Repository navigation
chore: upgrade opencode to 2.0.29 and openchamber to 2.3.2 - #24
Conversation
Both releases are under pnpm's minimum release age, so the excludes move from the 2.0.27 opencode packages to 2.0.29 and add @openchamber/web and @openchamber/sdk 2.3.2 after reviewing their changelogs. Every other pinned tool, image, plugin, MCP package, and action is already at its latest release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
OpenCode 2.0.29 stabilizes top-level policies; experimental.policies still merges in but is the legacy spelling. The README now states that /etc/opencode/opencode.json overrides global and project config, which 2.0.29 documents. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The provider security boundary lacks an integration assertion proving the migrated policy is enforced.
1 open finding
What changed in this PR
Upgrades OpenCode, OpenChamber, and Effect while adopting stable provider policies and documenting system-config precedence.
Changes:
- Updates pinned runtime and development dependencies.
- Migrates provider restrictions to top-level
policies. - Refreshes release-age exclusions and lock data.
| File | Description |
|---|---|
Dockerfile |
Updates runtime tool versions. |
README.md |
Clarifies configuration precedence. |
opencode.jsonc |
Migrates provider policies. |
package.json |
Updates development dependencies. |
pnpm-lock.yaml |
Regenerates dependency resolutions. |
pnpm-workspace.yaml |
Updates release-age exclusions. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| } | ||
| ] | ||
| } | ||
| "policies": [ |
There was a problem hiding this comment.
🤖 babysit-pr: Fixed in 78431a3: the integration test now checks that every model from /api/model belongs to google or github-copilot. /api/provider only lists connected providers, so it is empty in CI with or without the policy. With policies removed from the image config, /api/model returns OpenCode's 10 free models and the new assertion fails; with them it passes.
/api/provider lists only connected providers, so it is empty in CI either way. /api/model lists OpenCode's free models when provider.use is not enforced, so checking that every model belongs to google or github-copilot fails if the policies stop loading. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why
Upgrades opencode 2.0.27 to 2.0.29, openchamber 2.2.0 to 2.3.2, and effect 4.0.2 to 4.0.4. Every other pinned tool, image, plugin, MCP package, and action is already at its latest release.
Both releases are newer than pnpm's minimum release age, so they are excluded by exact version after a changelog review. The config moves to the stable top-level
policieskey.Risks
opencode 2.0.29 adds no database migrations, so rolling back to 2.0.27 is safe. openchamber 2.3.2 ships opencode 2.0.28 client packages against the 2.0.29 server.