1.18.21: plugin installer times out fetching public deps from registry.npmjs.org (NpmInstallFailedError: FetchError) — silent dead plugin / boot hang; headless run/serve hangs with any plugin

Environment

• OpenCode 1.18.21 (auto-updated from 1.18.20; 1.18.20 did not have these problems)
• macOS 26.6.2 (Intel), bun binary
• Two plugins configured: one from a private Verdaccio registry (scope-mapped in ~/.npmrc, reached via SSH tunnel — @scope:registry=http://localhost:4873), plus oh-my-openagent@latest
• Host network is healthy: curl https://registry.npmjs.org/ → 200 in 0.3s; the npm CLI installs the exact same dependency trees normally

Bug 1: background plugin install times out fetching public deps from registry.npmjs.org

On boot, the background dependency installer fails with:

level=WARN message="background dependency install failed" dir=~/.config/opencode
error="Cause([Fail(NpmInstallFailedError (cause: FetchError: network timeout at: https://registry.npmjs.org/@opencode-ai%2fplugin))])"

Notes:

• The private-registry package itself resolves fine — the timeout is on fetching the public dependency (@opencode-ai/plugin) from registry.npmjs.org, while plain curl/npm to the same URL work instantly. Looks like the internal fetcher (proxy/IPv6/timeout config?) differs from prior versions.
• In TUI mode the failure is silent: the UI renders, but the plugin is dead — no tools registered — and a half-created empty ~/.cache/opencode/packages/<plugin>@<version>/ directory is left behind. Every subsequent boot retries and fails the same way.
• In headless mode (opencode run, opencode serve) the same install path hangs the boot (see Bug 2).

Workaround we use: pre-seed the cache entry so the installer is bypassed entirely (complete entries are honored):

ENTRY=~/.cache/opencode/packages/<scope>/<plugin>@<version>
rm -rf "$ENTRY" && mkdir -p "$ENTRY"
printf '{\n  "dependencies": { "<scope>/<plugin>": "<version>" }\n}\n' > "$ENTRY/package.json"
cd "$ENTRY" && npm install --no-audit --no-fund

With a complete entry (package.json + package-lock.json + node_modules/), boot is clean, no installer run, plugin loads.

Bug 2 (same version): headless run/serve hangs at instance bootstrap with ANY plugin configured

Reproduced with:

1. a minimal hello-world plugin (config hook only),
2. oh-my-openagent@latest (fully cached, no install needed),
3. our private plugin (fully cached).

Control: same scratch HOME with plugin: [] → opencode run "say hi" completes in ~0.5s.

With any plugin configured:

• opencode run never returns (killed after 5+ min),
• opencode serve starts but POST /session never completes.

Stack sample of the hung process: main JS thread parked; one "Bun Pool 3" worker spinning in ~2205/2206 samples.

TUI mode with the same configs works (that's how we verified the plugins themselves are fine).

Minor observation

Settled idle CPU of a TUI instance on 1.18.21 sits at ~150–290% (measured via cumulative CPU-time deltas over 30s idle windows; all MCP child processes at 0.0% — burn is inside the main process). A scratch instance with a minimal config idles at ~9.5%, so it scales with configured MCP/LSP fleet + session state. Not measured on 1.18.20 for comparison, so reporting only as an observation.

Happy to provide the hello-world plugin source and full stack samples if useful.