diff --git a/CHANGELOG.md b/CHANGELOG.md
index f925513..08bf31f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,17 @@ cut and that this clone does not carry.
## [Unreleased]
+## [0.0.75] - 2026-09-25
+
+All seven setup systems refresh their software pins from current vendor
+artifacts, with bytes and SHA256 checked for six published platforms each:
+Claude Code 2.1.282, Codex 0.157.0, Grok Build 1.0.41, Pi 0.87.1,
+OpenCode 1.18.32, Cursor 2026.09.23-86fc751, and Antigravity CLI 1.2.11.
+The immediately preceding pins remain available for rollback. Pi's standalone
+0.87.1 binary reports 0.0.0 for --version; this observed vendor placeholder is
+bound to its exact Linux x86_64 artifact digest and is not the release identity.
+Provider protocol, setup content, postures and ownership are unchanged.
+
## [0.0.74] - 2026-09-24
Antigravity non-minimal setups now carry allowNonWorkspaceAccess alongside
diff --git a/Cargo.lock b/Cargo.lock
index 029ef46..b57d0ee 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -66,7 +66,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
[[package]]
name = "harness-runtime"
-version = "0.0.74"
+version = "0.0.75"
dependencies = [
"provider-v3",
"serde",
@@ -128,7 +128,7 @@ dependencies = [
[[package]]
name = "opencode-setup-system"
-version = "0.0.74"
+version = "0.0.75"
dependencies = [
"harness-runtime",
"provider-v3",
@@ -147,7 +147,7 @@ dependencies = [
[[package]]
name = "provider-v3"
-version = "0.0.74"
+version = "0.0.75"
dependencies = [
"serde",
"serde_json",
@@ -209,7 +209,7 @@ dependencies = [
[[package]]
name = "setup-core"
-version = "0.0.74"
+version = "0.0.75"
dependencies = [
"miniz_oxide",
"serde",
diff --git a/Cargo.toml b/Cargo.toml
index 9deaf12..aae0c92 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
]
[workspace.package]
-version = "0.0.74"
+version = "0.0.75"
edition = "2024"
rust-version = "1.89"
license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
# `setup-core::archive`); an inflate loop is not, because its bugs are
# memory-safety bugs and it is not improved by being hand-written here.
miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.74" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.74" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.74" }
+setup-core = { path = "crates/setup-core", version = "0.0.75" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.75" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.75" }
[workspace.lints.rust]
unsafe_code = "forbid"
diff --git a/README.md b/README.md
index 3c6074c..8ffbae1 100644
--- a/README.md
+++ b/README.md
@@ -179,7 +179,7 @@ release is a convenience, not the authorised copy.
```bash
docker run --rm -v "$HOME/.config:/config" \
- ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.74 \
+ ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.75 \
status --target /config/
--json
```
diff --git a/crates/opencode-setup-system/src/software.rs b/crates/opencode-setup-system/src/software.rs
index 70134a4..5abc280 100644
--- a/crates/opencode-setup-system/src/software.rs
+++ b/crates/opencode-setup-system/src/software.rs
@@ -20,103 +20,103 @@ use harness_runtime::{Artifact, Delivery, Previous, Shape, Software};
pub(crate) const ARTIFACTS: &[Artifact] = &[
Artifact {
platform: "linux/arm64",
- url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.31.tgz",
- bytes: 60_022_468,
- sha256: "sha256:9f30fc9882c2782b7ce5714db5263993f6bcb310c8c590192baa7cfd9b7465d0",
+ url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.32.tgz",
+ bytes: 60_032_395,
+ sha256: "sha256:29ab2d61a70e99d1224d289115c3b8194ff254968e2609531186227be39b2001",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "linux/x86_64",
- url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.31.tgz",
- bytes: 60_232_635,
- sha256: "sha256:6d89da252a8b030d923e728396dc34465cf6095101b78222b0ee337b68140dea",
+ url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.32.tgz",
+ bytes: 60_256_961,
+ sha256: "sha256:da0803c85eb86709c4f084adcbfb0b5329936670bfe43d2367f0ca034be0c1de",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "macos/arm64",
- url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.31.tgz",
- bytes: 46_009_615,
- sha256: "sha256:e1fa9a06765f0b3419b65f05ddfd457977c4ea07ab9c143192a4392fab57d671",
+ url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.32.tgz",
+ bytes: 46_028_592,
+ sha256: "sha256:a1707bb6cc9deaccca501c4097f1580b8af70dfc227f194ae0f576f32abbdebe",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "macos/x86_64",
- url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.31.tgz",
- bytes: 48_184_570,
- sha256: "sha256:dfcf4aa1207f1f47a6ff6620fe19a07ac6b204e8c27786f337ac8b38344494ea",
+ url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.32.tgz",
+ bytes: 48_203_499,
+ sha256: "sha256:e9c0cd81f873cb53b21394461f2b7119bd750329df7221d19642546d3b581386",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "windows/arm64",
- url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.31.tgz",
- bytes: 58_462_934,
- sha256: "sha256:bae1dec9b774176e4364da7abbbe96007c3ae5f09766217c9064bdb811848ec1",
+ url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.32.tgz",
+ bytes: 58_487_775,
+ sha256: "sha256:99ab07bf4e4309fa46d0e44a53a4bfffb72bde3e6be819d62cd2da106da5f625",
shape: Shape::GzipTar,
member: "package/bin/opencode.exe",
},
Artifact {
platform: "windows/x86_64",
- url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.31.tgz",
- bytes: 60_152_538,
- sha256: "sha256:8a300ee2b3210ccc6894ff27d21bdb0a60ee44107389c49b743b4caed10aa5cf",
+ url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.32.tgz",
+ bytes: 60_169_333,
+ sha256: "sha256:701f23388207a4d2e2ff46cda46e707474fa01cf2a1a1afa404f045c06e5eaa4",
shape: Shape::GzipTar,
member: "package/bin/opencode.exe",
},
];
-/// The artifacts 1.18.30 was published as, kept so
+/// The artifacts 1.18.31 was published as, kept so
/// `software_update` has a version to move from and `rollback` a tree to
/// return to. Measured from bytes when it was the current pin.
pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[
Artifact {
platform: "linux/arm64",
- url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.30.tgz",
- bytes: 59_985_069,
- sha256: "sha256:1e20b66e76afbb7c1e5cd9be7515d2744cb4ea3476ff57add1f7e9ad6fb3a32d",
+ url: "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.31.tgz",
+ bytes: 60_022_468,
+ sha256: "sha256:9f30fc9882c2782b7ce5714db5263993f6bcb310c8c590192baa7cfd9b7465d0",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "linux/x86_64",
- url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.30.tgz",
- bytes: 60_202_013,
- sha256: "sha256:aa31a7e68ce5c73cba302c6a4f31c2e308398db125e49d3dbea32f61862fe6de",
+ url: "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.31.tgz",
+ bytes: 60_232_635,
+ sha256: "sha256:6d89da252a8b030d923e728396dc34465cf6095101b78222b0ee337b68140dea",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "macos/arm64",
- url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.30.tgz",
- bytes: 45_975_576,
- sha256: "sha256:25b722fcdc8c46aebcb6501e1156dc1dc5a392492cc278c65b7775311674e7f8",
+ url: "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.31.tgz",
+ bytes: 46_009_615,
+ sha256: "sha256:e1fa9a06765f0b3419b65f05ddfd457977c4ea07ab9c143192a4392fab57d671",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "macos/x86_64",
- url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.30.tgz",
- bytes: 48_153_052,
- sha256: "sha256:d7119bd0adbacf86c1176f07b35d429909d1d702ca0c90dcd31415e66220f590",
+ url: "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.31.tgz",
+ bytes: 48_184_570,
+ sha256: "sha256:dfcf4aa1207f1f47a6ff6620fe19a07ac6b204e8c27786f337ac8b38344494ea",
shape: Shape::GzipTar,
member: "package/bin/opencode",
},
Artifact {
platform: "windows/arm64",
- url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.30.tgz",
- bytes: 58_430_892,
- sha256: "sha256:d26f3759e7c17754e1d6c72020853ffb153c7bb0f6b7d75efdc48466f482c4d4",
+ url: "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.31.tgz",
+ bytes: 58_462_934,
+ sha256: "sha256:bae1dec9b774176e4364da7abbbe96007c3ae5f09766217c9064bdb811848ec1",
shape: Shape::GzipTar,
member: "package/bin/opencode.exe",
},
Artifact {
platform: "windows/x86_64",
- url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.30.tgz",
- bytes: 60_117_264,
- sha256: "sha256:1a5cc50f529cf359fbb6d1a1750c6ae521799f463d00a0215e6eff579a08b036",
+ url: "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.31.tgz",
+ bytes: 60_152_538,
+ sha256: "sha256:8a300ee2b3210ccc6894ff27d21bdb0a60ee44107389c49b743b4caed10aa5cf",
shape: Shape::GzipTar,
member: "package/bin/opencode.exe",
},
@@ -124,12 +124,12 @@ pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[
/// Opencode's program, and where its bytes come from.
pub(crate) const SOFTWARE: Software = Software {
- version: "1.18.31",
+ version: "1.18.32",
command: "opencode",
delivery: Delivery::Artifacts(ARTIFACTS),
unsupported: &[],
previous: Some(Previous {
- version: "1.18.30",
+ version: "1.18.31",
artifacts: PREVIOUS_ARTIFACTS,
}),
};
diff --git a/install.ps1 b/install.ps1
index 02dff52..5683e59 100644
--- a/install.ps1
+++ b/install.ps1
@@ -7,7 +7,7 @@
# powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
[CmdletBinding()]
param(
- [string]$Version = "0.0.74",
+ [string]$Version = "0.0.75",
[string]$InstallDir = "$env:LOCALAPPDATA\Programs\opencode-setup-system"
)
$ErrorActionPreference = "Stop"
diff --git a/install.sh b/install.sh
index 1687db1..e1b9ffa 100644
--- a/install.sh
+++ b/install.sh
@@ -14,7 +14,7 @@ set -eu
REPO="NDDev-OpenNetwork/opencode-setup-system"
BINARY="opencode-setup-system"
-VERSION="${1:-0.0.74}"
+VERSION="${1:-0.0.75}"
PREFIX="${OPENCODE_INSTALL_DIR:-$HOME/.local/bin}"
case "$(uname -s)" in
diff --git a/references/opencode-baseline.json b/references/opencode-baseline.json
index 500c9ff..89218ad 100644
--- a/references/opencode-baseline.json
+++ b/references/opencode-baseline.json
@@ -8,9 +8,9 @@
"minimum_version_ref": "build/version.json:opencode_min"
},
"release": {
- "github_release": "https://github.com/anomalyco/opencode/releases/tag/v1.18.31",
- "github_release_api": "https://api.github.com/repos/anomalyco/opencode/releases/tags/v1.18.31",
- "tag": "v1.18.31",
+ "github_release": "https://github.com/anomalyco/opencode/releases/tag/v1.18.32",
+ "github_release_api": "https://api.github.com/repos/anomalyco/opencode/releases/tags/v1.18.32",
+ "tag": "v1.18.32",
"cli_signature": null,
"cli_signature_note": "Official CLI zip/tar assets expose GitHub release asset SHA-256 digests but no PGP/cosign signature was published for the CLI assets."
},
@@ -109,7 +109,7 @@
"OPENCODE_DISABLE_PROJECT_CONFIG",
"OPENCODE_DISABLE_SHARE"
],
- "verified_at": "2026-09-19T14:52:16+00:00",
+ "verified_at": "2026-09-25T11:49:12+00:00",
"native_surfaces": {
"verified_at": "2026-08-31",
"config_home": "~/.config/opencode",
@@ -294,44 +294,44 @@
"shape": "gzip-tar",
"platforms": {
"linux/arm64": {
- "url": "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.31.tgz",
- "bytes": 60022468,
- "sha256": "sha256:9f30fc9882c2782b7ce5714db5263993f6bcb310c8c590192baa7cfd9b7465d0",
+ "url": "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.32.tgz",
+ "bytes": 60032395,
+ "sha256": "sha256:29ab2d61a70e99d1224d289115c3b8194ff254968e2609531186227be39b2001",
"member": "package/bin/opencode"
},
"linux/x86_64": {
- "url": "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.31.tgz",
- "bytes": 60232635,
- "sha256": "sha256:6d89da252a8b030d923e728396dc34465cf6095101b78222b0ee337b68140dea",
+ "url": "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.32.tgz",
+ "bytes": 60256961,
+ "sha256": "sha256:da0803c85eb86709c4f084adcbfb0b5329936670bfe43d2367f0ca034be0c1de",
"member": "package/bin/opencode"
},
"macos/arm64": {
- "url": "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.31.tgz",
- "bytes": 46009615,
- "sha256": "sha256:e1fa9a06765f0b3419b65f05ddfd457977c4ea07ab9c143192a4392fab57d671",
+ "url": "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.32.tgz",
+ "bytes": 46028592,
+ "sha256": "sha256:a1707bb6cc9deaccca501c4097f1580b8af70dfc227f194ae0f576f32abbdebe",
"member": "package/bin/opencode"
},
"macos/x86_64": {
- "url": "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.31.tgz",
- "bytes": 48184570,
- "sha256": "sha256:dfcf4aa1207f1f47a6ff6620fe19a07ac6b204e8c27786f337ac8b38344494ea",
+ "url": "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.32.tgz",
+ "bytes": 48203499,
+ "sha256": "sha256:e9c0cd81f873cb53b21394461f2b7119bd750329df7221d19642546d3b581386",
"member": "package/bin/opencode"
},
"windows/arm64": {
- "url": "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.31.tgz",
- "bytes": 58462934,
- "sha256": "sha256:bae1dec9b774176e4364da7abbbe96007c3ae5f09766217c9064bdb811848ec1",
+ "url": "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.32.tgz",
+ "bytes": 58487775,
+ "sha256": "sha256:99ab07bf4e4309fa46d0e44a53a4bfffb72bde3e6be819d62cd2da106da5f625",
"member": "package/bin/opencode.exe"
},
"windows/x86_64": {
- "url": "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.31.tgz",
- "bytes": 60152538,
- "sha256": "sha256:8a300ee2b3210ccc6894ff27d21bdb0a60ee44107389c49b743b4caed10aa5cf",
+ "url": "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.32.tgz",
+ "bytes": 60169333,
+ "sha256": "sha256:701f23388207a4d2e2ff46cda46e707474fa01cf2a1a1afa404f045c06e5eaa4",
"member": "package/bin/opencode.exe"
}
},
- "version": "1.18.31",
- "verified_at": "2026-09-19T14:52:16+00:00"
+ "version": "1.18.32",
+ "verified_at": "2026-09-25T11:49:12+00:00"
},
"setup_catalogue_digest": "sha256:e251847ceb02bd92b12fd07ba83b6ac836d37e3cbdbf9aba1607719b281ab7e8",
"previous_software_artifacts": {
@@ -339,44 +339,44 @@
"shape": "gzip-tar",
"platforms": {
"linux/arm64": {
- "url": "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.30.tgz",
- "bytes": 59985069,
- "sha256": "sha256:1e20b66e76afbb7c1e5cd9be7515d2744cb4ea3476ff57add1f7e9ad6fb3a32d",
+ "url": "https://registry.npmjs.org/opencode-linux-arm64/-/opencode-linux-arm64-1.18.31.tgz",
+ "bytes": 60022468,
+ "sha256": "sha256:9f30fc9882c2782b7ce5714db5263993f6bcb310c8c590192baa7cfd9b7465d0",
"member": "package/bin/opencode"
},
"linux/x86_64": {
- "url": "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.30.tgz",
- "bytes": 60202013,
- "sha256": "sha256:aa31a7e68ce5c73cba302c6a4f31c2e308398db125e49d3dbea32f61862fe6de",
+ "url": "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.31.tgz",
+ "bytes": 60232635,
+ "sha256": "sha256:6d89da252a8b030d923e728396dc34465cf6095101b78222b0ee337b68140dea",
"member": "package/bin/opencode"
},
"macos/arm64": {
- "url": "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.30.tgz",
- "bytes": 45975576,
- "sha256": "sha256:25b722fcdc8c46aebcb6501e1156dc1dc5a392492cc278c65b7775311674e7f8",
+ "url": "https://registry.npmjs.org/opencode-darwin-arm64/-/opencode-darwin-arm64-1.18.31.tgz",
+ "bytes": 46009615,
+ "sha256": "sha256:e1fa9a06765f0b3419b65f05ddfd457977c4ea07ab9c143192a4392fab57d671",
"member": "package/bin/opencode"
},
"macos/x86_64": {
- "url": "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.30.tgz",
- "bytes": 48153052,
- "sha256": "sha256:d7119bd0adbacf86c1176f07b35d429909d1d702ca0c90dcd31415e66220f590",
+ "url": "https://registry.npmjs.org/opencode-darwin-x64/-/opencode-darwin-x64-1.18.31.tgz",
+ "bytes": 48184570,
+ "sha256": "sha256:dfcf4aa1207f1f47a6ff6620fe19a07ac6b204e8c27786f337ac8b38344494ea",
"member": "package/bin/opencode"
},
"windows/arm64": {
- "url": "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.30.tgz",
- "bytes": 58430892,
- "sha256": "sha256:d26f3759e7c17754e1d6c72020853ffb153c7bb0f6b7d75efdc48466f482c4d4",
+ "url": "https://registry.npmjs.org/opencode-windows-arm64/-/opencode-windows-arm64-1.18.31.tgz",
+ "bytes": 58462934,
+ "sha256": "sha256:bae1dec9b774176e4364da7abbbe96007c3ae5f09766217c9064bdb811848ec1",
"member": "package/bin/opencode.exe"
},
"windows/x86_64": {
- "url": "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.30.tgz",
- "bytes": 60117264,
- "sha256": "sha256:1a5cc50f529cf359fbb6d1a1750c6ae521799f463d00a0215e6eff579a08b036",
+ "url": "https://registry.npmjs.org/opencode-windows-x64/-/opencode-windows-x64-1.18.31.tgz",
+ "bytes": 60152538,
+ "sha256": "sha256:8a300ee2b3210ccc6894ff27d21bdb0a60ee44107389c49b743b4caed10aa5cf",
"member": "package/bin/opencode.exe"
}
},
- "version": "1.18.30",
- "verified_at": "2026-09-13T15:18:31+00:00"
+ "version": "1.18.31",
+ "verified_at": "2026-09-19T14:52:16+00:00"
},
"source_verified_runtime_flags_note": "All five read out of the 1.18.25 binary on 2026-08-31 -- the whole `OPENCODE_*` set is in its string table, and these are the five this provider has a reason to name. **Nothing in this repository read this block until now.** It is the same shape as the `windows` row that sat under `unsupported` for weeks while this provider installed Windows: a true-when-written list with no reader, which is the condition a stale fact needs. `native_declaration_names_the_switch_it_sets` now ties `updates_off_env` to this list, so the declaration and the measurement cannot drift apart in silence.",
"surface_presence": {