open-codeasier v0.3.4

[0.3.4] - 2026-09-12

Fixed

• Gate asynchronous and legacy cross-review starts on OpenCode permissions before creating snapshots, persisting runs, or starting child sessions. Supply ask defaults and execute the host's permission Effect with its captured context; requests identify the target, reviewer models/count, judge, and additional token cost. Explicit user permission overrides apply. Local target classification and shared-evidence checks run before the prompt. Legacy starts publish "preparing" metadata only after approval. A fiber-less host ask fails closed with an explicit runtime error.
• Restrict the cross-review workflow to explicit cross-review or independent multi-model review requests. Accidental skill loading in ordinary reviews and child sessions now exits the workflow without blocking the original task or incorrectly recommending plugin reinstallation.

Full Changelog: v0.3.3...v0.3.4

open-codeasier v0.3.3

[0.3.3] - 2026-09-09

Changed

• Store cross-review run manifests at ~/.open-codeasier/cross-review and snapshot worktrees at ~/.open-codeasier/cross-review/.worktrees/<runID>/worktree. Override the parent directory with OPEN_CODEASIER_STATE_HOME. The previous XDG_STATE_HOME / macOS Application Support / %LOCALAPPDATA% / ~/.local/state write locations are no longer used; those roots are still scanned so existing runs are not orphaned, and released manifests (no live snapshot worktree) are moved to the new root. Parent-session judging needs a one-time external_directory allow rule for ~/.open-codeasier/cross-review/**.

Fixed

• Catch /cross-review-audit up with the current cross-review protocol. The payload now carries cross_review_config previews, start arguments (target, hasEvidenceDir, reviewModelCount, judgeModel), status results (readyToFinalize, actionRequired roles, stray-timeoutAction warning), rejected-call errors, adapterGatherer, snapshot, finalStatus, and per-role timing, timeout, retry, and bounded error fields, so timeout decisions, adapter failures, and evidence provenance can be graded instead of inferred.
• Stop grading a failed PR adapter as a broken evidence contract: a new adapter.gather check reports the adapter error and run.evidence_contract is insufficient-evidence when no reviewer was dispatched, including a legacy blocking persist that omitted adapterGatherer.
• Stop failing role.prompt.tools_deny for prompts dispatched before cross_review_config or cross_review_audit joined READ_ONLY_TOOLS. The check fails only when a write tool is absent or any deny key is enabled, and names absent primary-session-gated keys in its detail.
• Add role.session.directory, which verifies that snapshot-run role sessions are bound to the snapshot worktree, and read role sessions through the run and caller directories when the worktree no longer answers.

Full Changelog: v0.3.2...v0.3.3

open-codeasier v0.3.1

[0.3.1] - 2026-09-07

Fixed

• Refuse install and init when ~/.agents/skills/cross-review exists and
  differs from the packaged skill, document that install does not update
  ~/.agents, and print an init next-step to fill only one of reviewers
  or reviewModels and then run npx open-codeasier validate <path>.
• Launch GitHub and GitCode PR snapshot adapters with a Node.js executable
  instead of reusing process.execPath, so a standalone OpenCode binary no
  longer fails snapshot gathering with its own CLI help. Override the runtime
  with OPEN_CODEASIER_NODE. PATH discovery skips Windows .cmd shims and
  non-executable files.

open-codeasier v0.3.0

[0.3.0] - 2026-09-06

Added

• Add /cross-review-audit and the cross_review_audit tool to inspect a
  parent session's owned runs through the local run-store and SDK sessions,
  reporting protocol checks and role behavior without reading OpenCode
  internal storage.
• Accept an optional gitcodeCli absolute path in cross-review config and
  persist it from guided setup after npx open-codeasier detect-gitcode
  locates gitcode-cli (PATH, then ~/miniconda3 / ~/anaconda3 including env
  bin/Scripts; --version output must contain gitcode, so a Graphviz
  gc is ignored). GitCode targets (gitcode.com URLs or remotes) fetch
  PR/Issue details with that CLI in the parent session and always pass
  context; GitHub fetching still uses gh.

Changed

• Load project .opencode/cross-review.json exclusively when present, without
  reading or merging ~/.config/opencode/cross-review.json. Global fallback
  applies only when the project file is absent. A present-but-empty project
  config, including the model-free {} created by init, is no longer
  backfilled from global; tell callers to configure reviewers in the existing
  project file or pass --review-models.

Fixed

• Embed non-PR shared context up to the 1,000,000-character schema cap
  instead of silently clipping reviewer briefs (and judge briefs for
  parent-provided context) at 100,000 characters, set warning when
  gatherer output or an unenforced parent context still exceeds the
  embed limit, and tighten that budget from the tightest known
  reviewer/judge limit.context (4 ASCII chars/token, 1 non-ASCII
  char/token, 25% reserve) so a typical payload cannot blow a smaller
  known window. Models without limit.context still use the 1M schema
  cap.
• Treat never-dispatched cross-review roles as insufficient-evidence in
  /cross-review-audit, keep per-run protocol timelines attributed by
  runID, and let a later silent-model-replace fail win over an earlier
  truncated session.
• Fail /cross-review-audit silent-model-replace on a visible prompt-model
  mismatch even when that session is truncated, and treat cancelled/failed
  roles that never landed a prompt as insufficient-evidence.
• Continue gitcode-cli discovery when a PATH entry is unreadable or not a
  directory, and when listing conda env directories fails with EPERM, so
  detect-gitcode no longer crashes on those filesystem errors.
• Treat host type-default cross-review overrides (reviewModels: [] and 0
  for agents, maxConcurrency, and reviewerTimeoutMs) as omitted so they
  fall back to the loaded config instead of failing validation before it is
  applied. Truly illegal overrides still fail fast. Empty or zero values that
  still reach validation mention omitting the argument to use config. Blank
  judgeModel still means parent-session judging; empty focus is unchanged.
• Harden the asynchronous cross-review parent-session protocol. Finalize
  rejects while gathering, reviewers, the explicit judge, or a pending
  timeout decision are still active, so it cannot be used as a poll;
  readyToFinalize is true when reviewers are terminal, the explicit
  judge is terminal, or the run is already in a terminal phase. A
  timeoutAction on the poll that first observes an already-overdue
  session is applied instead of being ignored. Empty or
  whitespace-only context is omitted,
  including PR snapshot notes.md. A stray timeoutAction on an
  ordinary poll is ignored with a warning, including abort after a
  preserved session has already finished.
• Reject a non-PR cross_review_start or legacy cross_review when
  parent-session judging omits context, instead of dispatching
  reviewers with a warning. Read-only reviewer, gatherer, and judge
  briefs now forbid .git/** reads, guessed historical or host-absolute
  paths, whole-tree glob/re-read detours, and webfetch retries after
  403/404/429.

open-codeasier v0.2.12

Added

• Preserve overdue cross-review sessions until the user explicitly chooses an action. Reviewers, gatherers, and judges now enter timeout_pending and return actionRequired; cross_review_status accepts timeoutAction: "preserve" to extend the same session or "abort" to terminate it. Abort also stops previously preserved sessions still inside their extension, ambiguous preserved dispatches are redispatched instead of idling, the decision applies throughout waitMs long polling, and transient fetch errors no longer stick to preserved sessions.
• Add server-side waiting (waitMs) to cross_review_status long polling. The tool holds active runs for up to waitMs (0-60000ms, default 30000ms) without holding the run lock across sleep intervals, returning early whenever any reviewer or phase state changes, the run finishes waiting, or timeout expires. This eliminates client-side busy-polling sleep loops in the parent session.
• Update cross-review skill and orchestration instructions to utilize server-side wait in cross_review_status without manual client sleeps.

open-codeasier v0.2.11

Fixed

• Reject out-of-range cross-review overrides and empty reviewer sets with an explicit error instead of running a 0-reviewer ghost run that finalizes as quorum-not-met. Tool overrides are revalidated against the config loader bounds even when the host skips tool-schema validation.
• Make cross-review setup write valid config shapes and validate semantically. Document the reviewers object-array versus reviewModels string-array shapes and add an open-codeasier validate subcommand that runs the runtime parser on a config file; guided setup validates the written file with it instead of a syntax-only JSON check.
• Resolve the no-arg validate path through the shared repository root fallback, so a linked worktree without its own config validates the same project file that cross_review_start loads instead of reporting not found.
• Surface config resolution (config.sources plus resolved paths) and the project-config fallback warning on cross_review_start and on cross_review_status when detail or includeOutputs is requested. Compact status polls stay unchanged. Judge-failed finalize results now include the same warning as the other terminal results.

open-codeasier v0.2.9

Changed

• Cut the token cost of the cross_review_status polling loop. The default status result is now compact (runID, phase, quorum, counts, readyToFinalize, pollAfterMs, and the per-reviewer text summary), omitting the full target and per-reviewer objects; request the full fields with detail: true or includeOutputs: true (includeOutputs implies detail), and cross_review_finalize still returns the complete candidates once. The recommended poll interval now settles to 10s while sessions are running, stays at 3s while the gatherer or any session is starting, and shortens near a session deadline, so a review that used to poll every 3 seconds now spends far fewer tokens on repeated status payloads.

open-codeasier v0.2.8

Added

• Gather the target context once and share it with every reviewer instead of letting each reviewer fetch it independently. With a configured judgeModel and no supplied context, cross-review runs a read-only gathering phase in the judge session first (reported as a gatherer in cross_review_status), embeds the gathered output into every reviewer brief, and degrades to independent fetching when gathering fails or times out. An optional context argument (collected by the parent session when no judgeModel is configured) skips the gathering phase and is embedded in reviewer briefs and the judge prompt. Run manifests migrate from schema version 1 to 2 on load.

open-codeasier v0.2.4

Fixed

• Keep runtime plugin and workflow asset upgrades on the same exact package version and scope, and print the matching runtime command after asset installs.
• Stop cross-review with versioned recovery guidance when its runtime tool is unavailable instead of improvising a fallback.
• Report live cross-review progress and child-session provenance through tool metadata so long-running reviewers and judges remain observable.
• Treat an explicitly blank judgeModel as parent-session judging instead of rejecting it as an invalid model identifier.

open-codeasier v0.2.2

Fixed

• Build distributable artifacts automatically before packing or publishing so the CLI and server exports are included in npm packages.
• Replace the deprecated npm 0.2.1 artifact, which was published without dist/ files.