Repository navigation
feat(providers): verify OpenCode 1.18.32 for the deny-all policy - #613
Conversation
- Bump _OPENCODE_SUPPORTED_VERSION 1.18.31 -> 1.18.32 plus all version references (code comments, test fixtures, README pin note, DEVELOPMENT); run --help flags identical across the bump, no policy changes - Verified: file suite 41 passed / 3 skipped; ruff + format clean; version gate passes on real 1.18.32; raw default-model inference returns the exact nonce with valid envelope - Note: full provider-path inference stays blocked by the known isolation x auth limitation (pre-existing, version-independent); Groq llama-3.3-70b-versatile and llama-3.1-8b-instant are retired server-side (404), use current IDs for future probes Fixes NVIDIA#612 Signed-off-by: Yoseph Zuskin <[email protected]> Co-Authored-By: OpenCode Muse Spark 1.3 Free (1M context) <[email protected]>
rng1995
left a comment
rng1995
left a comment
There was a problem hiding this comment.
[SkillSpector Review]
Hi @Yoseph-Zuskin, thank you for your contribution to SkillSpector — we really appreciate it!
This PR bumps _OPENCODE_SUPPORTED_VERSION from 1.18.31 to 1.18.32 and updates every non-historical version reference: code comments, the test comment and banner fixture, README, and docs/DEVELOPMENT.md.
What I checked:
-
Version gate: the logic is unchanged.
_parse_opencode_versionfull-matches a plainX.Y.Z, and both_opencode_auth_checkand_preflight_opencode_policyrequire exact string equality. Only 1.18.32 is accepted; suffixed, pre-release and all other versions (now including 1.18.31) still fail closed. -
Deny-all envelope: untouched. That covers the isolated environment, the per-invocation agent, the inline config,
OPENCODE_PERMISSIONand thedebug configpreflight. -
Upstream delta: I reviewed
anomalyco/opencodev1.18.31...v1.18.32(51 commits). The changes that affect the CLI are limited to:- Bedrock image-attachment hoisting (
session/message-v2.ts) - the
@ai-sdk/togetheraibump - npm plugin entrypoint resolution under Node (
core/src/npm.ts). The Bun branch is unchanged, and plugins are disabled here anyway. - an import-only refactor of core filesystem search
Nothing touches config loading or precedence, permission merging, the
OPENCODE_*variables (including the internalOPENCODE_TEST_HOMEandOPENCODE_TEST_MANAGED_CONFIG_DIRoverrides),debug config, or therunflags. That is the same bar applied when #575 moved the pin to 1.18.31. - Bedrock image-attachment hoisting (
-
Tests: the rejection cases still fake 1.18.99, which is unsupported under either pin, and the acceptance fixtures use the constant. These tests run in CI (no
providermarker). -
Merge: the head merges cleanly with current
main, and no other OpenCode version pin exists in CI or.opencode/.
Findings
- [Non-blocking]
src/skillspector/providers/_agent_cli.py:463: OpenCode v1.18.33 was published on 2026-09-28, so latest-version users will be refused again as soon as this lands. Each single-version bump also drops the previously verified release, so 1.18.31 users have to upgrade in lockstep. Consider a follow-up that keeps exact matching (never ranges) but accepts an explicit set of individually verified versions. - [Non-blocking] Verification evidence: the description says full provider-path inference could not be run on 1.18.32. Given the upstream delta, a semantic change is very unlikely, and the runtime
debug configpreflight still fails closed on drift. Still, please record that_preflight_opencode_policypasses against the real 1.18.32 binary; it needs neither auth nor inference.--versionandauth listdo not check the resolved deny-all config, and a preflight mismatch would make the provider fail closed for every 1.18.32 user. The auth-isolation limitation noted in the description is worth tracking in its own issue, since it blocks live re-verification of future bumps. - [Non-blocking] The 2.12.0 release notes say OpenCode 1.18.31 is required. The next release notes should call out the move to 1.18.32, since 1.18.31 is now rejected.
Tests/CI: All six checks pass. This was a static review; contributor code and tests were not run locally.
Decision: Approved (reviewed head 1d60524f583fd4fcd565503788676395b2d7e3c6)
2 participants
Verify OpenCode 1.18.32 for the deny-all policy
Problem
opencode_clifails closed on any runtime but exactly1.18.31. OpenCode1.18.32 is out, so the provider currently refuses to run on latest — the
pin did its job, and now needs re-verification against the new release.
Fixes: #612
Approach
_OPENCODE_SUPPORTED_VERSION1.18.31 → 1.18.32 plus all versionreferences (code comments, test fixtures, README pin note,
docs/DEVELOPMENT.md). No behavior, flag, or policy changes:run --helpoutput is identical across the bump.already fake
1.18.99, wrong under either pin.Verification
tests/provider/test_opencode_cli.py: 41 passed / 3 skipped,ruff + format clean.
_opencode_auth_checkreturns
(True, None)against the installed binary).with a valid event envelope and empty temp cwd.
isolation × auth limitation (HOME/XDG redirect hides auth.json;
deny-all agent trips Zen-free 403) — pre-existing and
version-independent, identical code pre/post bump. Two Groq
model IDs tried for the probe are retired server-side (404).
Risks
behavior silently, this bump would bless it. Mitigation: flags diffed
identical, version gate + resolved-config audit + adversarial tests all
still pass unchanged.
Signed-off-by(maintainer: verify on push).