v0.3.0 — v1 candidate (security & stability hygiene)

Documentation, security, and stability hardening toward 1.0 — no behaviour changes. Still 0.x / Beta until a live smoke test on a real instance.

Added

• SECURITY.md — private vulnerability reporting, scope, response policy.
• README Stability section: the SemVer public contract from 1.0.0 (CLI flags, .env keys, Talk commands, status JSON, forward-compatible migrations).
• CONTRIBUTING: the live smoke test is now a required gate before a stable release, plus a pre-1.0 checklist.
• GitHub issue forms + PR template; security reports routed to private advisories.

Changed

• __version__ derived from package metadata (single source of truth = pyproject.toml).
• OpenCode compatibility clarified: tested against 1.15.11, expected compatible with the 1.15+ HTTP API.
• docs/publishing.md refreshed for the live state.

Full diff: v0.2.8...v0.3.0

v0.2.8 — corrected PyPI page

Docs-only republish so the PyPI project page shows the corrected README (the uv tool install opencode-talk-bridge instructions). The 0.2.7 page was built from the README commit just before the PyPI-primary install flip.

No code changes.

Full diff: v0.2.7...v0.2.8

v0.2.7 — first PyPI release

Now on PyPI 🎉

uv tool install opencode-talk-bridge      # or: pipx install opencode-talk-bridge

Added

• PyPI Trusted-Publishing workflow (.github/workflows/publish.yml): each vX.Y.Z tag guards the tag↔version match, builds, twine checks, and publishes to PyPI via OIDC (no token in the repo). Package classifiers + docs/publishing.md.

The dependency nextcloud-talk-core also resolves from PyPI (>=1.0.2), so the install needs no git URLs at all.

Full diff: v0.2.6...v0.2.7

v0.2.6 — nextcloud-talk-core from PyPI

Changed

• nextcloud-talk-core is now a normal PyPI dependency (>=1.0.2,<2) instead of a pinned git URL — it has been published to PyPI. Simpler installs and dependency resolution; dropped allow-direct-references and the git-dep notes in README/CI.

Verified the used API (TalkClient/OCSClient methods + signatures) is unchanged in 1.0.2 and the full suite (182 tests) passes against it.

Full diff: v0.2.5...v0.2.6

v0.2.5 — no server text leaks into chat

Fixed

• No OpenCode server text leaks into Talk. The prompt worker caught generic exceptions and posted Fehler: {exc}; an OpenCodeError carries up to ~300 chars of the OpenCode HTTP response body, which could reach the chat. The worker (session-setup and prompt paths) now catches OpenCodeError and posts a generic oc_error message, logging the details only — consistent with the command handlers. Remaining error: {exc} paths only fire for local validation errors (e.g. a bad model string), which carry no server body.

Regression tests assert the server body never reaches chat.

Full diff: v0.2.4...v0.2.5

v0.2.4 — error isolation + hardening

Hardening pass from a code review.

Fixed

• Error isolation. Command handlers run inline on the poll thread and only caught OpenCodeDownError; an OpenCode HTTP 4xx/5xx (OpenCodeError) could escape and kill a conversation's poll thread. The poll loop now isolates every message (logs + notifies + keeps polling), and command dispatch catches OpenCodeError with a clean message.
• /task validation. Reject 0-minute schedules and empty prompts.

Internal

• Tests for __main__ (CLI wiring, 0→90%) and the Talk gateway / message parsing (57→95%); overall coverage 76→82%, 180 tests.

Full diff: v0.2.3...v0.2.4

v0.2.3 — project-scoped /sessions, /commands, /skills

Fixed

• /sessions, /commands, and /skills are project-scoped in OpenCode, but the bridge listed them against the global OPENCODE_DIRECTORY and ignored the per-conversation project chosen via /projects. They now use the conversation's directory, so /sessions shows the same sessions as the OpenCode desktop/TUI for that project (and follows /projects switches).
• /projects itself is global (all known projects), matching desktop.

Verified live against opencode serve 1.15.11.

Full diff: v0.2.2...v0.2.3

v0.2.2 — interactive --init wizard

Added

• opencode-talk-bridge --init — interactive .env wizard. Prompts for the essentials (Talk credentials, allowlist, OpenCode URL), hides the app password, refuses to overwrite without confirmation, and writes the file chmod 600.

First-run setup is now: uv tool install … → --init → --check → run. No manual file editing.

Full diff: v0.2.1...v0.2.2

v0.2.1 — /skills + run_command fix

Added

• /skills — browse & run OpenCode skills (via GET /skill).

Fixed

• run_command now always sends the required arguments field. Without it the command endpoint returned HTTP 400, so /commands (and any command run) was broken.
• /commands no longer lists skills (source == "skill" entries); those live under /skills.

Verified live against opencode serve 1.15.11.

Full diff: v0.2.0...v0.2.1

v0.2.0 — Telegram-bot feature parity

Brings opencode-talk-bridge close to feature parity with grinev/opencode-telegram-bot, adapted to Nextcloud Talk (no inline buttons → numbered-text pickers; live streaming via message editing).

Phase 1 — streaming + core UX

• Live response streaming by editing one Talk message (RESPONSE_STREAMING, throttled)
• Tool / thinking service messages from the SSE stream
• Agent questions (question.asked) answered by number or free text
• Numbered pickers: /sessions, /model, /agent

Phase 2 — breadth + i18n

• /rename, /detach, /projects, /worktree, /commands, /mcps, /messages (revert/fork)
• Per-conversation project/worktree directory binding
• Background-session notifications
• i18n (German + English) via BOT_LOCALE

Phase 3 — voice & tasks

• File/image input inlined as OpenCode file parts
• Voice notes → STT (Whisper-compatible) into the prompt
• Spoken replies (TTS) shared as audio, /tts per conversation
• Scheduled tasks: /task, /tasklist, SQLite-backed daemon scheduler

143 tests, CI green on Python 3.10–3.13.

Out of scope (by design): /opencode_start|stop (the menubar app/launchd owns the OpenCode process) and Telegram-only plumbing.

Full diff: v0.1.1...v0.2.0