fix: resolve OpenCode source imports and installed skills paths - #3115
fix: resolve OpenCode source imports and installed skills paths#3115yuefdev wants to merge 1 commit into
Conversation
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 15 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 4 PR taxonomy bucket(s): Harness Drift, Install Manifest Integrity, CI/CD Recommendation, Agent Config Review. Scanned 15 changed file(s). Roadmap taxonomy buckets: Harness DriftHarness-facing changes can drift across Claude Code, Codex, OpenCode, and shared adapter surfaces. Signals:
Paths:
Install Manifest IntegrityInstall manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance. Signals:
Paths:
CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
Agent Config ReviewAgent, command, skill, MCP, and local instruction changes should be reviewed as executable agent configuration. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 1/7 areas (14%) across 15 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 15 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (14)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used📓 Path-based instructions (21)Focus on command injection, unsafe subprocess usage, path traversal, SSRF, secret exposure, and missing tests for new CLI behavior.⚙️ CodeRabbit configuration file Files:
Lightweight agents with frequent invocation Pair programming and code generation Worker agents in multi-agent systems Main development work Orchestrating multi-agent workflows Complex coding tasks Complex architectural decisions Maximum rea...📄 CodeRabbit inference engine (.cursor/rules/common-performance.md) Files:
NEVER hardcode secrets in source code - ALWAYS use environment variables or a secret manager📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
No hardcoded secrets (API keys, passwords, tokens) - validate before any commit📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Package manager detection should support npm, pnpm, yarn, and bun, with configuration via CLAUDE_PACKAGE_MANAGER environment variable or project config.📄 CodeRabbit inference engine (CLAUDE.md) Files:
Always create new objects, never mutate existing ones.📄 CodeRabbit inference engine (.cursor/rules/common-coding-style.md) Files:
Use parameterized queries to prevent SQL injection📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Implement XSS prevention by sanitizing HTML output📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
All user inputs must be validated Enable CSRF protection on all state-changing endpoints Verify authentication and authorization for all protected endpoints Implement rate limiting on all endpoints to prevent abuse Ensure error messages do...📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Write tests before implementation (test-driven development); target 80%+ coverage Achieve minimum 80% test coverage across all three layers: Unit, Integration, and E2E Use AAA structure (Arrange / Act / Assert) in tests with descriptive tes...📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Do not hardcode secrets, API keys, passwords, or tokens📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Always create new objects and never mutate in place; return new copies instead Keep files between 200–400 lines typical, with a maximum of 800 lines Extract helpers when a file exceeds 200 lines Handle errors explicitly at every level; neve...📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
HTML output must be sanitized where applicable📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Auto-format JavaScript/TypeScript files using Prettier after edit Warn about `console.log` statements in edited files Check all modified files for `console.log` statements before session ends📄 CodeRabbit inference engine (.cursor/rules/typescript-hooks.md) Files:
Never hardcode secrets; always use environment variables for sensitive credentials like API keys Throw an error when required environment variables are not configured to fail fast and ensure security prerequisites are met📄 CodeRabbit inference engine (.cursor/rules/typescript-security.md) Files:
Use Playwright as the E2E testing framework for critical user flows in TypeScript/JavaScript📄 CodeRabbit inference engine (.cursor/rules/typescript-testing.md) Files:
Use spread operator for immutable updates in TypeScript/JavaScript instead of direct mutation Use async/await with try-catch for error handling in TypeScript/JavaScript Use Zod for schema-based input validation in TypeScript/JavaScript No c...📄 CodeRabbit inference engine (.cursor/rules/typescript-coding-style.md) Files:
Use the ApiResponse interface pattern with generic type parameter: `interface ApiResponse { success: boolean; data?: T; error?: string; meta?: { total: number; page: number; limit: number; } }` Implement custom React hooks following the...📄 CodeRabbit inference engine (.cursor/rules/typescript-patterns.md) Files:
Ensure cross-platform support for Windows, macOS, and Linux via Node.js scripts in the scripts/ directory.📄 CodeRabbit inference engine (CLAUDE.md) Files:
Required environment variables must be validated at startup📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Use parameterized queries for all database writes (no string interpolation) Auth/authz must be checked server-side for every sensitive path Rate limiting must be applied to all public endpoints📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
🧠 Learnings (1)📚 Learning: 2026-07-16T15:23:29.177ZApplied to files:
🪛 ast-grep (0.45.3)tests/lib/install-executor.test.js[warning] 718-718: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) [warning] 731-731: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) [warning] 744-744: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) [warning] 755-755: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) [warning] 760-760: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) [warning] 773-773: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) [warning] 774-774: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) [warning] 777-777: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) tests/scripts/build-opencode.test.js[warning] 189-189: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use. (detect-non-literal-fs-filename) 🔇 Additional comments (14)
📝 SummarySummary by CodeRabbit
WalkthroughThe change fixes OpenCode TypeScript module resolution, enables compiler extension rewriting, centralizes install content transforms, adds OpenCode home operation planning, and expands runtime and installation tests. ChangesOpenCode runtime and installation
Priority: ⬆️ High Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Bug fix · Severity of issue fixed: High Merge Risk: ⚪ Minimal · up to No actionable issue remains in the reviewed source-loading or installation changes. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 12 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
1 participant
What Changed
OpenCode's full home install currently copies TypeScript sources whose
.jsimports point to files that exist only underdist/. This causesERR_MODULE_NOT_FOUNDbefore the first model request. Use.tsfor relative source imports, including the lazy changed-files store, and enable TypeScript'srewriteRelativeImportExtensionsso published JavaScript still imports.jsfiles. Raise the standalone compiler minimum to 5.7 while retaining the locked 5.9.3 version.Home installation also rewrites the bundled
../skillspath to./skills, preserving the repository template and other configured paths. Installation and lifecycle operations share the transformation so repair restores identical content and uninstall recognizes it.Why This Change
Fixes #3112.
This is an alternative to #3113: it keeps the existing TypeScript runtime layout and also supports loading the repository sources directly. It does not migrate active runtime files to compiled JavaScript.
Testing Done
ERR_MODULE_NOT_FOUNDin a full-profile isolated home before the fix; the same regression test passes afterward..jsfiles to.ts.npm pack, andgit diff --checkpass.Validation ran on Windows / Node 24.19.0. The full repository suite, Node 18 execution, and actual macOS/OpenCode desktop startup or model responses were not tested. Existing Windows-incompatible symlink/POSIX subcases were skipped by their suites.
Type of Change
fix:Bug fixSecurity & Quality Checklist
Dependency Changes
corepack yarn install --mode=update-lockfile; the root lockfile is unchanged. Updated the nested package manifest and lockfile together; no resolved dependency versions changed.