Highlights
- Add private, project-opt-in GitHub issue and pull-request history across MCP, OpenCode, Pi, omp and CLI surfaces. Synchronization is explicit and read-only through existing
gh authentication; history is stored and searched locally, separately from ordinary code search, context, AST/call graphs and linked tests. Search returns cited, grounded passages, supports short technical terms, and prioritizes direct identifiers and primary descriptions. (#461)
- Reconcile required REST pages with conditional ETags while retaining deletion/tail reconciliation and fresh capability checks. Preserve cancellation and atomic publication, resumable private staging, explicit initial-window provenance and detected-access-loss cleanup. This is local lexical history, not cloud-embedded semantic history or real-time offline permission verification. (#461)
- Make both MCP binary names print root
--help/-h before configuration, providers, indexing, watchers or MCP worker startup. No-argument stdio startup and subcommand routing are unchanged. (#458)
- Raise the qualified
ip-address security floor and sole source-lock resolution to 10.7.4, addressing GHSA-rxp7-6hxx-x8q5 / CVE-2026-111997. This source/lock remediation is distinct from the unresolved GitHub alert state described below. Root overrides do not repair arbitrary pre-existing downstream consumer locks. (#463)
- Remove the inert tsup 8.x esbuild override without refreshing the checked-in dependency tree. This is configuration cleanup, not a bundler upgrade or new security remediation. Synchronize release metadata and security support for 0.38.x and 0.37.x. (#460, #462)
Verification already observed
- Exact merged-source commit
6b7c61e41c91584b12e7908e283d940184f4d2c3, tree 5763ea530e86a268050b75e314eac17537fc0482, has 13/13 successful checks and three successful exact-head runs, including CI and CodeQL.
- The accepted clean qualification ran build, typecheck, lint and
pretest:run, followed by the literal unfiltered Vitest run payload: 2,891 passed, 0 failed, 6 skipped. The watcher target passed in 1,574 ms. This is a two-stage canonical-equivalent invocation, not a claim that literal npm run test:run was executed. No source overlay or product patch was used. The unchanged candidate was not rebuilt or retested for publication preflight.
- The final bounded prepublication check found the same exact main commit, matching 0.38.0 package/lock/plugin metadata, sole locked
ip-address@10.7.4 with registry-matching integrity, and open security board counts Dependabot 1 / code scanning 0 / secret scanning 0.
Explicit release exceptions and limits
- Dependabot alert #76 remains OPEN, with stored dependency requirement
10.7.1 and fixed_at: null, despite the patched source lock. This release proceeds under the user's narrowly scoped authorization for that existing GitHub alert-state mismatch. The alert is not called fixed, cleared or dismissed; no Support case, dismissal, settings change, synthetic dependency snapshot or broad update/retry was used.
- The historical watcher failure's cause remains UNKNOWN. The user explicitly accepted that historical risk for this qualified candidate. The current passing run does not establish a historical fix or a flake diagnosis.
- The published consumer requirement remains Node >=22.13.0. Both npm identities are intended to remain synchronized:
open-codebase-index@0.38.0 and compatibility opencode-codebase-index@0.38.0. Windows ARM64 remains experimental/best-effort; the other five native targets are required by the publication workflow.
- Trusted-workflow publication, exact registry installation, integrity/signature/provenance binding, all declared aliases, MCP/native behavior and fresh normal-profile published-extension omp verification are post-publication requirements, not observations claimed by these prepublication notes. Actual outcomes will be recorded on release PR #462 if the published release is immutable. Local runtime evidence must not be represented as all-platform execution.
- No frozen comparison replay/regrade, historical campaign mutation, watcher repair, or performance/relevance/SOTA claim is made.
Complete changelog · Full delta since v0.37.2
