release: v7.0.5

[code-crusher]

Release v7.0.5

Bumps @matterailab/orbcode to 7.0.5. After merge, tag the merge commit on main and push the tag to trigger the publish workflow:

git checkout main && git pull
git tag v7.0.5
git push origin v7.0.5

Changed

• Background updates install after 15 minutes on npm instead of 24 hours (MIN_RELEASE_AGE_MS).

Fixed

• Updater no longer stalls on a bad latest release: it now scans all non-deprecated, non-prerelease releases newer than the running version past the age window and stages the newest one this Node can run, newer than what's staged, and not previously failed (isBadVersion).
• @vscode/ripgrep moved to regular dependencies (completes the 7.0.3 fix — installs that skip optional deps no longer miss the bundled rg).

Docs

• README.md / RELEASE.md age window updated to 15 min.

Checklist

• npm run typecheck passes
• npm run build passes; node dist/index.js --version → 7.0.5
• CHANGELOG.md entry added
• Version bumped in package.json + package-lock.json

[matterai-app]

Summary By MatterAI

🔄 What Changed

Bumped version to 7.0.5, added @vscode/ripgrep and string-width dependencies, and implemented a release age-gating mechanism (MIN_RELEASE_AGE_MS) using fetchEligibleReleases to safely filter out premature or faulty npm releases before staging auto-updates.

🔍 Impact of the Change

Enhances CLI update safety and resilience by introducing a 15-minute public age window for new releases, preventing rapid deployment of bad builds, alongside adding essential terminal dependencies.

📁 Total Files Changed

Click to Expand

File	ChangeLog
package.json	Version Bump - Updated version to 7.0.5 and added runtime dependencies @vscode/ripgrep and string-width.
src/utils/autoUpdate.ts	Release Gating - Added fetchEligibleReleases to validate node engines, skip deprecated versions, and enforce MIN_RELEASE_AGE_MS.

🧪 Test Added/Recommended

Recommended

• Add unit tests for fetchEligibleReleases covering version filtering, deprecation checks, and MIN_RELEASE_AGE_MS edge cases.

🔒 Security Vulnerabilities

• None detected. 🛡️

[matterai-app]

🧪 PR Review is completed: The auto-update refactor (fetchEligibleReleases + fallback to the newest compatible, non-bad release) is correct — staging, rollback, skip and thrash scenarios all check out. One flag: MIN_RELEASE_AGE_MS drops the safety window from 24h to 15min, contradicting RELEASE.md's documented bad-release containment strategy. package.json (version bump + dependency reordering): no issues.

Skipped files

• CHANGELOG.md: Skipped file pattern
• README.md: Skipped file pattern
• RELEASE.md: Skipped file pattern
• package-lock.json: Skipped file pattern

⬇️ Low Priority Suggestions (1)

src/utils/autoUpdate.ts (1 suggestion)

Location: src/utils/autoUpdate.ts (Lines 23-23)

🟡 Release-Safety / Business Logic

Issue: MIN_RELEASE_AGE_MS is cut from 24h (24 * 60 * 60 * 1_000) to 15 minutes, but RELEASE.md still documents the invariant: "Releases auto-install only after 24h on npm, so ship a fix within a day to keep a bad release from spreading." With a 15-minute window, a release that passes --self-test yet misbehaves in real usage reaches auto-updating users almost immediately, and the doc comment above the constant ("so a bad release can be caught ... before it reaches everyone") no longer reflects the real buffer.

Fix: If the shorter window is intentional (leaning on verify + launcher rollback instead of the age buffer), update RELEASE.md's "Background updates — compatibility rules" section and add a 7.0.5 CHANGELOG entry documenting the new behavior in this same release; if it was not meant to ship, restore the 24h value.

Impact: Keeps the documented release process truthful and preserves the stated bad-release containment window for the team operating the releases.

-  export const MIN_RELEASE_AGE_MS = 15 * 60 * 1_000;
+