
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@honcho-ai/opencode-honcho
Advanced tools
Add AI-native memory to OpenCode
Give OpenCode long-term memory that survives context wipes, session restarts, and fresh chats. Honcho remembers what you're working on, durable preferences, and prior context across your projects.
OpenCode installs the Honcho plugin and adds it to your global OpenCode config.
opencode plugin @honcho-ai/opencode-honcho --global
To update an existing plugin install:
opencode plugin @honcho-ai/opencode-honcho --force
This command expects the opencode CLI to already be installed and available on your PATH.
If your shell cannot find opencode, restart your shell or source your shell config and run the command again.
/honcho:setupHoncho Cloud option unless you explicitly want a self-hosted or local endpointpeerName/honcho:status to verify the runtimeOpenCode:
@honcho-ai/opencode-honcho with OpenCodeOpenCode Honcho configuration lives in:
~/.honcho/config.jsonOpenCode reads and writes this shared config file directly. OpenCode-specific defaults live under hosts.opencode in that file.
{
"apiKey": "hch-...",
"peerName": "user",
"baseUrl": "https://api.honcho.dev",
"hosts": {
"opencode": {
"workspace": "opencode",
"aiPeer": "opencode",
"recallMode": "hybrid",
"sessionStrategy": "per-directory"
}
}
}
For Honcho Cloud:
apiKey is requiredbaseUrl should remain https://api.honcho.devFor self-hosted or local Honcho:
baseUrl should point to your deployment, for example http://127.0.0.1:8000apiKey is required only if that deployment requires authenticationIf OpenCode is running in Docker or another remote environment, localhost may not refer to your machine. The configured baseUrl must be reachable from the OpenCode host runtime.
| Strategy | Behavior | Best for |
|---|---|---|
per-directory | One session per working directory | Default project memory |
per-repo | One session per repository | Repos with multiple entry directories |
git-branch | Session changes with the current branch | Branch-specific workflows |
per-session | New session for each OpenCode session id | Short-lived isolated work |
chat-instance | Session follows the current chat instance | Highly ephemeral usage |
global | One session for everything | Shared memory across all work |
| Command | Description |
|---|---|
/honcho:setup | First-time setup for cloud or local Honcho |
/honcho:status | Show effective Honcho status for the current OpenCode project, including live workspace and session names when available |
/honcho:settings | Show effective config values and config paths |
/honcho:config | Edit shared Honcho fields in ~/.honcho/config.json |
The plugin exposes these tools inside OpenCode:
| Tool | Description |
|---|---|
honcho_setup | Validate setup and persist shared credentials or endpoint settings |
honcho_status | Show effective runtime status |
honcho_get_config | Read effective and persisted settings |
honcho_set_config | Update a persisted shared setting |
honcho_search | Search Honcho session messages in the current session |
honcho_chat | Query Honcho for reasoning-backed context |
honcho_create_conclusion | Save a durable memory conclusion |
The plugin uses these OpenCode plugin capabilities:
eventchat.messagetool.execute.aftercommand.execute.beforeexperimental.chat.system.transformexperimental.session.compactingshell.envtoolFor macOS/Linux local branch testing:
bun install
bun run build
opencode plugin "$PWD" --global --force
That command wires the current checkout into OpenCode with --force, which is the intended local branch-testing flow.
FAQs
Honcho memory integration for OpenCode
We found that @honcho-ai/opencode-honcho demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.