$ the-wire · showcase
Goose extension allowlist now fails closed, opencode ships video input and reshuffles its AI package
By RepoJournal · Filed · About Agentic Coding · Composed from the cited sources · methodology
The day is mostly plumbing, but two of the changes reach operators: goose's extension allowlist now refuses to load anything when the policy fetch or parse fails, and opencode's @opencode/ai import paths have swapped their roots.
feat(allowlist): require HTTPS and validate redirects, block on policy failure aaif-goose/goose
The extension allowlist now requires HTTPS on the policy URL and on every redirect target, and blocks rather than falls back when fetching, redirecting, or parsing a configured policy fails; a configured empty allowlist means deny-all, while installing no policy keeps the old behavior. The whole fetch, redirects and body reads included, is bounded at 30 seconds, so a slow or redirecting policy ...
refactor(ai): make Promise the root entry and move Effect to @opencode/ai/effect anomalyco/opencode
The package root of @opencode/ai is now the Promise API (AI, ai) and the Effect API (LLM, AIClient, Image, schema) moved to @opencode/ai/effect, with /providers, /route, /protocols and /testing unchanged. This is a breaking change for anyone importing from @opencode/ai/promise or pulling Effect types from the bare root.
fix(ai): support Messages video inputs anomalyco/opencode
Messages-compatible providers can now receive video through ordinary input, as a video block with base64, URL, or file source, and nested inside tool results. Meta's unusual placement rule stays confined to its own adapter, so no new compatibility settings are needed from you.
fix(ai): support Responses video inputs anomalyco/opencode
Video on Responses-based providers used to go out as file encoding by default; it now uses standard input_video blocks for ordinary input and tool results. xAI still gets input_file and Meta still gets its trailing-batch placement, all inside the existing adapters.
chore(GDK): release v0.1.0-alpha.13 aaif-goose/goose
The GDK alpha train moved to 0.1.0-alpha.13 across goose-agent, goose-provider-types, goose-sdk-types and the rest, with the release notes flagging API breaking changes in goose-provider-types and goose-agent. Also in the long tail: opencode stopped silently dropping OpenAI Chat options, and OpenHands spent a cluster of PRs replacing inline styles with theme aliases and custom properties for it...
Action items
