v0.16.5

Changed

• OpenCode 2 stable: follow the released OpenCode 2 latest channel everywhere. The installer now provisions npm:@opencode/cli through mise with the up-front tool options its install needs (allow_builds for the binary-selecting postinstall, allow_low_downloads for the newly published package name), installs node@latest for that postinstall, migrates npm:@opencode-ai/cli beta entries to the stable package, and no longer prints a manual allow_builds snippet. Host compatibility accepts tagged 2.x.y builds only: beta/next channel handling is removed, and unsupported hosts just skip the optional post-setup location refresh.

v0.16.4

Changed

• Adversarial-review skill: replace external headless CLI/model selection, saved preferences, and fallback routing with one foreground adversarial-review subagent invocation. The subagent inspects the repository read-only; the host passes only repository path and session context. Simplify the standalone guide around this contract.

v0.16.3

Added

• Adversarial-review guide: standalone page with quick-start prompts, oy and single-file installation, an evidence-packet template, reviewer preferences, and reusable contributing instructions. The page embeds the canonical skill and rebuilds when it changes.

Fixed

• Adversarial-review skill: resolve explicit choices before compatible saved preferences and ask only for missing choices; make review scope, source evidence, constraints, and proposed work explicit; validate findings and adjust verdicts when supporting claims fail.
• Skill discovery docs: include adversarial review in setup guidance and the five-skill inventory.

v0.16.2

Fixed

• Adversarial review: fold reasoning effort into the model offers instead of asking twice; record cross-CLI fallbacks with fallback_cli; open evidence with a fixed CLI/model/effort/checks/omissions header. oy doctor --check now flags stale oy-owned copies in host skill directories (Cursor, OpenCode, Claude) that shadow the canonical skills.

v0.16.1

Fixed

• Adversarial review: ask once for supported reasoning effort (including existing preferences without it), recommend high/xhigh rather than unconditional max, and support plain-language per-run overrides. Honor explicitly authorized conditional fallbacks, verify analysis-only invocation and actual output, and report the provider/model/effort actually used.
• Skill setup: check for stale binaries and host-specific skill copies shadowing the upgraded installation.

v0.16.0

Added

• Adversarial-review skill: new adversarial-review skill gets an independent critique of recent work and session direction from a headless agent CLI. The host agent asks which CLI to use on first run, offers strong model/reasoning options from its live catalog, and remembers the choice in ${XDG_STATE_HOME:-~/.local/state}/oy/adversarial-review.json. Plain-language overrides (use Codex this time, switch reviewer) included; oy setup installs it by default.

v0.15.5

Changed

• Toolchain: bumped MSRV to Rust 1.98 and refreshed Cargo.lock (31 crate updates including clap 4.6.6, regex 1.13.1, ignore 0.4.33, serde 1.0.229).

v0.15.4

Changed

• Docs: reframed around what oy contributes (frozen evidence, full-coverage reading, verified reports) rather than what it avoids; docs/project.md non-goals became a short Boundaries section.

Removed

• Standalone oy agent: dropped the oy persona (oy-setup/oy-persona.md) and the default-agent upgrade flow. The oy-setup skill now only installs and verifies the four skills; remediation discipline (inspect first, smallest change, verify, report concisely) lives in the oy-enhance skill and runs under the user's own agent. Setup backs up and removes oy-owned persona copies; agents/oy.md from older releases is treated as legacy state and migrated to backup. If you set default_agent: "oy", remove the override and keep your host default.

v0.15.3

Changed

• Evidence: whole-file chunk headers now carry true source line ranges (## path (lines 1-N)) so findings can cite original file lines without inferring offsets; sliced files already labeled their ranges. Diff-hunk chunks are unchanged.
• Collection: security-prioritized ordering now matches keywords as identifier words in path components (auth, sessions, handle_upload, AuthHandler) instead of raw substrings; removed the noisy file/path needles so ordinary repositories no longer fall entirely into the security bucket.
• Index: prepared run indexes report per-chunk tokens alongside bytes/lines/sha256 for model context budgeting.
• Skills: the audit and review skills read the run manifest (scope, languages, largest files) before reading chunks.
• Platform support: dropped macOS support. Release archives ship for Linux x86_64 and aarch64 only; the installer exits with a clear message on non-Linux systems; docs describe Linux-only operation with WSL2 elsewhere. Source builds on other Unix targets remain possible but unsupported.

Added

• Supply chain: CI and just check now gate on cargo-deny (RustSec advisories, yanked crates, license allowlist); lockfile refreshed to pick up published advisories (anyhow 1.0.104, crossbeam-epoch 0.9.20).

Fixed

• Setup removal no longer panics when a bundled skill path has no parent directory.

v0.15.2

Changed

• Installer: docs/install.sh now installs opencode2 (npm:@opencode-ai/cli@beta) when it is missing from PATH and prints the allow_builds TOML snippet to add for non-interactive npm installs; skips silently when opencode2 is already installed.