OpenLore 3.0.1

OpenLore 3.0.1 delivers the OpenLore 3 major release to npm.

The 3.0.0 GitHub release exposed a release-workflow ordering mistake before any package reached npm: security-hook tests ran before the trusted launcher was built. We preserved that public tag as an honest record, corrected the workflow in this patch, repeated every release gate, and published the exact validated artifact as 3.0.1.

OpenLore 3 makes trust part of the architecture. It is more honest about what it analyzed, more careful with repositories it does not trust, and much harder to misconfigure at the boundaries between local code, agent tooling, and release infrastructure.

Highlights

• Secure by default. Repository-controlled symlinks can no longer redirect OpenLore writes outside their intended targets. Local daemon traffic is token-protected by default, legacy daemons are negotiated safely, and installed Git hooks pin a trusted OpenLore launcher instead of executing mutable project binaries.
• Secrets stay out of model context. Committed repository configuration can no longer resurrect ignored secret files or disable tool-output redaction. Explicit operator controls remain available when that behavior is intentional.
• More honest analysis and drift results. Analysis reports whether it came from cache, drift reports carry coverage receipts, and unavailable checks no longer masquerade as clean results.
• Stronger governance. Enforcement schema v3 normalizes severity names and adds frozen-baseline ratchet evidence. Decision-gate grace periods are bound to the exact staged source snapshot.
• A release pipeline that proves what it ships. CI tests the exact Node.js floor, deterministic integration paths, Windows packaging, dependency audit behavior, package contents, and the immutable artifact promoted to npm. Nix packaging is synchronized with the release.
• Fresh, compatible tooling. This release includes OpenSpec 1.10, Vitest 4.1.11, TypeBox 1.3.16, Vite 8.2.2, Inquirer 8.6, and CodeQL Action 4.37.8. Native parser and vector-store jumps that did not preserve behavior were deliberately held for dedicated compatibility work.

Breaking changes in OpenLore 3

• Analysis results now require fromCache; depGraph is optional when no trustworthy persisted graph exists.
• Generation and full-run results are discriminated by dryRun. Narrow on result.dryRun before reading pipelineResult, init, or analysis.
• GenerationReport.configSchemaVersion is required. openloreVersion now consistently means the OpenLore package version.
• Drift JSON requires analyzedFiles and filesOmitted. Exit code 1 means confirmed drift; exit code 2 means the check could not run.
• Enforcement JSON is schema version 3. Severity warn is now warning.
• The minimum supported Node.js version is 22.19.0.

Upgrade

npm install --global openlore@3.0.1

If you embed OpenLore as a library, update result narrowing and report types before deploying. If you use installed Git hooks or the local daemon, reinstall or restart them after upgrading so they receive the v3 launcher and protocol protections.

Full changelog: v2.2.0...v3.0.1