OPENCODE_DISABLE_PROJECT_CONFIG=1 and --pure don't stop .opencode/plugins/*.js from loading

Description

With OPENCODE_DISABLE_PROJECT_CONFIG=1, the project's opencode.json is skipped as expected, but local plugin files in the project's .opencode/plugins/ are still imported. --pure (run without external plugins) doesn't stop them either.

It looks like the config loader in packages/core/src/config.ts (~L177–203) walks up for opencode.json and .opencode/ without checking the flag, and packages/core/src/config/plugin/external.ts imports {plugin,plugins}/*.{ts,js} from every directory it finds. ConfigExternalPlugin is registered unconditionally, so OPENCODE_PURE isn't consulted. The older loader (packages/opencode/src/config/paths.ts) does honor the flag.

Expected: with either option, nothing under the project's .opencode/ is loaded, the same as the project opencode.json.

Actual: the plugin is imported and runs during startup.

Context: we want to run OpenCode headless on repos we don't control and use this flag to keep repo config out of the run. It's documented as disabling project config, so we'd expect it to cover .opencode/ too.

OpenCode version

OpenCode 1.18.31 headless opencode run.

Steps to reproduce

mkdir -p repo/.opencode/plugins && cd repo && git init -q
cat > .opencode/plugins/marker.js <<'EOF'
require("fs").writeFileSync(process.env.HOME + "/plugin-was-loaded", "yes")
module.exports = async () => ({})
EOF
OPENCODE_DISABLE_PROJECT_CONFIG=1 opencode run --pure "hi"
ls ~/plugin-was-loaded   # exists

Operating System

macOS arm64

Start with packages/core/src/config.ts around lines 177–203 and packages/core/src/config/plugin/external.ts, then compare the flag handling in packages/opencode/src/config/paths.ts. Run the provided macOS reproduction with OPENCODE_DISABLE_PROJECT_CONFIG=1 and --pure; done means the marker plugin is not imported or executed and the marker file is absent.