v0.1.4 — security release

What's Changed

• feat(A5a): manual context compaction (/compact, /context) by @zjshen14 in #114
• chore(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #99
• chore(deps): bump tsx from 4.21.0 to 4.22.0 by @dependabot[bot] in #103
• chore(deps): bump diff from 8.0.4 to 9.0.0 by @dependabot[bot] in #105
• chore(deps): bump typescript-eslint from 8.58.0 to 8.59.3 by @dependabot[bot] in #106
• chore(deps): bump yaml from 2.8.3 to 2.9.0 by @dependabot[bot] in #107
• chore(deps): bump @clack/prompts from 0.9.1 to 1.4.0 by @dependabot[bot] in #108
• chore(deps): bump ora from 8.2.0 to 9.4.0 by @dependabot[bot] in #111
• chore(deps): bump commander from 13.1.0 to 14.0.3 by @dependabot[bot] in #110
• chore(deps): bump @anthropic-ai/sdk from 0.91.1 to 0.96.0 by @dependabot[bot] in #109
• fix(prune): prevent model-first history when fallback fires + add task workflow guide by @zjshen14 in #123
• fix(agent): abort loop on repeated environmental errors by @zjshen14 in #124
• chore(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #100
• chore(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #101
• chore(deps): bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in #98
• fix(sandbox): loosen auto profile so normal coding workflows succeed by @zjshen14 in #148
• fix(agent): retry once when LLM returns empty response mid-task by @zjshen14 in #131
• fix: friendly error for missing session id; guard stdin.ref() for non-TTY stdin by @zjshen14 in #132
• fix(mcp): validate --transport and guard interactive prompts behind isTTY by @zjshen14 in #133
• docs: sync eval default Gemini model and add billing note by @zjshen14 in #134
• fix(todo): nudge the agent to continue when pending items remain by @zjshen14 in #150
• fix(bash): unblock when backgrounded grandchildren hold stdio pipes by @zjshen14 in #152
• fix(resume): unblock Gemini thinking-model sessions + prune-anchor hardening by @zjshen14 in #154
• fix: read version from package.json and mention OpenAI in description by @zjshen14 in #129
• docs: add mcp/ layer and missing state files to Source Structure in CLAUDE.md / AGENTS.md by @zjshen14 in #160
• fix(compact): add gemini-3.x and gpt-4.1 to contextWindowFor lookup table by @zjshen14 in #158
• fix(runner): show error when edit tool fails instead of silently swallowing it by @zjshen14 in #162
• chore(deps): bump typescript from 5.9.3 to 6.0.3 by @dependabot[bot] in #138
• chore(deps): bump typescript-eslint from 8.59.3 to 8.59.4 by @dependabot[bot] in #139
• fix(resume): persist thoughtSignature in JSONL so resume matches live path by @zjshen14 in #163
• validate --max-turns and --temperature flags to prevent silent NaN by @zjshen14 in #130
• fix(gemini): strip control tokens from text stream (Bug A, #125) by @zjshen14 in #147
• feat(permissions): add configurable deny rules to the confirmation system by @zjshen14 in #156
• feat(sandbox): implement real strict mode for macOS and Linux by @zjshen14 in #155
• chore(deps): bump @types/node from 22.19.17 to 25.9.1 by @dependabot[bot] in #140
• chore(deps): bump @google/genai from 1.48.0 to 2.6.0 by @dependabot[bot] in #141
• chore(deps): bump eslint from 10.2.0 to 10.4.0 by @dependabot[bot] in #142
• chore(deps): bump jiti from 2.6.1 to 2.7.0 by @dependabot[bot] in #143
• chore(deps): bump openai from 6.35.0 to 6.39.0 by @dependabot[bot] in #144
• chore(deps): bump @anthropic-ai/sdk from 0.96.0 to 0.98.0 by @dependabot[bot] in #145
• fix(plan): skip auto-execute when run --plan produces a direct answer by @zjshen14 in #135
• feat: add /undo command to remove the last agent turn from history by @zjshen14 in #165
• feat(permissions): add ask rules to force confirmation for SAFE_COMMANDS by @zjshen14 in #164
• docs: sync CLAUDE.md and AGENTS.md source structure with actual codebase by @zjshen14 in #167
• docs: mark A5a as implemented in a5-compact-context.md by @zjshen14 in #178
• fix(sandbox): expand strict-mode read paths so the shell actually loads on macOS Tahoe + Homebrew by @zjshen14 in #179
• docs(architecture): document the deny pattern format added in #156 by @zjshen14 in #180
• prompt: strengthen parallel-tool-call rule with cost framing and example by @zjshen14 in #181
• fix(renderer): expand compact-tool results on error instead of green ✓ by @zjshen14 in #182
• fix(renderer): keep spinner alive across tool calls and LLM re-entries by @zjshen14 in #184
• feat(input): multi-line input with backslash + Enter continuation by @zjshen14 in #183
• docs(A5b): promote A5b to ready-for-implementation with Phase 2 design decisions by @zjshen14 in #189
• docs(readme): sharpen positioning and add a richer demo GIF by @zjshen14 in #190
• docs(readme): badges, star-history chart, contributor on-ramp by @zjshen14 in #192
• feat(A5b): auto-compact at turn boundary with safety gates by @zjshen14 in #191
• refactor(agent): extract run() loop body into focused helper methods by @zjshen14 in #199
• feat(tools): add Tool composition interface with multi_edit proof of concept by @zjshen14 in #193
• feat: expand bash SAFE_COMMANDS allowlist with common read-only utilities by @zjshen14 in #198
• feat(skills): add /changelog built-in skill by @zjshen14 in #200
• chore(deps): bump ws from 8.20.0 to 8.21.0 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #185
• chore(deps): bump qs from 6.15.1 to 6.15.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #186
• chore(deps): bump @protobufjs/utf8 from 1.1.0 to 1.1.1 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #187
• chore(deps): bump protobufjs from 7.5.4 to 7.6.1 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #188
• chore(deps): bump openai from 6.39.0 to 6.39.1 by @dependabot[bot] in #170
• chore(deps): bump prettier from 3.8.1 to 3.8.3 by @dependabot[bot] in #173
• chore(deps): bump tsx from 4.22.0 to 4.22.3 by @dependabot[bot] in #174
• chore(deps): bump @google/genai from 2.6.0 to 2.7.0 by @dependabot[bot] in #169
• chore(deps): bump @anthropic-ai/sdk from 0.98.0 to 0.100.1 by @dependabot[bot] in #171
• chore(deps): bump @clack/prompts from 1.4.0 to 1.5.0 by @dependabot[bot] in #175
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #201
• docs(readme): document OPENCLI_SYSTEM_MD and OPENCLI_MAX_TOOL_OUTPUT by @zjshen14 in #202
• fix(eval): substring-aware notContains + multi_edit scenario by @zjshen14 in #204
• docs(A5b): mark A5b as implemented in a5-compact-context.md by @zjshen14 in #203
• feat(eval): workflow_dispatch eval + first parity baseline by @zjshen14 in #205
• docs: add multi_edit and tool composition fields to source structure docs by @zjshen14 in #207
• fix(prompt): include multi_edit in write-tool reminder conditions by @zjshen14 in #208
• docs: fix architecture.md — add multi_edit to reminders and confirmation table by @zjshen14 in https://github.com/zjs...

v0.1.3

What's Changed

• feat(snapshot): auto git-snapshot before writes + /rewind REPL command (A3) by @zjshen14 in #91
• feat(renderer): expanded display for long outputs and errors (A6) by @zjshen14 in #92
• feat(cli): @file mention expansion + per-CWD input history (A4) by @zjshen14 in #94

Full Changelog: v0.1.1...v0.1.3

v0.1.1 — Provider Override & Sandbox Isolation

Highlights

🔀 Model-agnostic — Supports Google Gemini, Anthropic Claude, and any OpenAI-compatible provider out of the box. Switch with --model or --provider.

🛡️ OS-level sandbox isolation — Shell commands run inside sandbox-exec (macOS) or bwrap (Linux) by default. Network access denied; writes restricted to project root.

🧩 Extensible skill system — Compatible with the Agent Skills open standard. Built-in skills: /review, /explain, /debug, /test, /commit.

📋 Plan mode — Review changes before they're applied (/plan <task>). Read-only tool access during planning, full execution after approval.

⚡ Lightweight — No heavy framework. Just npm install -g @zjshen/opencli and go.

What's New in v0.1.1

• Explicit --provider and --base-url flags for connecting to any OpenAI-compatible API
• Sandbox isolation for bash tool (macOS sandbox-exec, Linux bwrap)
• Stuck-loop detection (aborts after 3 identical consecutive tool calls)
• Session management (resume conversations with --resume)
• MCP client integration (load external tool servers from mcp.json)

Install

npm install -g @zjshen/opencli

Links

• Documentation
• Contributing Guide
• Architecture