v0.33.0

Highlights

• Selective Git-ignored indexing: indexing.includeIgnored opts specific ignored project sources into initial indexing and watching while preserving include, exclude, and safety filters (#373).
• Context and routing fixes: Incorporates the previously prepared but unpublished 0.32.2 work, including complete repository-relative evidence paths, routing hint lifetime and delivery, A/B terminology handling, retrieval guidance, and source-grounded routing (#371).
• Dependency security: Patches fast-uri and ip-address, closing four runtime Dependabot findings (#374).

The full change history since published v0.32.1 is in CHANGELOG.md.

Release checks

• Reconciled against all commits since v0.32.1.
• Changelog, npm version and Claude/Codex plugin manifests updated to 0.33.0.
• Node 22 and 24 CI, CodeQL, and cross-platform checks passed. Initial Node 22 test race was fixed with a deterministic integration test (#375).
• Both package identities staged and inspected, npm audit --omit=dev reports zero vulnerabilities.
• Trusted publish workflow passed on six native targets, including Windows ARM64. Both package identities at 0.33.0 are the npm latest version, with signed provenance. Clean installations load ESM, CJS and native bindings, and initialize MCP with 19 tools.

Two moderate findings remain in the development-only Pi coding agent dependency.