{
  "name": {
    "finding": "OpenCode, an open source AI coding agent (terminal TUI, CLI, desktop app, IDE extension). The repository sst/opencode now redirects to anomalyco/opencode (org 'Anomaly'). Docs at opencode.ai/docs describe OpenCode 1; a rewritten 'OpenCode 2' exists under /v2/docs and both install the `opencode` binary.",
    "source": "https://api.github.com/repos/anomalyco/opencode",
    "quote": "\"full_name\": \"anomalyco/opencode\" ... \"description\": \"The open source coding agent.\""
  },
  "repo": {
    "finding": "https://github.com/sst/opencode (redirects to https://github.com/anomalyco/opencode)",
    "source": "https://github.com/anomalyco/opencode",
    "quote": "anomalyco / opencode ... The open source coding agent. opencode.ai ... MIT license"
  },
  "headless": [
    {
      "finding": "Non-interactive execution is supported via the `opencode run` subcommand: `opencode run [message..]` takes the prompt as positional arguments and is documented for scripting/automation.",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "Run opencode in non-interactive mode by passing a prompt directly. ... This is useful for scripting, automation, or when you want a quick answer without launching the full TUI."
    },
    {
      "finding": "The working directory is passed with the `--dir` flag of `opencode run`; the session can also be directed with `--session`/`--continue`/`--fork`, `--model`, `--agent`, `--command` and `--file`.",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "`--dir` | Directory to run in, or path on the remote server when attaching"
    },
    {
      "finding": "Actions are auto-approved with no person present via the `--auto` flag on `opencode run` (or at startup); explicit `deny` permission rules are still enforced.",
      "source": "https://opencode.ai/docs/permissions/",
      "quote": "Start OpenCode with `--auto` to automatically approve permission requests that are not explicitly denied. ... `opencode run --auto \"Refactor this module\"`"
    },
    {
      "finding": "Machine-readable output is available via `opencode run --format json`, which emits raw JSON events; there is also `opencode serve` (headless HTTP server) plus a JS/TS SDK and `opencode run --attach <url>` to run against a persistent server.",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "`--format` | Format: default (formatted) or json (raw JSON events) ... `opencode serve` ... Start a headless OpenCode server for API access."
    },
    {
      "finding": "Whether `run` requires a TTY or explicitly exits when the prompt completes is not documented; the docs only state it is 'non-interactive mode' for scripting. A community plugin exists specifically for non-interactive shells ('opencode-shell-strategy ... prevents hangs from TTY-dependent operations'), suggesting TTY edge cases exist in practice.",
      "source": "https://opencode.ai/docs/ecosystem/",
      "quote": "opencode-shell-strategy | Instructions for non-interactive shell commands - prevents hangs from TTY-dependent operations"
    }
  ],
  "confinement": [
    {
      "finding": "Shell commands are limited by the `permission.bash` ruleset: allow/ask/deny per command pattern (wildcards `*`, `?`), e.g. `\"bash\": {\"*\": \"ask\", \"git *\": \"allow\", \"rm *\": \"deny\"}`; permissions are configurable globally, per project (opencode.json), per agent, or inline via the OPENCODE_PERMISSION env var.",
      "source": "https://opencode.ai/docs/permissions/",
      "quote": "\"bash\": { \"*\": \"ask\", \"git *\": \"allow\", \"npm *\": \"allow\", \"rm *\": \"deny\", \"grep *\": \"allow\" } ... Each permission rule resolves to one of: \"allow\" - run without approval, \"ask\" - prompt for approval, \"deny\" - block the action"
    },
    {
      "finding": "File writes are limited by `permission.edit` (covers edit, write, patch tools, matched against file paths), plus `external_directory` which gates ANY tool touching paths outside the working directory (defaults to 'ask'); `doom_loop` (repeat identical tool call 3x) also defaults to 'ask'. A read-only mode is effectively available via the built-in `plan` agent, which denies edits/writes/patches.",
      "source": "https://opencode.ai/docs/permissions/",
      "quote": "Use `external_directory` to allow tool calls that touch paths outside the working directory where OpenCode was started. ... `doom_loop` and `external_directory` default to \"ask\"."
    },
    {
      "finding": "Network access for agent tools is governed by `webfetch` and `websearch` permissions (allow/ask/deny); proxy/custom-CA support exists via HTTPS_PROXY/HTTP_PROXY/NO_PROXY and NODE_EXTRA_CA_CERTS env vars, but no egress allowlist or OS-level network sandbox is documented.",
      "source": "https://opencode.ai/docs/permissions/",
      "quote": "`webfetch` - fetching a URL (one action for all URLs); `websearch` - web search"
    },
    {
      "finding": "No built-in OS-level sandbox (Docker/seatbelt/landlock) is documented for OpenCode 1. A PR adding experimental macOS sandbox-exec confinement (experimental.sandbox, presets, workspace-write/read-only modes) was closed unmerged on 2026-05-15. Third-party ecosystem plugins provide external sandboxing (opencode-daytona: isolated Daytona sandboxes; an opencode-sandbox plugin using seatbelt/bubblewrap appears in a docs PR).",
      "source": "https://api.github.com/repos/anomalyco/opencode/pulls/21538",
      "quote": "\"state\": \"closed\" ... \"merged_at\": null ... feat(opencode): add experimental macOS bash command sandboxing ... This PR adds opt-in macOS command sandboxing with `sandbox-exec`."
    },
    {
      "finding": "MCP servers and plugins are NOT covered by the sandbox/permission model boundary beyond per-tool permissions; `task` (launching subagents), `skill`, `lsp`, `question`, `todowrite`, `glob`, `grep`, `read` each have their own permission keys.",
      "source": "https://opencode.ai/docs/permissions/",
      "quote": "OpenCode permissions are keyed by tool name, plus a couple of safety guards: `read`, `edit`, `glob`, `grep`, `bash`, `task`, `todowrite`, `skill`, `lsp`, `question`, `webfetch`, `websearch`, `external_directory`, `doom_loop`"
    }
  ],
  "usage": [
    {
      "finding": "Token usage and cost are reported: `opencode stats` shows aggregate token usage and cost statistics for sessions, filterable by days (--days), tool count (--tools), model breakdown (--models) and project (--project).",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "### stats ... Show token usage and cost statistics for your OpenCode sessions. `opencode stats`"
    },
    {
      "finding": "Machine-readable per-step usage exists: `opencode run --format json` emits raw JSON events, and the server's generated types define per-assistant-message `cost: number` and `tokens: {input, output, reasoning, cache{read, write}}` on AssistantMessage and on each 'step-finish' part, so scripts can sum usage from the event stream or via the SDK session API.",
      "source": "https://github.com/anomalyco/opencode/blob/v1.19.4/packages/sdk/js/src/gen/types.gen.ts",
      "quote": "export type AssistantMessage = { ... cost: number; tokens: { input: number; output: number; reasoning: number; cache: { read: number; write: number } } } ... export type StepFinishPart = { ... type: \"step-finish\" ... cost: number; tokens: {...} }"
    },
    {
      "finding": "Cost in money is tracked: the Message/AssistantMessage schema carries a `cost` field and `opencode stats` reports cost; model pricing comes from the models.dev catalog. Session data can also be exported as JSON (`opencode export [sessionID]`, optional --sanitize).",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "### export ... Export session data as JSON. `opencode export [sessionID]`"
    }
  ],
  "parallel": [
    {
      "finding": "Subagents are supported: primary agents can invoke subagents (built-in 'general' and 'explore', plus user-defined `mode: subagent` agents in opencode.json or .md files); each subagent runs as a child session with its own permissions, and the 'general' agent is explicitly intended for parallel units of work. The `task` permission controls which subagent types may be launched.",
      "source": "https://opencode.ai/docs/agents/",
      "quote": "A general-purpose agent for researching complex questions and executing multi-step tasks. ... Use this to run multiple units of work in parallel."
    },
    {
      "finding": "Multiple independent sessions can run concurrently: a persistent `opencode serve` server accepts multiple `opencode run --attach` clients and SDK-created sessions; `session.children` lists child sessions created by subagents.",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "# Start a headless server in one terminal ... opencode serve ... # In another terminal, run commands that attach to it ... opencode run --attach http://localhost:4096 \"...\""
    }
  ],
  "providers": [
    {
      "finding": "75+ providers via the Vercel AI SDK and the models.dev catalog; the docs directory covers 302.AI, Amazon Bedrock, Anthropic, Atomic Chat, Azure OpenAI, Azure Cognitive Services, Baseten, Cerebras, Cloudflare AI Gateway, Cloudflare Workers AI, Cortecs, DeepSeek, Deep Infra, DigitalOcean, Eden AI, FrogBot, Fireworks AI, GitLab Duo, GitHub Copilot, GMI Cloud, Google Vertex AI, Groq, Hugging Face, Helicone, llama.cpp, IO.NET, LM Studio, Moonshot AI, MiniMax, Modal, NVIDIA, Nebius Token Factory, Ollama, Ollama Cloud, OpenAI, OpenCode Zen, OpenRouter, LLM Gateway, Poolside, SAP AI Core, STACKIT, OVHcloud AI Endpoints, Scaleway, SCX.ai, Snowflake Cortex, Together AI, Venice AI, Vercel AI Gateway, xAI, Z.AI, ZenMux; arbitrary OpenAI-compatible endpoints can be added as custom providers.",
      "source": "https://opencode.ai/docs/providers/",
      "quote": "OpenCode uses the AI SDK and Models.dev to support 75+ LLM providers and it supports running local models."
    },
    {
      "finding": "Local and OpenAI-compatible endpoints are supported via custom providers using `@ai-sdk/openai-compatible` with a configurable `options.baseURL` - documented for Ollama (localhost:11434/v1), LM Studio, llama.cpp's llama-server, Atomic Chat and NVIDIA NIM; any provider's baseURL can also be overridden in config.",
      "source": "https://opencode.ai/docs/providers/",
      "quote": "`npm` specifies the package to use for this provider. Here, `@ai-sdk/openai-compatible` is used for any OpenAI-compatible API. ... `options.baseURL` is the endpoint for the local server."
    }
  ],
  "subscriptionLogin": [
    {
      "finding": "Yes, for several providers - stated explicitly: 'you can use the following subscriptions in OpenCode with zero setup: ChatGPT Plus, Github Copilot, Gitlab Duo'. OpenAI uses a browser OAuth 'ChatGPT Plus/Pro' login in /connect; GitHub Copilot uses device-code login at github.com/login/device; GitLab Duo uses OAuth (Premium/Ultimate required).",
      "source": "https://opencode.ai/docs/providers/",
      "quote": "Other companies support freedom of choice with developer tooling - you can use the following subscriptions in OpenCode with zero setup: * ChatGPT Plus * Github Copilot * Gitlab Duo ... select the **ChatGPT Plus/Pro** option and it'll open your browser and ask you to authenticate ... Navigate to github.com/login/device and enter the code."
    },
    {
      "finding": "Additional OAuth/subscription logins documented: xAI SuperGrok subscription via device-code OAuth, DigitalOcean OAuth, Snowflake Cortex browser OAuth, Azure via `az login` (Microsoft Entra ID), plus OpenCode's own Zen/Go subscription plans.",
      "source": "https://opencode.ai/docs/providers/",
      "quote": "Two ways to authenticate: a SuperGrok subscription via device-code OAuth or a pay-as-you-go API key ... Browser OAuth (Recommended) - sign in with your IdP/SSO; no secrets to manage, tokens refresh"
    },
    {
      "finding": "Claude Pro/Max subscription login is NOT supported: bundled plugins enabling it were removed in v1.3.0 because 'Anthropic explicitly prohibits this'; Claude requires an Anthropic API key (or Bedrock/Vertex). A third-party ecosystem plugin (opencode-openai-codex-auth, opencode-gemini-auth) offers subscription auth for other vendors - third-party, not official.",
      "source": "https://opencode.ai/docs/providers/",
      "quote": "There are plugins that allow you to use your Claude Pro/Max models with OpenCode. Anthropic explicitly prohibits this. Previous versions of OpenCode came bundled with these plugins but that is no longer the case as of 1.3.0"
    }
  ],
  "license": {
    "finding": "MIT License (LICENSE file, copyright 2025 opencode); also reported by the GitHub API as SPDX MIT.",
    "source": "https://raw.githubusercontent.com/anomalyco/opencode/dev/LICENSE",
    "quote": "MIT License ... Copyright (c) 2025 opencode ... Permission is hereby granted, free of charge, to any person obtaining a copy"
  },
  "latestRelease": {
    "finding": "v1.19.4, released 2026-10-22 (tag 148842e, assets timestamped 2026-10-22T13:03Z). The 1.x line is maintained for OpenCode 1 while OpenCode 2 ships under a separate version line (v1.19.2 notes: 'OpenCode 1 now stays on the 1.x release line').",
    "source": "https://github.com/anomalyco/opencode/releases",
    "quote": "v1.19.4 [Latest] ... released this 22 Oct 13:03 ... Upgraded the bundled Bun runtime to 1.4.4"
  },
  "maintenance": {
    "finding": "Actively maintained: newest commit on the default branch `dev` dated 2026-10-27T03:42:32Z ('fix(cli): let plugin add install GUI-only packages'), repo pushed_at 2026-10-27T03:51:04Z; 21,441 commits, 222k stars, frequent releases (v1.19.4 Oct 22, v1.19.3 Oct 16, v1.19.2 Oct 16).",
    "source": "https://api.github.com/repos/anomalyco/opencode/commits/dev",
    "quote": "\"date\": \"2026-10-27T03:42:32Z\" ... \"message\": \"fix(cli): let plugin add install GUI-only packages (#59492)\""
  },
  "language": {
    "finding": "TypeScript (GitHub-detected primary language; monorepo with packages/cli, packages/opencode, packages/sdk etc., bundled Bun runtime, tests use bun:test).",
    "source": "https://api.github.com/repos/anomalyco/opencode",
    "quote": "\"language\": \"TypeScript\" ... \"default_branch\": \"dev\""
  },
  "install": {
    "finding": "Documented installs: `curl -fsSL https://opencode.ai/install | bash`; `npm|bun|pnpm|yarn install -g opencode-ai`; `brew install anomalyco/tap/opencode` (v1; `brew install opencode` installs v2); `sudo pacman -S opencode` / `paru -S opencode-bin` (AUR v1); `choco install opencode`; `scoop install opencode`; `mise use -g github:anomalyco/opencode`; `docker run -it --rm ghcr.io/anomalyco/opencode`; or binaries from the Releases page.",
    "source": "https://opencode.ai/docs/",
    "quote": "curl -fsSL https://opencode.ai/install | bash ... npm install -g opencode-ai ... brew install anomalyco/tap/opencode ... You can also grab the binary from the Releases."
  },
  "checkedOn": {
    "finding": "2026-10-27",
    "source": "https://opencode.ai/docs/",
    "quote": "Docs pages footer: Last updated: Oct 24, 2026 (site checked 2026-10-27)"
  },
  "gaps": [
    {
      "finding": "TTY requirement and guaranteed exit-on-completion for `opencode run`: not explicitly documented on the CLI page (only 'non-interactive mode ... useful for scripting'). Looked at: /docs/cli/, /docs/tui/, /docs/troubleshooting/.",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "Run opencode in non-interactive mode by passing a prompt directly."
    },
    {
      "finding": "Exact event schema of `opencode run --format json` output is not documented on the CLI page; token/cost fields were instead established from the generated SDK types file in the repo.",
      "source": "https://opencode.ai/docs/cli/",
      "quote": "`--format` | Format: default (formatted) or json (raw JSON events)"
    },
    {
      "finding": "No documented OS-level sandbox or network egress restriction for OpenCode 1 beyond tool permissions (webfetch/websearch) and proxy env vars; the experimental macOS sandbox PR (#21538) was closed unmerged, and docs PR for an opencode-sandbox plugin is third-party. Looked at: /docs/permissions/, /docs/network/, /docs/enterprise/, /docs/ecosystem/, GitHub PRs/issues.",
      "source": "https://api.github.com/repos/anomalyco/opencode/pulls/21538",
      "quote": "\"state\": \"closed\" ... \"merged_at\": null"
    },
    {
      "finding": "All provider docs and findings above describe OpenCode 1 (sst/anomalyco repo's 1.x line); OpenCode 2 under /v2/docs was not profiled and may differ.",
      "source": "https://opencode.ai/docs/",
      "quote": "OpenCode 1 and OpenCode 2 both use the `opencode` command and cannot be installed side by side under their default command."
    }
  ]
}