v0.0.0

[0.0.0] - 2026-11-10

Added

• access, the plugin option every OpenCode plugin of this family has: "all" (the default), "ask-changes" and
  "read-only". It generates the default permission block from the tool classes, and /github-status shows it, with a
  note when the deprecated readOnly option set it. readOnly still works: true means "read-only" and false
  means "all".
• assets/icon-128.png and assets/icon-256.png, with opencode.icons and opencode.vendor in package.json, and
  scripts/check-icons.mjs, the family icon contract's check.

Changed

• The Code Mode catalogue no longer pins tool signatures. The namespace text names the skills; search finds a tool's parameters. The host can still show unpinned tools.

• The Code Mode namespace says what access decides, in one clause for each value: all runs every tool without asking, ask-changes asks before a change, and read-only denies one.

• github_events_list runs without a prompt at every access value, because it is a read and Memory's collector runs it unattended. Restrict it with a rule per tool, as any tool.

• The jelly declaration's settings carry their defaults (access, unknownTools and lockdown), which Jelly displays.

• Each GitHub skill's first line says how to sign in when the tools are absent.

• docs/scripting.md says a script's session needs the project as its location; without one, each call fails Agent not found.

• Every GitHub tool is allowed by default. The generated block allows every known tool and the github_* pattern,
  so a tool GitHub adds later runs without a prompt too, and github_api may change GitHub without asking. Restrict it
  with access, with an agent's own rules, or with a rule per tool; the README's Permissions section and SECURITY say
  what an all-allow default means here.

• A script's api change resolves the same write permission the direct path asserts: github_api on the call's
  own METHOD /path, from a prior explicit allow only. An allow scoped to GETs cannot POST, and a rule for another
  method does not cover it, with nothing sent.

• docs/scripting.md is the family's scripting contract: the strict envelope, the location section and its unload
  note, the result wording, and the refusal table, with an example-parsing test that fails when a doc example names a
  method that does not exist, omits the location header, or uses an input the tool does not take.

• One typed code table, PLUGIN_CODES and RPC_CODES in src/errors.ts, with a test that fails when a code in src
  is in neither, and when the README's Troubleshooting table, the configuration guide's Errors table or the scripting
  doc's refusal table drifts from it in either direction.

• unknownTools decides only whether GitHub lists a tool the plugin does not know: "ask" (the default) keeps it, and the generated github_* rule and access decide it, so it runs at the default, asks at "ask-changes" and is denied at "read-only"; "hide" removes it. The value's name is older than the all-allow default and does not make a tool ask.

• The README's Troubleshooting table lists every error code with its next step. The docs' tested-release sentences are
  checked against TESTED_HOSTS: 2.2.3, 2.2.4, 2.2.5 and 2.2.6. The README prints the default block in full.

• The CI has an actionlint job, and npm run check runs actionlint and the icon check.

• The tools RPC is v2: every known tool is a method with its class (read for the 61 catalogued reads, write for the 37 catalogued writes and for api), and a call runs only with a prior explicit allow in the agent's or the session's rules. An ask is refused before the tool runs, so no prompt waits, and a saved "Always allow" does not authorize an ad-hoc script. api now takes github_api's whole input: a write, a download and an upload run under an allow and assert github_api themselves, and readOnly: true still refuses every change; SCRIPT_READ_ONLY is gone. ui_get and unknown tools are still not methods.

• The OPTIONS_INVALID next step names the Git spec, github:joe-broadhead/opencode-github#v0.0.0, not the npm name.

Fixed

• The TUI part (dist/tui.js) loads from a local-path install again. It is built unminified: OpenCode could not resolve the minified form of its @opentui/solid and solid-js imports, so the /github status view never loaded. The build fails if the file is minified.

Known limits

• GitHub decides its tools. The plugin's tool table follows GitHub's hosted server at this release. A tool GitHub adds later runs under access, is listed as unknown in /github-status, and is not a script method until the plugin classifies it. npm run drift compares the table with the server.
• The token limits what is possible. The scopes you granted decide what the account's token can do. The default repo scope reaches every repository the account can write.
• Toolsets are a selection. The default toolsets turn on 15 of the 24 toolsets, which show 69 tools. Nine toolsets are off by default, such as copilot and gists, and GitHub's two issue artifact tools need a feature flag the plugin does not turn on. See the toolsets table.
• An allow on github_api covers writes. An allow for github_api authorises every api call, reads included, and also its writes, downloads and uploads. Grant it only to a session that may change GitHub, or set access to "read-only" for a read-only script.
• Tested on OpenCode 2.2.3, 2.2.4, 2.2.5 and 2.2.6 only. Other releases in >=2.2.3 <2.3.0 run untested.
• GitHub's rate limits and error text are GitHub's. Errors from OpenCode and GitHub pass through unchanged.
• Updates are not automatic for a Git install, and opencode plugin update and opencode plugin check do not work on one: to move to a newer release, remove the old entry and add the new tag.