This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+4 more
Summary
AI summaryThe curl|bash one-liner in v1.8.0 is broken; use v1.8.1 for the hotfix.
Full changelog
⚠️ v1.8.0's curl|bash one-liner was broken (BASH_SOURCE unbound + stray
--to parseArgs). Use v1.8.1 instead — same release contents plus the hotfix.
Brain still big. Two more mouths now small.
This release teaches caveman to two new agents: OpenClaw (the lobster) and opencode (the TUI). Both now grunt fluent caveman from message one — no /caveman per session, no setup nag.
Plus a stack of installer fixes from a top-to-bottom review of bin/install.js.
What's new
🦞 OpenClaw — first-class always-on target
npx -y github:JuliusBrussee/caveman -- --only openclaw and the lobster talks like a caveman every turn.
Two tiny writes do the work:
- Skill drop at
~/.openclaw/workspace/skills/caveman/SKILL.md— spec-correct frontmatter (version,always: true), discoverable byopenclaw skills list. - SOUL.md nudge — marker-fenced bootstrap block at
~/.openclaw/workspace/SOUL.md, auto-injected each turn under "Project Context". Stays well under OpenClaw's 12K-per-file cap.
Idempotent on both writes. Uninstall strips the skill folder + the marker block, leaves your other workspace content alone. Custom workspace via OPENCLAW_WORKSPACE.
See README's Lobster, Meet Rock section for the longer pitch.
🤖 opencode — native plugin replaces npx-skills fallback
opencode goes from "manual /caveman per session" to always-on. The installer drops:
- A real opencode plugin (
~/.config/opencode/plugins/caveman/) usingsession.createdandtui.prompt.appendlifecycle hooks - Six slash-command prompt templates (
/caveman,/caveman-{commit,review,compress,stats,help}) - Three cavecrew subagents
- Seven skill folders (caveman, caveman-commit/review/help/stats/compress, cavecrew)
- A Tier-3 always-on ruleset in
AGENTS.md, fenced with<!-- caveman-begin -->/<!-- caveman-end -->markers (clean uninstall later)
opencode.json gets patched with the plugin entry plus the caveman-shrink MCP server (when --with-mcp-shrink is on, which is the default).
opencode reaches Tier-1 minus the statusline (opencode's TUI exposes no plugin-writable badge).
🛠️ Installer rewrite + correctness fixes
The unified bin/install.js got reviewed end-to-end. What changed in this release:
Bug fixes (high-severity)
downloadToPromise was unawaited on the https fallback path — silent partial install ifcurlwas missing. Now properly awaited.--only <typo>used to exit0with no work done. Now validates against the provider matrix and exits2witherror: unknown agent: <id>..bakfiles were silently overwritten on every reinstall, destroying recovery. Now preserved on first install only.- opencode plugin payload (
plugin.js,package.json,caveman-config.cjs) used to be rewritten on every reinstall, wiping user edits. Now honors the same!--forceskip the rest of the payload uses. --config-dirhelp text now discloses scope honestly: it does not sandboxclaude plugin install,gemini extensions install, opencode (XDG_CONFIG_HOME), or openclaw (OPENCLAW_WORKSPACE).
Idempotency / hygiene
- Uninstall now probes
claude plugin list/gemini extensions listbefore firing the uninstaller — no more "Plugin not installed" stderr noise on cold uninstalls. - Uninstall now also runs
claude mcp remove caveman-shrink(when the subcommand exists). - opencode AGENTS.md is now fenced with
<!-- caveman-begin -->/<!-- caveman-end -->. Uninstall strips just the fenced block, preserving any user content above and below it. --config-dirvalue is now~-expanded.removeCavemanHooksno longer crashes on malformed pre-existingsettings.hooks(e.g. when a user hand-edited and broke things).
🧹 Repo layout consolidated
hooks/, rules/, tools/, mcp-servers/ all moved under src/. Sources of truth are at the top of the tree; distribution mirrors live below. See CLAUDE.md for the new map.
Tests
50/50 passing (npm test). Up from 43 in v1.7.0 — seven new tests cover:
--onlytypo validation--config-dir ~expansion--helpdiscloses--config-dirscoperemoveCavemanHooksmalformed-input safety- AGENTS.md fence assertion
- opencode plugin.js hand-edit survives reinstall (without
--force) - AGENTS.md fenced uninstall preserves user prefix and suffix
Verify after upgrade
node bin/install.js --list # 34 providers; OpenClaw + opencode visible
node bin/install.js --help # --config-dir scope is now spelled out
For the lobster: npx -y github:JuliusBrussee/caveman -- --only openclaw.
For opencode: npx -y github:JuliusBrussee/caveman -- --only opencode (needs a local clone or npx-extracted repo for the native plugin payload).
Upgrade
Existing users:
npx -y github:JuliusBrussee/caveman
Auto-detects everything you already had + picks up OpenClaw and opencode if present. Safe to re-run.
Behavior changes worth knowing
- opencode plugin payload no longer overwrites on reinstall. If you've edited
~/.config/opencode/plugins/caveman/plugin.jsand want the new version, pass--force. Without--force, your edits stay. - opencode
AGENTS.mdfrom v1.7.x and earlier was un-fenced. Reinstall won't replace a legacy block by default; pass--forceto rewrite with the fenced version. Uninstall still removes legacy blocks correctly.
Caveman ecosystem
- caveman (you here) — output compression
- cavemem — cross-agent memory
- cavekit — spec-driven build loop
One rock. Two rock. Three rock. That it.
Breaking Changes
- v1.8.0's `curl|bash` one-liner is broken (BASH_SOURCE unbound + stray `--`); requires upgrade to v1.8.1
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About caveman
🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman
Related context
Beta — feedback welcome: [email protected]