[Helweg]

Unpublished 0.37.2 security prerequisite

Targets Dependabot alert 75 / GHSA-5r4p-p66f-jhc7 (CVE-2026-111757), not an issue-closing reference. Remote alert closure is still pending.

• Exactly 4 files / +6−5: raise the existing qualified Hono guard to <4.13.11 / ^4.13.11; apply the actual npm-generated leaf lock update 4.13.7→4.13.13; add the unpublished changelog security bullet; update only the retained SECURITY Hono row, keeping its previous advisory/purpose. All 597 lock package keys remain, only the Hono record changes. 4.13.11 is the first fix/security floor; 4.13.13 is the resolved patch, not a latest claim. The old caret already admitted fixed versions.
• Source SDK1.32.1 and node-server2.0.10(peer ^4), unrelated dependencies/pins, all six0.37.2 versions, consumer Node>=22.13 and dev floors remain unchanged. Fresh unlocked consumers naturally resolve node-server2.1.5(peer ^4 || ^5.0.0-0), not source graph churn; all four actual clean consumers resolve one unoverridden Hono4.13.13, match574 public-tar regular-file bytes and pass production audit. Nested package overrides do not repair arbitrary downstream locks.

Observed local qualification on exact committed bytes

• Fresh ordinary lifecycle-enabled npm ci; full including-dev and production audits: exit0 / vulnerabilities0. npm’s post-execution allowScripts coverage warning is retained; no policy/approval bypass or fifth-script claim.
• Exact serial npm run build && npm run typecheck && npm run lint && npm run test:run: exit0; 143 files pass /1 existing skip; 2,832 tests pass /6 existing skips, fresh native build + real builtCLI smoke.
• BOTH packed identities on genuine Node22.13.0 and26.9.0: strictTS5.9.3 ESM.mts/CJS.cts NodeNext/noEmit/skipLibCheck:false, correct installed branches/full contained SDK closure, meaningful positive/negative/any-rejection API uses, actual root runtime + every supported CLI alias.
• Original src/**/*.ts: exactly 3 direct files /3 structural chunks; each runtime’s 3 actual MCP transport contexts passes initial index/lookup/search/caller/path/ambiguity, responses before stdinEOF. Each identity’s primary transport passes update/stale-removal/save/reopen. Preferred secondary legacy-MCP full transitions were UNATTEMPTED locally, not failed, and remain mandatory in final independent published verification. cbi/ocbi are CLI-only; all 7 declared CLI entries were tested only in supported help/hybrid modes, never counted as MCP.
• Nonvacuous private-loopback hybrid index/search: 4 requests per identity per runtime, no external embedding provider. Current executed native SHA256 59ee80436a6bbf6fbe15d8320b377360c4b750bc5e1397c90ed728d13489ba02; local native macOS ARM64 only. Exact source/probe/runtime/tar bytes and all prior failures retained; no Rust/AST/ranking/storage/watcher/test/alias changes or performance claim.

Remaining gates / limits

Qualified source only. New exact-head CI/CodeQL and genuine22.13 packed checks, merged-head CI, actual alert75 FIXED + all3 fresh boards, tag/release/trusted dual npm publication, real registry integrity/signature/provenance + all3 MCP transports’ FULL transitions on BOTH runtimes, and separately gated normal-profile published-extension OMP are still required—not claimed here. Existing WindowsARM64 experimental policy unchanged. No original250MB/OOM reproduction, historical watcher fix/callback proof, frozen regrade or baseline update; held#450 and immutable0.37.0/0.37.1 stay unchanged.

[Helweg]

Post-publication verification — v0.37.2

Release: https://github.com/Helweg/open-codebase-index/releases/tag/v0.37.2

Published identity: commit 6c506dee19146c32626eb7e0aa4638bb8d07a09b, tree 75e8d014c43c223c2de6237a82c1c0b6b1b7ccee; annotated unsigned tag object c710619d04d36a5c09ceec9de8f126ce4b69f8a3 peels to that commit. The GitHub release is immutable. Both npm package names publish 0.37.2 and currently resolve latest to that version.

Source and publication gates

• The qualified source ran npm run build && npm run typecheck && npm run lint && npm run test:run successfully: 143 test files passed / 1 skipped; 2,832 tests passed / 6 skipped. Generated import/require declarations, the original src/**/*.ts direct-file regression, and the narrow Hono security repair are included; no baseline updates or historical watcher replay were used.
• Exact merged-head CI and CodeQL succeeded, including genuine Node 22.13.0 built-CLI and both packed-package checks.
• Build And Publish, run 39573625645 attempt 1, succeeded in all eight jobs. All six native builds succeeded: macOS x64/ARM64, Linux x64/ARM64, Windows x64/ARM64. Windows ARM64 retains its existing experimental policy; this is not a new support promise.
• Both retained tarballs were validated before either publication; trusted publication used those same paths and bytes. Public downloaded tarball SHA-512, producer/pack receipt, registry integrity, each consumer lock and npm-verified attestation subjects agree.

Independent public-registry consumers

Four separate clean, normal registry installs were exercised: both package names × Node 22.13.0 and Node 26.9.0, each with its own private home/cache/config/lock/tree, npm 11.19.1, strict engines and normal applicable lifecycle scripts.

• Actual ESM and CommonJS root exports satisfy the id / setup / server object contract. Strict TypeScript 5.9.3 .mts and .cts consumers passed NodeNext, noEmit, skipLibCheck: false, positive/negative/any-rejection cases, mode-specific .d.ts / .d.cts resolution and the installed dependency closure—without source aliases or injected SDK dependencies.
• 14 supported help invocations + 14 non-vacuous hybrid dry runs passed. Dedicated MCP bins use their supported index --help mode; cbi / ocbi are CLI-only, not MCP transports.
• All three actual MCP transports across both runtimes completed six full contexts / 24 stage sessions: initial index, update, stale removal and reopen. Actual JSON-RPC responses arrived before stdin EOF. The original valid src/**/*.ts selected exactly three direct files with nonzero structural chunks; implementation lookup, distinct same-name ambiguity, graph/path and search assertions passed, including the preferred legacy MCP transport's full transitions.
• Four bounded real hybrid fixtures each produced six successful loopback embedding requests with input/request/response hashes and clean server exits; update and reopen assertions passed. Native parsing, UTF-8, IDs/scores, retrieval, optional save destination, persistence, update/removal and reopen were exercised.
• All six native files are present with matching per-platform hashes across the installs. Only macOS ARM64 was executed locally; the other five targets have build/artifact-presence evidence, not local runtime proof.
• Every install's production audit reported zero vulnerabilities. Every npm audit signatures --omit=dev --json --include-attestations completed successfully with empty invalid/missing lists and nonempty npm-VERIFIED target publish/provenance bundles. Verified subjects bind the actual downloaded bytes to source commit above, tag ref v0.37.2, .github/workflows/build.yml, and publisher run 39573625645 / attempt 1. Decoding DSSE alone was not treated as cryptographic verification; no signed-tag claim is made.
• The four unoverridden consumer graphs resolved Hono 4.13.13, above the authoritative first-fixed 4.13.11. Source guard floor and resolved lock are deliberately distinguished. This does not claim to repair arbitrary pre-existing downstream locks.

Normal-profile omp and published native extension

A real normal-home/profile print-mode omp child used only the exact published preferred package's dist/omp-extension.js with --no-extensions, a private side-effect overlay/session and a fresh owned structural fixture. Normal auth, rules, skills, configured model/provider and standard permissions were inherited; no installed-plugin upgrade, profile replacement, preload, inline-tool toggle or direct-MCP substitute was used.

• Actual model/provider: gpt-6.1-sol / openai-codex. All 15 actual outer calls were audited: six allowed candidate xd:// schema reads and nine candidate-device execution writes; no filesystem, shell, other-device or subagent calls.
• Real outer write IDs, exact device paths and submitted JSON correlate with returned details.xdev.mode=execute, canonical tool, validated args and native callback results. Only the declared indexing defaults estimateOnly:false, dryRun:false, verbose:false were added; no hidden search filters were used.
• The nine operations observed initial unindexed status, actual three files / four structural chunks / zero failures, ready status at the exact owned structural namespace, a unique authoritative declaration, two distinct same-name declarations (not a guessed winner), a resolved caller and positive call path, unfiltered sentinel search and final ready status.
• Child 29151 and capture driver 29143 completed successfully with complete JSON output/no incomplete tail. A passive same-PID lsof sample was taken after the genuine successful indexing write ended, while the child remained live: mapped txt native file, mandatory inode 696380503, size/device identity and actual SHA-256 all matched. This is post-operation native proof, not merely a preloaded module or nonerror envelope.
• Published macOS ARM64 native SHA-256: 03055cf9465253fbbda3a21792be7aa2bf655ef09346d9e028629566c95980a5. Before/after canonical full-install seals match; selected eleven normal host/config/rules/plugin input hashes are unchanged. The four created owned structural storage files are pinned privately.

Preserved failures and limits

This was not first-try-clean verification. Preserved verifier-only corrections cover the structural namespace expectation, unsupported bare MCP --help, and mixed regular-file/symlink inventory comparison. The first normal child failed the verification gate after one schema read and zero native operations because its prompt prohibited required device IO; the separately reviewed second run used the host's standard read-schema/write-execute route. No product fix, silent PASS, package mutation, reinstall, waiver or blind replay was substituted for these failures. Earlier immutable 0.37.1 packaging/glob failures remain historical failures, not regraded successes.

Structural results and bounded loopback workloads are not embedding-quality, relevance, performance, SOTA or original 250 MB/OOM reproduction claims. Call graphs establish static linkage, not runtime coverage. No frozen study/baseline was regraded. #450 remains draft/HOLD at its protected head; the historical watcher timeout cause remains unknown and callback loss unproved.

Final read-only security snapshots show all three complete open alert boards empty and Dependabot alert 75 fixed, not dismissed. Selected metadata checks preserve the local root main/cached origin, WIP archive branch, prior tag identities and frozen-worktree HEAD; the physical normal installation remains 0.36.3. These are selected metadata/scoped-operation statements, not a broad HOME or protected-payload byte-identity claim. Private credentials, instructions, raw model/session/cache data and signed access URLs are not published here.