Prepare fresh npm release 7.0.38 (#435)

The npm registry already has 7.0.37, so this keeps the release branch focused on the next publishable patch version and matching README release note.

Constraint: npm registry current version is 7.0.37

Rejected: npm version with git tag | branch still needs PR merge before release tag

Confidence: high

Scope-risk: narrow

Directive: Create GitHub release v7.0.38 only after this commit lands on main

Tested: npm test; node --check bin/multiagent-safety.js; npm pack --dry-run; openspec validate --specs

Not-tested: npm publish, requires maintainer registry auth/OTP or trusted publishing

Co-authored-by: NagyVikt <nagy.viktordp@gmail.com>

Author: NagyVikt

README.md

@@ -266,6 +266,12 @@ Being honest about where this still has issues:
 <details open>
 <summary><strong>v7.x</strong></summary>
 
+### v7.0.38
+- Bumped `@imdeadpool/guardex` from `7.0.37` to `7.0.38` so the current
+  `main` payload can publish under a fresh npm version after `7.0.37` reached
+  the registry.
+- No new CLI command behavior is introduced in this release lane.
+
 ### v7.0.37
 - Bumped `@imdeadpool/guardex` from `7.0.36` to `7.0.37` so the current
   package can publish under a fresh npm version after `7.0.36` reached the

openspec/changes/agent-codex-bump-npm-version-7-0-38-release-2026-04-27-10-18/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-04-27

openspec/changes/agent-codex-bump-npm-version-7-0-38-release-2026-04-27-10-18/notes.md

@@ -0,0 +1,30 @@
+# agent-codex-bump-npm-version-7-0-38-release-2026-04-27-10-18 (minimal / T1)
+
+Branch: `agent/codex/bump-npm-version-7-0-38-release-2026-04-27-10-18`
+
+Ship the next Guardex npm patch release by bumping `@imdeadpool/guardex`
+from `7.0.37` to `7.0.38`, adding the matching README release note, and
+cutting the matching GitHub release after the release branch merges.
+
+Scope:
+- Update `package.json` and `package-lock.json` to `7.0.38`.
+- Add the `v7.0.38` README release note.
+- Verify the package metadata and tarball before finish.
+- Finish through PR merge, sandbox cleanup, and GitHub release creation.
+
+Verification:
+- `npm test`
+- `node --check bin/multiagent-safety.js`
+- `npm pack --dry-run`
+
+## Handoff
+
+- Handoff: change=`agent-codex-bump-npm-version-7-0-38-release-2026-04-27-10-18`; branch=`agent/codex/bump-npm-version-7-0-38-release-2026-04-27-10-18`; scope=`package.json, package-lock.json, README.md, openspec/changes/agent-codex-bump-npm-version-7-0-38-release-2026-04-27-10-18/*`; action=`finish this sandbox via PR merge + cleanup, then create GitHub release v7.0.38`.
+- Copy prompt: Continue `agent-codex-bump-npm-version-7-0-38-release-2026-04-27-10-18` on branch `agent/codex/bump-npm-version-7-0-38-release-2026-04-27-10-18`. Work inside the existing sandbox, review `openspec/changes/agent-codex-bump-npm-version-7-0-38-release-2026-04-27-10-18/notes.md`, continue from the current state instead of creating a new sandbox, and when the work is done run `gx branch finish --branch agent/codex/bump-npm-version-7-0-38-release-2026-04-27-10-18 --base main --via-pr --wait-for-merge --cleanup`, then create GitHub release `v7.0.38`.
+
+## Cleanup
+
+- [ ] Run: `gx branch finish --branch agent/codex/bump-npm-version-7-0-38-release-2026-04-27-10-18 --base main --via-pr --wait-for-merge --cleanup`
+- [ ] Record PR URL + `MERGED` state in the completion handoff.
+- [ ] Create or update GitHub release `v7.0.38`.
+- [ ] Confirm sandbox worktree is gone (`git worktree list`, `git branch -a`).

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@imdeadpool/guardex",
-  "version": "7.0.37",
+  "version": "7.0.38",
   "description": "Guardian T-Rex for your multi-agent repo. Isolated worktrees, file locks, and PR-only merges stop parallel Codex & Claude agents from overwriting each other's work. Auto-wires Oh My Codex, Oh My Claude, OpenSpec, and Caveman.",
   "license": "MIT",
   "preferGlobal": true,