backeer-opencode 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to `backeer-opencode` are documented here.
 
+## 0.1.4 - 2026-09-01
+
+- Add `/backeer` and `/backeer status` for an in-session integration report.
+- Add secure, immediate token rotation with `/backeer token-file PATH`.
+- Keep raw tokens out of slash-command arguments, session messages, and logs.
+- Keep the management command available when notifications are disabled by a
+  missing token.
+
+## 0.1.3 - 2026-09-01
+
+- Split configuration, logging, HTTP, SSE, event publishing, and permission
+  command handling into focused source modules.
+- Keep the npm plugin entrypoint backward-compatible with a default export only.
+- Add an esbuild-generated, dependency-free bundle for legacy side-loaded
+  installations.
+
 ## 0.1.2 - 2026-09-01
 
 - Replace raw HTTP log lines with compact Backeer console status messages.

package/README.md

@@ -149,6 +149,30 @@ connection errors are suppressed for 30 seconds. Normal `info` output omits HTTP
 status codes and internal errors; set `BACKEER_LOG_LEVEL=debug` when technical
 details are needed. Set it to `error` for failures only or `silent` for no output.
 
+## OpenCode command
+
+The plugin registers a `/backeer` command inside OpenCode:
+
+```text
+/backeer
+/backeer status
+/backeer token
+/backeer token-file /absolute/path/to/a/protected-token-file
+```
+
+The status report shows the plugin version, gateway reachability, token source,
+notification switches, command-stream state, pending permissions, and log level.
+It never displays the token. Gateway reachability does not validate the source
+credential.
+
+`/backeer token` displays safe rotation instructions. Never paste a raw token
+into slash-command arguments because OpenCode may retain command text in session
+history. To rotate from inside OpenCode, first place the new token in an absolute
+file readable only by its owner (`chmod 600`), then use `token-file`. The plugin
+atomically copies it to the configured token location, applies mode `0600`, and
+activates it immediately without restarting OpenCode. The source file is not
+removed.
+
 ## Events and decisions
 
 The plugin publishes:
@@ -174,6 +198,26 @@ npm run pack:check
 npm run publish:check
 ```
 
+## Development architecture
+
+The npm plugin runs from the modular source in `src`. Configuration, console
+reporting, HTTP transport, SSE consumption, event publishing, permission command
+handling, and OpenCode event routing are kept in separate modules. The package
+root continues to expose only the default OpenCode plugin entrypoint.
+
+The legacy side-loaded installer still deploys one dependency-free file. Build
+that generated artifact before running the installer directly from a source
+checkout:
+
+```sh
+npm install
+npm run build
+node bin/backeer-opencode.js
+```
+
+`npm test`, `npm pack`, and `npm publish` build the side-loaded artifact
+automatically. Do not edit `dist/backeer-permission.js` by hand.
+
 ## Publishing
 
 Maintainers can publish a release after authenticating the `Backeer` npm

package/bin/backeer-opencode.js

@@ -173,7 +173,7 @@ const configDirectory = resolve(arguments_.configDir ?? defaultConfigDirectory()
 const pluginDirectory = join(configDirectory, "plugins")
 const secretPath = join(configDirectory, "secrets", "backeer-ingest-token")
 const packageDirectory = resolve(dirname(fileURLToPath(import.meta.url)), "..")
-const sourcePath = join(packageDirectory, "src", "index.js")
+const sourcePath = join(packageDirectory, "dist", "backeer-permission.js")
 // Keep the legacy filename so upgrading an existing Backeer installation
 // replaces it instead of loading two copies of the same plugin.
 const installedPath = join(pluginDirectory, "backeer-permission.js")