{
 "name": "OpenCode 2 (2.x line)",
 "repo": "https://github.com/anomalyco/opencode",
 "docs": "https://opencode.ai/v2/docs/",
 "headless": {
  "finding": "`opencode run [message..]` submits one prompt without the TUI and exits when the session ends. Flags (v2.1.4 source): --continue/-c, --session/-s, --fork, --model/-m provider/model#variant, --agent, --format default|json (json = one JSON event per line on stdout), --file/-f (attach up to 100 files, max 10 MiB each), --title, --thinking, --auto (hidden aliases --yolo, --dangerously-skip-permissions), plus --standalone (private server) or --server URL. Text after `--` is appended to the message. Piped stdin is read when stdin is not a TTY and is appended to the message, so a prompt file works as `opencode run < prompt.md`. There is no --prompt-file flag. `run` has no working-directory flag: it uses $PWD (or process.cwd()), so the script must cd into the target directory first. Only the root `opencode [directory]` TUI command takes a directory argument. Exit codes: 1 on error, on a failed/aborted step, or on a form a non-interactive run cannot answer; 130 when the user interrupts; otherwise unset (0). Approval prompts: without --auto every permission request that resolves to ask is auto-rejected with feedback and the model continues. With --auto the run answers 'once' to every request that is not explicitly denied. Questions are cancelled.",
  "quote": "Use opencode run to submit a prompt without opening the interactive interface. It is designed for scripts, CI jobs, and other workflows that need model output directly in the terminal. | auto: Flag.Boolean(\"auto\").pipe(Flag.withDescription(\"Auto-approve permissions that are not explicitly denied\") | const root = options.root ?? process.env.PWD ?? process.cwd() | const message = mergeInput(formatMessage(input.message), process.stdin.isTTY ? undefined : await readStdin()) | \"This non-interactive run cannot ask the user for permission, so the request was rejected. Continue without this action.\" | if (event.data.reason === \"user\" && interrupted) process.exitCode = 130",
  "url": "https://opencode.ai/v2/docs/cli/ ; https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/commands/commands.ts ; https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/run/run.ts ; https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/run/noninteractive.ts",
  "third_party": false
 },
 "confinement": {
  "finding": "Ordered `permissions` rules {action, resource, effect: allow|deny|ask}, where the last match wins and no match means ask. They can be set globally or per agent (agents.<id>.permissions). Built-in actions: read, edit (covers edit/write/patch, matched on the target path), glob, grep, shell (matched on scanner-produced command strings, wildcard patterns), subagent, skill, question, webfetch (URL), websearch (query), external_directory, MCP tools as <server>_<tool>, and execute (Code Mode). The default base policy allows everything (`*` allow) except asking for .env reads. external_directory is allowed by default, unlike V1. Separate `policies` are binary hard-denies (e.g. tool.use 'shell:sudo *', provider.use) that override permissions and saved approvals. Global and Console-managed policies outrank project config. Tools can be removed by denying their action (the V1 tools:{x:false} becomes a deny rule). No OS-level sandbox (Docker isolation, seatbelt, bubblewrap, gVisor) is described: the docs warn that shell runs with full host authority. A Docker image exists (ghcr.io/anomalyco/opencode:<version>), but the docs do not present it as a sandbox. No setting switches network off. Only webfetch/websearch can be denied as tools, and network settings cover only proxy variables. Shell network access is not restricted.",
  "quote": "shell runs with the host user’s filesystem, process, and network authority. Directory inference from command text is best effort, so prefer a narrow shell allowlist instead of patterns intended to recognize every dangerous command. | Every agent, including custom agents, starts with this ordered base policy: [ { \"action\": \"*\", \"resource\": \"*\", \"effect\": \"allow\" }, ... | Policies are binary, never prompt, and only ever tighten what permissions and providers would otherwise allow.",
  "url": "https://opencode.ai/v2/docs/permissions/ ; https://opencode.ai/v2/docs/policies/ ; https://opencode.ai/v2/docs/migrate-v1/ ; https://opencode.ai/v2/docs/network/ ; https://opencode.ai/v2/docs/",
  "third_party": false
 },
 "token_reporting": {
  "finding": "Yes, as JSON. With `opencode run --format json`, each model step emits a `step_finish` line {type, timestamp, sessionID, part:{type:'step-finish', reason, snapshot, cost, tokens}}. tokens is TokenUsage.Info = {input, output, reasoning, cache:{read, write}}, and cost is Money.USD. Errors are emitted as {type:'error', error:{type, message}}. The session record (Session.Info in the V2 API) also carries cost, allowance, tokens and outcome (succeeded|failed|interrupted). It can be read later with `opencode session export <id>` (JSON), through the server API, or from the SQLite DB whose path `opencode debug paths db` prints. `opencode stats` shows aggregated usage. With a ChatGPT-plan sign-in the docs say models show no cost. Default text output: no token line was found in the source checked.",
  "quote": "type: \"step-finish\", reason: event.data.finish, snapshot: event.data.snapshot, cost: event.data.cost, tokens: event.data.tokens, | export const Info = Schema.Struct({ input: Schema.Finite, output: Schema.Finite, reasoning: Schema.Finite, cache: Schema.Struct({ read: Schema.Finite, write: Schema.Finite, }), }).annotate({ identifier: \"TokenUsage.Info\" }) | Spec.make(\"export\", { description: \"Export session data as JSON\"",
  "url": "https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/run/noninteractive.ts ; https://github.com/anomalyco/opencode/blob/v2.1.4/packages/schema/src/token-usage.ts ; https://opencode.ai/v2/docs/api ; https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/commands/commands.ts ; https://opencode.ai/v2/docs/cli/ ; https://opencode.ai/v2/docs/providers/",
  "third_party": false
 },
 "parallelism": {
  "finding": "Subagents: the `subagent` tool starts a child session with a subagent-mode agent, in the foreground (waits) or with background: true (returns at once and notifies the parent). Builtin general and explore subagents exist, and custom ones live in .opencode/agents/*.md or the `agents` config. Which agents may be launched is gated by the `subagent` permission. Nesting depth defaults to 1 (experimental.subagent_depth). Commands with subagent: true run in a background child session. Code Mode `execute` can make parallel tool calls. Many sessions: one shared background server owns all sessions of all local clients, and --standalone gives each CLI run a private server. The docs give no explicit limit on concurrent top-level `run` processes and do not document a cap on parallel subagents.",
  "quote": "Foreground calls wait for the result. background: true returns immediately and notifies the parent when the child finishes. ... Only subagent-mode agents can be used, and the default nesting depth is one. | Subagents run with fresh context in foreground or background child sessions. | By default, OpenCode discovers or starts one shared background server for your user account. Every local OpenCode client connects to that server, which owns sessions",
  "url": "https://opencode.ai/v2/docs/tools/ ; https://opencode.ai/v2/docs/agents/ ; https://opencode.ai/v2/docs/config/ ; https://opencode.ai/v2/docs/commands/ ; https://opencode.ai/v2/docs/cli/",
  "third_party": false
 },
 "providers": {
  "finding": "Uses the models.dev catalog. Native runtime packages: OpenAI (chat/responses), OpenAI-compatible, Anthropic, Anthropic-compatible, Google, Google Vertex (Gemini/Anthropic/OpenAI-compatible models), Azure, Amazon Bedrock (incl. Mantle), OpenRouter and xAI, plus GitHub Copilot, OpenCode Go/Console, and any npm or file:// provider package. Local backends: Ollama (auto-probe 127.0.0.1:11434), LM Studio (127.0.0.1:1234/v1) and vLLM (127.0.0.1:8000/v1) have built-in discovery. Credential methods: API key, OAuth, command, environment variable.",
  "quote": "Native package options include: @opencode/ai/providers/openai ... @opencode/ai/providers/anthropic ... @opencode/ai/providers/google ... @opencode/ai/providers/amazon-bedrock ... @opencode/ai/providers/openrouter @opencode/ai/providers/xai | LM Studio and vLLM also have built-in local discovery. Their default endpoints are http://127.0.0.1:1234/v1 and http://127.0.0.1:8000/v1.",
  "url": "https://opencode.ai/v2/docs/providers/ ; https://opencode.ai/v2/docs/cli/providers",
  "third_party": false
 },
 "subscription_login": {
  "finding": "Yes for ChatGPT Plus/Pro (Sign in with ChatGPT, or legacy Codex device code) and GitHub Copilot (device OAuth). OpenCode Go is OpenCode's own $10/month plan, but it is used with an API key copied from the console. `opencode auth login <provider>` does the login without the TUI, and tokens are saved in the server's SQLite DB and refreshed. The docs note that API-key entry and paste-a-code OAuth need an interactive terminal, so a worker should log in once beforehand. No Claude (Anthropic) or Gemini subscription login was found in the v2 provider docs.",
  "quote": "Use a ChatGPT Plus or Pro plan instead of an OpenAI API key. Connect OpenAI, then choose Sign in with ChatGPT or one of the legacy Codex sign-in methods. Usage counts against your plan, so these models show no cost. | GitHub Copilot supports device OAuth rather than manual API-key entry. | API-key entry and provider forms require an interactive terminal. OAuth methods that ask you to paste an authorization code also require one.",
  "url": "https://opencode.ai/v2/docs/providers/ ; https://opencode.ai/v2/docs/cli/providers ; https://opencode.ai/v2/docs/",
  "third_party": false
 },
 "license": {
  "finding": "MIT (LICENSE file at tag v2.1.4. The GitHub API reports spdx_id MIT, and npm @opencode/cli license is MIT).",
  "quote": "MIT License\n\nCopyright (c) 2025 opencode",
  "url": "https://raw.githubusercontent.com/anomalyco/opencode/v2.1.4/LICENSE ; https://api.github.com/repos/anomalyco/opencode ; https://registry.npmjs.org/@opencode%2fcli",
  "third_party": false
 },
 "latest_stable": {
  "finding": "v2.1.4. The GitHub releases API has NO release objects for any v2.x tag (its 300 newest releases list only v1.x, github-v1.x and pr-* entries, and /releases/tags/v2.1.4 returns 404). v2.x exists as git tags, which the releases atom feed lists. The feed entry for v2.1.4 is updated 2026-10-23T10:14:51Z, and the tagged commit 'release: v2.1.4' is dated 2026-10-23T10:14:51Z. npm @opencode/cli dist-tag latest = 2.1.4, published 2026-10-23T10:13:53Z (2.0.0 published 2026-09-11T23:44:52Z). For comparison, the newest GitHub release object is v1.19.4 (2026-10-22T13:03:41Z, the 1.x line).",
  "quote": "<id>tag:github.com,2008:Repository/975734319/v2.1.4</id> <updated>2026-10-23T10:14:51Z</updated> ... <title>v2.1.4</title> <content type=\"html\">&lt;p&gt;release: v2.1.4&lt;/p&gt;</content> | npm dist-tags: 'latest': '2.1.4'",
  "url": "https://github.com/anomalyco/opencode/releases.atom ; https://api.github.com/repos/anomalyco/opencode/releases ; https://api.github.com/repos/anomalyco/opencode/releases/tags/v2.1.4 ; https://api.github.com/repos/anomalyco/opencode/commits/v2.1.4 ; https://registry.npmjs.org/@opencode%2fcli",
  "third_party": false
 },
 "latest_prerelease": {
  "finding": "No 2.x prerelease exists in the GitHub releases API or the atom feed. The only prerelease-flagged GitHub releases are PR media uploads (e.g. pr-38252-videos, 2026-07-22T05:01:56Z), which are not versions. On npm, @opencode/cli has the prerelease dist-tags beta = 0.0.0-beta-19507 (published 2026-09-12T01:25:32Z) and dev = 0.0.0-dev-65 (published 2026-10-27T04:12:29Z). The docs also list an AUR package opencode-beta.",
  "quote": "npm dist-tags: {'reserved': '0.0.0-reserved', 'beta': '0.0.0-beta-19507', 'latest': '2.1.4', 'dev': '0.0.0-dev-65'}",
  "url": "https://registry.npmjs.org/@opencode%2fcli ; https://api.github.com/repos/anomalyco/opencode/releases",
  "third_party": false
 },
 "package_registry": {
  "finding": "npm package @opencode/cli, version 2.1.4 (latest). The 1.x line remains under opencode-ai (latest 1.19.4). Other channels: Homebrew anomalyco/tap/opencode-v2, curl installer https://opencode.ai/v2/install, mise.",
  "quote": "npm install -g @opencode/cli | brew install anomalyco/tap/opencode-v2 | The mise command requires mise 2026.10.9 or later; older versions install OpenCode 1.",
  "url": "https://opencode.ai/v2/docs/ ; https://registry.npmjs.org/@opencode%2fcli ; https://registry.npmjs.org/opencode-ai",
  "third_party": false
 },
 "last_commit": {
  "finding": "Default branch is `dev`. Its newest commit is a5587e31103809932241769e4acae19df1dc8b90, dated 2026-10-27T04:16:18Z ('refactor(ai): align media and decision responses with the generate API (#59452)'). The repo was pushed at 2026-10-27T04:12:41Z.",
  "quote": "\"default_branch\": \"dev\" | refactor(ai): align media and decision responses with the generate API (#59452)",
  "url": "https://api.github.com/repos/anomalyco/opencode/commits?sha=dev&per_page=1 ; https://api.github.com/repos/anomalyco/opencode",
  "third_party": false
 },
 "fork_of": {
  "finding": "Not a GitHub fork: the API reports fork: false and parent: none. OpenCode 2 is the successor to OpenCode 1 in the same repository and reads the same V1 config locations. Whether it derives from another coding agent was not checked beyond the GitHub fork flag.",
  "quote": "\"fork\": false",
  "url": "https://api.github.com/repos/anomalyco/opencode ; https://opencode.ai/v2/docs/migrate-v1/",
  "third_party": false
 },
 "maintenance": {
  "finding": "Active and not archived (archived: false). Commits landed on dev on 2026-10-27, and 2.x tags were cut on 2026-10-16, 2026-10-20 (x2), 2026-10-21, 2026-10-22 and 2026-10-23. The repo shows no unmaintained marker.",
  "quote": "\"archived\": false",
  "url": "https://api.github.com/repos/anomalyco/opencode ; https://github.com/anomalyco/opencode/releases.atom",
  "third_party": false
 },
 "gaps": [
  "No GitHub Release objects (and so no release notes) exist for v2.x. Release dates come from the atom feed (tags), the tag commit and npm, and no 2.x changelog page was found. Checked: api.github.com/repos/anomalyco/opencode/releases pages 1-3, /releases/tags/v2.1.4 and /v2.0.0 (404), the releases.atom entries (body only 'release: v2.1.4').",
  "No 2.x prerelease version was found. The npm beta/dev dist-tags are snapshot builds whose 2.x lineage is not stated.",
  "OS-level sandbox and network-off switch: not found. Checked the v2 docs permissions/, policies/, network/, tools/, config/, troubleshooting/, the intro page (Docker image tag only) and the repo tree at v2.1.4 (no sandbox source files).",
  "`run` has no working-directory flag (none in the run spec in commands.ts). The directory is taken from $PWD/cwd.",
  "Exit codes are not documented. They were taken from source (process.exitCode = 1 / 130) and not run-tested.",
  "No limit on concurrent sessions or parallel subagents is documented (checked agents/, tools/, config/, cli/).",
  "No Claude (Anthropic) or Gemini subscription/OAuth login was found in v2 docs providers/ and cli/providers. A token line in default (non-JSON) run output was not found.",
  "Nothing here was executed. All findings come from docs and source at tag v2.1.4."
 ],
 "sources": [
  "https://opencode.ai/v2/docs/",
  "https://opencode.ai/v2/docs/cli/",
  "https://opencode.ai/v2/docs/cli/providers",
  "https://opencode.ai/v2/docs/permissions/",
  "https://opencode.ai/v2/docs/policies/",
  "https://opencode.ai/v2/docs/network/",
  "https://opencode.ai/v2/docs/migrate-v1/",
  "https://opencode.ai/v2/docs/agents/",
  "https://opencode.ai/v2/docs/tools/",
  "https://opencode.ai/v2/docs/config/",
  "https://opencode.ai/v2/docs/commands/",
  "https://opencode.ai/v2/docs/providers/",
  "https://opencode.ai/v2/docs/api",
  "https://opencode.ai/v2/docs/troubleshooting/",
  "https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/commands/commands.ts",
  "https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/run/run.ts",
  "https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/run/noninteractive.ts",
  "https://github.com/anomalyco/opencode/blob/v2.1.4/packages/cli/src/commands/handlers/run.ts",
  "https://github.com/anomalyco/opencode/blob/v2.1.4/packages/schema/src/token-usage.ts",
  "https://raw.githubusercontent.com/anomalyco/opencode/v2.1.4/LICENSE",
  "https://raw.githubusercontent.com/anomalyco/opencode/v2.1.4/README.md",
  "https://api.github.com/repos/anomalyco/opencode",
  "https://api.github.com/repos/anomalyco/opencode/releases",
  "https://api.github.com/repos/anomalyco/opencode/releases/tags/v2.1.4",
  "https://api.github.com/repos/anomalyco/opencode/tags",
  "https://api.github.com/repos/anomalyco/opencode/commits/v2.1.4",
  "https://api.github.com/repos/anomalyco/opencode/commits?sha=dev&per_page=1",
  "https://github.com/anomalyco/opencode/releases.atom",
  "https://registry.npmjs.org/@opencode%2fcli",
  "https://registry.npmjs.org/opencode-ai"
 ]
}