OpenCode Extension Stack v0.1.1

Security Hardening

All 12 findings from the initial security review have been addressed:

• SEC-001: Request body size limits (1MB cap on bridge JSON parsing)
• SEC-002: Per-key rate limiting (100 req/min per IP:method:path)
• SEC-003: SSE connection cap (50 max) and 1-minute hard timeout per session
• SEC-004: Path traversal guard in memory evidence resolution
• SEC-005: Security headers on all bridge responses
• SEC-006: Server timeout (30s) and headers timeout (35s)
• SEC-007: Telegram webhook rate limiting (30 req/min per IP)
• SEC-008-012: Positive security patterns verified

Full report: security_best_practices_report.md

Other Changes

• Add MIT License (Elliott Schmechel 2026)
• Add README badges (CI, Node.js, pnpm, license, issues)
• Add docs/publishing-strategy.md

Verification

• pnpm test (96 tests pass)
• pnpm run smoke (all packages pass)

OpenCode Extension Stack v0.1.0

v0.1.0

Initial public milestone for the OpenCode extension stack.

Highlights

• unattended queue, cron, runner, supervisor, daemon, retry, budget, and retention flows
• detached worker orchestration with team templates, synthesis, rerun-failed, and per-team memory shortcuts
• skeptical memory with evidence-backed notes, stale repair, consolidation, contradiction checks, and cross-topic merge workflows
• reusable prompt packs with durable invocation history and remote review handoff support
• remote bridge with approval gating, signed approval links, SSE status events, and Telegram integration

Verification

• pnpm test
• pnpm run smoke

Operator Docs

• docs/quickstart.md
• docs/operator-guide.md
• docs/remote-bridge-telegram-setup.md
• docs/team-template-memory-workflows.md
• docs/release-process.md