chore: release v2.24.4

[lindixu6-hash]

Summary

Bump the package version from 2.24.3 to 2.24.4. This is a maintenance release covering all independently reviewed fixes merged since v2.24.3.

Included changes (since v2.24.3)

Bug fixes:

• Include user-scope shards in all-projects tool queries #266 — Include user-scope shards in all-projects tool queries (JojiiOfficial, reviewed by lindixu6-hash)
• fix: vector search perf regression + Windows web server takeover loop #259 — Vector search performance regression fix + Windows web server takeover loop (petra-dot, reviewed by lindixu6-hash)
• fix: preserve opencode auto-capture errors #258 — Preserve original provider errors in auto-capture instead of masking with generic config error (lindixu6-hash, reviewed by NaNomicon)
• fix: preserve vector-first ANN query plan #257 — Preserve vector-first ANN query plan via CROSS JOIN planner barrier (lindixu6-hash, reviewed by NaNomicon)
• fix: keep orphaned linked memories visible in the timeline #260 — Keep orphaned linked memories visible in timeline
• fix: mark compacted memory injection part as synthetic #248 — Mark compaction-restored memory injection as synthetic

Maintenance:

• chore(deps): bump the minor-and-patch group across 2 directories with 11 updates #256 — Minor/patch dependency updates

Verification

• Rebased onto latest main (post-Include user-scope shards in all-projects tool queries #266 merge).
• All six-platform package smoke checks pass on the included PRs.
• tsc --noEmit clean.

Release safety

This PR will not be self-merged. It requires independent review and approval before the v2.24.4 tag is created. The existing Release workflow will verify tag/package version match, publish to npm, and create the GitHub Release.

Pending owner decisions

• LICENSE file: chore: add MIT LICENSE file #268 adds the MIT LICENSE text to match package.json metadata. It should be reviewed and merged before or alongside this release.
• NPM_TOKEN boundary: the Release workflow uses a repository-level token for v* tags. The owner should verify the publish configuration before tagging.

[lindixu6-hash]

Release-governance audit added to the PR description. Public evidence: GitHub repository-license API returns 404 and main has no LICENSE/COPYING file, while npm 2.24.3 declares MIT; repository Environments contain only copilot, and NPM_TOKEN is a repository secret consumed by every v* tag. I will keep this release unmerged and untagged until an independent owner decision resolves those boundaries.

[NaNomicon]

Happy to take a look.

[NaNomicon]

Review — release v2.24.4 (v2.24.3 → main)

Scope: static code review of the 5 changes merged into main since v2.24.3 plus this release PR's packaging. Not a functional review of the plugin end-to-end; runtime correctness of the plugin and its full feature set is owned by the author.

The release

PR #261 bumps the version (2.24.3 → 2.24.4). The tag covers 5 changes since v2.24.3:

Change	File	Assessment
#257 ANN search plan (JOIN→CROSS JOIN)	src/services/turso/vector-search.ts:239,245	✅ correct — forces the vector scan first; verified identical to INNER JOIN with real @libsql/client (same rows, SCAN v → SEARCH m plan)
#248 synthetic compaction part	src/index.ts:981	✅ SDK type has the field (types.gen.d.ts:148); matches established pattern at :519
#260 orphaned linked-memories surface	src/services/api-handlers.ts:257-260	✅ no double-render; web group-memories.ts:11 guards dangling links
#258 provider-error rethrow	src/services/auto-capture.ts:487,577,586-588	✅ caller guards instanceof; cleanup runs
#256 dependabot minor/patch	deps (hono, @opencode-ai sdk/plugin, vite)	✅ benign

Verification performed

• bun run typecheck — clean
• bun test — 412 pass / 0 fail (after bun run build; the 9 dist/-boundary tests need build output)
• CROSS JOIN equivalence: ran real @libsql/client in-memory with mismatched row counts, confirmed identical results and a stable plan — ANN forced first, exact-scan fallback intact

Findings

No blockers on shipped behavior.

Two follow-ups, neither holds the release:

1. #257 test asserts SQL text, not behavior (tests/turso-vector-search.test.ts:72-102). It mocks db.all→[] and only checks toContain("CROSS JOIN") + string ordering; the other case's 2-row shard never engages ANN. It would pass even if the planner reordered and search silently degraded. Behavior is correct today (verified), but the test can't catch a future planner/driver regression. → follow-up: result-level ANN test (seed a shard above the ANN threshold, assert returned memory IDs).

2. #258 silent fallback swallow (src/services/auto-capture.ts:576-589). If the opencode provider fails but a manual config exists, the error is logged and the code proceeds — the user never learns their configured provider is broken. → follow-up: non-blocking warning toast on that path.

Nit: prt-compaction-${Date.now()} part-id collision — practically impossible, non-issue.

Release-package fixes

1. Rebase before merge. PR is based on eda2c; main has since added #257 + #258. The "Included changes" list omits them. (Release notes auto-generate from the commit range, so the tag won't lose them — but the PR should describe what it merges.)
2. Patch version is fine. All three are bugfixes (perf, error handling, data visibility); #260 is additive/corrective, not breaking. Keep v2.24.4.

Release gates (owner decisions)

• LICENSE: package.json declares MIT but no LICENSE file exists in git history; the GitHub license API returns 404. Owner must add it or explicitly approve the grant — no one else should author it. However, the owner is not actively working on the repo anymore. I hereby grant you permission to add the MIT license.
• Publish boundary: the release workflow injects the repo-level NPM_TOKEN on every v* tag, and the only release env is copilot with no tag ruleset. Owner should tag manually after reviewing the exact merge SHA.

Suggested sequence

1. Rebase release PR onto current main (stale base).
2. Owner resolves LICENSE + publish boundary.
3. Ship v2.24.4.
4. Open two follow-up PRs: ANN result-level test, provider-fallback warning toast.

[lindixu6-hash]

Rebased onto latest main (post-#266) and updated the changelog to include #257, #258, #259, #266. The LICENSE blocker is addressed by #268 (MIT LICENSE), which you granted permission for in your review. Ready for re-review.