
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
opencode-autopilot
Advanced tools
Autonomous task orchestration for OpenCode — centralized backlog, auto-dispatch, session lifecycle, telemetry
Autonomous task orchestration for OpenCode — centralized backlog, auto-dispatch, session lifecycle, telemetry.
Stop being the scheduler. Define the work, let the machine manage the queue.
// ~/.config/opencode/opencode.jsonc
{
"plugin": ["opencode-autopilot"]
}
Type /plan in any session — the agent analyzes your project and creates a prioritized backlog.
/backlog — See task statuses/stats — Telemetry (dispatched, completed, rate, duration)/next — Force-dispatch next task/plan → backlog.json
↓
autopilot (every 60s) → picks "ready" task
↓
creates session → sends prompt with constraints
↓
agent works → goes idle → autopilot marks "done"
↓
next task auto-dispatched
Create ~/.local/share/opencode/orchestrator/config.json:
{
"maxConcurrent": 2,
"dailyTaskLimit": 10,
"maxTasksPerPlan": 15,
"autoDispatch": true,
"maxSessionsPerProject": 3,
"compactAfterMessages": 20,
"notifications": {
"onComplete": true,
"onBlocked": true,
"sound": false
}
}
| Option | Default | Description |
|---|---|---|
maxConcurrent | 2 | Max sessions working at once |
dailyTaskLimit | 10 | Max tasks dispatched per day (resets at midnight) |
maxTasksPerPlan | 15 | Max tasks a /plan can create |
autoDispatch | true | Set false to only dispatch via /next |
maxSessionsPerProject | 3 | Auto-prune excess sessions |
compactAfterMessages | 20 | Auto-compact sessions above this |
Every dispatched task includes these guardrails in the prompt:
Metrics are stored at ~/.local/share/opencode/orchestrator/metrics.json and track:
Run /stats to see the report.
This plugin implements the Task Orchestration pattern from the AI Dev Toolkit.
The key insight: you should define the work and its boundaries, not manage the queue. The orchestrator handles dispatch, monitoring, and chaining. You handle planning and review.
MIT
FAQs
Autonomous task orchestration for OpenCode — centralized backlog, auto-dispatch, session lifecycle, telemetry
We found that opencode-autopilot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.