build(deps): bump anomalyco/opencode/github from 2.0.18 to 2.2.6

DE
4d ago
+1-1

Bumps anomalyco/opencode/github from 2.0.18 to 2.2.6.

Release notes

Sourced from anomalyco/opencode/github's releases.

v2.2.6

Highlights

  • Shared MCP Connections: Turn on pooling for an MCP server to share one connection across projects with the same setup, so you run fewer processes and start faster. (#61185)
  • GUI Plugin Themes and New Slots: GUI plugins can now add color themes, render or add actions to code blocks, and use native settings and menu components. (#61485, #61533, #61527, #61509)
  • Mobile Composer Dock: On phones and tablets, composer actions now sit in a touch dock above the keyboard with larger buttons. (#61773)
  • Scripted Runs in Worktrees: Run opencode run -w to start the session in a new git worktree, or --worktree=<name> to name it. (#60712)
  • Automatically Archived Runs: Add --archived to opencode run to keep scripted and CI sessions out of your inbox and session lists. (#61270)

Core

Improvements

  • Added opt-in MCP connection sharing through pool: true. (#61185)
  • Added opencode run --archived, which creates the session already archived so scripted and CI runs stay out of the inbox, home, and session lists. Archived sessions are also hidden from the TUI session list and skipped by --continue. (#61270)
  • Added opencode run --worktree (-w), which starts the session in a new git worktree. Use --worktree=<name> to choose the worktree name. It cannot be combined with --continue or --session. (#60712)
  • Added provider- and model-specific session warming settings, including an interval: "auto" mode based on cache TTL. (#60025, #60969)
  • Added the websearch.use policy action and switches for enabling all feature flags with OPENCODE_FLAGS=all or experimental.all_flags. (#61557, #61826)
  • Added an experimental bytecode VM for Code Mode. It is off by default; turn it on with experimental.codemode_vm: true or OPENCODE_FLAGS=codemode_vm. (#62358)
  • Added support for Microsoft Store installations of PowerShell 7 on Windows. (#61952)
  • Added Azure Messages support for Foundry Claude models. (#60934)

Bug fixes

  • opencode run now waits for the background shell commands, subagents, and image jobs that its prompt started, then lets the model respond to their results before it exits. While it waits, it prints waiting for N background job(s) (a background_wait event with --format json). There is no time limit: a job that never exits, such as a dev server or file watcher, keeps the run open until you press Ctrl+C or send SIGTERM, so set a timeout on CI jobs. (#60699, #61911)
  • Reworked noninteractive opencode run execution so arguments, cancellation, compiled WebSocket upgrades, and service shutdown complete reliably. SIGTERM now cancels the session and its background jobs and exits with code 143. (#61911, #61721, #61518, #61564)
  • Serve file reads and media from the server API as sandboxed downloads, and refuse cross-site browser navigations and requests from disallowed origins to /api/*, so a file in your project cannot run scripts on the server's origin. (#62422)
  • Webfetch and Code Mode fetch now reject URLs that contain credentials and ignore the #fragment when matching permission rules, and Code Mode fetch checks every redirect against your webfetch rules. (#60502, #61701, #62373)
  • Ask for external_directory permission before session_move leaves the current project. (#62204)
  • Wait up to 2 seconds for MCP servers that are still connecting before a model call, so tools from servers that connect quickly reach the first prompt and opencode run. Also expand ~ in local MCP working directories, handle legacy stdio servers, and send logo_uri during dynamic registration. (#60490, #61496, #61817, #59031)
  • Time out OpenCode Console config requests after 5 seconds, so startup no longer hangs when the Console accepts the connection but never answers. (#62404)
  • Retry provider requests while their host is unreachable and recover prematurely ended Cohere streams. (#61880, #61184)
  • Keep legacy custom providers whose models set only part of limit, such as only limit.context, instead of dropping the whole provider without an error. Thanks @​Tarquinen. (#62240)
  • opencode acp now removes a session that a client creates with session/new and closes without prompting, so IDE integrations no longer leave empty sessions behind. (#62189)
  • Prevent repeated zsh q flags from freezing shell permission scanning. Thanks @​yangguan-xue. (#60791)
  • Allow npm upgrade install scripts again. Thanks @​renatomoselli. (#51554)

TUI

Improvements

  • Added Scroll on send in Settings. Choose Keep (session.submit_scroll: "keep") to retain your reading position after submitting a prompt. (#61460)

Bug fixes

  • Allow Ctrl+Z to suspend OpenCode while a form or dialog is open. (#62118)
  • Keep focus on an open dialog when a question arrives and contain plugin dialogs that throw during rendering. (#60365, #62110)
  • Show an error when Ctrl+V cannot read the clipboard. Thanks @​jimmyallinai. (#61094)
  • Prevent session titles containing newlines from crashing the TUI. Thanks @​vishalshekhar. (#57523)
  • Improved message spacing and prevented older history from flashing while scrolling. (#62104, #59236)

... (truncated)

Changelog

Sourced from anomalyco/opencode/github's changelog.

Changelog

Release notes for OpenCode V2, newest first.

v2.2.7 — 2026-11-10

Highlights

  • GitHub Copilot Auto: Pick Auto in the model picker when your Copilot account has an Auto pool, and Copilot's router chooses the model for each session at the Auto discount. If routing fails, OpenCode falls back to the account's default chat model. (#62997)
  • Side Panel Tab Shortcuts: Right-click a side panel tab and choose Close tabs to the right. ⌘W now closes side panel tabs wherever focus is, ⌥⌘W or Ctrl+Alt+W always closes the session tab, and ⌘⇧T reopens the last closed tab of either kind where it was. (#62922)
  • Mark Sessions Read or Unread: Open the menu on a tab, Home row, project row or inbox card and choose Mark as unread to keep its dot until you next visit. (#62889)

Breaking changes

@opencode/ai: ImageResponse.image is removed

This affects code that imports @opencode/ai directly. Read response.images[0] instead of response.image. (#63011)

SDK: fewer endpoints wait for plugins to load

On a Location that is still loading plugins, agent.list returns the agents loaded so far, and integration.list, usage.limits, vcs.init, rpc.call and artifact.* no longer wait up to 5 seconds. Entries and actions that a plugin provides appear when it finishes loading, so refresh on the matching *.updated event. Model, provider, generate.*, voice.* and websearch.query endpoints still wait. (#62796, #63040)

Core

Improvements

  • MCP Logins Stay Signed In: Remote MCP servers that rotate refresh tokens no longer sign you out when several clients refresh at once or the token endpoint fails for a moment. (#62827, #63012)
  • read accepts a negative offset to read from the end of a file, such as -50 for the last 50 lines. An offset past the end returns the last lines and the file's line count instead of failing. (#62147)
  • When read can't find a file, it suggests close names: different capitalization, another extension, a small typo, or the matching path inside the project. (#62147)
  • Shell results end with Exit code: N. Commands killed by a signal show the signal name, and timeouts say how long they waited and suggest a larger timeout. (#62141)
  • Prompt cache warming times its pings from the model's cache.ttl by default (interval: "auto"), or every 4 minutes without a TTL. Models whose cache outlasts the warming duration are no longer pinged. (#62831)
  • When MCP servers connect, disconnect or change tools, Code Mode sends the model a short list of what changed instead of the whole tool catalog. (#62176)

Bug fixes

  • GitHub Copilot session costs use the amount Copilot charged instead of the catalog estimate, and content-filter errors name the filter that blocked the response. (#62034)
  • GitHub Copilot picks up a new API endpoint after a plan change on its next model refresh, so you no longer have to sign in again. (#62171)
  • Remote MCP servers that rotate refresh tokens no longer log you out when the TUI, desktop app, background service or several projects refresh the same login at once. (#62827)
  • A temporary failure while refreshing an MCP OAuth token keeps your login for the next try instead of marking the server needs_auth. (#63012)
  • MCP tool calls no longer fail when the server's result doesn't match the tool's own output schema, so completed actions aren't reported as failed. (#61254)
  • MCP prompts stay available when refreshing a server's prompt list fails. (#62266)
  • With background_compaction on, a background summary no longer stops a running Claude Agent session mid tool call. (#63025)
  • After opencode auth logout on a .well-known integration, its remote providers and policies stop applying until you log back in. (#62760)
  • OpenCode Console workspace policies still apply when Console's instructions or skills fail to load. (#62702)
  • Cloudflare AI Gateway providers set up with only gatewayApiKey now send that key. (#62574)
  • A v1 model override that sets only some capabilities no longer resets the others, so catalog capabilities like PDF input are kept. (#62573)
  • A v1 provider config that sets both api and options.baseURL keeps options.baseURL. (#62570)
  • Legacy model references with an inline variant, such as "openai/gpt-5#high", keep the variant. (#62254)
  • A fresh install imports saved provider credentials from the legacy auth.json, and skips an invalid one with a warning instead of stopping setup. (#62568)
  • Cache warming stops for a session when a ping rebuilds the cache instead of reading it, counts its interval from when a request was sent, and no longer pings during compaction or after the session is deleted. (#62926, #62941, #62972)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by cubic

Bumps the OpenCode GitHub Action in the CI workflow from v2.0.18 to v2.2.6 and updates the pinned commit SHA in .github/workflows/opencode.yml.

Behavior changed

  • opencode run now waits for background jobs (shell commands, subagents, image jobs) before exiting, so CI runs can stay open until those jobs finish or hit a timeout.