@kontextmind/kxm 0.7.15 → 0.7.16

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.15",
+      "version": "0.7.16",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/configuration.md

@@ -199,13 +199,12 @@ When a Pi peer produces more than 32,000 characters, the extension returns a bou
 
 `KXM_AGENT_NAME` and `KXM_PROJECT` are required by `kxm agent worker`. Session isolation is opt-in for upgrade compatibility: pass `--session-isolation workflow` or set the environment variable to `workflow` after reviewing the fresh scoped-session behavior. Both the CLI and direct `scripts/kxm-worker.mjs` default to `off`, so existing shared `--continue` histories are not silently abandoned. The remaining agent settings are inherited by the spawned Pi RPC process. The worker resolves `.kxm` and explicit package paths inside `KXM_WORKDIR`, creates the standard directories, and passes absolute paths to Pi. When either resource-path variable is set, the worker disables discovery for that resource category and loads only the listed files or directories; setting just one category leaves discovery unchanged for the other. Missing paths and extension directories fail before the restart loop. A skill may be a `SKILL.md` file or a directory Pi scans for skills. Restart the worker after changing any resource or path.
 
-Use exact paths for release verification or an uninstalled worktree. Include every provider extension the selected models require because extension discovery is isolated:
+Use exact paths for release verification or an uninstalled worktree. The antigravity provider is bundled inside `plugins/kxm` (vendored from pi-antigravity, MIT) — do NOT also load a standalone pi-antigravity extension; the bundled registration warns fail-loud on the duplicate. Include every other provider extension the selected models require because extension discovery is isolated:
 
 ```powershell
 $separator = [IO.Path]::PathSeparator
 $env:KXM_WORKER_EXTENSION_PATHS = @(
   "plugins/kxm/src/extension.ts"
-  "$env:USERPROFILE/.pi/agent/npm/node_modules/pi-antigravity/src/index.ts"
 ) -join $separator
 $env:KXM_WORKER_SKILL_PATHS = "plugins/kxm/skills/kxm"
 $coordinatorTools = @(

package/docs/operator-pi-packages.md

@@ -40,8 +40,11 @@ commands for RTK independently of `rtk.ts`.
 
 ## Notes
 
-- `pi-antigravity` and `@tian.zuo/pi-antigravity` are different Pi providers.
-  They do not replace the native `agy` harness used by the assignment runner.
+- The antigravity provider is bundled inside `plugins/kxm` (vendored from
+  pi-antigravity, MIT); remove any standalone pi-antigravity Pi extension to
+  avoid the double-registration warning. `pi-antigravity` and
+  `@tian.zuo/pi-antigravity` are different Pi providers. They do not replace
+  the native `agy` harness used by the assignment runner.
 - For KXM development loads, prefer the working tree:
   `pi --no-extensions -e ./plugins/kxm/src/extension.ts`. Add every required
   provider extension with another `-e`; otherwise Pi discovery is disabled.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.15",
+  "version": "0.7.16",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.15",
+  "version": "0.7.16",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -25694,6 +25694,10 @@ var SECRET_PATTERNS = [
   /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi,
   /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/gi,
+  /\bya29\.[A-Za-z0-9._~+/-]+=*/g,
+  /\b1\/\/[A-Za-z0-9_-]+/g,
+  /\b1\/[A-Za-z0-9_-]{20,}/g,
+  /("?(?:access_token|refresh_token|id_token)"?\s*[:=]\s*")[^"]*(")/gi,
   /\bKXM_[A-Z0-9_]*(TOKEN|SECRET|KEY)[A-Z0-9_]*=\S+/gi,
   /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET)=\S+/gi,
   /\b[A-Fa-f0-9]{64}\b/g

package/plugins/kxm/dist/core.js

@@ -832,6 +832,10 @@ var SECRET_PATTERNS = [
   /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi,
   /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/gi,
+  /\bya29\.[A-Za-z0-9._~+/-]+=*/g,
+  /\b1\/\/[A-Za-z0-9_-]+/g,
+  /\b1\/[A-Za-z0-9_-]{20,}/g,
+  /("?(?:access_token|refresh_token|id_token)"?\s*[:=]\s*")[^"]*(")/gi,
   /\bKXM_[A-Z0-9_]*(TOKEN|SECRET|KEY)[A-Z0-9_]*=\S+/gi,
   /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET)=\S+/gi,
   /\b[A-Fa-f0-9]{64}\b/g