@omercnet/paseo-omp 0.2.1 → 0.3.0-next.100.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.3.0](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.1...paseo-omp-v0.3.0) (2026-09-18)
+
+
+### Features
+
+* **paseo-omp:** add first-class MCP management ([#64](https://github.com/omercnet/paseo-plugins/issues/64)) ([5a8fefa](https://github.com/omercnet/paseo-plugins/commit/5a8fefa9148e8d01f0461aa4a90619ec6ae2c2fa))
+* **paseo-omp:** add workspace-scoped OMP management ([#59](https://github.com/omercnet/paseo-plugins/issues/59)) ([2807aec](https://github.com/omercnet/paseo-plugins/commit/2807aec6217ed2d52f8b4666f0a41a688109f8f5))
+* **paseo-omp:** make composer pills configurable ([#76](https://github.com/omercnet/paseo-plugins/issues/76)) ([28e7501](https://github.com/omercnet/paseo-plugins/commit/28e75011a06a11cdc963187aa4106dfc21d561e6))
+* **release:** publish plugins to npm ([#80](https://github.com/omercnet/paseo-plugins/issues/80)) ([3c93048](https://github.com/omercnet/paseo-plugins/commit/3c93048cfefda97d8c2bc1631e3428fb64bdad09))
+
+
+### Bug Fixes
+
+* **paseo-omp:** advertise nested subsession capability ([#62](https://github.com/omercnet/paseo-plugins/issues/62)) ([fcb4e82](https://github.com/omercnet/paseo-plugins/commit/fcb4e8243e9559d70f26ac6945e2f3c0bf05d575))
+* **paseo-omp:** bound model catalogs and retain safe failure diagnostics ([#73](https://github.com/omercnet/paseo-plugins/issues/73)) ([e70afb7](https://github.com/omercnet/paseo-plugins/commit/e70afb72be782446e7ff585bad40940c7231bdc5))
+* **paseo-omp:** correlate terminal events by request ([#81](https://github.com/omercnet/paseo-plugins/issues/81)) ([41f756e](https://github.com/omercnet/paseo-plugins/commit/41f756e9bebf5cbc275e5cbd3657c37d45a18997))
+* **paseo-omp:** fail closed on unowned later-turn terminal events ([#69](https://github.com/omercnet/paseo-plugins/issues/69)) ([072cd09](https://github.com/omercnet/paseo-plugins/commit/072cd09e38e450376bcd3f4c7b5eae9a670b56b5))
+* **paseo-omp:** preserve prompt scheduling error fidelity ([#67](https://github.com/omercnet/paseo-plugins/issues/67)) ([1c6d549](https://github.com/omercnet/paseo-plugins/commit/1c6d549fddca48be8fd86b4dd2c5faea526c8ac0))
+* **paseo-omp:** reconcile incomplete terminal outcomes ([#68](https://github.com/omercnet/paseo-plugins/issues/68)) ([854f4e6](https://github.com/omercnet/paseo-plugins/commit/854f4e6daddf905c671bb39a94d06a2de0c6d51d))
+* **paseo-omp:** replay failed turns from native transcript ([#79](https://github.com/omercnet/paseo-plugins/issues/79)) ([4a13b77](https://github.com/omercnet/paseo-plugins/commit/4a13b778a9ba413b61fe0cc85878d3c333c161d2))
+* **paseo-omp:** scope providers and auxiliary state to named profiles ([#74](https://github.com/omercnet/paseo-plugins/issues/74)) ([b265ad3](https://github.com/omercnet/paseo-plugins/commit/b265ad317a47230ec76dba799197443664492729))
+* **paseo-omp:** settle concurrent startup races ([#70](https://github.com/omercnet/paseo-plugins/issues/70)) ([9d4e6ef](https://github.com/omercnet/paseo-plugins/commit/9d4e6efb26041f9c88ab4ed6c02a9526520b83e9))
+* **paseo-omp:** show immutable approval mode ([#66](https://github.com/omercnet/paseo-plugins/issues/66)) ([4c586dc](https://github.com/omercnet/paseo-plugins/commit/4c586dc7d012127ee7570077a0d12cc0d6415bd4))
+* **paseo-omp:** support Paseo 0.9 beta ([#103](https://github.com/omercnet/paseo-plugins/issues/103)) ([0444d52](https://github.com/omercnet/paseo-plugins/commit/0444d52078a52befa62bb52f44545f22ab10e8c7))
+* **paseo-omp:** support unkeyed terminal events ([#89](https://github.com/omercnet/paseo-plugins/issues/89)) ([a00a831](https://github.com/omercnet/paseo-plugins/commit/a00a83158993fdf648fc10e06f1d8f8ebc62fa6a))
+
 ## [0.2.1](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.0...paseo-omp-v0.2.1) (2026-09-15)
 
 

package/README.md

@@ -1,19 +1,19 @@
 # Paseo OMP plugin
 
-Community OMP integration for Paseo. The plugin registers the distinct `omp-plugin` provider and coexists with Paseo's bundled `omp` provider.
+Community OMP integration for Paseo. The plugin registers the distinct `omp-plugin` provider plus named profile providers and coexists with Paseo's bundled `omp` provider.
 
 > **Alpha preview:** persistence and protocol contracts are tested, but upgrades may still require re-importing sessions created by an earlier preview.
 
 ## Quick start
 
-Requirements: Paseo `^0.8.0`, OMP `18.1.15` or newer, and OMP RPC protocol v2.
+Requirements: Paseo `>=0.8.0 <0.10.0`, OMP `18.1.15` or newer, and OMP RPC protocol v2. Paseo `0.9.0-beta.1` or newer is required for nested provider-subagent ancestry and spawning-tool links, and is recommended for npm-managed installation and the complete client integration.
 
 ```bash
-paseo plugin add omercnet/paseo-plugins:paseo-omp --ref paseo-omp-v<version>
+paseo plugin install npm:@omercnet/paseo-omp@<version>
 paseo plugin ls paseo-omp
 ```
 
-Open the **OMP** sidebar to review the provider-profile contract, browse and edit native scalar settings, manage OMP-native plugins, verify runtime health, and inspect storage and process diagnostics. Then create an agent and select **OMP Plugin**. Normal use requires no plugin-specific settings.
+Open the **OMP** sidebar to review the provider-profile contract, choose which composer pills appear, browse and edit native scalar settings, manage OMP-native plugins, verify runtime health, and inspect storage and process diagnostics. Then create an agent and select **OMP Plugin**. Its optional **MCP** composer control runs OMP-native management commands in the current session; setup questions and authorization stay in that chat timeline, where OAuth can open in a workspace-scoped Paseo Browser or on the current device. Composer pill preferences are shared by clients connected to the same host; normal use requires no other plugin-specific settings.
 
 - [Install, update, rollback, and local development](docs/installation.md)
 - [Configuration and every provider option](docs/configuration.md)
@@ -22,13 +22,23 @@ Open the **OMP** sidebar to review the provider-profile contract, browse and edi
 - [Core-provider issue and parity audit](docs/core-provider-issue-audit.md)
 - [Alpha release checklist](docs/alpha-release-checklist.md)
 
-The plugin uses only public Paseo 0.8 provider contracts and registers the distinct `omp-plugin` identity; it does not modify the bundled `omp` provider.
+The plugin uses public Paseo 0.8 and 0.9 beta provider contracts and registers distinct `omp-plugin` and `omp-plugin-<profile>` identities; it does not modify the bundled `omp` provider.
+
+## Named OMP profiles
+
+At startup the plugin discovers directory names under `~/.omp/profiles/` (or `PI_CONFIG_DIR`) and registers **OMP · <profile>** for each valid lowercase name. Select that provider when creating a profile-backed agent. Discovery, launch, recovery and persisted session listing share its fixed profile and session root. Matching command wrappers, including Doppler, remain supported; conflicting profile or session-directory overrides fail before launch. Plain `env NAME=value omp` wrappers are supported, but environment-control flags such as `env -i` and `env -u` are rejected because they can discard the selected store. Profile-specific XDG roots cannot be overridden by per-launch environment values. Reload the plugin after adding a profile.
+
+Paseo 0.8 does not pass agent launch options to its model picker. Separate provider identities let the picker request the correct profile catalog before an agent exists. Existing `omp-plugin` and bundled `omp` agents retain their provider; they are not migrated automatically. Profile names use OMP's lowercase grammar, including dotted names such as `team.prod`.
+
+The OMP sidebar and memory panel expose an explicit store selector. Settings, plugins, quota, history, memory and diagnostics use that selection, and profile-agent popovers derive it from the provider ID. OMP-compatible XDG data and state roots are honored when a migrated profile uses them. Default-provider views are labelled **Daemon default store**; changing `providerOptions.command` on the default provider does not make those views profile-aware. Workspace configuration remains project-scoped, with the selected profile supplying inherited settings. Hub records are daemon-wide. The RPCs also accept an explicit absolute `store.agentDir` for custom stores; it is mutually exclusive with `store.profile`.
+
+Profile selection is request-local: concurrent clients cannot change each other's process environment or cached results. Settings edits affect the selected store immediately.
 
 ## Paseo provider SDK coverage
 
-This matrix inventories the complete capability set exported by the pinned `@getpaseo/plugin` 0.8.0 provider SDK. It measures strict SDK surface coverage, not general product quality.
+This matrix inventories the complete capability set exported by the pinned `@getpaseo/plugin` 0.9.0-beta.1 provider SDK. It measures strict SDK surface coverage, not general product quality.
 
-**Current capability completeness: 55.9%.** The provider advertises 10 of 17 capabilities (58.8%); nine are complete and `session.configure` is partial.
+**Current capability completeness: 61.8%.** The provider advertises 11 of 17 capabilities (64.7%); ten are complete and `session.configure` is partial.
 
 Scoring is deliberately mechanical so releases remain comparable:
 
@@ -39,7 +49,7 @@ Scoring is deliberately mechanical so releases remain comparable:
 
 | SDK capability | Completeness | Support and gap |
 | --- | ---: | --- |
-| `prompt.message` | **100%** | Text, structured attachments, optimistic correlation, streaming, and terminal outcomes map to native OMP prompts. |
+| `prompt.message` | **100%** | Text, structured attachments, optimistic correlation, streaming, and terminal outcomes map to native OMP prompts. Matching terminal request IDs remain authoritative; released OMP builds without them use the ordered compatibility policy described below. |
 | `prompt.command` | **100%** | Native command discovery plus structured `compact`, `autocompact`, `handoff`, `steer`, and `follow-up` dispatch. Individual commands can still fail when their documented OMP prerequisites are absent. |
 | `prompt.image` | **100%** | Native image blocks for capable models; private bounded temporary files with cleanup for text-only models. |
 | `prompt.output_schema` | **0%** | Not advertised. OMP has no equivalent structured-output contract; `outputSchema` fails visibly. |
@@ -55,7 +65,7 @@ Scoring is deliberately mechanical so releases remain comparable:
 | `session.unarchive` | **0%** | Not advertised; there is no native OMP archive state to reverse. |
 | `permission` | **100%** | Typed tool permissions when negotiated, with a bounded generic interaction fallback for OMP 18.1.15. Allow, deny, cancel, timeout, and interruption are covered. |
 | `permission.tool_policy` | **0%** | Not advertised. Exact MCP preapproval policy cannot be preserved through OMP `set_host_tools`, so the plugin fails closed instead of broadening access. |
-| `timeline.plugin` | **0%** | Not advertised. The provider currently expresses all output with Paseo's built-in timeline item types and registers no provider-owned custom timeline renderer. |
+| `timeline.plugin` | **100%** | Negotiated OMP MCP authorization requests render as interactive, schema-validated cards that can open a workspace-scoped Paseo Browser tab, with an on-device and built-in-notification fallback. |
 
 Provider functionality outside the capability flags is tracked separately:
 
@@ -68,7 +78,7 @@ Provider functionality outside the capability flags is tracked separately:
 | Models, modes, and thinking catalog | **100%** | Native catalog is mapped to opaque public model IDs with committed defaults and permission-gated modes. |
 | Connection `send` / `onEvent` / `close` lifecycle | **100%** | Request correlation, multi-session ownership, process recovery, teardown, and provider reload/removal are covered. |
 | Session launch: cwd, env, system prompt, title, and persistence | **100%** | Complete launch configuration is bounded, validated, forwarded, and re-read on recovery; selected daemon environment values are resolved only when catalog and session children spawn. |
-| MCP server forwarding and host tools | **100%** | Configured MCP tools are discovered, namespaced, labeled, executed, canceled, and bounded. Caller-scoped Paseo orchestration tools retain their native names, such as `create_agent` and `list_profiles`, so OMP skills can invoke them directly. Exact `toolPolicy` remains the separate 0% capability above. |
+| MCP server forwarding and host tools | **100%** | Configured MCP tools are discovered, namespaced, labeled, executed, canceled, and bounded. Caller-scoped Paseo orchestration tools retain their native names, such as `create_agent` and `list_profiles`, so OMP skills can invoke them directly. The MCP composer control delegates native server management to OMP instead of duplicating its profile and workspace precedence. Exact `toolPolicy` remains the separate 0% capability above. |
 | Denied native tools | **100%** | `disallowedTools` becomes an explicit OMP allow-list; unknown names fail closed. |
 | Commands and committed session state events | **100%** | Publishes `session.commands`, `session.opened`, `session.config`, `session.ready`, and request completion in protocol order. |
 | Built-in timeline snapshots | **100%** | Assistant, reasoning, tools, todos, notifications, errors, compaction, and friendly MCP labels use stable IDs and complete snapshots. OMP emits client-safe PNG/JPEG when possible; validated legacy WebP images render on capable clients with an explicit per-image fallback elsewhere. |
@@ -83,11 +93,13 @@ Tracking rules:
 
 ## Compatibility and coexistence
 
-The plugin always remains a separate provider. It registers only `omp-plugin`; it never registers, aliases, overrides, removes, or migrates Paseo's bundled `omp` provider. Both identities may be enabled on the same daemon and selected independently per agent.
+The plugin always remains a separate provider. It registers `omp-plugin` and `omp-plugin-<profile>` identities; it never registers, overrides, removes, or migrates Paseo's bundled `omp` provider. Both identities may be enabled on the same daemon and selected independently per agent.
+
+Existing agents whose provider is `omp` remain owned by the bundled provider. New plugin agents persist under their selected `omp-plugin` or `omp-plugin-<profile>` identity with the plugin's versioned opaque handle. The plugin can list and import OMP-native sessions through its own provider flow, but it performs no implicit conversion of bundled-provider records.
 
-Existing agents whose provider is `omp` remain owned by the bundled provider. New plugin agents persist under `omp-plugin` with the plugin's versioned opaque handle. The plugin can list and import OMP-native sessions through its own provider flow, but it performs no implicit conversion of bundled-provider records.
+OMP `18.1.15` is the oldest version tested end to end. The direct provider's hard compatibility gate is `rpc-ui` protocol v2: metadata-free legacy ready frames and v1-only runtimes are rejected before a provider session opens because they cannot support the advertised persistence and conversation-rewind capabilities. Typed tool approvals remain capability-gated and fall back as described above. For terminal completion, a matching `agent_end.requestId` is authoritative and mismatches are ignored before state changes. Released OMP 18.2.x builds that omit that field use an ordered fallback requiring a fresh correlated native user entry followed by current-turn assistant activity, an idle non-compacting runtime, and no conflicting permission, tool, steer, or child-session work. Ambiguous events while OMP is active are ignored; unresolved ambiguity after confirmed idle fails only the Paseo turn. This trades a bounded residual same-agent stale-event risk for compatibility with released OMP instead of terminating and lazily restarting the runtime after every later prompt. Paseo clients, including mobile clients inside reconnect grace, do not own or terminate the daemon-managed OMP session.
 
-OMP `18.1.15` is the oldest version tested end to end. The direct provider's hard compatibility gate is `rpc-ui` protocol v2: metadata-free legacy ready frames and v1-only runtimes are rejected before a provider session opens because they cannot support the advertised persistence and conversation-rewind capabilities. Typed tool approvals remain capability-gated and fall back as described above.
+Paseo 0.9.0-beta.1 is the verified canary target and the first release that preserves nested provider-subagent ancestry and spawning-tool links. The required full Docker canary passes there with OMP 18.1.15 and 18.2.0. Paseo 0.9 also provides npm-managed plugin sources, platform-owned external URL opening, and whole-item timeline transforms before Overview grouping. Paseo 0.8.x remains supported for other provider operations and Git or directory installation; its clients do not provide the external URL opener, retain their older timeline presentation semantics, and flatten nested provider subagents.
 
 Install, update, disable, or remove `paseo-omp` independently of the bundled provider. Verify the provider snapshot contains `omp-plugin` after installation; a bundled `omp` entry may remain present and is not modified by this plugin.
 

package/SUPPORT.md

@@ -12,12 +12,12 @@ After the failure is isolated:
 - report a Paseo plugin SDK, loader, or provider-protocol defect to [Paseo](https://github.com/getpaseo/paseo/issues);
 - keep adaptation, packaging, and cross-project compatibility work in this repository.
 
-Do not put credentials, private repository paths, session transcripts, or unredacted RPC payloads in an issue. Report vulnerabilities through the [private GitHub Security Advisory form](https://github.com/omercnet/paseo-plugins/security/advisories/new), not a public issue. Release checksums detect accidental corruption only; authenticate downloaded archives with their signed GitHub build-provenance attestation.
+Do not put credentials, private repository paths, session transcripts, or unredacted RPC payloads in an issue. Report vulnerabilities through the [private GitHub Security Advisory form](https://github.com/omercnet/paseo-plugins/security/advisories/new), not a public issue.
 
 ## Supported versions
 
-- Paseo: `^0.8.0` on both the daemon and every app loading the client entry.
-- OMP: `18.1.15` is the oldest release in the required real-binary regression job. The hard runtime contract is `rpc-ui` protocol v2, not the version string alone.
+- Paseo: `>=0.8.0 <0.10.0` on both the daemon and every app loading the client entry. The pinned SDK and controlled canary use `0.9.0-beta.1`, the first release that preserves nested provider-subagent ancestry and spawning-tool links. Paseo 0.8.x remains supported for other provider operations.
+- OMP: `18.1.15` is the oldest supported release. The required full Docker canary passes with 18.1.15 and 18.2.0; the hard runtime contract remains `rpc-ui` protocol v2, not the version string alone.
 - Plugin release channel: alpha. Backward compatibility is best effort until stable `0.1.0`; every known migration requirement must be stated in the release notes.
 - Typed approvals: optional. When both peers negotiate `typedToolApprovals: 1`, the plugin uses typed tool permissions. Otherwise it retains the bounded generic extension-question flow.
 
@@ -26,13 +26,17 @@ Do not put credentials, private repository paths, session transcripts, or unreda
 - `omp` and `omp-plugin` are independent provider identities. Agents, provider settings, and persisted handles do not migrate automatically between them.
 - Do not open the same underlying OMP session concurrently through both providers. Reservation tracking is provider-local and cannot coordinate ownership with Paseo's bundled adapter.
 - OMP 18.1.15 does not advertise typed tool approvals. The plugin uses its bounded generic permission fallback until both peers negotiate `typedToolApprovals: 1`.
+- OMP releases through 18.2.x may omit the originating prompt `requestId` from `agent_end`. A matching ID is authoritative when present, and a mismatch is discarded before changing turn state. For an unkeyed later-turn terminal, the plugin uses a bounded ordered fallback: the accepted prompt must not be known local-only, a fresh native user entry must correlate to it, current-turn assistant activity must follow that entry, OMP must report idle and non-compacting, and no permission, tool, steer, or child-session work may remain. Ambiguous candidates are ignored while OMP is active; once OMP is confirmed idle, unresolved ambiguity fails only the Paseo turn and keeps the OMP process available. This deliberately accepts a residual same-agent risk: a sufficiently delayed unkeyed event with indistinguishable ordered evidence can still be misattributed. It is safer than accepting any idle `agent_end`, while remaining usable with released OMP builds that cannot provide request identity.
+- Timeline correlation rebuilds an invalid watermark from a complete pre-prompt `get_branch_messages` snapshot, not replayed model context or an evicting identity cache. Snapshots are limited to 1,024 entries and 4 MiB; duplicate IDs, surplus exact-text matches, unavailable history, and exceeded bounds leave users uncorrelated rather than claiming an old entry. Repeated accepted prompts within a turn consume matching branch occurrences in order.
 - Configured MCP servers are supported and bridged into OMP. Paseo's own orchestration tools appear under their native names when the daemon's **Enable Paseo tools** / `daemon.mcp.injectIntoAgents` setting is enabled; other MCP servers remain namespaced. Exact Paseo `toolPolicy` preapproval cannot be represented by OMP `set_host_tools` and therefore fails session startup closed. `disallowedTools` applies only to recognized native OMP built-ins; unknown names are rejected and MCP tools are not silently filtered through it.
 - `qwen2.5:0.5b` is provided only for free exploratory inference. It may ignore exact-output instructions and is not a deterministic protocol or tool-use oracle; use `canary-mock/Deterministic Canary` for assertions.
 - The deterministic mock does not implement OMP's compaction-summary contract, so `/compact` reports `OMP compaction failed` in the canary; compaction remains covered by protocol fixtures.
 - `/handoff` reports `OMP command failed` in the controlled canary even with deterministic role models configured; treat handoff as unavailable there until its native prerequisite is isolated.
 - On official Paseo 0.8.0, requesting a live approval-mode change that the plugin rejects can trigger the daemon's unhandled-rejection restart path. Create a new `full`, `write`, or `ask` session instead of changing mode in place.
+- Paseo 0.8 clients do not expose the platform-owned plugin URL opener and transform timeline items after Overview grouping. Use a 0.9.0-beta.1 app for external documentation/device-authorization actions and for reliable image-card transformation of every source tool call.
 - Native Fast mode and a first-class plan mode are not exposed. `/handoff` is implemented but is not reproducible in the controlled canary without its native OMP workflow prerequisites.
 - Terminal-started OMP sessions are discoverable and importable but are not registered automatically through a terminal hook.
+- Paseo clients do not own OMP sessions. Mobile or desktop disconnects remain subject to Paseo's reconnect grace while the daemon-owned provider and OMP child continue independently; reconnecting can reveal an existing turn but does not transfer or sever runtime ownership.
 - OMP tool output reaching RPC stdout is strictly parsed and bounded, but channel purity ultimately depends on OMP keeping non-protocol output off stdout.
 
 The deduplicated comparison with every known OMP report in `getpaseo/paseo` is maintained in [docs/core-provider-issue-audit.md](docs/core-provider-issue-audit.md).

package/TESTING.md

@@ -1,6 +1,6 @@
 # OMP provider parity audit
 
-Validated against the Paseo plugin SDK versions pinned in `package.json`, official Paseo Docker image `0.8.0@sha256:5518da7cdd35f132e8a944c35e509c677a90a8f3ec8a78df98f7fb5fd5e2c6c3`, and OMP 18.1.15.
+Validated against the Paseo plugin SDK versions pinned in `package.json` and the real OMP compatibility matrix: high-use historical releases 17.2.15, 17.3.4, 18.0.11, and 18.1.10; minimum supported release 18.1.15; latest published 18.1 patch 18.1.22; and current release 18.2.0. On 2026-09-18, the full controlled canary passed against OMP 18.1.15 and 18.2.0 on official Paseo image `0.9.0-beta.1@sha256:f75a0eb3547ad3cc6bbdeaa7277d2d50eb4d06a9dd669d480371d7adf1c911b5`.
 
 Classifications:
 
@@ -31,7 +31,8 @@ Classifications:
 | Text prompts | **Equivalent** | Bounded multipart text joins and native prompt lifecycle coverage in `tests/provider.test.ts`. |
 | Image prompts | **Equivalent** | Valid native image models receive image blocks; text-only models receive private content-addressed local files with an aggregate cap and turn/session/failure cleanup. The file path is valid because the direct provider and OMP child share the daemon host. |
 | Structured attachments | **Equivalent** | Forge change requests/issues, legacy GitHub forms, text, reviews, and uploaded files render to bounded OMP prompt text; regression in `tests/provider.test.ts`. |
-| Optimistic message correlation | **Equivalent** | Native entry lookup, repeated-text occurrence ownership, steering correlation, replay-boundary dedupe, and exactly-one `session.prompt_result` regressions. |
+| Optimistic message correlation | **Equivalent** | Native entry lookup, repeated-text occurrence correlation, steering correlation, replay-boundary dedupe, and exactly-one `session.prompt_result` regressions. Bounded branch snapshots rebuild incomplete or evicted replay watermarks; duplicate IDs, surplus matching entries, unavailable snapshots, and count/byte overflow retain local user-message fallback instead of claiming an old entry. |
+| Terminal correlation on later turns | **Equivalent with legacy fallback** | A matching `agent_end.requestId` is authoritative and a mismatch is discarded before turn state changes. Released OMP builds that omit the field use ordered evidence from the accepted prompt: a fresh branch-correlated native user entry, later current-turn assistant activity, an idle non-compacting runtime, and no conflicting permission, tool, steer, or child-session work. `prompt_result.agentInvoked: false` remains local-only. Active ambiguous terminals are ignored; confirmed-idle ambiguity fails only the Paseo turn without killing the OMP process. Tests cover three sequential legacy prompts, stale terminals before evidence and while active, repeated text, local-only results, keyed mismatch/match, and degraded state/history. The remaining risk is same-agent misattribution when a delayed unkeyed event is indistinguishable from this ordered evidence. |
 | Streaming assistant text | **Equivalent** | `OmpTimelineProjector` publishes stable complete snapshots with frame coalescing and bounded retained bytes. |
 | Streaming reasoning | **Equivalent** | Indexed thinking blocks map to stable `reasoning` items and share stream bounds. |
 | `contentIndex` ordering | **Equivalent** | Stable 0→1→0 updates, sparse-index rejection, and 64-block bounds are tested in `tests/provider.test.ts`. |
@@ -40,8 +41,8 @@ Classifications:
 | Compaction events | **Equivalent** | Manual and automatic operations retain IDs, distinguish retry/skipped/canceled/failed states, flush streams, and refresh usage. |
 | Custom messages | **Equivalent** | Displayable custom and bash-execution messages map to typed or fallback items; `display: false` remains hidden. |
 | Advisor messages | **Equivalent** | Advisor notes preserve severity/attribution in stable tool-call blocks; `advisor_yielded` emits completion notice. |
-| System notices | **Equivalent** | Native notices and safe passive UI notifications map to bounded notification items; hidden custom notices remain hidden. |
-| Ask interactions | **Equivalent** | Select/confirm/input/editor questions, option descriptions, fixed-only rejection, bounded freeform input, native sentinel/follow-up submission, cancellation, timeout, and turn ownership are covered by permission regressions. |
+| System notices | **Equivalent** | Native notices and safe passive UI notifications map to bounded notification items; hidden custom notices remain hidden. Negotiated MCP authorization URLs use a schema-validated plugin item, can route through the caller-scoped Paseo `browser_new_tab` tool, and retain a notification fallback. |
+| Ask interactions | **Equivalent** | Select/confirm/input/editor questions, including remote OAuth redirect/code completion, option descriptions, fixed-only rejection, bounded freeform input, native sentinel/follow-up submission, cancellation, timeout, and turn ownership are covered by permission regressions. Allow, deny, cancel, timeout, and interruption remain in the agent timeline. |
 | Typed tool permission presentation | **Equivalent** | OMP `typedToolApprovals: 1` is negotiated reciprocally; strict native request/cancel/response frames are correlated exactly once and mapped from trusted shell/edit/write identity to bounded, content-preserving `kind: "tool"` permissions. Older OMP builds retain generic extension questions. |
 | Slash command catalog | **Equivalent** | Native commands and aliases refresh authoritatively; the bundled `compact`, `autocompact`, `handoff`, `steer`, and `follow-up` commands are always published. |
 | Manual `/compact` | **Equivalent** | Uses native `compact`, exposes one loading/completed operation, keeps long requests alive, refreshes usage, and supports interruption. |
@@ -56,7 +57,7 @@ Classifications:
 | Retry fallback events | **Equivalent** | Fallback telemetry renders bounded status items and triggers committed model/thinking refresh without trusting event strings as state. |
 | Context and token usage | **Equivalent** | Periodic, post-compaction, fallback, terminal, timeout, and stale-generation samples publish `session.usage`. |
 | Native host tools | **Equivalent** | Paseo's caller-scoped MCP endpoint is converted to OMP host tools with workspace identity, progress, cancellation, bounded results, and ownership cleanup. |
-| Configured MCP servers | **Equivalent** | stdio/http/SSE transports are opened by the plugin host process, namespaced, paginated, bounded, and passed through OMP's native host-tool API. |
+| Configured MCP servers | **Equivalent** | stdio/http/SSE transports are opened by the plugin host process, namespaced, paginated, bounded, and passed through OMP's native host-tool API. The agent-scoped MCP composer control invokes OMP's native management commands without copying its discovery or credential state. |
 | Subagents | **Equivalent** | Live lifecycle/progress/events create provider-owned child sessions; subscription failure removes the negotiated capability. |
 | Nested child timelines | **Equivalent** | Child/grandchild ancestry, stable IDs, live restart, cold transcript replay, terminal states, and cumulative replay bounds are covered. |
 | Conversation rewind | **Equivalent** | Only conversation scope is advertised; active-turn/stale-token rejection and branch replay are tested. |
@@ -94,9 +95,17 @@ npm run test:integration:wsl
 
 The WSL script skips when `wsl.exe` or WSL Node is unavailable. Set `PASEO_OMP_REQUIRE_WSL=1` to make either condition fatal, as CI does. `PASEO_OMP_WSL_NODE` may override the default `node` executable inside WSL.
 
-The Linux `paseo-omp real OMP 18.1.15` CI job downloads the pinned `omp-linux-x64` release asset, verifies SHA-256 `747518a41fbb32ac47491b4677a7a921d0d9e5977ae006c358d6836813149adc`, and runs `PASEO_OMP_REAL_E2E=1 npm test -- tests/provider.real.e2e.test.ts`. The test uses the real OMP binary and a local deterministic OpenAI-compatible model endpoint, so catalog and text-plus-Bash execution are mandatory without repository secrets.
+Run the full local provider integration canary with:
 
-The controlled canary in `canary/compose.yml` builds this plugin into that official Paseo image and installs checksummed OMP binaries for `amd64` and `arm64`. `canary/smoke.ts` passed catalog/mode discovery, text and image prompts, Bash, a configured stdio MCP tool, permission allow/deny/cancel, steering, interruption, session listing/import/resume, subagents, conversation rewind followed by another turn, Hub process visibility, usage, and every plugin RPC. Browser verification loaded the global OMP health/configuration surface and the agent-scoped Hub, Memory, and Sessions controls. The default mock returned `CANARY_MOCK_OK`, `CANARY_TOOL_OK`, and `CANARY_MCP_OK`; the optional Ollama profile pulled `qwen2.5:0.5b` and completed turns without paid credentials. The harness records the canary-only `/compact` and `/handoff` failures instead of masking them.
+```sh
+npm run test:integration:canary
+```
+
+Set `PASEO_CANARY_OMP_VERSION` to exercise another pinned release. The local runner knows the SHA-256 values for every version in the compatibility matrix; an unlisted version requires explicit `PASEO_CANARY_OMP_SHA256_AMD64` and `PASEO_CANARY_OMP_SHA256_ARM64` values. It allocates isolated loopback ports, builds a version-specific image, waits for both services to become healthy, runs the deterministic provider scenarios, prints container logs on failure, and always removes its containers, volumes, and image namespace. CI runs this full canary for OMP 18.1.15 and 18.2.0 whenever `paseo-omp` changes; both matrix entries feed the required `CI sentinel` gate and must pass before the supported OMP floor changes.
+
+The Linux real-OMP CI matrix downloads checksummed `omp-linux-x64` assets for OMP 17.2.15, 17.3.4, 18.0.11, 18.1.10, 18.1.15, 18.1.22, and 18.2.0, verifies each binary's pinned GitHub release SHA-256, and runs `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`. The historical entries are the four pre-floor releases with more than 4,000 downloads shown by npm for the seven days ending 2026-09-15; they are compatibility regression probes, not a support commitment. The remaining entries cover the supported floor, newest patch in that minor line, and current release. The test uses the real OMP binary and a local deterministic OpenAI-compatible model endpoint, including three sequential prompts on one native session, a Bash tool, and oversized-image transport.
+
+The controlled canary passed end to end with OMP 18.1.15 and 18.2.0 on 2026-09-18. In addition to runtime health, catalog, prompts, tools, MCP, permissions, steering, interruption, persistence, Hub, usage, rewind, and plugin RPC coverage, it verified that a direct child has `parentSubagentId: null` and the root task's `toolCallId`, a nested child has its direct parent's public subagent ID and the nested task's `toolCallId`, both children finish as `completed`, and both timelines remain independently fetchable without cross-contamination.
 
 ## OMP RPC compatibility intake
 
@@ -115,11 +124,7 @@ The plugin maintainer owns triage and adaptation. Escalate an isolated OMP imple
 
 ## Release publication
 
-`release-please.yml` only creates release metadata and forwards the created `paseo-omp` tag and commit SHA to `publish-paseo-omp.yml`. The metadata job never checks out or executes repository code. The publisher has no pull-request permission, resolves the tag independently, and waits for a successful `CI` push run whose `head_sha` is exactly the tagged commit before checkout or execution.
-
-The publisher builds the self-contained ZIP, writes its corruption-detection checksum, creates a signed GitHub build-provenance attestation for both files, rechecks that the tag still resolves to the gated SHA, and uploads with `--clobber`. To recover an interrupted upload, dispatch **Publish Paseo OMP** with the existing `paseo-omp-v<version>` tag; the same identity and CI gates apply, so reruns are idempotent.
-
-The SHA-256 file is not a signature. Consumers authenticate the archive with `gh attestation verify` and may use the checksum only to detect accidental transfer or storage corruption.
+`release-please.yml` creates GitHub releases and publishes every released plugin path to npm through trusted publishing. Stable versions use the `latest` distribution tag; prereleases use `next`. npm generates provenance from the GitHub Actions OIDC identity, and the workflow waits for registry propagation before succeeding.
 
 ### Alpha release channel
 
@@ -131,17 +136,15 @@ The go/no-go criteria, manual acceptance boundary, and alpha limitation list are
 
 ## Audit verification
 
-- `npm run check`: clean across 84 files.
+- `npm run check`: clean.
 - `npm run typecheck`: clean.
 - `npm test`: full Vitest suite passed, with environment-gated scenarios skipped when their runtimes were unavailable.
 - `npm test -- tests/provider-conformance.test.ts`: host-boundary conformance coverage includes `prompt.command`, `session.configure`, typed and fallback permission allow/deny/cancel paths, registry-driven reload/removal, verified stubborn-descendant cleanup, and sequential turns plus interrupt races with post-turn barriers.
-- `PASEO_OMP_REAL_E2E=1 npm test -- tests/provider.real.e2e.test.ts`: the installed `omp/18.1.15` catalog and hermetic real-binary text/Bash scenarios run against a local deterministic model.
+- `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`: the installed matrix version's catalog and hermetic real-binary text/Bash and oversized-image scenarios run against a local deterministic model.
 - `npm run test:coverage`: Vitest enforces aggregate 85% function and 89% line coverage over loaded source modules. Generated `dist/**` trees are excluded.
-- `npm run package:release`: `dist/paseo-omp-v0.0.0.zip` builds from tracked allowlisted source plus its closed production/compiler dependency set.
-- `npm run test:integration:install`: the self-contained archive imports dependencies and compiles with an unreachable proxy; a fresh Git-style checkout installs with lifecycle scripts disabled, retains required runtime packages, typechecks, bundles both entries, and loads the server contribution.
+- `npm run test:integration:install`: npm package acquisition retains required production dependencies, and a fresh Git-style checkout runs frozen production-only preparation with lifecycle scripts disabled. Both installed trees resolve runtime dependencies, compile the client and server entries with Paseo's host compiler, and load the server contribution.
 - `npm run test:integration:docker`: verifies the host/container ownership boundary.
 - `npm run test:integration:wsl`: locally skips when `wsl.exe` is unavailable; Windows CI sets `PASEO_OMP_REQUIRE_WSL=1`, so this boundary remains required there.
-- `docker compose -f canary/compose.yml`: official Paseo 0.8.0, deterministic mock, Tailscale-bound web UI, and optional Ollama `qwen2.5:0.5b` passed end-to-end.
-- `mise x actionlint@1.7.12 -- actionlint .github/workflows/*.yml`: passed.
+- `npm run test:integration:canary`: passed against OMP 18.1.15 and 18.2.0 on official Paseo `0.9.0-beta.1`; direct and nested ancestry, spawning-tool links, terminal status, and independently addressable child timelines passed.
 - `zizmor .github/workflows`: no findings (offline audit; six repository-wide suppressions remain).
 - Release Please 17.1.2 `config.json` and `manifest.json` schema validation: passed for `release-please-config.json` and `.release-please-manifest.json`.

package/client/composer-pill-settings.tsx

@@ -0,0 +1,157 @@
+import { type PluginSurfaceProps, type SettingsState, useSettings } from "@getpaseo/plugin/client";
+import {
+  SettingsAction,
+  SettingsCard,
+  SettingsSection,
+  SettingsSwitch,
+} from "@getpaseo/plugin/client/ui";
+import { useCallback, useEffect, useMemo } from "react";
+import { Text, View } from "react-native";
+import {
+  type ComposerPillKey,
+  type ComposerPillSettings,
+  composerPillSettings,
+  DEFAULT_COMPOSER_PILL_SETTINGS,
+} from "../shared/composer-pill-settings";
+
+type ReadySettings = Extract<
+  SettingsState<typeof composerPillSettings.schema>,
+  { status: "ready" }
+>;
+
+const PILLS: readonly { key: ComposerPillKey; label: string; hint: string }[] = [
+  {
+    key: "mcp",
+    label: "MCP",
+    hint: "OMP-native server controls on OMP Plugin agents",
+  },
+  {
+    key: "hub",
+    label: "Hub",
+    hint: "Supervised process status when this workspace has Hub processes",
+  },
+  {
+    key: "memory",
+    label: "Memory",
+    hint: "Retained facts for the current workspace",
+  },
+  {
+    key: "sessions",
+    label: "Sessions",
+    hint: "Recent OMP prompts for the current workspace",
+  },
+  {
+    key: "quota",
+    label: "Quota",
+    hint: "Provider quota usage when OMP has matching account data",
+  },
+];
+
+function ComposerPillControls({
+  settings,
+  onChange,
+}: {
+  settings: ReadySettings;
+  onChange(settings: ComposerPillSettings): void;
+}) {
+  const save = useCallback(
+    async (key: ComposerPillKey, value: boolean) => {
+      const next = { ...settings.values, [key]: value };
+      if (await settings.save(next, settings.revision)) onChange(next);
+    },
+    [onChange, settings],
+  );
+
+  return (
+    <SettingsSection
+      title="Composer pills"
+      info="Applies to all workspaces and connected clients on this host."
+    >
+      <SettingsCard>
+        {PILLS.map(({ key, label, hint }) => (
+          <SettingsSwitch
+            key={key}
+            label={label}
+            hint={hint}
+            value={settings.values[key]}
+            disabled={settings.saving}
+            onValueChange={(value) => void save(key, value)}
+          />
+        ))}
+        <SettingsAction
+          label="Restore composer pill defaults"
+          actionLabel="Reset"
+          disabled={settings.saving}
+          onPress={async () => {
+            if (await settings.reset()) onChange({ ...DEFAULT_COMPOSER_PILL_SETTINGS });
+          }}
+        />
+        {settings.saveError ? (
+          <SettingsAction
+            label="Reload saved composer preferences"
+            hint="Use after a conflict or connection error"
+            error={settings.saveError}
+            actionLabel="Reload"
+            disabled={settings.saving}
+            onPress={settings.reload}
+          />
+        ) : null}
+      </SettingsCard>
+    </SettingsSection>
+  );
+}
+
+export function ComposerPillSettingsSection({
+  theme,
+  onChange,
+}: {
+  theme: PluginSurfaceProps["theme"];
+  onChange(settings: ComposerPillSettings): void;
+}) {
+  const settings = useSettings(composerPillSettings);
+  const styles = useMemo(
+    () => ({
+      root: { gap: 12 },
+      text: { color: theme.colors.foreground },
+      error: { color: theme.colors.statusDanger },
+    }),
+    [theme],
+  );
+  const readyValues = settings.status === "ready" ? settings.values : undefined;
+
+  useEffect(() => {
+    if (readyValues) onChange(readyValues);
+  }, [onChange, readyValues]);
+
+  if (settings.status === "loading") return <Text style={styles.text}>Loading preferences…</Text>;
+  if (settings.status !== "ready") {
+    return (
+      <View style={styles.root}>
+        <SettingsSection title="Composer pills">
+          <Text accessibilityRole="alert" style={styles.error}>
+            {settings.error}
+          </Text>
+          <SettingsCard>
+            <SettingsAction
+              label="Read composer preferences again"
+              actionLabel="Reload"
+              onPress={settings.reload}
+            />
+            {settings.status === "invalid" ? (
+              <SettingsAction
+                label="Replace invalid preferences with defaults"
+                actionLabel="Reset"
+                disabled={settings.saving}
+                onPress={async () => {
+                  if (await settings.reset()) onChange({ ...DEFAULT_COMPOSER_PILL_SETTINGS });
+                }}
+              />
+            ) : null}
+          </SettingsCard>
+        </SettingsSection>
+      </View>
+    );
+  }
+
+  return <ComposerPillControls settings={settings} onChange={onChange} />;
+}

package/client/external-url.ts

@@ -0,0 +1,15 @@
+import * as paseoClient from "@getpaseo/plugin/client";
+import { Linking } from "react-native";
+import { selectExternalUrlOpener, validatedHttpUrl } from "../shared/external-url";
+
+const paseoOpenExternalUrl =
+  "openExternalUrl" in paseoClient && typeof paseoClient.openExternalUrl === "function"
+    ? paseoClient.openExternalUrl
+    : undefined;
+const openExternalUrl = selectExternalUrlOpener(paseoOpenExternalUrl, (url) =>
+  Linking.openURL(url),
+);
+
+export function openOmpExternalUrl(url: string): Promise<void> {
+  return openExternalUrl(validatedHttpUrl(url));
+}

package/client/mcp-authorization.tsx

@@ -0,0 +1,169 @@
+import { type PluginTimelineItemProps, useRpc } from "@getpaseo/plugin/client";
+import { Icon } from "@getpaseo/plugin/client/react-native";
+import { useMemo, useState } from "react";
+import { Pressable, Text, View } from "react-native";
+import {
+  type OmpMcpAuthorizationTimeline,
+  openOmpMcpAuthorizationInPaseoBrowser,
+} from "../shared/mcp";
+import { openOmpExternalUrl } from "./external-url";
+
+function browserAuthorizationError(error: unknown): string {
+  const detail = error instanceof Error ? error.message : String(error);
+  if (/No Paseo desktop browser host/iu.test(detail)) {
+    return "No Paseo desktop browser host is connected. Open the authorization on this device.";
+  }
+  if (/browser tools are disabled/iu.test(detail)) {
+    return "Paseo browser tools are disabled. Open the authorization on this device.";
+  }
+  if (/browser tools are unavailable/iu.test(detail)) {
+    return "Paseo tools are not available in this OMP session. Open the authorization on this device.";
+  }
+  if (/session is no longer available|session is closed/iu.test(detail)) {
+    return "The OMP authorization session ended. Start authorization again or open the URL on this device.";
+  }
+  return "Could not open a Paseo Browser tab. Open the authorization on this device.";
+}
+
+export function OmpMcpAuthorizationCard({
+  item,
+  theme,
+  layout,
+}: PluginTimelineItemProps<OmpMcpAuthorizationTimeline>) {
+  const openInPaseoBrowser = useRpc(openOmpMcpAuthorizationInPaseoBrowser);
+  const [opening, setOpening] = useState<"paseo" | "device" | null>(null);
+  const [message, setMessage] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const styles = useMemo(
+    () => ({
+      card: {
+        gap: layout.compact ? 10 : 12,
+        padding: layout.compact ? 12 : 14,
+        borderWidth: 1,
+        borderColor: theme.colors.border,
+        borderRadius: 10,
+        backgroundColor: theme.colors.surface1,
+      },
+      header: { flexDirection: "row" as const, alignItems: "center" as const, gap: 8 },
+      title: { color: theme.colors.foreground, fontSize: 14, fontWeight: "700" as const },
+      text: { color: theme.colors.foregroundMuted, fontSize: 13, lineHeight: 18 },
+      url: { color: theme.colors.accent, fontSize: 12, lineHeight: 17 },
+      buttonRow: { flexDirection: "row" as const, flexWrap: "wrap" as const, gap: 8 },
+      button: {
+        flexDirection: "row" as const,
+        alignItems: "center" as const,
+        alignSelf: "flex-start" as const,
+        gap: 7,
+        paddingHorizontal: 12,
+        paddingVertical: 9,
+        borderRadius: 8,
+        backgroundColor: theme.colors.accent,
+      },
+      buttonSecondary: {
+        borderWidth: 1,
+        borderColor: theme.colors.border,
+        backgroundColor: theme.colors.surface2,
+      },
+      buttonPressed: { opacity: 0.78 },
+      buttonDisabled: { opacity: 0.55 },
+      buttonText: {
+        color: theme.colors.accentForeground,
+        fontSize: 13,
+        fontWeight: "600" as const,
+      },
+      buttonTextSecondary: { color: theme.colors.foreground },
+      success: { color: theme.colors.statusSuccess, fontSize: 12 },
+      error: { color: theme.colors.statusDanger, fontSize: 12 },
+    }),
+    [layout.compact, theme],
+  );
+
+  async function openPaseoBrowser(): Promise<void> {
+    setOpening("paseo");
+    setError(null);
+    setMessage(null);
+    try {
+      const authorizationToken = item.data.browserAuthorizationToken;
+      if (!authorizationToken) throw new Error("Browser authorization is unavailable");
+      await openInPaseoBrowser({ authorizationToken });
+      setMessage("Opened in a Paseo Browser tab for this workspace.");
+    } catch (cause) {
+      setError(browserAuthorizationError(cause));
+    } finally {
+      setOpening(null);
+    }
+  }
+
+  async function openOnDevice(): Promise<void> {
+    setOpening("device");
+    setError(null);
+    setMessage(null);
+    try {
+      await openOmpExternalUrl(item.data.url);
+    } catch {
+      setError("Could not open the authorization URL. Copy the URL below into a browser.");
+    } finally {
+      setOpening(null);
+    }
+  }
+
+  return (
+    <View style={styles.card}>
+      <View style={styles.header}>
+        <Icon name="KeyRound" size={16} color={theme.colors.accent} />
+        <Text style={styles.title}>OMP MCP authorization</Text>
+      </View>
+      {item.data.instructions ? <Text style={styles.text}>{item.data.instructions}</Text> : null}
+      <View style={styles.buttonRow}>
+        {item.data.browserAuthorizationToken ? (
+          <Pressable
+            accessibilityRole="button"
+            accessibilityLabel="Open MCP authorization in Paseo Browser"
+            disabled={opening !== null}
+            onPress={() => void openPaseoBrowser()}
+            style={({ pressed }) => [
+              styles.button,
+              pressed ? styles.buttonPressed : null,
+              opening !== null ? styles.buttonDisabled : null,
+            ]}
+          >
+            <Icon name="PanelsTopLeft" size={15} color={theme.colors.accentForeground} />
+            <Text style={styles.buttonText}>
+              {opening === "paseo" ? "Opening…" : "Open in Paseo Browser"}
+            </Text>
+          </Pressable>
+        ) : null}
+        <Pressable
+          accessibilityRole="link"
+          accessibilityLabel="Open MCP authorization on this device"
+          disabled={opening !== null}
+          onPress={() => void openOnDevice()}
+          style={({ pressed }) => [
+            styles.button,
+            styles.buttonSecondary,
+            pressed ? styles.buttonPressed : null,
+            opening !== null ? styles.buttonDisabled : null,
+          ]}
+        >
+          <Icon name="ExternalLink" size={15} color={theme.colors.foreground} />
+          <Text style={[styles.buttonText, styles.buttonTextSecondary]}>
+            {opening === "device" ? "Opening…" : "Open on this device"}
+          </Text>
+        </Pressable>
+      </View>
+      <Text selectable style={styles.url}>
+        {item.data.url}
+      </Text>
+      {item.data.loopbackCallback ? (
+        <Text style={styles.text}>
+          Paseo Browser keeps authorization in this workspace when a desktop browser host is
+          connected. For a localhost callback, that browser host must run on the daemon machine.
+          Otherwise, copy the final URL or authorization code and paste it into the OMP prompt in
+          this chat.
+        </Text>
+      ) : null}
+      {message ? <Text style={styles.success}>{message}</Text> : null}
+      {error ? <Text style={styles.error}>{error}</Text> : null}
+    </View>
+  );
+}