feat(opencode): integrate the V2 compatibility chain

[VicenteOlmos]

Summary

• Native OpenCode V2 integration for the verified beta17823 (opencode2), including server routing, TUI commands/feedback and installed launcher support.
• All five child PRs (feat(opencode): port the server API for V2 #28, fix(opencode): reconcile the server with V2 beta #29, feat(opencode): add the native V2 TUI companion #30, fix(cli): resolve installed launcher symlinks #31, chore(release): prepare 0.2.0 for OpenCode V2 #32) are reviewed and merged bottom-up. Pullfrog findings are fixed and resolved; SECURITY.md includes 0.2.x while retaining 0.1.x.
• Stable opencode-herdr@0.2.0 is published on npm (latest=0.2.0) and GitHub; verified release commit 1c29055.

Checklist

• No secrets, tokens, or credentials in the diff
• Commits are signed and Verified on GitHub
• Tests and typecheck pass for the integrated source
• Docs updated for installation, support and behavior

Test plan

• Independent corrected release source: 120 tests, 425 expectations; typecheck, lifecycle smoke and supplied beta17823 catalog smoke pass.
• Child current-head CI passed before each integration; integrated tracker CI 37641066224 passed against current main.
• Package proof: 37 files; source bytes/modes and exports match candidate. Isolated tarball-installed launcher usage/exit2 passed (--ignore-scripts --legacy-peer-deps, automatic peer installation not proved).
• Latest tracker head required test: CI 37641482198 passed with exact head/current-main binding.
• Signed v0.2.0 at integrated main 1c29055; stable GitHub release published. OIDC Publish run 37645115605 passed; npm version and latest both 0.2.0, published 37-file package contents match verified main.

Chain context

main
└─ 📍 #27 integrated tracker
   └─ #28 initial server API (merged)
      └─ #29 actual beta server + routing fix (merged)
         └─ #30 native TUI + session-directory fix (merged)
            └─ #31 installed launcher (merged)
               └─ #32 0.2.0 release metadata (merged)

All children were folded leaf-to-root without rewriting branches: 32→31→30→29→28→27. Final tracker retains the exact corrected release source plus current-main manual Pullfrog workflow. Cohesive over-budget slices were accepted under actual repository policy; tests/docs were not cut or compressed.

Verification limits

• Matching actual runtime: @opencode-ai/cli@0.0.0-beta-17823, not a blanket claim for all V2 releases.
• No real provider calls, physical keyboard input, default downloader or remote-workspace ownership verification; ShellCheck unavailable.
• Prepared corrected tarball SHA256: d918d461100b5ca50799ad7d056cded87c231da57c4ae774d5798ffa3784fad7.
• Dependencies and final lock versions unchanged; prior transitive Socket alerts are not claimed remediated.
• Existing manual-dispatch workflow preserved and not launched. No generic issue/forms/type/size labels added, per explicit actual-repository policy authorization.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​opencode-ai/​plugin@​1.18.30 ⏵ 0.0.0-beta-17823			+2
	@​opencode/​theme@​2.0.23
	@​opentui/​core@​0.5.14
	solid-js@​1.9.12
	@​opentui/​solid@​0.5.14

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Critical CVE: Seroval: fromJSON() Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) CVE: GHSA-p6vx-979v-rg4c Seroval: fromJSON() Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) (CRITICAL) Affected versions: >= 0.12.0 < 1.6.2 Patched version: 1.6.2 From: package.json → npm/solid-js@1.9.12 → npm/seroval@1.5.6 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/seroval@1.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[pullfrog]

Run failed. View the logs →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using gpt-6.1-sol ｜ 𝕏}