opencode-power-pack

OpenCode 2 support

Version 0.6.0 supports OpenCode 2 and keeps OpenCode 1.18.7 support. Both hosts load all 55 skills and the three feature-development specialists. Smoke tests cover OpenCode 1.18.7, 2.0.14, and 2.0.32, including effective read-only permissions on V2.

Install the plugin in OpenCode 2:

opencode plugin add "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git"

Release v0.6.0 and npm 0.6.0 include the plugin for OpenCode 1 and 2. Tag v0.5.0 and npm 0.5.0 have only the OpenCode 1 plugin.

For host commands, update steps, and the current catalog, see the documentation and skill reference. The OpenCode compatibility guide covers source selection and V2 permissions.

Native sandboxes in v0.5.0

OpenCode Power Pack now includes an opt-in, fail-closed sandbox runner for safer command execution from Codex, OpenCode, Claude Code, and Pi. It gives all four agents one portable capability contract with four least-privilege profiles, while using native Seatbelt isolation on macOS and Bubblewrap on Linux.

• Lightweight: one contained command tree, with no container image, daemon, or persistent sandbox to manage.
• Portable: the same CLI and skill policy work from all four supported coding agents.
• Least privilege: skills default to observe, develop, network-read, or publish, with explicit escalation checks.
• Fail closed: unavailable isolation, undeclared escalation, missing confirmation, or backend failure stops execution instead of retrying outside the sandbox.

Install the CLI, verify the boundary from the active agent session, and run a command with the skill's trusted profile:

npm install --global @waybarrios/opencode-power-pack@0.6.0
opencode-power-pack sandbox doctor --json
opencode-power-pack sandbox exec --skill code-review -- git status --short

The current guarantee is intentionally precise: the command and its descendants are shell-contained. Automatic host routing and whole-agent isolation are not claimed yet. See run the sandbox from each agent and the complete compatibility specification.

Claude Code Quick Install

Run these commands inside Claude Code:

/plugin marketplace add waybarrios/opencode-power-pack
/plugin install opencode-power-pack@opencode-power-pack

Run /reload-plugins if the installation summary requests it. Skills are namespaced to avoid collisions, so explicit invocations use names such as /opencode-power-pack:code-review and /opencode-power-pack:feature-dev.

Codex Quick Install

codex plugin marketplace add waybarrios/opencode-power-pack --ref main
codex plugin add opencode-power-pack@opencode-power-pack

Start a new Codex session, open /plugins to confirm the installation, or invoke a workflow explicitly with $code-review, $feature-dev, $security-review, and the other bundled skills.

Pi Quick Install

pi install git:github.com/waybarrios/opencode-power-pack

Pi discovers the fifty-five skills declared by the package. Use pi list to verify the installation. For a project-local installation recorded in .pi/settings.json, add -l:

pi install git:github.com/waybarrios/opencode-power-pack -l

Selective Install With npm

Install only the workflows you want into the shared .agents/skills location recognized by Codex, OpenCode, and Pi:

Use npx when you want to run the latest installer without keeping a global copy:

# Inspect every profile and skill
npx @waybarrios/opencode-power-pack list

# Install the balanced recommended profile for your user
npx @waybarrios/opencode-power-pack install --profile recommended

# Install individual skills
npx @waybarrios/opencode-power-pack install code-review security-review

# Install a profile only for the current repository
npx @waybarrios/opencode-power-pack install --profile review --project

# Preview a selection without writing anything
npx @waybarrios/opencode-power-pack install --profile security --dry-run

# Update previously copied skills from the latest package
npx @waybarrios/opencode-power-pack@latest install --profile review --force

Or install the package globally and use its shorter executable:

npm install --global @waybarrios/opencode-power-pack

opencode-power-pack list
opencode-power-pack install --profile recommended
opencode-power-pack install code-review security-review

To update or remove the global installation:

npm update --global @waybarrios/opencode-power-pack
npm uninstall --global @waybarrios/opencode-power-pack

The npm package is scoped as @waybarrios/opencode-power-pack to give it an unambiguous registry identity. The package still installs the shorter opencode-power-pack executable for direct CLI use. No global installation is required when using npx.

GitHub Packages mirror

Every GitHub release can also be published from its immutable tag to the repository's GitHub Packages page. npmjs remains the recommended public installation source because it works without GitHub authentication.

To install the GitHub Packages mirror, first authenticate with a GitHub personal access token (classic) that has read:packages, then select the GitHub registry explicitly:

npm login --scope=@waybarrios --auth-type=legacy --registry=https://npm.pkg.github.com
npm install --global @waybarrios/opencode-power-pack --registry=https://npm.pkg.github.com

opencode-power-pack list

Run the installer directly from the mirror after authentication:

npx --registry=https://npm.pkg.github.com @waybarrios/opencode-power-pack list

Maintainers publish the mirror with the Publish GitHub Package workflow. Release events publish automatically, while a manual run requires an existing release tag such as v0.6.0. The workflow verifies that the tag matches package.json, uploads the artifact already verified by required release CI without rerunning lifecycle scripts, and authenticates with the repository-scoped GITHUB_TOKEN; no package token is stored in the repository.

Profiles automatically include required companion skills and can be combined with individual skill names. The default destination is ~/.agents/skills; --project finds the current Git root and in