opencode-agent-skill 7.7.0 → 10.0.0

package/CHANGELOG.md

@@ -6,12 +6,118 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+## [10.0.0] - 2026-09-22
+
+### Released
+- Promoted V10 RC.2 to stable after the local full gate passed with 182 tests passing, 0 failing, 2 platform-specific skips, plus package and install smoke validation.
+- Stable npm installs use the default `latest` dist-tag, so users install with `npm install -g opencode-agent-skill`.
+- Includes adaptive context/routing, weak-model recovery, no-progress watchdog, duplicate/loop guards, bounded exploration output, durable compaction checkpoints, provider recovery and retryable lease recovery.
+
+### Changed
+- Package version is 10.0.0.
+- V10 stable keeps FAST at 8k, STANDARD at 20k and DEEP at 48k while preserving configured executor capability and correctness-first verification gates.
+
+## [10.0.0-rc.2] - 2026-09-22
+
+### Added
+- No-progress watchdog for fresh executor sessions with active-tool grace so legitimate long-running tools are not killed merely for being quiet.
+- Duplicate exploration guard and loop detector for repeated read/grep/glob-style calls without new workspace/evidence progress.
+- Runtime tool-output budgets for large grep/glob/read/repo-graph style outputs.
+- Durable pre-compaction checkpoints containing current task, runId, plan hash, workspace fingerprint, evidence pointers and a structured next action.
+- Post-compaction resume enforcement with automatic fresh-session recovery when the next action is not executed.
+- Provider failure classification and recovery for no-token, timeout, rate-limit, upstream, quota, auth and context-overflow failures.
+- Periodic lease supervisor that recovers expired running executors to an explicit retryable state.
+
 ### Changed
-- The public npm distribution name is now the unscoped `opencode-agent-skill`, so users install it with `npm install -g opencode-agent-skill`.
+- Provider stalls retry once in a fresh session with the same model; repeated retryable provider failures use the configured escalation model/provider when available.
+- Stale lease recovery now records `retryable` instead of overloading terminal/logical `failed`.
+- Explicit `long/high-risk`, `high-risk`, and structured long/high-risk facts hard-override FAST/light routing to DEEP/heavy.
+- Package version is 10.0.0-rc.2.
+- npm tag releases publish prereleases under `next`; stable versions continue to use `latest`.
 
 ### Fixed
-- Packed global-install smoke derives the package install path from package metadata instead of assuming the former scoped npm name.
-- The installer accepts the former `@laivannha0202/opencode-agent-skill` state owner as legacy UES ownership and re-owns it as `opencode-agent-skill` during the next install.
+- A post-compaction session that only emits narrative text without executing the persisted next action is treated as stalled instead of silently completing.
+
+## [10.0.0-rc.1] - 2026-09-22
+
+### Added
+- Initial-input token telemetry and aggregate reporting for baseline-vs-UES evaluation.
+- Attempt-aware recovery policy with bounded context/skill escalation from initial execution to diagnosis and deep recovery.
+- Policy-aware FAST runtime routing that prioritizes direct domain/debug/review skills over generic orchestration.
+- Benchmark efficiency gates for initial input tokens and total tokens.
+- Reference-vs-candidate ablation CLI that requires pass-rate preservation and measurable initial-context reduction.
+
+### Changed
+- FAST context budget is 8k and STANDARD is 20k; DEEP remains 48k to preserve high-risk/long-horizon capability.
+- Always-loaded global engineering instructions are compressed while retaining exact-contract, evidence, verification, safety and durable-work invariants.
+- Retry context expands only after failure; repeated failures add graph/critic evidence instead of repeating speculative patches.
+- Adaptive model policy exposes recovery stage and does not silently downshift the configured/default executor tier for FAST tasks.
+- OpenCode V2 router metadata is versioned for the V10 policy-aware path.
+- Package version is 10.0.0-rc.1; npm publication/tagging is intentionally deferred until RC verification passes.
+
+## [9.0.0] - 2026-09-22
+
+### Added
+- Persistent incremental source index with bounded syntax-aware symbol/reference evidence and deterministic cache reuse.
+- Weak-model-oriented ACI commands for semantic search, exact text search, bounded file viewing and reference lookup.
+- FAST / STANDARD / DEEP execution profiles with adaptive context budgets, skill caps and verification depth.
+- Redacted operational trajectory JSONL for replay/debugging without recording hidden chain-of-thought.
+- Optional Docker/Podman verification sandbox with network-off, dropped capabilities, no-new-privileges and resource bounds.
+- Paired baseline-vs-UES confidence analysis with exact sign-test evidence, per-suite no-regression checks and speed limits.
+- Fail-closed `npm run evals:matrix:gate -- --model provider/model` release benchmark gate.
+- Regression tests for semantic index, ACI, trajectory redaction, sandbox arguments, benchmark confidence and stale lock takeover.
+
+### Changed
+- Context Manifest v4 consumes the incremental evidence index before broader graph expansion and keeps evidence labels explicit.
+- Learning promotion now requires complete paired benchmark evidence, statistically supported uplift and no suite regression.
+- OpenCode V2 dispatch records bounded redacted operational traces and adaptive execution-profile metadata.
+- Hardened live benchmark fairness by making previously implicit hidden-grader contract details explicit in task prompts without weakening hidden graders.
+- Clarified webhook stale/duplicate handling to require returning the exact original state reference, matching the hidden contract.
+- Counterbalanced paired live-eval execution order across tasks and trials to reduce provider order/throttling bias.
+- Focused small/FAST fixes now follow literal acceptance-contract discipline and avoid repo-wide discovery unless evidence requires it.
+- OpenCode live-eval telemetry now reads native `part.tokens` / `tokens` payloads in addition to `usage` payloads.
+- Extracted shared CLI parsing/read/truncation/error helpers into `lib/cli-utils.mjs` and added smoke/unit regression coverage.
+- Preserved documented CLI edge semantics while removing ad-hoc option parsing and unifying bounded output clipping.
+- Resolved README version drift and documented V9 capabilities.
+- Package version is 9.0.0.
+
+### Fixed
+- State locks use unique ownership tokens, heartbeat refresh and rename-based stale takeover so an expired owner cannot delete a replacement lock.
+- Generated `.ues-cache/` and `.ues-traces/` state no longer invalidates workspace verification fingerprints.
+- Windows CLI/router execution no longer falls back to shell-based `.cmd/.bat` invocation for unrecognized shims.
+- Windows doctor/OpenCode compatibility probing safely resolves extensionless Node-backed npm shims and fails closed instead of invoking `cmd.exe`.
+- Live benchmark execution now uses the same shell-free Windows resolver as `doctor`, skips unsupported batch shims in favor of safe native executables, and normalizes shim paths cross-platform.
+- Windows npm shim resolution can recover from non-standard `.cmd` formatting by resolving only an adjacent package's explicit `package.json` bin mapping, including extensionless Node launchers such as OpenCode.
+- Windows shim resolution also accepts validated native PE targets declared by npm package metadata, covering `opencode-ai` installs whose `bin.opencode` points to `bin/opencode.exe`.
+
+
+## [8.0.0] - 2026-09-20
+
+### Added
+- Structured plan and integration gate receipts bound to the current plan hash or workspace fingerprint, with gate receipts persisted in `EVIDENCE.json`.
+- Strict long/high-risk task completion that requires a successful verification receipt for the active `runId` and the current workspace fingerprint.
+- Append-only `EVENTS.jsonl` runtime journal for work initialization, plan import/approval, task start/heartbeat/session binding, verification receipts, failure/recovery, integration verification and finalization.
+- Task-scoped stale recovery and OpenCode V2 runtime tools for bounded executor cancellation/recovery.
+- Context manifest v3 with multilingual task terms, Git-change awareness, symbol hits, TF-IDF-style relevance scoring, related tests/instructions and adaptive centered excerpts.
+- Conflict-aware Git worktree integration plus automatic isolation support for concurrent writing executors.
+- Learning v2 with recurring failure clustering, explicit acceptance and shadow-benchmark promotion gates.
+- UES benchmark matrix runner for baseline-vs-UES comparison across standard, long-horizon and polyglot suites.
+- Eight polyglot benchmark tasks spanning Python, Java/Spring-style code, .NET, Next.js, React Native, SQL migration, monorepo boundaries and generated-contract discipline.
+- Control Center runtime-event visibility, receipt inspection and stale-task recovery control.
+- CodeQL, dependency review, Dependabot maintenance and release-tag/version consistency checks.
+
+### Changed
+- Fresh OpenCode V2 executor sessions now use bounded waits and `session.interrupt` on timeout, with capability probing and graceful degradation when optional hooks are unavailable.
+- Process execution escalates Unix process-tree cancellation from SIGTERM to SIGKILL after a bounded grace period and always reports cancelled runs as nonzero.
+- Router/task policy adds multilingual and framework-aware signals while preserving deterministic caps.
+- Managed resource ownership now uses `managed-by: opencode-agent-skill` while automatically recognizing and migrating the former scoped marker.
+- Package version is 8.0.0. Existing `opencode-agent-skill@7.7.0` users remain on the same package name and can update normally.
+
+### Fixed
+- Strict verification no longer accepts a receipt after the workspace changed.
+- Sandbox cleanup refuses to delete non-UES branches and removes temporary UES branches after successful integration.
+- Learning proposals cannot be promoted before explicit acceptance.
+- Plain npm-install smoke now reports lifecycle-script auto-sync versus explicit `ocskill install` recovery accurately.
 
 ## [7.7.0] - 2026-09-20
 
@@ -27,12 +133,15 @@ The project follows Semantic Versioning.
 - V2 runtime capability probing tool and fail-closed fresh-dispatch checks.
 
 ### Changed
+- The public npm distribution name is the unscoped `opencode-agent-skill`, so users install it with `npm install -g opencode-agent-skill`.
 - Live evaluation runs are asynchronous and observable: start messages, periodic heartbeats, hard timeout, idle timeout and Ctrl+C process-tree cancellation are supported.
 - V2 fresh task dispatch refreshes durable task leases while the executor session runs and reports task policy/runId alongside model policy.
 - Workspace fingerprints ignore UES runtime-only learning/dashboard/sandbox directories in addition to `.ues-work`.
 - Package version is 7.7.0.
 
 ### Fixed
+- Packed global-install smoke derives the package install path from package metadata instead of assuming the former scoped npm name.
+- The installer accepts the former `@laivannha0202/opencode-agent-skill` state owner as legacy UES ownership and re-owns it as `opencode-agent-skill` during the next install.
 - Live baseline/UES evaluation detects the OpenCode major version: OpenCode 1.x omits the V2-only `--standalone` flag, while OpenCode 2.x+ keeps it. Eval JSON records the detected OpenCode version/major for reproducibility.
 - The V2 automatic router retains domain/impact skills and `ues-engineering-orchestrator` ahead of generic process skills when the configured skill cap is exceeded.