改动摘要

chore

• 新增 SECURITY.md(支持版本说明 + GitHub 私密漏洞报告流程)
• ci.yml / auto-fix-issue.yml 中所有第三方 GitHub Actions 固定为 commit SHA(保留版本注释)
• 新增 .github/dependabot.yml(github-actions + npm,每周检查)
• 新增 .github/workflows/plugin-scanner.yml,接入 HOL ai-plugin-scanner-action 持续安全扫描

What's Changed

📖 Documentation

• 新增 README.zh-CN.md：README 的完整简体中文翻译，与英文版章节一一对应（#26）
• README.md 顶部增加语言切换链接：English | 简体中文（#26）
• package.json 的 files 中加入 README.zh-CN.md，中文 README 随 npm tarball 分发（#26）

🔧 Fixes

• 测试：将 package-exports 测试中钉死的 0.8.1 版本断言改为 semver 格式校验，避免每次发版测试必挂（#28）

Verification

• npm test：190/190 用例通过
• npm publish --dry-run：确认 tarball 同时包含 README.md 与 README.zh-CN.md（共 28 个文件）
• npm 发布已确认：npm view opencode-plugin-loop version → 0.8.2

Full Changelog: v0.8.1...v0.8.2

opencode-plugin-loop 0.8.1

Claude Code alignment release — v0.9.0 stage of the alignment report, published as 0.8.1.

Added

• loop.md re-read on every fire (Claude Code behavior): file-backed maintenance tasks (bare /loop with project .opencode/loop.md or user-level ~/.opencode/loop.md) record loopFilePath + lastContentHash and re-read the file at fire time — edited content is injected in full (hash persisted), unchanged content gets a short cache-friendly reminder, a deleted file turns the tick into a no-op. Legacy snapshot maintenance tasks are unaffected.
• Trailing "every" clause: /loop check the deploy every 20m / every 5 minutes is deterministically extracted as a fixed interval (Claude Code rule 2); word units (seconds/minutes/hours/days) map to s/m/h/d through the same parser. check every PR — no time expression — stays Adaptive.

Verification

• npm test: 190/190
• Real OpenCode E2E: trailing-every fixed task ran immediately; loop.md edits injected in full on next fire; unchanged content got the short reminder; deleting loop.md produced a no-op tick

Full Changelog: v0.8.0...v0.8.1

opencode-plugin-loop 0.8.0

Claude Code alignment release — v0.8.0 stage of the alignment report.

Added

• Fixed tasks run immediately on creation (Claude Code behavior): recurring fixed tasks execute in the creation turn via a first-run prompt (schedule confirmation + task execution); the next fire is anchored to creation time. --once tasks become due immediately, so the ticker fires them within one tick and auto-cancels.
• User-level ~/.opencode/loop.md: bare /loop now falls back to the user-level file when the project has none (priority: project > user > built-in default) — the README already promised this, the code now implements it.
• /proactive alias: works exactly like /loop — bundled commands/proactive.md, the command hook accepts both names, and the run-mode fallback intercepts /proactive ... too. (As with /loop, add the command definition to your opencode config if completion does not surface it.)

Verification

• npm test: 182/182
• Real OpenCode E2E: recurring fixed executed in the creation turn; --once fired within ~5s and auto-cancelled; /proactive created and ran its task; bare /loop picked up ~/.opencode/loop.md

Full Changelog: v0.7.4...v0.8.0

opencode-plugin-loop 0.7.4

Removes --all for Claude Code parity and fixes a multi-process persist bug, per the v0.7.3 field test report.

Breaking change

• --all removed: Claude Code's /loop has no cross-session equivalent — its jobs are strictly per-session. All subcommands (list, cancel, stop, pause, resume, stop-all) and both LLM tools (loop_schedule, loop_status) are now purely session-scoped. Another session's tasks are invisible to list, and managing one reports "No task <id> in this session". The all tool argument is gone.

Bug fixes

• Persist merge direction: an untouched (non-dirty) in-memory task no longer overwrites a newer disk version during persist() — only ids this instance actually modified win the merge. Two OpenCode processes sharing one tasks.json can no longer roll back each other's updates (e.g. a peer's set_fixed/pause being reverted).

Docs

• README no longer carries historical upgrade notes; it documents current behavior only.

Verification

• npm test: 176/176 (all --all cases re-pinned to session-only semantics; new merge-direction test)
• Real OpenCode E2E with two opencode serve processes on one project: cross-session tasks invisible/unmanageable, bare stop stays session-local, a peer's persist no longer reverts a pause

Full Changelog: v0.7.3...v0.7.4

opencode-plugin-loop 0.7.3

Patch release fixing the run-mode /loop bypass (issue #18).

Bug fixes

• Run-mode fallback: opencode run "/loop ..." (headless and -i) never emits command.execute.before, so raw command text went straight to the model and every deterministic guard (missing prompt, cron rejection, unknown flags, canonical help) was bypassed. The plugin now intercepts the literal /loop ... text in the chat.message hook and runs the same deterministic parser (runLoopCommand shared by both hooks). Parts already consumed by command.execute.before are skipped, so the TUI path is never handled twice.
• Quoted argv: opencode run re-quotes argv elements containing spaces, so the stored text is often "/loop 5m" with literal quotes — outer quotes are now stripped before fallback matching, and all text parts are scanned.

Verification

• npm test: 176/176 (12 new run-mode tests)
• Real opencode run E2E: quoted cron input rejected deterministically; quoted valid interval creates the fixed task

Full Changelog: v0.7.2...v0.7.3

opencode-plugin-loop 0.7.2

Patch release fixing the three P1 findings from the OpenCode vs Claude Code /loop comparison eval (L10/L11/L14), plus a small command addition.

Bug fixes

• LOOP-001 — prompt fidelity: scheduling flags (--once, --all, --jitter=*) are now parsed only in the option prefix before the prompt begins, and -- terminates flag parsing. The prompt is kept as the original substring, so flag-like text, whitespace, and newlines in the body are preserved verbatim (previously silently stripped — eval L14).
• LOOP-002 — multi-process task safety: tasks record ownerPid/ownerStartedAt. Store load drops only tasks whose owner process is confirmed dead (signal-0 probe, conservative on probe errors) instead of tombstoning everything written by a different live process. The instance lock now only serializes same-process plugin instances (shouldFire), so a second OpenCode process in the same project fires its own tasks instead of starving (eval L11).
• LOOP-003 — tool entry validation: a shared validateFixedInterval (≥ 1000ms) is now used by the slash parser, loop_schedule create, and set_fixed; the tool schema gains .min(1000); adaptive/maintenance create carrying intervalMs is rejected (eval L10 — loop_schedule(create, fixed, intervalMs=0) previously succeeded and silently fell back to 60s).

Added

• Bare /loop stop cancels every task in scope (current session, or all sessions with --all). /loop stop <id> remains a single-task cancel alias.

Verification

• npm test: 164/164 (new parser-fidelity, dual-process store, shouldFire, tool-validation, and stop tests)
• Real OpenCode 1.18.5 E2E with two concurrent opencode serve processes: L14 marker written verbatim with one-shot auto-cleanup, L11 dual-process coexistence + dead-owner cleanup, L10 tool rejection without ghost tasks

Full Changelog: b192f19...v0.7.2