@joe-broadhead/opencode-github 0.0.0 → 0.0.1

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.1] - 2026-11-03
+
+### Added
+
+- The tools RPC, `github.platform.tools`: a script can call GitHub's known MCP reads, and `api` (`github_api` limited
+  to REST GET and HEAD and single GraphQL queries), with no model, through `opencode api`, as a session and its agent.
+  It gets exactly the access that agent's model has: a tool its rules hide is refused, OpenCode checks each MCP call
+  against the agent's and the session's rules, and an ask is refused at once because no one is there to answer it.
+  `describe` lists the methods with each tool's live input schema. GitHub's writes, `ui_get` and any tool GitHub adds
+  later are never methods, and `api` refuses changes, downloads and uploads with `SCRIPT_READ_ONLY` before any
+  request. With `host` (GitHub Enterprise Server) only `api` runs. `docs/scripting.md` explains it.
+
+### Changed
+
+- `check_dependency_vulnerabilities`, which GitHub's hosted server now lists in the `dependabot` toolset, is a known
+  read: it looks up a list of packages in the GitHub Advisory Database and changes nothing, so it runs without a
+  prompt, and `/github-status` no longer lists it as unknown.
+
 ## [0.0.0] - 2026-11-01
 
 ### Added

package/README.md

@@ -82,6 +82,17 @@ Three skills come with it:
 
 Each skill reports findings and changes nothing on GitHub unless you ask.
 
+**Scripts.** A script or a cron job can call GitHub's read tools and `github_api`'s reads with no model, through
+`opencode api`. It runs as a session and its agent, under that agent's permission rules and the session's own.
+Scripts can never change anything on GitHub:
+
+```sh
+opencode api post /api/rpc/github.platform.tools/pull_request_read \
+  -d '{"input":{"sessionID":"ses_…","input":{"method":"get","owner":"OWNER","repo":"REPO","pullNumber":42}}}'
+```
+
+See [Scripting](https://github.com/joe-broadhead/opencode-github/blob/HEAD/docs/scripting.md).
+
 **Status.** `/github` in the TUI, or **GitHub: Status** in the command palette, opens a dialog with the state, the
 account and access, the tools (with the names of any the plugin does not know yet), the agents that miss the default
 rules with the rules to paste, the OpenCode check and the next step. `r` refreshes it and `Esc` closes it. It also
@@ -224,6 +235,9 @@ Error codes:
 | `OPTIONS_INVALID` | An option is unknown or has a wrong value; the message names it. Fix that option for the plugin in `opencode.json`. |
 | `SIGN_IN_…`, `TOKEN_…`, `DEVICE_…`, `CLIENT_ID_UNKNOWN` | Sign-in failed. The message ends with the next step; [the error codes](https://github.com/joe-broadhead/opencode-github/blob/HEAD/docs/configuration.md#errors) list them all. |
 
+A script's errors from the tools RPC have their own codes, listed in
+[Scripting](https://github.com/joe-broadhead/opencode-github/blob/HEAD/docs/scripting.md#errors).
+
 Other problems:
 
 | You see | What to do |
@@ -245,6 +259,8 @@ Other problems:
 
 - [Configuration](https://github.com/joe-broadhead/opencode-github/blob/HEAD/docs/configuration.md): options,
   toolsets, permission rules and error codes.
+- [Scripting](https://github.com/joe-broadhead/opencode-github/blob/HEAD/docs/scripting.md): calling GitHub's reads
+  from scripts, with no model.
 - [Security](https://github.com/joe-broadhead/opencode-github/blob/HEAD/SECURITY.md): network endpoints,
   credentials, untrusted content and reporting a vulnerability.
 - [Contributing](https://github.com/joe-broadhead/opencode-github/blob/HEAD/CONTRIBUTING.md): development, checks