v2.5.2

Changed

• Bumped @opencode/client to 2.2.5.
• Verified with OpenCode V2 2.2.5.

v2.5.1

Security

• Bumped @opentui/core and @opentui/solid to 0.8.1 and solid-js to
  1.9.18. A consumer install now gets seroval 1.6.12, past
  GHSA-97r2-qh9m-474h, GHSA-wp97-x4hv-qvhp, GHSA-7rv5-mrxv-xcr9,
  GHSA-p6vx-979v-rg4c and GHSA-jp82-f5mq-hwhp, and @babel/core 7.29.7, past
  GHSA-4x5r-pxfx-6jf8. The consumer npm audit gate no longer admits any
  residual advisory.

Fixed

• Commands that usually only read are no longer labeled read-only when they
  write or run something. sort now recognizes -o inside a short-option
  cluster (sort -uo FILE), attached (-nruoFILE), and as an abbreviated
  long option (--out=FILE), and --compress-program as code execution.
  uniq and xxd now report their second operand as a write, tree reports
  -o FILE and -R, and yq reports -i inside a cluster (-iP) and
  --inplace=true. Before, enforced policy rules on writes or code execution
  did not match these forms, and the reviewer was told the command was
  read-only.
• On OpenCode V2, the TUI's fallback theme is a fresh copy on every call, so a
  caller that mutates the returned theme no longer changes it for later
  renders.

Changed

• The minimum Bun is now 1.3.14 (engines.bun), the floor declared by
  @opentui/core 0.8. Every supported OpenCode host already embeds Bun 1.3.14
  or later, so plugin installs inside OpenCode are unaffected. CI now runs
  1.3.14 and 1.4.4.
• Verified with OpenCode V1 1.19.5.

v2.5.0

Added

• Liquid AI liquid-ai/d1 and liquid-ai/d1-ultra as System One reviewer
  models, with the key read from LIQUID_API_KEY. A key that is not shaped
  like a Liquid AI key (liquid_ prefix) is never sent; the review follows the
  failure settings instead. Liquid keys are also redacted from reviewer evidence
  (#94, thanks @giannisCKS). On the synthetic benchmark, liquid-ai/d1-ultra is
  recommended and liquid-ai/d1 is not; see the README for its settings.
• Baseten's mammoth-1 and elephant-1 decision models as System One reviewer
  models (baseten/decision-models/baseten-mammoth-27b-latest and
  baseten/decision-models/baseten-elephant-9b-latest), with the key read from
  BASETEN_API_KEY.
• The README's TypeSafe AI route now names typesafe-ai/jev-1.14.0, the release
  evaluated on the synthetic benchmark.

Fixed

• OpenCode session IDs in reviewer evidence (intent, actor, and lineage) are no
  longer masked as credentials, so the reviewer can tell which session each
  piece of intent came from. Other values assigned to session keys are still
  redacted.
• On OpenCode V2, package script evidence starts from the shell command's
  workdir, resolving relative paths against the session directory, instead of
  always using the session directory. The workdir is followed to its real
  path, as package managers do, and one that is not an existing directory marks
  the scripts as unresolved rather than reporting another manifest. Reads stay
  within the approved evidence roots.

Changed

• Bumped the @opencode/client runtime dependency to 2.1.4.
• Bumped the zod runtime dependency to 4.6.7.
• Verified with OpenCode V1 1.19.4 and V2 2.1.3.

v2.4.3

Fixed

• On OpenCode V2, run reviews with the model's own default when the reviewer
  model does not offer the built-in medium variant. Models without variants,
  such as opencode-go/mimo-v2.6-flash, previously made every review fail
  closed. An explicitly configured variant the model lacks still fails closed,
  and the reason now lists the variants the model offers.

Changed

• Bumped the @opencode/client runtime dependency to 2.0.28, which moves
  effect from 4.0.0-rc.112 to the stable 4.0.1.
• Verified with OpenCode V1 1.19.0 and V2 2.0.28.
• Documented that free OpenCode Zen models cannot act as the reviewer: Zen
  rejects the sessions the plugin creates, so every review falls back to a
  manual prompt.

v2.4.2

Fixed

• Keep MCP servers out of the OpenCode V1 reviewer location when plugins from
  config sources applied after it (OPENCODE_CONFIG_CONTENT,
  OPENCODE_CONFIG_DIR, the global plugin directory) add them from their config
  hooks. Those servers previously started inside the reviewer location and made
  every review fail closed.

v2.4.1

Fixed

• Keep MCP servers that other plugins add from code, such as
  @upstash/context7-opencode, out of the OpenCode V2 reviewer Location. They
  previously made every review fail closed. (#74, thanks @cris005)

Changed

• Bumped the @opencode/client runtime dependency to 2.0.26.

Security

• Documented a residual advisory in the installed dependency tree: npm audit
  reports GHSA-p6vx-979v-rg4c and GHSA-jp82-f5mq-hwhp in seroval, reached
  through solid-js@1.9.12, which @opentui/solid pins exactly. seroval is
  only imported by the SSR renderer solid-js/web, which this package never
  loads, so the vulnerable code is not reachable. See the README for details.

v2.4.0

Added

• Git remote evidence for network subcommands: git push, fetch, pull,
  ls-remote, and git remote now report each remote operand as a configured
  remote (with the push/fetch URLs it resolves to, credential userinfo
  redacted), a literal URL, or unmatched, plus the default remote an
  operand-less command would contact. The reviewer judges the destination
  from this evidence instead of treating an unresolved alias as unknown.

• Recognize deno and tsx as local script interpreters, attaching the
  executed file as evidence for direct invocations (deno <file>,
  tsx <file>), deno run/serve/watch, and tsx watch file targets. Deno
  tasks, package specifiers (jsr:/npm:/URLs), manifest scripts, and
  ambiguous option forms gather no evidence rather than risk attaching the
  wrong file. Node-family value flags (--test-reporter-destination and
  siblings) are skipped for node and tsx for the same reason.

• Inspect manifest definitions and bounded local script chains for Bun, npm,
  pnpm, and Yarn script invocations. Referenced local code and conditional
  lifecycle hooks are included as evidence without executing package code or
  assuming the invocation needs network access.

Changed

• Verify compatibility with OpenCode V1 1.18.34 and V2 2.0.21.
• No lifecycle scripts ship with the package: the prepare build hook is
  gone, so installs execute nothing from this repository. The npm registry is
  the supported install source (Git/local installs yield a package without
  dist/); build from source explicitly with bun install && bun run build.

Fixed

• Attach local script evidence only for the executed interpreter, preserve
  leading-dash file names after --, and inspect equally named scripts in
  different working directories separately. Remote commands and interpreter
  mentions no longer attach unrelated local code.
• Resolve Git repository evidence only for a local Git executable; remote
  commands and command mentions no longer inherit the local repository's state
  or configured destinations.
• Prevent OpenCode V1's isolated reviewer location from starting another copy
  of globally configured MCP servers. Its local bootstrap excludes MCP, and
  reviews fail closed if the host reports servers or an invalid inventory.
  Isolation files are replaced atomically and reject links and special files.
  Thanks @jg33 for the fix (#62).
• Preserve reviewer cancellation and timeout errors across garbage collection,
  including waits admitted after a review has already ended.
• Normalize shell redirections before resolving executables, including glued,
  leading, file-descriptor, clobber, and command-string forms. Redirections can
  no longer hide root destruction, credential reads, network clients, or
  external write targets; heredoc payload text is no longer treated as an
  executed command.
• Classify git add, remote/config/ref mutations, fetch/pull, dd of=...,
  attached sort -o..., and writes inside worktrees under temporary roots with
  their actual mutation, network, and path effects.
• Treat V1 inline plugin options as unknown-origin input, matching V2, and keep
  reviewer selection, policy, resource limits, and debug logging under trusted
  global configuration.
• Redact URL userinfo even when a credential occupies only the username slot,
  and block GitHub config and token-shaped content from file enrichment.
• Refuse symlinked config files in init; planning, backups, and updates now
  hold a no-follow regular-file descriptor through their operation. Config
  parsing and change detection use the same file snapshot.
• Recognize shell -c flag clusters, options after -c, exec, clustered SSH
  flags, and value-taking wrapper options so they cannot hide destructive
  commands from the emergency brake. Direct cp and install overwrites of
  block devices are also rejected.
• Preserve file mutation effects for target-directory options, optional
  option values, rename operands, implicit link destinations, and rsync
  source removal.
• Keep relative cd targets unresolved when the preceding working directory
  is ambiguous, instead of throwing or assuming the initial directory.
• Resolve attached and trailing Git push --repo overrides, and redact URL
  passwords before bounding evidence, including unavailable Git snapshots.
• Withhold Git snapshots when a successful status process returns incomplete
  output, preserving the planned action without inventing repository state.
• Include the executed file as local script evidence for bun run <file>
  commands; package manifest scripts (bun run check) and bun option values
  are not mistaken for the run target.
• Emergency brake: peel systemd-run, strace, ltrace, and script -c
  wrappers (including clustered value-taking options such as sudo -nu root
  and env -iS), treat a live root glob (rm -rf /*) as root destruction,
  and reject shell redirections onto real block devices (> /dev/sda,
  glued 2>/dev/sda, tee /dev/sda) in direct and command-string forms.
• Audit records always land in a mode 0600 file: a pre-existing audit path
  with looser permissions is tightened before receiving new records instead of
  being extended as-is.
• Recover literal user intent after long operational histories, compaction,
  and host restarts, while keeping synthetic control messages and inherited
  fork messages out of direct authorization evidence.

v2.3.1

Fixed

• Prevent OpenCode V2 permission reviews from starting additional configured
  MCP processes for each review. Reviews now share an isolated Location without
  MCP servers while keeping their sessions independent.
• Retry reviewer Location setup after a transient failure and clean up reviewer
  hooks registered after a Location reload.

Thanks to @Movoid for the detailed report in #52.

v2.3.0

Added

• Add Jev as a reviewer model choice through OpenCode Zen, TypeSafe AI, or the
  Command Code Provider API. Use Jev alone, or configure a second LLM such as
  Luna for difficult decisions. See the Jev setup
  guide.

Changed

• Default to GPT-6 Luna at medium effort and share trusted V1 reviewer settings
  between the server and TUI.
• Verify compatibility with OpenCode V2 2.0.15.

v2.2.1

Changed

• Verify compatibility with OpenCode V1 1.18.32 and V2 2.0.14, update the
  matching SDK and client packages, update Zod, and refresh the documented
  support matrix.