v1.0.3

Highlights

• Sandbox create fixed on msb 0.7.x: the sandbox cache disk moved from /opt/forge/.cache to /opt/forge/cache. msb >= 0.7.0 derives a named disk's device id from its guest mount path and rejects ids that are not [A-Za-z0-9_-]; the dot in the old path made every sandbox create fail with managed additional disk has an invalid or reserved device id. Rebuild the sandbox image after upgrading so the image env matches the new path.

What's Changed

• fix(sandbox): keep the cache disk guest path free of dots

v1.0.2

Highlights

• Sandbox cache disk: package and tool caches — including uv tool installs — now live on a dedicated disk mounted at /opt/forge/.cache; forge-cache-prune reclaims space without losing installed toolchains
• Unexecuted plans in the dashboard: projects holding only unexecuted plans appear in a collapsed Unofficial projects section with their plans inline; an unscoped /api/data payload ships those rows so they can be viewed and deleted, and the Plans section splits into Executed and Unexecuted blocks
• Restart with new models: the TUI loop restart dialog can change the execution (code) model and variant alongside the auditor settings; overrides persist on the loops row so continuation prompts use the new model
• Sandbox-accurate plan requirements: architect prompts now describe the real sandbox boundary and ban requirements that authenticate to or mutate systems outside it; auditor addenda treat such requirements as plan defects to amend via plan-adjust instead of findings the coder can never satisfy
• Focused docs: the README is condensed into focused docs with a refreshed loop diagram

What's Changed

• feat(dashboard): view and clean up unexecuted plans (#101)
• feat(loop): override execution model and variant on restart
• docs: condense README into focused docs and refresh loop diagram
• fix(prompts): forbid sandbox-unsatisfiable plan requirements
• feat(sandbox): mount tool caches on a dedicated block device (#100)

v1.0.0

First stable release of opencode-forge.

Highlights

• Durable audit handoffs: loop audit attempts are persisted with full audit snapshots, so a restart resumes the audit with the exact findings, evidence, and code state it started from instead of re-auditing from scratch; restarts from a stalled final audit rebuild their prompts from the persisted attempt snapshot
• Obscura replaces Chromium in the sandbox image: the image ships the Obscura headless browser (Rust, CDP-compatible with Puppeteer and Playwright) instead of the Playwright Chromium build, and the sandbox context note announces it with a pointer to obscura --help
• Tighter audit/fix convergence: verification evidence is reused only when command, outcome, environment, and code state all align; remediation is reproduction-first with shared root-cause ordering; delegated auditor subtasks are narrowly scoped and non-overlapping; coder decisions count as evidence, never an automatic waiver

What's Changed

• feat(sandbox): replace chromium with obscura in the sandbox image (#99)
• feat(loop): ship durable audit handoffs in 1.0.0
• feat(agents): restrict architect planning to the current repository boundary
• fix(storage): repair audit table after migration ID collision
• fix(loop): strengthen audit remediation and verification evidence rules (#98)

v0.9.4

Highlights

• Restart loops from the TUI: a new forge.loop.restart palette command restarts a running or stopped loop from persisted progress, with an auditor model and variant override chosen in the execution dialog; restartability is surfaced per loop so blocked restarts explain themselves
• Chromium ships in the sandbox image: the current Playwright Chromium build is installed unconditionally as chromium (Google publishes no linux/arm64 Chrome build, so Chromium is the arm64 equivalent of current Chrome), replacing the opt-in Browser Control payload, which is removed along with its sandbox.imageFeatures.browserControl option
• Usage-limit detection through wrapper errors: provider error extraction now prefers the message that matches the usage-limit pattern, so limits hidden behind a generic SDK wrapper message (with the real message in data.message) classify correctly

What's Changed

• feat(tui): restart loops from persisted progress with auditor model override
• feat(sandbox): ship Chromium in the image and drop browser control

v0.9.3

Highlights

• No autoscaling ceilings: sandbox.resources.memory and sandbox.resources.cpus now pin the sandbox for its whole life; msb's --max-memory/--max-cpus ceilings are deliberately not exposed, because agents run inside the sandbox and cannot call msb modify from the host, so a ceiling never rescues a failing in-sandbox build
• Sandbox environment probing: the loop probes host and container environments and leads sandbox notes with concrete transitions

What's Changed

• feat(sandbox): probe host and container environments to lead sandbox notes with concrete transitions
• refactor(sandbox): drop maxMemory/maxCpus boot ceilings

v0.9.2

Highlights

• Persisted findings are now the sole auditor-to-coder channel: coder prompts inline each finding's full detail (description, scenario, verification) directly, and auditor response prose is never replayed to the coder — the loop runner only parses the section-summary block
• review-read shares one finding renderer with coder prompts (formatFindingDetails), so findings read identically on every surface
• Auditor output economy: the loop addendum now requires a single verdict line on dirty audits instead of restating findings; audit prompts direct the auditor to review-read for existing findings rather than inlining them

What's Changed

• refactor(loop): inline persisted findings in coder prompts instead of auditor prose
• chore: bump version to 0.9.2

v0.9.1

Highlights

• Live session view in the dashboard: loop sessions stream in real time over SSE, with the live model summary rendered at primary text strength
• Change loop models from the dashboard: pick the execution and auditor models (and variants) per loop and apply them; changes persist to the loop configuration
• Plan amendment diffs: amendments are diffed and rendered in the dashboard
• Sandbox image pins the pnpm store via PNPM_CONFIG_STORE_DIR (pnpm 11 ignores npm_config_*), so the store no longer lands inside the project directory and gets committed by loop teardown
• Dashboard hardening: guarded loop POST routes, released SSE streams, stricter loopback host checks

What's Changed

• feat(dashboard): live session view and plan amendment diffs (#96)
• fix(dashboard): guard loop POST routes and release SSE streams
• fix(sandbox): pin pnpm store via PNPM_CONFIG_STORE_DIR
• fix(dashboard): harden loopback host checks and live view interactions
• chore: bump version to 0.9.1
• fix(dashboard): render live model summary at primary text strength

v0.9.0

Highlights

• msb sandbox driver replaces the sbx runtime: in-VM Docker, opt-in egress, and a plugin-dir installer (refactor(sandbox): replace sbx runtime with msb driver, #95)
• Sandbox images mount allowExternalDirectories read-only and ship build-essential
• Passwordless sudo for runtime package installs inside the sandbox
• Auditor persisted findings now require implementation-ready detailed solutions
• Indeterminate sandbox template checks are deferred and treated as non-fatal; keep-alive sentinel execs removed

What's Changed

• refactor(sandbox): replace sbx runtime with msb driver (#95)
• feat(sandbox): mount allowExternalDirectories read-only and ship build-essential
• feat(sandbox): grant passwordless sudo for runtime package installs
• feat(auditor): require implementation-ready detailed solutions in persisted findings
• fix(sandbox): defer indeterminate template checks
• fix(sandbox): remove keep-alive sentinel execs
• fix(sandbox): treat indeterminate availability probes as non-fatal

v0.8.8

What changed

• feat(sandbox): mount git metadata read-write and disable git hooks
• chore(prompts): keep code agent from calling destructive forge tools proactively

Sandboxed loops now mount the worktree and its git metadata directory read-write, so in-sandbox git (status, log, diff, commits) resolves against the real repository. Two guards keep that from becoming a path out of the sandbox: the git hooks directory is re-mounted read-only, and every git command Forge runs on the host disables core.hooksPath, so a sandboxed agent cannot plant a hook that the user's own git would execute.

The code-agent prompt now forbids calling execute-goal, execute-plan, launch-group, or loop-cancel proactively.

Full Changelog: v0.8.7...v0.8.8

v0.8.7

What's Changed

• chore(agents): rework auditor/architect prompts and drop impact-reviewer subagent (#93)

The dedicated impact-reviewer subagent is removed and whole-change impact analysis is folded directly into the auditor-loop audit workflow. Auditor and architect agent prompts are tightened around the minimal-design ladder and single-source-of-truth planning:

• Auditor-loop final audit rules now require a direct "Whole-Change Impact Analysis" covering duplication, parallel implementations, missed callers/companion updates, and unreachable/superseded code — no separate impact agent.
• The auditor findings lifecycle is simplified (read → manifest → reconcile → inspect → validate → persist) with review-write fields documented.
• Architect research/design steps mandate reusing existing code, the standard library, native platforms, or installed dependencies before new code; plans must name a single owner for shared behavior, prohibit parallel implementations, and demand explicit caller migrations and removal of obsolete code paths.

Full Changelog: v0.8.6...v0.8.7