[cursor]

Summary

Bump the exact @opencode/codemode pin from 2.2.6's predecessor 2.2.5 to 2.2.6, and move Effect from 4.0.6 to the published exact dependency 4.1.0. Acorn stays 8.15.0. The default engine remains the legacy interpreter; engine: "vm" is not enabled.

require is now a CodeMode builtin that can load url, util, and crypto. Preflight rejects that name before runtime construction or host effects, including after a would-be host call and when the name is shadowed. Dynamic import() stays outside the syntax allowlist. for...in behavior is unchanged and stays rejected.

• Starting main: 0c144cf232f1850f602423cf2b740eff0b9bdb02
• Tested revision: 101f98cc3c7dc7f22a3c5054fdec355655f569c2
• No older open dependency PRs.

Artifacts

Registry https://registry.npmjs.org/. npm view @opencode/codemode dist-tags.latest --json --prefer-online returned "2.2.6" during the 2026-11-07T15:01Z run (exact stable semver; semver 7.7.4 compare("2.2.6", "2.2.5") === 1). Published 2026-11-06T23:33:15.623Z. The published package has no gitHead, engines, or peer dependencies. Repository: git+https://github.com/anomalyco/opencode.git (packages/codemode).

Package	Version	Tarball	Integrity
@opencode/codemode (old)	2.2.5	https://registry.npmjs.org/@opencode/codemode/-/codemode-2.2.5.tgz	sha512-oqZXynEO71nOpM9kOVacyRY6qOceYdk2p9Q0667kwSP4ZXgKSKtxV2HkI0iUBh3ci+TueO88BxIb2CgL1slpGw==
@opencode/codemode (new)	2.2.6	https://registry.npmjs.org/@opencode/codemode/-/codemode-2.2.6.tgz	sha512-pOV+PwhZbcVySVgKY29LThmdhVSkx/HC3/A+a9KbrhZx/sgxQTXMXthu6P/hWCcER5hGKiGU6g8P7m6bV/kKMg==
effect	4.1.0	https://registry.npmjs.org/effect/-/effect-4.1.0.tgz	sha512-lGx2MJJyrXA8RZb2UpQ/0Nkb5Utaimby7oD92+18noBxLPE85IFOvptdzau8dvcxAOwfwHo9iqapbKeFzqQM/Q==

Both CodeMode tarballs were integrity-checked and extracted with path-escape rejection. Lockfile diff is only those version and integrity lines. One Effect module is loaded by the extension and by CodeMode (node_modules/effect).

• npm: https://www.npmjs.com/package/@opencode/codemode/v/2.2.6 and https://www.npmjs.com/package/@opencode/codemode/v/2.2.5
• Effect: https://www.npmjs.com/package/effect/v/4.1.0
• Release notes: https://github.com/anomalyco/opencode/releases/tag/v2.2.6 (experimental bytecode VM, off by default)
• Monorepo compare, not a package gitHead: anomalyco/opencode@v2.2.5...v2.2.6

The published package diff is the comparison baseline. The monorepo compare is hundreds of commits and is supporting context only.

Effect

2.2.6 depends on effect exactly 4.1.0 (2.2.5 depended on exact 4.0.6). The extension pin moves to that exact version so both sides share one Effect runtime. It is not widened, and it is not a speculative upgrade past the published dependency. Acorn stays the shared exact 8.15.0.

Change-to-test map

1. Effect 4.0.6 → 4.1.0 (package.json dependencies). The bridge uses Effect.tryPromise, ensuring, promise, and runPromise on the same instance CodeMode runs. Existing cancellation, deadline, and host-cleanup tests cover that, plus a resolved-module check that the extension and CodeMode load the same effect path. No second copy in the lockfile.
2. Default runtime stays legacy. CodeMode.make without engine still returns only catalog + execute. New program / resume / snapshot APIs exist only for engine: "vm". The extension does not pass engine. Assertion: default runtime has no program or resume. VM implementation is out of scope and not enabled.
3. require global and module loader (dist/interpreter/globals.js, modules.js, import evaluation). require("url") returns {URL, URLSearchParams}, require("util") returns TextEncoder/TextDecoder, and typeof require("crypto") is "object". Documented contract already excludes require. require was not in NATIVE_NAMES, so it was admitted and executed. Fix: add require to NATIVE_NAMES. Assertions reject require("url"), require("crypto"), typeof require, a shadowed require, and require after await tools.write({}) before runtime construction, with empty tool-call lists. A property named require still executes and returns 1. Direct runtime calls on the installed 2.2.6 artifact show why the rejection is required.
4. Dynamic import() now executes if it reaches the interpreter (typeof import("url") === "object"). It was already unsupported-syntax:ImportExpression. The no-host-effects path now also covers import() after a would-be host call. Static import remains a script-mode syntax error. The allowlist is not expanded.
5. for...in unchanged on 2.2.6 (inherited keys visited; keys deleted during iteration still visited). Existing preflight and no-host-effects tests still apply. No new for-in test.
6. Out of scope: new VM sources, Extension.make object globals, extra index exports (fromBytes, toBytes, toolExpression, snapshot/suspend types), and export parse-message wording. This extension does not use those APIs. Tool schemas, Tool.make, toolError, limits, and the tool bridge source are unchanged.

Fail-before on 2.2.6 without the NATIVE_NAMES change: node --test test/preflight.test.js test/route.test.js had 26 tests, 24 pass, 2 fail (return require("url") stayed supported, and routing selected codemode_o). After the change: 26 pass, 0 fail, exit 0.

Verification

Local scope only. Linux 6.12.113+ x64. CodeMode 2.2.6, Effect 4.1.0, one shared Effect instance, Acorn 8.15.0. PI_OPENCODE_UPSTREAM_VERSION and PI_OPENCODE_TEST_VERSION were unset. PI_OPENCODE_SDK was set only to the isolated install under test. Scripted assistant stream; no live model API.

Command	Exit	Result
npm ci --ignore-scripts in a fresh copy	0	121 packages; resolved CodeMode 2.2.6, Effect 4.1.0, Pi/TUI 1.3.0
npm test (no PI_OPENCODE_SDK), Node v22.23.4	0	tests 84, pass 83, fail 0, skipped 1 (SDK session)
PI_OPENCODE_SDK=$PWD/node_modules/@earendil-works/pi-coding-agent npm test, Node v22.23.4	0	tests 94, pass 94, fail 0, skipped 0; Actual SDK 1.3.0; session parent plus 10 subtests
npm run test:pi-versions, Node v22.23.4	0	parent tests 3, pass 3, fail 0, skipped 0. Cells: Pi 0.99.0, 1.3.0, 1.4.0, each reporting CodeMode 2.2.6 and no inner skips
Clean-copy inner npm test for Pi/TUI 0.99.0, 1.3.0, 1.4.0 on Node v22.19.0, v22.23.4, and v24.22.2	0 each	each inner suite tests 94, pass 94, fail 0, skipped 0; matching Pi/TUI; same Effect path
npm pack --dry-run --json	0	pi-opencode-mode-0.1.5.tgz, 11 files (runtime sources plus LICENSE, README, SECURITY, TESTING, CHANGELOG). No lockfile, node_modules, or secrets
git diff --check	0	clean

Parent matrix counts are the 3 Pi cells. Inner-suite counts are the 94-test npm test runs. The literal deadline probe still runs (about 30s) inside each SDK suite.

Verified for that local Node/OS/Pi/TUI scope. Pending: hosted Modal CI (Node 22.19.0 and 24.x × Pi 0.99.0, 1.3.0, 1.4.0) has not run on this revision. macOS was not exercised. No live-provider run and no new benchmark.

Docs

README compatibility text, the Unreleased changelog entry, and the current TESTING baseline now name CodeMode 2.2.6 and Effect 4.1.0. Historical changelog entries and dated verification sections are unchanged.

  

---

Note

Medium Risk
Combines a dependency upgrade with lazy backend loading and stricter preflight around require, plus coalesced UI updates that change visible cadence without altering execution contracts.

Overview
Prepares 0.2.0 (unreleased on npm): bumps pins to @opencode/codemode 2.2.6 and Effect 4.1.0, and expands changelog, README, testing notes, and the maintainer release checklist for the new version and behavior.

Execution and safety: Preflight now rejects require (including shadowed names and uses after a would-be host call) because 2.2.6 exposes a real require; dynamic import() stays disallowed. CodeMode and Effect load only after preflight passes, via a shared module promise—rejected programs and registration no longer pull in the backend. Concurrent runs share that import only; each execution still gets its own runtime, signal, and call log, with abort during load isolated from other waiters.

TUI / presentation: Nested-call onUpdate notifications are coalesced on a 16ms timer (host dispatch stays immediate; close() flushes before the final result). The renderer caches highlighted source and output per tool row, defers expensive highlighting until paint, invalidates on theme/proxy changes, shows raw previews while args stream, and caps collapsed source at 8,192 UTF-8 bytes without changing executed source.

New regression suites cover lazy loading, renderer caching/coalescing, and require preflight; the default test script gains renderer-performance.test.js and lazy-loading.test.js.

^{Reviewed by Cursor Bugbot for commit 92d6bcc. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ace1fcc3-c2c3-47d5-ba63-6860f2cb101d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn