OpenCode compatibility

CC Safety Net supports OpenCode 1.18.29+ and 2.0.6+. Both use the same npm package. Older v1 releases do not support the combined plugin entrypoint. Upgrade OpenCode before updating CC Safety Net.

For TypeScript imports, use CCSafetyNetPlugin or the default plugin's server from cc-safety-net with the v1 SDK. Use the default export from cc-safety-net/opencode/v2 with the v2 SDK. Each entry's declarations require only its own generation's optional peer. Both entries load the same runtime plugin; automatic installation is unchanged.

npx -y cc-safety-net@latest install --opencode

The installer checks the host version. For v2 it uses opencode plugin add and opencode plugin update, then checks the package ID and source in opencode plugin list. That listing confirms discovery, not successful hook activation. Check OpenCode's diagnostics if the plugin fails to activate. As with v1, protection requires a loaded integration.

If an existing global config uses cc-safety-net or a pinned version, the v2 installer stops before changing it. Change that entry's package spec to cc-safety-net@latest, keeping its options and comments, then retry. This avoids creating duplicate plugin IDs.

V2 shell configuration

V2's tool event does not identify the shell executable. CC Safety Net therefore analyzes shell calls as POSIX on Unix and PowerShell on Windows, and verifies the actual executable before OpenCode starts a shell. It rejects an executable from another dialect or an unsupported executable rather than analyzing with the wrong parser.

If you use PowerShell on Unix, or Git Bash on Windows, set the plugin's expected dialect:

{
  "plugins": [
    {
      "package": "cc-safety-net@latest",
      "options": { "shell": "powershell" }
    }
  ]
}

Use "posix" for bash, dash, ksh, sh, or zsh; use "powershell" for powershell or pwsh. This option does not select OpenCode's executable. It must match the executable OpenCode uses. Unsupported shells, including cmd.exe, fish, and nushell, are rejected.

OpenCode's shell hook has no typed denial channel or session ID. A dialect mismatch stops before spawn but may fail the current operation rather than return an ordinary tool denial. It has no session-attributed CC Safety Net audit entry. This consistency check applies to all shell creation in the plugin's location, including shell operations outside agent tool calls.

Protection and commands

V1's bash and v2's shell use the same policy, analyzer, and audit code. The v2 tool-before hook returns typed Tool.Error denials. It also checks read, edit, write, patch, grep, glob, and unknown-tool inputs through the existing input routes. Code Mode's child tool calls cross the same OpenCode hook; CC Safety Net does not interpret the outer Code Mode JavaScript.

V2 registers /cc-safety-net through the command API, preserving a command of that name already present when the plugin loads. Use it to explain blocks and operate CC Safety Net.

The shell consistency check is not an operating-system sandbox. It does not inspect commands that bypass the tool hook, or protect against trusted plugins rewriting a command after inspection. The standard, strict, and paranoid contracts in SECURITY.md remain unchanged.