Skip to content

v0.35.3

Choose a tag to compare

View all tags
@Helweg Helweg released this 06 Oct 08:35
Immutable release. Only release title and notes can be modified.
v0.35.3
261f5d0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Conceptual retrieval: balance semantic/lexical evidence with identifier lanes and keep file diversity from displacing stronger evidence (#410).
  • Source fallback: retain real implementation text when large supported files exceed the semantic chunk cap, while preserving explicit-lookup declaration policy, hard scopes and score thresholds (#412).
  • Accurate pre-edit evaluation: grade only structured evidence retained after final fitting; long display paths and budget-omitted evidence no longer distort results (#413).
  • Dependencies: include the reviewed runtime and development updates from #408/#409; Node.js >=22.13 remains supported.
  • Security: patch critical runtime proxy-addr IP spoofing (GHSA-jqcg-44mw-7w3h, #417) and high development-only source-map-js denial of service (GHSA-68fv-2mgg-jv7q, #416).

Full changelog · Changes since v0.35.2

Release checks

  • Full previous-tag delta reconciled, including #408/#409 and newly approved security patches #416/#417.
  • Package/lockfile and Claude/Codex manifest versions synchronized.
  • Security-fixed combined local full build, typecheck, lint and Vitest gate passed: 2,582 tests passed, six skipped.
  • Fresh npm audit: zero vulnerabilities; Dependabot, CodeQL and secret-scanning boards: zero open alerts. Alerts #73/#74 are fixed, not dismissed. Before/after runtime smokes confirmed the IP trust and source-map offset guards, with valid controls preserved.
  • Accepted baseline: four unchanged long-root Ollama/nomic evaluation budgets passed.
  • Release notes PR #418 exact-head CI/CodeQL passed. Final merged-main commit 261f5d0a9ac9b4ebb758326136aed0737b36b372 passed CI and CodeQL; no open PRs or security alerts at tag decision.
  • Annotated v0.35.3 tag resolves to the exact green merged commit 261f5d0a9ac9b4ebb758326136aed0737b36b372.
  • Build and Publish succeeded on the tagged commit: all six native targets and trusted npm publication of both open-codebase-index@0.35.3 and opencode-codebase-index@0.35.3. Signed provenance recorded at Sigstore log indexes 3105769603 and 3105782025.
  • Both registry identities report version/latest 0.35.3; independent clean installs passed runtime audit (zero vulnerabilities), ESM/CJS loading, declared CLI aliases and native dry-run indexing. npm cryptographically verified signatures/attestations and the exact tagged source commit. Actual MCP initialization reported 0.35.3, listed 19 tools and answered calls before stdin EOF.
  • Fresh normal-profile omp sessions loaded the published native extension and successfully exercised readiness, conceptual context, fallback-source search and explicit declaration lookup; development link and global config/rules hashes stayed unchanged. Exact unfiltered Java/C# searches were additionally exercised via the published MCP server; see argument-control limitation below.

Scope and known non-blockers

#411 is closed unmerged and excluded; routing regressions and future acceptance criteria are preserved in #414. No query-specific ranking exceptions, relabelled gold evidence or weakened budgets. Accepted retrieval has documented per-query tradeoffs; no universal-ranking, SOTA or productivity claim.

All six platform binaries are present in both installed registry packages, with identical per-platform hashes across identities. Only Darwin ARM64 was executed locally. Windows ARM64 remains best-effort in the existing workflow; successful presence in this release does not change that guarantee.

The normal omp installation remains a development link to the checkout. Fresh verification inherited the user's normal profile/auth/prompt/rules/skills and used an explicit temporary published-extension override. MCP, memory/autolearn/advisor and automatic model fallback were disabled only for verification; normal-profile MCP activation was not tested. Owned installs, indexes, executable probes and embedding servers were removed after preserving evidence.

Verification limit: both actual omp sessions added chunkType: "block" to requested search calls, so they do not prove exact unfiltered model-generated arguments. Unfiltered conceptual context and explicit declaration lookup worked in omp; direct MCP calls with the original omitted-filter arguments separately retained Java/C# fallback implementation source with directory/file-type scopes. Deterministic fixture embeddings prove runtime plumbing/content/scoping, not retrieval quality; the unchanged Ollama evaluation gates supply the quality evidence.

Assets 3
Loading