fix(opencode): remove install-breaking upper bounds on shared deps

[iceteaSA]

Installing 2.0.0 fails outright on a current host. Reported in Discord by two users; the trigger is anything that rebuilds the plugin cache (rm -rf ~/.cache/opencode, a fresh machine, a new install).

npm error ERESOLVE unable to resolve dependency tree
npm error Found: @opentui/core@0.5.1
npm error peer @opentui/core@"^0.4.5" from @cortexkit/opencode-antigravity-auth@2.0.0

The failure does not look like a failure. npm aborts, the plugin is never installed, and the user sees:

ProviderModelNotFoundError: Model not found: google/antigravity-claude-opus-4-6-thinking

Cause

2.0.0 declared @opentui/* as peer dependencies at ^0.4.5. On a 0.x version, caret is minor-locked — ^0.4.5 means >=0.4.5 <0.5.0. OpenTUI has since released 0.5.0 and 0.5.1.

@opencode-ai/plugin declares the same three packages as optional peers at >=0.4.5, so the host resolves 0.5.1 happily. Our range rejects it, and no single version satisfies both — hence ERESOLVE.

This was a 2.0.0 regression. 1.1.0 declared neither the OpenTUI peers nor a host-version ceiling.

Fix

Match the shape the sibling openai-auth plugin already uses:

   "peerDependencies": {
-    "@opencode-ai/plugin": "^1.17.13",
-    "@opentui/core": "^0.4.5",
-    "@opentui/keymap": "^0.4.5",
-    "@opentui/solid": "^0.4.5",
+    "@opencode-ai/plugin": "*",
     "typescript": "^5 || ^6"
   },
   "dependencies": {
+    "@opentui/core": ">=0.4.5",
+    "@opentui/keymap": ">=0.4.5",
+    "@opentui/solid": ">=0.4.5",

The ^1.17.13 ceiling on the host goes too. It is not biting yet — 1.18.11 satisfies it — but it is the same defect one major bump away, and both sibling plugins use *.

I also tested keeping the OpenTUI packages as peers marked optional. That installs cleanly but leaves them uninstalled, and the ./tui entry then fails to import. Ordinary dependencies is the correct shape for a package that imports them at runtime.

engines.opencode still reads >=1.17.13 <2. Left alone deliberately: it is advisory rather than resolver input, so it does not cause this failure, and tightening or loosening it is a separate call.

Verification

Installed the packed tarball against the exact host from the report:

$ npm i @opencode-ai/plugin@1.18.11 ./cortexkit-opencode-antigravity-auth-2.0.0.tgz
install exit=0   ERESOLVE lines=0

opentui/core : 0.5.1
opentui/solid: 0.5.1
host plugin  : 1.18.11
server entry : AntigravityCLIOAuthPlugin,GoogleOAuthPlugin
tui entry    : resolves (src/tui/entry.mjs + src/tui-compiled/tui.tsx present)

npm ls shows one hoisted copy — @opentui/core@0.5.1 with keymap and solid both deduped, so no duplicate runtime.

Gates: 1830 unit / 0 fail · 28 e2e / 0 fail · typecheck · format · lint · build · smoke:tui.

Regression guard

packages/opencode/src/package-manifest.test.ts fails when any range we publish for one of the host's own peer dependencies rejects a future version, since those must resolve to a single shared copy. It reads the host manifest from the installed tree rather than hardcoding a version, and asserts directly that 0.4.5 / 0.5.0 / 0.5.1 / 1.0.0 are all accepted.

Restoring the 2.0.0 ranges turns all three tests red:

(fail) declares no upper bound on the host's own peer dependencies
(fail) declares no upper bound on the host plugin itself
(fail) accepts the OpenTUI versions the host accepts
0 pass, 3 fail

The host's ordinary dependencies are deliberately not flagged — those can nest a second copy, so a bound there is not an install hazard. Scoping to peers only was a correction: the first version of the guard flagged zod and would have been wrong.

For affected users before a release

npm i --legacy-peer-deps

or legacy-peer-deps=true in .npmrc. Both verified — the plugin installs and the server entry loads.

This needs a patch release to reach anyone; the fix has no effect until 2.0.1 is on npm.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fix npm install failures on fresh hosts by removing upper bounds on shared OpenTUI packages and making them direct dependencies. Adds a guard test to block future ceilings and duplicated installs so one version is shared with the host.

• Bug Fixes
  • Moved @opentui/core, @opentui/keymap, @opentui/solid from peerDeps ^0.4.5 to deps >=0.4.5 to allow 0.5.x+ and match the host.
  • Relaxed @opencode-ai/plugin peer range to *.
  • Added package-manifest.test.ts to fail on any ceilings, assert OpenTUI 0.4.5/0.5.x/1.x are accepted, and verify exactly one installed copy across ancestor and nested trees (hardlinks handled).

^{Written for commit a4761e7. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>