[Microck]

Summary

• Fix profile activation rollback, untrusted-origin writes, stale response/draft loss, command rename data loss, missing agent delete confirmation, plugin extension/backup handling and bounded port selection.
• Add native v2 agents/Markdown, ordered permissions, commands, MCP and provider/plugin configuration support without silently migrating users' files.
• Add separate cli.json editing with stale-write protection, v1/v2 usage DB support, metadata-only v2 auth safeguards, and remove raw auth secrets from legacy status responses.
• Improve narrow-screen navigation and add reproducible locks, regression CI and a release runbook for server 2.5.0/client 1.18.0.

Verification

All checks were performed by the assistant, not a human:

• 55 backend tests and 29 frontend tests passed.
• TypeScript, production build and lint passed (0 errors, 44 warnings).
• Dependency audits: zero known vulnerabilities for backend production and frontend tree.
• Real browser interaction against a synthetic HOME: command create/rename/cancel, profile switching, agent create/delete confirmation, invalid config, native agent permission edits followed by MCP toggles, 500px navigation, cli.json invalid/valid writes and persistence, and v2 auth read-only controls.
• Official @opencode/schema 2.1.4 accepted the edited native configuration fixture.

Explicit limitations

• Official OpenCode 2.1.4 agent discovery returned an empty inventory in isolated global/project fixtures. This remains under investigation, not a successful end-to-end runtime compatibility claim.
• V2 credential changes use opencode auth; Studio's v2 view is metadata-only. Native plugin runtime controls require plugin IDs, so package-name toggles are blocked rather than guessed. Existing plugin implementations are not auto-ported.
• No paid model calls, real login flows, Windows/macOS installation validation, npm publication or hosted deployment are claimed by local checks.
• The full TypeScript + Effect rewrite is a follow-on, not part of this PR.

AI assistance disclosure

• agent_name: dot, powered by OpenAI
• agent_version: not exposed by this environment
• model_used: exact model identifier is not exposed; no model name is fabricated
• human_testing: none claimed; all listed checks are automated assistant-run checks, including browser interaction
• contribution_summary: QA fixes and source-preserving native OpenCode v2 configuration support

The repository owner explicitly authorized an exception to CONTRIBUTING's human-testing and exact-model-disclosure requirements on 2026-10-24 after these limits were disclosed. This is specific to this owner-directed contribution, not a standing change to repository policy.

See docs/QA-2026-10.md, docs/OPENCODE-V2-COMPATIBILITY.md and docs/RELEASE.md for coverage and release gates.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
opencode-studio	Ready	Preview	Oct 24, 2026 9:05pm UTC

[Microck]

@coderabbitai full review

Please review correctness, data-loss/security risks and the source-preserving v1/v2 boundaries. The exact head 541462b passed the GitHub regression job (backend/client tests, lint, type checking, build). Vercel preview is Ready. Native auth is intentionally metadata-only and package-name plugin runtime toggles are intentionally blocked; no blanket v2 runtime compatibility claim is made.

[Microck]

Release gate: exact head 541462b passed all regression CI steps and the Vercel preview deployment. The assistant-run review and synthetic browser checks are documented. CodeRabbit was requested but has not returned a review; no bot approval is claimed. The owner authorized merging/releasing this bounded configuration-support work with the disclosed v2 runtime/auth/plugin limitations. The full TypeScript + Effect rewrite remains separate.

[coderabbitai]

⚠️ Action not completed

Pull request is closed.