v0.37.0

v0.37.0

Highlights

• Scoped caller-aware JavaScript/TypeScript test-reference discovery: bounded, current-source-verified direct target references and separately labeled one-hop related caller tests. Hard scopes, direct-reference precedence and result/token budgets are retained. Labels describe static source linkage, not runtime test coverage. (#440, #442, #444)
• Exact executable binding and alias handling across ESM/CommonJS, constructor-owned callers, conditional exports and same-name declarations; unsupported, stale, shadowed or ambiguous origins remain unlinked. Scoped retrieval now stays scoped unless allowUnscopedRecovery: true explicitly opts into broader recovery. (#440, #442, #444)
• Watcher polling-replacement readiness/continuity and incremental indexing recovery after source-read failure; deterministic BM25 tie ordering before native result limits without changing scoring/fusion formulas. (#440, #439, #444)
• Pi guidance composes through native prompt sections without replacing sibling instructions; the existing omp prompt/tool contract is unchanged. Thanks to @dr-pattern. (#437)
• Narrowed security overrides and seven reviewed runtime/development dependency updates retain Node.js >=22.13.0 and the OpenCode plugin 1.3.13 compatibility pin. (#436, #438)
• Preserved historical frozen body/retrieval-study publication and separate CRLF forensics. Its rejected #432 candidate was not merged; its historical metrics are not a new evaluation of this release. (#433)

Complete product changes since v0.36.3: #433, #436, #439, #440, #437, #438, #442 and #444. Release metadata is prepared by #443.

Full changelog · Compare v0.36.3...v0.37.0

Observed merged-source qualification

• Qualified merged-main commit 573b71c3d5cfaba3a83d602f7534605047a01363, tree e84c641ec7a868980e38452f41b73d7438ed0ab6, has 13 successful checks across three successful first-attempt runs: CI, CodeQL and Release Drafter. The seven-file release-metadata diff in #443 received an automated review reporting no actionable findings.
• All eight CI jobs passed. Node 22/24 each exercised Rust/native builds, TypeScript and built/packed CLI smokes, typecheck, lint and unrestricted test:coverage, including its native/build prehooks and full test selection. Each reported 2,826 passing tests with six existing skips; Rust reported 146 passing tests each. Minimum Node 22.13.0 evidence is built/packed CLI smoke only, not broad all-runtime testing. CI did not literally invoke the root build or test:run commands and does not convert the historical local failed gate to a pass.
• All four exact-commit CodeQL analyses completed without analysis errors or warnings. Refreshed Dependabot, code-scanning and secret-scanning open-alert boards each returned HTTP 200 with a complete empty array after those scans completed; analysis result counts are not open-alert counts.
• Accepted exact-head frozen functional observations were 94/94 versus baseline 41/94, with 32 shared controls/repeated BM25 assertions disclosed. All metrics on 17 representative retrieval rows were unchanged, with no graded loss or gain. This supports bounded correctness improvement/non-regression, not general relevance, speed or SOTA superiority.
• The original Python-realpath assertion and post-action manifest reread are missing, and deleted partial-copy bytes remain unavailable. These limitations remain disclosed; frozen comparison evidence is not automatically transferred to newly built or registry artifacts.
• The historical local macOS watcher-test failure remains an explicitly accepted nonblocking historical risk; its cause is unknown and it is not claimed fixed. The test remains enabled. Every new required failure blocks release progression; only the existing experimental Windows ARM64 publication policy below is separate.

Observed publication and verification

The release was published on 2026-10-19 at 09:09:57 UTC. Build and Publish, attempt 1 at the qualified merged commit above, completed successfully with all eight jobs and all six native targets, including the existing experimental Windows ARM64 target. Both exact package identities and latest=0.37.0 were observed in the public registry after processing.

Both independent clean installs used --ignore-scripts: dependency installation hooks were not exercised. Downloaded tarball digests, registry/lock integrity and installed package bytes matched; each runtime audit reported zero vulnerabilities. npm-verified signatures/provenance bound each actual tarball to the source commit, tag ref, repository, workflow and publication run/attempt, rather than relying on decoded payloads alone.

Actual published-package smokes on Node 26.9.0 and genuine Node 22.13.0 completed eight ESM/CJS export-contract cases, 28 CLI invocations covering every declared identity-specific alias, and 36 MCP tool calls across six sessions. Five further native tool executions passed in a fresh normal-HOME omp session using the configured model/provider and published extension, with guidance, actual arguments/results and private native loading observed. These are operation counts, not independent tests. The existing active 0.36.3 installation was preserved unchanged; it was not a symlink, and no linked-development installation was assumed or upgraded.

Native runtime execution was macOS ARM64 only; the other five targets have build/file-byte evidence. HYBRID dry-run made no external embedding-provider requests. Direct imported-alias, one-hop related-caller and shadowed-name-negative evidence demonstrates bounded static linkage, not runtime test coverage. This was a fresh release smoke, not a frozen comparison replay/regrade or a general relevance/speed/SOTA claim; all historical limitations above remain.

Detailed observed outcomes and limits: final verification on PR #443.