v0.2.59

OrangePro 0.2.59

Security

• OrangePro no longer reads .env files. Model keys, the provider, its endpoint and the model now come only from your shell environment, or from the env block of your MCP client's config.
  • Why: in 0.2.58, a repository you scanned could commit a .env that sent your key, and the context drafted from your code, to an endpoint of its choosing.
  • What to do: if you kept a key in .env.provider.local, .env.local or .env, set it in your shell or MCP config instead.
• Dependency advisories: the MCP SDK moves to 1.32.2, zod to 4.6.7, and the Express dependencies are refreshed. npm audit --omit=dev finds no vulnerabilities.
• Proof runs no longer write the test mutation into your own files when the source folder you pass is a symbolic link. This applies in every language: JavaScript, TypeScript, Go, Java and Python.

JavaScript support

• More public functions are seen:
  • export { a, b } lists;
  • Foo.prototype.x = function …;
  • methods assigned to an exported object, as Express does (res.cookie = function …);
  • module.exports = { a, b };
  • an unnamed export default function.
• What counts: only functions a package actually hands out are counted. Plumbing that only stores, returns or passes values on is kept in the graph but not counted.

New: proving a change, one fault at a time

Four commands take one changed function from a merged change to a reviewable test patch. Each writes a run folder with a manifest of checksums.

• opro probe-fault puts one exact fault into the changed function, runs the existing tests on an original and a faulty copy inside a container, and says honestly whether they caught it.
• opro test-brief writes, for a fault the existing tests missed, what a coding agent needs to write one new test: the expected behavior, the fault and the rules.
• opro verify-test runs that new test on the original, on the fault (twice), under text controls, restored, and in the whole suite. It reports verified_gap only when the test passes on the original and fails at its own declared assertion on the fault. It refuses tests that read the code's text, replace built-ins, or forge where a failure comes from.
• opro export-tests turns a verified run into a test-only patch, replays it on a fresh copy, and writes a verification receipt with proof rows A–H.

A verified result means one named test caught one specified fault at its declared assertion, on one revision. It is not a claim of general correctness.

Build identity

• Every build is stamped (dist/local/build-info.json). OrangePro refuses to run a build whose files changed after it was built, or that mixes files from two builds.
• opro start prints the build, the ranking configuration hash and the rank-exclude paths. Receipts record the build that made them.

Requirements

Node ^22.23.4, ^24.22.1 or >=26.12.1, on macOS or Linux.