@kontextmind/kxm 0.7.16 → 0.7.18

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.16",
+      "version": "0.7.18",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/README.md

@@ -9,7 +9,7 @@ This documentation is organized by task. Start with the guide that matches what
 | [Configuration](configuration.md) | Users and operators | Understand every supported setting and default |
 | [Architecture](architecture.md) | Maintainers and integrators | Learn the component boundaries and message lifecycle |
 | [Agent Skills](agent-skills.md) | Users and integrators | Comprehensive skill suite covering all KXM commands with progressive disclosure |
-| [Browser automation](browser-automation.md) | Developers and operators | Self-hosted Steel on DOKS, agent-browser, Playwright, pass-cli, and human takeover |
+| [Browser automation](browser-automation.md) | Developers and operators | Self-hosted Steel on DOKS, agent-browser, Playwright, pass-cli, and human takeover. See the [knowledge base](browser-automation.md#knowledge-base) and [prompt templates](browser-automation.md#prompt-templates) |
 | [Skills](skills.md) | Operators and skill authors | Governed candidate lifecycle; also the [repository work delivery](skills/repo-work-delivery.md) skill |
 | [Operations](operations.md) | Hub operators | Run, monitor, secure, and recover the service |
 | [Troubleshooting](troubleshooting.md) | Everyone | Diagnose common installation and delivery failures |

package/docs/browser-automation.md

@@ -7,7 +7,7 @@ project: "kxm"
 status: "accepted"
 owner: "@operator"
 created: "2026-09-14"
-updated: "2026-09-14"
+updated: "2026-09-15"
 authority: "instruction"
 confidence: "verified"
 summary: "Comprehensive guide to browser automation in KXM using self-hosted Steel on DOKS, agent-browser, Playwright, pass-cli, and human takeover."
@@ -114,3 +114,26 @@ When authentication challenges (MFA, CAPTCHA, SSO) are encountered:
 - **Session Timeouts**: Default 300s (5m), max 1800s (30m). Sessions terminate automatically on expiry.
 - **Orphan Sweeping**: Periodically sweep untracked sessions via `GET /v1/sessions` and release idle processes.
 - **Memory Protection**: Kubernetes mounts a 2Gi `emptyDir` memory volume at `/dev/shm` to prevent Chromium tab crashes without exhausting node memory.
+
+---
+
+## Knowledge base
+
+- [How are credentials retrieved without exposing them to the model?](kb/how-credentials-retrieved-safely.md)
+- [How do I capture a UI section and annotate changes for an agent?](kb/how-to-capture-and-annotate-section.md)
+- [How do I connect Playwright to the existing Steel session?](kb/how-to-connect-playwright-to-steel.md)
+- [How do I recover an expired session or remove an orphaned browser?](kb/how-to-recover-expired-session-or-orphan.md)
+- [How does an agent resume after MFA?](kb/how-to-resume-after-mfa.md)
+- [How do I take over a browser session to log in?](kb/how-to-take-over-session.md)
+- [Why did authentication disappear?](kb/why-authentication-disappeared.md)
+- [Why did automation open a different browser?](kb/why-automation-opened-different-browser.md)
+- [Why can I view a session but not control it?](kb/why-session-viewer-cannot-control.md)
+
+## Prompt templates
+
+- [Starting browser work](prompts/browser-start.md)
+- [Exploring an application](prompts/browser-explore.md)
+- [Requesting human takeover](prompts/browser-takeover.md)
+- [Diagnosing and recovering a failed session](prompts/browser-diagnose-recover.md)
+- [Reproducing a UI bug and writing a Playwright test](prompts/browser-repro-fix.md)
+- [Capturing UI section annotations](prompts/browser-annotate-feedback.md)

package/docs/prompts/browser-annotate-feedback.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-006"
+type: "prompt"
+title: "Capturing UI Section Annotations and Sending Changes to Agent"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Turn annotated Steel UI-section feedback into source changes and recapture verified proof."
+tags: ["browser", "annotation", "feedback", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-capture-and-annotate-section.md"]
+---
+
 # Task Template: Capturing UI Section Annotations and Sending Changes to Agent
 
 ## Purpose

package/docs/prompts/browser-diagnose-recover.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-004"
+type: "prompt"
+title: "Diagnosing and Recovering a Failed Browser Session"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Troubleshoot unresponsive Steel sessions, CDP attachment errors, auth loops, and orphaned browser containers."
+tags: ["browser", "diagnostics", "recovery", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-recover-expired-session-or-orphan.md"]
+---
+
 # Task Template: Diagnosing and Recovering a Failed Browser Session
 
 ## Purpose

package/docs/prompts/browser-explore.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-002"
+type: "prompt"
+title: "Exploring an Application with an Authenticated Session"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Exploratory discovery, DOM mapping, and journey inspection via agent-browser attached to a remote Steel session."
+tags: ["browser", "explore", "agent-browser", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-connect-playwright-to-steel.md"]
+---
+
 # Task Template: Exploring an Application with an Authenticated Session
 
 ## Purpose

package/docs/prompts/browser-repro-fix.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-005"
+type: "prompt"
+title: "Reproducing a UI Bug and Producing a Playwright Regression Test"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Reproduce a UI defect on Steel, collect evidence, write a Playwright regression, and prove RED then GREEN."
+tags: ["browser", "playwright", "repro", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-connect-playwright-to-steel.md"]
+---
+
 # Task Template: Reproducing a UI Bug and Producing a Playwright Regression Test
 
 ## Purpose

package/docs/prompts/browser-start.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-001"
+type: "prompt"
+title: "Starting Browser Work in a KXM Project"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Initialize a remote Steel browser session for a project task, verifying credentials, connectivity, and attachment endpoints before automation."
+tags: ["browser", "steel", "session", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-credentials-retrieved-safely.md"]
+---
+
 # Task Template: Starting Browser Work in a KXM Project
 
 ## Purpose

package/docs/prompts/browser-takeover.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "PROMPT-BROWSER-003"
+type: "prompt"
+title: "Requesting Human Authentication and Resuming Afterward"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-14"
+updated: "2026-09-15"
+authority: "instruction"
+confidence: "verified"
+summary: "Pause automation for MFA, OAuth, or CAPTCHA takeover, then resume after verified human success."
+tags: ["browser", "takeover", "mfa", "prompt"]
+related: ["docs/browser-automation.md", "docs/kb/how-to-take-over-session.md", "docs/kb/how-to-resume-after-mfa.md"]
+---
+
 # Task Template: Requesting Human Authentication and Resuming Afterward
 
 ## Purpose

package/docs/templates/README.md

@@ -40,7 +40,7 @@ This directory contains standardized Markdown documentation templates adapted fo
 
 ## Workflow Guide Integration Matrix
 
-The 12 templates map directly across the 7 Areas and 22 Workflows in [`docs/workflow-guide.md`](../workflow-guide.md):
+The 11 templates map directly across the 7 Areas and 22 Workflows in [`docs/workflow-guide.md`](../workflow-guide.md):
 
 ```mermaid
 flowchart TD

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.16",
+  "version": "0.7.18",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",
@@ -69,6 +69,12 @@
       "./plugins/kxm/skills"
     ]
   },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "0.2.141",
+    "@earendil-works/pi-tui": "0.85.1",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "yaml": "^2.9.0"
+  },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*",
     "typebox": "*"
@@ -120,9 +126,5 @@
     "LICENSE",
     "SECURITY.md"
   ],
-  "license": "MIT",
-  "dependencies": {
-    "@earendil-works/pi-tui": "0.85.1",
-    "yaml": "^2.9.0"
-  }
+  "license": "MIT"
 }

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.16",
+  "version": "0.7.18",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -8072,36 +8072,38 @@ var require_Alias = __commonJS({
           if (node.anchor === this.source)
             found = node;
         }
+        if (found && ctx) {
+          const { anchors: anchors2, doc: doc2, maxAliasCount } = ctx;
+          let data = anchors2.get(found);
+          if (!data) {
+            toJS.toJS(found, null, ctx);
+            data = anchors2.get(found);
+          }
+          if (data?.res === void 0) {
+            const msg = "This should not happen: Alias anchor was not resolved?";
+            throw new ReferenceError(msg);
+          }
+          if (maxAliasCount >= 0) {
+            data.count += 1;
+            if (data.aliasCount === 0)
+              data.aliasCount = getAliasCount(doc2, found, anchors2);
+            if (data.count * data.aliasCount > maxAliasCount) {
+              const msg = "Excessive alias count indicates a resource exhaustion attack";
+              throw new ReferenceError(msg);
+            }
+          }
+        }
         return found;
       }
       toJSON(_arg, ctx) {
         if (!ctx)
           return { source: this.source };
-        const { anchors: anchors2, doc, maxAliasCount } = ctx;
-        const source = this.resolve(doc, ctx);
+        const source = this.resolve(ctx.doc, ctx);
         if (!source) {
           const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
           throw new ReferenceError(msg);
         }
-        let data = anchors2.get(source);
-        if (!data) {
-          toJS.toJS(source, null, ctx);
-          data = anchors2.get(source);
-        }
-        if (data?.res === void 0) {
-          const msg = "This should not happen: Alias anchor was not resolved?";
-          throw new ReferenceError(msg);
-        }
-        if (maxAliasCount >= 0) {
-          data.count += 1;
-          if (data.aliasCount === 0)
-            data.aliasCount = getAliasCount(doc, source, anchors2);
-          if (data.count * data.aliasCount > maxAliasCount) {
-            const msg = "Excessive alias count indicates a resource exhaustion attack";
-            throw new ReferenceError(msg);
-          }
-        }
-        return data.res;
+        return ctx.anchors.get(source).res;
       }
       toString(ctx, _onComment, _onChompKeep) {
         const src = `*${this.source}`;
@@ -12103,37 +12105,38 @@ var require_resolve_flow_scalar = __commonJS({
       }
       if (badChar)
         onError(0, "BAD_SCALAR_START", `Plain value cannot start with ${badChar}`);
-      return foldLines(source);
+      return unfoldLines(source);
     }
     function singleQuotedValue(source, onError) {
       if (source[source.length - 1] !== "'" || source.length === 1)
         onError(source.length, "MISSING_CHAR", "Missing closing 'quote");
-      return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+      return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
     }
-    function foldLines(source) {
-      let first, line;
+    function unfoldLines(source) {
+      const line = /(.*?)\r?\n/sy;
+      let match = line.exec(source);
+      if (!match)
+        return source;
+      let trimEnd, trimBoth;
       try {
-        first = new RegExp("(.*?)(?<![ 	])[ 	]*\r?\n", "sy");
-        line = new RegExp("[ 	]*(.*?)(?:(?<![ 	])[ 	]*)?\r?\n", "sy");
+        trimEnd = new RegExp("(?<![ 	])[ 	]+$");
+        trimBoth = new RegExp("^[ 	]+|(?<![ 	])[ 	]+$", "g");
       } catch {
-        first = /(.*?)[ \t]*\r?\n/sy;
-        line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+        trimEnd = /[ \t]+$/;
+        trimBoth = /^[ \t]+|[ \t]+$/g;
       }
-      let match = first.exec(source);
-      if (!match)
-        return source;
-      let res = match[1];
+      let res = match[1].replace(trimEnd, "");
       let sep4 = " ";
-      let pos = first.lastIndex;
-      line.lastIndex = pos;
+      let pos = line.lastIndex;
       while (match = line.exec(source)) {
-        if (match[1] === "") {
+        const lm = match[1].replace(trimBoth, "");
+        if (lm === "") {
           if (sep4 === "\n")
             res += sep4;
           else
             sep4 = "\n";
         } else {
-          res += sep4 + match[1];
+          res += sep4 + lm;
           sep4 = " ";
         }
         pos = line.lastIndex;
@@ -25690,6 +25693,7 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 // plugins/kxm/src/redact.ts
 var SECRET_PATTERNS = [
   /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+  /\bsk-ant-[A-Za-z0-9_-]{8,}\b/g,
   /\bghp_[A-Za-z0-9_]{20,}\b/g,
   /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi,
@@ -25697,9 +25701,9 @@ var SECRET_PATTERNS = [
   /\bya29\.[A-Za-z0-9._~+/-]+=*/g,
   /\b1\/\/[A-Za-z0-9_-]+/g,
   /\b1\/[A-Za-z0-9_-]{20,}/g,
-  /("?(?:access_token|refresh_token|id_token)"?\s*[:=]\s*")[^"]*(")/gi,
+  /("?(?:access_token|refresh_token|id_token|sessionKey|session_key|claude_oauth_token|anthropicApiKey)"?\s*[:=]\s*")[^"]*(")/gi,
   /\bKXM_[A-Z0-9_]*(TOKEN|SECRET|KEY)[A-Z0-9_]*=\S+/gi,
-  /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET)=\S+/gi,
+  /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CLAUDE_API_KEY)=\S+/gi,
   /\b[A-Fa-f0-9]{64}\b/g
 ];
 function redactSecrets(value) {

package/plugins/kxm/dist/core.js

@@ -828,6 +828,7 @@ function workerResult(worker, payload) {
 // plugins/kxm/src/redact.ts
 var SECRET_PATTERNS = [
   /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+  /\bsk-ant-[A-Za-z0-9_-]{8,}\b/g,
   /\bghp_[A-Za-z0-9_]{20,}\b/g,
   /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi,
@@ -835,9 +836,9 @@ var SECRET_PATTERNS = [
   /\bya29\.[A-Za-z0-9._~+/-]+=*/g,
   /\b1\/\/[A-Za-z0-9_-]+/g,
   /\b1\/[A-Za-z0-9_-]{20,}/g,
-  /("?(?:access_token|refresh_token|id_token)"?\s*[:=]\s*")[^"]*(")/gi,
+  /("?(?:access_token|refresh_token|id_token|sessionKey|session_key|claude_oauth_token|anthropicApiKey)"?\s*[:=]\s*")[^"]*(")/gi,
   /\bKXM_[A-Z0-9_]*(TOKEN|SECRET|KEY)[A-Z0-9_]*=\S+/gi,
-  /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET)=\S+/gi,
+  /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CLAUDE_API_KEY)=\S+/gi,
   /\b[A-Fa-f0-9]{64}\b/g
 ];
 function redactSecrets(value) {