
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
opencode-max
Advanced tools
Memory and task orchestration plugin for OpenCode with project/session isolation
OpenCode Max is the fundamental solution to the "Project Amnesia" problem in AI coding agents. It provides a strictly isolated, local-first memory architecture that guarantees coding efficiency and architectural consistency across long-term projects.
Unlike generic memory plugins that treat context as a flat list, OpenCode Max understands project boundaries and session lifecycles, ensuring your agent never "hallucinates" patterns from other repos or forgets architectural decisions made weeks ago.
Most AI agents suffer from Context Drift: as a project grows, they lose track of established patterns, or worse, bleed context from Project A into Project B. OpenCode Max solves this at the architectural level:
var here? We switched to const last week!" Agents forget past decisions..opencode/vectors/<hash_A>. It is mathematically impossible for the agent to access Project B's context while working on Project A. This is not just a filter; it's a physical firewall for your context.While plugins like opencode-supermemory or opencode-mem offer memory, they often rely on cloud services or loose tagging. OpenCode Max is built for Enterprise-Grade Consistency.
| Feature | OpenCode Max | Cloud Memory Plugins | Generic Local Plugins |
|---|---|---|---|
| Global Memory Problem | SOLVED (Physical Isolation) | Mitigated (Tags/Filters) | Unsolved (Flat File) |
| Agent Consistency | High (Project-Scoped RAG) | Medium (Global Context Noise) | Low (Session Only) |
| Coding Efficiency | High (Precise Retrieval) | Medium (Network Latency) | Low (Limited Context) |
| Data Privacy | 100% Local (LanceDB) | Cloud Dependent | Local |
| Indexing Strategy | Incremental & Background | Full Re-upload | Manual / Sync |
Verdict: If you need an agent that "codes like a senior engineer" who remembers the project history without getting confused by other projects, OpenCode Max is the only architectural solution.
~/.config/opencode/config.json or %USERPROFILE%\\.config\\opencode\\config.json):{
"$schema": "https://opencode.ai/config.json",
"plugin": [
"opencode-max"
]
}
If you want to modify the plugin or use a local version:
git clone https://github.com/drpr/alex.git
cd alex/opencode-max
npm install
plugin.mjs is ready.opencode-max directory:{
"plugin": [
"/Users/yourname/path/to/alex/opencode-max"
]
}
To customize indexing behavior, create a .opencode-max.json file in the root of the project you are working on (not the plugin directory).
{
"vectorDir": ".opencode/vectors",
"include": ["**/*.{js,ts,jsx,tsx,py,java,cs,go,rs,md,c,cpp,h}"],
"exclude": ["**/node_modules/**", "**/dist/**", "**/.git/**", "**/.vscode/**"],
"topK": 8,
"indexingDebounce": 1000
}
| Field | Meaning | Recommendation |
|---|---|---|
| vectorDir | Vector storage directory | Keep default |
| include | File patterns to index | Cover primary languages |
| exclude | File patterns to ignore | Exclude build outputs and dependencies |
| topK | Max candidates per retrieval | 3–8 |
codebase table)codebase table. Wait for the initial indexing to complete.@opencode-ai/plugin@1.1.37. Prefer installing via the npm package name to avoid loading stale local path versions..opencode/vectors/<projectId>, derived from a hash of the project rootOpenCode Max is designed for developers who demand absolute context control.
References:
npm install
npm publish --access public
MIT
FAQs
Memory and task orchestration plugin for OpenCode with project/session isolation
We found that opencode-max demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.