Kaspersky Antivirus deletes OpenCode during in-app update (suspected false positive) #10174

Description

While performing an in-app update using the OpenCode update notification,
Kaspersky Antivirus detects the update installation as malware once the update
is applied in place.

Kaspersky then deletes:

• the update files
• the existing installed OpenCode application

As a result, the application is completely removed from the system.

This appears to be a false positive triggered specifically during the update process.

Environment

• OS: Windows (windows 11 pro 25 H2/ 26200.7623)
• OpenCode version: Installed version 1.1.32 → Updated version 1.1.33 (via in-app update)
• Update method: In-app update notification
• Antivirus: Kaspersky Antivirus

Antivirus Detection

• Antivirus: Kaspersky
• Detection type: Malware / Heuristic (exact name available in AV report)
• Action taken: Automatic deletion of update and existing installation

Evidence

• Kaspersky event log (CSV available)
• Issue reproducible only during in-place update
• Normal execution without update does not trigger detection

Expected Behavior

In-app update should complete without triggering antivirus deletion
and without removing the existing installation.

Plugins

No response

OpenCode version

1.1.32

Steps to reproduce

No response

Screenshot and/or share link

av_report.csv

Operating System

windows 11 pro 25H2

Terminal

No response