oy

A focused OpenCode agent with repeatable audits, code reviews, and one-finding fixes.

oy helps OpenCode review a repository without quietly choosing a small sample. It prepares an ordered, reviewable set of files, lets the selected model analyze them under OpenCode's permissions, and verifies the report before writing it.

• oy audit for security-focused repository audits (ISSUES.md or SARIF)
• oy review for whole-workspace or target-diff code reviews (REVIEW.md)
• oy enhance for fixing one reported finding at a time
• one concise oy coding agent plus /oy-audit, /oy-review, and /oy-enhance inside OpenCode
• Cursor models inside OpenCode through the official Cursor SDK

OpenCode owns models, credentials, sessions, and general tools. oy adds the evidence and report workflow; it is not a second agent runtime or permission system. One important exception: cursor/* models run Cursor's own local agent tools outside OpenCode's permission system.

Requirements: Linux or macOS (WSL2 on Windows), oy on PATH, and a supported OpenCode 2 installation.

curl -fsSL https://oy.adonm.dev/install.sh | sh
# Choose global or current-workspace mise installation when prompted.
oy doctor --check

# Optional: use your Cursor subscription models in OpenCode.
# Run /connect in OpenCode, choose Cursor, and paste a Cursor API key.

cd your-repository
oy audit

Use --global or --workspace to skip the mise scope prompt.

The installer uses mise for prebuilt oy, Node.js, OpenCode, and context helpers. Review the installer before piping it to a shell.

Prefer a manual install or project-local setup? See Getting started.

oy audit                                  # writes ISSUES.md
oy audit src/auth                         # audit one path
oy audit "authentication boundaries"     # apply a focus lens
oy audit --format sarif --out oy.sarif

A single argument that exactly matches a workspace path narrows collection. Other text is treated as review guidance.

oy review                                 # review the collected workspace
oy review main                            # review git diff main
oy review main --focus "error handling"

A branch, commit, tag, or ref selects target-diff review. Without a target, oy reviews the workspace.

oy enhance review-0123456789abcdef
# Confirm the result by rerunning the originating workflow.
oy review main

Reports include stable finding IDs. oy enhance confirms the cited source, makes one focused fix, and runs the narrowest available verification.

You can run the same workflows inside OpenCode with /oy-audit, /oy-review, and /oy-enhance.

1. Prepare: oy collects eligible repository text or a Git diff into ordered files under .oy/runs/.
2. Review: OpenCode reads every prepared chunk and writes a candidate report.
3. Verify: oy rejects changed inputs, modified evidence, concurrent report changes, or malformed findings.
4. Finalize: oy writes normalized Markdown or SARIF with stable finding metadata.

The inputs are deterministic; the conclusions are not. Model choice and prompt quality still affect findings.

“Every chunk” means every chunk collected by oy, not every byte in the repository. The collector excludes ignored/hidden paths, dependencies and build output, lockfiles, likely secrets, binary or unreadable files, and files larger than 512 KiB. See Coverage and limits before using a report for high-assurance work.

oy is not a sandbox. Prepared source may be sent to your configured model provider. cursor/* uses Cursor tools outside OpenCode permissions; use a disposable environment for untrusted repositories and read SECURITY.md.

• Getting started — install, configure, and create a first report
• Workflow guide — scopes, findings, remediation, and limits
• Examples and CI — report examples and SARIF upload
• CLI reference — commands, environment variables, and setup ownership
• Compatibility — supported platforms and OpenCode versions
• Architecture and contributing — maintainer documentation

Run oy <command> --help for the installed version's exact flags.