Repository navigation
[superseded] feat(auto-advisor): add OpenCode Auto Advisor - #54
Closed
capyBearista wants to merge 143 commits into
Closed
capyBearista wants to merge 143 commits into
capyBearista wants to merge 143 commits into
Conversation
Version Packages
Unifies all three package READMEs structures.
CI workflow now uses paths-ignore to skip on *.md, docs/, .github/assets/, .changeset/, CONTRIBUTING.md, and LICENSE* changes. Release workflow uses a paths allowlist so it only runs when package source, changesets, lockfile, or workflow files actually change.
Updated logo display in README with responsive images.
Clarify CONTRIBUTING.md
Version Packages
Set up four layers of GitHub security scanning for this public monorepo: Dependabot for automated dependency vulnerability alerts. CodeQL for static analysis of TypeScript code. SHA-pinned actions to prevent supply chain attacks via tag mutation. Also fixes a pre-existing bug where the cache key referenced the old binary lockfile format (bun.lockb) that does not exist, causing every CI run to miss the cache and do a full install. - .github/dependabot.yml: monitor bun + github-actions ecosystems with weekly grouped updates to reduce PR fatigue - .github/workflows/codeql.yml: security-and-quality query suite on push/PR to main and weekly cron - .github/workflows/ci.yml: SHA-pin all actions, fix bun.lockb cache key - .github/workflows/release.yml: SHA-pin all actions, fix bun.lockb key Secret scanning and push protection are UI-based settings that must be enabled manually in the repo's Advanced Security settings.
Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.5` | | [github/codeql-action](https://github.com/github/codeql-action) | `c3f298df8c1fea2fefe20c785e6aa00f32df8260` | `e46ed2cbd01164d986452f91f178727624ae40d7` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.4.0` | | [changesets/action](https://github.com/changesets/action) | `e87c8ed249971350e47fab7515075f44eb134e5b` | `6a0a831ff30acef54f2c6aa1cbbc1096b066edaf` | Updates `actions/checkout` from 4.3.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) Updates `actions/cache` from 4.3.0 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...27d5ce7) Updates `github/codeql-action` from c3f298df8c1fea2fefe20c785e6aa00f32df8260 to e46ed2cbd01164d986452f91f178727624ae40d7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c3f298d...e46ed2c) Updates `actions/setup-node` from 4.4.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...48b55a0) Updates `changesets/action` from e87c8ed249971350e47fab7515075f44eb134e5b to 6a0a831ff30acef54f2c6aa1cbbc1096b066edaf - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](changesets/action@e87c8ed...6a0a831) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action dependency-version: e46ed2cbd01164d986452f91f178727624ae40d7 dependency-type: direct:production dependency-group: actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: changesets/action dependency-version: 6a0a831ff30acef54f2c6aa1cbbc1096b066edaf dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the development-dependencies group with 2 updates: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) and [turbo](https://github.com/vercel/turborepo). Updates `@biomejs/biome` from 2.4.13 to 2.4.14 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.14/packages/@biomejs/biome) Updates `turbo` from 2.9.7 to 2.9.8 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.7...v2.9.8) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.4.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: turbo dependency-version: 2.9.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Version Packages
…ions-396b4c3574 chore(deps): bump the actions group with 5 updates
…pendencies-10f7b88162 chore(deps-dev): bump the development-dependencies group with 2 updates
… 2 updates Bumps the major-updates group with 2 updates in the / directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript](https://github.com/microsoft/TypeScript). Updates `@types/node` from 22.19.17 to 25.6.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `typescript` from 5.9.3 to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.3) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.6.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the actions group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [changesets/action](https://github.com/changesets/action). Updates `github/codeql-action` from 4.35.3 to 4.35.5 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...9e0d7b8) Updates `changesets/action` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](changesets/action@6a0a831...63a615b) --- updated-dependencies: - dependency-name: changesets/action dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
…ectory with 8 updates dependabot
… 2 updates Bumps the major-updates group with 2 updates in the / directory: [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) and [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional). Updates `@commitlint/cli` from 20.5.3 to 21.0.1 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.0.1/@commitlint/cli) Updates `@commitlint/config-conventional` from 20.5.3 to 21.0.1 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.0.1/@commitlint/config-conventional) --- updated-dependencies: - dependency-name: "@commitlint/cli" dependency-version: 21.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@commitlint/config-conventional" dependency-version: 21.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com>
… 2 updates dependabot
Bumps the production-dependencies group with 1 update in the / directory: [yaml](https://github.com/eemeli/yaml). Updates `yaml` from 2.8.4 to 2.9.0 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.4...v2.9.0) --- updated-dependencies: - dependency-name: yaml dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
…cies group across 1 directory dependabot
Prepare both plugins at 2.0.0 with guarded opencode2 releases, frozen V1 latest tags, native entrypoints, and updated documentation. BREAKING CHANGE: loader and timeline 2.0.0 require OpenCode V2; their V1 releases remain frozen on latest.
Agent guidance lagged the V2 port: loader and timeline shipped on the opencode2 channel with no paired AGENTS.md updates, and the root contract taught phantom paths alongside pre-V2 1.15.x rules as current. Context: - Root AGENTS.md scopes 1.15.x rules to V1, adds V2 boundary with port-status table pointing at docs/v1-plugins.md - Loader/timeline AGENTS.md rewritten around the real V2 surface and entries - Remaining packages carry accurate file maps plus V1-only labels
This was referenced Sep 25, 2026
12 of 14 tasks
capyBearista
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Active work
The governing design has also changed since this PR was opened, including the OpenCode 2.0.18 baseline, optional sparse
auto-advisor.json, Zen-only v1 routing, ordered free->paid System One fallback, configurable consultations-per-turn budget, plugin-storage telemetry/RPC export, and consolidation of #49/#51/#52 into the active contracts.See #61 and
docs/plans/opencode-auto-advisor.mdonfeat/auto-advisorfor the current plan.