chore(release): prepare v0.33.0

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "codebase-index",
       "description": "Semantic code search and codebase graph tools for Claude Code",
       "source": "./",
-      "version": "0.32.2"
+      "version": "0.33.0"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-index",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "Semantic code search and codebase graph tools for Claude Code",
   "displayName": "Codebase Index",
   "author": {

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-index",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "Semantic code search and codebase graph tools for Codex",
   "author": {
     "name": "Kenneth",

CHANGELOG.md

@@ -7,14 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.33.0] - 2026-09-29
+
 ### Added
 
 - **Selective ignored-path indexing**: Added `indexing.includeIgnored` to opt specific `.gitignore`-ignored project source paths into initial indexing and file watching while retaining normal include rules, explicit excludes, and built-in hidden, build, dependency, output, and restricted-path safety filters.
 
-## [0.32.2] - 2026-09-28
-
 ### Fixed
 
+- **Dependency security**: Updated transitive `fast-uri` to 3.1.7 and `ip-address` to 10.5.1 to resolve four GitHub Dependabot advisories affecting the runtime dependency tree.
+
 - **Conceptual evidence locations**: Render complete repository-relative source paths for configured project and knowledge-base hits, including knowledge bases configured through symlinks, instead of machine-specific absolute paths clipped to 120 characters. Keep origin labels for multi-repository results, escape control characters in evidence paths and labels without altering normal bracketed paths, and preserve exact-symbol ordering.
 
 - **OpenCode answer-guidance lifetime**: Retain source-verification guidance for the current turn after a discovery tool consumes the one-shot routing hint. A new user message clears or replaces it. Small exploratory studies found better supporting citations but did not establish improved factual accuracy.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-codebase-index",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling",
   "type": "module",
   "main": "dist/index.js",

tests/multiprocess-indexing.test.ts

@@ -1791,11 +1791,14 @@ describe("multiprocess indexing", () => {
     const owner = JSON.parse(fs.readFileSync(path.join(leasePath, "owner.json"), "utf-8")) as { pid: number };
     const follower = first.transport.pid === owner.pid ? second : first;
 
+    embeddingServer.block();
     fs.writeFileSync(sourcePath, "export function alpha() { return 'follower-refresh'; }\nexport function gamma() { return alpha(); }\n");
-    const search = await follower.client.callTool({
+    const pendingSearch = follower.client.callTool({
       name: "codebase_search",
       arguments: { query: "beta" },
     });
+    await embeddingServer.waitForRequestCount(1, 12_000);
+    const search = await pendingSearch;
     const searchText = (search.content as Array<{ text?: string }>).map(({ text }) => text ?? "").join("\n");
     expect(search.isError).toBe(true);
     expect(searchText).toContain("INDEX_UNAVAILABLE");
@@ -1807,6 +1810,7 @@ describe("multiprocess indexing", () => {
       },
     });
     expect(searchText).not.toContain("INDEX_BUSY");
+    embeddingServer.release();
     await waitForCondition(
       () => embeddingServer.inputs.some((input) => input.includes("follower-refresh")),
       "leader refresh requested by follower",