v0.2.6

Changes

• Allow the StructuredOutput tool in stable reviewer sessions so permission reviews complete with enforced structured output instead of timing out (the deny-all reviewer ruleset was also blocking the structured-output tool on the stable create path).
• Use Cloudflare DeepSeek V4 Flash as the example reviewer model across docs, tests, and the isolated runtime launcher; the launcher now resolves models.dev providers from the local catalog and stored opencode auth credentials.
• Add contribution guardrails: CI (typecheck, tests, build, package), PR branch-name check, issue templates, CODEOWNERS, and CONTRIBUTING.md.
• Document the reasoning-free (`none`) variant for fast reviewer decisions.

v0.2.5

Highlights

• Install globally with opencode plugin -g opencode-auto-permissions.
• Automatically inherit the requesting session model and variant, with optional dedicated reviewer configuration.
• Preserve the primary agent, model, and reasoning variant after permission denial or failure.
• Prevent duplicate stable server/TUI reviews and cross-process reviewer-session cleanup.
• Increase the default review timeout to 30 seconds for cold starts.

Published to npm as opencode-auto-permissions@0.2.5.

v0.2.4

Fixes

• Increase the default permission-review timeout from 8 seconds to 30 seconds for cold reviewer starts.
• Classify deadline-triggered aborted generations as permission-review timeouts.

Published to npm as opencode-auto-permissions@0.2.4.

Historical Snapshot

This tag was reconstructed after publication from the immutable npm tarball because the original source commit was not recorded. The parentless tagged commit contains exactly the five published package files. npm SHA-1: f5bdd021416024392abca6e69435d2c32d4282a7.

v0.2.3

Fixes

• Stop startup cleanup from deleting standalone reviewer sessions owned by concurrent OpenCode processes.

Published to npm as opencode-auto-permissions@0.2.3.

Historical Snapshot

This tag was reconstructed after publication from the immutable npm tarball because the original source commit was not recorded. The parentless tagged commit contains exactly the five published package files. npm SHA-1: cebbbff2cc2707fbcf57e241311235b527d25c1b.

v0.2.2

Fixes

• Prevent duplicate permission reviews on stable OpenCode by assigning review ownership to the server integration and disabling the TUI reviewer for stable runtimes.
• Expand installation and lifecycle documentation.

Published to npm as opencode-auto-permissions@0.2.2.

Historical Snapshot

This tag was reconstructed after publication from the immutable npm tarball because the original source commit was not recorded. The parentless tagged commit contains exactly the five published package files. npm SHA-1: 22d8885634aa6bdb193375d9d349aeb7c6d6a769.

v0.2.1

Fixes

• Prevent plugin-authored denial messages from becoming self-reinforcing human instructions.
• Honor later explicit user authorization when an earlier conditional gate has been satisfied.
• Delete temporary reviewer sessions after decisions and failures.
• Sweep orphaned Auto Permissions reviewer sessions on startup without touching user conversation history.

Validation

• Verified against OpenCode 1.18.12.
• Passed TypeScript checks, all 81 tests, package validation, and production builds.
• Live model-reviewed permission test passed with no reviewer sessions left behind.

v0.2.0

Fully autonomous permission resolution for unattended OpenCode agents.\n\nHighlights:\n- Every reviewed request resolves automatically: allow once, guarded session approval, or deny\n- No manual permission outcome; denials include actionable safer-alternative guidance\n- Reviewer timeouts, invalid output, and provider failures fail closed and resume the main agent\n- Narrow, tool-provided patterns can be approved for the current session\n- Broad, destructive, elevated, deployment, publish, push, credential-sensitive, edit, and external-directory actions remain one-time\n- Direct continuation instructions such as proceed, continue, and keep going are recognized\n- Low reviewer reasoning variant remains recommended for latency\n\nValidation:\n- 80 tests, 141 assertions\n- Strict TypeScript, production builds, package export smoke test, and clean package payload\n- Live stable acceptance proved allow_session caching: the cached third git fetch generated no permission request\n\nCompatibility:\n- OpenCode stable 1.18.12\n- OpenCode V2 0.0.0-beta-202608040144\n\nRestart every running OpenCode process after upgrading so no process retains the prior plugin bundle.

v0.1.0

First stable Git-backed release of OpenCode Auto Permissions.\n\nHighlights:\n- Context-aware one-time review of OpenCode permission requests\n- Stable OpenCode 1.18.12 and V2 beta protocol support\n- Risk-based unattended-agent policy with safer-alternative guidance\n- Structured-output review with strict JSON fallback\n- Standalone, no-tool reviewer sessions\n- Optional reviewer-only variant; low reasoning is recommended for latency\n- Bounded privacy-minimized diagnostics\n\nValidation:\n- 67 tests, 121 assertions\n- Strict TypeScript, production build, and package export smoke test\n- Live acceptance of safe Git push dry runs, composed Git checks, temporary cleanup, sudo diagnostics, and external-directory review\n\nInstall using the pinned v0.1.0 Git reference shown in the README.