opencode-context-indicator 1.8.3 → 1.8.4

package/CHANGELOG.md

@@ -4,6 +4,17 @@ Notable user-facing changes per release. Dates are commit days (UTC).
 The package also ships a dual V1/V2 plugin — see the README for the surface
 matrix; everything below concerns the V2 path unless stated otherwise.
 
+## 1.8.4 — 2026-11-06
+
+- CI gained a runtime-only dependency audit (`npm audit --omit=dev`, also
+  `npm run test:audit`): the package ships no dependencies, so that number must
+  stay at zero. The dev tree keeps 26 moderate advisories inside npm's own CLI
+  packages pulled by `@opencode/plugin` (types only) plus `glob`/`minimatch` with
+  no upstream fix; two of them are not fixable without dropping the typecheck
+  dependency, and none of them can reach a user. The README documents the
+  expected `WARN EBADENGINE` from `@opentui/core` (`node >= 26.4.0`) in a
+  checkout.
+
 ## 1.8.3 — 2026-11-03
 
 - **A deleted session disappears immediately.** `session.deleted` now removes the

package/README.md

@@ -703,6 +703,15 @@ package — the sidebar is live there too, exactly as with an npm install (see
   adds **no** runtime dependency; `solid-js`, the GUI SDK and the client are
   provided by the app itself. On hosts without that API the export is simply not
   loaded and everything else keeps working.
+* **Developing in a checkout** (not a user-facing requirement): `npm install`
+  may print `WARN EBADENGINE` for `@opentui/core`, which declares
+  `node >= 26.4.0` while the repo is developed and tested on Node 20/22. It is a
+  devDependency (plus an optional peer) used only for typechecking and for the
+  gate's resolve/version checks - the plugin itself runs inside the host's Bun
+  and installs no dependencies for a user, so the warning is expected and
+  harmless. The CI audit step therefore checks `npm audit --omit=dev` (zero
+  findings) instead of the dev tree, where several advisories live inside npm's
+  own CLI packages pulled in by `@opencode/plugin`.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-context-indicator",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "Real-time context-window usage for OpenCode: per-category token breakdown, /context-diff, a zero-LLM /cx panel with per-session cost and a searchable family-session picker, a TUI sidebar, and an experimental Desktop panel. Dual V1 + V2 plugin entry.",
   "type": "module",
   "license": "MIT",
@@ -86,6 +86,7 @@
     "test:e2e:quick": "node test/e2e-tui.mjs --quick",
     "test:drift": "node test/drift-watch.mjs",
     "test:drift:strict": "node test/drift-watch.mjs --strict",
+    "test:audit": "npm audit --omit=dev --audit-level=moderate",
     "prepublishOnly": "npm run build:gui && node test/prepublish.mjs && node test/e2e-tui.mjs --full"
   }
 }