Release v0.5.0 · only-cli/oc

Eleven language documentation references with real search, and bring-your-own-cookie login for the sites that need an account.

Added

Language documentation shortcuts: py, mdn, node, ruby, go, rust, java, php, cpp, and ts, plus a dotnet verb on learn for the .NET API browser. Where the docs ship their own search data, search uses it: oc py search fetches the full-text index a Sphinx site already publishes (cached on disk for a day) and ranks it locally, oc node search and oc ruby search do the same over the Node.js JSON reference and the RDoc index, and oc mdn search asks MDN's own search API. A query that names a symbol exactly, like json.dumps, links straight to its anchor. The sites that only render docs search client-side go through DuckDuckGo with a baked-in site: filter instead. (#25)
Authenticated sessions. printf %s "session=..." | oc login --cookie - --domain example.com seeds cookies for a session, every fetch in that session sends them, and oc logout forgets the session early: cookies and saved page both. Cookies live in a per-session jar under OC_HOME, separate from page state, pinned to the exact host they were seeded for, and marked secure by default so they travel over https only (--allow-http at login opts a plain-http site in). A session lasts an hour unless --expires says otherwise. (#4)

Response bodies are bounded at every transport: 25MB decoded, checked against Content-Length before the bytes arrive and counted as they land, so a hostile URL is no longer an unbounded allocation and a decompression bomb stops at the cap. (#27)
Titles, headings, and input names are cut at the render boundary like every other block, so one hostile page-written scalar can no longer print unbounded output whatever the budget said. The distilled page keeps the full values and --json stays the machine-stable view. (#28)
A short page is judged unreadable by evidence, not by length alone: a status endpoint or a one-line answer now exits 0, script-only shells and consent walls still exit 2, and the --json empty field follows the same policy. (#29)

Full changelog: v0.4.0...v0.5.0