v0.5.0

Added

• Configurable tool messages - New global toolMessages settings control
  whether tool calls, compact arguments, and selected tool outputs are returned
  to chat. Presentation modes include off, immutable events, editable
  current status, and an editable cumulative trace. Editable modes work
  across WhatsApp, Telegram, Slack, Discord, Mattermost, Matrix, and Web, with
  progressive ACP argument updates, trace pagination, and edit-failure
  recovery. The former streamTools option is migrated automatically.
• Telegram file attachments from users - The Telegram connector now
  downloads photos, documents, videos, audio, voice notes, animations
  (GIFs), video notes, and stickers that users send to the bot. Each
  attachment is saved to <session-cwd>/uploads/ and its absolute path is
  prepended to the LLM prompt (alongside the user's caption) so the LLM
  can use read, bash, glob, or other tools to inspect the file.
  Telegram Bot API's 20 MB-per-file download limit is enforced up-front;
  oversized files are skipped with a log line and the message is still
  processed. Caption-less media in DMs (or inside active forum topics)
  count as engagement and bypass the trigger requirement.
• Telegram connector - New connector using the Telegram Bot API over HTTPS
  with native fetch and long-polling getUpdates. Zero external runtime
  dependencies, no public port or webhook required. Features:
  • Trigger-prefixed messages (!oc ...), @-mentions of the bot, and
    auto-handled DMs (no prefix required in private chats)
  • Per-topic session isolation in forum supergroups, configurable via
    threadIsolation in chat-bridge.json (default true); each topic gets
    its own isolated OpenCode session
  • Plain replies inside an active topic continue the conversation without
    requiring a re-mention (mirrors the behavior of the Slack/Mattermost
    thread-isolation feature)
  • Native image (sendPhoto) and document (sendDocument) uploads for
    outputs from OpenCode tools
  • Long-message splitting at the 4096-char Telegram limit
  • sendChatAction "typing..." indicator while OpenCode is processing
  • Automatic exponential-backoff polling with retry_after honored for 429s
  • allowedUsers / TELEGRAM_ALLOWED_USERS allowlist plus ignoreChats
    and ignoreUsers blocklists
  • TELEGRAM_DROP_PENDING=1 to skip messages queued while offline
  • Swipe-replies to one of this bot's own messages are forwarded without
    a trigger/@-mention, gated on an active session so stale replies are
    ignored. Toggle with telegram.respondToReplies (default true).
    Fixes #34.
• Universal user allowlists (Slack, WhatsApp, Matrix, Discord, Mattermost, Telegram) -
  Each connector now supports allowedUsers in chat-bridge.json plus
  per-connector *_ALLOWED_USERS env vars. Messages from unlisted users are
  silently dropped. Feature originated from PR #28 by @llvilanova and was
  generalized across all connectors.
• Thread isolation (Slack, Mattermost, Matrix, Telegram) - Sessions are now keyed per thread (channel:threadTs for Slack/Mattermost,
  room:$eventId for Matrix, or chatId:messageThreadId for Telegram forum
  topics) instead of per channel. Each thread gets its own isolated OpenCode
  session. Replies always stay in threads. Implicit follow-ups work without
  re-mentioning the bot. Configurable via threadIsolation in
  chat-bridge.json (default: true).
  Inspired by PR #2, reimplemented with proper separation of concerns.
• Event deduplication (all connectors) - New EventDeduplicator in BaseConnector
  prevents duplicate event processing. Tracks recently seen event IDs with automatic
  eviction. Protects against Slack retries, Matrix sync replays, Discord
  re-deliveries, and Mattermost WebSocket replays.
• Active query guard (all connectors) - Prevents concurrent queries on the same
  session. Users get a clear "request already running" message. Sessions with
  in-flight queries are protected from expiry.
• Runtime session expiry - New SESSION_RETENTION_MINS config (default: 30 for
  Slack). Background sweep loop expires inactive in-memory sessions and cleans up
  their on-disk cache directories. Coexists with existing SESSION_RETENTION_DAYS
  startup cleanup.
• Document attachment support (WhatsApp) - New [DOCLIBRARY_DOC] marker and
  sendDocumentFromFile method for sending PDF, CSV, XLSX, and other document
  types as native WhatsApp file attachments. Same pattern as image handling.
  Shared utilities (extractDocPaths, removeDocMarkers) and reusable
  DocHandler class available for other connectors.
• Mattermost connector - New connector using Mattermost REST API v4 and
  WebSocket for real-time events. Zero external dependencies (uses native
  fetch and WebSocket). Features: trigger-based responses in channels,
  DM support without trigger, image file uploads, long message splitting,
  tool output streaming, automatic reconnection with backoff.
• HTML message formatting for Matrix - New formatHtml config option converts
  markdown responses to HTML using marked, sending both formatted_body (HTML)
  and body (plain text fallback) per the Matrix spec. Tables, bold, lists, and
  code blocks render natively in Matrix clients. Disabled by default.
• MCP server environment variables - MCP servers defined in opencode.json can
  now include an env block for passing configuration (API URLs, tokens,
  feature flags) to the server process.
• Streaming tool output - Tool output now streams in real-time during execution.
  Requires opencode PR #13589.
  • Configurable via streamTools in chat-bridge.json (default: ["bash"])
  • Only tools in the list have output streamed to chat
  • Properly computes deltas from cumulative output (fixes accumulation bug)
  • Skips final tool result if already streamed
• OpenCode commands forwarding - Commands like /init, /compact, /review
  are discovered from OpenCode via ACP and shown in /help. When invoked, they
  are forwarded directly to OpenCode instead of being handled by the bridge.
• Skills infrastructure - The .opencode/skills/ directory is symlinked to
  session directories, allowing custom skills to be loaded via the skill tool.
  Skills provide domain-specific instructions (e.g., weather formatting, personas).
• Permission request handling - Properly handles OpenCode permission requests
  • Auto-rejects with clear message (e.g., "Permission denied: write")
  • Prevents hanging when tools require elevated permissions
  • Shows both the permission denial and the tool error to users

Changed

• Security dependency refresh - Updated Baileys to 7.0.0-rc.13,
  Discord.js to 14.27.0, Slack Bolt to 4.7.3, and Marked to 17.0.6.
  This removes the audited Baileys protocol-message vulnerability and several
  vulnerable transitive networking and parsing packages.
• Breaking config rename (WhatsApp) - allowedNumbers and
  WHATSAPP_ALLOWED_NUMBERS were removed in favor of allowedUsers and
  WHATSAPP_ALLOWED_USERS to match all other connectors.

Fixed

• Telegram: bot never answered swipe-replies to its own messages
  (#34) - Added telegram.respondToReplies (default true) and a
  shouldHandleTelegramBotReply decision branch in the Telegram connector so
  long-pressing the bot's message and tapping "Reply" continues the
  conversation even in regular groups without a forum topic. Match is keyed
  on the parent message's from.id, so replies to other bots (or to
  messages where Telegram redacts from) are ignored, and the connector
  only engages when an active session exists for the chat/topic.
• Trigger env var inconsistency - All connectors now support per-connector
  trigger overrides (SLACK_TRIGGER, MATTERMOST_TRIGGER, etc.) with fallback
  to chat-bridge.json. Previously only Slack and Discord had env overrides.

Changed

• Generic tool activity formatting - Tool activity messages now show
  key=value, key=value [toolname] for ANY tool, removing hardcoded formatting.
  This ensures new MCP tools display useful context automatically.
• Added marked as a dependency for markdown-to-HTML conversion