[dependabot]

Bumps @opencode/plugin from 2.0.26 to 2.0.27.

Changelog

Sourced from @​opencode/plugin's changelog.

v2.0.27 — 2026-10-12

Highlights

• Built-In Worktree Tools: Ask OpenCode to use worktree_create, worktree_list, and worktree_remove in Code Mode. You can create isolated worktrees, move sessions into them, and remove them with normal edit approval. (#53981)
• Safer Remote Pairing: The first opencode pair --remote now warns that it will expose your server and asks for confirmation. For non-interactive use, pass opencode pair --remote --yes. (#54561)
• Installable Web App: Use Chrome or Edge’s Install button to install the OpenCode web app, including when it runs behind an authenticating proxy. (#53905)
• Clear Session Failures: Desktop and TUI timelines now show execution errors that happen before or between model steps instead of ending without an explanation. (#53826)
• Automatic Project Cleanup: Projects whose directories no longer exist are automatically hidden from the project list. Opening the directory again restores the project. (#54354)

Core

Improvements

• Added the built-in Code Mode tools opencode.worktree_create, opencode.worktree_list, and opencode.worktree_remove. Removing a worktree requires edit approval, and force: true can discard modified or untracked files. (#53981)
• Added confirmation before opencode pair --remote first enables internet access, plus --yes/-y for scripts and other non-interactive use. (#54561)
• Automatically archived projects when all known directories disappear. Reopening a project restores it, while surviving clones and linked worktrees keep it active. (#54354)
• Raised the ChatGPT OAuth input limit for gpt-6.1-sol and gpt-6.1-sol-fast to 500,000 tokens. (#54668)
• Added Vertex AI routes for Interactions and Mistral models. (#54175, #54058)

Bug fixes

• Fixed updater detection for symlinked home directories and package-manager installations, increased probe timeouts, and now report unavailable updates clearly when the installation method cannot be detected. (#54609, #54622, #54672)
• Fixed GitHub Copilot routing for Gemini, Anthropic, and Responses models when live model metadata is unavailable, and accepted interleaved Claude reasoning values. (#54208, #54210, #54201)
• Fixed Google Vertex Application Default Credentials when CLOUDSDK_CONFIG points to a custom gcloud configuration directory. Thanks @​H-Max. (#54164)
• Prevented ChatGPT token-sharing sessions from sending unsupported mid-session reasoning-effort updates. (#54085)
• Blocked file:// access through Code Mode’s fetch, which now returns a clear filesystem-access error. Thanks @​ferdinandyb. (#54510)
• Fixed remote workspace file operations so driver-provided filesystem overrides are used correctly.
• Preserved subagent notifications when location services are evicted, and propagated well-known configuration updates across locations with bounded HTTP timeouts. (#54072, #53821)

TUI

Bug fixes

• Displayed session execution failures that occur before or between model steps directly in the timeline. (#53826)
• Preserved a saved session’s unavailable model selection instead of silently replacing it with a fallback. (#53822)
• Added syntax highlighting for C++ module interface files such as .cppm, .ixx, and .cxxm. (#53853)
• Summarized integrations with multiple credentials as a connection count, preventing long labels from crowding the integration name. (#54054)

Desktop

Improvements

• Made the web app installable from Chrome and Edge, including deployments behind cookie-based authenticating proxies. (#53905)
• Updated the session column layout and text wrapping for clearer long content. (#54020)

Bug fixes

• Displayed session execution failures that occur before or between model steps directly in the timeline. (#53826)
• Fixed command-palette selection so newly arriving higher-ranked results become active until you explicitly choose a result. (#54275)

... (truncated)

Commits

• 1f4d07a release: v2.0.27
• 4d9678a fix(release): exclude V1 history from the release review range (#54674)
• 4d3d8fd docs: trim agent instructions (#54678)
• e5a557e fix(cli): return unavailable in updater.check when install method is unknown ...
• 35ef229 feat(core): raise ChatGPT OAuth context for gpt-6.1-sol to 500k (#54668)
• 707de58 fix(cli): prioritize path-matched package manager and extend probe timeout (#...
• ca19780 fix(stats): bound public page caching
• 47e5e71 fix(cli): resolve symlinked home path when detecting curl installs (#54609)
• 1c63fe9 docs: use update service latest redirect URLs for downloads (#54598)
• 727fd60 feat(update): redirect artifact filenames to latest release URLs (#54597)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Updates @opencode/plugin from 2.0.26 to 2.0.27, a patch release with bug fixes and minor improvements. No code changes required beyond updating the version and lockfile.

^{Written for commit 20f70c7. Summary will update on new commits.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​opencode/​plugin@​2.0.26 ⏵ 2.0.27

View full report

[dependabot]

Looks like @opencode/plugin is up-to-date now, so this is no longer needed.