opencode-agent-skill 7.7.0 → 9.0.0

package/CHANGELOG.md

@@ -6,12 +6,69 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+## [9.0.0] - 2026-09-22
+
+### Added
+- Persistent incremental source index with bounded syntax-aware symbol/reference evidence and deterministic cache reuse.
+- Weak-model-oriented ACI commands for semantic search, exact text search, bounded file viewing and reference lookup.
+- FAST / STANDARD / DEEP execution profiles with adaptive context budgets, skill caps and verification depth.
+- Redacted operational trajectory JSONL for replay/debugging without recording hidden chain-of-thought.
+- Optional Docker/Podman verification sandbox with network-off, dropped capabilities, no-new-privileges and resource bounds.
+- Paired baseline-vs-UES confidence analysis with exact sign-test evidence, per-suite no-regression checks and speed limits.
+- Fail-closed `npm run evals:matrix:gate -- --model provider/model` release benchmark gate.
+- Regression tests for semantic index, ACI, trajectory redaction, sandbox arguments, benchmark confidence and stale lock takeover.
+
 ### Changed
-- The public npm distribution name is now the unscoped `opencode-agent-skill`, so users install it with `npm install -g opencode-agent-skill`.
+- Context Manifest v4 consumes the incremental evidence index before broader graph expansion and keeps evidence labels explicit.
+- Learning promotion now requires complete paired benchmark evidence, statistically supported uplift and no suite regression.
+- OpenCode V2 dispatch records bounded redacted operational traces and adaptive execution-profile metadata.
+- Hardened live benchmark fairness by making previously implicit hidden-grader contract details explicit in task prompts without weakening hidden graders.
+- Clarified webhook stale/duplicate handling to require returning the exact original state reference, matching the hidden contract.
+- Counterbalanced paired live-eval execution order across tasks and trials to reduce provider order/throttling bias.
+- Focused small/FAST fixes now follow literal acceptance-contract discipline and avoid repo-wide discovery unless evidence requires it.
+- OpenCode live-eval telemetry now reads native `part.tokens` / `tokens` payloads in addition to `usage` payloads.
+- Extracted shared CLI parsing/read/truncation/error helpers into `lib/cli-utils.mjs` and added smoke/unit regression coverage.
+- Preserved documented CLI edge semantics while removing ad-hoc option parsing and unifying bounded output clipping.
+- Resolved README version drift and documented V9 capabilities.
+- Package version is 9.0.0.
 
 ### Fixed
-- Packed global-install smoke derives the package install path from package metadata instead of assuming the former scoped npm name.
-- The installer accepts the former `@laivannha0202/opencode-agent-skill` state owner as legacy UES ownership and re-owns it as `opencode-agent-skill` during the next install.
+- State locks use unique ownership tokens, heartbeat refresh and rename-based stale takeover so an expired owner cannot delete a replacement lock.
+- Generated `.ues-cache/` and `.ues-traces/` state no longer invalidates workspace verification fingerprints.
+- Windows CLI/router execution no longer falls back to shell-based `.cmd/.bat` invocation for unrecognized shims.
+- Windows doctor/OpenCode compatibility probing safely resolves extensionless Node-backed npm shims and fails closed instead of invoking `cmd.exe`.
+- Live benchmark execution now uses the same shell-free Windows resolver as `doctor`, skips unsupported batch shims in favor of safe native executables, and normalizes shim paths cross-platform.
+- Windows npm shim resolution can recover from non-standard `.cmd` formatting by resolving only an adjacent package's explicit `package.json` bin mapping, including extensionless Node launchers such as OpenCode.
+- Windows shim resolution also accepts validated native PE targets declared by npm package metadata, covering `opencode-ai` installs whose `bin.opencode` points to `bin/opencode.exe`.
+
+
+## [8.0.0] - 2026-09-20
+
+### Added
+- Structured plan and integration gate receipts bound to the current plan hash or workspace fingerprint, with gate receipts persisted in `EVIDENCE.json`.
+- Strict long/high-risk task completion that requires a successful verification receipt for the active `runId` and the current workspace fingerprint.
+- Append-only `EVENTS.jsonl` runtime journal for work initialization, plan import/approval, task start/heartbeat/session binding, verification receipts, failure/recovery, integration verification and finalization.
+- Task-scoped stale recovery and OpenCode V2 runtime tools for bounded executor cancellation/recovery.
+- Context manifest v3 with multilingual task terms, Git-change awareness, symbol hits, TF-IDF-style relevance scoring, related tests/instructions and adaptive centered excerpts.
+- Conflict-aware Git worktree integration plus automatic isolation support for concurrent writing executors.
+- Learning v2 with recurring failure clustering, explicit acceptance and shadow-benchmark promotion gates.
+- UES benchmark matrix runner for baseline-vs-UES comparison across standard, long-horizon and polyglot suites.
+- Eight polyglot benchmark tasks spanning Python, Java/Spring-style code, .NET, Next.js, React Native, SQL migration, monorepo boundaries and generated-contract discipline.
+- Control Center runtime-event visibility, receipt inspection and stale-task recovery control.
+- CodeQL, dependency review, Dependabot maintenance and release-tag/version consistency checks.
+
+### Changed
+- Fresh OpenCode V2 executor sessions now use bounded waits and `session.interrupt` on timeout, with capability probing and graceful degradation when optional hooks are unavailable.
+- Process execution escalates Unix process-tree cancellation from SIGTERM to SIGKILL after a bounded grace period and always reports cancelled runs as nonzero.
+- Router/task policy adds multilingual and framework-aware signals while preserving deterministic caps.
+- Managed resource ownership now uses `managed-by: opencode-agent-skill` while automatically recognizing and migrating the former scoped marker.
+- Package version is 8.0.0. Existing `opencode-agent-skill@7.7.0` users remain on the same package name and can update normally.
+
+### Fixed
+- Strict verification no longer accepts a receipt after the workspace changed.
+- Sandbox cleanup refuses to delete non-UES branches and removes temporary UES branches after successful integration.
+- Learning proposals cannot be promoted before explicit acceptance.
+- Plain npm-install smoke now reports lifecycle-script auto-sync versus explicit `ocskill install` recovery accurately.
 
 ## [7.7.0] - 2026-09-20
 
@@ -27,12 +84,15 @@ The project follows Semantic Versioning.
 - V2 runtime capability probing tool and fail-closed fresh-dispatch checks.
 
 ### Changed
+- The public npm distribution name is the unscoped `opencode-agent-skill`, so users install it with `npm install -g opencode-agent-skill`.
 - Live evaluation runs are asynchronous and observable: start messages, periodic heartbeats, hard timeout, idle timeout and Ctrl+C process-tree cancellation are supported.
 - V2 fresh task dispatch refreshes durable task leases while the executor session runs and reports task policy/runId alongside model policy.
 - Workspace fingerprints ignore UES runtime-only learning/dashboard/sandbox directories in addition to `.ues-work`.
 - Package version is 7.7.0.
 
 ### Fixed
+- Packed global-install smoke derives the package install path from package metadata instead of assuming the former scoped npm name.
+- The installer accepts the former `@laivannha0202/opencode-agent-skill` state owner as legacy UES ownership and re-owns it as `opencode-agent-skill` during the next install.
 - Live baseline/UES evaluation detects the OpenCode major version: OpenCode 1.x omits the V2-only `--standalone` flag, while OpenCode 2.x+ keeps it. Eval JSON records the detected OpenCode version/major for reproducibility.
 - The V2 automatic router retains domain/impact skills and `ues-engineering-orchestrator` ahead of generic process skills when the configured skill cap is exceeded.