OpenCode 1.4.0 rewrites `package-lock.json` for local plugin dependencies (despite `bun.lock`)

[dkarter]

Description

Hi! I ran into something a little confusing with local plugin dependency installs and wanted to check if this is intentional:

The plugin docs still say local plugin dependencies use bun install at startup, but on OpenCode 1.4.0 I can reproduce behavior that looks npm-based instead.

What I expected

I expected one of these:

• local plugin dependencies still use Bun, matching the docs
• ideally respect the existing bun.lock file
• (or) the docs reflect the current npm-based behavior

Note

Personally, I would also love for this to be configurable if possible. I still prefer using Bun, and right now the generated package-lock.json is conflicting with my bun.lock which feels weird.

Docs reference

The current plugins docs still say:

OpenCode runs bun install at startup to install these.

https://opencode.ai/docs/plugins/#how-plugins-are-installed

---

If this change was intentional, would you be open to either documenting it more clearly or better yet, making the package manager configurable for local plugin dependencies?

I'm happy to open a PR for either if you're interested

Plugins

Workmux/self written plugins

OpenCode version

1.4.0

Steps to reproduce

Repro

1. Put a local plugin config under ~/.config/opencode (I use bun so on install it creates bun.lock)
2. Add a package.json there for local plugin dependencies.
3. Remove node_modules from that directory.
4. Run opencode run "test" --print-logs --log-level INFO.

The startup logs show:

service=npm dir=/Users/dorian/.config/opencode checking dependencies
service=npm node_modules missing, reifying

After that run, OpenCode recreates:

• package-lock.json
• node_modules/.package-lock.json
• node_modules/

So if I delete package-lock.json, it comes back on the next dependency bootstrap.

Screenshot and/or share link

No response

Operating System

macOS Tahoe

Terminal

Ghostty

[github-actions]

This issue might be a duplicate of or related to existing issues. Please check:

• [Bug] .opencode/package-lock.json generated without respecting ~/.npmrc registry configuration #21079: Also about .opencode/package-lock.json being generated unexpectedly — that issue focuses on npm ignoring ~/.npmrc registry config, but both stem from the same npm-based install behavior introduced when the project switched from Bun to npm for plugin dependency management.

[rekram1-node]

oh yeah we use arborist instead of bun now

[dkarter]

would it be possible to respect this standard in package.json? (mentioned here)

  "devEngines": {
    "packageManager": {
      "name": "bun",
      "version": ">=1.13.0",
      "onFail": "error"
    }
  }

I tried that but OpenCode/arborist just ignored it.

It's really weird because when I develop plugins/hooks I use bun - which I much prefer to npm/node, but then opencode would still force npm on me which creates a conflict