From d67e877e28071b6def350ee65c6dd39d22b5225f Mon Sep 17 00:00:00 2001
From: Dax Raad <d@ironbay.co>
Date: Tue, 10 Mar 2026 12:29:21 -0400
Subject: [PATCH] core: remove shell execution and server URL from plugin API

Plugins no longer receive shell access or server URL to prevent unauthorized
execution and limit plugin sandbox surface area.
---
 packages/plugin/src/index.ts | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/packages/plugin/src/index.ts b/packages/plugin/src/index.ts
index b78bcae177..9bc74e58a8 100644
--- a/packages/plugin/src/index.ts
+++ b/packages/plugin/src/index.ts
@@ -12,7 +12,6 @@ import type {
   Config,
 } from "@opencode-ai/sdk"
 
-import type { BunShell } from "./shell.js"
 import { type ToolDefinition } from "./tool.js"
 
 export * from "./tool.js"
@@ -28,8 +27,6 @@ export type PluginInput = {
   project: Project
   directory: string
   worktree: string
-  serverUrl: URL
-  $: BunShell
 }
 
 export type Plugin = (input: PluginInput) => Promise<Hooks>