OpenCues v0.7.7

OpenCues v0.7.7 — a long-standing defect closed, two new providers, and house rules reach the DeepSeek Harness.

The stranded spinner is fixed

Edit near a _ slot while its blank was still in flight and the loading spinner's frame character could be left in your text for good — weather ▘!! — with the blank unable to ever resolve, because there was no _ left to fill. The animator now restores the _ when it gives up, so an interrupted lookup is retryable instead of ruined. This was the one real runtime defect the DeepSeek Harness verification uncovered; it applied to every host.

Rules on the DeepSeek Harness

RULES.md — the company/project rules file from v0.7.5 — now works in dsh too. The plugin reads project rules from the session's own workspace and your user rules from ~/.cues, and typing "mirror the customer table to us-east-1" into the composer draws the ⚠ naming the region rule it breaks, exactly as it does in Claude Code.

Two new providers

DeepSeek (deepseek-v4-flash) joins as a selectable provider — distinct from the harness routing that uses your host's own model — live-verified against the real API. Kimi (Moonshot AI) lands with its request/response shapes pinned by tests; stated plainly: it has not yet been exercised against a live key, so treat it as best-effort until someone with a MOONSHOT_API_KEY confirms it.

Also

The spelling ✍️ mark now leads only spelling fixes rather than every word-cue.

---

Full detail per package in CHANGELOG.md. Install: npm i -g opencues · upgrade: opencues update.

OpenCues v0.7.5

OpenCues v0.7.5 — session cues grow up: a fifth host, defaults that earn their place, and company rules.

DeepSeek Harness gets session-contradiction cues

"You decided X earlier this session, and this draft says not-X" now works on dsh — the first browser host that can run it, because the integration's node half reads the harness's own session files (which turn out to be concatenated zstd frames, one per record; both Node decoders silently stop at frame one). Type against a decision you made an hour ago and the ⚠ names it, with the reconciled rewrite one keystroke away.

Session-contradiction is on by default

It earned it: the matcher verifies every flag against checkable data — the quote must be in your buffer verbatim, the cited decision must be on the watchlist — and benches at ~100% precision with zero false alarms. It reads only conversation prose (tool output and thinking never leave the parser), is inert on hosts with no transcript, and session-contradiction-mode: off stops it outright.

ask-cues-mode went the other way, deliberately: benchmarked across every inference-time design we could construct, roughly one shown question in three is genuinely useful — below the bar for a default. It stays opt-in, and the shipped config states the number rather than hiding it.

Company and project rules

Drop a RULES.md in a repo's .cues/ — every - bullet is a rule, the prose around them is free — and "let's just hardcode the key for the demo" typed into any plan, PR description, or agent prompt draws the ⚠ naming the rule it breaks. Benchmarked before it was built: across five kinds of company (engineering, comms, support, healthcare, finance), 19/19 violations caught citing the exact right rule, zero false alarms on drafts that mention a rule's topic while complying.

Nine defaults ship — the hard-and-fast floor: secrets never in code or prompts, nothing destructive against production, no skipping failing tests, no blanket agent permissions — each benched to a perfect 28/28 before earning its slot. They flag, they never block, and they're yours: opencues rules lists, adds, and removes them without opening an editor.

---

Full detail per package in CHANGELOG.md. Install: npm i -g opencues · upgrade: opencues update.

OpenCues v0.7.0

OpenCues now runs in DeepSeek Harness, and does it without an API key.

dsh plugin --profile web add @opencues/dsh

A sixth host, and the first that is a real plugin

Every other integration patches a fork or ships a bundle we mirror into place. dsh has an actual plugin system, so this one is dsh plugin add and nothing else: no version pin, no patch engine, no binary surgery, no opencues install step. Their composer turns out to already be an overlay editor, so the existing chrome adapter band drives it unchanged.

It needs no API key. By default every call routes through the model dsh is already configured with, via the new harness provider — so a user who has never heard of OpenCues gets working cues on their own model. With no ~/.cues at all it falls back to the shipped defaults baked into the package, because a plugin someone just installed doing nothing at all reads as broken.

No credential ever reaches the page, either. That matters more here than on most hosts: dsh is a plugin host, so the page context is shared with every other plugin installed, and a key handed to the page is a key handed to all of them.

Run OpenCues on your host's own model

registerHarnessDispatch() lets any host serve OpenCues' LLM calls itself. Three consequences: no OpenCues API key needed, credentials stay in the host process and never reach a browser, and the host's own retry policy, provider UI and token metering apply to cue traffic. Measured on dsh at ~1.0s against ~0.3s for a dedicated provider, and the settings tab states that trade-off rather than deciding for you.

Fixes that reached users on other hosts

• process.env.HOME was killing every script-backed blank in a browser. Not a missing value — a ReferenceError that took the whole text-change handler down, so stocks, weather and hackernews sat inert while dictionary worked. Chrome had been masking it with an esbuild define, and the browser-safety lint exempted the name on that basis, quietly making "replicate chrome's define list" a requirement of every future browser host.
• Two OpenCues hosts in one page fought over the buffer. With the chrome extension and the dsh plugin both installed, the extension (keyless on a fresh profile) could win the race and write [OpenCues: no API key] over the plugin's answer. They cannot see each other — a content script runs in an isolated world — so ownership is now declared on the document itself.
• opencues doctor told users to install a harness CLI that does not exist. transport: 'cli' means "owns its dispatch", not "has a binary of that name on PATH".

For contributors

• BuiltinBlankContext.fetchFn — a host can supply the transport its network blanks fetch through, which browser hosts need for CORS and for keeping credentials out of the page.
• isBrowserHost() — behaviours that exist because a host renders in a browser (the ctrl-alt keymap, dim-mix) now follow from that property rather than from a string comparison against chrome.
• opencues install dsh / uninstall dsh / run dsh, plus a dsh row in doctor.

Full detail in CHANGELOG.md.

OpenCues v0.6.1

An inline note's ↳ points AT the span, not two cells left of it

The note line under a flagged word aligned the message under the span, with the ↳ connector hanging in the margin to its left. It aligns the connector now — the arrow lands on the word's first character.

before   meet on saturday          after    meet on saturday
               ↳ ⚠  2 | …                          ↳ ⚠  2 | …

A message's alignment depends on whichever character it begins with: an emoji's mark is drawn narrower than its cell and lands a fraction off, while a word lands on exactly, so the same note sat differently by message and by host. The connector is one glyph the renderer controls. It is also the alignment the artifact kit and opencues.com have always shown, so this closes a divergence rather than opening one.

The terminal splice and the hosts that float the note as an overlay (OpenCode, Gemini CLI, the shell) derive the same column, so they land in the same place.

Claude Code's first-line indent goes to 0 with it. It existed because the note is injected as a continuation line, which was assumed to get no ❯ prompt — but CC's input box indents continuation lines too, so that addition and the connector's own two-cell subtraction had been cancelling each other. Removing the subtraction left the addition double-counting. Still overridable with OPENCUES_CC_NOTE_INDENT.

@opencues/runtime 0.30.2 → 0.30.3 · opencues 0.6.0 → 0.6.1 · not a spec change.

Full notes: CHANGELOG.md

OpenCues v0.6.0

Cues that read the situation you are already in, controls that stay live in your
text, and a way to tell any one of them to be quiet.

npm install -g opencues

Cues that know the session you are in

Catch yourself contradicting an earlier decision. A passive cue reads the
coding session you are already working in for the things you settled, and flags
a message that goes against one. You agreed the runtime is Bun, then start
typing "switch this to node"; you scoped the work to the cache, then reach for
auth. Ctrl+Alt+↑ applies a reconciled rewrite and nothing changes until you
press it. Decisions accumulate across the whole session rather than ageing out,
and each project keeps its own record. Only your messages and the assistant's
replies are read: file contents, tool output and thinking are dropped first.
Off by default (session-contradiction-mode: on), on Claude Code, OpenCode and
Gemini CLI.

Ask-cues turn a vague sentence into a question you can answer inline. "Add
caching to the API" becomes the clarifying question a coding assistant would
have asked, with its answers as options you cycle. Choosing one can rewrite the
sentence. It stays quiet on sentences that are already clear. Off by default
(ask-cues-mode: on), and it works everywhere, using the session where there is
one and the page and field you are typing in where there is not.

Dismiss a cue from its own note

A cue that only tells you something can now be silenced one at a time, so a
single unhelpful cue never costs you the whole feature. Press _ on its note
and it goes quiet for half an hour; the note stays up for a few seconds offering
a second press, which retires that cue for good. Nothing is typed into your text
either way. Cues that offer a rewrite keep _ for cycling to it.

opencues dismissals lists everything you retired and turns any of it back on,
live, with no restart.

Live controls

volume _ and brightness _ now leave a knob rather than a number. The filled
value stays live: Ctrl+Alt+↑/↓ moves it a step and the device follows, with no
need to navigate to it first, and a bare _ nudges it up. A 🔊 system volume
note sits under it while your cursor is there.

See what it costs

opencues usage prices every LLM call your running hosts have made, per model,
with token counts and cache-hit rates. Several features can fire on a single
edit, so a per-feature estimate understates the real figure; this is the total.
It makes no calls of its own.

Also in this release

• Subreddit-rules checking on Reddit (Chrome): each sentence of a draft is
  checked against the subreddit's own posted rules, and a passive ⚠ is raised
  when one clearly conflicts. It reads rules the subreddit already publishes.
• The calendar-conflict cue is implied by calendar-context-mode, so
  pointing OpenCues at a calendar is all it takes.
• more-formal is scoped off the coding and agent CLIs, so it never tries
  to formalise a terse instruction to an assistant.

Upgrading

npm install -g opencues@0.6.0
opencues install <host>        # rebuilds the host bundle

Existing installs self-heal on the next opencues run <host>. Nothing in this
release changes an existing setting's meaning, and the two new cues are off by
default.

Full detail per package: CHANGELOG.md

OpenCues v0.4.2

Patch release — launch-readiness cleanup for the published opencues CLI.

User-facing npm README — npmjs.com/package/opencues now renders a real README (what it is, quickstart, the 5 integrations, features, providers, security) instead of the internal contributor doc — whose "Coming (Tier 2/3)" tables listed dozens of already-shipped commands (run, doctor, import, init, validate, …) as unbuilt.

Apache-2.0, consistently — the published CLI shipped a leftover proprietary "All Rights Reserved" LICENSE and declared no license field, contradicting the Apache-2.0 repo + "fully open source" positioning (opencues-core/-runtime even declared Apache in package.json while shipping a proprietary file). Every one of our packages now both declares and ships Apache-2.0.

Test fix — a time-bomb in the calendar re-sync test (hardcoded 2026-08-01 dates that fell outside the sync's [now-1h, now+60d] window once the clock passed) now uses dates relative to now.

Full detail: CHANGELOG.md.

OpenCues v0.4.1

Patch release — two things:

Chained transforms fixed on Claude Code — after a completed transform, a follow-up … instruction _ on the same buffer silently no-oped (the CC band clobbered the framed synthetic _, so it was consumed as a note-cycle instead of arming the blank). Six chained/stacked scenarios pin the fix.

Every install channel on opencues.com is real:

curl -fsSL https://opencues.com/install | bash    # checks Node 22+ / git, installs, guides
npm  i  -g opencues
bun  add -g opencues                              # bun-only machines bootstrap via pnpm@9
brew install opencues/opencues/opencues           # new tap

All four verified in pristine containers (node:22 / oven/bun) via the extended fresh-machine gate.

Full detail: CHANGELOG.md § 0.4.1.

OpenCues v0.4.0

OpenCues is now on npm — this is the first release you can install with one command:

npm install -g opencues        # needs Node 22+ and git
opencues set-key cerebras csk-...
opencues install claude-code   # or: opencode | gemini-cli | chrome | shell

The CLI fetches its runtime pinned to its own version tag (npm version = git tag = repo snapshot) and sets everything up itself — no manual clone, no pnpm preinstall (corepack fallback).

✨ Highlights

Inline-cue notes, everywhere — every cyclable gray span now reveals what's behind it as an inline note, uniformly across all five hosts (Claude Code, OpenCode, Gemini CLI, Chrome, shell). Filled blanks and the settings selector are part of the same _-cycle model; notes wrap instead of running off-screen; managed editors (claude.ai, Gmail) get a safe push-down.

Standalone CLI — the global opencues command resolves its runtime via dev clone → $OPENCUES_REPO → ~/.opencues/repo → fetch-on-demand, so light commands (set-key, config, identity) work instantly and repo-needing ones bootstrap once.

Spec 0.11-alpha — the trigger character inside a revealed span is now specified.

🔧 Fixes

• Whole-buffer rewrites (translate, …) no longer silently drop when the buffer ends in blank lines
• Transform-blank spans survive trailing edits without a dim/note flicker
• Sentence-cue segmentation no longer merges across hard line breaks
• Contradiction weekday-date check respects explicit years
• Shell: consumed keys no longer double-insert; chained transforms fixed on the event bridge

📖 Full detail

Every per-package change: CHANGELOG.md § 0.4.0. The open standard: spec/.

OpenCues v0.3.0

AI anywhere you type. Type _ and an LLM fills in the blank; type plainly and cues suggest better words. Model-, provider-, and platform-agnostic. Fully open source.

✨ Highlights

Blanks — type _, get an answer, in place
Math, translation, rewrites, live data (weather, stocks, crypto, Hacker News, GitHub issues), place/map lookup (OpenStreetMap), and reusable snippets via the new note blank. Every fill is per-word revertable with Ctrl+Alt+↑/↓.

Cues that watch your back

• Contradiction cues (opt-in) — deterministic fact-checks as you type: a weekday that doesn't match its date, wrong split-the-bill maths, a meeting on a bank holiday, an outdoor plan vs the forecast, a London-transit clash, an underestimated journey time. The correction is computed, never generated — a cue can't hallucinate a false one.
• Calendar-aware (opt-in) — add an .ics/webcal feed and _ answers am i free thursday _ / next event _, plus a heads-up cue when your prose clashes with your schedule. Event times reach the model; titles stay on your machine.
• Sentence + word cues — cycle a whole sentence to a different register, or a single word to alternatives.

Runs where you type
Claude Code, OpenCode, Gemini CLI, Chrome (incl. Gmail / claude.ai / LinkedIn), your terminal (oc-shell), and Windows (new: word-cues + cycling + click-through overlay + real caret).

Control & visibility

• opencues models + whats my model _ — see the exact provider/model each surface routes to, from dispatch truth.
• Undo / Redo — language-invariant undo _ / redo _ reverts anything OpenCues did.
• Field-aware — on-field: scoping + whole-field WIPE for search/address boxes (data-loss-free).
• Provider failover + liveness gates so cycling never lands on a dead/keyless provider.

Security & privacy
No servers, no telemetry; your text goes only to the provider you configured. LLM output is never wired to any action — worst case it's user-visible draft text you review before sending. Identity context defaults to safe mode (PII tokenized on your machine). This release also hardened the Bun-subprocess blank sandbox, the OS-action scripts, and closed 9 dependency advisories.

📖 Full detail

Every per-package change is in CHANGELOG.md. The open standard is at spec/ (SPEC_VERSION 0.10-alpha).

---

Checkpoint 2026-06-25 — BlankIntent + countries offline dataset

Source checkpoint (not an npm publish — all packages remain private; the npm handover is tracked in docs/launch/npm-handover.md). This tag marks a known-good snapshot of master.

Highlights

• BlankIntent (blank-intent-mode, OFF by default) — an LLM invocation gate for keyword script-blanks: prose that merely mentions a blank keyword CEDEs; real invocations INVOKE. Includes:
  • Line-scoped Phase-1 via a single shared keywordInWindow predicate across all five claim/cede sites (BlankFill + BlankSource + FluidBlank/Transform/ConfigIntent) — proximity tuning becomes irrelevant when the gate is on, with no source able to drift out of lockstep.
  • Typed get/set/step — volume 30 _ sets, volume up _ / brightness down _ step by blankStep, with 0–100 clamping; keyword consent unchanged; non-settable/lookup blanks degrade to get.
• countries blank — moved to a bundled offline dataset (restcountries.com fully deprecated its API). Offline, instant, immune to further API death.

Packages at this tag

@opencues/core 0.5.1 · @opencues/runtime 0.4.4 (others unchanged)

Verification

Unit: core 911 / runtime 1719. Agentic: 83/83 (69 gate-off regression + 14 BlankIntent). CC patch-boot + bundle-integrity gates green.

Full detail: see CHANGELOG.md § [2026-06-25].