
Security News
TC39 Advances Temporal to Stage 4 Alongside Several ECMAScript Proposals
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.
@howaboua/opencode-planning-toolkit
Advanced tools
Comprehensive planning toolkit for OpenCode: manage specifications, track study plans, and automate roadmaps.
Keep your projects organized and your AI agents aligned.
This plugin adds structure to your development workflow with reusable specifications, actionable plans, and progress tracking—all integrated directly into OpenCode.
<available_plans> in the system prompt with all plan names and descriptionscreate_spec - Create a reusable specification (repo-level or feature-specific)create_plan - Create an actionable work plan with implementation steps (min 5)append_spec - Link an existing spec to a planread_plan - Read a plan with all linked spec content expanded inlinemark_plan_done - Mark a plan as completeThis plugin includes a bundled skill (plans-and-specs) that automatically loads with the plugin. The skill provides agents with:
When agents use it:
The skill ensures agents follow best practices automatically without manual prompting.
Add to your opencode.json:
{
"plugins": [
"@howaboua/opencode-planning-toolkit@latest"
]
}
Or for local development:
{
"plugins": [
"file:///path/to/opencode-planning-toolkit/index.ts"
]
}
Define standards or requirements once, use them everywhere:
Ask the agent: "Create a repo-level spec for TypeScript coding standards"
The agent creates docs/specs/typescript-standards.md:
# Spec: typescript-standards
Scope: repo
- Use strict mode
- All functions must have explicit return types
- Prefer `const` over `let`
- No `any` types without justification
Turn a goal into actionable steps:
Ask the agent: "Create a plan for adding user authentication"
The agent creates docs/plans/user-auth.md:
---
plan name: user-auth
plan description: JWT authentication for API
plan status: active
---
## Idea
Add secure JWT authentication to the API with login, logout, and token refresh.
## Implementation
- Design JWT token structure and expiry policy
- Add /auth/login endpoint with password validation
- Add /auth/refresh endpoint for token renewal
- Add /auth/logout endpoint to invalidate tokens
- Write tests for all auth endpoints
## Required Specs
<!-- SPECS_START -->
<!-- SPECS_END -->
Agent automatically:
Attach relevant specs to ensure standards are followed:
Ask the agent: "Link typescript-standards spec to the user-auth plan"
The plan updates:
## Required Specs
<!-- SPECS_START -->
- typescript-standards
<!-- SPECS_END -->
When starting implementation, the agent reads the full context:
Ask the agent: "Read the user-auth plan and start implementing"
The agent receives the full plan with all linked spec content expanded inline.
Ask the agent: "Mark the user-auth plan as done"
Status updates from active → done.
your-project/
├── docs/
│ ├── specs/ # Reusable specifications
│ │ └── *.md # Each spec is a markdown file
│ └── plans/ # Work plans
│ └── *.md # Each plan is a markdown file
Specs naming: {name}.md (e.g., typescript-standards.md)
Plans naming: {name}.md (e.g., user-auth.md)
MIT
FAQs
Comprehensive planning toolkit for OpenCode: manage specifications, track study plans, and automate roadmaps.
The npm package @howaboua/opencode-planning-toolkit receives a total of 56 weekly downloads. As such, @howaboua/opencode-planning-toolkit popularity was classified as not popular.
We found that @howaboua/opencode-planning-toolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.

Research
/Security News
Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting developers.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.