[Helweg]

Scope

Safe five-update replacement for #470, integrated onto main after #474 (4dd7d6f82c412d3c68e61ef179714e294fd2762e). The original bot branch and original candidate checkout were not changed.

Dependency	Main	Replacement
ignore	7.0.12	7.0.13
@napi-rs/cli	3.10.8	3.10.9
eslint	10.12.0	10.13.0
rollup	4.64.7	4.65.0
typescript-eslint	8.71.2	8.72.0

Includes the associated reviewed lock entries. Keeps current-main security overrides, version0.38.2, Chokidar6 and its directory recovery/regressions, and the published Node.js >=22.22.0 floor from #474. One narrow Unreleased changelog entry; no host source, tests, benchmark inputs, SDK contracts, or release metadata changed relative current main.

SDK ABI hold

Keep @opencode-ai/sdk and development @opencode-ai/plugin exactly 1.3.13 together. Exclude SDK1.19.4 from #470: it changes the SDK-backed public Plugin input/error structure and fails the existing upstream plugin1.3.13 assignability contract. No casts, declaration suppression, SDK override, or weakened consumer assertion is introduced. SDK advancement needs separate compatibility design/review.

Verification on this changed revision

Official Node22.22.0 Darwin ARM64; private npm caches, fresh private source dependencies, private Cargo target. Each stable-revision command executed once, sequentially:

• npm ci --no-audit --no-fund — pass.
• npm run build — pass, including native build, declarations and actual built-CLI smoke.
• npm run typecheck — pass.
• npm run lint — pass.
• npm run test:run — pass:149 files,2961 tests;1 file/6 tests skipped by existing conditions.
• Unchanged scripts/smoke-test-packed-cli.mjs under exact Node22.22.0 — both actual packed identities pass: strict standalone ESM/CommonJS types, separate upstream plugin1.3.13 interoperability, actual exports, expected CLI aliases, estimate-only indexing, MCP initialization/tools.
• Execution-time receipt/preload verifies45 actual Node processes used exact22.22.0 with engine-strict and14 successful installed native loads; tarballs pinned before install. Existing consumer installs use --ignore-scripts, so install hooks are not claimed.
• All110 frozen benchmark files unchanged; no shared mutable dependency links.

Local coverage is Darwin ARM64; GitHub CI supplies independent matrix coverage. No global Node repair, installed plugin modification, release/tag/npm publication, merge, or closure of #470 performed by this worker.

Preserved earlier failure

The initial five-update overlay on pre-#474 main d6f26f6 passed build/typecheck/lint and exact22.13 both-identity consumer smoke, but its single full-gate attempt failed the unchanged watcher permission/filtering assertion at tests/include-excluded-paths-indexing.test.ts:832 (ordinary source event absent within20s). That failure is preserved; cause remains UNKNOWN, not waived or retried for green. Coordinator changed landing order and merged the independently reviewed watcher/Node-floor update #474 first; the green gate above is on that genuinely changed source, not an unchanged-source retry.

Private local evidence: /var/folders/9w/x_7k46cx7x589xfrf4bwp81h0000gn/T/pr470-safe-post474-20261026-h1e0f3sw; original failed-revision evidence: /var/folders/9w/x_7k46cx7x589xfrf4bwp81h0000gn/T/pr470-safe-main-20261026-9fqsc38v.

Coordinator retains merge authority and will close #470 only after accepted integration.