
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
oh-my-opencode-lite
Advanced tools
Delegate-first OpenCode plugin with seven agents, thoth-mem persistence, and bundled SDD skills.
Seven specialized agents, one orchestrator — delegate any task to the right specialist and ship faster.
oh-my-opencode-lite · Delegate-first orchestration · Thoth-mem persistence · Bundled SDD pipeline
Delegate-first OpenCode plugin with a seven-agent roster, root-session
thoth_mem persistence, disk-backed delegation records, bundled requirements-interview,
and a full SDD workflow.
oh-my-opencode-lite keeps the orchestrator lean, pushes discovery into
specialists, persists important context, and ships the planning skills needed
to move from ambiguous requests to verified implementation.
bunx oh-my-opencode-lite@latest install
opencode auth login
opencode
Then ask OpenCode to verify the roster:
ping all agents
bunx oh-my-opencode-lite@latest install --no-tui --tmux=no --skills=yes
bunx oh-my-opencode-lite@latest install --reset
When skills are enabled, the installer adds the recommended external skills and copies the bundled requirements-interview, cartography, plan-reviewer, executing-plans, and SDD skills into your OpenCode skills directory.
Use the installer directly:
bunx oh-my-opencode-lite@latest install --no-tui --tmux=no --skills=yes
Or hand another coding agent this README:
Install and configure oh-my-opencode-lite by following:
https://raw.githubusercontent.com/EremesNG/oh-my-opencode-lite/refs/heads/master/README.md
The package ships oh-my-opencode-lite.schema.json for editor autocomplete and
validation:
{
"$schema": "https://unpkg.com/oh-my-opencode-lite@latest/oh-my-opencode-lite.schema.json"
}
See docs/installation.md and docs/provider-configurations.md for the full setup flow.
The delegate-first philosophy is simple: the orchestrator coordinates while
specialists execute. Read-only discovery work goes to async specialists for
context isolation. Advisory and write-capable work stays sync so review, undo
safety, and verification remain straightforward.
For blocking user decisions, the orchestrator uses a question tool —
agents do not ask those questions in plain text. Independent work can be
launched together when parallel dispatch is safe, and failed delegations are
retried once before being reported back to the user.
Orchestrator Root coordinator and sole primary agent. Role: The root coordinator. Handles delegation, sequencing, memory ownership, and SDD progress tracking. Does not read or modify source files directly. Mode: primary, non-mutating Dispatch: sync coordinator Recommended: anthropic/claude-opus-4-6 · openai/gpt-5.4 · kimi-for-coding/k2p5
Personality: Autonomous deep coordinator — multi-agent reasoning, works through delegation |
Explorer Speed runner — fast parallel grep, codebase search. Role: Local codebase discovery and navigation. Fast parallel search, file reading, symbol lookup. Mode: read-only Dispatch: async via background_task
Recommended: Grok Code Fast · openai/gpt-5.4-nano · anthropic/claude-haiku-4-5
|
Librarian All-rounder — large context + decent speed for research. Role: External docs and API research. Fetches documentation, finds public examples, validates version-specific behavior. Mode: read-only Dispatch: async via background_task
Recommended: openai/gpt-5.4 · anthropic/claude-sonnet-4-6 · google/gemini-3.1-pro-preview
|
Oracle Deep reasoner — maximum strategic thinking capability. Role: Strategic advisor for debugging, architecture review, code review, and SDD plan review. Mode: read-only Dispatch: sync via task
Recommended: openai/gpt-5.4 · anthropic/claude-opus-4-6 · opencode-go/glm-5
|
Designer Visual/multimodal — UI/UX reasoning, frontend engineering. Role: UI/UX implementation with visual verification. Owns approach, execution, and browser-based quality checks. Mode: write-capable Dispatch: sync via task
Recommended: google/gemini-3.1-pro-preview · opencode-go/glm-5 · kimi-for-coding/k2p5
|
Quick Speed runner — well-defined tasks, fast turnaround. Role: Fast implementation for well-defined, bounded tasks. Optimized for speed over thoroughness. Mode: write-capable Dispatch: sync via task
Recommended: openai/gpt-5.4-mini · anthropic/claude-haiku-4-5 · google/gemini-3-flash-preview
|
Deep Deep specialist — maximum coding capability for complex tasks. Role: Thorough implementation and verification. Handles correctness-critical, multi-file, edge-case-heavy work. Mode: write-capable Dispatch: sync via task
Recommended: openai/gpt-5.4 · anthropic/claude-opus-4-6 · google/gemini-3.1-pro-preview
|
thoth_mem persistence for root-session memory workflowssdd-propose, sdd-spec, sdd-design, sdd-tasks,
sdd-apply, sdd-verify, sdd-archiveplan-reviewer for oracle review loops on task plansexecuting-plans for task-state ownership and progress trackingcartography for repository mapping and codemap generationDelegation records persist under:
~/.local/share/opencode/delegations/<project-id>/<root-session-id>/<task-id>.md
The bundled SDD workflow follows this path:
propose -> [spec || design] -> tasks -> apply -> verify -> archive
For medium work, the requirements interview can route into an accelerated path that starts at
propose -> tasks. For complex work, the full path is used.
Artifacts can be persisted in four modes:
| Mode | Writes to | Cost | Use when |
|---|---|---|---|
thoth-mem | Memory only | Low | Fast iteration without repo planning files |
openspec | openspec/ files only | Medium | Reviewable planning artifacts in the repo |
hybrid | Both | High | Maximum durability; default |
none | Neither | Lowest | Ephemeral iterations, no persistence |
After sdd-tasks, the orchestrator can run an oracle review loop with
plan-reviewer:
tasks.mdplan-reviewer[REJECT], fix only the blocking issues[OKAY]During execution, executing-plans owns task-state tracking. Progress has two
mandatory layers: todowrite for the visual task list, plus a persistent SDD
artifact via tasks.md checkboxes and/or thoth_mem.
- [ ] pending- [~] in progress- [x] completed- [-] skipped with reasonThe bundled requirements-interview skill is the front door for ambiguous or substantial
work. It is step-0 in the orchestrator prompt and runs before implementation when the
request is open-ended, spans multiple parts of the system, or needs scope calibration.
Its workflow is six phases:
After clarification, the skill routes the work into direct implementation, accelerated SDD, or full SDD based on complexity assessment.
| Skill | Category | Purpose |
|---|---|---|
requirements-interview | Clarification | Clarify intent, assess scope, and choose direct work vs accelerated or full SDD |
cartography | Discovery | Generate and update hierarchical repository codemaps |
plan-reviewer | Review | Validate tasks.md for real execution blockers and return [OKAY] or [REJECT] |
sdd-init | SDD | Bootstrap OpenSpec structure and SDD context for a project |
sdd-propose | SDD | Create or update proposal.md |
sdd-spec | SDD | Write OpenSpec delta specs with RFC 2119 requirements and scenarios |
sdd-design | SDD | Produce design.md with technical decisions and file changes |
sdd-tasks | SDD | Generate phased tasks.md checklists |
sdd-apply | SDD | Execute assigned SDD tasks and report structured results |
executing-plans | Execution | Run task lists with durable progress tracking and verification checkpoints |
sdd-verify | Verification | Create compliance-oriented verification reports |
sdd-archive | Archive | Merge verified deltas into main specs and archive the change |
| Skill | Status | Typical use |
|---|---|---|
simplify | Installed by --skills=yes | Keep solutions lean and reduce unnecessary complexity |
agent-browser | Installed by --skills=yes | Browser automation for designer visual checks |
test-driven-development | Optional companion | Useful before implementing bug fixes or features with deep |
systematic-debugging | Optional companion | Useful for oracle and deep when failures need disciplined diagnosis |
| MCP | Purpose | Auth / runtime |
|---|---|---|
websearch | Exa-backed web search | Optional EXA_API_KEY via env |
context7 | Official library and framework docs | Optional CONTEXT7_API_KEY via env |
grep_app | Public GitHub code search | No auth required |
thoth_mem | Local persistent memory and artifact storage | Local command, default npx -y thoth-mem@latest |
🧠 Thoth-Mem is a persistent memory MCP server purpose-built for cross-session context. The orchestrator uses it to save architectural decisions, bug-fix learnings, SDD artifacts, and session summaries so the next session picks up where the last one left off — even after context-window compaction. It is included by default and runs locally via
npx.
For targeted retrieval, Thoth-Mem uses a 3-layer recall protocol:
mem_search — scan the compact index of IDs and titlesmem_timeline — inspect chronological context around candidatesmem_get_observation — read full content for selected recordsAfter task completion, an automatic save nudge reminds the orchestrator to
persist important observations. Session start also degrades gracefully if
thoth_mem is unavailable, so memory errors do not block the main plugin flow.
Skill and MCP access in this project is prompt-driven. The generated plugin config focuses on model presets and runtime options rather than per-agent permission matrices.
The project targets @opencode-ai/plugin and @opencode-ai/sdk v1.3.3.
| Command | Purpose |
|---|---|
bun run build | Build TypeScript into dist/ |
bun run typecheck | Run TypeScript type checking without emit |
bun test | Run the Bun test suite |
bun run lint | Run Biome linter |
bun run format | Run Biome formatter |
bun run check | Run Biome check with auto-fix |
bun run check:ci | Run Biome check without writes |
bun run dev | Build and launch the plugin in local dev mode |
MIT
FAQs
Delegate-first OpenCode plugin with seven agents, thoth-mem persistence, and bundled SDD skills.
The npm package oh-my-opencode-lite receives a total of 204 weekly downloads. As such, oh-my-opencode-lite popularity was classified as not popular.
We found that oh-my-opencode-lite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.