opiv0.11.0

Changelog

Generated from CHANGELOG.md in the project repository. Never maintained twice.

0.11.0

26 September 2026

  • addedA push workflow, opi --check push: every detected check, then the build, on a working tree that is clean and not behind its upstream branch. The build is the project's own build script (each member's in a workspace whose root has none) and cargo build --workspace --locked, run after the other checks and one at a time. release builds too; commit stays fast.
  • addedopi --hooks installs opi --check push as the pre-push hook — in .husky/pre-push where the repository has husky, otherwise wherever git keeps its hooks. Idempotent; an existing hook keeps its lines.
  • addedThe list names task runner files beside the manifest — Makefile, justfile, Taskfile.yml, a mise.toml with tasks — in the line under the heading (also Makefile). Named only, never read or run.
  • addedThree supply-chain lines in opi --security for npm projects: registry signatures (npm audit signatures, fails the run on a mismatch), the minimum release age (minimumReleaseAge / min-release-age, asked with config get), and a license overview for pnpm (pnpm licenses list --prod) naming copyleft and unlicensed packages. The last two only report.

0.10.0

25 September 2026

  • addedA Lockfile check in opi --health and both workflows: whether the lockfile still matches package.json (and Cargo.lock the manifests), asked of the package manager that wrote it — pnpm install --frozen-lockfile --lockfile-only --offline, npm ci --dry-run, bun install --frozen-lockfile --dry-run, cargo metadata --locked. Each was measured to change nothing and to fail only on drift. yarn gets none; its only strict form is a full install.
  • addedopi --updates offers bun projects Choose in bun's own list, which hands over to bun update --interactive and runs the commit checks afterwards.
  • addedopi --security reads yarn's audit output. Measured against yarn 4.18.0: yarn npm audit --all --recursive --json prints newline-separated JSON, one object per advisory, in a shape of its own rather than npm's — a third shape beside npm/pnpm's and bun's, told apart the same way those already are, by which manager was asked. Like bun, it names only the vulnerable range, never a patched one, so its findings carry no remedy. Unlike every other manager here, a clean yarn audit prints nothing at all rather than an empty report, so an empty result is read as clean only when stderr is empty too — the same distinction --updates already made for npm and pnpm.
  • addedAn optional fifth Cargo check, docs.rs: cargo docs-rs, where the subcommand is installed.
  • changedThe manifest's documentation field points at casoon.github.io/opi instead of docs.rs.
  • fixedopi --security no longer reports a failed audit as clean. An audit stopped by a network error or a broken lockfile explains itself on stderr and prints no report; opi named the reason but still ended with "Nothing to act on." and exited 0. It now exits non-zero. A missing cargo audit is still named with its cargo install rather than failing the run.

0.9.0

23 September 2026

  • addedopi --updates offers Decide per package: every finding as a ticked line, majors among them.
  • addedA fourth Cargo check, Docs: cargo rustdoc --all-features -- -D warnings.

0.8.0

20 September 2026

  • addedopi --updates offers to take what it found, and runs the commit checks on what comes back.
  • addedopi --updates answers for Rust as well, through cargo outdated. Another external subcommand, found on PATH the way cargo audit is, and named along with its cargo install where it is missing.
  • addedopi --security reads bun's audit instead of saying it cannot. Bun has had an audit of its own for a while, and it emits clean JSON on stdout with its banner on stderr — measured against 1.3.3.
  • addedinstall.sh, and release binaries for it to install:
  • fixedopi --updates sees a pnpm workspace's packages. It asked the root package.json alone, which on one real repository found 2 of 11 outdated packages — and where a root declares no dependencies of its own it answers {}, so --updates reported "everything is current" over stale packages. A false acquittal is worse than no answer. 79 of 133 npm projects measured here are pnpm workspaces.
  • fixed--updates survives a warning printed ahead of the JSON. pnpm writes its own warnings to stdout, so a slow registry put ‼ WARN‼ Request took 11084ms: … in front of the document and the area answered "could not read pnpm's output". It only showed up when the network was slow enough, which is why the first round of testing missed it.
  • fixed--updates in a project without a package.json no longer says opi checks updates only for npm, which stopped being true.
  • fixedopi --security answers the dependency question for Rust as well, through cargo audit.
  • fixedopi --security and opi --updates no longer run npm in a project that has no package.json.
  • fixedIn a Cargo workspace, opi started inside a crate now works on the workspace rather than on that crate.
  • fixedA Bun project is recognised by bun.lock, not only by the binary bun.lockb it stopped writing in 1.2.
  • fixedopi --updates says that it cannot read bun's or yarn's output, instead of failing on it.

0.7.0

20 September 2026

  • changedWorkspace packages share one Packages tab instead of taking one each, with a divider in front of it. Inside, each package keeps its name as a heading.

0.6.1

20 September 2026

  • fixed0.6.0 did not compile on Rust 1.85, the version this crate declares. The cause was in runemark 0.7.0, which used a let chain — stable only from 1.88 — for the tab digits. Requires runemark 0.7.1.

0.6.0

20 September 2026

  • addedPast 15 entries or 5 groups the start screen shows the groups as a row of tabs and lists only the active one. web-casoon has 27 scripts in its root in 7 groups, which is 34 lines with a heading each — taller than a full-screen terminal, so the top scrolled away. ← →, Tab and the digits 1–9 switch groups.
  • addedA line under the heading says what was found: 43 entries · 10 groups · 3 packages. Two of those three are no longer on screen at once once the groups are tabs, and packages are named only where there are any.

0.5.3

19 September 2026

  • fixedThe audit's severity counts are legible without colour. They carried a tone, which is nothing in a pipe or in CI, so high: 1 read exactly like a clean count; they now render as [FAIL] high: 1 (runemark 0.6).

0.5.2

19 September 2026

  • changedThe dependency audit and the update list render as runemark Reports. The split between safe and breaking updates is now two groups rather than a sentence under a flat list, severity counts are metrics, and an advisory's fixed version range is a remedy.

0.5.1

19 September 2026

  • fixedopi --help said entries come from package.json, which stopped being the whole truth when Cargo.toml was added in 0.5.0. It now names both, and mentions the <member>/<script> form, which was undocumented.

0.5.0

19 September 2026

  • addedRust projects. Cargo.toml is discovered the same way package.json is, and its commands join the same list, groups and search. Health gains cargo fmt --check, cargo clippy and cargo test; clean gains target/.
  • addedA repository can be both at once, and neither wins. Measured across 231 directories: 133 carry a package.json, 51 a Cargo.toml, and twelve both.
  • addedA repository with only a Cargo.toml is now a project. 39 of them were previously turned away with "No package.json found".

0.4.0

19 September 2026

  • addedPer-script metadata in the opi key of package.json: description, group, favorite and confirm. None of it is required — a project with neither opi nor scripts-info still gets a usable list, which is the point.
  • addeddescription there wins over scripts-info without invalidating it. Both may name the same script; that is how a project says something to opi without changing what nr and npm-scripts-info read.
  • addedgroup replaces the group a script's name implies. A name opi already knows takes that group's fixed place in the order, so configuration refines the meaning-first arrangement rather than dropping out of it.
  • addedfavorite lifts a script out of its group into a Favorites group at the top. Sorting it first *within* its group would barely show — measured on a real project, five of ten groups held two entries.
  • addedconfirm asks before running. Without a terminal it refuses rather than assuming yes, since skipping the question where it cannot be asked would remove the protection in exactly the case it exists for. --yes says it out loud instead.

0.3.0

19 September 2026

  • addedHealth (H, --health) runs every check the project's tools can answer, concurrently. opi reimplements none of them: it detects the tool, runs it, and relays the result. Checks run per workspace member, in the member — a monorepo keeps TypeScript and its test runner in the packages, and pnpm does not hoist their binaries.
  • addedSecurity (S, --security) scans for secrets and parses the package manager's audit into package, severity and the version that fixes it.
  • addedUpdates (U, --updates) lists what is outdated, split into safe and major. A pre-1.0 minor counts as breaking, as does a version that does not parse.
  • addedClean (C, --clean) shows removable artefacts with what each costs, and removes build output without ever bundling node_modules along with it.
  • addedWorkflows (--check commit, --check release) run named subsets plus repository gates: a clean tree and an untagged version before a release.
  • changeddeploy, release, clean, setup and similar standalone names now have Deploy and Maintenance groups instead of the catch-all, which halves it.
  • changednpm's own lifecycle scripts are hidden from the list — prepare appeared in 49 of 133 measured projects — but remain runnable by name.

0.2.0

19 September 2026

  • added/ filters the list as you type. Groups with nothing left disappear and the cursor sits on the best match. In one real project this narrows 29 entries to 3 for dep; og finds a workspace member's generate:og that would otherwise be twenty rows down.
  • addedThe footer shows / search, so the key is discoverable rather than folklore.

0.1.1

19 September 2026

  • fixedEntries are fitted to the terminal width instead of wrapping to column zero, which destroyed the two-column layout (runemark 0.4.2). Long descriptions are shortened with an ellipsis; where the name column leaves no useful room, the description is dropped rather than cut to a stub.
  • changedA workspace member's script is no longer listed when the root defines one by the same name. The root wins that name on the command line anyway, so listing both offered a choice the interface could not honour. On one real project this removed 12 of 18 member entries, none of which carried a description. What remains is what the root cannot reach; a member left with nothing shows no group at all.

0.1.0

19 September 2026

  • addedAn interactive list of the project's scripts, grouped by the prefix before the first : and labelled from scripts-info. Group order is meaning-first, not alphabetical. A list taller than the terminal scrolls.
  • addedopi <script> runs one directly, forwarding any further arguments. Scripts take precedence over built-in names, so a project with a script called help keeps working.
  • addedPackage manager detection from the packageManager field or a lockfile, searching upwards. Where neither exists the npm default is marked as a fallback rather than presented as a detection.
  • addedMonorepo support: the nearest package.json is found by searching upwards, and a workspace root also offers each member's scripts under the member's name. opi blog/dev addresses a member, since root and member scripts share names in practice.
  • addedSuggestions for a mistyped script name, using optimal string alignment so a transposition counts as one edit.
  • notesUnix only. opi runs a script by replacing its own process with exec, so Ctrl-C reaches your dev server and the exit code is the script's. Building on Windows fails with that reason rather than producing a degraded binary.
  • notesLifecycle hooks npm runs on its own are hidden when their main script exists.