chore(release): prepare v0.37.1

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "codebase-index",
       "description": "Semantic code search and codebase graph tools for Claude Code",
       "source": "./",
-      "version": "0.37.0"
+      "version": "0.37.1"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-index",
-  "version": "0.37.0",
+  "version": "0.37.1",
   "description": "Semantic code search and codebase graph tools for Claude Code",
   "displayName": "Codebase Index",
   "author": {

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-index",
-  "version": "0.37.0",
+  "version": "0.37.1",
   "description": "Semantic code search and codebase graph tools for Codex",
   "author": {
     "name": "Kenneth",

CHANGELOG.md

@@ -7,14 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.37.1] - 2026-10-20
+
 ### Added
 
-- **Watcher failure diagnostics for contributors**: Retain bounded, test-owned observations and private fixture snapshots only when the default-root-build watcher rejection scenarios fail, with failure-only CI artifact pickup. Production watcher behavior, consumer assertions, and test deadlines are unchanged; unavailable internal observations are explicitly marked missing.
+- **Watcher failure diagnostics for contributors** (#451): Retain bounded, test-owned observations and private fixture snapshots only when the default-root-build watcher rejection scenarios fail, with failure-only CI artifact pickup. Production watcher behavior, consumer assertions, and test deadlines are unchanged; unavailable internal observations are explicitly marked missing.
+
+### Changed
+
+- **Runtime dependencies** (#446, #449): Update the internal queue from `p-queue` 9.3.3 to 10.0.0 and locked Zod from 4.6.5 to 4.6.7. The published Node.js minimum remains 22.13. Custom-provider `requestIntervalMs` values above 2,147,483,647 ms are now rejected by the queue instead of overflowing Node's timer delay.
+- **Development toolchain** (#447, #448, #449): Update tsup from 8.5.1 to 9.0.0, the Pi development host to 1.3.0, Vitest and coverage tooling to 5.0.5, and typescript-eslint to 8.71.2. Development requires Node.js 22.19 or newer within 22.x, 24.11 or newer within 24.x, or 26 or newer; this does not raise the published runtime floor.
+- **Linked citation regression coverage** (#453): Assert selected caller-test citation paths and source ranges alongside the existing linkage expectations without changing production test-discovery behavior.
 
 ### Fixed
 
-- **Large BM25 index saves** (#452): Stream borrowed native index data directly to a lease-owned temporary file instead of cloning the index and transferring complete JSON through a JavaScript string. Preserve the existing JSON format, atomic rename and cleanup, and structural generation ordering; report buffered-write failures before publication.
-- **Pi real-host prompt tests**: Use Pi 1.3's user-trigger/options runner API and raise only the development host floor to 1.3, retaining sibling section/append preservation and intentional override assertions in both extension orders. The optional Pi peer contract, production extension, legacy string-return fallback, and omp behavior are unchanged.
+- **Fresh-checkout builds**: Build the native module before TypeScript's built-CLI smoke so `npm ci` followed by `npm run build` works without a pre-existing native binding. Keep the actual CLI smoke enabled.
+- **Large BM25 index saves** (#452, #454): Stream borrowed native index data directly to a lease-owned temporary file instead of cloning the index and transferring complete JSON through a JavaScript string. Preserve the existing JSON format, atomic rename and cleanup, and structural generation ordering; report buffered-write failures before publication. The native `save(destination)` option is a backward-compatible API addition supporting this fix.
+- **Pi real-host prompt tests** (#448): Use Pi 1.3's user-trigger/options runner API, retaining sibling section/append preservation and intentional override assertions in both extension orders. The optional Pi peer contract, production extension, legacy string-return fallback, and omp behavior are unchanged.
 
 ## [0.37.0] - 2026-10-16
 
@@ -1035,7 +1044,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - File watcher for automatic re-indexing
 - OpenCode tools: `codebase_search`, `index_codebase`, `index_status`, `index_health_check`
 
-[Unreleased]: https://github.com/Helweg/open-codebase-index/compare/v0.37.0...HEAD
+[Unreleased]: https://github.com/Helweg/open-codebase-index/compare/v0.37.1...HEAD
+[0.37.1]: https://github.com/Helweg/open-codebase-index/compare/v0.37.0...v0.37.1
 [0.37.0]: https://github.com/Helweg/open-codebase-index/compare/v0.36.3...v0.37.0
 [0.36.3]: https://github.com/Helweg/open-codebase-index/compare/v0.36.2...v0.36.3
 [0.36.2]: https://github.com/Helweg/open-codebase-index/compare/v0.36.1...v0.36.2

CONTRIBUTING.md

@@ -42,7 +42,7 @@ Use this when you just want the shortest path to a good PR:
 
 ### Prerequisites
 
-- Node.js 22.19 or newer for development (required by the Pi development dependencies). Node.js 24 LTS is recommended. The published package supports Node.js 22.13 or newer.
+- Development Node.js range: `^22.19.0 || ^24.11.0 || >=26.0.0` (Pi and tsup development dependencies). Node.js 24.11+ LTS is recommended. The published package still supports Node.js 22.13 or newer.
 - Rust toolchain (for native module)
 - npm
 

SECURITY.md

@@ -54,7 +54,7 @@ Track override decisions in [#379](https://github.com/Helweg/open-codebase-index
 | `postcss@>=8.0.0 <8.5.26` | `^8.5.26` | Retain the sourceMappingURL map-file-disclosure floor from commit `5b0cf22`, including earlier PostCSS fixes |
 | `vite@>=8.0.0 <8.0.16` | `^8.0.16` | [GHSA-v6wh-96g9-6wx3](https://github.com/advisories/GHSA-v6wh-96g9-6wx3) and [GHSA-fx2h-pf6j-xcff](https://github.com/advisories/GHSA-fx2h-pf6j-xcff) |
 
-The development-only `tsup@^8.1.0` override replaces its `esbuild` edge with `^0.28.1`. Current `tsup@8.5.1` declares `^0.27.0`, whose fresh resolution is vulnerable `0.27.7`: [GHSA-g7r4-m6w7-qqqr](https://github.com/advisories/GHSA-g7r4-m6w7-qqqr), a low-severity Windows development-server file-read issue fixed in `0.28.1`. This is an intentional, scoped parent-range exception, not a claim that every declared range is satisfied. The native CLI/YAML, bundler, built CLI, full suite, and both minimum-runtime packed identities were exercised on macOS ARM64; this does not establish Windows or Linux runtime coverage. Remove the exception when tsup supports a patched esbuild range; do not restore a global pin that downgrades chord's exact `0.28.2` edge.
+The retained development-only `tsup@^8.1.0` override replaces its `esbuild` edge with `^0.28.1`. It was introduced for `tsup@8.5.1`, whose declared `^0.27.0` range resolved to vulnerable `0.27.7`: [GHSA-g7r4-m6w7-qqqr](https://github.com/advisories/GHSA-g7r4-m6w7-qqqr), a low-severity Windows development-server file-read issue fixed in `0.28.1`. This scoped parent-range exception does not apply to the current root `tsup@9.0.0`, which declares patched `esbuild@^0.28.2`; the selector is retained pending separate override cleanup. Do not restore a global pin that downgrades chord's exact `0.28.2` edge. The prior override review exercised the native CLI/YAML, bundler, built CLI, full suite, and both minimum-runtime packed identities on macOS ARM64; that historical evidence does not establish current-release qualification or Windows/Linux runtime coverage.
 
 ### Removed Overrides and Resolved Pi Exception
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-codebase-index",
-  "version": "0.37.0",
+  "version": "0.37.1",
   "description": "Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling",
   "type": "module",
   "main": "dist/index.js",
@@ -38,7 +38,7 @@
     "node": ">=22.13.0"
   },
   "scripts": {
-    "build": "npm run build:ts && npm run build:native",
+    "build": "npm run build:native && npm run build:ts",
     "build:ts": "tsup && node scripts/smoke-test-built-cli.mjs",
     "smoke:package": "node scripts/smoke-test-packed-cli.mjs",
     "build:native": "cd native && cargo build --release && napi build --release --platform",