
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@constellationdev/opencode
Advanced tools
While Constellation's MCP server provides raw code intelligence capabilities, this plugin enhances your OpenCode experience with:
| Feature | Benefit |
|---|---|
| Specialized Agents | AI agents for codebase exploration, impact analysis, and dependency health |
| Session Hooks | Automatic Constellation availability checks and context preservation |
Specialized AI agents for autonomous analysis:
| Agent | Purpose |
|---|---|
| @source-scout | Explores and navigates codebase, discovers symbols and architectural patterns |
| @impact-investigator | Proactively assesses risk before refactoring, renaming, or deleting code |
| @dependency-detective | Detects circular dependencies and unhealthy coupling patterns |
Example Trigger:
You: "What does this codebase do?"
OpenCode: [Activates @source-scout agent]
You: "I'm renaming AuthService to AuthenticationService"
OpenCode: "Before renaming, let me analyze the potential impact..."
[Activates @impact-investigator agent]
Event hooks enable intelligent, transparent assistance:
| Hook | Event | Behavior |
|---|---|---|
| Availability Check | session.created | Silently checks Constellation connectivity at session start |
| System Prompt Enhancement | chat.system.transform | Injects Constellation priority into prompts |
| Context Preservation | session.compacting | Preserves Constellation insights in compacted summary |
When you run constellation init with OpenCode tool configuration, the CLI automatically configures both the plugin and MCP server in your project's opencode.json.
Add the plugin to your project's opencode.json:
{
"plugin": ["@constellationdev/opencode"]
}
OpenCode will automatically install the plugin at startup.
Note: Install this plugin at the project level, not globally. It should only be enabled for projects that use Constellation.
The plugin ships a set of on-demand skills — OpenCode's agent loads them automatically when a user request matches the skill's description. There are no slash commands; just ask.
> Check Constellation status
[skill: constellation-status]
Status: Connected
Project: my-awesome-app
Files Indexed: 1,247
Symbols: 8,932
Languages: TypeScript, JavaScript
> What's the impact of changing validateUser in src/auth/validator.ts?
[skill: constellation-impact]
Symbol: validateUser (function)
Risk Level: MEDIUM
Files Affected: 12
Symbols Affected: 34
Test Coverage: 67%
Recommendations:
- Update unit tests in auth.spec.ts
- Check integration with UserController
> Find unused functions
[skill: constellation-unused]
Found 7 orphaned functions:
├── src/utils/legacy.ts
│ ├── formatLegacyDate (line 23)
│ └── parseLegacyConfig (line 45)
├── src/helpers/deprecated.ts
│ └── oldValidation (line 12)
...
> Show me the dependencies for src/services/payment.service.ts
[skill: constellation-deps]
Dependencies (12):
├── Internal (8)
│ ├── src/models/payment.model.ts
│ ├── src/utils/currency.ts
│ └── ...
└── External (4)
├── stripe
├── lodash
└── ...
No circular dependencies detected.
| Skill | Triggers on |
|---|---|
constellation-status | "Is Constellation working?", "ping Constellation" |
constellation-diagnose | "Full Constellation health check" |
constellation-impact | "What would break if I change X?", "blast radius of X" |
constellation-deps | "Dependencies of X", "what depends on X" |
constellation-unused | "Find dead code", "orphaned exports" |
constellation-architecture | "Codebase overview", "architecture summary" |
constellation-troubleshooting | Any Constellation error code or "Constellation broken" |
Constellation uses privacy-preserving AST extraction to understand your code structure without transmitting source code:
Your Code → AST Extraction → Constellation API → Code Intelligence
(no source) (encrypted) (semantic queries)
| Issue | Solution |
|---|---|
AUTH_ERROR | Check CONSTELLATION_ACCESS_KEY is set correctly, use constellation auth CLI command to set |
PROJECT_NOT_INDEXED | Run constellation index --full in your project |
| MCP Server not responding | Restart OpenCode, or ask "Run a Constellation health check" to invoke the constellation-diagnose skill |
GNU Affero General Public License v3.0 (AGPL-3.0)
Copyright © 2026 ShiftinBits Inc.
See LICENSE file for details.
FAQs
Upgrade OpenCode from text search to code understanding.
The npm package @constellationdev/opencode receives a total of 3 weekly downloads. As such, @constellationdev/opencode popularity was classified as not popular.
We found that @constellationdev/opencode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.