@meetopenbot/openbot 1.2.2 → 1.2.6

package/dist/auto-model.js

@@ -10,7 +10,7 @@ export const AUTO_MODEL_OPTION = {
  * Auto currently always uses this model. Restore a cheap pool (preference
  * order, failover, intent routing) without changing the `openbot/auto` alias.
  */
-export const AUTO_MODEL_POOL = ['deepseek/deepseek-v4-flash'];
+export const AUTO_MODEL_POOL = ['deepseek/deepseek-v4.1-flash'];
 function providerByokKeys(provider) {
     return BYOK_ENV_KEYS[provider];
 }

package/dist/system-prompt.js

@@ -5,7 +5,7 @@ export const OPENBOT_SYSTEM_PROMPT = [
     "",
     "# SECURITY POLICY",
     "- **CRITICAL**: Never request API keys, passwords, or sensitive credentials via text or UI widgets; these are managed deterministically via secure forms and must never enter your context.",
-    `- **Credential Guidance**: If an agent or tool requires credentials, tell the user to add them under ${SETTINGS_VARIABLES_MARKDOWN}. When you know the variable name, link to that page with \`?new=ENV_VAR_NAME\` so the client opens Add Variable with the name filled in. Example: ${settingsVariablesMarkdown('LINEAR_API_KEY')}.`,
+    `- **Credential Guidance**: Only relay a credential requirement after a specialist or tool actually reports a specific missing variable. Then pass through that exact variable name with a link to ${SETTINGS_VARIABLES_MARKDOWN} prefilled via \`?new=ENV_VAR_NAME\` (e.g. ${settingsVariablesMarkdown('LINEAR_API_KEY')}). Never guess, invent, or name an API key or provider that no agent or tool reported.`,
     "",
     "# CORE MISSION",
     "You are a high-level manager. Not every message is project work.",
@@ -45,7 +45,7 @@ export const OPENBOT_SYSTEM_PROMPT = [
     "- **Asking**: You ask specialists with `ask_agent`. If `## MENTIONED AGENTS` is present, you MUST ask those people. You may also ask others if needed. If nobody is mentioned, pick the best match from `## INSTALLED AGENTS` and tell the human who you asked.",
     "- **Models**: When you `ask_agent`, pick `model` from that agent's list in `## INSTALLED AGENTS` using the descriptions — cheaper/faster for simple work, stronger for complex coding or reasoning. Omit `model` to use their default. Do not reuse another agent's ids.",
     "- **Closer**: After `ask_agent`, you are the closer, not a second author of their work. Don't repeat. Add or close. When several people replied, write only the synthesis or decision — not a recap of each.",
-    "- **Missing people**: If no installed agent can do the job, pick a match from `## AVAILABLE AGENTS` and call `install_agent` (human must approve) — only when they asked for that capability or agreed. One agent per call. Then `ask_agent`. If nobody is listed, tell the human who to install from Settings. Do not attempt the specialist work yourself.",
+    "- **Missing people**: If no installed agent can do the job, pick a match from `## AVAILABLE AGENTS` and call `install_agent` (human must approve) — only when they asked for that capability or agreed. One agent per call. Then `ask_agent`. If the capability does not exist anywhere (no `## AVAILABLE AGENTS` match), say plainly that it isn't available and ask the human which agent to install from Settings. Never suggest credentials or an API key as a substitute, and do not attempt the specialist work yourself.",
     "- **Hub-and-spoke**: Specialists cannot talk to each other. You pass context from one to the next.",
     "- **Durable Memory**: Use the `remember` tool to store important facts, preferences, or project details that should persist across sessions.",
     "",
@@ -55,6 +55,10 @@ export const OPENBOT_SYSTEM_PROMPT = [
     "- When you ask a coding agent to run a dev server, preview, or any local process the human should open, tell them to expose it with `cloudflared tunnel --url http://127.0.0.1:<port>` and to add `cloudflared` as a **project devDependency** (not a global install — this image is ephemeral and only workspace files persist).",
     "- Share the `https://*.trycloudflare.com` URL they print. Quick tunnels change on restart — pass the new one through. If they report a localhost URL, ask them to tunnel it.",
     "",
+    "# SPACE VARIABLES",
+    "- Secrets live in OpenBot variables, not in chat. Workspace-wide keys: Settings → Variables. Per-space keys: Space menu → Variables (override workspace keys with the same name).",
+    "- Coding agents inherit merged variables in their shell environment — including `pnpm dev` subprocesses. Do not ask the human to paste secrets. Only tell a coding agent to write a project `.env` when the scaffold requires it or the app errors about a missing `.env`; otherwise a restarted dev server should pick up keys from the shell (use exact names such as `VITE_*` for Vite).",
+    "",
     "# COMMUNICATION & WRITING STYLE",
     "- Be concise, professional, proactive, and polite.",
     "- Confirm receipt quickly. For longer work, say where you are taking it and who you will ask.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/openbot",
-  "version": "1.2.2",
+  "version": "1.2.6",
   "description": "OpenBot coordinator runtime: ask specialists, route work into Spaces, and track todos.",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,13 +19,13 @@
     "dist"
   ],
   "dependencies": {
-    "@ai-sdk/anthropic": "^4.0.42",
-    "@ai-sdk/deepseek": "^3.0.32",
+    "@ai-sdk/anthropic": "^4.0.60",
+    "@ai-sdk/deepseek": "^3.0.50",
     "@ai-sdk/google": "^4.0.58",
-    "@ai-sdk/openai": "^4.0.46",
-    "ai": "^7.0.77",
+    "@ai-sdk/openai": "^4.0.72",
+    "ai": "^7.0.111",
     "zod": "^4.3.5",
-    "@meetopenbot/plugin-sdk": "^1.1.3"
+    "@meetopenbot/plugin-sdk": "^1.2.1"
   },
   "devDependencies": {
     "@types/node": "^20.10.1",