Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: anomalyco/opencode
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: dev
Choose a base ref
...
head repository: Almoosawi/opencode
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: dev
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 11 commits
  • 92 files changed
  • 3 contributors

Commits on May 23, 2026

  1. release: v1.15.10

    opencode committed May 23, 2026
    Configuration menu
    Copy the full SHA
    d74d166 View commit details
    Browse the repository at this point in the history

Commits on May 25, 2026

  1. chore(snapshot): pre-change snapshot for updater removal

    @Almoosawi
    Almoosawi committed May 25, 2026
    Configuration menu
    Copy the full SHA
    f22bd36 View commit details
    Browse the repository at this point in the history

  2. feat(security): remove auto-updater — all update capability stripped 

    Removes electron-updater dep, updater.ts (main + renderer), all IPC handlers,
preload bridge, error.tsx update UI, and electron-builder publish blocks.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 25, 2026
    Configuration menu
    Copy the full SHA
    c0d8619 View commit details
    Browse the repository at this point in the history

  3. feat(security): strip Sentry telemetry from desktop + app 

    Removes @sentry/solid, @sentry/vite-plugin, all Sentry.init calls,
captureException usage, and report-error UI. Zero data transmitted
to sentry.io.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 25, 2026
    Configuration menu
    Copy the full SHA
    8f1a9a8 View commit details
    Browse the repository at this point in the history

  4. feat(security): disable release notes network egress 

    Defaults releaseNotes to false and short-circuits the changelog fetch
in highlights.tsx. No outbound calls to opencode.ai/changelog.json.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 25, 2026
    Configuration menu
    Copy the full SHA
    f9d77f7 View commit details
    Browse the repository at this point in the history

  5. feat(ci): add hardened build pipeline with CI-only code signing 

    OPENCODE_SIGN_BUILD env var gates signing. CSC_LINK and CSC_KEY_PASSWORD
from CI secrets. SHA256 timestamping via digicert. Artifact manifest with
full provenance chain.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 25, 2026
    Configuration menu
    Copy the full SHA
    a6999e6 View commit details
    Browse the repository at this point in the history

Commits on May 26, 2026

  1. feat(security): harden Dockerfiles — non-root users + pinned base image 

    - Production CLI: pin alpine:3.21, add opencode user, USER directive
- CI base: create builder user in base image
- All 5 CI images: switch to non-root builder user after installs
- Addresses 12 Fortify findings (6 Default User Privilege, 6 Dependency Confusion)

Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 26, 2026
    Configuration menu
    Copy the full SHA
    707f304 View commit details
    Browse the repository at this point in the history

  2. docs(security): add Fortify triage report, managed config schema, and… 

    … assessment

- fortify-triage-v1.15.10.md: full triage of 158 findings (127 FP, 16 mitigated, 15 accepted)
- managed-config-schema.md: enterprise config investigation with deployable GPO JSON
- opencode-security-assessment.md: formal assessment summary for corporate deployment approval

Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 26, 2026
    Configuration menu
    Copy the full SHA
    f0219b0 View commit details
    Browse the repository at this point in the history

  3. chore: remove unused README translations, keep English + Arabic only 

    Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 26, 2026
    Configuration menu
    Copy the full SHA
    540bef1 View commit details
    Browse the repository at this point in the history

  4. chore(ci): disable upstream-only workflows with if: false 

    Prevents failures from missing upstream secrets (Cloudflare, npm,
Discord, Sentry, etc.) and disables community management workflows
irrelevant to the private fork. Kept: typecheck, nix-eval,
pr-standards, storybook, build-hardened.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed May 26, 2026
    Configuration menu
    Copy the full SHA
    087ebf1 View commit details
    Browse the repository at this point in the history

Commits on Jun 2, 2026

  1. fix(slack): stop logging Slack token-presence flags at startup 

    Removes the four console.log lines in packages/slack/src/index.ts that printed whether SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET and SLACK_APP_TOKEN were set. Fortify SSC flagged this as a Privacy Violation (information disclosure): secret-configuration state was written to stdout/logs. The Slack App still reads the same env vars directly, so behaviour is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
    @Almoosawi @claude
    Almoosawi and claude committed Jun 2, 2026
    Configuration menu
    Copy the full SHA
    959794a View commit details
    Browse the repository at this point in the history
Loading