v0.35.1

Highlights

• Patch the native xxhash-rust dependency to 0.8.16 for GHSA-6g2r-675j-hx59. The affected custom-secret API is not used by this project's native hashing wrappers; default-secret hash outputs are unchanged.
• Remove the remaining development-only npm audit finding by upgrading Pi's contract dependency to 1.0.1, which no longer publishes the vulnerable shrinkwrapped brace-expansion subtree.
• Preserve the tested OpenCode plugin 1.3.13 pin during clean installs without raising the Node.js 22.13 consumer runtime floor or adopting the deferred beta-dependent plugin upgrade.
• Correct pre-edit evaluation to grade the final evidence order shown to agents, and classify fallback source paths relative to the project root. Checkout names such as snapshot, tests, or docs no longer defeat source-first fallback packing.

Implemented in #404. No public tool names, storage paths, index formats, or retrieval quality thresholds changed.

Full changelog · Compare v0.35.0…v0.35.1

Verification

• Follow-up full suite on Node 22.13: 2,586 passed, 6 skipped; typecheck and lint passed.
• Native rebuild and default-secret hash-stability smoke passed.
• Representative, agent-context, and pre-edit production-CLI quality gates passed without changing labels or thresholds. Pre-edit Hit@5 and MRR@10 both reached 1.0.
• Repository npm audit: zero vulnerabilities, including development dependencies.
• Both packed package identities passed engine-strict clean-install CLI smoke checks on Node 22.13.
• Release metadata validation and release PR #405 CI passed. Local release suite on Node 22.13: 2,586 passed, 6 skipped.
• Merged release commit 3f8421b passed main CI before tagging.
• Build and Publish completed via npm trusted publishing for both package identities; all six native target builds passed, including Windows ARM64.
• Both published identities passed engine-strict clean installs on Node 22.13.0 and production npm audits with zero vulnerabilities. Verified ESM/CJS loading, all six packaged bindings and local native generator parsing, every advertised CLI alias, actual indexing/incremental call-graph retention/search, MCP server version 0.35.1 with 19 tools and working graph/search calls, and real omp index_status/call_graph execution returning resolved streamRecords → normalizeRecord.

Publication provenance: open-codebase-index and opencode-codebase-index.

Local validation note: the first full-suite run missed one native-watcher config event on macOS. Twelve direct single-write probes correctly refreshed the call graph, and the unchanged full suite then passed. No watcher source, tests, or timeouts were changed; the initial failure's root cause was not established.

Compatibility notes

Published packages retain Node.js >=22.13 support. The development-only Pi toolchain declares Node >=22.19 and retains the engine warnings already present before this upgrade; installation and the full test suite were exercised on Node 22.13. The OpenCode plugin upgrade tracked in #392 remains deferred. Windows ARM64 remains a best-effort build target; the publish workflow reports any missing experimental binding explicitly.