[Helweg]

Summary

Prepare v0.38.0 from the complete three-commit delta since v0.37.2:

• Feature — private local GitHub history (feat: add private local GitHub PR and issue history #461): project-opt-in, manually synchronized issue/PR history with cited local lexical search, status and explicit clearing; includes conditional reconciliation, initial-window provenance, cancellation and private-cache cleanup.
• Fix — MCP root help (fix(cli): show root MCP help before startup #458): print useful --help/-h output before project configuration, providers, indexing or watchers start, without changing ordinary stdio MCP startup.
• Maintenance (chore: remove inert tsup 8 esbuild override #460): remove the inert tsup 8 scoped esbuild override; this is not new security remediation or a dependency/engine upgrade.

Keep an empty Unreleased section, date the reconciled changelog, update all six package/plugin version fields to 0.38.0, and add 0.38.x to supported security-policy versions while retaining 0.37.x support and the existing unsupported cutoff. No functional source, dependency, engine or Rust changes are included in this release-preparation PR.

Observed local qualification

• Fresh npm ci, then canonical npm run build && npm run typecheck && npm run lint && npm run test:run completed successfully on Node 26.9.0 / npm 11.19.1: 2,891 tests passed, 6 skipped (146 test files passed, 1 skipped).
• Both staged package identities, open-codebase-index and opencode-codebase-index, passed clean scripts-enabled, engine-strict consumer installations under Node 22.13.0 and Node 26.9.0. Strict TypeScript 5.9.3 ESM/CJS declaration consumers and runtime exports verified the current OpenCode id/setup/server object contract.
• Every declared CLI alias passed help, estimate and dry-run checks. All declared MCP aliases completed initialization, the current 23-tool inventory and actual structural native indexing/definition lookup/search. Four history-only sessions exposed the four history tools. Across ten MCP sessions, 108 responses were received before actual stdin closure, with clean JSON framing and clean process exits.
• Packed, bundled-path history checks passed in all four identity/runtime cells using a controlled gh protocol subprocess: sync/search/status/clear, actual nonzero HTTP304 handling, changed/deleted discussion tails, deleted entities, scope preservation/rejection, precommit cancellation and resume, and known-denial cancellation cleanup.
• Source and final artifacts were frozen after the last native rebuild. An independent, nonexecuting custody review checked all 35 artifact files (34 dist files plus the local native addon) against frozen workspace, tarball and installed bytes in every identity/runtime cell, including each tarball's SHA512 integrity.

Limits and evidence custody

• Native runtime execution here is Darwin ARM64 only. Other-platform native build/publication outcomes remain a later release-workflow gate; no six-platform runtime-verification claim is made.
• GitHub history used a controlled fixture, not live GitHub synchronization. No benchmark or relevance-superiority claim is made.
• The source installation emitted an allowScripts policy-coverage warning. Original observed execution records show all four applicable dependency lifecycle actions completed successfully. Its auxiliary full npm debug log was subsequently lost to cache rotation; retained command output, original tool-result excerpts and an explicit custody disclosure preserve the observed facts without claiming recovery of the missing complete log.
• This PR is release preparation only. Published-registry installation, npm provenance/attestation verification and a fresh normal-profile published OMP extension session are not yet claimed. Merge, tag and published-release creation remain separately gated.