[FEATURE]: Plugin install - add to trusted dependencies #8208

Activity

1. backnotprop

   added

   discussionUsed for feature requests, proposals, ideas, etc. Open discussionUsed for feature requests, proposals, ideas, etc. Open discussion

   on Jan 13, 2026
2. github-actions

   assigned

   thdxr

   on Jan 13, 2026
3. github-actions commented on Jan 13, 2026

   

   github-actionsBot

   on Jan 13, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • Security Issue - Lifecycle Script Execution via .opencode/package.json #7173: Security Issue - Lifecycle Script Execution via .opencode/package.json (addresses postinstall scripts execution)
   • Security Issue - Autoloading Repository Plugins #7163: Security Issue - Autoloading Repository Plugins (addresses untrusted plugin loading)
   • No trusted workspace functionality leads to arbitrary commands execution on startup #6361: No trusted workspace functionality leads to arbitrary commands execution on startup (addresses need for trusted workspace feature)

   Your feature request to add plugins to trusted dependencies aligns with the broader security concern raised in these issues about requiring user confirmation before executing plugin lifecycle scripts. Feel free to ignore if you're specifically focusing on a different aspect of plugin installation.

   👎React with 👎1Reacted by Michael Ramos
4. thdxr commented on Mar 25, 2026

   

   thdxr

   on Mar 25, 2026

   Member

   More actions

   To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.
5. thdxr

   closed this as completedon Mar 25, 2026