[coder9io]

Second part of #23. #24 pinned Node 22 and 24, but two gaps remained.

What

• 9e3fdd2 test(opencode): add Node 26 (26.12.1) to PATCHED_FLOORS in test/node-version.test.ts. engines.node is derived from that table.
• c734106 fix(opencode): engines.node is now ^22.23.4 || ^24.22.1 || ^26.12.1, and the README Development note is updated to match.

(0510d70 is a no-op merge of master, because #24 was squash-merged from this branch.)

Why

• Node 26: v26.12.1 (2026-10-21, security: true in nodejs.org/dist/index.json) is the first 26.x release with tls: reject chains containing blocked public keys (a2caddd20e, tls: reject chains containing blocked public keys nodejs/node#66871, CHANGELOG_V26). Before this change, engines rejected every Node 26 install, including patched ones.
• Republish: chore(opencode): require Node >=22, dropping end-of-life 18 and 20 #24 merged as chore:, and release-please doesn't release on chores. npm latest is still @last9/opencode-plugin@0.3.0 with engines.node: ">=18". This fix(opencode): commit lets release-please open a 0.3.1 release PR. After that release, the package needs to be published to npm (publishing isn't done in this repo).

Node surfaces are unchanged from #24: .nvmrc (24.22.1) is used for development and by every actions/setup-node step in opencode-plugin.yml and oss-guardrails.yml. The package's engines.node covers the OpenCode/Bun runtime users. There is no Dockerfile or container image.

Tests

• I watched engines.node admits only patched releases of supported lines fail on 9e3fdd2 (actual ^22.23.4 || ^24.22.1, expected ... || ^26.12.1). It passes on c734106.
• npm test (14/14) and npm run typecheck pass.
• TLS probe on the pinned runtime (node --use-env-proxy scripts/tls-probe.mjs):

  process.version=v24.22.1
  https://dv-g3b-emudhra.we-have-a-problem.com/ -> CERT_REVOKED certificate revoked
  https://registry.npmjs.org/ -> HTTP 200
  

  The CI TLS revocation probe job already passed on master (7ff760d).
• scripts/check-skill-pack.sh needs approval in my sandbox, so it is left to CI.
• 2 commits pushed: the test commit fails on its own by design, and the fix commit passes.

Fixes #23

Agent usage

• Est. cost at Anthropic list price: $3.38
• Models:
  • claude-opus-5-5 · $2.97 · 162 input · 42,864 output · 3,669,519 cache-read · 172,028 cache-write-1h
  • claude-sonnet-5-5 · $0.41 · 44 input · 8,625 output · 635,974 cache-read · 66,209 cache-write-1h
• Agent runs: 7 · elapsed: 9m
• Pricing snapshot: 2026-10-14.2 (https://claude.com/pricing + https://platform.claude.com/docs/en/build-with-claude/prompt-caching (1h cache writes), checked 2026-10-14)

---

Opened by coder9io. Review comments and CI results on this PR are picked up automatically.

[reviewer9io]

The engine range, README and regression test agree on the first patched Node 26 release, while retaining the Node 22/24 floors. Completed the three-file assessment at c73410607467eae3e3a66974f9b9336a0f56c938; no actionable finding.

Fresh verification on checksum-verified Node 26.12.1: 14 tests, typecheck and 11 npm-semver boundary probes passed. Reverting the package’s Node 26 range makes the committed engine assertion fail. The upstream v26.12.1 changelog includes the blocklist backport. Current-head test/typecheck, guardrails, skill parity and TLS-probe CI are green.

The repository has no committed lockfile; installation followed its declared ranges, with the resolved versions recorded. npm reported an unapproved esbuild postinstall; the checks above passed without enabling it. No live TLS probe, Bun/OpenCode integration or npm publication was performed locally.

Advisory rollout: the fix commit enables the configured release flow, but existing npm consumers retain the old metadata until a release is published. Publishing remains a separate step.

Unverified assumptions

• The separate npm publication process will publish the generated release; it is outside this repository and was not verified.

Coverage

• Ran: Intent, Correctness and safety, Contract and rollout, Tests, Guidance compliance
• Skipped: Reliability (No async/error-handling behavior changed.), Cost and resource (No hot-path, I/O, loop or cache change.), Maintainability and design (Three-path engine metadata/test/docs adjustment; no structural change.), Prior discussion (No earlier reviews or threads.)