Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
71 commits
Select commit Hold shift + click to select a range
6288a03
bump bun to 1.3.4
rekram1-node Dec 10, 2025
03c6c3f
docs: document accept always behavior (#5340)
igordertigor Dec 10, 2025
936a6be
stuff adam needs
thdxr Dec 10, 2025
a1175bd
gen types
thdxr Dec 10, 2025
0ab3b88
chore: format code
actions-user Dec 10, 2025
59fb3ae
ignore: add bash tests
rekram1-node Dec 10, 2025
9ad828d
tui: use random free port and enable icon discovery by default
thdxr Dec 10, 2025
8d3eac2
fix type
thdxr Dec 10, 2025
67a95c3
wip(desktop): progress
adamdotdevin Dec 10, 2025
a4ec619
wip(desktop): progress
adamdotdevin Dec 10, 2025
6866a06
wip(desktop): progress
adamdotdevin Dec 10, 2025
ada40de
wip(desktop): progress
adamdotdevin Dec 10, 2025
e694d4d
wip(desktop): progress
adamdotdevin Dec 10, 2025
f20d6e8
wip(desktop): progress
adamdotdevin Dec 10, 2025
804ad58
wip(desktop): progress
adamdotdevin Dec 10, 2025
91d743e
wip(desktop): progress
adamdotdevin Dec 10, 2025
190fa4c
wip(desktop): progress
adamdotdevin Dec 10, 2025
58e66dd
wip(desktop): progress
adamdotdevin Dec 10, 2025
86f7cc1
tui: pass dynamic port to frontend
thdxr Dec 10, 2025
e060f96
Update Nix flake.lock and hashes
actions-user Dec 10, 2025
7435d94
fix(cli): obtain directory data from server (#5320)
OpeOginni Dec 10, 2025
7d82f17
tweak: small fix
rekram1-node Dec 10, 2025
e46080a
fix(auth): add plugin lookup for custom provider in 'Other' flow (#5324)
Yukaii Dec 10, 2025
72eb004
feat: add helicone docs + helicone session tracking (#5265)
H2Shami Dec 10, 2025
b274371
feat: use |- for intermediate sub-agent steps (#5336)
paralin Dec 10, 2025
e36c349
tweak: oc -> OC
rekram1-node Dec 10, 2025
cbb591e
fix: more descriptive tool or subtask execution failed error (#5337)
paralin Dec 10, 2025
85cfa22
wip(desktop): progress
adamdotdevin Dec 10, 2025
15b8c14
fix: tauri
adamdotdevin Dec 10, 2025
89d51ad
compaction: improve compaction prompt (#5348)
shantur Dec 10, 2025
56540f8
wip(desktop): progress
adamdotdevin Dec 10, 2025
1a1874d
docs: desktop
jayair Dec 10, 2025
92fa66d
core: reposition OpenCode as open source multi-platform coding agent
jayair Dec 11, 2025
1361117
fix deploy
thdxr Dec 11, 2025
fadeed1
desktop: enable zoom hotkeys in Tauri app
thdxr Dec 11, 2025
df55ad8
Add Cerebras integration header with opencode identifier (#5354)
sebastiand-cerebras Dec 11, 2025
01fd0d8
docs(bash): clarify description parameter is required (#5353)
zenyr Dec 11, 2025
499ad4f
fix: light mode visibility for filepath in /undo diff files (#5352)
koichincom Dec 11, 2025
bd1f5f8
tauri: update icons
Brendonovich Dec 11, 2025
6f5f73a
desktop: exclude ts-dist from tsconfig sources
Brendonovich Dec 11, 2025
439aebb
tweak: correct thinkingLevel
rekram1-node Dec 11, 2025
7b4f852
ignore: tmp transform exclusion
rekram1-node Dec 11, 2025
530b75a
ignore
thdxr Dec 11, 2025
13a7700
global.dispose
thdxr Dec 11, 2025
28c6320
chore: format code
actions-user Dec 11, 2025
d88912a
global bus
thdxr Dec 11, 2025
9b05217
ignore
thdxr Dec 11, 2025
f1b8707
ignore
thdxr Dec 11, 2025
7eb509d
ci: rm bash tool from opencode ci workflow, reduce risks
rekram1-node Dec 11, 2025
d93c8c7
docs: update doc sdk.mdx (#5315)
AyushWalekar Dec 11, 2025
a02223a
sync
thdxr Dec 11, 2025
d14462f
fix
thdxr Dec 11, 2025
4309c07
domain
thdxr Dec 11, 2025
5955d20
remove
thdxr Dec 11, 2025
231390c
ci
thdxr Dec 11, 2025
578072b
use new share url
thdxr Dec 11, 2025
6251231
release: v1.0.144
Dec 11, 2025
40f121c
prevent indexing of share page
thdxr Dec 11, 2025
65a6b3d
chore: format code
actions-user Dec 11, 2025
85c01e8
enterprise: add social card meta tags to share pages
thdxr Dec 11, 2025
2d9c76b
enterprise: add default social card images to HTML head
thdxr Dec 11, 2025
9e0a2bc
Update Nix flake.lock and hashes
actions-user Dec 11, 2025
a8f83cd
ignore: comment out item in project cfg
rekram1-node Dec 11, 2025
f7e29a1
downgrade bun
rekram1-node Dec 11, 2025
5d57d03
opencode config
thdxr Dec 11, 2025
c211b22
update
thdxr Dec 11, 2025
fbad378
release: v1.0.145
Dec 11, 2025
ddd5464
release: v1.0.146
Dec 11, 2025
dd4e690
sync: merge upstream v1.0.146 into integration
opencode-agent[bot] Dec 11, 2025
feed63a
sync: merge upstream v1.0.146 into integration
opencode-agent[bot] Dec 11, 2025
503d678
chore: format code
actions-user Dec 11, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/last-synced-tag
Original file line number Diff line number Diff line change
@@ -1 +1 @@
v1.0.143
v1.0.146
13 changes: 0 additions & 13 deletions .opencode/opencode.jsonc
Original file line number Diff line number Diff line change
Expand Up @@ -9,17 +9,4 @@
"options": {},
},
},
"mcp": {
"exa": {
"type": "remote",
"url": "https://mcp.exa.ai/mcp",
},
"morph": {
"type": "local",
"command": ["bunx", "@morphllm/morphmcp"],
"environment": {
"ENABLED_TOOLS": "warp_grep",
},
},
},
}
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ _Last updated: 2025-12-10_
</picture>
</a>
</p>
<p align="center">The AI coding agent built for the terminal.</p>
<p align="center">The open source AI coding agent.</p>
<p align="center">
<a href="https://opencode.ai/discord"><img alt="Discord" src="https://img.shields.io/discord/1391832426048651334?style=flat-square&label=discord" /></a>
<a href="https://www.npmjs.com/package/opencode-ai"><img alt="npm" src="https://img.shields.io/npm/v/opencode-ai?style=flat-square" /></a>
Expand Down
77 changes: 38 additions & 39 deletions bun.lock

Large diffs are not rendered by default.

6 changes: 3 additions & 3 deletions infra/enterprise.ts
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
import { SECRET } from "./secret"
import { domain } from "./stage"
import { domain, shortDomain } from "./stage"

const storage = new sst.cloudflare.Bucket("EnterpriseStorage")

const enterprise = new sst.cloudflare.x.SolidStart("Enterprise", {
domain: "enterprise." + domain,
const teams = new sst.cloudflare.x.SolidStart("Teams", {
domain: shortDomain,
path: "packages/enterprise",
buildCommand: "bun run build:cloudflare",
environment: {
Expand Down
6 changes: 6 additions & 0 deletions infra/stage.ts
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,9 @@ new cloudflare.RegionalHostname("RegionalHostname", {
regionKey: "us",
zoneId: zoneID,
})

export const shortDomain = (() => {
if ($app.stage === "production") return "opncd.ai"
if ($app.stage === "dev") return "dev.opncd.ai"
return `${$app.stage}.dev.opncd.ai`
})()
2 changes: 1 addition & 1 deletion nix/hashes.json
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
{
"nodeModules": "sha256-JT8J+Nd2kk0x46BcyotmBbM39tuKOW7VzXfOV3R3sqQ="
"nodeModules": "sha256-WcFRAG8w1XwgZxzyAawkQ7mYfJxu5VhA3sPApEG6FdI="
}
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
"@tsconfig/bun": "1.0.9",
"@cloudflare/workers-types": "4.20251008.0",
"@openauthjs/openauth": "0.0.0-20250322224806",
"@pierre/precision-diffs": "0.6.0-beta.10",
"@pierre/precision-diffs": "0.6.1",
"@tailwindcss/vite": "4.1.11",
"diff": "8.0.2",
"ai": "5.0.97",
Expand Down
2 changes: 1 addition & 1 deletion packages/console/app/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@opencode-ai/console-app",
"version": "1.0.143",
"version": "1.0.146",
"type": "module",
"scripts": {
"typecheck": "tsgo --noEmit",
Expand Down
2 changes: 1 addition & 1 deletion packages/console/app/src/app.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ export default function App() {
root={(props) => (
<MetaProvider>
<Title>opencode</Title>
<Meta name="description" content="OpenCode - The AI coding agent built for the terminal." />
<Meta name="description" content="OpenCode - The open source coding agent." />
<Favicon />
<Suspense>{props.children}</Suspense>
</MetaProvider>
Expand Down
8 changes: 4 additions & 4 deletions packages/console/app/src/config.ts
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ export const config = {
github: {
repoUrl: "https://github.com/sst/opencode",
starsFormatted: {
compact: "35K",
full: "35,000",
compact: "38K",
full: "38,000",
},
},

Expand All @@ -22,8 +22,8 @@ export const config = {

// Static stats (used on landing page)
stats: {
contributors: "350",
commits: "5,000",
contributors: "375",
commits: "5,250",
monthlyUsers: "400,000",
},
} as const
17 changes: 5 additions & 12 deletions packages/console/app/src/routes/index.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -157,15 +157,9 @@ export default function Home() {
<section data-component="what">
<div data-slot="section-title">
<h3>What is OpenCode?</h3>
<p>OpenCode is an open source agent that helps you write and run code directly from the terminal.</p>
<p>OpenCode is an open source agent that helps you write code in your terminal, IDE, or desktop.</p>
</div>
<ul>
<li>
<span>[*]</span>
<div>
<strong>Native TUI</strong> A responsive, native, themeable terminal UI
</div>
</li>
<li>
<span>[*]</span>
<div>
Expand Down Expand Up @@ -199,7 +193,7 @@ export default function Home() {
<li>
<span>[*]</span>
<div>
<strong>Any editor</strong> OpenCode runs in your terminal, pair it with any IDE
<strong>Any editor</strong> Available as a terminal interface, desktop app, and IDE extension
</div>
</li>
</ul>
Expand Down Expand Up @@ -651,9 +645,8 @@ export default function Home() {
<ul>
<li>
<Faq question="What is OpenCode?">
OpenCode is an open source agent that helps you write and run code directly from the terminal. You can
pair OpenCode with any AI model, and because it’s terminal-based you can pair it with your preferred
code editor.
OpenCode is an open source agent that helps you write and run code with any AI model. It's available
as a terminal-based interface, desktop app, or IDE extension.
</Faq>
</li>
<li>
Expand All @@ -674,7 +667,7 @@ export default function Home() {
</li>
<li>
<Faq question="Can I only use OpenCode in the terminal?">
Yes, for now. We are actively working on a desktop app. Join the waitlist for early access.
Not anymore! OpenCode is now available as an app for your desktop.
</Faq>
</li>
<li>
Expand Down
20 changes: 20 additions & 0 deletions packages/console/app/src/routes/t/[...path].tsx
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
import type { APIEvent } from "@solidjs/start/server"

async function handler(evt: APIEvent) {
const req = evt.request.clone()
const url = new URL(req.url)
const targetUrl = `https://enterprise.opencode.ai/${url.pathname}${url.search}`
const response = await fetch(targetUrl, {
method: req.method,
headers: req.headers,
body: req.body,
})
return response
}
Comment on lines +3 to +13
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: Add authentication, error handling, and fix URL construction.

The proxy handler has several critical issues:

  1. URL Construction Bug (Line 6): The template literal creates a double slash when url.pathname starts with /. Use https://enterprise.opencode.ai${url.pathname}${url.search} instead.

  2. Missing Authentication: No authentication or authorization checks before proxying requests to the enterprise endpoint, potentially exposing the backend to unauthorized access.

  3. No Error Handling: The fetch call lacks error handling. Network failures, timeouts, or non-2xx responses will propagate as unhandled errors.

  4. No Timeout: External calls should have timeout protection to prevent hanging request threads.

  5. Header Leakage: Blindly forwarding all headers (line 9) could leak sensitive client information (cookies, auth tokens, internal headers) to the external service.

  6. Body Streaming: For large request bodies, consider whether the body cloning approach (line 4) is appropriate or if streaming is needed.

Apply this diff to fix the URL construction:

-  const targetUrl = `https://enterprise.opencode.ai/${url.pathname}${url.search}`
+  const targetUrl = `https://enterprise.opencode.ai${url.pathname}${url.search}`

Consider adding authentication, error handling, and timeout:

async function handler(evt: APIEvent) {
  // Add authentication check
  const authHeader = evt.request.headers.get("authorization")
  if (!authHeader || !isValidAuth(authHeader)) {
    return new Response("Unauthorized", { status: 401 })
  }

  const req = evt.request.clone()
  const url = new URL(req.url)
  const targetUrl = `https://enterprise.opencode.ai${url.pathname}${url.search}`
  
  try {
    const controller = new AbortController()
    const timeout = setTimeout(() => controller.abort(), 30000) // 30s timeout
    
    const response = await fetch(targetUrl, {
      method: req.method,
      headers: sanitizeHeaders(req.headers), // Filter sensitive headers
      body: req.body,
      signal: controller.signal,
    })
    
    clearTimeout(timeout)
    return response
  } catch (error) {
    if (error instanceof Error && error.name === 'AbortError') {
      return new Response("Request timeout", { status: 504 })
    }
    return new Response("Proxy error", { status: 502 })
  }
}
🤖 Prompt for AI Agents
In packages/console/app/src/routes/t/[...path].tsx around lines 3 to 13, fix the
URL construction to avoid double slashes by using
`https://enterprise.opencode.ai${url.pathname}${url.search}` and add
authentication, header sanitization, timeout and error handling: check
evt.request.headers.get("authorization") and validate with an isValidAuth helper
returning 401 when missing/invalid; sanitize request headers to remove
cookies/internal headers before forwarding; use an AbortController with a ~30s
timeout and pass its signal to fetch; wrap fetch in try/catch and return 504 for
abort/timeouts and 502 for other errors; continue to forward the request body
but consider streaming for large payloads rather than cloning.


export const GET = handler
export const POST = handler
export const PUT = handler
export const DELETE = handler
export const OPTIONS = handler
export const PATCH = handler
2 changes: 1 addition & 1 deletion packages/console/core/package.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"$schema": "https://json.schemastore.org/package.json",
"name": "@opencode-ai/console-core",
"version": "1.0.143",
"version": "1.0.146",
"private": true,
"type": "module",
"dependencies": {
Expand Down
2 changes: 1 addition & 1 deletion packages/console/function/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@opencode-ai/console-function",
"version": "1.0.143",
"version": "1.0.146",
"$schema": "https://json.schemastore.org/package.json",
"private": true,
"type": "module",
Expand Down
2 changes: 1 addition & 1 deletion packages/console/mail/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@opencode-ai/console-mail",
"version": "1.0.143",
"version": "1.0.146",
"dependencies": {
"@jsx-email/all": "2.2.3",
"@jsx-email/cli": "1.4.3",
Expand Down
2 changes: 1 addition & 1 deletion packages/desktop/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@opencode-ai/desktop",
"version": "1.0.143",
"version": "1.0.146",
"description": "",
"type": "module",
"exports": {
Expand Down
8 changes: 7 additions & 1 deletion packages/desktop/src/app.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,14 @@ import { GlobalSDKProvider } from "./context/global-sdk"
import { SessionProvider } from "./context/session"
import { Show } from "solid-js"

declare global {
interface Window {
__OPENCODE__?: { updaterEnabled?: boolean; port?: number }
}
}

const host = import.meta.env.VITE_OPENCODE_SERVER_HOST ?? "127.0.0.1"
const port = import.meta.env.VITE_OPENCODE_SERVER_PORT ?? "4096"
const port = window.__OPENCODE__?.port ?? import.meta.env.VITE_OPENCODE_SERVER_PORT ?? "4096"

const url =
new URLSearchParams(document.location.search).get("url") ||
Expand Down
Loading
Loading