v0.38.1

v0.38.1

Highlights

• GitHub Enterprise history and omp CLI compatibility: accept [HOST/]OWNER/REPO history selectors with selected-server gh REST/GraphQL routing and host-isolated identity, while preserving GitHub.com and valid legacy staging compatibility. CLI --host omp uses canonical Pi mode without adding a programmatic HostMode.
• Selected-source watcher registration recovery: reuse bounded one-shot polling recovery when Node rejects an identified, readable, selected source watch registration with EPERM or EACCES beneath traversable, policy-eligible project ancestors. Default polling remains off; unreadable, excluded, restricted, root-build, configuration-only, directory and ambiguous-target handling remain conservative.
• Consumer regression and failure capture: check actual callbacks and indexed definitions, including a second real edit after the first update settles. Preserve early backend error/readiness anchors and phase counts in failure-only contributor captures, plus legacy staging and cancellation-test setup regressions without attributing earlier untraced failures.
• Dependency security: resolve body-parser 2.4.0, fast-uri 3.1.9, and development Undici 8.12.3 (patched floor 8.12.2), addressing seven alerts across four package families. The affected dependency graph was already present in v0.38.0; it was not introduced by the watcher release preparation.
• Safe standalone OpenCode packaging: retain the existing bundled helper and tool.schema convention with direct Zod ^4.6.7. Move @opencode-ai/plugin@1.3.13 to build-only use; declare dependency-free @opencode-ai/sdk@1.3.13 for shared public client type identity. Preserve the existing SDK schema type ABI using only integrity-pinned, unmodified declarations and their MIT notice—not legacy implementation JavaScript. Strict standalone and unmodified upstream SDK interoperability remain supported in ESM and CommonJS.
• Privacy documentation: clarify configured-provider boundaries, local cache behavior, and explicitly opted-in manual history synchronization.

Both package identities advance to 0.38.1. The published Node.js runtime minimum remains 22.13.0. The existing development Node.js floor is unchanged; development Undici already required 22.19.0.

Changes since v0.38.0

• GitHub Enterprise history and omp compatibility — #464
• Release metadata, privacy documentation and controlled watcher repair — #465
• Dependency security and preserved OpenCode type contracts — #468

Reconciled changelog

Observed source validation

On source commit 5d2ab1d73c8e830d5a3973be727f19ed6268616a (tree 793b250b106c31d377592177467a404423c9d6f1):

• Canonical npm run build, npm run typecheck, npm run lint, and unfiltered npm run test:run passed once, with native pretest intact: 2,916 tests passed and 6 existing tests skipped, across 147 passed files and 1 existing skipped file.
• Both actual local package identities passed engine-strict source-package acceptance at Node.js 22.13.0: eight strict TypeScript 5.9.3 ESM/CommonJS compiles, including separate unmodified SDK interoperability, plus real runtime imports, seven CLI aliases, MCP initialize/tools-list, and parsing through each installed native addon.
• Fresh source/full, source/runtime, and both ordinary packed-consumer production audits reported zero findings. The external unmodified SDK comparison fixture is not our production dependency graph.
• The controlled watcher registration fault had failed its real-filesystem consumer oracle before repair and passed the unchanged oracle afterward; the retained 75 targeted watcher cases also passed.

Accepted historical uncertainty

On 2026-10-25, the owner chose to proceed despite the documented historical uncertainty. An earlier f402 watcher failure remains unattributed because its critical early registration/error observations were irretrievably lost. The controlled repair and successful source checks do not recover those observations, establish that old cause, or retroactively pass the old failed gate. This risk decision does not waive the subsequently discovered dependency alerts.