OpenCode v2.2.6 stops project files from running scripts on its server

OpenCode shuts a hole in its server. Files and media from the server API now arrive as sandboxed downloads, and the API refuses cross-site requests, so a file in your project can't run scripts on the server.

Webfetch gets stricter too. It rejects URLs that carry credentials, ignores the fragment when it matches your permission rules, and in Code Mode, every redirect is checked against your webfetch rules.

OpenCode run now waits for the shell commands and subagents its prompt started, then lets the model answer them. There's no time limit, so a dev server keeps the run open. Give CI jobs a timeout.

With the worktree flag, OpenCode run starts its session in a new git worktree, and you can give that worktree a name. It can't be combined with continuing an existing session.

Add the archived flag, and OpenCode run creates the session already archived, so CI runs stay out of your inbox and session lists. Continuing your last session skips them too.

Turn on pooling for an MCP server, and every project with the same setup shares one connection to it. You run fewer processes, and OpenCode starts faster.

Startup no longer hangs when the OpenCode Console never answers. Provider requests keep retrying while their host is unreachable. And Control Z suspends OpenCode even with a dialog open.

If you run OpenCode in CI, I'd upgrade now for the server and webfetch fixes, and give each job a timeout. The rest is in OpenCode's changelog.