opencode-x v1.0.9

v1.0.9 ships three new slash commands (/insights, /loop, /distill this), project-scoped persistent memory, SSRF hardening for webfetch, and a batch of reliability fixes across compaction, TUI, LSP, and providers.

Highlights

• /insights: generates an HTML report summarizing session activity and token usage.
• /loop: recurring prompt scheduler for periodic automation inside a session.
• /distill this: extracts the current session into a reusable skill.
• Project-scoped memory: persistent memory is now scoped per project, with a global opt-out.
• Security: SSRF hardening for webfetch, plus a warning when the provider cache is lost.
• Reliability: compaction race fixes, prompt assembly fixes, doom loop detection, and hung LSP recovery.

New features

• /insights slash command with HTML report generation.
• /loop recurring prompt scheduler.
• /distill this to extract skills from the current session.
• /context command showing a session context breakdown in the TUI.
• Persistent memory scoped by project with a global opt-out.

Fixes

• Compaction/session: fixed a compaction race condition, reset session status to idle after manual compact, prevented user prompts and autocompaction from interfering, and fixed three prompt assembly bugs in toModelMessagesEffect.
• TUI: preserved agent model overrides, matched events by worktree when started from a subdirectory, added doom loop detection, and prevented tool output truncation of skill files.
• LSP: detect and recover from hung language server processes.
• Session: surface empty output-cap responses instead of silently dropping them.
• Providers: cherry-picked upstream fixes for textVerbosity injection on @ai-sdk/openai-compatible providers, deprecated Gemini sampling defaults, widened interleaved reasoning fields, Azure Cognitive Services endpoint restoration, and MCP/server fixes.
• Security: SSRF hardening for webfetch.

Internal

• Regenerated v2 SDK types from current server schemas.