What Happened

v3.4.1 was published to npm on 2026-02-10T13:04:04.741Z and subsequently unpublished. Users who installed during the window got a broken version cached locally.

Symptom

All external MCP tools fail with:

TypeError: undefined is not an object (evaluating 'output.output.toLowerCase')

Affected: any MCP whose response shape has output.output as undefined — both user-configured MCPs (e.g. in .mcp.json) and OMO-bundled MCPs. Local/simple tools (bash, read, grep, write) were unaffected.

Root Cause

The plugin's MCP response post-processing calls .toLowerCase() on output.output, which is undefined for certain MCP response shapes.

Why Users Still Got 3.4.1 After It Was Yanked

Even after npm unpublish, npm/bun CDN caches can still serve the tarball for a short window. The latest dist-tag was reverted to 3.4.0 and npm view versions no longer lists 3.4.1, but npm view oh-my-opencode time still shows the publish timestamp:

"3.4.1": "2026-02-10T13:04:04.741Z"

Users whose lockfiles or package managers resolved during the cache window ended up with the ghost version.

How to Fix (if you're affected)

Nuke and reinstall:

cd ~/.config/opencode
rm -rf node_modules bun.lock package-lock.json package.json
# Restart opencode — re-resolves to 3.4.0

Or pin explicitly in opencode.json:

"plugin": ["[email protected]"]

Diagnosis

npm view oh-my-opencode dist-tags --json   # latest → 3.4.0 (correct)
npm view oh-my-opencode time --json        # 3.4.1 timestamp still visible
npm view oh-my-opencode versions --json    # 3.4.1 NOT listed (yanked)

If opencode shows a version that doesn't exist on npm view versions, you hit the CDN cache race.

Suggestion

Consider adding a stable dist-tag that only gets updated after smoke-testing, so @stable users don't hit publish-then-yank scenarios.