Bug Description
The pluginAutoInstall config field exists in the schema but has no effect. Users can set pluginAutoInstall: false in their config file, but plugins still auto-install because the config value is never checked by any code.
Only the undocumented OPENCODE_DISABLE_PLUGIN_INSTALL=true environment variable actually disables auto-install, but there's no way to set this from the config file.
Steps to Reproduce
- Add
"pluginAutoInstall": false to opencode.json
- Start opencode
- Observe that plugins are still auto-installed (check
~/.cache/opencode/packages/)
Root Cause
npm.ts: add() and install() never check any disable flag
config.ts: pluginAutoInstall schema field is not wired to set the env var
flag.ts: No OPENCODE_DISABLE_PLUGIN_INSTALL flag defined as a runtime getter
Expected Behavior
Setting pluginAutoInstall: false in config should prevent automatic plugin installation, equivalent to setting OPENCODE_DISABLE_PLUGIN_INSTALL=true.
Impact
This caused a critical issue in our deployment: opencode auto-installed an npm package that overwrote our patched fork plugin, destroying session compression state and losing data.
Bug Description
The
pluginAutoInstallconfig field exists in the schema but has no effect. Users can setpluginAutoInstall: falsein their config file, but plugins still auto-install because the config value is never checked by any code.Only the undocumented
OPENCODE_DISABLE_PLUGIN_INSTALL=trueenvironment variable actually disables auto-install, but there's no way to set this from the config file.Steps to Reproduce
"pluginAutoInstall": falsetoopencode.json~/.cache/opencode/packages/)Root Cause
npm.ts:add()andinstall()never check any disable flagconfig.ts:pluginAutoInstallschema field is not wired to set the env varflag.ts: NoOPENCODE_DISABLE_PLUGIN_INSTALLflag defined as a runtime getterExpected Behavior
Setting
pluginAutoInstall: falsein config should prevent automatic plugin installation, equivalent to settingOPENCODE_DISABLE_PLUGIN_INSTALL=true.Impact
This caused a critical issue in our deployment: opencode auto-installed an npm package that overwrote our patched fork plugin, destroying session compression state and losing data.