@kontextmind/kxm 0.7.15 → 0.7.17

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.15",
+      "version": "0.7.17",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/README.md

@@ -9,7 +9,7 @@ This documentation is organized by task. Start with the guide that matches what
 | [Configuration](configuration.md) | Users and operators | Understand every supported setting and default |
 | [Architecture](architecture.md) | Maintainers and integrators | Learn the component boundaries and message lifecycle |
 | [Agent Skills](agent-skills.md) | Users and integrators | Comprehensive skill suite covering all KXM commands with progressive disclosure |
-| [Browser automation](browser-automation.md) | Developers and operators | Self-hosted Steel on DOKS, agent-browser, Playwright, pass-cli, and human takeover |
+| [Browser automation](browser-automation.md) | Developers and operators | Self-hosted Steel on DOKS, agent-browser, Playwright, pass-cli, and human takeover. See the [knowledge base](browser-automation.md#knowledge-base) and [prompt templates](browser-automation.md#prompt-templates) |
 | [Skills](skills.md) | Operators and skill authors | Governed candidate lifecycle; also the [repository work delivery](skills/repo-work-delivery.md) skill |
 | [Operations](operations.md) | Hub operators | Run, monitor, secure, and recover the service |
 | [Troubleshooting](troubleshooting.md) | Everyone | Diagnose common installation and delivery failures |

package/docs/browser-automation.md

@@ -7,7 +7,7 @@ project: "kxm"
 status: "accepted"
 owner: "@operator"
 created: "2026-09-14"
-updated: "2026-09-14"
+updated: "2026-09-15"
 authority: "instruction"
 confidence: "verified"
 summary: "Comprehensive guide to browser automation in KXM using self-hosted Steel on DOKS, agent-browser, Playwright, pass-cli, and human takeover."
@@ -114,3 +114,26 @@ When authentication challenges (MFA, CAPTCHA, SSO) are encountered:
 - **Session Timeouts**: Default 300s (5m), max 1800s (30m). Sessions terminate automatically on expiry.
 - **Orphan Sweeping**: Periodically sweep untracked sessions via `GET /v1/sessions` and release idle processes.
 - **Memory Protection**: Kubernetes mounts a 2Gi `emptyDir` memory volume at `/dev/shm` to prevent Chromium tab crashes without exhausting node memory.
+
+---
+
+## Knowledge base
+
+- [How are credentials retrieved without exposing them to the model?](kb/how-credentials-retrieved-safely.md)
+- [How do I capture a UI section and annotate changes for an agent?](kb/how-to-capture-and-annotate-section.md)
+- [How do I connect Playwright to the existing Steel session?](kb/how-to-connect-playwright-to-steel.md)
+- [How do I recover an expired session or remove an orphaned browser?](kb/how-to-recover-expired-session-or-orphan.md)
+- [How does an agent resume after MFA?](kb/how-to-resume-after-mfa.md)
+- [How do I take over a browser session to log in?](kb/how-to-take-over-session.md)
+- [Why did authentication disappear?](kb/why-authentication-disappeared.md)
+- [Why did automation open a different browser?](kb/why-automation-opened-different-browser.md)
+- [Why can I view a session but not control it?](kb/why-session-viewer-cannot-control.md)
+
+## Prompt templates
+
+- [Starting browser work](prompts/browser-start.md)
+- [Exploring an application](prompts/browser-explore.md)
+- [Requesting human takeover](prompts/browser-takeover.md)
+- [Diagnosing and recovering a failed session](prompts/browser-diagnose-recover.md)
+- [Reproducing a UI bug and writing a Playwright test](prompts/browser-repro-fix.md)
+- [Capturing UI section annotations](prompts/browser-annotate-feedback.md)

package/docs/configuration.md

@@ -199,13 +199,12 @@ When a Pi peer produces more than 32,000 characters, the extension returns a bou
 
 `KXM_AGENT_NAME` and `KXM_PROJECT` are required by `kxm agent worker`. Session isolation is opt-in for upgrade compatibility: pass `--session-isolation workflow` or set the environment variable to `workflow` after reviewing the fresh scoped-session behavior. Both the CLI and direct `scripts/kxm-worker.mjs` default to `off`, so existing shared `--continue` histories are not silently abandoned. The remaining agent settings are inherited by the spawned Pi RPC process. The worker resolves `.kxm` and explicit package paths inside `KXM_WORKDIR`, creates the standard directories, and passes absolute paths to Pi. When either resource-path variable is set, the worker disables discovery for that resource category and loads only the listed files or directories; setting just one category leaves discovery unchanged for the other. Missing paths and extension directories fail before the restart loop. A skill may be a `SKILL.md` file or a directory Pi scans for skills. Restart the worker after changing any resource or path.
 
-Use exact paths for release verification or an uninstalled worktree. Include every provider extension the selected models require because extension discovery is isolated:
+Use exact paths for release verification or an uninstalled worktree. The antigravity provider is bundled inside `plugins/kxm` (vendored from pi-antigravity, MIT) — do NOT also load a standalone pi-antigravity extension; the bundled registration warns fail-loud on the duplicate. Include every other provider extension the selected models require because extension discovery is isolated:
 
 ```powershell
 $separator = [IO.Path]::PathSeparator
 $env:KXM_WORKER_EXTENSION_PATHS = @(
   "plugins/kxm/src/extension.ts"
-  "$env:USERPROFILE/.pi/agent/npm/node_modules/pi-antigravity/src/index.ts"
 ) -join $separator
 $env:KXM_WORKER_SKILL_PATHS = "plugins/kxm/skills/kxm"
 $coordinatorTools = @(

package/docs/operator-pi-packages.md

@@ -40,8 +40,11 @@ commands for RTK independently of `rtk.ts`.
 
 ## Notes
 
-- `pi-antigravity` and `@tian.zuo/pi-antigravity` are different Pi providers.
-  They do not replace the native `agy` harness used by the assignment runner.
+- The antigravity provider is bundled inside `plugins/kxm` (vendored from
+  pi-antigravity, MIT); remove any standalone pi-antigravity Pi extension to
+  avoid the double-registration warning. `pi-antigravity` and
+  `@tian.zuo/pi-antigravity` are different Pi providers. They do not replace
+  the native `agy` harness used by the assignment runner.
 - For KXM development loads, prefer the working tree:
   `pi --no-extensions -e ./plugins/kxm/src/extension.ts`. Add every required
   provider extension with another `-e`; otherwise Pi discovery is disabled.

package/docs/prompts/browser-annotate-feedback.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-006"
+type: "prompt"
+title: "Capturing UI Section Annotations and Sending Changes to Agent"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Turn annotated Steel UI-section feedback into source changes and recapture verified proof."
+tags: ["browser", "annotation", "feedback", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-capture-and-annotate-section.md"]
+---
+
 # Task Template: Capturing UI Section Annotations and Sending Changes to Agent
 
 ## Purpose

package/docs/prompts/browser-diagnose-recover.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-004"
+type: "prompt"
+title: "Diagnosing and Recovering a Failed Browser Session"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Troubleshoot unresponsive Steel sessions, CDP attachment errors, auth loops, and orphaned browser containers."
+tags: ["browser", "diagnostics", "recovery", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-recover-expired-session-or-orphan.md"]
+---
+
 # Task Template: Diagnosing and Recovering a Failed Browser Session
 
 ## Purpose

package/docs/prompts/browser-explore.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-002"
+type: "prompt"
+title: "Exploring an Application with an Authenticated Session"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Exploratory discovery, DOM mapping, and journey inspection via agent-browser attached to a remote Steel session."
+tags: ["browser", "explore", "agent-browser", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-connect-playwright-to-steel.md"]
+---
+
 # Task Template: Exploring an Application with an Authenticated Session
 
 ## Purpose

package/docs/prompts/browser-repro-fix.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-005"
+type: "prompt"
+title: "Reproducing a UI Bug and Producing a Playwright Regression Test"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Reproduce a UI defect on Steel, collect evidence, write a Playwright regression, and prove RED then GREEN."
+tags: ["browser", "playwright", "repro", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-connect-playwright-to-steel.md"]
+---
+
 # Task Template: Reproducing a UI Bug and Producing a Playwright Regression Test
 
 ## Purpose

package/docs/prompts/browser-start.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-001"
+type: "prompt"
+title: "Starting Browser Work in a KXM Project"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Initialize a remote Steel browser session for a project task, verifying credentials, connectivity, and attachment endpoints before automation."
+tags: ["browser", "steel", "session", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-credentials-retrieved-safely.md"]
+---
+
 # Task Template: Starting Browser Work in a KXM Project
 
 ## Purpose

package/docs/prompts/browser-takeover.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-003"
+type: "prompt"
+title: "Requesting Human Authentication and Resuming Afterward"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Pause automation for MFA, OAuth, or CAPTCHA takeover, then resume after verified human success."
+tags: ["browser", "takeover", "mfa", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-take-over-session.md", "docs/kb/how-to-resume-after-mfa.md"]
+---
+
 # Task Template: Requesting Human Authentication and Resuming Afterward
 
 ## Purpose

package/docs/templates/README.md

@@ -40,7 +40,7 @@ This directory contains standardized Markdown documentation templates adapted fo
 
 ## Workflow Guide Integration Matrix
 
-The 12 templates map directly across the 7 Areas and 22 Workflows in [`docs/workflow-guide.md`](../workflow-guide.md):
+The 11 templates map directly across the 7 Areas and 22 Workflows in [`docs/workflow-guide.md`](../workflow-guide.md):
 
 ```mermaid
 flowchart TD

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.15",
+  "version": "0.7.17",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.15",
+  "version": "0.7.17",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -25694,6 +25694,10 @@ var SECRET_PATTERNS = [
   /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi,
   /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/gi,
+  /\bya29\.[A-Za-z0-9._~+/-]+=*/g,
+  /\b1\/\/[A-Za-z0-9_-]+/g,
+  /\b1\/[A-Za-z0-9_-]{20,}/g,
+  /("?(?:access_token|refresh_token|id_token)"?\s*[:=]\s*")[^"]*(")/gi,
   /\bKXM_[A-Z0-9_]*(TOKEN|SECRET|KEY)[A-Z0-9_]*=\S+/gi,
   /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET)=\S+/gi,
   /\b[A-Fa-f0-9]{64}\b/g

package/plugins/kxm/dist/core.js

@@ -832,6 +832,10 @@ var SECRET_PATTERNS = [
   /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi,
   /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/gi,
+  /\bya29\.[A-Za-z0-9._~+/-]+=*/g,
+  /\b1\/\/[A-Za-z0-9_-]+/g,
+  /\b1\/[A-Za-z0-9_-]{20,}/g,
+  /("?(?:access_token|refresh_token|id_token)"?\s*[:=]\s*")[^"]*(")/gi,
   /\bKXM_[A-Z0-9_]*(TOKEN|SECRET|KEY)[A-Z0-9_]*=\S+/gi,
   /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET)=\S+/gi,
   /\b[A-Fa-f0-9]{64}\b/g