oy-cli 0.14.11

Focused coding agent integrations with repeatable audits, reviews, and one-finding fixes
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

# @oy-cli/opencode

OpenCode plugin for [oy](https://github.com/adonm/oy-cli): a focused coding agent with repeatable audits, code reviews, and one-finding fixes.

> This package is the OpenCode integration. Install the `oy` CLI as well; the audit/review skills call its local `prepare` and `finalize` commands.

## Install

The recommended path installs matching CLI and plugin versions:

```bash
cargo install oy-cli --locked
oy setup
```

`oy setup` registers the matching package version in OpenCode config so OpenCode installs the plugin and its Cursor SDK dependencies. To configure the package manually instead, add it to an OpenCode JSON/JSONC file:

```jsonc
{
  "$schema": "https://opencode.ai/config.json",
  "plugins": ["@oy-cli/opencode@0.14.11"]
}
```

Restart OpenCode after changing the package version.

The package pins `undici@6.28.0` through npm overrides because the current
Cursor SDK release still requests the vulnerable 5.x line indirectly through
Connect. Run `npm audit --omit=dev` after dependency changes.

## What it registers

- one primary agent: `oy`;
- skills: `oy-audit`, `oy-review`, and `oy-enhance`;
- slash commands: `/oy-audit`, `/oy-review`, and `/oy-enhance`;
- a Cursor provider and `cursor/*` models backed by oy's OpenCode V2-focused
  [`opencode-cursor` fork](https://github.com/adonm/opencode-cursor) and the
  official Cursor SDK.

Run `/connect`, choose **Cursor**, and paste an API key from the Cursor dashboard. The live models available to that key then replace the fallback Cursor catalog.

Oy defaults the provider's idle-stream watchdog to 120,000 ms (2 minutes), with
a separate 600,000 ms budget while a Cursor tool is running. Set
`OPENCODE_CURSOR_STALL_MS` or `OPENCODE_CURSOR_TOOL_STALL_MS` explicitly to
override those budgets, or to `0` to disable the corresponding bound.

The provider retries a terminal failure once on a fresh agent only when no
output has reached OpenCode, removes failed agents from the session pool, and
includes Cursor SDK terminal error details and update counts in the final error.
The bridge validates complete text/reasoning/tool lifecycles, sends SSE
heartbeats, respects response backpressure, aborts active runs during shutdown,
and bounds retained tool history by age, entry count, and bytes.

OpenCode 2 accepts Cursor through an authenticated loopback OpenAI Responses bridge. The bridge binds only to `127.0.0.1`, uses a random per-process token, and forwards each request into the official Cursor local-agent runtime. It preserves one Cursor agent per OpenCode session, carries Cursor token/cache usage back to OpenCode without double-counting cached input, mirrors the three bundled oy skills into the active workspace, and exposes Cursor-native `explore`, `general`, and `reviewer` subagents. Select the `plan` model variant to use Cursor plan mode.

For a live smoke test against this checkout, run `CURSOR_API_KEY=... just opencode-dev`, connect Cursor if prompted, select a `cursor/*` model, and ask it to read a file without editing. Set `OPENCODE_CURSOR_DEBUG=1` to inspect provider retry/session diagnostics; never paste the key into a config file or report output.

Cursor-specific settings under `providers.cursor.request.body` are forwarded to the local agent. Supported settings include `cwd`, `sandbox`, `autoReview`, `settingSources`, `agents`, `mcpServers`, `session`, `systemPrompt`, `toolDisplay`, and `transport`. An explicit absolute `cwd` wins; otherwise the bridge follows the current absolute OpenCode working directory. Either may be outside the initial workspace so multi-repository workflows work as requested. Use an external container or VM when host isolation is required. Static MCP launch specifications are supported; OpenCode's live MCP connection state and permission prompts cannot cross the Cursor boundary in the current V2 plugin API.

No-tool requests are no longer assumed to be disposable side calls. The
provider's transcript classifier keeps normal tool-less conversations reusable;
an integration can opt into an ephemeral call explicitly with Responses
metadata `{ "oy_ephemeral": "true" }`.

The plugin defines no permission rules. `cursor/*` uses Cursor tools outside OpenCode permissions; read the [security policy](https://github.com/adonm/oy-cli/blob/main/SECURITY.md) before selecting one.

Audit and review prepare ordered workspace-local evidence, require the agent to read every prepared chunk, and verify the final report. Model conclusions remain nondeterministic.

## Requirements

- OpenCode 2 compatible with this package version;
- the matching `oy` CLI on `PATH`;
- Linux or macOS (use WSL2 on Windows).

See the [oy documentation](https://oy.adonm.dev/) for setup, workflows, compatibility, and security guidance. Maintainer publishing instructions are in [`docs/npm-publishing.md`](../../docs/npm-publishing.md).