oy-cli 0.14.11

Focused coding agent integrations with repeatable audits, reviews, and one-finding fixes
Documentation

oy

Crates.io docs.rs

A focused OpenCode agent with repeatable audits, code reviews, and one-finding fixes.

oy helps OpenCode review a repository without quietly choosing a small sample. It prepares an ordered, reviewable set of files, lets the selected model analyze them under OpenCode's permissions, and verifies the report before writing it.

What you get

  • oy audit for security-focused repository audits (ISSUES.md or SARIF)
  • oy review for whole-workspace or target-diff code reviews (REVIEW.md)
  • oy enhance for fixing one reported finding at a time
  • one concise oy coding agent plus /oy-audit, /oy-review, and /oy-enhance inside OpenCode
  • Cursor models inside OpenCode through the official Cursor SDK

OpenCode owns models, credentials, sessions, and general tools. oy adds the evidence and report workflow; it is not a second agent runtime or permission system. One important exception: cursor/* models run Cursor's own local agent tools outside OpenCode's permission system.

Quick start

Requirements: Linux or macOS (WSL2 on Windows), oy on PATH, and a supported OpenCode 2 installation.

curl -fsSL https://oy.adonm.dev/install.sh | sh
# Choose global or current-workspace mise installation when prompted.
oy doctor --check

# Optional: use your Cursor subscription models in OpenCode.
# Run /connect in OpenCode, choose Cursor, and paste a Cursor API key.

cd your-repository
oy audit

Use --global or --workspace to skip the mise scope prompt.

The installer uses mise for prebuilt oy, Node.js, OpenCode, and context helpers. Review the installer before piping it to a shell.

Prefer a manual install or project-local setup? See Getting started.

Common workflows

Audit a repository

oy audit                                  # writes ISSUES.md
oy audit src/auth                         # audit one path
oy audit "authentication boundaries"     # apply a focus lens
oy audit --format sarif --out oy.sarif

A single argument that exactly matches a workspace path narrows collection. Other text is treated as review guidance.

Review code

oy review                                 # review the collected workspace
oy review main                            # review git diff main
oy review main --focus "error handling"

A branch, commit, tag, or ref selects target-diff review. Without a target, oy reviews the workspace.

Fix one finding

oy enhance review-0123456789abcdef
# Confirm the result by rerunning the originating workflow.
oy review main

Reports include stable finding IDs. oy enhance confirms the cited source, makes one focused fix, and runs the narrowest available verification.

You can run the same workflows inside OpenCode with /oy-audit, /oy-review, and /oy-enhance.

How repeatable review works

  1. Prepare: oy collects eligible repository text or a Git diff into ordered files under .oy/runs/.
  2. Review: OpenCode reads every prepared chunk and writes a candidate report.
  3. Verify: oy rejects changed inputs, modified evidence, concurrent report changes, or malformed findings.
  4. Finalize: oy writes normalized Markdown or SARIF with stable finding metadata.

The inputs are deterministic; the conclusions are not. Model choice and prompt quality still affect findings.

“Every chunk” means every chunk collected by oy, not every byte in the repository. The collector excludes ignored/hidden paths, dependencies and build output, lockfiles, likely secrets, binary or unreadable files, and files larger than 512 KiB. See Coverage and limits before using a report for high-assurance work.

Safety

oy is not a sandbox. Prepared source may be sent to your configured model provider. cursor/* uses Cursor tools outside OpenCode permissions; use a disposable environment for untrusted repositories and read SECURITY.md.

Documentation

Run oy <command> --help for the installed version's exact flags.