OpenCode MCP Bridge v0.4.2
Changed
- CI runtime caps and least privilege: timeout-minutes 20 on validate-pr, validate-main, docker (ci.yml) and verify (release.yml); top-level permissions contents:read in ci.yml to match release.yml.
- Codex approval metadata: .mcp.json declares worker_decide and worker_resume with approval_mode prompt; bundle test pins exact 8-tool safe set with prompt vs approve modes.
- Empty-taskID validation: worker_status rejects empty/whitespace taskID with ValueError before backend I/O, matching wait/verify/cleanup.
Tests
- Full offline gate on PR head 6235cc6: uv sync --frozen, pytest 416 passed 8 skipped, ruff check, ruff format --check, git diff --check, workflow YAML parse, JSON manifest validation (server.json, plugin manifests, .mcp.json), secret scan clean.
- Focused: worker_status empty-taskID rejected with zero backend calls; missing-session 404/500 still maps to stable unknown; bundle approval test green.
Patch: PR #33 (release/v0.4.2) into master (base v0.4.1 merge 9dc83a3).
Merge: bd512df
Tag: v0.4.2 on merged master
Note: pyproject.toml, server.json, and .codex-plugin/plugin.json still carry pre-existing version 0.4.0 metadata (not bumped in this PR); the release identity is the git tag v0.4.2, not a package version claim.