OpenCode 1.19.0: updates on demand, OpenCode 2 behind a gate

The default posture of terminal agents has been inertia: the tool updates in the background, work keeps running, nobody gets asked. Version 1.19.0 of OpenCode, released October 11, 2026, ends that posture. One line in the release notes carries the change: updates are no longer installed automatically, the terminal UI waits for the /update command instead. And the jump to OpenCode 2 sits even deeper behind a deliberate call, opencode upgrade --major. In this post I read the release page line by line, place the version inside the release wave of recent weeks, pi v1.1.0 on October 7, Hermes Agent v0.21.6 on October 8, the Codex Rust tag 0.162.1 on October 9, and I ask what a tool says about its risk model when it puts its own major migration behind a gate command. The yardstick is my own operation: a second-hand 45-euro Android phone running as the HUNTER cyberdeck, cron windows instead of endless sessions, model access billed by request, not by month. Two limits first: I have installed neither the 1.x line nor OpenCode 2, so this is a reading of release pages, not a software test, and the stars I cite carry their verification date from a third-party ranking.

Numbers and dates first. The releases page lists v1.19.0, published at 1:39 UTC on October 11, 2026 by the bot account opencode-agent and marked immutable; afterwards only title and notes can change, and the commit carries the short reference 733b2c6. Between version 1.18.29, which shipped September 4, and the new tag, the list shows six patch versions, 1.18.30 through 1.18.35. Read the other way, the headline line documents something silent: until this version the tool wrote updates to disk unasked, otherwise the sentence updates are no longer installed automatically would have nothing to revoke. The tag is structured in three sections. In Core: the way to OpenCode 2 runs through opencode upgrade --major; the OpenAI ultrafast service tier is allowed; and a security fix validates PTY origin and tickets before checking whether a PTY exists. In the TUI: /update installs updates or the ascent to OpenCode 2. One community contribution closes the tag on the Zen docs: Exo Free added, Fledge Alpha Free removed, plus a stats fix attributing unmapped Exo usage to an unknown provider.

OpenCode moved last, and its neighbours' dates can be measured because each project timestamps its releases. pi shipped v1.1.0 on October 7, verified in my own release check of October 11 via radar_1110_fetch.py against the GitHub releases API. Hermes Agent followed on October 8 with v0.21.6, first cut of a new stable pipeline coupling a tag to a tested Docker image and a receipt tag; the window since v0.21.5 is counted at 2,103 merged pull requests, 3,027 closed issues, 8,867 non-merge commits across 8,342 changed files. Codex answered on October 9 with the Rust tag 0.162.1, a tag line beyond the CLI anchor 0.160.1. OpenCode published on October 11. Four houses, nine days, the last two two days apart. What differs is the posture: Hermes frames its window as a measured batch cut with auditable numbers, OpenCode frames its window as a contract change, because what the tool does unasked has been rewritten. The postures fit together: one makes releases provable, the other makes the transition deliberate.

What do you actually know about OpenCode 2 after this reading? Three sentences are documented: the line exists, it is not pushed automatically, and entry runs through opencode upgrade --major or /update. Nothing more. What OpenCode 2 changes, which configurations it migrates, whether provider settings survive, and whether the license moves, I could not learn here; the notes for v1.19.0 are silent and I have read no 2.x notes. I flag that as not available rather than guessing. Documented instead: the 1.x line's properties. Per the morphllm ranking OpenCode is MIT licensed, model-agnostic, accepts any provider, the ranking's default open-source pick with 199,640 stars, its most starred MIT entry. Whoever types --major has made a decision; whoever does not stays productive on 1.x, including every patch update that now arrives only after an explicit /update. For a tool of this size, that is an honest separation between the comfort track and the risk track, however unfamiliar that feels at first.

The reason this line resonates on my deck is live operations. I run the HUNTER cyberdeck on a second-hand Google Pixel 6a, agents run in cron windows, and my Ollama model access is metered by request in a five-hour window with a weekly cap. An automatic update landing mid-run costs more than nothing in such an operation: it writes files, disturbs sessions, and in the worst case burns a window whose budget I had allocated to real work. The workshop's 88-hour record run, August 28, 19:40, to September 1, 12:18, without a single OOM kill since the hardening, was not achieved despite those constraints but because of them: everything that could disturb the run is scheduled, reviewed, and executed on demand. The OOM storm of August 28 with five gateway deaths taught the same lesson both ways: Android wins under memory pressure, the operation must survive kills, and nothing careless should decide mid-run when it writes. OpenCode's release policy encodes exactly this idea: the moment of change becomes a deliberate act by the operator, not a background event.

Honesty against my own position: update on demand has a price, and the release notes accept it in silence. Operators who never type /update keep running old versions with known bugs; security fixes such as the PTY validation in v1.19.0 only help those who install them. My practice for the deck: maintenance belongs inside the cron window, updates run as a scheduled step with the release notes read, never in the background. OpenCode encodes the posture as policy, only stricter: the TUI drops auto-install entirely, the major boundary gets its own command, and the release ships immutable from the bot account. This blog knows the pattern from the coding-agents analysis: core becomes provable, shell replaceable, change management explicit. Hermes pulls the same lever on the vendor side, coupling a tag to a tested Docker image and a receipt tag. What is missing is the counterweight on the user side: a discipline nobody has is not a discipline. Scheduled update windows are the price, and operators who skip it pay later in missed security fixes.

This post remains a reading, and it names its gaps. I have installed no OpenCode, neither 1.x nor 2.x; the major migration might transform configurations or relocate projects, both unproven. The sensible next test: install OpenCode 1.x in a throwaway environment, run /update manually, measure the minutes it takes, then try the major command against a copy of the configuration. Only when such a test produces a log will this blog state an upgrade recommendation. Until then the posture holds: v1.19.0 is well read, OpenCode 2 is visible behind its gate, and neither installs itself now. Operators mirroring this need three things on paper: a fixed maintenance date, a rule for which release-note lines change their risk, and a way back if the jump breaks something.

External sources, retrieved October 12, 2026:
- GitHub, OpenCode releases with v1.19.0 of October 11, 2026, 1:39 UTC (Core: opencode upgrade --major, ultrafast tier, PTY validation; TUI: /update, no auto-install; Zen docs changes, commit 733b2c6): https://github.com/anomalyco/opencode/releases
- GitHub, Hermes Agent v0.21.6 of October 8, 2026 (stable pipeline, 8,867 non-merge commits, 8,342 changed files, 2,103 merged PRs in the window, 3,027 closed issues): https://github.com/NousResearch/hermes-agent/releases/tag/v0.21.6
- morphllm, ranking of AI coding agents with Terminal Bench 4.0 data (Claude Code plus Opus 5.5 at 64.8 percent, Codex plus GPT-6.1 Sol at 58.2 percent at 1.92 dollars per task, 330 trials; OpenCode at 199,640 stars, API verify August 21, 2026): https://www.morphllm.com/ai-coding-agent
Own measurements through GitHub releases and the release list (scripts radar_1110_fetch.py of October 11, 2026, and release reading of October 12, 2026): release dates of pi v1.1.0 on 10-07, Hermes Agent v0.21.6 on 10-08, Codex Rust tag 0.162.1 on 10-09, OpenCode v1.19.0 on 10-11, 2026; six patch versions between v1.18.29 and v1.19.0.
Own measurement series from the vault: 88-hour run from 2026-08-28 to 2026-09-01, five gateway deaths on 2026-08-28, 36 of 36 tests passed across the verified projects, five-hour request window with a weekly cap on the Ollama access.

About the author: I am Marcel, a graphic designer running the HUNTER cyberdeck on a second-hand Google Pixel 6a. For this post I read the release pages of OpenCode, Hermes Agent, pi and Codex on October 12, 2026, and cross-checked the release dates against my own release check of October 11, 2026; the raw notes live in the deck's topic radar. I did not install OpenCode, so every statement about the software comes from release notes and rankings and carries its retrieval date there. Operating experience with update behavior in agent operations comes from my own setup. Last subject-matter review on October 12, 2026.