@omercnet/paseo-omp 0.3.0 → 0.4.0-next.114.1

package/CHANGELOG.md

@@ -1,113 +0,0 @@
-# Changelog
-
-## [0.3.0](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.1...paseo-omp-v0.3.0) (2026-09-18)
-
-
-### Features
-
-* **paseo-omp:** add first-class MCP management ([#64](https://github.com/omercnet/paseo-plugins/issues/64)) ([5a8fefa](https://github.com/omercnet/paseo-plugins/commit/5a8fefa9148e8d01f0461aa4a90619ec6ae2c2fa))
-* **paseo-omp:** add workspace-scoped OMP management ([#59](https://github.com/omercnet/paseo-plugins/issues/59)) ([2807aec](https://github.com/omercnet/paseo-plugins/commit/2807aec6217ed2d52f8b4666f0a41a688109f8f5))
-* **paseo-omp:** make composer pills configurable ([#76](https://github.com/omercnet/paseo-plugins/issues/76)) ([28e7501](https://github.com/omercnet/paseo-plugins/commit/28e75011a06a11cdc963187aa4106dfc21d561e6))
-* **release:** publish plugins to npm ([#80](https://github.com/omercnet/paseo-plugins/issues/80)) ([3c93048](https://github.com/omercnet/paseo-plugins/commit/3c93048cfefda97d8c2bc1631e3428fb64bdad09))
-
-
-### Bug Fixes
-
-* **paseo-omp:** advertise nested subsession capability ([#62](https://github.com/omercnet/paseo-plugins/issues/62)) ([fcb4e82](https://github.com/omercnet/paseo-plugins/commit/fcb4e8243e9559d70f26ac6945e2f3c0bf05d575))
-* **paseo-omp:** bound model catalogs and retain safe failure diagnostics ([#73](https://github.com/omercnet/paseo-plugins/issues/73)) ([e70afb7](https://github.com/omercnet/paseo-plugins/commit/e70afb72be782446e7ff585bad40940c7231bdc5))
-* **paseo-omp:** correlate terminal events by request ([#81](https://github.com/omercnet/paseo-plugins/issues/81)) ([41f756e](https://github.com/omercnet/paseo-plugins/commit/41f756e9bebf5cbc275e5cbd3657c37d45a18997))
-* **paseo-omp:** fail closed on unowned later-turn terminal events ([#69](https://github.com/omercnet/paseo-plugins/issues/69)) ([072cd09](https://github.com/omercnet/paseo-plugins/commit/072cd09e38e450376bcd3f4c7b5eae9a670b56b5))
-* **paseo-omp:** preserve prompt scheduling error fidelity ([#67](https://github.com/omercnet/paseo-plugins/issues/67)) ([1c6d549](https://github.com/omercnet/paseo-plugins/commit/1c6d549fddca48be8fd86b4dd2c5faea526c8ac0))
-* **paseo-omp:** reconcile incomplete terminal outcomes ([#68](https://github.com/omercnet/paseo-plugins/issues/68)) ([854f4e6](https://github.com/omercnet/paseo-plugins/commit/854f4e6daddf905c671bb39a94d06a2de0c6d51d))
-* **paseo-omp:** replay failed turns from native transcript ([#79](https://github.com/omercnet/paseo-plugins/issues/79)) ([4a13b77](https://github.com/omercnet/paseo-plugins/commit/4a13b778a9ba413b61fe0cc85878d3c333c161d2))
-* **paseo-omp:** scope providers and auxiliary state to named profiles ([#74](https://github.com/omercnet/paseo-plugins/issues/74)) ([b265ad3](https://github.com/omercnet/paseo-plugins/commit/b265ad317a47230ec76dba799197443664492729))
-* **paseo-omp:** settle concurrent startup races ([#70](https://github.com/omercnet/paseo-plugins/issues/70)) ([9d4e6ef](https://github.com/omercnet/paseo-plugins/commit/9d4e6efb26041f9c88ab4ed6c02a9526520b83e9))
-* **paseo-omp:** show immutable approval mode ([#66](https://github.com/omercnet/paseo-plugins/issues/66)) ([4c586dc](https://github.com/omercnet/paseo-plugins/commit/4c586dc7d012127ee7570077a0d12cc0d6415bd4))
-* **paseo-omp:** support Paseo 0.9 beta ([#103](https://github.com/omercnet/paseo-plugins/issues/103)) ([0444d52](https://github.com/omercnet/paseo-plugins/commit/0444d52078a52befa62bb52f44545f22ab10e8c7))
-* **paseo-omp:** support unkeyed terminal events ([#89](https://github.com/omercnet/paseo-plugins/issues/89)) ([a00a831](https://github.com/omercnet/paseo-plugins/commit/a00a83158993fdf648fc10e06f1d8f8ebc62fa6a))
-
-## [0.2.1](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.0...paseo-omp-v0.2.1) (2026-09-15)
-
-
-### Bug Fixes
-
-* **paseo-omp:** handle oversized pasted images ([#55](https://github.com/omercnet/paseo-plugins/issues/55)) ([4b6ed7d](https://github.com/omercnet/paseo-plugins/commit/4b6ed7d3015f1f85dcc13a9dd29061efef5f22c7))
-* **paseo-omp:** preserve buffered terminal ownership evidence ([#54](https://github.com/omercnet/paseo-plugins/issues/54)) ([b49400e](https://github.com/omercnet/paseo-plugins/commit/b49400e09d73cd67a23986f52c17bfc1f23cd297))
-* **paseo-omp:** steer auto messages during active turns ([#61](https://github.com/omercnet/paseo-plugins/issues/61)) ([b36002b](https://github.com/omercnet/paseo-plugins/commit/b36002bbc5b108cd525dd9c356fbdb89d6a9f3e6))
-
-## [0.2.0](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.1.2...paseo-omp-v0.2.0) (2026-09-14)
-
-
-### Features
-
-* **paseo-omp:** add config workspace shell ([#48](https://github.com/omercnet/paseo-plugins/issues/48)) ([1c0126b](https://github.com/omercnet/paseo-plugins/commit/1c0126b51bd3c8ceccacf7758fc14270cd67440e))
-* **paseo-omp:** add opt-in output redaction ([#44](https://github.com/omercnet/paseo-plugins/issues/44)) ([0b0cea1](https://github.com/omercnet/paseo-plugins/commit/0b0cea1501230437fe4d6390b67ca25ee2079c93))
-* **paseo-omp:** browse complete runtime settings catalog ([#49](https://github.com/omercnet/paseo-plugins/issues/49)) ([ef68cd7](https://github.com/omercnet/paseo-plugins/commit/ef68cd754fa3aad4a15bcdc8649f8c7dcdcde79e))
-* **paseo-omp:** edit scalar settings in sidebar ([#50](https://github.com/omercnet/paseo-plugins/issues/50)) ([78da43f](https://github.com/omercnet/paseo-plugins/commit/78da43fd155ed06e29faef507156399b55cf3439))
-* **paseo-omp:** support explicit env passthrough ([#39](https://github.com/omercnet/paseo-plugins/issues/39)) ([e22b3b4](https://github.com/omercnet/paseo-plugins/commit/e22b3b448f218bdecfcb3a168c14fa32051a6392))
-
-
-### Bug Fixes
-
-* **omp:** preserve safe published URLs ([#42](https://github.com/omercnet/paseo-plugins/issues/42)) ([4530430](https://github.com/omercnet/paseo-plugins/commit/4530430a02bee076f8940c376401d3266ce17499))
-* **paseo-omp:** align prompt attachment rendering ([#41](https://github.com/omercnet/paseo-plugins/issues/41)) ([4b708c8](https://github.com/omercnet/paseo-plugins/commit/4b708c897b4af4cd6673e7581f736e95843b545b))
-* **paseo-omp:** expose native Paseo tools ([#52](https://github.com/omercnet/paseo-plugins/issues/52)) ([3b52adf](https://github.com/omercnet/paseo-plugins/commit/3b52adff1de6329fa9f0bc4a1dcea339166e3974))
-* **paseo-omp:** label direct MCP tool calls ([#53](https://github.com/omercnet/paseo-plugins/issues/53)) ([e09b1fd](https://github.com/omercnet/paseo-plugins/commit/e09b1fd2c05cb45422e7d0633e8b638d0841b931))
-* **paseo-omp:** preserve structured tool results ([#46](https://github.com/omercnet/paseo-plugins/issues/46)) ([9e5fe98](https://github.com/omercnet/paseo-plugins/commit/9e5fe989e57e100f67285257cada3242218eee58))
-* **paseo-omp:** render WebP images across clients ([#51](https://github.com/omercnet/paseo-plugins/issues/51)) ([397cb2d](https://github.com/omercnet/paseo-plugins/commit/397cb2d1e660e43e22312ecf9f054d77afcddc6e))
-* **paseo-omp:** stop speculative stream redaction ([#40](https://github.com/omercnet/paseo-plugins/issues/40)) ([539cb61](https://github.com/omercnet/paseo-plugins/commit/539cb61db0b904b8130319c7887852f991c50aba))
-
-## [0.1.2](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.1.1...paseo-omp-v0.1.2) (2026-09-13)
-
-
-### Bug Fixes
-
-* **paseo-omp:** serialize persistent session registration ([#35](https://github.com/omercnet/paseo-plugins/issues/35)) ([03d38bc](https://github.com/omercnet/paseo-plugins/commit/03d38bc7e4a3d00ec54190e2b234a459bbdc55ae))
-* **paseo-omp:** settle late child dispatches ([#34](https://github.com/omercnet/paseo-plugins/issues/34)) ([0746f11](https://github.com/omercnet/paseo-plugins/commit/0746f11fd94f15028fd624ac7a99ac8ebd88b63d))
-
-## [0.1.1](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.1.0...paseo-omp-v0.1.1) (2026-09-13)
-
-
-### Bug Fixes
-
-* **paseo-omp:** preserve Plexus plugin credentials ([#27](https://github.com/omercnet/paseo-plugins/issues/27)) ([0674ef1](https://github.com/omercnet/paseo-plugins/commit/0674ef1d3d66efa37ec9d2da9a19dd57472c2cdd))
-* **paseo-omp:** wait for session registration ([#30](https://github.com/omercnet/paseo-plugins/issues/30)) ([82e901e](https://github.com/omercnet/paseo-plugins/commit/82e901e4bb0e66cafeb572c4bd92e0461b57a647))
-
-## 0.1.0 (2026-09-13)
-
-
-### Features
-
-* **paseo-omp:** add first OMP provider plugin ([#19](https://github.com/omercnet/paseo-plugins/issues/19)) ([f6f3e5e](https://github.com/omercnet/paseo-plugins/commit/f6f3e5e224bf8537f85305d79ea5d1bcf5849549))
-
-## Changelog
-
-## Unreleased
-
-### Features
-
-* Add the permanent `omp-plugin` direct provider, OMP workspace tools, diagnostics, versioned persistence, and nested-subagent support.
-* Add Release Please packaging, Git installation, compatibility policy, and release rollback guidance.
-* Add a digest-pinned official Paseo Docker canary with deterministic mock, configured MCP, and optional local Ollama inference.
-* Document the deduplicated Paseo core OMP issue audit, verified plugin fixes, host-owned concerns, and remaining alpha gaps.
-* Add the OMP sidebar configuration editor with revision-checked scalar writes, structured collection display, and documentation of provider-profile options including names-only inherited environment settings.
-* Add official OMP documentation links and an OMP-native plugin manager with status, user-scoped lifecycle actions, upgrades, write-only non-secret scalar configuration, and presence-only secret handling.
-
-### Bug Fixes
-
-* Cancel pending generic permissions before interrupting OMP so the host receives a terminal cancellation.
-* Rebuild the native branch watermark during replay so a post-rewind prompt retains terminal ownership.
-* Label `xd://` and MCP timeline calls with their registered human-readable title instead of the generic `write` transport or technical route name.
-* Support host-wide session discovery when Paseo opens the unscoped import sheet, preventing its provider failure path from crashing affected 0.8 daemons.
-* Recover degraded or compacted `agent_end` outcomes from complete streamed assistant evidence while continuing to fail closed on partial evidence.
-* Preserve `PLEXUS_API_KEY` when launching OMP so Plexus extension providers can attach their configured bearer header.
-* Serialize concurrent persistent-session registration so startup restoration waits instead of returning transient provider failures.
-* Expose caller-scoped Paseo orchestration tools under their native names so OMP skills can invoke `list_profiles`, `create_agent`, and related tools without CLI fallback.
-* Render validated WebP timeline images on capable clients, show a local fallback when decoding fails, hide machine-facing coordinate annotations, and request PNG/JPEG output from OMP for cross-client compatibility.
-
-### Security
-
-* Split release metadata from least-privilege artifact publishing, gate publication on exact-commit CI, and attest release artifacts.
-* Make release archives self-contained, restrict source inputs to tracked allowlisted files, and verify offline installation plus contained extraction.
-* Disable dependency lifecycle scripts during Git installation and verify both plugin entries from a fresh checkout.
-* Document native-output fidelity, optional best-effort configured-value replacement, its limits, and the host-owned redaction boundary.

package/SUPPORT.md

@@ -1,44 +0,0 @@
-# Support
-
-## Ownership
-
-`@omercnet` maintains the `paseo-omp` package, its release artifacts, and the translation between Paseo's provider protocol and OMP's `rpc-ui` protocol. Support is best effort; no response-time or compatibility SLA is promised.
-
-Report plugin packaging, installation, provider behavior, and compatibility failures in the [paseo-plugins issue tracker](https://github.com/omercnet/paseo-plugins/issues). Use the [OMP RPC compatibility template](https://github.com/omercnet/paseo-plugins/issues/new?template=omp-rpc-compatibility.yml) for native protocol changes.
-
-After the failure is isolated:
-
-- report an OMP CLI or `rpc-ui` implementation defect to [Oh My Pi](https://github.com/can1357/oh-my-pi/issues);
-- report a Paseo plugin SDK, loader, or provider-protocol defect to [Paseo](https://github.com/getpaseo/paseo/issues);
-- keep adaptation, packaging, and cross-project compatibility work in this repository.
-
-Do not put credentials, private repository paths, session transcripts, or unredacted RPC payloads in an issue. Report vulnerabilities through the [private GitHub Security Advisory form](https://github.com/omercnet/paseo-plugins/security/advisories/new), not a public issue.
-
-## Supported versions
-
-- Paseo: `>=0.8.0 <0.10.0` on both the daemon and every app loading the client entry. The pinned SDK and controlled canary use `0.9.0-beta.1`; 0.8.x remains the compatibility line.
-- OMP: `18.1.15` is the oldest release in the required real-binary regression job. The hard runtime contract is `rpc-ui` protocol v2, not the version string alone.
-- Plugin release channel: alpha. Backward compatibility is best effort until stable `0.1.0`; every known migration requirement must be stated in the release notes.
-- Typed approvals: optional. When both peers negotiate `typedToolApprovals: 1`, the plugin uses typed tool permissions. Otherwise it retains the bounded generic extension-question flow.
-
-## Known limitations
-
-- `omp` and `omp-plugin` are independent provider identities. Agents, provider settings, and persisted handles do not migrate automatically between them.
-- Do not open the same underlying OMP session concurrently through both providers. Reservation tracking is provider-local and cannot coordinate ownership with Paseo's bundled adapter.
-- OMP 18.1.15 does not advertise typed tool approvals. The plugin uses its bounded generic permission fallback until both peers negotiate `typedToolApprovals: 1`.
-- OMP releases through 18.2.x may omit the originating prompt `requestId` from `agent_end`. A matching ID is authoritative when present, and a mismatch is discarded before changing turn state. For an unkeyed later-turn terminal, the plugin uses a bounded ordered fallback: the accepted prompt must not be known local-only, a fresh native user entry must correlate to it, current-turn assistant activity must follow that entry, OMP must report idle and non-compacting, and no permission, tool, steer, or child-session work may remain. Ambiguous candidates are ignored while OMP is active; once OMP is confirmed idle, unresolved ambiguity fails only the Paseo turn and keeps the OMP process available. This deliberately accepts a residual same-agent risk: a sufficiently delayed unkeyed event with indistinguishable ordered evidence can still be misattributed. It is safer than accepting any idle `agent_end`, while remaining usable with released OMP builds that cannot provide request identity.
-- Timeline correlation rebuilds an invalid watermark from a complete pre-prompt `get_branch_messages` snapshot, not replayed model context or an evicting identity cache. Snapshots are limited to 1,024 entries and 4 MiB; duplicate IDs, surplus exact-text matches, unavailable history, and exceeded bounds leave users uncorrelated rather than claiming an old entry. Repeated accepted prompts within a turn consume matching branch occurrences in order.
-- Configured MCP servers are supported and bridged into OMP. Paseo's own orchestration tools appear under their native names when the daemon's **Enable Paseo tools** / `daemon.mcp.injectIntoAgents` setting is enabled; other MCP servers remain namespaced. Exact Paseo `toolPolicy` preapproval cannot be represented by OMP `set_host_tools` and therefore fails session startup closed. `disallowedTools` applies only to recognized native OMP built-ins; unknown names are rejected and MCP tools are not silently filtered through it.
-- `qwen2.5:0.5b` is provided only for free exploratory inference. It may ignore exact-output instructions and is not a deterministic protocol or tool-use oracle; use `canary-mock/Deterministic Canary` for assertions.
-- The deterministic mock does not implement OMP's compaction-summary contract, so `/compact` reports `OMP compaction failed` in the canary; compaction remains covered by protocol fixtures.
-- `/handoff` reports `OMP command failed` in the controlled canary even with deterministic role models configured; treat handoff as unavailable there until its native prerequisite is isolated.
-- On official Paseo 0.8.0, requesting a live approval-mode change that the plugin rejects can trigger the daemon's unhandled-rejection restart path. Create a new `full`, `write`, or `ask` session instead of changing mode in place.
-- Paseo 0.8 clients do not expose the platform-owned plugin URL opener and transform timeline items after Overview grouping. Use a 0.9.0-beta.1 app for external documentation/device-authorization actions and for reliable image-card transformation of every source tool call.
-- Native Fast mode and a first-class plan mode are not exposed. `/handoff` is implemented but is not reproducible in the controlled canary without its native OMP workflow prerequisites.
-- Terminal-started OMP sessions are discoverable and importable but are not registered automatically through a terminal hook.
-- Paseo clients do not own OMP sessions. Mobile or desktop disconnects remain subject to Paseo's reconnect grace while the daemon-owned provider and OMP child continue independently; reconnecting can reveal an existing turn but does not transfer or sever runtime ownership.
-- OMP tool output reaching RPC stdout is strictly parsed and bounded, but channel purity ultimately depends on OMP keeping non-protocol output off stdout.
-
-The deduplicated comparison with every known OMP report in `getpaseo/paseo` is maintained in [docs/core-provider-issue-audit.md](docs/core-provider-issue-audit.md).
-
-See [TESTING.md](TESTING.md#omp-rpc-compatibility-intake) for the schema-drift intake and regression process.

package/TESTING.md

@@ -1,150 +0,0 @@
-# OMP provider parity audit
-
-Validated against the Paseo plugin SDK versions pinned in `package.json` and the real OMP compatibility matrix: high-use historical releases 17.2.15, 17.3.4, 18.0.11, and 18.1.10; minimum supported release 18.1.15; latest published 18.1 patch 18.1.22; and current release 18.2.0. Validation against official Paseo Docker image `0.9.0-beta.1@sha256:f75a0eb3547ad3cc6bbdeaa7277d2d50eb4d06a9dd669d480371d7adf1c911b5` is partial as recorded below.
-
-Classifications:
-
-- **Equivalent**: same consumer-observable behavior is implemented by the `omp-plugin` provider.
-- **Unsupported**: OMP has no meaningful native operation for this behavior.
-- **Protocol**: Paseo core owns the behavior for every public provider.
-- **Blocked**: parity needs the linked narrow public API or core change; the plugin fails visibly or provides the documented partial behavior.
-
-## Evidence matrix
-
-| Inventory behavior | Classification | Evidence |
-| --- | --- | --- |
-| Binary availability and version diagnostics | **Equivalent** | Provider refresh calls the bounded `checkAvailability` hook with normalized profile options and the host deadline. `server/provider-diagnostics.ts` distinguishes missing, unrunnable, incompatible, and available runtimes without exposing probe output. |
-| Catalog discovery | **Equivalent** | `server/provider/catalog.ts::discoverOmpCatalog` launches with the normalized profile command, environment policy, parameters, workspace, and timeout settings; selected daemon values are resolved only when the catalog child spawns. |
-| Catalog cache identity | **Equivalent** | `getCatalogCacheKey` hashes normalized `providerOptions`, including configured `inheritEnv` names but never their values or secret-derived fingerprints, plus profile `settings`, scope, working directory, and the effective default command. Core applies configured `models` and `additionalModels` per profile. |
-| Default mode | **Equivalent** | Catalog reports `defaultMode: full`; `full` is always available, while bundled `write`/`ask` modes are advertised only after `permission` negotiation. Covered by `tests/provider.test.ts` and `tests/provider-options.test.ts`. |
-| Create session | **Equivalent** | `OmpProviderSession.open`; ordered `session.opened`, committed `session.config`, and `session.ready` regression. |
-| Resume session | **Equivalent** | Versioned plugin persistence validates the native session ID, authorizes cwd against the configured `providerOptions.params.sessionDir`, resumes exactly, and replays before ready. Covered by `tests/provider.test.ts` and `tests/provider-conformance.test.ts`. |
-| List sessions | **Equivalent** | `session.list` consumes profile-scoped `providerOptions` and `settings`, scans the configured session root, and returns separate bounded first- and last-user-prompt previews. |
-| Import session | **Protocol** and **Equivalent** | `session.list` plus persistence replay feeds the generic plugin-provider import path and creates an `omp-plugin` agent without changing bundled-provider records. |
-| Archive/unarchive | **Unsupported** | OMP has no native archive operation. Neither adapter mutates OMP transcripts; Paseo still archives its own agent record. |
-| Working directory | **Equivalent** | Absolute cwd validation, launch forwarding, resume ownership checks, session-list scoping, and host-tool cwd tests. |
-| Environment propagation | **Equivalent** | `config-normalization.ts` overlays session env on profile env; `omp-rpc.ts::buildOmpEnvironment` allowlists inherited runtime/provider variables and rejects loader/path injection. |
-| System prompts | **Protocol** and **Equivalent** | Core combines agent and daemon prompts before `session.open`; plugin forwards one bounded `--append-system-prompt`. Profile/recovery tests preserve it. |
-| Persisted sessions | **Equivalent** | Versioned opaque plugin persistence, transcript reservation, replay, process recovery, and cleanup quarantine regressions are covered in `tests/provider.test.ts` and `tests/provider-conformance.test.ts`. |
-| Ephemeral sessions | **Equivalent** | `persist: false` maps to `--no-session`; runtime loss fails visibly instead of inventing a resume handle. |
-| Internal sessions | **Protocol** and **Equivalent** | Metadata generation requests `persistSession: false`; the generic plugin host maps that to `config.persist: false`, then OMP receives `--no-session`. |
-| Text prompts | **Equivalent** | Bounded multipart text joins and native prompt lifecycle coverage in `tests/provider.test.ts`. |
-| Image prompts | **Equivalent** | Valid native image models receive image blocks; text-only models receive private content-addressed local files with an aggregate cap and turn/session/failure cleanup. The file path is valid because the direct provider and OMP child share the daemon host. |
-| Structured attachments | **Equivalent** | Forge change requests/issues, legacy GitHub forms, text, reviews, and uploaded files render to bounded OMP prompt text; regression in `tests/provider.test.ts`. |
-| Optimistic message correlation | **Equivalent** | Native entry lookup, repeated-text occurrence correlation, steering correlation, replay-boundary dedupe, and exactly-one `session.prompt_result` regressions. Bounded branch snapshots rebuild incomplete or evicted replay watermarks; duplicate IDs, surplus matching entries, unavailable snapshots, and count/byte overflow retain local user-message fallback instead of claiming an old entry. |
-| Terminal correlation on later turns | **Equivalent with legacy fallback** | A matching `agent_end.requestId` is authoritative and a mismatch is discarded before turn state changes. Released OMP builds that omit the field use ordered evidence from the accepted prompt: a fresh branch-correlated native user entry, later current-turn assistant activity, an idle non-compacting runtime, and no conflicting permission, tool, steer, or child-session work. `prompt_result.agentInvoked: false` remains local-only. Active ambiguous terminals are ignored; confirmed-idle ambiguity fails only the Paseo turn without killing the OMP process. Tests cover three sequential legacy prompts, stale terminals before evidence and while active, repeated text, local-only results, keyed mismatch/match, and degraded state/history. The remaining risk is same-agent misattribution when a delayed unkeyed event is indistinguishable from this ordered evidence. |
-| Streaming assistant text | **Equivalent** | `OmpTimelineProjector` publishes stable complete snapshots with frame coalescing and bounded retained bytes. |
-| Streaming reasoning | **Equivalent** | Indexed thinking blocks map to stable `reasoning` items and share stream bounds. |
-| `contentIndex` ordering | **Equivalent** | Stable 0→1→0 updates, sparse-index rejection, and 64-block bounds are tested in `tests/provider.test.ts`. |
-| Tool lifecycle | **Equivalent** | Running/update/terminal snapshots, mapped shell/read/edit/write/search/fetch/subagent details, ID reuse defense, and terminal cleanup are covered. |
-| Todo lifecycle | **Equivalent** | Todo tool results and reminder/auto-clear events reduce to one stable `omp:todos` item; malformed inputs degrade safely. |
-| Compaction events | **Equivalent** | Manual and automatic operations retain IDs, distinguish retry/skipped/canceled/failed states, flush streams, and refresh usage. |
-| Custom messages | **Equivalent** | Displayable custom and bash-execution messages map to typed or fallback items; `display: false` remains hidden. |
-| Advisor messages | **Equivalent** | Advisor notes preserve severity/attribution in stable tool-call blocks; `advisor_yielded` emits completion notice. |
-| System notices | **Equivalent** | Native notices and safe passive UI notifications map to bounded notification items; hidden custom notices remain hidden. Negotiated MCP authorization URLs use a schema-validated plugin item, can route through the caller-scoped Paseo `browser_new_tab` tool, and retain a notification fallback. |
-| Ask interactions | **Equivalent** | Select/confirm/input/editor questions, including remote OAuth redirect/code completion, option descriptions, fixed-only rejection, bounded freeform input, native sentinel/follow-up submission, cancellation, timeout, and turn ownership are covered by permission regressions. Allow, deny, cancel, timeout, and interruption remain in the agent timeline. |
-| Typed tool permission presentation | **Equivalent** | OMP `typedToolApprovals: 1` is negotiated reciprocally; strict native request/cancel/response frames are correlated exactly once and mapped from trusted shell/edit/write identity to bounded, content-preserving `kind: "tool"` permissions. Older OMP builds retain generic extension questions. |
-| Slash command catalog | **Equivalent** | Native commands and aliases refresh authoritatively; the bundled `compact`, `autocompact`, `handoff`, `steer`, and `follow-up` commands are always published. |
-| Manual `/compact` | **Equivalent** | Uses native `compact`, exposes one loading/completed operation, keeps long requests alive, refreshes usage, and supports interruption. |
-| `/autocompact` | **Equivalent** | `on`, `off`, and state-backed `toggle` use native `set_auto_compaction`; invalid or unavailable state fails visibly. |
-| `/handoff` | **Equivalent** | Structured command calls native `handoff` with optional instructions and owns a provider turn until native assistant/tool/permission/terminal events settle. |
-| `/follow-up` | **Equivalent** | Structured command sends native `follow_up` and owns a provider turn rather than publishing an immediate synthetic completion. |
-| Native steering | **Equivalent** | `delivery: steer` and `/steer` use native steering, correlate one user row, preserve active-turn ownership, and reject stale/terminal targets. |
-| Interrupt | **Equivalent** | Native abort, exactly-one terminal event, in-flight tool/child retirement, permission cleanup, and concurrent-close serialization are covered. |
-| Model selection | **Equivalent** | Catalog-backed opaque public IDs map to native provider/model IDs; committed state is re-read after open/configure/recovery. |
-| Thinking selection | **Equivalent** | Model-specific effort lists, defaults, runtime changes, invalid selections, and recovery are covered. |
-| Mode selection | **Equivalent** | `full`/`write`/`ask` map to `yolo`/`write`/`always-ask`; catalogs and opens expose interactive modes only when `permission` was negotiated, and live changes retain the bundled “new session” constraint. |
-| Retry fallback events | **Equivalent** | Fallback telemetry renders bounded status items and triggers committed model/thinking refresh without trusting event strings as state. |
-| Context and token usage | **Equivalent** | Periodic, post-compaction, fallback, terminal, timeout, and stale-generation samples publish `session.usage`. |
-| Native host tools | **Equivalent** | Paseo's caller-scoped MCP endpoint is converted to OMP host tools with workspace identity, progress, cancellation, bounded results, and ownership cleanup. |
-| Configured MCP servers | **Equivalent** | stdio/http/SSE transports are opened by the plugin host process, namespaced, paginated, bounded, and passed through OMP's native host-tool API. The agent-scoped MCP composer control invokes OMP's native management commands without copying its discovery or credential state. |
-| Subagents | **Equivalent** | Live lifecycle/progress/events create provider-owned child sessions; subscription failure removes the negotiated capability. |
-| Nested child timelines | **Equivalent** | Child/grandchild ancestry, stable IDs, live restart, cold transcript replay, terminal states, and cumulative replay bounds are covered. |
-| Conversation rewind | **Equivalent** | Only conversation scope is advertised; active-turn/stale-token rejection and branch replay are tested. |
-| Native branch transition | **Equivalent** | New native IDs atomically replace persistence/reservation ownership; indeterminate post-branch failures close and quarantine the session. |
-| Custom executable command | **Equivalent** | Strict `providerOptions.command` replaces the executable prefix and survives recovery. |
-| Custom environment | **Equivalent** | Strict `providerOptions.env` is merged below launch env and survives recovery. Strict `providerOptions.inheritEnv` stores bounded names only and resolves unshadowed daemon values at catalog/session spawn. Unexpected or internal launch failures use fixed fallbacks rather than serializing launch configuration, while explicit public validation errors may include caller-supplied configuration names or values. |
-| Configured output redaction | **Equivalent** | `providerOptions.outputRedaction` defaults to `none`. `configured-values` performs bounded best-effort literal replacement for explicitly supplied credential values and every non-empty value selected through `inheritEnv`, regardless of its name, across root and nested timelines; generated, encoded, transformed, and independently streamed fragments remain outside its scope. |
-| Provider parameters | **Equivalent** | `sessionDir`, `rpcTimeoutMs`, and `smol`/`slow`/`plan` model roles map to native arguments and survive recovery; cold resume authorization scans the normalized configured `sessionDir`. |
-| Configured model replacement/additions | **Protocol** and **Equivalent** | Paseo applies profile `models` replacement and `additionalModels` overlays to the profile-specific plugin catalog. |
-| Generic denied tools | **Equivalent** | Core forwards a bounded, deduplicated `deniedTools` list; the plugin turns recognized OMP built-ins into an explicit launch allow-list before the process starts and rejects unknown names rather than silently under-enforcing. |
-| Strict provider option validation before launch | **Equivalent** | The provider registers `OmpProviderOptionsSchema`, including bounded `inheritEnv` names; core normalizes once and forwards the same names-only value through availability, cache identity, discovery, listing, and launch. |
-| Profile settings in provider discovery | **Equivalent** | Core forwards profile settings to catalog, cache-key, and session-list operations; the provider includes them in cache identity without claiming unsupported live OMP settings. |
-| Terminal-started OMP session hooks | **Unsupported** | The bundled terminal hook registry contains Claude, Codex, and OpenCode only; OMP exposes no registered terminal activity hook to preserve. |
-| Metadata-generation flows | **Protocol** and **Equivalent** | Generic structured generation selects plugin models from catalog metadata and creates non-persisted sessions; provider responses use the existing parse/validation retry loop. |
-
-The output boundary validates protocol shapes and bounds strings, structured values, depth, item counts, nodes, cumulative serialized bytes, and cycles. With the default `outputRedaction: "none"`, it does not heuristically redact or rewrite native OMP, model, tool, or permission content. The optional `configured-values` mode replaces exact configured credential literals on a best-effort basis, but it cannot detect generated secrets or encoded, transformed, or independently streamed fragments. Credentials therefore must not appear in prompts or tool output, and centralized Paseo policy is required for redaction guarantees. Unexpected or internal launch failures use fixed public fallbacks rather than serializing launch configuration, while explicit public validation errors may include caller-supplied configuration names or values.
-
-## Integration boundary tests
-
-The provider identity boundary is permanent: `server/provider/registration.ts` registers only `omp-plugin`, while diagnostics recognize both the bundled `omp` provider and this plugin. `tests/server-bundle.test.ts` verifies the packaged server contribution keeps that identity. No test removes, replaces, aliases, migrates, or assumes ownership of the bundled provider.
-
-Run the real Docker host/container ownership boundary test with:
-
-```sh
-npm run test:integration:docker
-```
-
-The script starts the MCP server as a host process, calls it from a Node container, executes a host tool, and verifies the returned host PID, host working directory, caller agent ID, and workspace ID. Set `PASEO_OMP_DOCKER_IMAGE` to override the default `node:22.22.1-bookworm-slim` image.
-
-Run the equivalent Windows-host/WSL boundary with:
-
-```sh
-npm run test:integration:wsl
-```
-
-The WSL script skips when `wsl.exe` or WSL Node is unavailable. Set `PASEO_OMP_REQUIRE_WSL=1` to make either condition fatal, as CI does. `PASEO_OMP_WSL_NODE` may override the default `node` executable inside WSL.
-
-Run the full local provider integration canary with:
-
-```sh
-npm run test:integration:canary
-```
-
-Set `PASEO_CANARY_OMP_VERSION` to exercise another pinned release. The local runner knows the SHA-256 values for every version in the compatibility matrix; an unlisted version requires explicit `PASEO_CANARY_OMP_SHA256_AMD64` and `PASEO_CANARY_OMP_SHA256_ARM64` values. It allocates isolated loopback ports, builds a version-specific image, waits for both services to become healthy, runs the deterministic provider scenarios, prints container logs on failure, and always removes its containers, volumes, and image namespace.
-
-The Linux real-OMP CI matrix downloads checksummed `omp-linux-x64` assets for OMP 17.2.15, 17.3.4, 18.0.11, 18.1.10, 18.1.15, 18.1.22, and 18.2.0, verifies each binary's pinned GitHub release SHA-256, and runs `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`. The historical entries are the four pre-floor releases with more than 4,000 downloads shown by npm for the seven days ending 2026-09-15; they are compatibility regression probes, not a support commitment. The remaining entries cover the supported floor, newest patch in that minor line, and current release. The test uses the real OMP binary and a local deterministic OpenAI-compatible model endpoint, including three sequential prompts on one native session, a Bash tool, and oversized-image transport.
-
-The controlled canary in `canary/compose.yml` successfully built the plugin into that official Paseo image, started the daemon, loaded `paseo-omp`, and completed runtime health, catalog/mode discovery, initial text, model switching, `autocompact`, `follow-up`, and the documented compact/handoff error collection. It then failed on the first Bash scenario because the later turn ended without request-correlated terminal ownership: `OMP terminal ownership could not be confirmed`. The subsequent image, MCP, permission, steering, interruption, persistence, subagent, Hub, usage, rewind, browser, and optional Ollama scenarios were not reached and remain unverified on Paseo 0.9.0-beta.1.
-
-## OMP RPC compatibility intake
-
-Treat every upstream `rpc-ui` change as explicit compatibility work. Do not widen a Zod schema with `passthrough`, `unknown`, or an optional field merely to accept a new frame.
-
-1. Open an issue with the [OMP RPC compatibility template](https://github.com/omercnet/paseo-plugins/issues/new?template=omp-rpc-compatibility.yml). Record exact OMP, plugin, Paseo daemon, and Paseo app versions; the negotiated protocol and capabilities; the smallest reproduction; and sanitized frame shapes. Never attach credentials, private paths, prompts, or transcripts.
-2. Reproduce against both the reported OMP revision and the pinned minimum-tested `omp/18.1.15` binary. Classify the change as additive optional, additive required, removed or renamed, type or semantic change, or negotiation change.
-3. Compare the affected ready, request, response, or event shape with the strict schemas in `server/provider/omp-rpc.ts`. Decide whether the plugin can support both contracts without ambiguity. A breaking contract requires an explicit compatibility decision and changelog entry, not silent coercion.
-
-Required drift is release-blocking. If OMP adds a mandatory frame, removes or renames a required method or field, or changes an existing field's meaning, keep the strict parser and make session startup or the active request fail visibly. Do not silently discard the frame, make the requirement optional, or route around negotiation. Resume release work only after both sides have an explicit compatible contract, fixtures, focused regressions, and a real-binary result.
-4. Add the changed frame to `tests/fixtures/fake-omp.ts`, then add a focused regression for acceptance, rejection, negotiation, cancellation, and bounds as applicable. Capability changes must cover both reciprocal negotiation and the absent-capability fallback. Typed approval drift must retain the generic extension-question path when `typedToolApprovals: 1` is not negotiated.
-5. Run `npm test -- tests/omp-rpc.test.ts tests/provider.test.ts`, `npm run test:coverage`, and `PASEO_OMP_REAL_E2E=1 npm test -- tests/provider.real.e2e.test.ts` with the candidate OMP binary.
-6. Update the minimum-tested version only after the real-binary job is pinned to that release and its SHA-256, the compatibility issue links the evidence, and the README, support matrix, CI job name, fixture version, and changelog agree.
-
-The plugin maintainer owns triage and adaptation. Escalate an isolated OMP implementation defect upstream and an isolated Paseo SDK or provider-protocol defect to Paseo, while keeping the cross-project regression in this repository.
-
-## Release publication
-
-`release-please.yml` creates GitHub releases and publishes every released plugin path to npm through trusted publishing. Stable versions use the `latest` distribution tag; prereleases use `next`. npm generates provenance from the GitHub Actions OIDC identity, and the workflow waits for registry propagation before succeeding.
-
-### Alpha release channel
-
-`release-please-config.json` sets only `paseo-omp` to `prerelease: true` with `prerelease-type: alpha`. With the existing `initial-version: 0.1.0` and manifest version `0.0.0`, the first release PR is expected to prepare `0.1.0-alpha.1`, tag it as `paseo-omp-v0.1.0-alpha.1`, and mark the GitHub release as a prerelease. Other monorepo components keep their existing stable release behavior.
-
-Do not manually edit `paseo-omp/package.json` or `.release-please-manifest.json` before that release PR; Release Please must update both atomically. After alpha validation, remove `prerelease` and `prerelease-type` from the `paseo-omp` package config and let Release Please prepare stable `0.1.0`. Never retag an alpha commit as stable.
-
-The go/no-go criteria, manual acceptance boundary, and alpha limitation list are maintained in [docs/alpha-release-checklist.md](docs/alpha-release-checklist.md). Preparation does not authorize a push, tag, GitHub release, or publication; explicit maintainer approval after testing is required.
-
-## Audit verification
-
-- `npm run check`: clean.
-- `npm run typecheck`: clean.
-- `npm test`: full Vitest suite passed, with environment-gated scenarios skipped when their runtimes were unavailable.
-- `npm test -- tests/provider-conformance.test.ts`: host-boundary conformance coverage includes `prompt.command`, `session.configure`, typed and fallback permission allow/deny/cancel paths, registry-driven reload/removal, verified stubborn-descendant cleanup, and sequential turns plus interrupt races with post-turn barriers.
-- `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`: the installed matrix version's catalog and hermetic real-binary text/Bash and oversized-image scenarios run against a local deterministic model.
-- `npm run test:coverage`: Vitest enforces aggregate 85% function and 89% line coverage over loaded source modules. Generated `dist/**` trees are excluded.
-- `npm run test:integration:install`: npm package acquisition retains required production dependencies, and a fresh Git-style checkout runs frozen production-only preparation with lifecycle scripts disabled. Both installed trees resolve runtime dependencies, compile the client and server entries with Paseo's host compiler, and load the server contribution.
-- `npm run test:integration:docker`: verifies the host/container ownership boundary.
-- `npm run test:integration:wsl`: locally skips when `wsl.exe` is unavailable; Windows CI sets `PASEO_OMP_REQUIRE_WSL=1`, so this boundary remains required there.
-- `docker compose -f canary/compose.yml`: official Paseo 0.9.0-beta.1 image build, daemon startup, plugin load, and early deterministic scenarios passed; the smoke stopped at the first later-turn Bash scenario with `OMP terminal ownership could not be confirmed`, so the remaining scenarios are unverified.
-- `zizmor .github/workflows`: no findings (offline audit; six repository-wide suppressions remain).
-- Release Please 17.1.2 `config.json` and `manifest.json` schema validation: passed for `release-please-config.json` and `.release-please-manifest.json`.

package/docs/alpha-release-checklist.md

@@ -1,68 +0,0 @@
-# Alpha release checklist
-
-This checklist prepares `paseo-omp-v0.1.0-alpha.1`. It does not authorize publication. A maintainer must explicitly approve the tested package before any push, tag, GitHub release, or npm publication.
-
-## Release identity
-
-- [ ] Release Please proposes `0.1.0-alpha.1` from manifest version `0.0.0`.
-- [ ] Package and tag names are `@omercnet/paseo-omp` and `paseo-omp-v0.1.0-alpha.1`.
-- [ ] Provider identity remains `omp-plugin`; bundled `omp` remains independent and enabled or disabled by the user.
-- [ ] Paseo requirement remains the reviewed dual-version range, currently `>=0.8.0 <0.10.0`.
-- [ ] Minimum tested OMP version, checksum, CI job, README, SUPPORT, and TESTING agree.
-
-## Required gates
-
-- [ ] `npm run check`
-- [ ] `npm run typecheck`
-- [ ] `npm run test:coverage`; aggregate loaded-source coverage meets the configured threshold.
-- [ ] Real installed OMP regression against the documented minimum version.
-- [ ] `npm run test:integration:install`
-- [ ] `npm run test:integration:docker`
-- [ ] Windows/WSL host ownership job passes in CI.
-- [ ] Docker canary matrix passes on the exact release candidate.
-- [ ] GitHub Actions syntax and release-configuration schemas pass.
-
-## Required manual acceptance
-
-- [ ] Maintainer installs the exact `npm pack` candidate into the controlled official-Paseo Docker canary.
-- [ ] Maintainer verifies catalog, prompt, tools, configured MCP, permissions, steer, interrupt, import/resume, subagents, rewind, usage, Hub, and plugin surfaces.
-- [ ] Maintainer confirms the known limitations are acceptable for alpha.
-- [ ] Maintainer explicitly authorizes publication after testing. Silence or prior approval for development is not release authorization.
-
-## Alpha blocker
-
-- [x] `omp-audit.1`: incomplete or compacted `agent_end` frames recover success, failure, or native cancellation from complete streamed `message_end` evidence, or from bounded history whose entry IDs correlate with the streamed turn. Idle state is confirmed before and after retrieval, and concurrent interrupts remain authoritative. Missing, unavailable, non-correlatable, or conflicting terminal evidence fails closed with content-free count diagnostics.
-
-## Accepted alpha limitations
-
-These may remain only when called out in `SUPPORT.md`, `CHANGELOG.md`, and the GitHub prerelease notes:
-
-- Native Fast mode is not exposed.
-- No first-class plan mode; `/handoff` depends on native OMP prerequisites not reproduced by the deterministic canary.
-- Terminal-started OMP sessions are importable but are not registered automatically.
-- Large skill-body presentation has no dedicated provider regression.
-- OMP RPC stdout contamination is structurally mitigated but requires upstream channel purity.
-- `omp` and `omp-plugin` do not share ownership, configuration, or persisted handles.
-- The deterministic model does not implement OMP compaction summarization; protocol fixtures cover compaction behavior.
-- The tiny Ollama model is exploratory and is not a deterministic oracle.
-
-## Non-blocking post-alpha cleanup
-
-- [ ] `omp-maintenance.1`: remove `ProviderRegistrationCompat`, both `ProviderCatalogOptionsCompat` declarations, and `parseProviderInputCompat` after the published `@getpaseo/plugin` types natively expose the registration hooks and request fields they bridge. The required upstream surface is `providerOptionsSchema`, `getCatalogCacheKey`, `checkAvailability`, catalog/session-list `providerOptions` plus `settings`, and session-open `deniedTools`. This is type/compatibility cleanup only; it must not change provider behavior and does not block alpha.
-
-## Release notes
-
-The prerelease notes must include:
-
-1. Alpha support statement and compatibility range.
-2. Permanent side-by-side `omp-plugin` identity.
-3. Provider SDK capability percentage and link to the README matrix.
-4. Link to the deduplicated [core-provider issue audit](core-provider-issue-audit.md).
-5. Verification totals from the exact release commit.
-6. Known limitations above, including the distinction between supported MCP host tools, unsupported exact `toolPolicy`, and native-only `disallowedTools`.
-7. Install, upgrade, rollback, support, and security-reporting links.
-8. Artifact provenance verification command.
-
-## Publication boundary
-
-Release Please may prepare metadata. Publication must use npm trusted publishing from the immutable release commit. Never retag an alpha commit as stable.

package/docs/configuration.md

@@ -1,126 +0,0 @@
-# Configuration
-
-Open the global **OMP** sidebar to browse and edit machine-wide state, or open the workspace **OMP** panel from the workspace tab or Explorer to manage project-scoped state. Scalar edits in the global surface use OMP's native `config set` and `config reset` commands. Workspace edits create validated overrides in `<workspace>/.omp/config.yml`; removing an override restores the effective global or default value. Arrays, records, and credentials remain read-only in both surfaces.
-
-The **Plugin** tab documents the supported `omp-plugin` launch options, including names-only inherited environment configuration. Paseo's public plugin API does not expose the effective provider options for active launches, so the tab does not claim profile values are active. Choose **OMP Plugin** when creating an agent. Model, mode, thinking level, system prompt, persistence, MCP servers, workspace, and agent environment use Paseo's standard provider controls.
-
-## Optional provider profile overrides
-
-Advanced launch overrides belong in an `omp-plugin` provider profile. The provider options schema is strict; unknown fields fail validation.
-
-```json
-{
-  "provider": "omp-plugin",
-  "providerOptions": {
-    "command": ["/opt/omp/bin/omp"],
-    "params": {
-      "sessionDir": "/var/lib/omp/sessions",
-      "rpcTimeoutMs": 60000,
-      "smolModel": "openai/gpt-5-mini",
-      "slowModel": "anthropic/claude-opus-5",
-      "planModel": "openai/gpt-5.4"
-    }
-  }
-}
-```
-
-| Option | Purpose |
-| --- | --- |
-| `command` | Complete OMP executable and argument prefix. |
-| `env` | Non-secret process overrides applied below the session launch environment. |
-| `inheritEnv` | Daemon environment variable names copied only when OMP starts. Values are never stored in the profile or displayed in the sidebar. |
-| `outputRedaction` | `none` (default) preserves native output. `configured-values` performs best-effort literal replacement only for explicitly supplied configured credential values from profile/session credential environment fields and configured MCP headers or environment. |
-| `params.sessionDir` | Native OMP session directory supplied through `--session-dir`. Used consistently by discovery, import, resume, and launch. |
-| `params.rpcTimeoutMs` | Startup, request, catalog, and availability timeout, from 1 ms through 10 minutes. |
-| `params.smolModel` | Native selector supplied through `--smol`. |
-| `params.slowModel` | Native selector supplied through `--slow`. |
-| `params.planModel` | Native selector supplied through `--plan`. |
-
-Paseo's generic provider profile fields remain available:
-
-| Profile field | Behavior |
-| --- | --- |
-| `models` | Replaces the discovered model list. |
-| `additionalModels` | Extends the discovered model list. |
-| `disallowedTools` | Restricts only the known native OMP built-ins accepted by this plugin. It becomes an explicit OMP allow-list; unknown names fail closed rather than being ignored. It does not filter MCP host tools. |
-| `paseoTools` | Enables or restricts which caller-scoped Paseo orchestration tools the daemon includes before they reach OMP as MCP host tools. |
-
-These options cover every plugin-specific launch value. Values that belong to an individual agent, including model, mode, thinking level, title, system prompt, MCP servers, persistence, and cwd, remain standard Paseo session fields rather than duplicate plugin options.
-
-## OMP-native plugins
-
-Open **OMP → OMP plugins** globally for user-scoped management, or use the workspace **OMP** panel to include project-scoped installations and effective project overrides. The manager uses OMP's documented singular `omp plugin` CLI and supports install, enable, disable, upgrade, and uninstall operations. Every state-changing action requires explicit confirmation; already-running OMP sessions are unchanged.
-
-Project-scoped lifecycle commands run from the selected workspace and use `--scope project`. Duplicate path installations that share one npm package identity remain read-only because OMP's lifecycle CLI addresses npm plugins by package name rather than installation path. Plugin configuration exposes schema metadata without returning current or default values. Non-secret scalar plugin settings can be set or deleted through write-only controls. Secret settings are presence-only and delete-only because OMP's CLI would otherwise expose a new secret through process arguments.
-
-The Configuration view links to the official OMP settings reference, value parsing and precedence guides, relevant category sections, and a small curated set of setting-specific anchors.
-
-
-## MCP tools, management, and policy boundary
-
-Configured MCP servers and Paseo's caller-scoped MCP tools are supported. The plugin discovers their schemas, assigns collision-safe OMP names, binds them before `session.ready`, forwards progress and terminal results, propagates cancellation, and renders calls with friendly labels.
-
-Use the **MCP** control beside the composer on an **OMP Plugin** agent to run OMP's native list, add, reload, test, authorize, enable, disable, resource, and prompt commands. The control is agent-scoped because OMP MCP discovery depends on both the active profile and the workspace directory. The global OMP sidebar remains a host-level health and settings surface; a separate workspace manager would duplicate OMP's own discovery and precedence rules.
-
-Command output, setup questions, and OAuth prompts appear in the agent timeline. OAuth URLs render as an interactive card and always retain the full provider authorization URL, never substituting OMP's daemon-local `/launch` shortcut. **Open in Paseo Browser** calls the current agent's caller-scoped `browser_new_tab` tool, so the authorization page becomes a browser tab in the same workspace; it requires Paseo tools to be injected into the agent, browser tools to be enabled, and a connected Paseo desktop browser host. **Open on this device** remains available when no browser host is connected. For a loopback callback to complete automatically, the chosen browser host must run on the daemon machine. Otherwise, finish authorization in either browser, copy the final redirect URL or authorization code, and submit it in the OMP authorization prompt. Tokens and refresh material are stored by OMP on the daemon (or its configured auth broker), never in the Paseo client or plugin timeline.
-
-Paseo's exact session `toolPolicy` preapproval grants are not equivalent to OMP's `set_host_tools` contract. The plugin cannot preserve that policy exactly, so any non-empty `toolPolicy` rejects session startup. It never converts exact grants into broader access. `disallowedTools` is separate: it controls only recognized native OMP built-ins and rejects unknown names.
-
-## Credentials and environment
-
-The plugin is deny-by-default. It inherits only its fixed built-in allowlist of core provider authentication variables plus exact names that an operator selects with `providerOptions.inheritEnv`; it does not discover or inherit arbitrary credential-shaped names. Prefer OMP's native credential store or auth broker whenever possible.
-
-For example:
-
-```json
-{
-  "provider": "omp-plugin",
-  "providerOptions": {
-    "inheritEnv": ["ACME_OMP_API_KEY"],
-    "outputRedaction": "configured-values",
-    "env": {
-      "ACME_OMP_REGION": "us-east-1"
-    }
-  }
-}
-```
-
-`inheritEnv` accepts an array of at most 256 names matching `[A-Za-z_][A-Za-z0-9_]{0,127}`. Selecting a name is an operator trust decision: its daemon-owned value becomes available to the OMP child and anything OMP launches. The plugin resolves selected values from the Paseo daemon environment immediately before each catalog or session launch. Unselected variables remain absent. Explicit `providerOptions.env` and per-session `env` overlays win over inherited values with the same name.
-
-Profiles, persistence, errors, and catalog cache identity contain only the configured `inheritEnv` names, never resolved values or secret-derived hashes. A selected variable that is present and not shadowed by explicit `env` must contain at least 4 UTF-8 bytes. The existing 64 KiB per-value and 1 MiB total environment bounds still apply; shadowed daemon values are neither validated nor counted.
-
-Process-control variables are always rejected case-insensitively, even when explicitly selected. The blocked prefix families are `BUN_INSTALL*`, `DYLD_*`, `GIT_CONFIG*`, `LD_*`, and `NPM_CONFIG_*`. The blocked exact names are:
-
-```text
-BASH_ENV, BUN_OPTIONS, CLASSPATH, CLAUDE_BASH_NO_CI, CLAUDE_BASH_NO_LOGIN,
-CLAUDE_CODE_SHELL_PREFIX, EDITOR, ELECTRON_RUN_AS_NODE, ENV, GEM_HOME, GEM_PATH,
-GIT_SSH_COMMAND, HOME, JAVA_TOOL_OPTIONS, NODE_OPTIONS, NODE_PATH,
-OMP_AUTORESEARCH_DB_DIR, OMP_COMMAND, OMP_GITHUB_CACHE_DB, OMP_PROFILE,
-OMP_WORKTREE_DIR, PATH, PATHEXT, PERL5LIB, PERL5OPT, PI_BASH_NO_CI,
-PI_BASH_NO_LOGIN, PI_CODING_AGENT_DIR, PI_CODING_AGENT_SESSION_DIR,
-PI_CONFIG_DIR, PI_CONFIG_FILES, PI_GIT_COMMON_DIR, PI_PACKAGE_DIR, PI_PROFILE,
-PI_PROJECT_DIR, PI_SESSION_ID, PI_SHELL_PREFIX, PI_SUBPROCESS_CMD,
-PI_WORKTREE_DIR, PWD, PYTHONHOME, PYTHONINSPECT, PYTHONPATH, PYTHONSTARTUP,
-RUBYLIB, RUBYOPT, SHELL, SYSTEMROOT, USERPROFILE, VISUAL, XDG_CACHE_HOME,
-XDG_CONFIG_HOME, XDG_DATA_HOME, XDG_RUNTIME_DIR, XDG_STATE_HOME, _JAVA_OPTIONS
-```
-
-Unlike `inheritEnv`, `providerOptions.env` stores its literal values in the provider profile/configuration. Use it only for deliberate non-secret overrides. If configuration contains sensitive values anyway, restrict `<paseo-home>/config.json` to the daemon account (`chmod 600` on POSIX), protect backups, and never attach it to an issue.
-
-The plugin validates and bounds native protocol data, but it does not heuristically detect, redact, or rewrite credentials in OMP, model, or tool content. Never put credentials in prompts or tool output. With `outputRedaction: "configured-values"`, every non-empty value selected through `inheritEnv` is treated as sensitive regardless of its name, alongside the existing explicitly configured credential values. Exact configured literals are replaced on a best-effort basis; generated secrets and encoded, transformed, or independently streamed fragments are not detected. With the default `none`, inherited values are not rewritten in output. Centralized Paseo policy is required for redaction guarantees. Unexpected or internal launch failures use fixed fallback messages rather than serializing the launch configuration, while explicit public validation errors may include caller-supplied configuration names or values.
-
-## Modes and permissions
-
-- `full` is always available.
-- `write` and `ask` appear when Paseo negotiates provider permission support.
-- Typed OMP approval frames become Paseo tool permissions when both sides negotiate `typedToolApprovals: 1`.
-- OMP 18.1.15 uses the bounded generic interaction fallback.
-- Changing approval mode requires a new session. Live model and thinking changes are supported.
-
-## Persistence and images
-
-Non-persisted sessions use `--no-session`. Persistent sessions keep a versioned native handle, replay before becoming ready, and recover with the effective launch configuration.
-
-For text-only models, image inputs are written to a private bounded temporary directory shared with the local OMP child and removed after the turn, session, or failed launch.
-
-Every OMP process launched by the plugin receives provider-owned `OMP_NO_WEBP=1` compatibility mode after caller environment validation, so generated and resized images use PNG or JPEG across Paseo clients without reducing the configured environment limits. Persisted or upstream WebP blocks are still retained: capable clients render them directly, while an unsupported client shows a per-image fallback instead of failing the timeline item.