
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
opencode-local
Advanced tools
Read local Opencode project data directly from Node.js without shelling out to opencode db for every query.
It can also read project.list() directly from a running Opencode server.
>=22.5.0npm install opencode-local
import { createLocal } from "opencode-local"
const client = createLocal()
const projects = await client.listProjects()
const sessions = await client.listSessions(projects.slice(0, 5).map((project) => project.id))
console.log(projects[0])
console.log(sessions[0])
client.close()
Use a custom database path or CLI binary when needed:
import { createLocal } from "opencode-local"
const client = createLocal({
dbPath: "/absolute/path/to/opencode.db",
bin: "/absolute/path/to/opencode",
})
Read projects from the running server instead of the SQLite database when needed:
import { createLocal } from "opencode-local"
const client = createLocal()
const projects = await client.search({
baseUrl: "http://localhost:4096",
directory: "/absolute/path/to/project",
})
Export the merged project list to JSON when needed:
import { exportProjects } from "opencode-local/export"
const file = await exportProjects({
outputPath: "/absolute/path/to/projects.json",
})
console.log(file)
When a project worktree is a git repository with a GitHub remote, the exported row also includes a url field for that repository.
createLocal(options?)
type CreateLocalOptions = {
dbPath?: string
bin?: string
}
Returns a client with these methods:
path()close()search(options?)listProjectsFromServer(options?)listProjects()listVisibleProjects()listSessionOnlyProjects()listProjectSessions(projectIds)listSessions(projectIds)fetchProjectIcons(projectIds)saveProjectIcon(worktree, icon)Additional export helper:
exportProjects(options?)type SearchOptions = {
baseUrl?: string
directory?: string
workspace?: string
headers?: Record<string, string>
type?: "projects"
}
type ProjectRow = {
id: string
worktree: string
name?: string | null
worktree_name?: string | null
latest_session_title?: string | null
icon_color?: string | null
startup_command?: string | null
time_updated?: number | null
sandbox_count?: number | null
has_icon?: number | null
}
type VisibleProjectRow = ProjectRow & {
kind: "project" | "session_only"
}
type ServerProject = {
id: string
worktree: string
vcs?: "git"
name?: string
icon?: {
url?: string
override?: string
color?: string
}
commands?: {
start?: string
}
time: {
created: number
updated: number
initialized?: number
}
sandboxes: string[]
}
type SessionDirectoryRow = {
id: string
directory: string
latest_session_title?: string | null
time_updated?: number | null
}
type ProjectSessionRow = {
id: string
project_id: string
title?: string | null
updated_at?: number | null
waiting?: number | null
}
type SessionRow = {
id: string
directory: string
title?: string | null
updated_at?: number | null
waiting?: number | null
}
type ExportProjectsOptions = {
dbPath?: string
bin?: string
outputPath?: string
}
type ExportProjectRow = ProjectRow & {
url?: string
}
Method return values:
path(): Promise<string>close(): voidsearch(options?): Promise<ServerProject[]>listProjectsFromServer(options?): Promise<ServerProject[]>listProjects(): Promise<ProjectRow[]>listVisibleProjects(): Promise<VisibleProjectRow[]>listSessionOnlyProjects(): Promise<SessionDirectoryRow[]>listProjectSessions(projectIds): Promise<ProjectSessionRow[]>listSessions(projectIds): Promise<SessionRow[]>fetchProjectIcons(projectIds): Promise<Map<string, string>>saveProjectIcon(worktree, icon): Promise<void>exportProjects(options?): Promise<string>listProjects() returns one merged list:
opencode.dbproject row yetMerged visible rows now also:
House Apartment KassandrasUse listVisibleProjects() when you also want the per-row kind (project or session_only).
Search helpers are also exported for downstream palettes and filters:
getProjectDisplayName(project)getProjectSearchAliases(project)getProjectSearchText(project)matchesProjectQuery(project, query)These helpers search across project name, workspace/display name, worktree path, latest session title, and path-derived aliases while normalizing spaces, hyphens, and underscores.
The search helpers live with the search API exports so matching code stays separate from project-loading code.
By default the client resolves the database path like this:
options.dbPath, when providedopencode db path, when options.bin is providedOPENCODE_DB, when setRelevant environment variables:
OPENCODE_DBOPENCODE_CHANNELOPENCODE_DISABLE_CHANNEL_DBXDG_DATA_HOMEThe fallback path logic currently targets those platforms. Windows is not implemented in the path helper.
bun install
bun run typecheck
bun run build
bun run test
Git hooks are installed automatically via Husky on bun install.
pre-commit runs typecheck, test, and requires a staged CHANGELOG.md update or .changeset/*.md entry when staged changes touch src/, package.json, or tsconfig.json.pre-push runs the same publish-readiness checks used by prepublishOnly.bun run changeset
bun run version-packages
bun run release
version-packages applies pending changesets, updates package.json, and regenerates CHANGELOG.md.
release runs the full publish verification and then publishes through Changesets. If npm two-factor auth is enabled, npm will still prompt for the OTP during publish.
GitHub Actions can also publish directly to npm when you push a v* tag that matches package.json.
The workflow in .github/workflows/publish.yml:
check:publish verification as local releasenpm publish --provenance --access publicThe separate workflow in .github/workflows/release.yml creates the GitHub release for the same tag.
For the GitHub workflow to publish to npm, configure npm Trusted Publishing for this repository so GitHub Actions can mint the npm publish token via OIDC.
Release notes live in CHANGELOG.md.
FAQs
Read local opencode SQLite database without shell calls
The npm package opencode-local receives a total of 11 weekly downloads. As such, opencode-local popularity was classified as not popular.
We found that opencode-local demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.