oc/CHANGELOG.md

Changelog

Notable changes per release. Releases before 0.4.0 are listed at github.com/only-cli/oc/releases.

Unreleased

Fixed

• A feed entry's title is now the link to the entry, so oc do <n> on a post in a subreddit feed opens it. The link used to sit beside the byline as an anchor labelled open, the same label on every entry, and the repeated-controls filter hid them all on any feed with five or more entries, which left nothing in a listing that led anywhere: an agent asked to open the first post's comments got the heading text back, refetched the feed looking for the link, and met Reddit's 429 (#59).

Changed

• oc open on a reddit.com front page, subreddit, post, user or search URL fetches the matching www.reddit.com Atom feed when no login session is held, since the HTML page ends at a login wall for a logged-out reader. Following a post out of a feed lands on its comments feed instead of the wall. A URL that is already a feed, any other reddit.com path, and any request carrying reddit.com cookies are fetched as asked (#59).

0.5.3

Changed

• Requests to reddit.com present the Firefox fingerprint first and fall back to Chrome, the reverse of every other site. Reddit's edge answers the Chrome fingerprint with a 403 or a 429 while letting Firefox through, and since it allows anonymous readers about ten requests a minute per address, the wasted Chrome attempt was costing a real share of that budget on every read (#52).

0.5.2

Changed

• oc reddit reads the Atom feeds on www.reddit.com instead of old.reddit.com pages. Reddit has sent every logged-out old.reddit.com request to a login page since 30 June 2026, and the .json views on www.reddit.com have answered 403 to anything without an OAuth token since 30 May, whatever the User-Agent or TLS fingerprint. The feeds still answer, so sub, post, user, and search point at them, and new <name> and top <name> join the verbs. A subreddit renders in about 480 tokens and a thread with 22 comments in about 1,000. The feeds carry no scores or comment counts, and anonymous reddit.com allows roughly ten requests a minute per address, so a burst of shortcuts ends in a 429 that takes minutes to clear. (#52)

0.5.1

Added

• find <query> in every actions: footer, after do <n> and before read <n>, the order the skill's "going further, cheapest first" list already gives. One command lands on the block that matters, where read needs the right number first and next pages toward it. The entry costs 3 or 4 tokens per render. (#46)

Fixed

• oc open no longer dies with Impersonating chrome150 is not supported on machines where impers loads a system copy of libcurl-impersonate older than v2.1.0, which predates the fingerprint the chrome alias resolves to. A refused fingerprint now downgrades the same way a blocked response already did: chrome falls back to firefox, and when both identities are refused the plain fetch transport still gets the page. Any other impers failure propagates unchanged, and installs where impers works keep the newest chrome fingerprint. (#40)
• The actions: footer no longer offers fill <n> <text> and submit on pages with an input. Both are still planned, and following the footer's own suggestion always failed. A test now keeps every footer free of commands that are not available yet. (#44)

0.5.0

Added

• Language documentation shortcuts: py, mdn, node, ruby, go, rust, java, php, cpp, and ts, plus a dotnet verb on learn for the .NET API browser. search on py, node, and ruby ranks the docs' own search index locally and on mdn asks the site's API; the sites that only render docs search client-side go through DuckDuckGo with a baked-in site: filter instead. (#25)
• Authenticated sessions: oc login seeds cookies for a session and every fetch in that session sends them; oc logout forgets a session early, cookies and saved page both. Cookies live in a per-session jar under OC_HOME, separate from page state, pinned to the exact host they were seeded for, and marked secure by default so they travel over https only (--allow-http at login opts a plain-http site in). A session lasts an hour unless --expires says otherwise. --cookie - reads the header from stdin, the form to prefer since an argv secret is visible in ps and kept in shell history. (#4)

Fixed

• Response bodies are bounded at every transport, 25MB decoded, checked against Content-Length before the bytes arrive and counted as they land, so a hostile URL is no longer an unbounded allocation and a decompression bomb stops at the cap. (#27)
• Titles, headings, and input names are cut at the render boundary like every other block, so one hostile page-written scalar can no longer print unbounded output whatever the budget said. The distilled page keeps the full values and --json stays the machine-stable view. (#28)
• A short page is judged unreadable by evidence, not by length alone: nothing extracted is empty whatever the page weighed, and a short render only fails when the markup behind it was far too big to have carried only that. A status endpoint or a one-line answer now exits 0; script-only shells and consent walls still exit 2. (#29)

0.4.0

Added

• Site shortcuts are dispatched, not just documented. oc <site> <verb> [args] resolves to a URL and then takes the same path oc open does, so it costs the same and reads the same. A site is named by short name, bare name, or domain (oc hn, oc ycombinator, oc news.ycombinator.com), the last argument absorbs every word after it so a query needs no quoting, and oc sites lists every site with its verbs. Shortcuts come from clis/*.json, so adding a site is a JSON file and no code. (#19)
• Wikipedia shortcuts: oc wiki article <title>, oc wiki search <query>, and oc wiki lang <code> <title> for the other language editions. Articles are read through action=render, which serves the article body without the site chrome, navigation, and edit controls that surround /wiki/<Title>. (#22)
• Outbound fetches honor HTTP_PROXY, HTTPS_PROXY, and NO_PROXY, including the lowercase forms, so oc works in a sandbox whose only route out is a proxy. HTTP and HTTPS proxies are supported and proxy credentials in the URL are sent as Proxy-Authorization. (#17)
• The MIT LICENSE file that the badge and package.json were already claiming. (#18)

Changed

• A page that distills to no readable text now fails loud instead of printing an empty render and exiting 0. It writes one line to stderr and exits 2, which is distinct from the exit 1 every other failure uses, so a caller can tell "this page is empty" from "oc could not read this page" and fall back to a browser only when that is worth doing. --json carries the same verdict as an empty field. (#20)
• The SSRF guard runs before a proxy is chosen, so a proxied request cannot be used to reach an address the direct path would have refused. (#17)

Fixed

• GitHub and Reddit shortcut URL templates corrected so their verbs reach the pages they name. (#19)