Plugin install can leave a declared dependency missing, and the load failure is silent

What happens

envsitter-guard@latest sat in the plugin array, opencode listed it as loaded, and it silently did nothing: a declared runtime dependency was never installed and the resulting import failure was not surfaced. The guard is a .env-leak protection plugin whose entire job is a tool.execute.before hook — it failed open with no signal.

Measured

• OpenCode 1.18.30.
• ~/.cache/opencode/packages/envsitter-guard@latest/node_modules/ contained only envsitter-guard, while the package's own package.json declares "envsitter": "^0.0.4".
• Other plugins installed at the same time (opencode-pty, opencode-mem) got full dependency trees, so install completeness is at least inconsistent between plugins.
• The plugin entry (dist/index.js) top-level-imports envsitter; resolving it from the package dir fails: Cannot find package 'envsitter' imported from ….
• Result: the plugin never registers, its hook never fires, and a read of .env succeeded — while opencode debug config still listed the plugin and stderr/logs showed no error.

Fix that worked

cd ~/.cache/opencode/packages/envsitter-guard@latest/node_modules/envsitter-guard && bun add envsitter@0.0.4

After that the plugin registers and .env reads are blocked (Reading .env* is blocked to prevent secret leaks…).

Expected

• After installing a plugin, verify its declared runtime dependencies resolve (the host-provided @opencode-ai/plugin and @opencode-ai/sdk are special and would need exempting), or
• Surface the plugin's import/load error (stderr, a log line, or a visible load-failure status) instead of listing the plugin as loaded.

We only found this because an unrelated smoke test failed; a user-side check that resolves every declared dependency from each plugin dir catches it consistently.