v2.1.0

HTTP status on the protocol trace, structured CLI errors, and a
validate-the-client agent skill.

Breaking change

error events are objects (error, optional status,
error_description), not a string. Nested request.response includes
HTTP status plus the parsed body.

Highlights

• Skill workflow is “validate this client”: expected denials can pass;
  user-supplied issuer / client_id / redirect is the default path
• --redirect-uri is an alias of --redirect-url
• Help text: --callback-addr is the local bind, --audience is access-token
  aud, --prompt is OpenID Connect prompt
• Opaque or JWE access tokens are a successful token response

v2.0.1

Windows installer fix, JSON-lines CLI errors, and skill validation.

Highlights

• Windows installer accepts the v2.0.0 .tar.gz and prefers .zip on newer releases (GoReleaser now publishes Windows ZIP)
• Unknown flags, missing args, and SIGINT/SIGTERM write {"error":"..."} on stderr; --silent still prints those errors
• go install builds report the module version from build info instead of master
• Agent skill requires oauth2c version 2., documents the missing-nonce exception, and includes license: Apache-2.0 (gh skill publish --dry-run passes)

v2.0.0

JSON-lines protocol trace, an agent skill, and installers that do not need Go.

Breaking change

stderr is JSON lines (one object per event), not YAML. Token JSON on stdout
is unchanged. For a YAML view of the trace, install
yq (brew install yq) and pipe stderr
through yq -p json -o yaml.

Highlights

• JSON-lines protocol trace on stderr; --silent still keeps only token JSON on stdout
• Empty flags fail at the CLI (for example --client-id "$UNSET") before any HTTP call
• Required grant and auth fields (client-id, secrets, tokens) are checked up front
• Agent skill at skills/oauth2c
• Install without Go:

curl -fsSL https://raw.githubusercontent.com/sukujgrg/oauth2c/master/scripts/install.sh | sh

irm https://raw.githubusercontent.com/sukujgrg/oauth2c/master/scripts/install.ps1 | iex

v1.0.0

First public release of this educational fork of cloudentity/oauth2c.

This is a new version line, not a continuation of upstream v1.20.x. The Go module is github.com/sukujgrg/oauth2c.

Highlights

• Educational YAML protocol trace on stderr (tokens, checks, and JWT contents)
• Flags-only CLI: TUI and extra UI dependencies removed
• --silent keeps stdout as machine-readable token JSON
• ID token nonce, signature, and claims validation
• Opaque access tokens logged without assuming JWT shape
• Self-serve Auth0 demo tenant (scripts/setup-auth0.sh) and live grant tests
• Module path, CI, and Go 1.26 encoding/json/v2 (GOEXPERIMENT=jsonv2)