Repository navigation
v3.27.2
What's new
Bug Fixes
Discovered skills now keep valid routing settings when exposed as OpenCode v1 slash commands. Systematic passes through subtask (including false), treats context: fork as a subtask, and accepts an agent only for a subtask targeting a known, enabled agent. Models must use provider/model form. Unsupported values, such as Claude-style model aliases, are omitted with warnings so they do not break the command. On OpenCode v2, discovered skills remain available with unsupported routing fields removed. (#1254)
Documentation
A new security policy explains private vulnerability reporting, the information to include, support for the latest release, and how to check npm trusted publishing and provenance. Contributor learnings also document the OCX registry validation gap and OpenCode v1's two skill-permission names, including how to preserve user-authored rules when mirroring managed permissions. (#1250, #1249)
Continuous Integration
Release-tag rulesets restrict creation of v* tags to the release App and prohibit tag updates or deletion, including by that App. Release recovery instructions now cover the ruleset overrides needed for manual intervention. The accompanying release-hardening work enables immutable releases and required SHA pinning for workflow actions; published release notes remain editable. (#1251)
The static semantic-release configuration now lists only the plugins used for release previews. Publishing already builds its own plugin list per release, so removing the unused entries makes the configuration reflect how the pipeline actually runs. A regression test pins the preview plugin list and order. (#1252)
Also in this release
- Update Fro Bot Agent to v0.129.0. (#1248)
- Update the development dependency agent-browser to v0.39.3. (#1255)