v1.1.1

Highlights

• Sandbox mounts are the file-tool boundary: host file tools (read, edit, write, patch) are fenced to the sandbox mounts, and the external_directory permission rules are dropped from the loop and audit rulesets. A single boundary now governs both in-container and host file access.

What's Changed

• refactor(sandbox): make sandbox mounts the file-tool boundary (#103)

v1.1.0

Requirements

• OpenCode 2.x is required. Forge now targets OpenCode 2.x only (engines.opencode is >=2.0.14). OpenCode 1.x is no longer supported: the V1-only plugin surfaces were removed. Upgrade OpenCode before installing this release.

Highlights

• OpenCode 2.x support on a shared host-neutral core: createForgeCore holds the handler bodies both hosts drive, so loop runtime, storage, sandbox, and tool logic stay single-sourced. src/index.ts and src/tui.tsx are thin adapters, and V2 differences are absorbed at the ForgeClient port, event normalization, and the hook adapters.
• Native worktrees and locations replace warp: loop sessions are created directly at location.directory = <worktree>, and session.move replaces warp. Loop metadata moves from the V1 workspace extra to <worktree>/.forge/workspace.json — git-excluded and deleted with the worktree, so no new table or migration is needed.
• V2 TUI: the execution dialog, loop restart, loop sidebar (capped at three loops), and loop-session deletion run on OpenCode 2.x, sharing the dashboard launcher and keybinds with the existing TUI surface.
• Installer: --link and --vendor write the cli.json plugins entry alongside the existing tui.json plugin entry, through one shared jsonc-edit implementation.
• Docs: README and docs/ cover the V2 entries, the worktree/location model, shell routing, and the install layout.

What's Changed

• feat(host): add OpenCode 2.x support on a shared host-neutral core (#102)
• refactor(v2): require OpenCode 2.x and remove 1.x-only surfaces
• feat(v2): add the execution dialog and loop controls to the V2 TUI
• feat(v2): restyle the loop sidebar and cap it at three loops
• feat(v2): delete retired loop sessions through the TUI
• fix(v2): align event mapping, toasts, and session usage with OpenCode 2.x
• fix(install): write the server plugin shim for --link and --vendor
• feat(sandbox): auto-approve permissions in sandboxed sessions

v1.0.3

Highlights

• Sandbox create fixed on msb 0.7.x: the sandbox cache disk moved from /opt/forge/.cache to /opt/forge/cache. msb >= 0.7.0 derives a named disk's device id from its guest mount path and rejects ids that are not [A-Za-z0-9_-]; the dot in the old path made every sandbox create fail with managed additional disk has an invalid or reserved device id. Rebuild the sandbox image after upgrading so the image env matches the new path.

What's Changed

• fix(sandbox): keep the cache disk guest path free of dots

v1.0.2

Highlights

• Sandbox cache disk: package and tool caches — including uv tool installs — now live on a dedicated disk mounted at /opt/forge/.cache; forge-cache-prune reclaims space without losing installed toolchains
• Unexecuted plans in the dashboard: projects holding only unexecuted plans appear in a collapsed Unofficial projects section with their plans inline; an unscoped /api/data payload ships those rows so they can be viewed and deleted, and the Plans section splits into Executed and Unexecuted blocks
• Restart with new models: the TUI loop restart dialog can change the execution (code) model and variant alongside the auditor settings; overrides persist on the loops row so continuation prompts use the new model
• Sandbox-accurate plan requirements: architect prompts now describe the real sandbox boundary and ban requirements that authenticate to or mutate systems outside it; auditor addenda treat such requirements as plan defects to amend via plan-adjust instead of findings the coder can never satisfy
• Focused docs: the README is condensed into focused docs with a refreshed loop diagram

What's Changed

• feat(dashboard): view and clean up unexecuted plans (#101)
• feat(loop): override execution model and variant on restart
• docs: condense README into focused docs and refresh loop diagram
• fix(prompts): forbid sandbox-unsatisfiable plan requirements
• feat(sandbox): mount tool caches on a dedicated block device (#100)

v1.0.0

First stable release of opencode-forge.

Highlights

• Durable audit handoffs: loop audit attempts are persisted with full audit snapshots, so a restart resumes the audit with the exact findings, evidence, and code state it started from instead of re-auditing from scratch; restarts from a stalled final audit rebuild their prompts from the persisted attempt snapshot
• Obscura replaces Chromium in the sandbox image: the image ships the Obscura headless browser (Rust, CDP-compatible with Puppeteer and Playwright) instead of the Playwright Chromium build, and the sandbox context note announces it with a pointer to obscura --help
• Tighter audit/fix convergence: verification evidence is reused only when command, outcome, environment, and code state all align; remediation is reproduction-first with shared root-cause ordering; delegated auditor subtasks are narrowly scoped and non-overlapping; coder decisions count as evidence, never an automatic waiver

What's Changed

• feat(sandbox): replace chromium with obscura in the sandbox image (#99)
• feat(loop): ship durable audit handoffs in 1.0.0
• feat(agents): restrict architect planning to the current repository boundary
• fix(storage): repair audit table after migration ID collision
• fix(loop): strengthen audit remediation and verification evidence rules (#98)

v0.9.4

Highlights

• Restart loops from the TUI: a new forge.loop.restart palette command restarts a running or stopped loop from persisted progress, with an auditor model and variant override chosen in the execution dialog; restartability is surfaced per loop so blocked restarts explain themselves
• Chromium ships in the sandbox image: the current Playwright Chromium build is installed unconditionally as chromium (Google publishes no linux/arm64 Chrome build, so Chromium is the arm64 equivalent of current Chrome), replacing the opt-in Browser Control payload, which is removed along with its sandbox.imageFeatures.browserControl option
• Usage-limit detection through wrapper errors: provider error extraction now prefers the message that matches the usage-limit pattern, so limits hidden behind a generic SDK wrapper message (with the real message in data.message) classify correctly

What's Changed

• feat(tui): restart loops from persisted progress with auditor model override
• feat(sandbox): ship Chromium in the image and drop browser control

v0.9.3

Highlights

• No autoscaling ceilings: sandbox.resources.memory and sandbox.resources.cpus now pin the sandbox for its whole life; msb's --max-memory/--max-cpus ceilings are deliberately not exposed, because agents run inside the sandbox and cannot call msb modify from the host, so a ceiling never rescues a failing in-sandbox build
• Sandbox environment probing: the loop probes host and container environments and leads sandbox notes with concrete transitions

What's Changed

• feat(sandbox): probe host and container environments to lead sandbox notes with concrete transitions
• refactor(sandbox): drop maxMemory/maxCpus boot ceilings

v0.9.2

Highlights

• Persisted findings are now the sole auditor-to-coder channel: coder prompts inline each finding's full detail (description, scenario, verification) directly, and auditor response prose is never replayed to the coder — the loop runner only parses the section-summary block
• review-read shares one finding renderer with coder prompts (formatFindingDetails), so findings read identically on every surface
• Auditor output economy: the loop addendum now requires a single verdict line on dirty audits instead of restating findings; audit prompts direct the auditor to review-read for existing findings rather than inlining them

What's Changed

• refactor(loop): inline persisted findings in coder prompts instead of auditor prose
• chore: bump version to 0.9.2

v0.9.1

Highlights

• Live session view in the dashboard: loop sessions stream in real time over SSE, with the live model summary rendered at primary text strength
• Change loop models from the dashboard: pick the execution and auditor models (and variants) per loop and apply them; changes persist to the loop configuration
• Plan amendment diffs: amendments are diffed and rendered in the dashboard
• Sandbox image pins the pnpm store via PNPM_CONFIG_STORE_DIR (pnpm 11 ignores npm_config_*), so the store no longer lands inside the project directory and gets committed by loop teardown
• Dashboard hardening: guarded loop POST routes, released SSE streams, stricter loopback host checks

What's Changed

• feat(dashboard): live session view and plan amendment diffs (#96)
• fix(dashboard): guard loop POST routes and release SSE streams
• fix(sandbox): pin pnpm store via PNPM_CONFIG_STORE_DIR
• fix(dashboard): harden loopback host checks and live view interactions
• chore: bump version to 0.9.1
• fix(dashboard): render live model summary at primary text strength

v0.9.0

Highlights

• msb sandbox driver replaces the sbx runtime: in-VM Docker, opt-in egress, and a plugin-dir installer (refactor(sandbox): replace sbx runtime with msb driver, #95)
• Sandbox images mount allowExternalDirectories read-only and ship build-essential
• Passwordless sudo for runtime package installs inside the sandbox
• Auditor persisted findings now require implementation-ready detailed solutions
• Indeterminate sandbox template checks are deferred and treated as non-fatal; keep-alive sentinel execs removed

What's Changed

• refactor(sandbox): replace sbx runtime with msb driver (#95)
• feat(sandbox): mount allowExternalDirectories read-only and ship build-essential
• feat(sandbox): grant passwordless sudo for runtime package installs
• feat(auditor): require implementation-ready detailed solutions in persisted findings
• fix(sandbox): defer indeterminate template checks
• fix(sandbox): remove keep-alive sentinel execs
• fix(sandbox): treat indeterminate availability probes as non-fatal