@polderlabs/bizar-omp 0.6.5 → 0.6.7

package/docs/releases/0.6.6.md

@@ -0,0 +1,27 @@
+# 0.6.6
+
+## Highlights
+- Dashboard overhaul: overview-first console with secondary Chat page, workspace-aware floating composer, and a unified searchable settings center with five tabs (General, Runtime, OMP config, Providers, Security). All 460 live OMP 18.2.7 settings exposed through a typed keyed config adapter with write round-trip and redaction.
+- Cross-session settings propagation: `watchOmbSettings` watches the directory holding `omb.json`; a setting change in the dashboard, another `omb agents` window, or `omp config set` is reflected in every open `omb agents` TUI within ~100 ms without restart. The daemon re-reads settings per request, so only the TUI needed the watcher.
+- Mobile chat navigation: the header Chat control reveals the console pane at narrow widths (`data-mobile-view`), `min-width:0` + `flex-wrap` eliminate horizontal overflow at every tested viewport (360/390/768/1024/1366/1920 px), `conversation-title` is an `<h2>` (one `<h1>` per page), and the header bar wraps below 1100 px.
+- Security tab Collab card: `GET /omp/collab` runs `omp collab list --json` and returns sanitized host records (instanceId, pid, sessionId, sessionName, cwd, model, startedAt, participants, relayConnected, access). The tab surfaces active collab hosts with provider/model, cwd basename, participant count, relay dot, and copy-id button. The "Refresh auth status" and "List auth methods" buttons in the same tab, previously dead, are now wired to `authAction(...)`.
+
+## Validation
+- 230/230 tests across 28 files.
+- `npm run typecheck`, `npm run build`, `npm run verify:package` (11 checks), `npm run verify:security` (276 files), `npm run pack:check` (759 files, 474.9 kB packed) all pass.
+- Cross-process propagation verified by separate OS processes (watcher imports `dist/omp/omb-settings.js`, daemon writes via `PATCH /settings`); A logged `mouseScrolling:false` ~100 ms after B's atomic temp+rename.
+- Packed-native gates pass against the published artifact: `npm run verify:omp` (`{"ok":true,"tools":8,"agents":8,"skills":8}`, packed install/repeat install/native discovery/profile isolation/uninstall PASS) and `npm run verify:omp:registry` (registry plugin install, native discovery, and doctor PASS at 0.6.6).
+- Live `GET /omp/collab` smoke against an isolated daemon: `{"hosts":[]}`, 401 without token, served HTML carries `id="collab-list"`, 96 unique DOM ids with zero duplicates.
+
+## Merged PRs
+- #63 `feat/dashboard-ux-fixes` (`cb90949`)
+- #64 `feat/settings-propagation` (`013ebe9`)
+- #65 `feat/collab-urls` (`b3b4d56`)
+
+## Release commit
+`a053a5d` (release: 0.6.6) on `main`. Tag `v0.6.6` points to this commit.
+
+## Deliberate limits in this release
+- `omp collab link` is not called from the dashboard (it rotates access tokens and is interactive). Link minting stays in the terminal.
+- Auth-broker writes remain terminal-only (`OMP_AUTH_ACTIONS = {"status","list"}`).
+- URL-type OMP settings are not duplicated into a second card; they stay editable in the existing typed OMP config tab.

package/docs/releases/0.6.7.md

@@ -0,0 +1,29 @@
+# 0.6.7
+
+## Highlights
+- `omb a` is now a shortcut for `omb agents` (same behaviour, identical output). `omb hub` and `omb a` are documented as aliases in the help text.
+- Interactive Ink progress panel for `omb update`: renders the update lifecycle (checking → downloading → installing) with stage indicators and a live outcome block. The panel fires only when stdout is a TTY and none of `--json`, `--check`, or `--dry-run` are set; text and JSON output are unchanged for scripts and CI.
+- Dashboard SSE chat stream: the daemon now serves `GET /sessions/:name/messages/stream` as a Server-Sent Events endpoint. The dashboard consumes it with `fetch` + `body.getReader()` (not `EventSource`, which cannot send the `Authorization` header the daemon requires). A connection-status pill shows live, connecting, polling, idle, and offline states. On stream failure the dashboard degrades to the previous 1.6 s journal poll.
+- New unauthenticated `GET /capabilities` route advertising `protocolVersion` and the `messages-stream` capability (same trust posture as `/ping`).
+- Daemon graceful-shutdown fix: `service.close()` now runs every active SSE cleanup callback (clearing poll/keepalive timers) and calls `server.closeAllConnections?.()` before awaiting `server.close()`, so a connected streaming client can no longer hold daemon shutdown open.
+
+## Validation
+- 248/248 tests across 29 files.
+- `npm run typecheck`, `npm run build`, `npm run verify:package`, `npm run verify:docs`, `npm run verify:security` (278 files) all pass.
+- Packed-native gate `npm run verify:omp` → `{"ok":true,"tools":8,"agents":8,"skills":8}` + `Packed install, repeat install, native discovery/tools, profile isolation and uninstall: PASS`.
+- Registry gate `npm run verify:omp:registry` → `Registry plugin install, native discovery, and doctor: PASS (@polderlabs/bizar-omp@0.6.7)`.
+- SSE snapshot test asserts the dashboard receives the `event: snapshot` payload within 2 s of `event: ready`; close-drain test asserts `service.close()` resolves while an SSE connection is still open.
+
+## Merged PRs
+- #66 `2eb9989` — `feat(cli): add omb a alias for agents view`
+- #67 `c32f259` — `feat(dashboard): stream session messages over SSE with RPC status`
+- #69 `c52805b` — `feat(cli): add interactive Ink progress UI for omb update`
+- #70 `37b0432` — `fix(docs): add 0.6.5 entry, correct 0.6.6 release notes`
+
+## Release commit
+- `7bb959b` (after merging #70, #66, #69, #67 into `a053a5d`)
+
+## Deliberate limits
+- `EventSource` is not used because it cannot send the `Authorization` header; the dashboard deliberately uses `fetch` + `body.getReader()`.
+- The Ink panel is opt-in (TTY + no `--json`/`--check`/`--dry-run`); non-interactive and CI environments keep the existing text/JSON output exactly as in 0.6.6.
+- No new runtime dependencies.

package/docs/releases/native-stable.md

@@ -1,3 +1,3 @@
 # Native release policy
 
-The package is releasable when typecheck, tests, packed-install qualification, and documentation checks pass against the supported OMP/Bun baseline. A GitHub release is created from an exact `v<version>` tag; npm publication uses trusted publishing. See npm-publishing.md for setup and 0.6.5.md for the current release notes. A passing release gate does not imply every native provider or worker route has been tested.
+The package is releasable when typecheck, tests, packed-install qualification, and documentation checks pass against the supported OMP/Bun baseline. A GitHub release is created from an exact `v<version>` tag; npm publication uses trusted publishing. See npm-publishing.md for setup and 0.6.7.md for the current release notes. A passing release gate does not imply every native provider or worker route has been tested.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar-omp",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Native oh-my-pi engineering workflow extension with typed evidence and serialized integration.",
   "type": "module",
   "engines": {
@@ -65,7 +65,9 @@
   },
   "dependencies": {
     "@trayjs/trayjs": "^0.0.10",
+    "gsap": "^3.15.0",
     "ink": "^7.1.1",
-    "react": "^19.3.0"
+    "react": "^19.3.0",
+    "yaml": "^2.9.1"
   }
 }