headroom/plugins/opencode
JD Davis 37faf2f247
chore: release 0.36.1 (#3152)
## Description

Release 0.36.1, generated by Release Please, containing the security
fixes from #2207 (WEB-01–07). This updates the changelog and keeps
Python, TypeScript SDK, plugin package, marketplace, server, and release
metadata versions aligned at 0.36.1.

## Type of Change

- [x] Release / version metadata

## Changes Made

- Updated the release manifest and generated changelog for 0.36.1.
- Synchronized `pyproject.toml`, TypeScript SDK, OpenClaw, OpenCode,
agent-hook plugin, marketplace, server, and release metadata versions.
- Included the 0.36.1 changelog entry for the security assessment fixes
merged in #2207.

## Testing

- [x] CI and release validation pass

### Test Output

All current required checks are complete and passing, including version
sync, package builds, wheel smoke imports, security scans, Python test
shards, native wrapper checks, and devcontainer validation.

## Real Behavior Proof

- Environment: GitHub Actions release and CI workflows for commit
`52c0a0c61dce0af81af3ff73a34efe8b451501cb`.
- Observed result: all generated version-bearing files report 0.36.1;
build and smoke-import jobs produced and validated the release
artifacts.
- Not exercised: publishing jobs are intentionally skipped for a pull
request and run only after the release receives final human approval and
is merged.

## Runtime Rollout Safety

- Rollout-managed features: none; this PR packages already-merged
behavior.
- Stable/default behavior changed: no additional runtime behavior beyond
the included, already-reviewed security fixes.
- Kill switch / disable path: not applicable to generated release
metadata.
- Qualification impact: release artifact construction and smoke-import
validation are green.
- Rollback path: do not merge the release PR, or revert the release
commit before publishing.

## Review Readiness

- [x] I have performed a self-review
- [x] This PR is ready for human review

## Release Notes

### Bug Fixes

- **security:** address u9up assessment findings (WEB-01–07) (#2207)

This PR was generated with Release Please and then its description was
expanded to document review and qualification evidence. It still
requires final human review; no publishing or merge has been performed.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-20 17:20:18 -07:00
..
hook-shim feat: headroom wrap opencode / unwrap opencode CLI (#1105) 2026-06-22 11:07:12 -05:00
src fix(opencode): send x-headroom-project header on all proxied requests (#2868) 2026-08-17 20:21:24 -07:00
.gitignore feat(opencode): ship the transport plugin in pip installs (#2601) 2026-07-27 06:40:43 -07:00
package-lock.json fix: publish headroom-opencode in release workflow (#2372) 2026-08-11 23:56:40 -05:00
package.json chore: release 0.36.1 (#3152) 2026-08-20 17:20:18 -07:00
README.md fix(ccr): make headroom_retrieve a hash-only full-content lookup (#1532) 2026-06-28 10:32:43 -07:00
tsconfig.json feat: headroom wrap opencode / unwrap opencode CLI (#1105) 2026-06-22 11:07:12 -05:00
tsup.config.ts fix(opencode): route native providers + load transport plugin, fix Serena context (#1573) 2026-06-29 15:04:56 -07:00
tsup.standalone.config.ts fix(opencode): ship the transport hook-shim so wheel installs route Node child traffic 2026-08-11 09:10:38 -07:00
vitest.config.ts feat: headroom wrap opencode / unwrap opencode CLI (#1105) 2026-06-22 11:07:12 -05:00

headroom-opencode

OpenCode integration helpers for Headroom. The package supports two integration paths:

  1. Provider config helpers used by headroom wrap opencode and persistent installs.
  2. A native OpenCode plugin that installs Headroom transport interception and exposes the retrieve tool.

Install

npm install headroom-opencode

Provider Config Helpers

Use these helpers when you need to generate OpenCode config that routes a headroom provider through a running Headroom proxy.

import {
  buildOpencodeConfigContent,
  createHeadroomProvider,
} from "headroom-opencode";

const provider = createHeadroomProvider({ proxyPort: 8787 });
const config = buildOpencodeConfigContent({
  proxyPort: 8787,
  defaultModel: "claude-sonnet-4-6",
});

console.log(provider.provider.headroom.npm);
console.log(config.model);

The generated provider uses @ai-sdk/openai-compatible and points model requests at http://127.0.0.1:<port>/v1.

Native OpenCode Plugin

Use HeadroomPlugin when OpenCode should intercept provider traffic in-process and expose Headroom tooling from a plugin.

import { HeadroomPlugin } from "headroom-opencode";

export default async function plugin(input) {
  return HeadroomPlugin(input, {
    proxyUrl: process.env.HEADROOM_PROXY_URL ?? "http://127.0.0.1:8787",
  });
}

HeadroomPlugin:

  • installs Headroom transport interception for OpenCode provider traffic.
  • exposes the headroom_retrieve tool.
  • publishes HEADROOM_PROXY_URL in the plugin output env.
  • defaults to http://127.0.0.1:8787 when no proxy URL is supplied.

Retrieve Tool

import { createHeadroomRetrieveTool } from "headroom-opencode";

const retrieve = createHeadroomRetrieveTool({
  proxyBaseUrl: "http://127.0.0.1:8787",
});

const result = await retrieve.execute({
  hash: "0123456789abcdef01234567",
});

The tool calls /v1/retrieve/<hash> on the Headroom proxy.

Compression Helper

import { compressWithHeadroom } from "headroom-opencode";

const result = await compressWithHeadroom(
  [{ role: "user", content: "Summarize this file" }],
  { model: "gpt-4o", proxyUrl: "http://127.0.0.1:8787" },
);

console.log(`Saved ${result.tokensSaved} tokens`);

Models

Model Context Output
claude-sonnet-4-6 200K 16K
claude-opus-4-6 200K 16K
claude-haiku-4-5-20251001 200K 8K
gpt-4o 128K 16K
gpt-4.1 1M 32K

The provider config exposes these as headroom/<model> and defaults to headroom/claude-sonnet-4-6.

Environment

Variable Used by Description
HEADROOM_PROXY_URL Native plugin Proxy URL used by HeadroomPlugin
OPENCODE_CONFIG_CONTENT OpenCode wrapper Generated OpenCode provider, model, and MCP config

License

Apache-2.0