Release Notes

Changed

• The JS engine is now built from the in-tree hesojs determinism
  fork (a QuickJS-NG fork) instead of stock rquickjs's vendored tree
  (ADR 0030). Determinism is injected at the C layer —
  JS_SetClockSource / JS_SetRandomSource / JS_SetRuntimeTimezone
  replace the JS-side monkey-patches (the WrappedDate shim, the
  Math.random / performance.now closures, and the process-global
  TZ=UTC pin). crypto is now a pure-JS shim over the seeded engine
  RNG rather than a Rust closure.
• heso search no longer queries the DuckDuckGo endpoints by default —
  they 202/403-throttle scripted callers per IP and only added a
  blocked row from a normal egress IP. They remain available opt-in
  via --engines ddg,ddg-lite. The default pool is now Mojeek + Brave +
  Marginalia + Wikipedia (plus SearXNG when --searx-url is set).
• Repository and homepage links updated to github.com/heso-inc/heso
  across the Cargo, npm, and PyPI package metadata, the CLI banner, and
  the docs.

Added

• The README publishes measured macOS arm64 release-binary stats
  (binary size, cold-start latency over the network, and engine-only
  latency).

Removed

• The disable-assertions (-DNDEBUG) workaround and the four-step
  Drop GC dance. heso now ships with C assertions ON: the
  ES2025 iterator-helper shutdown-GC reference cycle that aborted
  eval-dom on some pages is fixed at the engine (hesojs F1), with
  JS_FreeRuntimeForce as the safety net.

Fixed

• eval-dom no longer aborts tearing down the runtime on pages that
  exercise the iterator-helper shutdown-GC cycle (e.g. astro.build,
  vercel.com).
• First-run signing-identity creation is now atomic: the 32-byte key is
  written to a temp file and hard-linked into place, so concurrent heso
  invocations on a fresh machine can no longer observe a half-written key
  and fail with identity key file ... has wrong length: expected 32, got 0.

Note: plat_hash shifts for pages that read the date or RNG.
Native Date.toString() and Math.random produce different bytes
than the old JS shims (determinism still holds: same seed + same
engine version → identical bytes). Re-stamp cassettes recorded
against the old engine. Plats over static content (no date/RNG) are
unaffected and replay byte-identically across the swap.

heso-cli 0.3.0

Install heso-cli 0.3.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/heso-inc/heso/releases/download/v0.3.0/heso-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/heso-inc/heso/releases/download/v0.3.0/heso-cli-installer.ps1 | iex"

Download heso-cli 0.3.0

| File | Platform | Checksum |
|--------|----------|----------|
| heso-cli-aarch64-apple-darwin.tar.gz | Apple Silicon macOS | checksum |
| heso-cli-x86_64-apple-darwin.tar.gz | Intel macOS | checksum |
| heso-cli-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| heso-cli-aarch64-unknown-linux-gnu.tar.gz | ARM64 Linux | checksum |
| heso-cli-x86_64-unknown-linux-gnu.tar.gz | x64 Linux | checksum |

heso-verify 0.3.0

Install heso-verify 0.3.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/heso-inc/heso/releases/download/v0.3.0/heso-verify-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/heso-inc/heso/releases/download/v0.3.0/heso-verify-installer.ps1 | iex"

Download heso-verify 0.3.0

| File | Platform | Checksum |
|--------|----------|----------|
| heso-verify-aarch64-apple-darwin.tar.gz | Apple Silicon macOS | checksum |
| heso-verify-x86_64-apple-darwin.tar.gz | Intel macOS | checksum |
| heso-verify-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| heso-verify-aarch64-unknown-linux-gnu.tar.gz | ARM64 Linux | checksum |
| heso-verify-x86_64-unknown-linux-gnu.tar.gz | x64 Linux | checksum |