v0.5.0

Eleven language documentation references with real search, and bring-your-own-cookie login for the sites that need an account.

Added

• Language documentation shortcuts: py, mdn, node, ruby, go, rust, java, php, cpp, and ts, plus a dotnet verb on learn for the .NET API browser. Where the docs ship their own search data, search uses it: oc py search fetches the full-text index a Sphinx site already publishes (cached on disk for a day) and ranks it locally, oc node search and oc ruby search do the same over the Node.js JSON reference and the RDoc index, and oc mdn search asks MDN's own search API. A query that names a symbol exactly, like json.dumps, links straight to its anchor. The sites that only render docs search client-side go through DuckDuckGo with a baked-in site: filter instead. (#25)
• Authenticated sessions. printf %s "session=..." | oc login --cookie - --domain example.com seeds cookies for a session, every fetch in that session sends them, and oc logout forgets the session early: cookies and saved page both. Cookies live in a per-session jar under OC_HOME, separate from page state, pinned to the exact host they were seeded for, and marked secure by default so they travel over https only (--allow-http at login opts a plain-http site in). A session lasts an hour unless --expires says otherwise. (#4)

Fixed

• Response bodies are bounded at every transport: 25MB decoded, checked against Content-Length before the bytes arrive and counted as they land, so a hostile URL is no longer an unbounded allocation and a decompression bomb stops at the cap. (#27)
• Titles, headings, and input names are cut at the render boundary like every other block, so one hostile page-written scalar can no longer print unbounded output whatever the budget said. The distilled page keeps the full values and --json stays the machine-stable view. (#28)
• A short page is judged unreadable by evidence, not by length alone: a status endpoint or a one-line answer now exits 0, script-only shells and consent walls still exit 2, and the --json empty field follows the same policy. (#29)

Full changelog: v0.4.0...v0.5.0

v0.4.0

Site shortcuts actually work now, Wikipedia is one of them, and a page oc cannot read says so instead of returning empty.

Added

• Site shortcuts are dispatched, not just documented. oc <site> <verb> [args] resolves to a URL and then takes the same path oc open does, so it costs the same and reads the same. Name a site by short name, bare name, or domain (oc hn, oc ycombinator, oc news.ycombinator.com), the last argument absorbs every word after it so a query needs no quoting, and oc sites lists every site with its verbs. Shortcuts live in clis/*.json, so adding a site is a JSON file and no code. (#19)
• Wikipedia: oc wiki article <title>, oc wiki search <query>, and oc wiki lang <code> <title> for the other language editions. Articles come through action=render, which serves the article body without the chrome, navigation, and edit controls that surround /wiki/<Title>. (#22)
• Proxy support. Outbound fetches honor HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, including the lowercase forms, so oc works in a sandbox whose only route out is a proxy. HTTP and HTTPS proxies both work, and credentials in the proxy URL are sent as Proxy-Authorization. (#17)
• The MIT LICENSE file that the badge and package.json were already claiming. (#18)

Changed

• A page that distills to no readable text fails loud. It used to print an empty render and exit 0. It now writes one line to stderr and exits 2, which is distinct from the exit 1 every other failure uses, so a caller can tell "this page is empty" from "oc could not read this page" and reach for a browser only when that is worth doing. --json carries the same verdict as an empty field. (#20)
• The SSRF guard runs before a proxy is chosen, so a proxied request cannot reach an address the direct path would have refused. (#17)

Fixed

• GitHub and Reddit shortcut URL templates now reach the pages their verbs name. (#19)

Docs

• New CHANGELOG.md.
• The bundled agent skill gained a site shortcuts section. 0.3.0 shipped the shortcuts but the skill never mentioned them, so an agent reading only the skill could not use the feature. It also documents the exit 2 contract and the proxy variables, and its npx pins point at 0.4.0.
• The README gained an end to end benchmark alongside the existing per-page one: five Wikipedia lookups run as whole tasks in Claude Code, one tool per run. All three tools answered every task correctly, so it is a cost comparison and not an accuracy one.

tool	answered correctly	input tokens	cost	turns	avg time
oc wiki	5/5	5,535	$0.27	22	11s
built-in WebFetch	5/5	128,792	$0.37	25	14s
built-in WebSearch	5/5	160,431	$0.52	27	22s

Full changelog: v0.3.0...v0.4.0

v0.3.0

0.3.0 is about the cost of a second command. A page view was already cheap; answering a real question was not, because it took several commands, and inside an agent session one tool call costs far more than the page it prints. This release makes the first command the answer more often, and makes what it prints something an agent can act on without checking.

Fewer turns

• A search result title is a link, so oc do <n> on it opens the result. Headings lost their inner anchor during distillation, so do read the title back and the agent spent another turn hunting for a number that navigates. A heading whose only link is a permalink to its own id, which is every heading on a docs page, still reads instead of refetching the page already open.
• oc find <query> with a single match prints that region. One match is the answer, not an index, and the next command was always the read that looks.
• oc find prints whole matches instead of snippets when they all fit inside the allowance a page already gets for finishing.
• Truncation ends where a sentence ended, or where a line ended in code, so the half that is shown can be trusted on its own.

Measured end to end with an interleaved A/B, four reps per task, frozen builds and correct answers throughout: 64 turns down to 49, 40 commands down to 25. Eight of eight paired reps improved and none regressed.

Code you can run

A syntax highlighter gives every token of a command its own element, so the AWS CLI reference used to hand over aws s3 cp test . txt s3 : // amzn - s3 - demo - bucket / test2 . txt, and Node's docs handed over console . log and fd ?. close (). Any command or snippet taken from a docs page was wrong, and nothing in the output said so. Of 172 code blocks across the AWS CLI reference, the Rust book, the Node API docs and the Python library docs, 159 are split this way.

A code block is now read whole, keeps its lines and its indentation, and leaves the page's own copy buttons and language labels behind. Inline code is fixed by the same change: Byte ( u8 only) is Byte (u8 only) again.

JSON APIs

• A JSON resource is read as the resource, not as the array beside it.
• Nested objects render as fields instead of collapsing.
• JSON API responses render as pages at all, which is new in this line.

Sites

Docs search for the AWS, GCP, and Azure CLIs.

Fixed

• Binary responses are refused on the impers transport too.
• A node_modules symlink that 0.3.0-beta.1 packed by accident is gone.
• Both transports now share one redirect loop, so the check that revalidates every hop cannot be fixed in one copy and left broken in the other. It is proven offline, against a transport that never leaves the process, instead of against a third party's uptime.

Install

npm install -g @only-cli/oc

The skill and the Claude Code plugin both move to 0.3.0.

v0.3.0-beta.2

Second beta of 0.3.0. The theme is turn count: every change here removes a command an agent used to have to run, because one tool call inside an agent session costs far more than the page it prints.

Fewer turns

• A search result title is a link, so oc do <n> on it opens the result. Headings used to lose their inner anchor during distillation, so do read the title back and the agent then spent another turn hunting for a number that navigates. Headings whose only link is a self-fragment permalink, which is every heading on a docs page, still read rather than refetch the page already open.
• oc find <query> with exactly one match prints that region instead of naming its number. One match is the answer, not an index, and the agent's next command was always the read that looks.
• oc find prints whole matches instead of snippets when they all fit inside the allowance a page already gets for finishing, so the command answers instead of pointing.
• Truncation ends on the last sentence that finished inside the cap. A cut mid-sentence made the shown half untrustworthy and cost a read to find out whether it carried on.

Measured end to end against beta.1 with an interleaved A/B, four reps per task, frozen builds and correct answers throughout: 64 turns down to 49, 40 commands down to 25. Eight of eight paired reps improved and none regressed.

Fixed

• A JSON resource is read as the resource, not as the array beside it.
• Binary responses are refused on the impers transport too.
• Dropped a node_modules symlink that the 0.3.0-beta.1 release accidentally packed.

Notes

Pre-release. The skill at npx skills add only-cli/oc still pins 0.2.0, and that pin moves when 0.3.0 goes stable.

v0.3.0-beta.1

Beta. Install with npm install -g @only-cli/oc@beta.

Highlights

• JSON APIs render as pages (#3). An endpoint that answers with JSON becomes one numbered item per record, so oc open on a search API reads like a results page. The renderer keeps the fields that vary between items, states once what every item shares, names the fields empty everywhere, and points at oc raw for the rest. 30 Stack Exchange results land in about 960 tokens against 5,543 for the raw body.
• Stack Overflow search (#3). search <query> through the Stack Exchange API. Each result prints its question_id, which the existing question <id> feed reads in full, since the question's own HTML page answers a bot challenge instead of the question.
• Cloud documentation shortcuts (#11). AWS (guide, page, cli), Google Cloud (docs, page, gcloud), and Microsoft Learn (azure, doc, cli), each with search <query>. Microsoft Learn has a real search API; AWS and Google Cloud render search client-side with no feed, so theirs go through DuckDuckGo with a baked-in site: filter.
• JSON is a readable content type on both transports. The native-fetch path used to reject anything that was not HTML or XML, while the impers path never checked at all, so one URL could render two ways depending on which client got it.
• Plugin marketplace install path and a discoverable web-browsing skill.
• CI hardening: CodeQL, dependency review, npm provenance, and OpenSSF Scorecard.

Notes

• fill, submit, and back are still not implemented. They were labelled v0.2 in the help output, which shipped without them; they now read (planned).
• The bundled skill still pins @only-cli/oc@0.2.0. That pin is what agents execute, so it moves when 0.3.0 is stable rather than at beta.

Full changelog

v0.2.0...v0.3.0-beta.1

v0.2.0

Highlights

• Navigation without URLs: oc do <n> follows a numbered link or reads it if it's text; oc find <query>, oc read <n>, and oc next let an agent dig into a long page without refetching it.
• Rendering leads with the page's main content instead of chrome/nav, so the budget is spent on what the page is actually about.
• YouTube support: video <id> and channel <name>, including transcript access via caption track links.
• Stack Overflow via Atom/RSS feeds: question <id>, tag <name>, user <id>, recent.
• Yahoo Finance CLI: quote, news, history, lookup, markets, gainers, losers, trending.
• Security fix: the SSRF guard now validates the resolved IP a request actually connects to (including every redirect hop), instead of pattern-matching the hostname string. Closes IPv4-mapped IPv6 loopback, 0.0.0.0, and DNS-rebinding bypasses, and fixes a false positive on hostnames like 10.example.com.
• README condensed to the core pitch; full benchmark methodology and results now live in only-cli/benchmarks.

Full changelog

v0.2.0-beta.1...v0.2.0

v0.2.0-beta.1

Beta preview with two new site shortcut packs.

New

• GitHub shortcuts: repo <owner> <name>, user <name>, search <query>, trending, issues <owner> <name>
• LinkedIn shortcuts (public guest views): profile <name>, company <name>, jobs <query>

Both ride the Chrome-impersonating fetch layer, so LinkedIn guest pages and GitHub search render without a browser. A GitHub repo search that costs ~71,600 tokens as raw HTML renders in ~440.

Install

npm install -g @only-cli/oc@beta

Feedback welcome in the issues.