Repository navigation
v3.5.6
What's new
Bug Fixes
The receipt guard now correctly attributes worktree-targeted operations to the worktree they actually touched, closing out issue #678 end-to-end. Previously, child operations that acted on a registered worktree could have their receipts rolled up under the parent observer's identity, and ambient GIT_DIR/GIT_WORK_TREE environment variables could spoof which repository an observer subprocess believed it was operating in. The fix introduces validateRegisteredWorktree (checking common-dir identity, git worktree list membership, and .git linkage) and strips GIT_* variables from observer subprocesses before they run.
On top of that validation, deriveOpencodeOperationTarget resolves the actual worktree a bash/write/edit/apply_patch operation acted on — from workdir, filePath, path, or multi-file patch targets — and fails closed on escaping, mixed-worktree, or git-admin paths. rollupForegroundTask now snapshots each recovered child receipt's authenticated operationTargetIdentity instead of assuming the fixed parent observer, and is fatal on workspace/target/registration mismatches while remaining skippable only for repository/worktree revision staleness after the target already matches.
Completion readback was the last gap: it now resolves a single effective completion observer — the pinned registered worktree for pinned units, the parent observer otherwise — and anchors both the global and remote final readbacks to that target's revision, while workspaceIdentity stays the stable parent identity. This eliminates the cross-root false "worktree delta" that had been marking legitimate worktree-targeted evidence as stale, and adds defense-in-depth by requiring a pinned unit's global readback to carry the pinned operationTargetIdentity.
Follow-up review fixes registered operation-target-mismatch in the REASON_CODES set so the reason round-trips at the host marker boundary instead of degrading to guard-unavailable, threaded operationTargetIdentity through the legacy single-readback parser, and replaced an unsafe cast with proper digest narrowing at the receipt envelope parse boundary.
Also in this release
- build: Bump OpenCode to v1.18.10.
- chore: Bump the playwright dependency to v1.62.1.