[pierreraby]

0.7.7

Closes the generate-transport gap cluster and ships the catalog/security follow-ups reviewed this week:

• fix(core): shorten compound tool-call ids on the generate fallback #144 — shorten compound tool-call ids on the /alpha/generate fallback to the 64-char wire limit, deterministic and pair-preserving, short ids untouched (fixes Error 400 when using muse spark 1.3 contributor on some longer threads #141).
• feat(models): refresh Command Code catalog to 1.79.2 with claude-haiku-5-5 #145 — Command Code catalog 1.79.2 (claude-haiku-5-5, mistral/mistral-large-4, stealth/glyph-cluster:free), off reasoning effort recognition, reviewed pricing for all 87 models.
• fix(core): replay assistant reasoning on the generate fallback #148 — replay prior assistant reasoning on generate follow-up turns, matching the CLI toWireMessages wire (fixes Generate fallback drops prior assistant reasoning from follow-up requests #146).
• fix(auth): reject untrusted browser origins for local OAuth callbacks #149 — reject untrusted browser Origins on the local OAuth callback before any payload processing.

Changelog section dated 2026-10-11 with contributors; package.json/lock at 0.7.7.

Validation

• Full npm test with both real hosts required (pi 1.1.0 + OMP 18.4.2 against mock APIs): 386 tests, 0 fail, 0 skip.
• npm run format:check, npm audit --audit-level=moderate, npm pack --dry-run, git diff --check all clean; actionlint unavailable locally (CI covers workflow syntax).
• Per-PR validation records live in the merged PRs: fix(core): shorten compound tool-call ids on the generate fallback #144 (330 unit + collision regressions both orders), feat(models): refresh Command Code catalog to 1.79.2 with claude-haiku-5-5 #145 (live catalog/pricing checks, 87/87), fix(core): replay assistant reasoning on the generate fallback #148 (fresh integration review OK with notes, source delta byte-identical after rebasing), fix(auth): reject untrusted browser origins for local OAuth callbacks #149 (fresh security review OK with notes, 18/18 OAuth tests).

A bounded live generate-transport check is scheduled before tagging, per review follow-up. Release via the tag-triggered workflow after this PR merges.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Memory benchmark

Compared base 6c8773b with PR head e517817 on the same GitHub-hosted darwin runner. Lower values are better.

Metric	Base	PR	PR − Base	Change
Stable RSS	119.9 MiB ± 1.1 MiB	120.9 MiB ± 0.5 MiB	+0.8 MiB ± 1.1 MiB	+0.7%
Physical footprint	67.0 MiB ± 0.2 MiB	66.2 MiB ± 0.5 MiB	-0.3 MiB ± 0.9 MiB	-0.5%
Physical peak	77.7 MiB ± 0.2 MiB	77.1 MiB ± 0.5 MiB	-0.5 MiB ± 0.5 MiB	-0.6%

Interpretation: No metric shows a clear Base-to-PR difference beyond its measured run-to-run variation.

Extension overhead above pi baseline

Metric	Base overhead	PR overhead	Difference
Stable RSS	+6.1 MiB ± 3.0 MiB	+6.9 MiB ± 1.0 MiB	+0.8 MiB ± 1.1 MiB
Physical footprint	+3.8 MiB ± 0.7 MiB	+3.7 MiB ± 0.5 MiB	-0.3 MiB ± 0.9 MiB
Physical peak	+5.6 MiB ± 1.0 MiB	+5.1 MiB ± 1.3 MiB	-0.5 MiB ± 0.5 MiB

Values are medians of 6 alternating, paired runs. The value after ± is the median absolute deviation (MAD). Each process was sampled 12 times after a 2500 ms warm-up.

Environment: pi 0.84.4, Bun 1.4.0, darwin arm64. RSS comes from ps; physical footprint and peak come from macOS footprint.

This is a comparative signal, not a pass/fail threshold. GitHub-hosted runner noise can affect absolute values.