Release v2.17.0 · ZeR020/opencode-mem0

v2.17.0 — 2026-06-28

file://~/ path expansion in *ApiKey config fields — file:// references with ~ (home directory) now work on Linux. Previously new URL() parsed ~ as the URL host and threw. ~ is now expanded before URL parsing. (#34)
initConfig() empty-config guard — When both global and project config sources return empty (transient I/O failure, file lock, race condition), the existing CONFIG singleton is preserved instead of being silently overwritten with hardcoded defaults. (#35, #36)

initConfig() silent CONFIG reset — buildConfig({}) was called with an empty object when config files were transiently inaccessible, resetting all user-configured values (embedding model, dimensions, API endpoint) to defaults. The guard preserves the existing CONFIG from module-level initialization. (#35)
file://~/ throws on Linux — secret-resolver.ts called new URL(value) before expanding ~, causing fileURLToPath to throw "File URL host must be localhost or empty". (#34)
Vitest critical CVE (GHSA-5xrq-8626-4rwp) — Updated vitest and @vitest/coverage-v8 to 3.2.6, fixing arbitrary file read/execute via Vitest UI server. Dev-only dependency, not shipped to users.

NSW vector backend — NSWBackend (nsw-backend.ts, 321 lines) was production-unreachable: the VectorBackendConfig enum only allows usearch-first/usearch/exact-scan, so nsw/nsw-first were factory-only dead branches. Removed NSWBackend, the nsw/nsw-first factory branches, the createNSWBackend injection seam, and cosineDistance (only NSW caller).
supportsSession() abstract method — Removed from BaseAIProvider and all 4 provider overrides. Every implementation returned true and no code branched on the result.
profile-utils.ts — Deleted dead code (safeArray/safeObject exports with zero importers).
aiSessionManager backward-compatible Proxy export — Removed redundant singleton surface. All consumers use getAISessionManager() via constructor injection.
getSupportedProviders() on AIProviderFactory — Removed zero-caller method.
startCleanupSchedule/stopCleanupSchedule static methods on AIProviderFactory — Inlined as setInterval/clearInterval in index.ts.
ConflictCheckLock class — Inlined as a module-level Set<string> (single consumer).

iso-639-3 full dataset replaced with Intl.DisplayNames — Language name lookup now uses the native API instead of importing the full ~9000-entry dataset.
Dynamic imports converted to static — auto-capture.ts and handlers/memory.ts now use static imports, removing unnecessary async overhead.
.gitignore reorganized — 280-line catch-all replaced with 73-line categorized file.
localStorage API key storage — Added comment documenting the accepted security tradeoff (localhost-only server).

Thanks to the community contributors who reported issues and submitted fixes:

#34 — Support file:// with ~ expansion in *ApiKey config fields
#35 — initConfig() silently resets CONFIG to defaults when global config file is transiently inaccessible
#36 — Guard initConfig against silent config reset on empty file load (approach applied directly)
#37 — Preserve global config during transient init misses (closed, over-engineered)

Full Changelog: v2.16.2...v2.17.0