Security Hardening & Stability
This release locks down HTTP hook execution and fixes several determinism bugs that caused subtle issues across process restarts and parallel sessions.
Hook Security
HTTP hooks now validate URL schemes before execution — only http: and https: are allowed. Previously, file://, data:, and other dangerous schemes could be used to read local files through hook URLs. The disable mechanism (disabled_hooks) now works for HTTP hooks too, not just command hooks.
Deterministic IDs
Message and part IDs generated by the hook system now include a process-unique prefix (msg_<hex>_<counter>), eliminating storage collisions when multiple OpenCode processes run against the same session store.
Hashline Edit: Now Opt-In
The hash-anchored edit tool (hashline_edit) is now disabled by default. If you relied on LINE#ID references in your workflow, add "hashline_edit": true to your config.
Performance
Image dimension parsing for the read-image-resizer hook now decodes only the first 32KB of base64 data instead of the full payload — significant memory savings for large images.
Community
New features from contributors: agent-usage-reminder fix for subagents, glob/grep relative path resolution, duplicate agent entry fix, Russian README, and more.
- 3db46a5 feat(hashline): change hashline_edit default from true to false
- 0dd9ac4 perf(read-image-resizer): decode only first 32KB of base64 for dimension parsing
- 1a9e7eb fix(hook-message-injector): add process-unique prefix to message/part IDs to prevent storage collisions
- 682a3c8 fix(hooks): prevent SSRF via URL scheme validation and extend disable mechanism to HTTP hooks
- a666612 @mathew-cf has signed the CLA in #2233
- a6955d7 @Chocothin has signed the CLA in #2230
- 1a25b25 @DEAN-Cherry has signed the CLA in #2227
- 9a505a3 @laciferin2024 has signed the CLA in #2222
- acc2132 Merge pull request #2212 from code-yeongyu/fix/h5-collector-ordering
- e750365 Merge pull request #2211 from code-yeongyu/fix/c2-hook-message-ids
- 73fea69 Merge pull request #2210 from code-yeongyu/fix/c1-synthetic-part-id
- d39b3aa Merge pull request #2151 from ualtinok/fix/agent-usage-reminder-subagent-exclusion
- 7c9f507 fix(context-injector): use monotonic registration order instead of timestamp for deterministic sorting
- 4d8360c fix(context-injector): use deterministic synthetic part ID for cache stability
- 6e9f273 fix(hook-message-injector): use monotonic counter for deterministic message/part IDs
- 2478b28 Merge pull request #2204 from ualtinok/fix/glob-directory-prefix
- 418cf85 fix(glob): use cwd-relative search for ripgrep to fix directory prefix patterns
- cc6ab1a feat(hooks): add read-image-resizer hook
- 74f7992 feat(agents): add Gemini tool guide and few-shot examples to system prompt
- 13d689c feat(agents): add Plan Agent dependency and strengthen Deep Parallel Delegation for non-Claude models
- 29d6062 Merge pull request #2202 from ualtinok/fix/glob-grep-relative-path
- d65ee31 Merge pull request #2208 from code-yeongyu/feat/http-hook-support
- 4dae458 style(hooks): add blank line between interpolateEnvVars and resolveHeaders
- 4740515 fix(agents): replace active polling with notification-based waiting for background tasks
- 3eb53ad fix(hooks): resolve cubic review issues
- 43dfdb2 feat(hooks): add HTTP hook handler support
- 7cec6f7 fix(tools): resolve relative paths in glob/grep against project directory
- 866bd50 @renanale has signed the CLA in #2201
- 518e3c5 Merge pull request #2161 from acamq/fix/duplicate-agent-entries
- 8512624 Merge pull request #2153 from devxoul/fix/docs-master-to-dev-branch
- bc2eaaf Merge pull request #2160 from dwnmf/add-russian-readme
- 0f73504 @mertyldrm has signed the CLA in #2184
- db32ac5 @YLRong has signed the CLA in #2176
- 2eb7994 fix(atlas): use start-work session agent for continuation gating
- 15ad944 @1noilimrev has signed the CLA in #2166
- 07542d3 Fix markdown blockquote structure in Russian README
- d6dd548 fix(agents): remove duplicate remapped agent keys
- f3cbc24 @dwnmf has signed the CLA in #2160
- b76abeb Add Russian README
- 21c249e fix(ci): pre-download baseline compile targets to avoid Bun extraction failures
- 0749a8f fix(ci): make platform publish resilient to individual build failures
- 35edcec fix(agent-usage-reminder): skip reminders for non-orchestrator subagents
- 0cc9eda replace master branch references with dev across docs, schema URLs, and tests
Thank you to 6 community contributors:
- @devxoul:
- replace master branch references with dev across docs, schema URLs, and tests
- @ualtinok:
- fix(agent-usage-reminder): skip reminders for non-orchestrator subagents
- fix(tools): resolve relative paths in glob/grep against project directory
- fix(glob): use cwd-relative search for ripgrep to fix directory prefix patterns
- @dwnmf:
- Add Russian README
- Fix markdown blockquote structure in Russian README
- @acamq:
- fix(agents): remove duplicate remapped agent keys
- @kdcokenny:
- @KNN-07:
- Merge pull request #2161 from acamq/fix/duplicate-agent-entries