@agentikos/omega-os 0.19.42 → 0.19.43

package/omega/Agentik_Engine/omega_engine/cli.py

@@ -271,6 +271,31 @@ def cmd_doctor(args: argparse.Namespace) -> int:
     except Exception as exc:  # noqa: BLE001
         line("warn", f"provider auth check failed: {exc}")
 
+    # v0.19.43 — Hermès budget-isolation check. Hermès SHOULD use its own
+    # paid Anthropic key (ANTHROPIC_API_KEY_HERMES) so its calls don't
+    # share the AISB Max OAuth pool. See omega_engine/hermes.py::build_env
+    # for the 3-tier fallback. When path (3) — Max OAuth — is the live
+    # path, surface it here so the operator knows isolation is OFF.
+    try:
+        from omega_engine.vault import vault_read as _vread
+        _hermes_vault_key = (_vread(home, "ANTHROPIC_API_KEY_HERMES") or "").strip()
+        _hermes_env_key = (_os.environ.get("ANTHROPIC_API_KEY") or "").strip()
+        if _hermes_vault_key:
+            line("ok", "Hermès budget isolation: vault key present "
+                       "(ANTHROPIC_API_KEY_HERMES)")
+        elif _hermes_env_key:
+            line("warn", "Hermès budget isolation: shell env key only "
+                         "(ANTHROPIC_API_KEY) — works but couples Hermès to "
+                         "whatever the env points at. Consider wiring the "
+                         "vault key for permanent isolation.")
+        else:
+            line("warn", "Hermès budget isolation OFF — no vault key, no env "
+                         "key. Hermès will fall back to Max OAuth (charges "
+                         "your Max sub). Wire with: "
+                         "`omega vault write ANTHROPIC_API_KEY_HERMES sk-ant-...`")
+    except Exception as exc:  # noqa: BLE001
+        line("warn", f"Hermès isolation check failed: {exc}")
+
     # 6c1. LLM CLIs installed on the host
     section("llm clis")
     import shutil as _shu
@@ -2885,8 +2910,11 @@ def cmd_aisb(args: argparse.Namespace) -> int:
     from omega_engine import tmux
     sub = getattr(args, "aisb_cmd", None) or "chat"
     if sub in ("chat", None):
+        # v0.19.43 — AISB-chat is now a WINDOW inside the Omega master
+        # session (Omega:aisb), not a standalone session. spawn_aisb_chat
+        # returns "Omega:aisb" so we pass that as the switch target.
         return _attach_or_spawn_chat(
-            "AISB-chat",
+            "Omega:aisb",
             spawn_fn=tmux.spawn_aisb_chat,
             label="AISB master (Claude Code on Max OAuth)",
         )
@@ -3175,14 +3203,14 @@ def _legacy_fzf_menu(_args: argparse.Namespace) -> int:
             subprocess.run(["tmux", "kill-session", "-t", "Omega"])
             return 0
 
-        # Chat sessions — switch tmux client to the chat session.
+        # Chat sessions — windows inside Omega master (v0.19.43).
         if action == "open:aisb":
-            tmux.spawn_aisb_chat(HOME, force_replace=False)
-            subprocess.run(["tmux", "switch-client", "-t", "AISB-chat"])
+            target = tmux.spawn_aisb_chat(HOME, force_replace=False)
+            subprocess.run(["tmux", "switch-client", "-t", target])
             continue
         if action == "open:hermes":
-            tmux.spawn_hermes_chat(HOME, force_replace=False)
-            subprocess.run(["tmux", "switch-client", "-t", "Hermes-chat"])
+            target = tmux.spawn_hermes_chat(HOME, force_replace=False)
+            subprocess.run(["tmux", "switch-client", "-t", target])
             continue
 
         # Inline actions — run in the menu pane, prompt to return.
@@ -3494,6 +3522,13 @@ def cmd_switch(args: argparse.Namespace) -> int:
         "qwen_code":    "qwen",
         "continue_dev": "cn",
         "aider":        "aider",
+        # v0.19.43 — providers installable via the CLI catalog that were
+        # missing from `omega switch`. Each maps to its bin_name from
+        # bootstrap/lib/llm-clis.py::_CATALOG.
+        "glm_sdk":      "zhipuai",     # Python SDK — no binary, kept for completeness
+        "ollama":       "ollama",
+        "lm_studio":    "lms",
+        "gh_copilot":   "gh",          # extension on top of gh
     }
     if not getattr(args, "provider", None):
         print(f"  active provider: {_active_provider()}")
@@ -3598,10 +3633,12 @@ def cmd_hermes(args: argparse.Namespace) -> int:
 
     # v0.19.15 — `omega hermes` with no subcommand opens the Hermès chat
     # tmux session. Same UX as bare `omega` → AISB chat, but for L2.
+    # v0.19.43 — Hermes-chat is now a WINDOW inside the Omega master
+    # session (Omega:hermes); spawn_hermes_chat returns that ref.
     if sub is None or sub == "chat":
         from omega_engine import tmux as _tx
         return _attach_or_spawn_chat(
-            "Hermes-chat",
+            "Omega:hermes",
             spawn_fn=_tx.spawn_hermes_chat,
             label="Hermès meta-companion chat",
         )

package/omega/Agentik_Engine/omega_engine/hermes.py

@@ -262,6 +262,39 @@ def build_env(
          calls through your Max sub.
 
     Caller env wins via ``extra``.
+
+    ──────────────────────────────────────────────────────────────────
+    IMPORTANT — Hermès credential resolution (v0.19.43 clarification)
+    ──────────────────────────────────────────────────────────────────
+
+    Hermès SHOULD use ANTHROPIC_API_KEY_HERMES from the vault for budget
+    isolation from the AISB Max OAuth. The 3-tier fallback below is a
+    SAFETY NET for the edge case where the vault key is missing but the
+    operator still wants Hermès to work (during initial setup, debugging,
+    or a one-off command before they have wired the paid key).
+
+    Fallback order (first non-empty wins):
+
+      1. ANTHROPIC_API_KEY_HERMES (vault)     ← preferred, isolated budget
+      2. ANTHROPIC_API_KEY        (shell env) ← shared env, semi-isolated
+      3. CLAUDE_CODE_OAUTH_TOKEN  (Max OAuth) ← LAST RESORT, breaks isolation
+
+    Hierarchy intent:
+      * Path (1) is the contract Hermès was designed to honor.
+      * Path (2) lets a developer ``ANTHROPIC_API_KEY=sk-... omega hermes``
+        without writing to the vault.
+      * Path (3) preserves "Hermès still works on a fresh install before
+        the user has wired their key" — at the cost of charging the user's
+        Max sub for what should be a paid-API call.
+
+    ``omega doctor`` warns when Hermès would fall through to path (3) in
+    practice (vault empty AND ``ANTHROPIC_API_KEY`` unset). The persistent
+    Hermès chat (``step_hermes_session`` in bootstrap/lib/steps.sh) SKIPS
+    its spawn entirely on missing vault key — it does NOT fall through to
+    Max OAuth for 24/7 runtime use, because an always-on Max-billed Hermès
+    is rarely what the operator wants. Only the interactive on-demand
+    ``omega hermes`` path uses this fallback chain.
+    ──────────────────────────────────────────────────────────────────
     """
     env = {**os.environ}
     # 1. Vault first.
@@ -279,10 +312,19 @@ def build_env(
     if not key:
         key = (os.environ.get("ANTHROPIC_API_KEY") or "").strip()
     # 3. Last-resort OAuth (preserves the old behaviour without making
-    # Hermès depend on it).
+    # Hermès depend on it). When this branch fires, log a warning to
+    # stderr so the operator knows budget isolation is OFF — Hermès is
+    # now sharing the Max OAuth pool with AISB+Oracle+Workers. The
+    # `omega doctor` `personas` / `providers` section will also surface
+    # this drift.
     if not key:
         try:
             env["CLAUDE_CODE_OAUTH_TOKEN"] = claude_oauth_token(creds_path)
+            import sys as _sys
+            print("  ⚠️  Hermès budget isolation OFF — falling back to "
+                  "Max OAuth. Run `omega vault write "
+                  "ANTHROPIC_API_KEY_HERMES sk-ant-...` to restore.",
+                  file=_sys.stderr)
         except Exception:  # noqa: BLE001
             pass
     if key:

package/omega/Agentik_Engine/omega_engine/paperclip_bridge.py

@@ -292,6 +292,28 @@ def send_heartbeat(
     return True
 
 
+def heartbeat_on_spawn(agent_id: str, project: str | None = None) -> None:
+    """v0.19.43 — call this from spawn_worker / spawn_oracle right after
+    the tmux session is created. Drops a one-shot heartbeat to Paperclip
+    so the dashboard's live-agent indicator wakes up immediately instead
+    of waiting for the agent's first explicit heartbeat call.
+
+    Never raises — if Paperclip is not installed or not running, this is
+    a no-op. Safe to call from any spawn path.
+    """
+    try:
+        hb = Heartbeat(
+            agent_id=agent_id,
+            project=project or "",
+            session=os.environ.get("TMUX_SESSION", ""),
+            status="alive",
+            summary="spawned",
+        )
+        send_heartbeat(hb)
+    except Exception:
+        pass  # silent fallback — bridge is optional infrastructure
+
+
 # ---------------------------------------------------------------------------
 # Registration — write Paperclip's agent + company config from OmegaOS
 # ---------------------------------------------------------------------------

package/omega/Agentik_Engine/omega_engine/personas.py

@@ -55,6 +55,14 @@ _LLM_PERSONA_PATHS: dict[str, list[str]] = {
     "continue_dev": [".continue/CONTEXT.md"],
     "aider":        ["CONVENTIONS.md"],
     "hermes":       ["HERMES.md"],
+    # v0.19.43 — 4 CLIs were installable but had no persona file. Without
+    # this mapping, write_all_personas() silently skipped them and the
+    # CLI would launch with no Omega context. Each maps to the closest
+    # convention for that CLI.
+    "glm_sdk":      ["GLM.md"],         # Zhipu GLM SDK — bespoke marker
+    "ollama":       ["OLLAMA.md"],      # Ollama local runtime
+    "lm_studio":    ["LM_STUDIO.md"],   # LM Studio local
+    "gh_copilot":   ["CLAUDE.md"],      # gh copilot piggy-backs on CLAUDE.md
 }
 
 
@@ -98,7 +106,7 @@ You sit at L4 or L5 depending on context.
 $OMEGA_HOME = ~/Omega
 ├── Agentik_Engine/                  ← Python engine (omega CLI)
 ├── Agentik_SSOT/                    ← source of truth
-│   ├── skills/                      ← 17 audits + orchestrators + /newcmd
+│   ├── skills/                      ← 18 audits + orchestrators + /newcmd
 │   ├── agents/aisb/                 ← 13 AISB persona files
 │   ├── personas/OMEGAOS-CONTEXT.md  ← THIS FILE
 │   ├── docs/LAYERS.md               ← formal L1-L5 architecture
@@ -122,11 +130,11 @@ $OMEGA_HOME = ~/Omega
 | Status / health | `omega doctor` / `omega status` |
 | Session manager (tmux) | `omega` (no args) |
 
-## Quality Arsenal (17 forensic audits)
+## Quality Arsenal (18 forensic audits)
 
 `/codeaudit /flowaudit /uiuxaudit /debugaudit /featureaudit /perfaudit
 /secaudit /a11yaudit /seoaudit /dataaudit /apiaudit /copyaudit /dxaudit
-/motionaudit /automationaudit /logicaudit /retentionaudit`
+/motionaudit /automationaudit /logicaudit /retentionaudit /refontaudit`
 
 Each: Gestalt clarity gate, Popper falsification, hinge point 10x
 scrutiny, auto-fix, auto-re-audit, scored /100.

package/omega/Agentik_Engine/omega_engine/provider.py

@@ -440,13 +440,28 @@ class _OpenAICompatProvider:
         self._base_url = base_url or self._default_base_url
 
     def _resolve_key(self) -> str:
-        key = self._api_key or os.environ.get(self._env_var)
-        if not key:
+        # Constructor-injected key always wins.
+        if self._api_key:
+            return self._api_key
+        # v0.19.43 — try the encrypted vault first, then fall back to env.
+        # The vault is where step_providers stores api keys provided via
+        # the install manifest; env is the legacy / fallback path.
+        try:
+            from omega_engine.vault import vault_read
+            from pathlib import Path
+            home = Path(os.environ.get("OMEGA_HOME", str(Path.home() / "Omega")))
+            v = vault_read(home, self._env_var)
+            if v and v.strip():
+                return v.strip()
+        except Exception:
+            pass
+        key = os.environ.get(self._env_var)
+        if not key or not key.strip():
             raise RuntimeError(
                 f"{type(self).__name__} requires an API key. "
                 f"Pass api_key=... or set {self._env_var} in the environment."
             )
-        return key
+        return key.strip()
 
     def _build_messages(self, req: AgentRequest) -> list[dict[str, str]]:
         prompt = req.prompt

package/omega/Agentik_Engine/omega_engine/tmux.py

@@ -385,30 +385,37 @@ def spawn_chat_in_omega(
 
 def spawn_aisb_chat(omega_home: str | Path | None = None,
                      force_replace: bool = False) -> str:
-    """Spawn the AISB master chat tmux session — REAL Claude Code TUI.
+    """Spawn the AISB master chat as a WINDOW inside the Omega master session.
 
-    v0.19.20 — moved from ``exec claude`` (which kills the session when
-    claude exits) to ``spawn shell + send-keys claude``. The shell stays
-    alive even if claude can't start (no Max OAuth wired, etc.), so the
-    user lands inside the session and sees the actual failure instead of
-    "ça fait rien du tout" silent attach-to-dead.
+    v0.19.43 — refactored to use the window-based pattern via
+    :func:`spawn_chat_in_omega` so AISB-chat lives UNDER the persistent
+    Omega master session (single tmux lifecycle, detach returns to the
+    Omega menu) instead of as a standalone tmux session. This honors the
+    v0.19.31+ design promise: "everything under Omega".
+
+    Returns the full tmux ref ``"Omega:aisb"`` — callers can use it
+    directly with ``tmux switch-client -t`` / ``tmux attach -t``.
 
     Auth: Claude Max OAuth (inherited from the user's shell env, no env
     override needed — `claude` reads `~/.claude/.credentials.json`).
 
-    ``force_replace=True`` kills any existing AISB-chat first — used by
-    the `omega` session manager's "+ New" action so the user gets a
-    fresh session each time.
+    ``force_replace=True`` kills any existing aisb window first — used
+    by the menu's "+ New" action so the user gets a fresh window each
+    time.
     """
-    name = "AISB-chat"
     home = Path(omega_home or os.environ.get("OMEGA_HOME")
                 or Path.home() / "Omega")
+    # Ensure the Omega master session exists — spawn_chat_in_omega tries
+    # to do this too, but its fallback uses ctx_dir.parent.parent.parent
+    # which doesn't always resolve to OMEGA_HOME. Be explicit.
+    spawn_omega_master(home)
     persona = home / "Agentik_SSOT" / "agents" / "aisb" / "CLAUDE.md"
     ctx_dir = _ensure_chat_context_dir(home, "aisb-master", persona)
-    return _spawn_with_shell_then_run(
-        name, cwd=ctx_dir, run_command="claude",
+    spawn_chat_in_omega(
+        "aisb", ctx_dir=ctx_dir, run_command="claude",
         force_replace=force_replace,
     )
+    return "Omega:aisb"
 
 
 def spawn_omega_master(omega_home: str | Path | None = None) -> str:
@@ -448,19 +455,31 @@ def spawn_omega_master(omega_home: str | Path | None = None) -> str:
 
 def spawn_hermes_chat(omega_home: str | Path | None = None,
                        force_replace: bool = False) -> str:
-    """Spawn the Hermès chat tmux session — REAL Claude Code TUI, but on
-    Anthropic API (Hermès's own paid key, budget-isolated from Max OAuth).
+    """Spawn the Hermès chat as a WINDOW inside the Omega master session.
+
+    v0.19.43 — refactored to use the window-based pattern via
+    :func:`spawn_chat_in_omega` to match :func:`spawn_aisb_chat` and the
+    menu TUI (single tmux lifecycle, detach returns to the Omega menu).
+
+    Credential isolation is PRESERVED — Hermès reads
+    ``ANTHROPIC_API_KEY_HERMES`` from the vault to keep its budget
+    isolated from the AISB Max OAuth. If the vault key is missing we
+    fall back to ``ANTHROPIC_API_KEY`` in the shell env, and finally to
+    plain ``claude`` (Max OAuth) with a marker file dropped in the
+    context dir so the operator sees the message after attaching.
 
-    Mirrors ``spawn_aisb_chat`` for the L2 companion: drops a Hermès
-    persona ``CLAUDE.md`` into a dedicated context dir, exports
-    ``ANTHROPIC_API_KEY`` (from vault) before launching `claude`. Same
-    shell-stays-alive pattern.
+    Returns ``"Omega:hermes"`` so callers can use it with
+    ``tmux switch-client -t`` / ``tmux attach -t`` directly.
     """
-    name = "Hermes-chat"
     home = Path(omega_home or os.environ.get("OMEGA_HOME")
                 or Path.home() / "Omega")
+    # Ensure the Omega master session exists — see spawn_aisb_chat.
+    spawn_omega_master(home)
     persona = home / "Agentik_SSOT" / "docs" / "LAYERS.md"
     ctx_dir = _ensure_chat_context_dir(home, "hermes", persona)
+    # Credential isolation — vault key first, env fallback, Max OAuth
+    # last-resort. MUST stay in this function: the budget-isolation
+    # contract belongs to Hermès, not to the generic spawn helper.
     try:
         from omega_engine.vault import vault_read
         api_key = (vault_read(home, "ANTHROPIC_API_KEY_HERMES") or "").strip()
@@ -479,10 +498,11 @@ def spawn_hermes_chat(omega_home: str | Path | None = None,
     else:
         # Single-line shell statement; send-keys passes it as-is.
         run_cmd = f"ANTHROPIC_API_KEY={api_key} claude"
-    return _spawn_with_shell_then_run(
-        name, cwd=ctx_dir, run_command=run_cmd,
+    spawn_chat_in_omega(
+        "hermes", ctx_dir=ctx_dir, run_command=run_cmd,
         force_replace=force_replace,
     )
+    return "Omega:hermes"
 
 
 # ---------------------------------------------------------------------------

package/omega/Agentik_Engine/omega_engine/tui.py

@@ -67,7 +67,7 @@ except ImportError:
 CATEGORIES: list[tuple[str, str]] = [
     ("chat",      "Chat — AISB & Hermès"),
     ("projects",  "Projects — Genesis & shells"),
-    ("audits",    "Audits — Quality Arsenal (17 forensic)"),
+    ("audits",    "Audits — Quality Arsenal (18 forensic)"),
     ("missions",  "Missions — run with verified completion"),
     ("sessions",  "Sessions — live tmux sessions"),
     ("accounts",  "Accounts — Claude Max + provider auth"),
@@ -135,22 +135,23 @@ def dispatch_slash(line: str) -> CommandResult:
     if cmd in ("detach", "d"):
         return CommandResult(detach=True)
 
-    # Chat sessions
+    # Chat sessions — v0.19.43 are now WINDOWS inside the Omega master
+    # session (Omega:aisb, Omega:hermes), not standalone sessions.
     if cmd == "aisb" or (cmd == "chat" and rest and rest[0] == "aisb"):
         from omega_engine import tmux as _tx
-        _tx.spawn_aisb_chat(Path(os.environ.get(
+        target = _tx.spawn_aisb_chat(Path(os.environ.get(
             "OMEGA_HOME", str(Path.home() / "Omega"))))
         return CommandResult(
             text="  AISB-chat spawned — switching client…",
-            session_jump="AISB-chat",
+            session_jump=target,
         )
     if cmd == "hermes" or (cmd == "chat" and rest and rest[0] == "hermes"):
         from omega_engine import tmux as _tx
-        _tx.spawn_hermes_chat(Path(os.environ.get(
+        target = _tx.spawn_hermes_chat(Path(os.environ.get(
             "OMEGA_HOME", str(Path.home() / "Omega"))))
         return CommandResult(
             text="  Hermes-chat spawned — switching client…",
-            session_jump="Hermes-chat",
+            session_jump=target,
         )
 
     # Provider hot-swap
@@ -164,7 +165,7 @@ def dispatch_slash(line: str) -> CommandResult:
         if rest:
             return CommandResult(text=_run_omega("audit", *rest))
         return CommandResult(text=(
-            "  Quality Arsenal — 17 forensic audits:\n"
+            "  Quality Arsenal — 18 forensic audits:\n"
             "    /codeaudit /uiuxaudit /flowaudit /debugaudit\n"
             "    /featureaudit /perfaudit /secaudit /a11yaudit\n"
             "    /seoaudit /dataaudit /apiaudit /copyaudit\n"

package/omega/Agentik_Engine/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "omega-engine"
-version = "0.19.42"
+version = "0.19.43"
 description = "The Omega OS orchestration engine — event-sourced, verified-completion agent graphs."
 readme = "README.md"
 requires-python = ">=3.11"