@cairnkeep/cli 2.18.0 → 2.19.1

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.19.1] - 2026-10-06
+
+### Security
+
+- Upgrade the MCP SDK floor to 1.32.1 and refresh both production lock graphs
+  so `fast-uri` 3.1.8, `hono` 4.13.13, `ip-address` 10.7.3, and
+  `proxy-addr` 2.0.8 exclude the newly disclosed URI-normalization, request
+  parsing, SSRF, denial-of-service, XSS, and proxy-trust advisories.
+- Extend the dependency-security gate to reject future lockfile regressions
+  below those patched transitive versions.
+
+## [2.19.0] - 2026-09-28
+
+### Added
+
+- Include oh-my-pi (OMP) in guided setup with a project launcher and explicit,
+  opt-in machine sync instructions.
+- Report every required machine sync command when multiple harnesses are
+  selected, while retaining the singular JSON field for compatibility.
+- Support OMP in opt-in Git-linked work evidence and preserve its diff-artifact
+  provenance.
+
 ## [2.18.0] - 2026-09-28
 
 ### Added
@@ -561,7 +583,9 @@ stored memories.
 - Preserve executable permissions and Bash 3.2 portability on macOS.
 - Add backup-first uninstall and SQLite-safe memory export/import guidance.
 
-[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.18.0...HEAD
+[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.19.1...HEAD
+[2.19.1]: https://github.com/cairnkeep/cairnkeep/compare/v2.19.0...v2.19.1
+[2.19.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.18.0...v2.19.0
 [2.18.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.17.3...v2.18.0
 [2.15.1]: https://github.com/cairnkeep/cairnkeep/compare/v2.15.0...v2.15.1
 [2.15.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.14.0...v2.15.0

package/CONTRIBUTING.md

@@ -43,7 +43,7 @@ endpoints. They are not part of the default offline test suite.
   Node-based CLI implementations.
 - `bin/cairn` is the installed command entry point.
 - `templates/` contains project scaffolding and managed instruction assets.
-- `claude/`, `opencode/`, `pi/`, and `kimi/` contain harness-specific operating
+- `claude/`, `opencode/`, `pi/`, `omp/`, and `kimi/` contain harness-specific operating
   assets.
 - `scripts/` contains sync, lifecycle, packaging, and contract checks.
 - `docs/` contains the versioned user and operator references indexed from

package/docs/harness-compatibility.md

@@ -80,7 +80,8 @@ registry-current release.
 
 ## oh-my-pi (omp)
 
-Run `cairn sync-omp --apply` explicitly to install
+Select OMP in `cairn setup` to create the project launcher, then run
+`cairn sync-omp --apply` explicitly to install
 `extensions/cairnkeep-memory.ts` and `extensions/cairnkeep-capture.ts` under
 the omp agent root (default
 `~/.omp/agent`; `PI_CODING_AGENT_DIR` overrides it, matching omp's agent

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.18.0
+**Baseline:** Cairnkeep 2.19.1
 **Last reviewed:** 2026-08-19
 
 This map prevents the course from drifting behind the product. It assigns each

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.18.0
+**Baseline:** Cairnkeep 2.19.1
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -86,6 +86,7 @@ prerequisites for ordinary memory.
 | Context packs | Manual local or commit-pinned Git install plus project enablement | Immutable objects and atomic pointers under `CAIRN_PACK_BASE_DIR`; no background sync | Validate, inspect digest, check/apply update, disable/remove | `course-10-trust-context` |
 | OKF exchange | `cairn pack validate-okf`, `import-okf`, and preview-confirm `export-okf` | Local import/export by default; explicit file/shared-note allowlist; redacted output | Inspect diagnostics/provenance/output list; exact-digest apply; disable/remove imported pack | `course-10-trust-context` |
 | Pi local stdio memory | Select Pi during setup, then explicitly run `cairn sync-pi --apply` | Local memory-server child; dynamic effective tool catalog; annotations retained in trusted details, not a native Pi field | `cairn sync-pi --check`, `cairn doctor`, cancel one call, then observe awaited shutdown with no orphan | `course-12-guided-setup` |
+| OMP local stdio memory | Select OMP during setup, then explicitly run `cairn sync-omp --apply` | Local memory-server child; dynamic effective tool catalog; capture stages candidates for review | `cairn sync-omp --check`, `cairn doctor`, cancel one call, then verify session-stop staging and no orphan | `course-12-guided-setup` |
 
 ## Evidence, governance, and measurement
 

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.18.0
+**Tested with:** Cairnkeep 2.19.1
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.18.0
+**Tested with:** Cairnkeep 2.19.1
 
 ## Outcome
 

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.18.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.19.1 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.18.0
+**Tested with:** Cairnkeep 2.19.1
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.18.0
+**Tested with:** Cairnkeep 2.19.1
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.18.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.19.1 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.18.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.19.1 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.18.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.19.1, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.18.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.19.1; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 
@@ -13,13 +13,14 @@ Pi's local stdio memory bridge, and recover or uninstall every managed asset
 without hidden machine changes.
 
 The selected harnesses come from Cairnkeep's declarative registry. Codex is a
-supported selection: it receives `.codex/config.toml` and a launcher, while Pi
-continues to require its separate explicit machine sync.
+supported selection: it receives `.codex/config.toml` and a launcher. Pi and
+OMP receive project launchers and each require a separate, explicit machine
+sync; selecting both reports both sync commands.
 
 ## Prerequisites
 
 - Node.js 22 or newer, npm, and Git for the main exercise.
-- Pi 0.84.1 or newer.
+- Pi 0.84.1 or newer; OMP is optional.
 - A disposable parent directory containing no credentials, secrets, private
   state, or identifying project data.
 
@@ -32,7 +33,7 @@ cairn setup /tmp/cairnkeep-guided-selector-lab
 ```
 
 Choose Git with Up/Down and Enter, tick Pi with Space in the harness checklist,
-keep local memory, then inspect the plan before confirming. Pressing Escape or
+optionally tick OMP as well, keep local memory, then inspect the plan before confirming. Pressing Escape or
 Ctrl-C cancels; redirected and limited terminals use the documented text-input
 fallback. Remove that disposable selector lab before continuing if you applied
 the plan.
@@ -63,6 +64,14 @@ cairn doctor
 ./.ai/start-pi.sh
 ```
 
+If OMP was selected, run its separate sync and use the generated launcher:
+
+```bash
+cairn sync-omp --apply
+cairn sync-omp --check
+./.ai/start-omp.sh
+```
+
 In the disposable Pi session, list the registered Cairnkeep tools and make one
 harmless read-only memory call. The extension starts `cairn memory-server` as a
 local stdio child in this project; it does not select HTTP or a remote server.
@@ -107,9 +116,10 @@ cairn sync-pi --check
 cairn doctor
 ```
 
-Doctor reports project-state drift separately from missing or drifted Pi
+Doctor reports project-state drift separately from missing or drifted harness
 machine assets. Setup repairs only recorded project assets; `cairn sync-pi
---apply` repairs only the package-owned Pi extension and prompt paths.
+--apply` and `cairn sync-omp --apply` repair only their respective package-owned
+machine paths.
 
 Preview backup-first removal before confirming it:
 
@@ -128,6 +138,7 @@ and context packs remain unless their separate purge flags are supplied.
 | Setup refuses a missing target | The non-interactive command omitted an explicit choice or `--yes` | Run `cairn setup PATH` in a terminal, or supply the target, `--git`, `--harness`, `--memory`, and `--yes` together |
 | Setup refuses `--git existing` | The target is not inside a Git work tree | Choose an existing repository, or explicitly authorize `--git init`; use `--git none` only when limited mode is intended |
 | Doctor reports missing or drifted Pi assets | Project setup selected Pi but machine sync is incomplete | Run `cairn sync-pi --apply`, then `cairn sync-pi --check` and `cairn doctor` |
+| OMP is missing an extension | Project setup selected OMP but its explicit machine sync was not applied | Run `cairn sync-omp --apply`, then `cairn sync-omp --check` and `cairn doctor` |
 | A cancelled call ends the session | The Pi/bridge version does not satisfy the per-call cancellation contract | Preserve sanitized diagnostics, close the session, and do not claim release readiness |
 | Pi exits but a child process remains | Shutdown did not complete or the tested extension drifted | Preserve process-state evidence, run the sync check, and treat the release gate as failed |
 | A client expects native annotation hints | Pi's public tool API has no annotations field | Inspect trusted bridge metadata/result `details`; never claim native propagation |

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.18.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.19.1 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.18.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.19.1 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/operating.md

@@ -75,7 +75,7 @@ cairn setup /path/to/project --git init --harness claude,pi --memory local --yes
 ```
 
 The deterministic form accepts `--git init|existing|none`, a comma-separated
-subset of `claude,opencode,pi,kimi,qwen,codex`, and `--memory local|none`. `--git
+subset of `claude,opencode,pi,omp,kimi,qwen,codex`, and `--memory local|none`. `--git
 existing` requires the target to be in an existing work tree. `--git init`
 requires Git and is the only non-interactive authorization to initialize a
 repository. `--git none` is an explicit limited mode: repository-aware features
@@ -95,16 +95,21 @@ selected harnesses, and digests/modes/template identifiers for setup-owned
 assets. It contains no credentials, endpoints, or absolute paths.
 
 Setup never installs or refreshes machine-level harness assets. Its
-`machine_sync.automatic` field is always false, and the human output labels the
-reported command as not run automatically. For selections such as Codex and
-Qwen that need no machine sync, `machine_sync.command` is `null` and the human
-output says that sync is not required. Apply any reported command explicitly,
-check it, then diagnose and launch:
+`machine_sync.automatic` field is always false, and the human output labels each
+reported command as not run automatically. The JSON result's
+`machine_sync.commands` lists every required command; the older singular
+`machine_sync.command` field remains as the first command for compatibility.
+For selections such as Codex and Qwen that need no machine sync,
+`machine_sync.commands` is empty and the human output says that sync is not
+required. Apply each reported command explicitly, check the corresponding
+assets, then diagnose and launch:
 
 ```bash
 cairn sync --apply                    # Claude Code operating assets
 cairn sync-pi --apply                 # Pi extension and prompt
 cairn sync-pi --check
+cairn sync-omp --apply                # OMP extensions
+cairn sync-omp --check
 cd /path/to/project && cairn doctor
 ./.ai/start-pi.sh
 ```

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.18.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.19.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/artifact-schema.js

@@ -32,7 +32,7 @@ export const artifactNodeRefSchema = z.object({
 export const artifactProvenanceSchema = z.object({
     producer: z.string().min(1).max(256).refine((value) => !/[\u0000-\u001f\u007f]/.test(value)),
     source_event: z.string().min(1).max(256).optional(),
-    harness: z.enum(["claude-code", "opencode", "pi"]).optional(),
+    harness: z.enum(["claude-code", "opencode", "pi", "omp"]).optional(),
     harness_version: z.string().min(1).max(128).optional(),
     native_id: z.string().min(1).max(256).optional(),
 }).strict();

package/mcp-memory-server/dist/work-evidence-schema.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 export const WORK_EVIDENCE_SCHEMA_VERSION = 1;
-export const WORK_EVIDENCE_HARNESSES = ["claude", "opencode", "pi", "kimi", "qwen", "codex"];
+export const WORK_EVIDENCE_HARNESSES = ["claude", "opencode", "pi", "omp", "kimi", "qwen", "codex"];
 export const WORK_EVIDENCE_DEFAULT_RETENTION_DAYS = 30;
 export const WORK_EVIDENCE_DEFAULT_STORE_MAX_BYTES = 64 * 1024 * 1024;
 export const WORK_EVIDENCE_DEFAULT_MAX_TOUCHED_PATHS = 4096;

package/mcp-memory-server/dist/work-evidence-store.js

@@ -292,7 +292,7 @@ export async function finishWorkEvidence(projectRoot, evidenceId, exitStatus, op
             provenance: {
                 producer: "cairn-work-evidence",
                 source_event: "launcher-exit",
-                harness: start.harness === "claude" ? "claude-code" : ["opencode", "pi"].includes(start.harness) ? start.harness : undefined,
+                harness: start.harness === "claude" ? "claude-code" : ["opencode", "pi", "omp"].includes(start.harness) ? start.harness : undefined,
             },
             content: { text: patchCapture.text },
         }, { ...artifactLimits, artifactMaxBytes: Math.min(artifactLimits.artifactMaxBytes, limits.patchMaxBytes) });

package/mcp-memory-server/package.json

@@ -69,7 +69,7 @@
         "check:pi-bridge-child": "node scripts/smoke-pi-bridge-child.mjs"
     },
     "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.30.0",
+        "@modelcontextprotocol/sdk": "^1.32.1",
         "agentfs-sdk": "^0.6.4",
         "yaml": "2.9.0",
         "zod": "^4.4.3"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.18.0",
+    "version": "2.19.1",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",
@@ -38,7 +38,7 @@
         "node": ">=22"
     },
     "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.30.0",
+        "@modelcontextprotocol/sdk": "^1.32.1",
         "agentfs-sdk": "^0.6.4",
         "yaml": "2.9.0",
         "zod": "^4.4.3"

package/schemas/artifact.schema.json

@@ -27,7 +27,7 @@
       "properties": {
         "producer": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001f\\u007f]+$" },
         "source_event": { "type": "string", "minLength": 1, "maxLength": 256 },
-        "harness": { "enum": ["claude-code", "opencode", "pi"] },
+        "harness": { "enum": ["claude-code", "opencode", "pi", "omp"] },
         "harness_version": { "type": "string", "minLength": 1, "maxLength": 128 },
         "native_id": { "type": "string", "minLength": 1, "maxLength": 256 }
       }

package/schemas/cairnkeep-setup-policy.schema.json

@@ -16,7 +16,7 @@
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": {"enum": ["claude", "opencode", "pi", "kimi", "qwen", "codex"]}
+          "items": {"enum": ["claude", "opencode", "pi", "omp", "kimi", "qwen", "codex"]}
         },
         "memory": {"enum": ["local", "none"]}
       }
@@ -35,13 +35,13 @@
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": {"enum": ["claude", "opencode", "pi", "kimi", "qwen", "codex"]}
+          "items": {"enum": ["claude", "opencode", "pi", "omp", "kimi", "qwen", "codex"]}
         },
         "required_harnesses": {
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": {"enum": ["claude", "opencode", "pi", "kimi", "qwen", "codex"]}
+          "items": {"enum": ["claude", "opencode", "pi", "omp", "kimi", "qwen", "codex"]}
         },
         "memory": {
           "type": "array",

package/schemas/cairnkeep-setup.schema.json

@@ -14,7 +14,7 @@
       "type": "array",
       "minItems": 1,
       "uniqueItems": true,
-      "items": {"enum": ["claude", "opencode", "pi", "kimi", "qwen", "codex"]}
+      "items": {"enum": ["claude", "opencode", "pi", "omp", "kimi", "qwen", "codex"]}
     },
     "assets": {
       "type": "object",

package/scripts/harness-registry.mjs

@@ -28,6 +28,13 @@ const DEFINITIONS = [
     project_assets: [],
     machine_sync: "cairn sync-pi --apply",
   },
+  {
+    id: "omp",
+    title: "Oh My Pi (OMP)",
+    launcher: { template: "start-omp.sh.template", path: ".ai/start-omp.sh", mode: 0o755 },
+    project_assets: [],
+    machine_sync: "cairn sync-omp --apply",
+  },
   {
     id: "kimi",
     title: "Kimi Code",
@@ -90,9 +97,14 @@ export function requiredHarnessAssetPaths(harnesses, memory = "local") {
 }
 
 export function machineSyncCommand(harnesses) {
-  const commands = harnesses.map(harnessDefinition).map((definition) => definition?.machine_sync).filter(Boolean);
-  if (commands.includes("cairn sync-pi --apply")) return "cairn sync-pi --apply";
-  return commands[0] ?? null;
+  const commands = machineSyncCommands(harnesses);
+  return commands.find((command) => command === "cairn sync-pi --apply") ?? commands[0] ?? null;
+}
+
+export function machineSyncCommands(harnesses) {
+  return Object.freeze([...new Set(
+    harnesses.map(harnessDefinition).map((definition) => definition?.machine_sync).filter(Boolean),
+  )]);
 }
 
 function validateRegistry() {

package/scripts/setup.mjs

@@ -22,7 +22,7 @@ import {
   resolveSetupChoices,
 } from "./setup-core.mjs";
 import { reconcileSetupPlan } from "./setup-reconcile.mjs";
-import { HARNESS_IDS, HARNESS_REGISTRY, machineSyncCommand, requiredHarnessAssetPaths } from "./harness-registry.mjs";
+import { HARNESS_IDS, HARNESS_REGISTRY, machineSyncCommand, machineSyncCommands, requiredHarnessAssetPaths } from "./harness-registry.mjs";
 import { reconcilePlaybookInstructions } from "./playbook-instructions.mjs";
 import { selectManyPrompt, selectOnePrompt, supportsTerminalPrompts } from "./terminal-prompts.mjs";
 
@@ -189,6 +189,7 @@ function setupRecovery(plan) {
 }
 
 function resultFor(plan, reconciliation, platform) {
+  const machineCommands = machineSyncCommands(plan.harnesses);
   const machineCommand = machineSyncCommand(plan.harnesses);
   return Object.freeze({
     schema_version: 1,
@@ -203,7 +204,7 @@ function resultFor(plan, reconciliation, platform) {
     launch_commands: Object.freeze(launchCommands(plan, platform)),
     recovery: Object.freeze(setupRecovery(plan)),
     limitations: Object.freeze(plan.limited ? ["Git integration is disabled; repository-aware features are limited."] : []),
-    machine_sync: Object.freeze({ automatic: false, command: machineCommand }),
+    machine_sync: Object.freeze({ automatic: false, command: machineCommand, commands: machineCommands }),
   });
 }
 
@@ -223,9 +224,13 @@ export function renderSetupResult(result, stream) {
   if (result.harnesses.includes("codex") && result.memory === "local") {
     writeLine(stream, "Codex: review .codex/config.toml and accept the project trust prompt before use");
   }
-  writeLine(stream, result.machine_sync.command
-    ? `Machine sync: ${result.machine_sync.command} (not run automatically)`
-    : "Machine sync: not required for the selected harnesses");
+  if (result.machine_sync.commands.length > 0) {
+    for (const command of result.machine_sync.commands) {
+      writeLine(stream, `Machine sync: ${command} (not run automatically)`);
+    }
+  } else {
+    writeLine(stream, "Machine sync: not required for the selected harnesses");
+  }
 }
 
 function createTarget(target) {

package/scripts/test-bootstrap-untracked.sh

@@ -90,7 +90,7 @@ grep -qxF "/.agentfs/" "$tmp/repo/.git/info/exclude" || fail "missing /.agentfs/
 printf '%s\n' '{"schema_version":1,"capabilities":{"wiki":false},"logging":{"callbacks":true}}' >"$tmp/repo/.ai/capabilities.json"
 chmod 600 "$tmp/repo/.ai/capabilities.json"
 printf '%s\n' '# operator-owned environment' >"$tmp/repo/.ai/env.example"
-asset_paths='.ai/start-claude.sh .ai/start-opencode.sh .ai/start-pi.sh .ai/start-kimi.sh .ai/start-qwen.sh .ai/start-codex.sh .ai/env.example .ai/trajectory-redaction.json .ai/capabilities.json .agentfs/.gitignore .planning/config.json .planning/wiki/index.md .planning/wiki/policy.md .planning/wiki/CONTRADICTIONS.md .planning/wiki/LOG.md .planning/alignment/policy.md .planning/alignment/gap-register.yaml .planning/graphs/policy.md .planning/graphs/.gitignore .planning/security/policy.md'
+asset_paths='.ai/start-claude.sh .ai/start-opencode.sh .ai/start-pi.sh .ai/start-omp.sh .ai/start-kimi.sh .ai/start-qwen.sh .ai/start-codex.sh .ai/env.example .ai/trajectory-redaction.json .ai/capabilities.json .agentfs/.gitignore .planning/config.json .planning/wiki/index.md .planning/wiki/policy.md .planning/wiki/CONTRADICTIONS.md .planning/wiki/LOG.md .planning/alignment/policy.md .planning/alignment/gap-register.yaml .planning/graphs/policy.md .planning/graphs/.gitignore .planning/security/policy.md'
 mkdir -p "$tmp/assets-before"
 for path in $asset_paths; do
   cp "$tmp/repo/$path" "$tmp/assets-before/${path//\//__}"

package/scripts/test-completion.sh

@@ -165,7 +165,7 @@ if [[ "$completion_surface_complete" != true ]]; then
 fi
 
 setup_flags='--git --harness --memory --policy --yes --json'
-setup_values='init existing none claude opencode pi kimi qwen local'
+setup_values='init existing none claude opencode pi omp kimi qwen codex local'
 for shell in bash zsh fish powershell; do
   for flag in $setup_flags; do
     grep -q -- "$flag\|${flag#--}" "$tmp/$shell" || {

package/scripts/test-harness-registry.sh

@@ -25,7 +25,7 @@ for (const path of [
   assert.match(content, /approval/);
 }
 const registry = await import(pathToFileURL(join(root, "scripts", "harness-registry.mjs")).href);
-assert.deepEqual(registry.HARNESS_IDS, ["claude", "opencode", "pi", "kimi", "qwen", "codex"]);
+assert.deepEqual(registry.HARNESS_IDS, ["claude", "opencode", "pi", "omp", "kimi", "qwen", "codex"]);
 assert.equal(new Set(registry.HARNESS_IDS).size, registry.HARNESS_IDS.length);
 for (const id of registry.HARNESS_IDS) {
   const definition = registry.harnessDefinition(id);
@@ -40,6 +40,14 @@ assert.deepEqual(registry.harnessProjectAssets("codex", "local").map(({ path })
 assert.deepEqual(registry.requiredHarnessAssetPaths(["codex"], "local"), [".ai/start-codex.sh"]);
 assert.deepEqual(registry.requiredHarnessAssetPaths(["codex"], "none"), [".ai/start-codex.sh"]);
 assert.equal(registry.machineSyncCommand(["codex"]), null);
+assert.deepEqual(registry.machineSyncCommands(["claude", "opencode", "pi", "omp", "kimi"]), [
+  "cairn sync --apply",
+  "cairn sync-pi --apply",
+  "cairn sync-omp --apply",
+  "cairn sync-kimi --apply",
+]);
+assert.equal(registry.machineSyncCommand(["claude", "pi"]), "cairn sync-pi --apply", "legacy singular machine sync should retain its Pi preference");
+assert.deepEqual(registry.machineSyncCommands(["codex"]), []);
 
 const schema = JSON.parse(readFileSync(join(root, "schemas", "cairnkeep-setup.schema.json"), "utf8"));
 assert.deepEqual(schema.properties.harnesses.items.enum, registry.HARNESS_IDS, "setup schema drifted from harness registry");
@@ -56,6 +64,7 @@ assert.equal(setup.status, 0, setup.stderr);
 const result = JSON.parse(setup.stdout);
 assert.deepEqual(result.harnesses, ["codex"]);
 assert.equal(result.machine_sync.command, null);
+assert.deepEqual(result.machine_sync.commands, []);
 assert.deepEqual(result.launch_commands, [".ai/start-codex.sh"]);
 assert.match(readFileSync(join(target, ".codex", "config.toml"), "utf8"), /\[mcp_servers\.cairn-memory-local\][\s\S]*command = "cairn"[\s\S]*args = \["memory-server"\]/);
 
@@ -73,6 +82,24 @@ const launch = spawnSync(join(target, ".ai", "start-codex.sh"), ["--fixture"], {
 assert.equal(launch.status, 0, launch.stderr);
 assert.deepEqual(launch.stdout.trim().split("\n"), [target, "loaded", "--fixture"]);
 
+const ompTarget = join(sandbox, "omp-project");
+const ompSetup = spawnSync(join(root, "bin", "cairn"), [
+  "setup", ompTarget, "--git", "init", "--harness", "omp", "--memory", "local", "--yes", "--json",
+], { encoding: "utf8", shell: false });
+assert.equal(ompSetup.status, 0, ompSetup.stderr);
+assert.deepEqual(JSON.parse(ompSetup.stdout).harnesses, ["omp"]);
+const fakeOmp = join(fakeBin, "omp");
+writeFileSync(fakeOmp, "#!/bin/sh\nprintf '%s\\n' \"$PWD\" \"${CAIRN_REGISTRY_TEST:-}\" \"$*\"\n");
+chmodSync(fakeOmp, 0o755);
+writeFileSync(join(ompTarget, ".ai", ".env"), "CAIRN_REGISTRY_TEST=omp-loaded\n", { mode: 0o600 });
+const ompLaunch = spawnSync(join(ompTarget, ".ai", "start-omp.sh"), ["--fixture"], {
+  encoding: "utf8",
+  shell: false,
+  env: { ...process.env, PATH: `${fakeBin}:${process.env.PATH}` },
+});
+assert.equal(ompLaunch.status, 0, ompLaunch.stderr);
+assert.deepEqual(ompLaunch.stdout.trim().split("\n"), [ompTarget, "omp-loaded", "--fixture"]);
+
 const noMemory = join(sandbox, "codex-no-memory");
 const noMemorySetup = spawnSync(join(root, "bin", "cairn"), [
   "setup", noMemory, "--git", "init", "--harness", "codex", "--memory", "none", "--yes",

package/scripts/test-setup-output.sh

@@ -68,6 +68,7 @@ assert.equal(result.launch_commands.some((line) => /start-pi\.sh/.test(line)), t
 assert.equal(Array.isArray(result.recovery), true);
 assert.equal(result.machine_sync.automatic, false);
 assert.match(result.machine_sync.command, /^cairn sync(?:-pi)? --(?:check|apply)/);
+assert.deepEqual(result.machine_sync.commands, ["cairn sync --apply", "cairn sync-pi --apply"]);
 NODE
 
 complete_human="$tmp/complete.txt"
@@ -86,7 +87,25 @@ for expected in \
   "Recovery:"; do
   grep -qF "$expected" "$complete_human" || fail "human output missing $expected"
 done
-grep -qE 'cairn sync(-pi)? --(check|apply)' "$complete_human" || fail "human output omitted explicit machine sync direction"
+grep -qF 'Machine sync: cairn sync --apply (not run automatically)' "$complete_human" || fail "human output omitted Claude machine sync"
+grep -qF 'Machine sync: cairn sync-pi --apply (not run automatically)' "$complete_human" || fail "human output omitted Pi machine sync"
+
+omp_json="$tmp/omp.json"
+"$ROOT/bin/cairn" setup "$tmp/omp target" \
+  --git init --harness omp --memory local --yes --json >"$omp_json"
+node --input-type=module - "$omp_json" <<'NODE'
+import assert from "node:assert/strict";
+import fs from "node:fs";
+
+const result = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+assert.deepEqual(result.harnesses, ["omp"]);
+assert.deepEqual(result.launch_commands, [".ai/start-omp.sh"]);
+assert.equal(result.machine_sync.automatic, false);
+assert.equal(result.machine_sync.command, "cairn sync-omp --apply");
+assert.deepEqual(result.machine_sync.commands, ["cairn sync-omp --apply"]);
+NODE
+[[ -x "$tmp/omp target/.ai/start-omp.sh" ]] || fail "OMP launcher missing"
+grep -qF 'cairn evidence run --harness omp -- omp' "$tmp/omp target/.ai/start-omp.sh" || fail "OMP launcher work-evidence integration missing"
 
 limited_json="$tmp/limited.json"
 "$ROOT/bin/cairn" setup "$tmp/limited target" \

package/scripts/test-setup-preflight.mjs

@@ -345,7 +345,7 @@ async function testStructuredSetupSelectors(setup, fixture) {
     "Apply this setup plan?",
   ]);
   const harnessPrompt = selections.find(({ message }) => message === "Coding harnesses");
-  assert.deepEqual(harnessPrompt.choices.map(({ value }) => value), ["claude", "opencode", "pi", "kimi", "qwen", "codex"]);
+  assert.deepEqual(harnessPrompt.choices.map(({ value }) => value), ["claude", "opencode", "pi", "omp", "kimi", "qwen", "codex"]);
   assert.match(harnessPrompt.choices.find(({ value }) => value === "codex").label, /Codex CLI/);
   assertNoManagedPaths(fixture.empty, "cancelled structured setup");
 }

package/scripts/test-work-evidence-cli.sh

@@ -16,7 +16,7 @@ exec node "$ROOT/bin/cairn" "\$@"
 EOF
 chmod +x "$fake_bin/cairn"
 
-for harness in claude opencode pi kimi qwen codex; do
+for harness in claude opencode pi omp kimi qwen codex; do
   project="$tmp/$harness"
   mkdir -p "$project/.ai" "$project/.agentfs"
   cp "$ROOT/templates/start-$harness.sh.template" "$project/.ai/start-$harness.sh"

package/scripts/uninstall.sh

@@ -43,6 +43,7 @@ PROJECT_AI_FILES=(
   start-claude.sh
   start-opencode.sh
   start-pi.sh
+  start-omp.sh
   start-kimi.sh
   start-qwen.sh
   start-codex.sh

package/scripts/verify-dependency-security.mjs

@@ -4,8 +4,14 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
 const ROOT = resolve(process.cwd());
-const MINIMUM_SDK = [1, 30, 0];
+const MINIMUM_SDK = [1, 32, 1];
 const MINIMUM_NODE_SERVER = [2, 0, 5];
+const TRANSITIVE_MINIMUMS = new Map([
+  ["fast-uri", [3, 1, 8]],
+  ["hono", [4, 13, 13]],
+  ["ip-address", [10, 7, 3]],
+  ["proxy-addr", [2, 0, 8]],
+]);
 const DIRECT_HONO_PACKAGES = new Set(["hono", "@hono/node-server"]);
 const PACKAGE_ROOTS = [
   { label: "root", directory: "." },
@@ -110,11 +116,23 @@ function verifyPackageRoot({ label, directory }) {
       `${label} resolved @hono/node-server`,
     );
   }
+
+  for (const [packageName, minimum] of TRANSITIVE_MINIMUMS) {
+    const packages = resolvedPackages(lock, packageName);
+    assert.ok(packages.length > 0, `${label}: resolved ${packageName} is missing`);
+    for (const [path, packageValue] of packages) {
+      assertMinimum(
+        parseVersion(packageValue.version, `${label} ${path}`),
+        minimum,
+        `${label} resolved ${packageName}`,
+      );
+    }
+  }
 }
 
 try {
   PACKAGE_ROOTS.forEach(verifyPackageRoot);
-  process.stdout.write("PASS: dependency manifests and lock graphs use the patched MCP Hono transport\n");
+  process.stdout.write("PASS: dependency manifests and lock graphs exclude known MCP transport advisories\n");
 } catch (error) {
   process.stderr.write(`FAIL: dependency security policy: ${error instanceof Error ? error.message : String(error)}\n`);
   process.exitCode = 1;

package/templates/start-omp.sh.template

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Cairnkeep launcher for oh-my-pi (OMP). Loads this repo's private .ai/.env,
+# runs the optional pre/post seams, and launches OMP from the project root.
+set -euo pipefail
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+
+if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/.env"
+  set +a
+fi
+if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/pre-launch.sh"
+fi
+
+cd "$ROOT_DIR"
+
+case "${CAIRN_WORK_EVIDENCE:-}" in
+  1|true|TRUE|yes|YES|on|ON)
+    if command -v cairn >/dev/null 2>&1 && cairn evidence --help >/dev/null 2>&1; then
+      set +e
+      cairn evidence run --harness omp -- omp "$@"
+      CAIRN_EXIT_STATUS=$?
+      set -e
+      export CAIRN_EXIT_STATUS
+      if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+        # shellcheck disable=SC1091
+        . "$ROOT_DIR/.ai/post-exit.sh" || true
+      fi
+      exit "$CAIRN_EXIT_STATUS"
+    fi
+    echo "cairn: compatible evidence command unavailable; launching without capture" >&2
+    ;;
+esac
+if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+  set +e
+  omp "$@"
+  CAIRN_EXIT_STATUS=$?
+  set -e
+  export CAIRN_EXIT_STATUS
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/post-exit.sh" || true
+  exit "$CAIRN_EXIT_STATUS"
+fi
+exec omp "$@"