OpenCode 2.0: one daemon, a new API, three known escapes
meta_description: “OpenCode 2.0 rebuilds the coding agent around a background daemon and a new API. It shipped with three known security escapes, and one of them is still open.”
sources:
- https://anoma.ly/notes/opencode-2-0/
- https://news.ycombinator.com/item?id=50094994
- https://api.github.com/repos/anomalyco/opencode
- https://github.com/anomalyco/opencode/issues/52333
- https://github.com/anomalyco/opencode/pull/54921
figures:
- /images/articles/opencode-2-serve/daemon-architecture.svg
- /images/articles/opencode-2-serve/security-escapes.svg
original-facts:
- anomalyco/opencode stands at 213,541 GitHub stars and the opencode-ai npm package pulls 11.9 million downloads a month, 2.86 million in the last week alone
- The 2.0 rollout is already 29 patches deep on the client packages: @opencode/client, @opencode/sdk and @opencode/codemode sit at 2.0.29 while the main opencode-ai npm tag still reads 1.19.0
- Issue #52333, open since September 30, shows the config and plugin hot-reload window bypasses provider deny policies, so session traffic including the system prompt and code in tool results can silently flow to a third-party provider and keep flowing there
- Pull request #54921, merged October 13, restored the system config directories (/etc/opencode on Linux, /Library/Application Support/opencode on macOS) that the initial 2.0 release had silently dropped
- Because every tool call now executes inside the background daemon, TUI-level sandbox wrappers stop enforcing without any warning; one commenter watched web fetches that should have been blocked start succeeding for a day before noticing
- The name is a trap: the archived opencode-ai repository lives on as Charm’s Crush with 28,642 stars, while the real project moved from sst to anomalyco in January 2026 and the npm package stayed opencode-ai
- Pi, the minimalist alternative from the i18n-tan developer, runs 115,193 stars on a fraction of OpenCode’s scope and is where the two loudest security critics say they moved
TLDR: OpenCode 2.0 is an open source coding agent rebuilt around a background service that every client shares. It enables one session to be driven from the terminal, a desktop app, and hand-written scripts at the same time. The difference between OpenCode 2.0 and the previous release is that the agent now runs as a daemon on your machine by default, with a fresh API, scriptable tools, background subagents, and a plugin system the whole product is built on.
OpenCode 2.0 shipped October 14. The team at Anomaly, the company behind SST, watched the project go from zero to 213,541 stars in seventeen months, then tore the architecture open and rebuilt it around one idea: the agent is a service that runs on your machine whether you are looking at it or not.
The numbers explain why the rewrite was worth the risk. The opencode-ai npm package did 11.9 million downloads last month. The HN thread pulling 286 points within hours is not attention from strangers; it is a user base reacting to a tool it runs daily.
The service
The 1.x release already had a client/server split, but it was opt-in plumbing that most people never touched. In 2.0 the server runs automatically as a single background process, and every surface talks to it: the TUI, the web interface, the desktop app. Open a terminal and a desktop window and both are driving the same session state. The session stops being a terminal scrollback and becomes a shared object with several windows on it.
The practical payoff lands in scripting and remote work. Start a job with opencode api from a scheduled script at midnight, review the diff in the desktop app over coffee, and the daemon does not care which client is attached. The new @opencode/client package autodiscovers the running service, so scheduled scripts just work. A /pair command exposes the service to other hosts, and native mobile apps are promised on that path.
Anomaly’s own example points to where this is going: OpenCode calling its own API to move the current session into a git worktree when starting new work, which makes the agent a client of itself.
The API, rewritten because the old one was honest about being bad
The release post describes the old API the way a doctor describes a tumor: it “grew haphazardly as we and the world collectively learned what agents are.” That API is gone. The new one is designed around everything the millions of users turned out to need, and the first-party demo is OpenCode manipulating its own sessions: list them, interrupt the stuck one, rename it, transplant it into a worktree, close its finished tabs.
The most consequential idea in the release is barely two paragraphs long. @opencode/codemode is a minimal JavaScript interpreter that ingests MCP servers and OpenAPI endpoints and turns them into functions the model can call inside a script. Search, map over the results, call the next tool, all in one round trip instead of one tool call at a time.
Every MCP server is opted into code mode by default. The default is what lets the team claim you can attach a thousand of them with minimal context bloat: the model does not read a thousand tool descriptions, it discovers what it needs and writes code against the rest. They built the interpreter rather than embedding QuickJS or spinning up Node VMs, which keeps the whole thing native and fast.
Background everything
Two related features land here. Background subagents let the primary agent fork work to another agent, automatically or on demand, with a different model if you want the cheap one reviewing while the expensive one writes. Background shell runs long commands asynchronously with a notification on completion. If a foreground task turns out to be slow, one hotkey, ctrl-b, moves it to the background mid-flight.
The release treats orchestration as a first-class citizen. The latest models are good at orchestrating; a harness that forces every task to block the main loop wastes that capability.
Plugins, because they had to
The plugin system in 1.0 existed and was neglected. The 2.0 discipline: nearly every feature in the release is implemented as an internal plugin, 80+ of them, so the plugin API gets exercised by the product itself. TUI plugins, built on the OpenTUI toolkit, graduated from experimental to stable. Everything hot-reloads, including plugins the agent writes for itself mid-session.
What the release post does not mention
Three security regressions surfaced in the first week, and they share a theme: the service architecture moves trust boundaries without moving the sandboxes.
The sharpest one is issue #52333, open since September 30 with a working reproduction on 2.0.20. During a config or plugin hot-reload there is a window where deny policies on providers stop applying. A prompt landing in that window gets its session silently switched to a provider you explicitly denied, carrying the system prompt, the conversation history, and code from tool results to infrastructure you said should never see them. The switch persists after the window closes. Policy enforcement that holds statically but dissolves during reload is not a guarantee; it is a default.
Second: PR #54921, merged October 13, restored the platform system configuration directories that 2.0 initially stopped reading entirely. On Linux that is /etc/opencode, the place a corporate endpoint lockdown would live. The regression shipped in the initial release and was fixed four days after the v2 announcement.
Third, and least visible: with the daemon in the middle, tool calls no longer execute inside the process you launched from your shell. One commenter discovered that the sandbox wrapping their TUI process had quietly become decorative, because the network fetches it was supposed to block were being performed by the daemon instead. A day of successful blocked fetches before anyone noticed. The short-term answer is running with –standalone, which trades away the daemon convenience.
The honest scorecard: the config regression is fixed, the other two are open questions. How many more exist is the question the HN thread kept circling, because a plugin system that hot-reloads agent-authored code is a large surface to stand up in one release.
The name is a trap, check what you install
The confusion in the thread’s top replies is its own warning. The archived opencode-ai GitHub repository lived on as Crush, Charm’s source-available agent, 28,642 stars and counting. The real OpenCode moved from sst to the anomalyco organization in January 2026. The npm package never changed: it is opencode-ai, published by the team at opencode.ai. If your muscle memory installs based on the GitHub org name alone, you can end up on a different agent.
Two of the loudest security critics in the thread said they moved to Pi, 115,193 stars, as their alternative. And the pricing side gets an independent nod worth repeating: OpenCode’s subscription quotas are regarded by one heavy user as generous to the point where they assume the company is lighting money.
Upgrade path
From 1.x: opencode upgrade --major. Desktop app: download the new build. Three breaking changes: 1.0 plugins do not load, the server API is different, and the TUI config file moved shape. The documented migration path is pointing OpenCode itself at the migration document and letting it migrate your setup, which is either reassuring or exactly the amount of trust you were already debating.
Related on this site: the MXC containment piece covers what OS-level agent sandboxing looks like when it is done on purpose, NVIDIA OpenShell ships credential controls for exactly the daemon-shaped trust problem OpenCode just handed its users. Codex CLI’s persistent background daemon went the same architectural direction three weeks ago, and its issue tracker is following the same pattern.