triss-coworker 0.24.0 → 0.24.2

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.24.2] — 2026-07-15
+
+### Changed
+
+- Bumped the pinned `@phpcraftdream/crush` version for the `triss coder` crush
+  engine from `0.1.3` to `0.1.6` (`CRUSH_PIN_DEFAULT`). Override with
+  `TRISS_CODER_CRUSH_VERSION` as before. Re-verified live against `0.1.6`
+  (clean `crush version v0.1.6`, single JSON envelope, `ZHIPU_API_KEY`→`ZAI_API_KEY`
+  env bridge, `--restrict-run` CLI-flag allowlist enforcement, and disposable
+  worktree isolation all unchanged). Updated the default across `.env.example`,
+  `docs/configuration.md`, `docs/glm-clients.md`, and the CLAUDE/Codex templates.
+  `detect()` still tolerates older binaries non-fatally (a below-pin version
+  prints a yellow warning but runs).
+
+## [0.24.1] — 2026-07-10
+
+### Changed
+
+- Bumped the pinned `opencode-ai` version for `triss coder` from `1.17.13` to
+  `1.17.18` (`OPENCODE_PIN`). Override with `TRISS_CODER_OPENCODE_VERSION` as
+  before. Updated the default across `.env.example`, `docs/configuration.md`,
+  `docs/glm-clients.md`, and the CLAUDE/Codex templates.
+
 ## [0.24.0] — 2026-07-10
 
 ### Added
@@ -644,7 +667,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial release of `triss-coworker`.
 
-[Unreleased]: https://github.com/ayleen/triss-coworker/compare/v0.22.2...HEAD
+[Unreleased]: https://github.com/ayleen/triss-coworker/compare/v0.24.1...HEAD
+[0.24.1]: https://github.com/ayleen/triss-coworker/compare/v0.24.0...v0.24.1
+[0.24.0]: https://github.com/ayleen/triss-coworker/compare/v0.23.0...v0.24.0
+[0.23.0]: https://github.com/ayleen/triss-coworker/compare/v0.22.4...v0.23.0
+[0.22.4]: https://github.com/ayleen/triss-coworker/compare/v0.22.3...v0.22.4
+[0.22.3]: https://github.com/ayleen/triss-coworker/compare/v0.22.2...v0.22.3
 [0.22.2]: https://github.com/ayleen/triss-coworker/compare/v0.22.1...v0.22.2
 [0.22.1]: https://github.com/ayleen/triss-coworker/compare/v0.22.0...v0.22.1
 [0.22.0]: https://github.com/ayleen/triss-coworker/compare/v0.21.0...v0.22.0

package/docs/configuration.md

@@ -249,9 +249,9 @@ self-hosted endpoints).
 | `OPENCODE_API_KEY`               | no¹      | —                  | OpenCode Zen key (opencode engine only) — unlocks `opencode/*` models like `opencode/hy3-free` — <https://opencode.ai/docs/zen/> |
 | `TRISS_CODER_MODEL`              | no       | `zai-coding-plan/glm-5.2`       | Resolved model, passed to opencode via `--model` (and written to `opencode.json` by `init`). Use `opencode/hy3-free` for OpenCode Zen |
 | `TRISS_CODER_SMALL_MODEL`        | no       | `zai-coding-plan/glm-5-turbo`   | Small/fast model written to `opencode.json`|
-| `TRISS_CODER_OPENCODE_VERSION`   | no       | `1.17.13`           | Pin override for the `opencode-ai` npm install |
+| `TRISS_CODER_OPENCODE_VERSION`   | no       | `1.17.18`           | Pin override for the `opencode-ai` npm install |
 | `TRISS_CODER_ENGINE`             | no       | `opencode`          | Coding engine: `opencode` (default) or `crush` |
-| `TRISS_CODER_CRUSH_VERSION`      | no       | `0.1.3`             | Pin override for the `@phpcraftdream/crush` npm install (crush engine) |
+| `TRISS_CODER_CRUSH_VERSION`      | no       | `0.1.6`             | Pin override for the `@phpcraftdream/crush` npm install (crush engine) |
 | `TRISS_CODER_CRUSH_RESTRICT`     | no       | unset (`0`)        | crush only — `1` opts INTO the CLI allowlist (`--restrict-run` + `--allow-bash`/`--allow-tool`, the only enforcement path that works today — crush 0.1.3 ignores the `permissions.run` config). Unset leaves crush unrestricted; crush then defaults to isolate-ON. CLI `--restrict`/`--no-restrict` overrides; crush.json `permissions.run.restrict` is the next fallback (forward-compat — currently inert) |
 
 `triss coder init` auto-detects which Z.AI endpoint `ZHIPU_API_KEY`

package/docs/glm-clients.md

@@ -48,7 +48,7 @@ needs — `ZHIPU_API_KEY` for GLM, `OPENCODE_API_KEY` for OpenCode Zen (§3).
 | | **opencode** (engine #1, default) | **crush** (engine #2) |
 |---|---|---|
 | Select via | default, or `--engine opencode` | `--engine crush` / `TRISS_CODER_ENGINE=crush` |
-| npm package | `opencode-ai` (pinned `1.17.13`) | `@phpcraftdream/crush` (pinned `0.1.3`) |
+| npm package | `opencode-ai` (pinned `1.17.18`) | `@phpcraftdream/crush` (pinned `0.1.6`) |
 | Version pin env | `TRISS_CODER_OPENCODE_VERSION` | `TRISS_CODER_CRUSH_VERSION` |
 | Key it reads | `ZHIPU_API_KEY` (native); `OPENCODE_API_KEY` for `opencode/…` Zen models | `ZAI_API_KEY` (Triss bridges from `ZHIPU_API_KEY`; crush ≥0.1.1 also reads `ZHIPU_API_KEY` natively) |
 | Providers | Z.AI GLM (`zai-coding-plan/…`, `zai/…`) **and** OpenCode Zen (`opencode/…`, e.g. `opencode/hy3-free`) | Z.AI GLM only |
@@ -279,8 +279,8 @@ Read `files_changed` + `diff_stat` + `worktree` to know what to review.
 | `TRISS_CODER_ENGINE` | no | Default engine: `opencode` (default) or `crush`. |
 | `TRISS_CODER_MODEL` | no | Override main model, e.g. `zai-coding-plan/glm-5.2` (verbatim, prefix included). |
 | `TRISS_CODER_SMALL_MODEL` | no | Override small/fast model, e.g. `zai-coding-plan/glm-5-turbo`. |
-| `TRISS_CODER_OPENCODE_VERSION` | no | Pin a different `opencode-ai` npm version (default `1.17.13`). |
-| `TRISS_CODER_CRUSH_VERSION` | no | Pin a different `@phpcraftdream/crush` version (default `0.1.3`). |
+| `TRISS_CODER_OPENCODE_VERSION` | no | Pin a different `opencode-ai` npm version (default `1.17.18`). |
+| `TRISS_CODER_CRUSH_VERSION` | no | Pin a different `@phpcraftdream/crush` version (default `0.1.6`). |
 | `TRISS_CODER_CRUSH_RESTRICT` | no | crush only: `1` opts INTO the allowlist (emits `--restrict-run` plus the `--allow-bash`/`--allow-tool` CLI flags — the only enforcement path that works today); unset/`0` leaves crush unrestricted (the default, paired with isolate-ON). Overridden per-run by `--restrict`/`--no-restrict`. |
 
 All are documented in `.env.example`; this table is the authoritative

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triss-coworker",
-  "version": "0.24.0",
+  "version": "0.24.2",
   "description": "Give your AI coding agent a cheap DeepSeek coworker. Delegate bulk reads, boilerplate, and doc updates to save 60-70% of your token budget.",
   "type": "module",
   "bin": {

package/src/coder-engines/crush.js

@@ -13,11 +13,14 @@
 
 import { spawnSync as nodeSpawnSync } from 'node:child_process';
 
-// Pin the npm package version. crush ≥0.1.3 reports a clean `crush version
-// v0.1.3` (docs/crush-issues.md "[High] Version string does not match the
-// release" — resolved in 0.1.3), so detect() now parses the semver and
-// compares against this pin. The pin still also drives installHint().
-const CRUSH_PIN_DEFAULT = '0.1.3';
+// Pin the npm package version. The semver-parse fix landed in 0.1.3 (crush
+// ≥0.1.3 reports a clean `crush version vX.Y.Z` — docs/crush-issues.md "[High]
+// Version string does not match the release"), so detect() parses the semver
+// and compares against this pin (installed >= pin). The pin tracks the latest
+// version verified live against the triss adapter (envelope shape, ZHIPU→ZAI
+// env bridge, --restrict-run CLI-flag enforcement, worktree isolation — all
+// re-verified on 0.1.6, 2026-07-15). The pin also drives installHint().
+const CRUSH_PIN_DEFAULT = '0.1.6';
 
 // crush selects models by "atoms". For GLM the large atom is glm5_2 (GLM-5.2)
 // and the small atom is glm5_turbo (GLM-5-turbo). `crush models use <large>

package/src/commands/coder.js

@@ -58,7 +58,7 @@ import { defaultBranchVia } from '../git.js';
 import { crush as crushEngine } from '../coder-engines/crush.js';
 
 // Pinned opencode-ai version, overridable for testing/upgrades.
-export const OPENCODE_PIN = '1.17.13';
+export const OPENCODE_PIN = '1.17.18';
 // Provider corrected during Phase 0 recon: the configured ZHIPU_API_KEY is
 // a `zai-coding-plan` (subscription) key, not a pay-as-you-go `zai` key —
 // `zai/glm-*` fails with "Insufficient balance or no resource package" on

package/templates/claude-full.md

@@ -177,7 +177,7 @@ triss coder clean [--all]  # remove finished isolation worktrees (default: only
 ```json
 {
   "engine": "opencode",
-  "engine_version": "1.17.13",
+  "engine_version": "1.17.18",
   "session_id": "ses_0d7b5c721ffeouI80ItCOxAJ3g",
   "exit_reason": "end_turn | error | timeout | killed",
   "final_text": "...",
@@ -223,9 +223,9 @@ Zen run forwards only `OPENCODE_API_KEY`, so a Zen-only machine needs no
 provider), `OPENCODE_API_KEY` (optional — unlocks `opencode/*` Zen models),
 `TRISS_CODER_MODEL` / `TRISS_CODER_SMALL_MODEL`
 (model overrides, default `zai-coding-plan/glm-5.2` / `zai-coding-plan/glm-5-turbo`),
-`TRISS_CODER_OPENCODE_VERSION` (pin override, default `1.17.13`),
+`TRISS_CODER_OPENCODE_VERSION` (pin override, default `1.17.18`),
 `TRISS_CODER_ENGINE` (default `opencode`), `TRISS_CODER_CRUSH_VERSION`
-(crush pin override, default `0.1.3`), `TRISS_CODER_CRUSH_RESTRICT`
+(crush pin override, default `0.1.6`), `TRISS_CODER_CRUSH_RESTRICT`
 (crush only — set `1` to opt INTO the CLI allowlist; default unset/OFF).
 
 `triss coder run` is **POSIX only** (macOS/Linux) — it refuses to run on

package/templates/codex-full.md

@@ -81,8 +81,8 @@ it natively; triss also forwards it as `ZAI_API_KEY` for older binaries). See
 Env: `ZHIPU_API_KEY` (required), `TRISS_CODER_MODEL` /
 `TRISS_CODER_SMALL_MODEL` (model overrides, default `zai-coding-plan/glm-5.2` /
 `zai-coding-plan/glm-5-turbo`), `TRISS_CODER_OPENCODE_VERSION` (pin override, default
-`1.17.13`), `TRISS_CODER_ENGINE` (default `opencode`), `TRISS_CODER_CRUSH_VERSION`
-(crush pin override, default `0.1.3`), `TRISS_CODER_CRUSH_RESTRICT` (crush only —
+`1.17.18`), `TRISS_CODER_ENGINE` (default `opencode`), `TRISS_CODER_CRUSH_VERSION`
+(crush pin override, default `0.1.6`), `TRISS_CODER_CRUSH_RESTRICT` (crush only —
 set `1` to opt INTO the CLI allowlist; default unset/OFF).
 
 `triss coder run` is **POSIX only** (macOS/Linux) — it refuses to run on