# Release Audit: 1.4.1

## Metadata

- Timestamp: 2026-06-12 22:59:03 +0900
- Branch: `main`
- Baseline commit: `36b8a1ba1e9c5c90a6a40bc2d92436b3646dd419`
- Release type: patch over the prepared `1.4.0` minor integration

## Scope

This audit covers the `1.4.1` patch release preparation for:

- Authorized shell-listener CLI integration.
- OpenCode SDK/plugin dependency alignment.
- Rust clippy warning cleanup.
- Package metadata and documentation synchronization.

## Latest SDK Check

The registry check returned:

- `@opencode-ai/plugin`: `1.17.4`
- `@opencode-ai/sdk`: `1.17.4`

Installed package typings were read from:

- `node_modules/@opencode-ai/plugin/dist/index.d.ts`
- `node_modules/@opencode-ai/sdk`

Observed plugin contract remains compatible with the current plugin implementation:

- `PluginInput` includes `client`, `project`, `directory`, `worktree`, `experimental_workspace`, `serverUrl`, and `$`.
- `PluginOptions` remains `Record<string, unknown>`.
- `Plugin` remains `(input: PluginInput, options?: PluginOptions) => Promise<Hooks>`.

## Five-Pass Review

| Pass | Focus | Result |
| :--- | :--- | :--- |
| 1 | Entry-point reachability | `shell-listener` is reachable only through explicit CLI dispatch in `crates/orchestrator-cli/src/main.rs`; it is not registered in `src/tools/registry.ts`. |
| 2 | Dependency and SDK alignment | `package.json`, `package-lock.json`, README, architecture docs, and dependency compatibility tests are aligned to `@opencode-ai/*` `1.17.4`. |
| 3 | Rust stability and linting | Existing clippy warnings were removed in core config, hooks, and tool helpers without changing public contracts. |
| 4 | Shell listener safety | Default bind is loopback, remote bind requires `--allow-remote`, raw logs are separated from sanitized TUI previews, and empty `run` commands are rejected. |
| 5 | Release readiness | Build, tests, lint, audit, and dry-run package checks passed for `1.4.1`. |

## Verification Log

| Command | Result |
| :--- | :--- |
| `npm view @opencode-ai/plugin version --json` | `1.17.4` |
| `npm view @opencode-ai/sdk version --json` | `1.17.4` |
| `npx tsc --noEmit` | Passed |
| `cargo clippy --workspace --all-targets -- -D warnings` | Passed |
| `cargo test --workspace --all-targets` | Passed: 41 Rust tests |
| `npm run build` | Passed |
| `npm test` | Passed: 713 Vitest tests |
| `git diff --check` | Passed |
| `npm run release:dry-run` | Passed; produced dry-run package metadata for `opencode-orchestrator-1.4.1.tgz` without publishing |

## Residual Risk

- `npm run release:dry-run` validates package contents but does not publish to npm.
- The local git remote initially contained an embedded credential; rotate that credential if it is still valid and prefer credential-manager based authentication.
