-free trace line when the optional CODEOPS_EFFORT_TRACE
+ * switch is on. Tracing is diagnostic only: it never affects a request and
+ * swallows its own failures.
+ *
+ * @param enabled - Whether tracing is enabled for this runtime
+ * @param sessionID - Session the entry belongs to
+ * @param entry - Content-free trace record
+ */
 function traceEffort(
   enabled: boolean,
   sessionID: string,
   entry: Record<string, unknown>
 ): void {
   if (!enabled) return
-  appendEffortTrace(sessionID, { ts: new Date().toISOString(), ...entry })
+  appendEffortTrace(runtimeID, { ts: new Date().toISOString(), sessionID, ...entry })
+}
+
+/**
+ * Look up the active model's variant record from the model registry.
+ *
+ * OpenCode 2 request hooks carry only a model reference (provider and model
+ * id), while the provider-specific option sets live on the registered model as
+ * a `variants` array. Any lookup failure means "no variants", which leaves the
+ * request unchanged.
+ *
+ * @param ctx - Plugin context whose model registry is queried
+ * @param ref - Model reference from the request hook
+ * @returns A variant record keyed by variant id, or an empty record
+ */
+async function readModelVariants(
+  ctx: Plugin.Context,
+  ref: { providerID: string; id: string }
+): Promise<Record<string, unknown>> {
+  try {
+    const listed = await ctx.model.list()
+    const info = listed.data.find(
+      (model) => model.providerID === ref.providerID && model.id === ref.id
+    )
+    if (info === undefined) return {}
+    return normalizeModelVariants(info.variants)
+  } catch {
+    return {}
+  }
 }
 
 // ---------------------------------------------------------------------------
-// CodeOps plugin for OpenCode
+// CodeOps plugin for OpenCode 2
 // Replaces: hooks/hooks.json + hook_session_context.sh + hook_marker_guard.sh
 // ---------------------------------------------------------------------------
-export const CodeOpsPlugin: Plugin = async ({ client, directory }) => {
-  // Reasoning-effort state lives for the lifetime of this plugin instance:
-  // the latest dispatch-marker level per session, plus a deduplication set
-  // for unsupported-level warnings.
-  const effortMarkers = new Map<string, EffortLevel>()
-  const warnedEffortLevels = new Set<string>()
-  const effortTraceEnabled = isEffortTraceEnabled(process.env.CODEOPS_EFFORT_TRACE)
+export default Plugin.define({
+  id: "opencode-codeops",
+  async setup(ctx) {
+    const directory = ctx.location.directory
 
-  return {
-    // -----------------------------------------------------------------------
-    // Hook 1 & 2: inject standards on session.created and session.compacted.
-    // Both are dispatched via the generic event hook.
-    // session.created  → new session    (Codex: startup)
-    // session.compacted → after compact  (Codex: resume|compact)
-    // Also the hygiene lifecycle: a new top-level session sweeps abandoned
-    // temp directories once, and a deleted session's temp directory is removed.
-    // -----------------------------------------------------------------------
-    event: async ({ event }) => {
-      if (event.type === "session.created") {
-        const info = (event.properties as { info: { id: string; parentID?: string } }).info
-        await injectStandards(client, info.id)
-        await warnOnVersionSkew(client, directory)
-        if (!info.parentID) sweepStaleTmpDirsOnce()
-      } else if (event.type === "session.deleted") {
-        const info = (event.properties as { info: { id: string } }).info
-        removeSessionTmpDir(info.id)
-        try {
-          effortMarkers.delete(info.id)
-        } catch {
-          await warnContentFree(client, "Could not clear captured reasoning-effort markers.")
-        }
-      } else if (event.type === "session.compacted") {
-        const sessionId: string = (event.properties as { sessionID: string }).sessionID
-        await injectStandards(client, sessionId)
-      }
-    },
+    // Reasoning-effort state lives for the lifetime of this plugin instance:
+    // the latest dispatch-marker level per session, plus a deduplication set
+    // for unsupported-level warnings.
+    const effortMarkers = new Map<string, EffortLevel>()
+    const warnedEffortLevels = new Set<string>()
+    const effortTraceEnabled = isEffortTraceEnabled(process.env.CODEOPS_EFFORT_TRACE)
 
-    // -----------------------------------------------------------------------
-    // Hook 3: inject standards into the compaction context itself, so they
-    // survive through the compaction summary and are not lost mid-session.
-    // -----------------------------------------------------------------------
-    "experimental.session.compacting": async (_input, output) => {
-      output.context.push(
-        "## CodeOps Standards (always active — survive this compaction)\n\n" +
-          standardsText
-      )
-    },
+    // Sweep scratch directories abandoned by earlier interrupted runs, once.
+    // Cleanup is best effort: a failure must never block a session.
+    try {
+      cleanStaleTmpDirs()
+    } catch {
+      // Best effort only.
+    }
 
-    // -----------------------------------------------------------------------
-    // Hook 4: export CODEOPS_PLUGIN_ROOT into every shell so skills can call
-    // scripts as: python3 "${CODEOPS_PLUGIN_ROOT}/scripts/codeops_plan.py"
-    // The value is the package root (parent of this plugin/ directory), which
-    // is where skills/, scripts/, and the other shipped assets live.
-    // CODEOPS_TMPDIR is the session's directory under the CodeOps temp root;
-    // skills and agents put every scratch file there and delete it when done.
-    // -----------------------------------------------------------------------
-    "shell.env": async (input, output) => {
-      output.env.CODEOPS_PLUGIN_ROOT = PACKAGE_ROOT
+    warnOnVersionSkew(directory)
+
+    // ---------------------------------------------------------------------
+    // Session lifecycle: drop captured markers when a session is deleted, so
+    // a long-lived runtime does not remember ended sessions.
+    // ---------------------------------------------------------------------
+    const controller = new AbortController()
+    void (async () => {
       try {
-        output.env.CODEOPS_TMPDIR = ensureSessionTmpDir(input.sessionID)
+        for await (const event of ctx.event.subscribe({ signal: controller.signal })) {
+          if (event.type === "session.deleted") {
+            effortMarkers.delete(event.data.sessionID)
+          }
+        }
       } catch {
-        // Best effort: a temp-directory failure must never block a shell.
+        // The stream ended or the plugin unloaded; nothing to do.
       }
-    },
-
-    // -----------------------------------------------------------------------
-    // Hook 5: advisory guard — warn (non-blocking) if any edit tool targets
-    // codeops/.codeops.yml, which is owned exclusively by the setup-codeops
-    // skill. Equivalent to Codex PreToolUse hook_marker_guard.sh.
-    // args are on the output parameter per the OpenCode plugin type signature.
-    // -----------------------------------------------------------------------
-    "tool.execute.before": async (input, output) => {
-      const editTools = ["write", "edit", "apply_patch"]
-      if (!editTools.includes(input.tool)) return
+    })()
 
-      const args = output.args as Record<string, unknown> | undefined
-      const filePath: string =
-        (args?.filePath as string | undefined) ??
-        (args?.path as string | undefined) ??
-        ""
+    // ---------------------------------------------------------------------
+    // Standards injection: add the CodeOps standards to every agent-loop
+    // request and to every compaction summary, so every agent and every turn
+    // sees them and they cannot be lost to compaction.
+    // ---------------------------------------------------------------------
+    await ctx.session.hook("context", (event) => {
+      event.system.push({ type: "text", text: standardsText })
+    })
 
-      if (filePath.includes("codeops/.codeops.yml")) {
-        process.stderr.write(
-          "CodeOps warning: codeops/.codeops.yml is the layout marker and is " +
-            "owned by setup-codeops. Edit it only through the setup/migration " +
-            "workflow (run the setup-codeops skill).\n"
-        )
-      }
-    },
+    await ctx.session.hook("compaction", (event) => {
+      event.system.push({ type: "text", text: `${STANDARDS_HEADING}\n\n${standardsText}` })
+    })
 
-    // -----------------------------------------------------------------------
-    // Hook 6: capture a dispatch marker from an incoming user message. The
-    // marker travels in the dispatch packet text; it is remembered for the
-    // whole session, because the later chat.params hook receives the latest
-    // user message, which can differ from the message that carried it.
-    // -----------------------------------------------------------------------
-    "chat.message": async (input, output) => {
+    // ---------------------------------------------------------------------
+    // Effort capture: a dispatch marker travels in the incoming user prompt.
+    // It is remembered for the whole session, because the later request hook
+    // sees the same session rather than the message that carried it.
+    // ---------------------------------------------------------------------
+    await ctx.session.hook("prompt", (event) => {
       try {
-        const texts = output.parts.map((part) =>
-          part?.type === "text" ? part.text : undefined
-        )
-        const level = findEffortMarker(texts)
+        const level = findEffortMarker([event.prompt.text])
         if (level !== undefined) {
-          effortMarkers.set(input.sessionID, level)
-          traceEffort(effortTraceEnabled, input.sessionID, {
+          effortMarkers.set(event.sessionID, level)
+          traceEffort(effortTraceEnabled, event.sessionID, {
             event: "capture",
-            messageID: output.message.id,
+            messageID: event.messageID,
             level,
           })
         }
       } catch {
-        await warnContentFree(client, "Could not scan a message for a reasoning-effort marker.")
+        warnContentFree("Could not scan a message for a reasoning-effort marker.")
       }
-    },
+    })
 
-    // -----------------------------------------------------------------------
-    // Hook 7: resolve the request's reasoning level (dispatch marker, then
-    // session flag, then routing default) and merge the model's own variant
-    // options. Any failure leaves the request unchanged.
-    // -----------------------------------------------------------------------
-    "chat.params": async (input, output) => {
+    // ---------------------------------------------------------------------
+    // Effort apply: resolve the request's reasoning level (dispatch marker,
+    // then session flag, then routing default) and merge the model's own
+    // variant options. Any failure leaves the request unchanged.
+    // ---------------------------------------------------------------------
+    await ctx.session.hook("context", async (event) => {
       try {
-        const marker = effortMarkers.get(input.sessionID)
-        const session = readSessionEffort(input.sessionID)
-        const routing = readRoutingReasoning(readRoutingConfig(directory), input.agent)
+        const marker = effortMarkers.get(event.sessionID)
+        const session = readSessionEffort(runtimeID)
+        const routing = readRoutingReasoning(readRoutingConfig(directory), event.agent)
         const level = resolveEffort({ marker, session, routing })
         const source = isEffortLevel(marker)
           ? "marker"
@@ -331,10 +304,9 @@ export const CodeOpsPlugin: Plugin = async ({ client, directory }) => {
               ? "routing"
               : "none"
         if (level === undefined) {
-          traceEffort(effortTraceEnabled, input.sessionID, {
+          traceEffort(effortTraceEnabled, event.sessionID, {
             event: "apply",
-            messageID: input.message.id,
-            agent: input.agent,
+            agent: event.agent,
             level: null,
             source,
             applied: false,
@@ -342,37 +314,88 @@ export const CodeOpsPlugin: Plugin = async ({ client, directory }) => {
           return
         }
 
-        const applied = applyEffort(output.options, level, input.model)
-        const changed = applied !== output.options
-        traceEffort(effortTraceEnabled, input.sessionID, {
+        const variants = await readModelVariants(ctx, event.model)
+        const model = { variants }
+        const applied = applyEffort(event.options, level, model)
+        const changed = applied !== event.options
+        traceEffort(effortTraceEnabled, event.sessionID, {
           event: "apply",
-          messageID: input.message.id,
-          agent: input.agent,
+          agent: event.agent,
           level,
           source,
           applied: changed,
-          variant: selectEffortVariant(level, input.model) ?? null,
-          reasoningSupported: modelSupportsReasoning(input.model),
-          variantLevels: Object.keys(extractModelVariants(input.model) ?? {}),
+          variant: selectEffortVariant(level, model) ?? null,
+          variantLevels: Object.keys(extractModelVariants(model) ?? {}),
         })
         if (!changed) {
           if (marker !== undefined) {
-            const warningKey = `${input.sessionID}:${marker}`
+            const warningKey = `${event.sessionID}:${marker}`
             if (!warnedEffortLevels.has(warningKey)) {
               warnedEffortLevels.add(warningKey)
-              await warnContentFree(
-                client,
-                `Reasoning effort ${marker} is not available for agent ${input.agent}; ` +
+              warnContentFree(
+                `Reasoning effort ${marker} is not available for agent ${event.agent}; ` +
                   "request left unchanged."
               )
             }
           }
           return
         }
-        output.options = applied
+        Object.assign(event.options, applied)
       } catch {
-        await warnContentFree(client, "Could not apply a reasoning-effort level to a request.")
+        warnContentFree("Could not apply a reasoning-effort level to a request.")
       }
-    },
-  }
-}
+    })
+
+    // ---------------------------------------------------------------------
+    // Shell environment: export CODEOPS_PLUGIN_ROOT so skills can call
+    // scripts as: python3 "${CODEOPS_PLUGIN_ROOT}/scripts/codeops_plan.py".
+    // CODEOPS_TMPDIR is this runtime's scratch directory; skills and agents
+    // put every scratch file there and delete it when done.
+    // ---------------------------------------------------------------------
+    await ctx.shell.hook("create.before", (event) => {
+      event.env.CODEOPS_PLUGIN_ROOT = PACKAGE_ROOT
+      try {
+        event.env.CODEOPS_TMPDIR = ensureSessionTmpDir(runtimeID)
+      } catch {
+        // Best effort: a temp-directory failure must never block a shell.
+      }
+    })
+
+    // ---------------------------------------------------------------------
+    // Advisory guard: warn (non-blocking) if any edit tool targets
+    // codeops/.codeops.yml, which is owned exclusively by the setup-codeops
+    // skill.
+    // ---------------------------------------------------------------------
+    await ctx.tool.hook("execute.before", (event) => {
+      const editTools = ["write", "edit", "apply_patch", "multiedit", "patch"]
+      if (!editTools.includes(event.tool)) return
+
+      const input = isRecord(event.input) ? event.input : undefined
+      const filePath =
+        (typeof input?.filePath === "string" ? input.filePath : undefined) ??
+        (typeof input?.path === "string" ? input.path : undefined) ??
+        ""
+
+      if (filePath.includes("codeops/.codeops.yml")) {
+        process.stderr.write(
+          "CodeOps warning: codeops/.codeops.yml is the layout marker and is " +
+            "owned by setup-codeops. Edit it only through the setup/migration " +
+            "workflow (run the setup-codeops skill).\n"
+        )
+      }
+    })
+
+    // ---------------------------------------------------------------------
+    // Plugin cleanup: stop listening for events and remove the runtime's
+    // scratch directory. Both are best effort.
+    // ---------------------------------------------------------------------
+    return () => {
+      controller.abort()
+      try {
+        removeSessionTmpDir(runtimeID)
+      } catch {
+        // Best effort only.
+      }
+    }
+  },
+})

package/standards/coding-standards-full.md

@@ -54,8 +54,8 @@ These apply to all code I write unless this project's `AGENTS.md` overrides a sp
 
 - **Own your temporary artifacts.** Verification logs, diffs, patch files, commit-message files,
   scratch directories, fixture trees, and downloaded artifacts are borrowed space. Put them under
-  `$CODEOPS_TMPDIR` when the CodeOps plugin exports it (one directory per session); otherwise use
-  the OS temp directory. Never write temporary files into the repository.
+  `$CODEOPS_TMPDIR` when the CodeOps plugin exports it (one directory per OpenCode runtime);
+  otherwise use the OS temp directory. Never write temporary files into the repository.
 - **Delete at completion.** Before reporting any task, phase, or session complete, delete every
   temporary artifact the run created — including verification logs. If the user asked for an
   artifact to be kept, name its exact path and keep that file only.