OpenCode v2.0.18 安全加固版发布
TUI、CLI 与 MCP OAuth 现在只允许打开 http/https 链接，并修复了含图片附件的旧压缩检查点无法加载的问题。
𝙊𝙥𝙚𝙣𝘾𝙤𝙙𝙚 v2.0.18 released. TL;DR: A small hardening release: TUI, CLI, and MCP OAuth only open http/https URLs now, and sessions with older compaction checkpoints that contain images or files load again. 𝗧𝗨𝗜 • Changed clickable links, OAuth authorization prompts, and external-link form fields to open only http and https URLs. Other schemes such as file:, javascript:, and ms-msdt:, plus UNC paths, are refused. Where a prompt has an error path, it tells you to copy the URL and continue manually. • Kept "Open in system file manager" for the working directory on a separate path-opening route, so it still works under the new URL rules. 𝗔𝗴𝗲𝗻𝘁 • Fixed loading of compaction checkpoints written before 2.0.15 that contain image or file attachments. Old checkpoints stored media in a different format, which now fails to decode. They are upgraded on read, so older sessions can be restored and continued. 𝗠𝗖𝗣 • Changed MCP OAuth to reject authorization URLs that are not http or https. You get an error naming the server instead of a handoff to an arbitrary system URL handler. 𝗖𝗟𝗜 • Changed browser opening in CLI prompts to use the same http/https-only check as the TUI and core, so all three behave the same way. No noticeable bundle change Compare: https://github.com/anomalyco/opencode/compare/v2.0.17...v2.0.18