
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ha-opencode
Advanced tools
Unofficial Home Assistant Plugin for OpenCode
Note: This is an unofficial community project and is not affiliated with, endorsed by, or supported by OpenCode or Anomaly. OpenCode branding is used in accordance with their brand guidelines.
OpenCode plugin that enables real-time integration with Home Assistant via native WebSocket connection.
Monitor and control your OpenCode sessions directly from Home Assistant - get notified when tasks complete, approve permissions from your phone, and even send prompts remotely.
Full Documentation | Home Assistant Integration
# From npm (when published)
npm install --prefix ~/.config/opencode ha-opencode
# Or from local path
npm install --prefix ~/.config/opencode /path/to/opencode-homeassistant
Add "ha-opencode" to the plugins array in ~/.config/opencode/opencode.json:
{
"plugins": ["ha-opencode"]
}
The plugin requires the companion Home Assistant integration. See ha-opencode for installation instructions.
ABC12DEF)ha_pair tool with:
http://homeassistant.local:8123)Once paired, the plugin will automatically reconnect on subsequent OpenCode sessions.
The plugin stores connection configuration in ~/.config/opencode/ha-config.json after pairing:
{
"url": "ws://homeassistant.local:8123/api/websocket",
"accessToken": "your-access-token",
"instanceToken": "generated-during-pairing",
"instanceId": "instance_abc123"
}
You can also set the Home Assistant URL and access token via environment variables:
export OPENCODE_HA_URL=http://homeassistant.local:8123
export OPENCODE_HA_ACCESS_TOKEN=your-access-token
┌─────────────────┐ WebSocket ┌──────────────────┐
│ │◄────────────────►│ │
│ OpenCode │ │ Home Assistant │
│ + Plugin │ │ + Integration │
│ │ │ │
└─────────────────┘ └──────────────────┘
│
▼
┌──────────────────┐
│ Lovelace Card │
│ Mobile App │
│ Automations │
└──────────────────┘
The plugin responds to these commands sent via the Home Assistant integration:
| Command | Description |
|---|---|
send_prompt | Send a text prompt to the current session |
respond_permission | Approve (once/always) or reject a permission request |
get_history | Retrieve session conversation history |
get_agents | Get list of available agents |
Each OpenCode session reports the following to Home Assistant:
| Data | Description |
|---|---|
state | Session state: idle, working, waiting_permission, error |
title | Session/conversation title |
model | AI model being used (e.g., anthropic/claude-sonnet-4-20250514) |
current_tool | Currently executing tool |
tokens_input | Total input tokens used |
tokens_output | Total output tokens used |
cost | Total session cost in USD |
last_activity | Timestamp of last activity |
agent | Primary agent selected |
current_agent | Sub-agent currently executing |
hostname | Machine hostname |
permission | Pending permission details (if any) |
# Install dependencies
npm install
# Build TypeScript
npm run build
# Watch mode
npm run dev
# Run tests
npm test
# Run tests with coverage
npm run test:coverage
src/
index.ts Plugin entry point
websocket.ts Home Assistant WebSocket client
state.ts Session state tracking
commands.ts Command handler (prompts, permissions, history)
ha-config.ts Configuration storage
notify.ts Terminal notifications (Kitty OSC 99)
tests/
*.test.ts Unit tests
~/.config/opencode/ha-config.json and pair againThis plugin uses Kitty terminal notifications (OSC 99). Supported terminals:
If your terminal doesn't support OSC 99, notifications will be silent.
Full documentation is available at stephengolub.github.io/opencode-homeassistant
MIT
FAQs
OpenCode plugin for Home Assistant integration via native WebSocket API
The npm package ha-opencode receives a total of 13 weekly downloads. As such, ha-opencode popularity was classified as not popular.
We found that ha-opencode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.