[patlux]

Release preparation only

Prepare 0.7.8 and leave this PR open for the maintainer. This PR does not authorize or perform tagging, npm publication, or a GitHub Release.

• Bump package and lockfile versions from 0.7.7 to 0.7.8.
• Collect the integrated changes into the dated changelog and credit @karaaslanz, @sandexzx, and @pierreraby.
• Release delta: fix(errors): redact direct stream and normalized overflow messages #155 (error redaction), fix(quota): enforce overall timeout for stalled fetch and body reads #152 (quota deadline), fix(transport): honor generate fallback when provider stream rejects upgrade #154 (defensive generate fallback), feat(models): refresh Command Code catalog to 1.82.4 #153 (CLI 1.82.4 metadata/parser and reviewed pricing for 93 API models).
• Superseded feat(models): use the Provider API OpenAI Responses wire #124 and chore(models): sync Command Code catalog #151 are closed with references to feat(models): use the Provider API OpenAI Responses wire #133 and feat(models): refresh Command Code catalog to 1.82.4 #153 respectively. New unrelated PRs fix(models): disable lifecycle scripts during catalog inspection #157–feat(models): refresh catalog 1.82.4 and reviewed prices #160 are not included.

Verification

All checks below ran against the release contents; exact local commit: 66786551292a52784d5042cea2845f2db3280c63.

• Full npm test: 397 TAP tests passed, 0 failed, 0 skipped, plus successful real Pi 1.3.0 and OMP 18.11.1 mock integration suites. Both host binaries were required.
• npm run typecheck, npm run format:check, and git diff --check: PASS.
• npm run check:commandcode-catalog: current 1.82.4 (68 image, 77 reasoning, 61 effort, 10 output-limit entries).
• npm run check:commandcode-pricing: PASS for 93 models, no drift.
• npm audit --audit-level=moderate: 0 vulnerabilities.
• npm pack --dry-run: reviewed 32 package files, no fixtures or credentials.
• Actual npm pack --ignore-scripts artifact installed outside the checkout and exercised through test:release-package: Pi and OMP PASS.
• Tested tarball integrity: sha512-TLcPxHPJxO1wQF3XW8Y4PNzUsXlSPAtbDCNC6WN5zHim6aHc+n+XdsGpYtf1qdBB+t0Ym2vlZ1ktc+oWylE+7A==.
• Post-merge main CI for 36e50af4fa404c4f5c218e3a8101b45def6e0e83: PASS. The automatic push run did not appear, so the existing CI workflow was explicitly dispatched on the unchanged main SHA. No workflow edits or bypasses.

Release state and limitations

• Before preparation, npm 0.7.8 returned the expected E404 and no local/remote v0.7.8 tag existed. npm latest remains 0.7.7 and next remains 0.7.3-next.0; latest GitHub Release is v0.7.7.
• No authenticated live generation was run: host coverage uses loopback-only mock APIs and isolated test credentials/homes. Public catalog and pricing sources were checked live.
• Models advertised after CLI 1.82.4 are priced but retain conservative static capability defaults. Cat Jam is free only while its stealth preview lasts, with no published expiry.
• Wait for all checks on this exact PR head. Keep the PR open; any later release must follow RELEASE.md and separate maintainer authorization.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Memory benchmark

Compared base 36e50af with PR head 6678655 on the same GitHub-hosted darwin runner. Lower values are better.

Metric	Base	PR	PR − Base	Change
Stable RSS	120.9 MiB ± 0.2 MiB	120.3 MiB ± 0.8 MiB	-0.8 MiB ± 0.4 MiB	-0.6%
Physical footprint	66.2 MiB ± 1.0 MiB	66.4 MiB ± 1.0 MiB	-0.3 MiB ± 1.1 MiB	-0.4%
Physical peak	77.5 MiB ± 0.7 MiB	76.7 MiB ± 0.9 MiB	-0.5 MiB ± 0.6 MiB	-0.7%

Interpretation: Differences larger than their measured MAD: Stable RSS -0.8 MiB ± 0.4 MiB.

Extension overhead above pi baseline

Metric	Base overhead	PR overhead	Difference
Stable RSS	+7.0 MiB ± 0.6 MiB	+5.9 MiB ± 1.2 MiB	-0.8 MiB ± 0.4 MiB
Physical footprint	+2.4 MiB ± 1.2 MiB	+2.2 MiB ± 1.3 MiB	-0.3 MiB ± 1.1 MiB
Physical peak	+4.5 MiB ± 1.9 MiB	+2.8 MiB ± 2.5 MiB	-0.5 MiB ± 0.6 MiB

Values are medians of 6 alternating, paired runs. The value after ± is the median absolute deviation (MAD). Each process was sampled 12 times after a 2500 ms warm-up.

Environment: pi 0.84.4, Bun 1.4.0, darwin arm64. RSS comes from ps; physical footprint and peak come from macOS footprint.

This is a comparative signal, not a pass/fail threshold. GitHub-hosted runner noise can affect absolute values.