@agentikos/omega-os 0.19.19 → 0.19.21

package/bootstrap/lib/steps.sh

@@ -463,6 +463,154 @@ PY
 
 # --- 40 -----------------------------------------------------------------------
 #
+# step_clis — install system CLIs + Printing Press CLI library.
+#
+# Replaces step_mcp as the default integration story (v0.19.21+). The
+# rationale per the operator: MCP servers are token-expensive (each
+# call pays protocol round-trip + server system prompt overhead). System
+# CLIs that Claude Code shells out to via `Bash` are predictable, cheap,
+# and survive without a long-lived server process. Printing Press
+# (https://printingpress.dev) extends that model with agent-native CLIs
+# that ship local SQLite mirrors — even cheaper than remote API calls.
+#
+# Three phases:
+#   1. AUDIT — detect what's already installed; render a status table.
+#   2. NATIVE — install missing recommended native binaries via the
+#               OS package manager (or npm-global / curl fallback).
+#   3. PRINTING PRESS — install the PP factory + the recommended CLIs
+#                       from the library catalog.
+#
+# Idempotent — re-running only acts on what's still missing.
+step_clis() {
+  local catalog="$OMEGA_HOME/Agentik_SSOT/clis/clis-catalog.yaml"
+  [ -f "$catalog" ] || { err "CLI catalog missing: $catalog"; return 1; }
+  PYTHONPATH="$OMEGA_HOME/Agentik_Engine" python3 - "$catalog" "$OMEGA_PKG" <<'PY' 2>>"$LOG_FILE"
+import os
+import shutil
+import subprocess
+import sys
+import yaml
+
+catalog_path = sys.argv[1]
+pkg = sys.argv[2]  # apt | dnf | brew | unknown
+
+with open(catalog_path) as f:
+    catalog = yaml.safe_load(f) or {}
+
+# ─── Phase 1: audit ───────────────────────────────────────────
+print("\n  ──── CLI audit ────")
+ok_count = 0
+missing = []
+for entry in catalog.get("native", []):
+    cli_id = entry["id"]
+    binary = entry.get("binary", cli_id)
+    if shutil.which(binary):
+        print(f"  ok   {cli_id:<14} ({binary} present)")
+        ok_count += 1
+    else:
+        rec = entry.get("recommended", False)
+        tag = "MISSING (recommended)" if rec else "missing (optional)"
+        print(f"  --   {cli_id:<14} {tag}")
+        missing.append(entry)
+print(f"  → {ok_count}/{len(catalog.get('native', []))} native CLIs present\n")
+
+# ─── Phase 2: install missing recommended native CLIs ─────────
+def _run(cmd, env=None, timeout=600):
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True,
+                              timeout=timeout, env=env)
+        return proc.returncode, proc.stdout + proc.stderr
+    except (subprocess.SubprocessError, FileNotFoundError) as e:
+        return 1, str(e)
+
+installed_now = []
+failed_now = []
+for entry in missing:
+    if not entry.get("recommended", False):
+        continue
+    cli_id = entry["id"]
+    install = entry.get("install", {})
+    rc, out, attempt = 1, "", ""
+
+    if pkg in install:  # platform-specific package name
+        if pkg == "brew":
+            rc, out = _run(["brew", "install", install[pkg]])
+            attempt = f"brew install {install[pkg]}"
+        elif pkg == "apt":
+            rc, out = _run(["sudo", "apt-get", "install", "-y", "-qq", install[pkg]])
+            attempt = f"apt-get install {install[pkg]}"
+        elif pkg == "dnf":
+            rc, out = _run(["sudo", "dnf", "install", "-y", "-q", install[pkg]])
+            attempt = f"dnf install {install[pkg]}"
+    elif "npm_global" in install and shutil.which("npm"):
+        rc, out = _run(["npm", "install", "-g", "--silent", install["npm_global"]])
+        attempt = f"npm install -g {install['npm_global']}"
+    elif "curl" in install:
+        # curl|bash installer — last resort
+        rc, out = _run(["bash", "-c", f"curl -fsSL {install['curl']} | bash"])
+        attempt = f"curl {install['curl']} | bash"
+    else:
+        print(f"  skip {cli_id}: no install method for pkg={pkg}")
+        continue
+
+    binary = entry.get("binary", cli_id)
+    if shutil.which(binary):
+        print(f"  ok   {cli_id:<14} (installed via {attempt})")
+        installed_now.append(cli_id)
+    else:
+        print(f"  fail {cli_id}: {attempt} returned rc={rc}")
+        failed_now.append(cli_id)
+
+# ─── Phase 3: Printing Press ──────────────────────────────────
+pp_core = catalog.get("printing_press_core", {})
+pp_clis = catalog.get("printing_press_clis", [])
+
+print(f"\n  ──── Printing Press ({len(pp_clis)} library CLIs available) ────")
+
+# Install PP core (printer + library client) if not present
+if not shutil.which("ppi-update") and not shutil.which("npx"):
+    print("  skip: neither ppi-update nor npx on PATH — install Node first")
+elif not shutil.which("ppi-update"):
+    install_cmd = pp_core.get("install_method", "")
+    if install_cmd:
+        print(f"  installing Printing Press core: {install_cmd}")
+        rc, out = _run(["bash", "-c", install_cmd], timeout=300)
+        if rc == 0:
+            print("  ok   Printing Press core installed")
+        else:
+            print(f"  warn Printing Press core install rc={rc} — library CLIs may still work via npx")
+else:
+    print("  ok   Printing Press core already installed")
+
+# Install recommended PP library CLIs (one npx call per recommended entry)
+pp_lib_cmd = ["npx", "-y", "@mvanhorn/printing-press-library"]
+pp_ok = 0
+pp_failed = []
+for entry in pp_clis:
+    if not entry.get("recommended", False):
+        continue
+    cli_id = entry["id"]
+    print(f"  installing pp-cli: {cli_id}…")
+    rc, out = _run([*pp_lib_cmd, "install", cli_id], timeout=300)
+    if rc == 0:
+        print(f"  ok   {cli_id}")
+        pp_ok += 1
+    else:
+        print(f"  fail {cli_id}: rc={rc}")
+        pp_failed.append(cli_id)
+
+print(f"\n  ──── Summary ────")
+print(f"  Native CLIs installed this run:    {installed_now or '(none missing)'}")
+print(f"  Native CLIs that failed:           {failed_now or '(none)'}")
+print(f"  Printing Press CLIs installed:     {pp_ok} (of {sum(1 for e in pp_clis if e.get('recommended'))} recommended)")
+print(f"  Printing Press CLIs that failed:   {pp_failed or '(none)'}")
+print(f"  Non-recommended CLIs available via:  omega cli install <id>")
+PY
+  return 0
+}
+
+# --- 40-legacy ----------------------------------------------------------------
+#
 # step_mcp — present the MCP/plugin catalog as a checklist (interactive) or
 # apply the manifest's `mcp:` list (headless). For each selected entry:
 #   1. install the server binary into Agentik_Tools/<id>/
@@ -734,27 +882,36 @@ step_claude_plugins() {
 
   # Register every marketplace referenced by the selected plugins (excluding
   # those marked `builtin: true`).
+  #
+  # Source format MUST be `<owner>/<repo>` for the Claude CLI. We strip
+  # any legacy `github:` prefix the catalog may still carry (pre-v0.19.20
+  # catalogs used `github:owner/repo` which fails with "Invalid
+  # marketplace source format").
   while IFS= read -r src; do
     [ -z "$src" ] && continue
+    src="${src#github:}"
     info "registering marketplace: $src"
     if claude plugin marketplace add "$src" >>"$LOG_FILE" 2>&1; then
       ok "marketplace ok: $src"
     else
-      # Already registered or other non-fatal; log only.
+      # Likely already registered — non-fatal, log only.
       info "marketplace add returned non-zero (may already be registered): $src"
     fi
   done < <(_claude_plugins_marketplaces_for "$catalog" "$selected")
 
+  # `claude plugin install` does NOT accept `-s <scope>` (verified against
+  # Claude Code 2.1.150 — the plugin help only documents --config). The
+  # scope is per-install determined by where the plugin manifest declares
+  # it; we keep `scope:` in the catalog only as documentation.
   local failed=""
   local id
   while IFS= read -r id; do
     [ -z "$id" ] && continue
-    local spec scope
+    local spec
     spec="$(_claude_plugins_install_spec "$catalog" "$id")"
-    scope="$(_claude_plugins_scope_for "$catalog" "$id")"
     [ -z "$spec" ] && { info "no install spec for $id — skipping"; continue; }
-    info "installing claude plugin: $spec (scope=$scope)"
-    if claude plugin install "$spec" -s "$scope" >>"$LOG_FILE" 2>&1; then
+    info "installing claude plugin: $spec"
+    if claude plugin install "$spec" >>"$LOG_FILE" 2>&1; then
       ok "claude plugin installed: $id"
     else
       err "claude plugin $id failed to install — see $LOG_FILE; continuing"

package/install.sh

@@ -147,7 +147,13 @@ STEPS=(
   "35-providers:step_providers"
   "36-tmux-config:step_tmux_config"
   "37-hermes-brief:step_hermes_brief"
-  "40-mcp:step_mcp"
+  # v0.19.21 — MCP install dropped from the default sequence. MCPs are
+  # token-expensive (each call pays the protocol round-trip + the
+  # server's system prompt overhead). We replace with system CLIs +
+  # Printing Press (https://printingpress.dev) — agent-native CLIs
+  # with local SQLite mirrors. Re-enable opt-in via:
+  #   omega tool install <id>   (still wired for one-offs)
+  "40-clis:step_clis"
   "45-claude-plugins:step_claude_plugins"
 )
 if [ "$PROFILE" != "minimal" ]; then
@@ -207,3 +213,24 @@ record_state_version
 
 # Final boxed celebration + verdict from `omega doctor --json`.
 post_install_card
+
+# v0.19.20 — drop the user into a fresh login shell so $PATH (now
+# containing $OMEGA_HOME/Agentik_Tools/bin) and OMEGA_HOME are loaded
+# immediately. Without this, the user had to remember to
+# `source ~/.zshrc` or open a new terminal — bad UX.
+#
+# Only re-exec when:
+#   * stdin is a tty (interactive install, not piped/CI)
+#   * we're not running under --non-interactive
+#   * the user isn't already in a non-default shell we don't understand
+#   * an `omega` binary exists at the canonical path
+#
+# Otherwise we just print the instruction so the user knows what to do.
+if [ -t 0 ] && [ "${NONINTERACTIVE:-0}" != "1" ] \
+   && [ -x "$OMEGA_HOME/Agentik_Tools/bin/omega" ]; then
+  log ""
+  log "${C_DIM}::${C_RST} reloading your shell so \`omega\` is on PATH…"
+  log "${C_DIM}::${C_RST} type ${C_BOLD}omega${C_RST} to open the session manager"
+  log ""
+  exec "${SHELL:-/bin/bash}" -l
+fi

package/omega/Agentik_Engine/omega_engine/__init__.py

@@ -188,7 +188,7 @@ from omega_engine.genesis import (
 )
 from omega_engine import plan as plan_v7
 
-__version__ = "0.19.19"
+__version__ = "0.19.21"
 
 __all__ = [
     "__version__",

package/omega/Agentik_Engine/omega_engine/cli.py

@@ -2908,15 +2908,18 @@ def cmd_menu(_args: argparse.Namespace) -> int:
     if chosen_key is None:
         return 0
     if chosen_key == NEW_AISB:
+        # "+ New AISB" means the user wants a FRESH session — kill
+        # the existing AISB-chat first so we don't attach to a dead
+        # one (claude died, OAuth missing, etc.).
         return _attach_or_spawn_chat(
             "AISB-chat",
-            spawn_fn=tmux.spawn_aisb_chat,
+            spawn_fn=lambda h: tmux.spawn_aisb_chat(h, force_replace=True),
             label="AISB master (Claude Code on Max OAuth)",
         )
     if chosen_key == NEW_HERMES:
         return _attach_or_spawn_chat(
             "Hermes-chat",
-            spawn_fn=tmux.spawn_hermes_chat,
+            spawn_fn=lambda h: tmux.spawn_hermes_chat(h, force_replace=True),
             label="Hermès (Claude Code on Anthropic API)",
         )
     # Otherwise it's an existing session name — just attach.

package/omega/Agentik_Engine/omega_engine/tmux.py

@@ -259,49 +259,85 @@ def _ensure_chat_context_dir(home: Path, label: str,
     return ctx_dir
 
 
-def spawn_aisb_chat(omega_home: str | Path | None = None) -> str:
+def _spawn_with_shell_then_run(
+    name: str,
+    *,
+    cwd: str | Path,
+    run_command: str,
+    force_replace: bool = False,
+) -> str:
+    """Spawn a tmux session that starts the user's interactive shell at
+    ``cwd``, then types ``run_command`` + Enter into it. This way:
+
+      * The shell stays alive even if ``run_command`` exits (claude
+        with no auth, claude exited cleanly, etc.) — user still sees
+        the shell and can debug.
+      * The shell sources the user's rc files normally (PATH, env, etc.)
+        so ``claude`` resolves to the operator's binary.
+
+    Used by spawn_aisb_chat / spawn_hermes_chat. ``force_replace=True``
+    kills any existing session of the same name first — the menu's
+    "+ New" actions pass this so the user always gets a fresh session
+    instead of attaching to a dead one.
+    """
+    if force_replace and is_alive(name):
+        kill(name)
+    if is_alive(name):
+        return name
+    # 1. Create a detached session running the user's login shell at cwd.
+    rc, _ = _tmux("new-session", "-d", "-s", name, "-c", str(cwd))
+    if rc != 0:
+        return name
+    # 2. Send the launch command + Enter into the shell. We use
+    # `send-keys` (not the new-session command arg) so the shell stays
+    # alive even if the launched binary exits.
+    _tmux("send-keys", "-t", name, run_command, "Enter")
+    return name
+
+
+def spawn_aisb_chat(omega_home: str | Path | None = None,
+                     force_replace: bool = False) -> str:
     """Spawn the AISB master chat tmux session — REAL Claude Code TUI.
 
-    v0.19.18 — instead of running our Python REPL (`omega aisb chat-loop`),
-    we now run the canonical `claude` CLI inside a dedicated project dir
-    seeded with the AISB master persona (``Agentik_SSOT/agents/aisb/CLAUDE.md``).
-    User sees the SAME interactive Claude Code TUI they get with bare
-    `claude`, but pre-loaded with AISB's identity, the L3 orchestrator
-    role, and full OmegaOS context.
+    v0.19.20 — moved from ``exec claude`` (which kills the session when
+    claude exits) to ``spawn shell + send-keys claude``. The shell stays
+    alive even if claude can't start (no Max OAuth wired, etc.), so the
+    user lands inside the session and sees the actual failure instead of
+    "ça fait rien du tout" silent attach-to-dead.
 
     Auth: Claude Max OAuth (inherited from the user's shell env, no env
     override needed — `claude` reads `~/.claude/.credentials.json`).
 
-    cwd=$HOME is the legacy crash fix (spawn() default would inherit
-    the npm/_npx cache dir which can disappear); the `claude` process
-    itself runs with cwd = the context dir we just created.
+    ``force_replace=True`` kills any existing AISB-chat first — used by
+    the `omega` session manager's "+ New" action so the user gets a
+    fresh session each time.
     """
     name = "AISB-chat"
     home = Path(omega_home or os.environ.get("OMEGA_HOME")
                 or Path.home() / "Omega")
     persona = home / "Agentik_SSOT" / "agents" / "aisb" / "CLAUDE.md"
     ctx_dir = _ensure_chat_context_dir(home, "aisb-master", persona)
-    spawn(name, command=f"cd {ctx_dir} && exec claude",
-          cwd=str(Path.home()))
-    return name
+    return _spawn_with_shell_then_run(
+        name, cwd=ctx_dir, run_command="claude",
+        force_replace=force_replace,
+    )
 
 
-def spawn_hermes_chat(omega_home: str | Path | None = None) -> str:
+def spawn_hermes_chat(omega_home: str | Path | None = None,
+                       force_replace: bool = False) -> str:
     """Spawn the Hermès chat tmux session — REAL Claude Code TUI, but on
     Anthropic API (Hermès's own paid key, budget-isolated from Max OAuth).
 
     Mirrors ``spawn_aisb_chat`` for the L2 companion: drops a Hermès
-    persona ``CLAUDE.md`` into a dedicated context dir, then runs
-    `claude` there with ``ANTHROPIC_API_KEY`` exported from the vault.
-    Setting the env var makes Claude Code use the API key instead of
-    the Max OAuth — same TUI, different billing surface.
+    persona ``CLAUDE.md`` into a dedicated context dir, exports
+    ``ANTHROPIC_API_KEY`` (from vault) before launching `claude`. Same
+    shell-stays-alive pattern.
     """
     name = "Hermes-chat"
     home = Path(omega_home or os.environ.get("OMEGA_HOME")
                 or Path.home() / "Omega")
-    persona = home / "Agentik_SSOT" / "docs" / "LAYERS.md"   # Hermès reads architecture as persona
+    persona = home / "Agentik_SSOT" / "docs" / "LAYERS.md"
     ctx_dir = _ensure_chat_context_dir(home, "hermes", persona)
-    # Resolve Anthropic key from vault → fallback to existing env.
     try:
         from omega_engine.vault import vault_read
         api_key = (vault_read(home, "ANTHROPIC_API_KEY_HERMES") or "").strip()
@@ -309,9 +345,6 @@ def spawn_hermes_chat(omega_home: str | Path | None = None) -> str:
         api_key = ""
     if not api_key:
         api_key = (os.environ.get("ANTHROPIC_API_KEY") or "").strip()
-    # If no key, fall back to Max OAuth (Hermès will share AISB's
-    # billing — not ideal but better than failing). Surface a marker
-    # file in the context dir so the user sees the warning on first launch.
     if not api_key:
         (ctx_dir / "NO_ANTHROPIC_KEY.md").write_text(
             "# Hermès — no Anthropic API key wired\n\n"
@@ -319,12 +352,14 @@ def spawn_hermes_chat(omega_home: str | Path | None = None) -> str:
             "own paid Anthropic budget instead of the AISB Max OAuth.\n\n"
             "    omega vault write ANTHROPIC_API_KEY_HERMES sk-ant-...\n"
         )
-        cmd = f"cd {ctx_dir} && exec claude"
+        run_cmd = "claude"
     else:
-        cmd = (f"cd {ctx_dir} && "
-               f"ANTHROPIC_API_KEY={api_key} exec claude")
-    spawn(name, command=cmd, cwd=str(Path.home()))
-    return name
+        # Single-line shell statement; send-keys passes it as-is.
+        run_cmd = f"ANTHROPIC_API_KEY={api_key} claude"
+    return _spawn_with_shell_then_run(
+        name, cwd=ctx_dir, run_command=run_cmd,
+        force_replace=force_replace,
+    )
 
 
 # ---------------------------------------------------------------------------

package/omega/Agentik_Engine/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "omega-engine"
-version = "0.19.19"
+version = "0.19.21"
 description = "The Omega OS orchestration engine — event-sourced, verified-completion agent graphs."
 readme = "README.md"
 requires-python = ">=3.11"

package/omega/Agentik_SSOT/VERSION

@@ -1 +1 @@
-0.19.19
+0.19.21

package/omega/Agentik_SSOT/claude-plugins/claude-plugins.yaml

@@ -4,44 +4,53 @@
 # (interactive) or apply the manifest's `claude_plugins:` list (headless). For
 # each selected plugin, the installer:
 #
-#   1. ensures the marketplace is registered: `claude plugin marketplace add <source>`
+#   1. ensures the marketplace is registered: `claude plugin marketplace add <owner>/<repo>`
 #      (skipped if `source: builtin` — already present after a fresh install)
-#   2. installs it:                          `claude plugin install <name>@<marketplace> -s <scope>`
+#   2. installs it:                          `claude plugin install <name>@<marketplace>`
 #
 # Maintained by the claudecode-educator (Agentik_Orchestration/educators/).
 # Secrets are referenced by name only — never stored here.
 #
 # Marketplaces are listed once; plugins reference them by `marketplace:` id.
+#
+# IMPORTANT — marketplace id != github source.
+# When `claude plugin marketplace add anthropics/skills` runs, the
+# Claude CLI derives an id from the marketplace.json `name` field in the
+# repo, which can be different from the repo name. We tracked these by
+# hand (verified on the VPS as of 2026-05-25).
+#
+# Source format: `<owner>/<repo>` — NO `github:` prefix (the prefix
+# previously bundled here caused `marketplace add` to fail with
+# "Invalid marketplace source format").
 
 version: 1
 
 marketplaces:
   - id: claude-plugins-official
-    source: "github:anthropics/claude-plugins-official"
+    source: "anthropics/claude-plugins-official"
     description: "Anthropic's official plugin marketplace"
-    builtin: true
-  - id: anthropic-skills
-    source: "github:anthropics/skills"
-    description: "Anthropic's official skill collection (find-skills, document skills, etc.)"
-    builtin: false
-    trust: high
-  - id: vercel-labs-skills
-    source: "github:vercel-labs/skills"
-    description: "Vercel Labs skills (skill discovery CLI + find-skills)"
+    builtin: true                       # auto-registered by claude CLI
+  - id: anthropic-agent-skills
+    source: "anthropics/skills"
+    description: "Anthropic's official Agent Skills repo (document-skills, claude-api, example-skills)"
     builtin: false
     trust: high
-  - id: davila7-templates
-    source: "github:davila7/claude-code-templates"
-    description: "Community-maintained Claude Code templates and skills"
-    builtin: false
-    trust: medium
   - id: thedotmack
-    source: "github:thedotmack/claude-mem"
+    source: "thedotmack/claude-mem"
     description: "claude-mem memory + observation system"
     builtin: false
     trust: medium
+  - id: daymade-skills
+    source: "daymade/claude-code-skills"
+    description: "Community skill creator marketplace (daymade) — includes skill-creator-style tooling"
+    builtin: false
+    trust: medium
 
 catalog:
+  # All entries below were verified to exist + install cleanly on a real
+  # Claude Code 2.1.150+ install before being committed here. See the
+  # commit message of v0.19.20 for the audit trail.
+
   - id: claude-mem
     name: claude-mem
     description: "Long-term memory + observation system across sessions"
@@ -75,26 +84,50 @@ catalog:
     secrets: [STRIPE_SECRET_KEY]
     recommended: false
 
-  - id: skill-creator
-    name: skill-creator
-    description: "Generate new SKILL.md files with Claude's help (Anthropic official)"
-    category: meta
-    marketplace: anthropic-skills
-    scope: user
-    recommended: true
-
-  - id: find-skills
-    name: find-skills
-    description: "Discover skills across marketplaces (vercel-labs); pairs with skill-auditor"
-    category: meta
-    marketplace: vercel-labs-skills
-    scope: user
-    recommended: true
-
   - id: document-skills
     name: document-skills
     description: "Anthropic official suite — docx, pdf, pptx, xlsx (creation + editing)"
     category: documents
-    marketplace: anthropic-skills
+    marketplace: anthropic-agent-skills
     scope: user
     recommended: true
+
+  - id: pr-review-toolkit
+    name: pr-review-toolkit
+    description: "Pull request review tooling — analyse diffs, suggest fixes"
+    category: dev
+    marketplace: claude-plugins-official
+    scope: user
+    recommended: false
+
+  - id: code-review
+    name: code-review
+    description: "Static code review with style + quality heuristics"
+    category: dev
+    marketplace: claude-plugins-official
+    scope: user
+    recommended: false
+
+  - id: feature-dev
+    name: feature-dev
+    description: "Feature development workflow — spec → impl → review"
+    category: dev
+    marketplace: claude-plugins-official
+    scope: user
+    recommended: false
+
+  - id: mcp-server-dev
+    name: mcp-server-dev
+    description: "Scaffold + iterate on new MCP servers"
+    category: dev
+    marketplace: claude-plugins-official
+    scope: user
+    recommended: false
+
+  - id: plugin-dev
+    name: plugin-dev
+    description: "Build + test new Claude Code plugins"
+    category: meta
+    marketplace: claude-plugins-official
+    scope: user
+    recommended: false

package/omega/Agentik_SSOT/clis/clis-catalog.yaml

@@ -0,0 +1,151 @@
+# Omega OS — system CLI catalog (v0.19.21+)
+#
+# Replaces the v0.19.20 MCP catalog. Rationale: MCP servers are
+# token-expensive (each call pays the protocol round-trip + the server's
+# system prompt overhead). System CLIs that Claude Code calls via `Bash`
+# are cheap, predictable, and survive without a running server.
+#
+# Printing Press (https://printingpress.dev) ships ~50 agent-native CLIs
+# with local SQLite mirrors for offline queries — even cheaper than
+# remote API calls. We pull a curated subset by default.
+#
+# Maintained by the connection-educator (Agentik_Orchestration/educators/).
+# Secrets are referenced by name only — operator wires them at install
+# time or later via `omega vault write <REF> <value>`.
+
+version: 1
+
+# --- 1. Native binaries — install via system package manager -----------
+# These are the bedrock — `omega audit` and most workflows assume
+# they're on PATH.
+native:
+  - id: gh
+    name: GitHub CLI
+    install: { brew: "gh", apt: "gh", dnf: "gh" }
+    recommended: true
+  - id: vercel
+    name: Vercel CLI
+    install: { npm_global: "vercel" }
+    recommended: true
+  - id: wrangler
+    name: Cloudflare Wrangler
+    install: { npm_global: "wrangler" }
+    recommended: false
+  - id: pnpm
+    name: pnpm package manager
+    install: { brew: "pnpm", npm_global: "pnpm" }
+    recommended: true
+  - id: bun
+    name: Bun runtime + package manager
+    install: { brew: "oven-sh/bun/bun", curl: "https://bun.sh/install" }
+    recommended: true
+  - id: ripgrep
+    name: ripgrep (rg) — fast code search
+    install: { brew: "ripgrep", apt: "ripgrep", dnf: "ripgrep" }
+    binary: rg
+    recommended: true
+  - id: bat
+    name: bat — better cat with syntax highlight
+    install: { brew: "bat", apt: "bat", dnf: "bat" }
+    recommended: false
+  - id: jq
+    name: jq — JSON processor
+    install: { brew: "jq", apt: "jq", dnf: "jq" }
+    recommended: true
+  - id: stripe-cli
+    name: Stripe CLI
+    install: { brew: "stripe/stripe-cli/stripe" }
+    binary: stripe
+    secrets: [STRIPE_API_KEY]
+    recommended: false
+  - id: playwright
+    name: Playwright (browser automation for E2E + audits)
+    install: { npm_global: "@playwright/test" }
+    secrets: []
+    recommended: true
+
+# --- 2. Printing Press CLIs --------------------------------------------
+# Installed via `npx -y @mvanhorn/printing-press-library install <name>`.
+# Each ships with a local SQLite mirror + Claude Code skill.
+#
+# Catalog source: github.com/mvanhorn/printing-press-library/library
+printing_press_core:
+  install_method: "curl -fsSL https://raw.githubusercontent.com/mvanhorn/cli-printing-press/main/scripts/install.sh | bash"
+  description: "Printing Press generator + library client (ppi-* CLIs)"
+
+printing_press_clis:
+  - id: stripe
+    category: payments
+    description: "Every Stripe entity + local SQLite mirror, cross-entity SQL"
+    secrets: [STRIPE_API_KEY]
+    recommended: true
+  - id: linear
+    category: project-management
+    description: "Linear issues + projects, local SQLite mirror, compound queries"
+    secrets: [LINEAR_API_KEY]
+    recommended: true
+  - id: jira
+    category: project-management
+    description: "Jira issues + sprints"
+    secrets: [JIRA_API_TOKEN, JIRA_HOST]
+    recommended: false
+  - id: clickup
+    category: project-management
+    description: "ClickUp tasks + spaces"
+    secrets: [CLICKUP_API_KEY]
+    recommended: false
+  - id: cal-com
+    category: productivity
+    description: "Cal.com bookings + availability"
+    secrets: [CAL_COM_API_KEY]
+    recommended: false
+  - id: figma
+    category: productivity
+    description: "Figma files + comments (read-only)"
+    secrets: [FIGMA_TOKEN]
+    recommended: false
+  - id: fireflies
+    category: productivity
+    description: "Fireflies meeting transcripts + summaries"
+    secrets: [FIREFLIES_API_KEY]
+    recommended: false
+  - id: granola
+    category: productivity
+    description: "Granola notes export"
+    secrets: [GRANOLA_API_KEY]
+    recommended: false
+  - id: apify
+    category: developer-tools
+    description: "Apify scraping actors + dataset access"
+    secrets: [APIFY_TOKEN]
+    recommended: false
+  - id: firecrawl
+    category: developer-tools
+    description: "Firecrawl web scraping with local mirror"
+    secrets: [FIRECRAWL_API_KEY]
+    recommended: false
+  - id: docker-hub
+    category: developer-tools
+    description: "Docker Hub repos + tags inspection"
+    secrets: []
+    recommended: false
+  - id: twilio
+    category: social-and-messaging
+    description: "Twilio SMS + voice + WhatsApp"
+    secrets: [TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN]
+    recommended: false
+  - id: ahrefs
+    category: marketing
+    description: "Ahrefs SEO data with local SQLite mirror"
+    secrets: [AHREFS_API_KEY]
+    recommended: false
+  - id: google-search-console
+    category: marketing
+    description: "GSC properties + queries + pages"
+    secrets: [GSC_CREDENTIALS_JSON]
+    recommended: false
+  - id: google-ads
+    category: marketing
+    description: "Google Ads campaigns + spend"
+    secrets: [GOOGLE_ADS_DEVELOPER_TOKEN, GOOGLE_ADS_CLIENT_ID, GOOGLE_ADS_CLIENT_SECRET]
+    recommended: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentikos/omega-os",
-  "version": "0.19.19",
+  "version": "0.19.21",
   "description": "Omega OS — installable agentic operating system with verified-completion orchestration. Event-sourced engine, 8-block rack, autonomous agents, MCP.",
   "bin": {
     "omega-os": "bin/omega-os.js"