@polderlabs/bizar-omp 0.7.0 → 0.7.1

package/docs/development/contributing-and-releasing.md

@@ -0,0 +1,117 @@
+# Contributing and Releasing BizarHarness-OMP
+
+## Overview
+
+This runbook is the policy for human and agent contribution plus the local
+release process. It complements:
+
+- `AGENTS.md` — coding-agent authority rules.
+- `docs/development/ci-release-implementation-guide.md` — source-grounded
+  architecture and current CI/release flow.
+
+## Normal contribution
+
+A normal PR:
+
+1. Branches from current `main`.
+2. Has one logical change. Refactors are split from behavioural fixes.
+3. Adds tests that fail without the change and pass with it.
+4. Updates documentation alongside behaviour changes.
+5. Adds a CHANGELOG entry under `## [Unreleased]`.
+
+A normal PR MUST NOT:
+
+- Edit `package.json` version, `package-lock.json` root version,
+  `docs/compatibility/baseline.json -> package.version`,
+  `CHANGELOG.md` historical entries, or `docs/releases/native-stable.md`.
+- Create or push a `v*` tag.
+- Call `npm publish` or `gh release create`.
+- Mark a release as completed in the changelog.
+
+## Verification gates
+
+The contributor gate is `make check`:
+
+```sh
+make check        # typecheck + test + verify:package + verify:docs + verify:security
+make check-full   # check + verify:omp + release preflight (requires a qualified local OMP host)
+```
+
+The release gate is `make check-full` plus `node scripts/verify-release-state.mjs --strict-network`.
+
+## Release process
+
+The release is owned by `scripts/release.mjs`, which the maintainer invokes
+locally:
+
+```sh
+npm run release -- patch        # bumps 0.7.0 -> 0.7.1
+npm run release -- minor        # bumps 0.7.0 -> 0.8.0
+npm run release -- major        # bumps 0.7.0 -> 1.0.0
+npm run release -- 0.8.0        # explicit version (must be > current)
+npm run release -- preflight    # only runs the preflight gate
+npm run release -- 0.8.0 --dry-run   # reports the planned mutation without applying it
+```
+
+The orchestrator refuses to operate unless:
+
+- the working tree is clean,
+- the current branch is `main`,
+- the registry reports a version not greater than the local one,
+- the requested bump is greater than the current version,
+- the proposed tag does not already exist on the remote,
+- `CHANGELOG.md` contains a populated `[Unreleased]` section.
+
+It performs the following mutations in order:
+
+1. `npm version <target> --no-git-tag-version --ignore-scripts` so npm keeps
+   `package.json` and both lockfile root version fields consistent.
+2. Update `docs/compatibility/baseline.json -> package.version`.
+3. Promote `CHANGELOG.md ## [Unreleased]` to `## <version> — released <iso-date>`
+   and leave a fresh `## [Unreleased]` section behind.
+4. Generate `docs/releases/<version>.md` from the promoted changelog entry.
+5. Commit the bump as `chore: bump version to <version>`.
+6. Push `main` and `refs/tags/v<version>` atomically.
+
+The unified CI workflow (`.github/workflows/ci.yml`) generates its runtime
+matrices from `.github/ci-policy.json`, `package.json`, and the OMP
+compatibility source. PRs test every supported Node line; ordinary `main`
+pushes use one line. CI builds and uploads one package artifact, reuses it for
+native OMP qualification, and runs a stable `CI required` fan-in job. On a
+release commit, CI verifies the matching tag and strict release preflight,
+publishes the artifact to npm through Trusted Publishing and to GitHub
+Packages through `GITHUB_TOKEN`, verifies both registry copies, then creates
+the GitHub release with the tarball and receipt. Write credentials are scoped
+to the job that needs them.
+
+CI MUST NOT create tags, push to the repository, or run `npm version`. Tag
+creation is exclusively the local release script's responsibility.
+
+## Emergency override
+
+If CI is billing-blocked at the org level (the documented escape hatch for
+private repositories where trusted publishing cannot be attested), the
+operator:
+
+1. Bumps `package.json` and regenerates the lockfile.
+2. Packs: `npm pack --ignore-scripts`.
+3. Publishes: `NPM_CONFIG_PROVENANCE=false npm publish --ignore-scripts`.
+4. Tags the merge commit locally: `git tag vX.Y.Z <sha> && git push origin vX.Y.Z`.
+5. Creates the GitHub release manually.
+6. Records the override in the release notes and the audit log.
+
+## CHANGELOG discipline
+
+- One entry per PR under `## [Unreleased]`. Bullet points are imperative
+  mood: "Add", "Fix", "Refactor", "Remove".
+- Promote via `scripts/release.mjs`. Never hand-edit `## X.Y.Z` headings.
+- `## [Unreleased]` must have at least one entry, or the release script
+  refuses to proceed.
+
+## Compatibility updates
+
+OMP compatibility updates (changing `SUPPORTED_OMP.version` or
+`QUALIFIED_OMP_VERSIONS`) MUST go through `scripts/update-omp-compatibility.mjs`.
+The script does not bump the Bizar package version — that is the release
+script's responsibility. A compatibility update is followed by a release
+when the maintainer decides the new baseline should ship.

package/docs/development/omp-compatibility-update-guide.md

@@ -0,0 +1,117 @@
+# Updating OMP Compatibility
+
+This guide covers how to update the plugin's OMP compatibility markers when a
+new OMP version is released. It does **not** cover releasing a new version of
+BizarHarness-OMP itself — see `docs/development/contributing-and-releasing.md`
+for that process.
+
+## What changes
+
+The update script (`scripts/update-omp-compatibility.mjs`) updates:
+
+| File | What changes |
+|---|---|
+| `src/omp/compatibility.ts` | `SUPPORTED_OMP` version + commit; adds to `QUALIFIED_OMP_VERSIONS` |
+| `.github/workflows/ci.yml` | pinned `@oh-my-pi/pi-coding-agent@<version>` |
+| `.github/workflows/omp-compatibility.yml` | pinned `@oh-my-pi/pi-coding-agent@<version>` |
+| `docs/compatibility/baseline.json` | `omp.testedVersion`, `omp.testedCommit`, `omp.previouslyQualifiedVersions` |
+| `docs/compatibility/supported-surfaces.json` | `qualified[0]` (new version), inserts old version |
+| `README.md` | OMP version strings in text and inline links |
+| `skills/omp-native-development/SKILL.md` | qualification target fingerprint |
+| `skills/omp-native-development/references/accuracy-and-versioning.md` | qualification target + npm integrity |
+| `skills/omp-native-development/references/source-manifest.json` | current qualification block |
+
+The script **does not** bump the Bizar package version or touch `package.json`,
+`package-lock.json`, or `CHANGELOG.md`. Those are owned by the release
+orchestrator (`scripts/release.mjs`).
+
+## Prerequisites
+
+You need three values from the new OMP release:
+
+1. **Version tag** — e.g. `18.2.9`.
+2. **Release commit SHA** — the full 40-char git commit hash of the `can1357/oh-my-pi` tag.
+3. **npm integrity value** — the `sha512-…` string for the npm package at that version.
+
+To get the integrity value:
+
+```sh
+npm view @oh-my-pi/pi-coding-agent@<version> dist.integrity
+```
+
+To get the release commit, check the OMP repo's tag:
+
+```sh
+git ls-remote https://github.com/can1357/oh-my-pi.git refs/tags/<version>
+```
+
+Or look at `node_modules/@oh-my-pi/pi-coding-agent/.npm/package.json` after
+installing the new version — it contains the `repository.commit` field.
+
+## Running the update
+
+```sh
+node scripts/update-omp-compatibility.mjs \
+  --version 18.2.9 \
+  --commit 5e0fc867f8a58dfe8812b5e99b2e7b6a0313da6c \
+  --integrity sha512-...
+```
+
+The script exits with error if the target version is not strictly greater than
+the current `SUPPORTED_OMP.version` in `src/omp/compatibility.ts`.
+
+On success it prints a JSON summary:
+
+```json
+{
+  "ok": true,
+  "omp": { "from": "18.2.8", "to": "18.2.9", "commit": "5e0fc867…" },
+  "changed": ["src/omp/compatibility.ts", "docs/compatibility/baseline.json", "…"],
+  "packageVersion": "0.7.0"
+}
+```
+
+## After the update
+
+1. **Review the diff** — especially `src/omp/compatibility.ts` and
+   `docs/compatibility/baseline.json`. The `packageVersion` in the output
+   confirms which Bizar version the change was qualified against; it should
+   match the current `package.json` version.
+
+2. **Run the qualification gate** — with a local qualified OMP host:
+
+   ```sh
+   BIZAR_OMP_PACKAGE_ROOT=/path/to/18.2.9/node_modules/@oh-my-pi/pi-coding-agent \
+   BIZAR_OMP_BIN=/path/to/18.2.9/node_modules/.bin/omp \
+   npm run verify:omp
+   ```
+
+   If you don't have a local host yet, install one:
+
+   ```sh
+   mkdir -p /tmp/omp-host && cd /tmp/omp-host
+   npm install @oh-my-pi/pi-coding-agent@<version>
+   BIZAR_OMP_PACKAGE_ROOT=/tmp/omp-host/node_modules/@oh-my-pi/pi-coding-agent \
+   BIZAR_OMP_BIN=/tmp/omp-host/node_modules/.bin/omp \
+   npm run verify:omp
+   ```
+
+3. **Open a PR** with the compatibility changes. Use
+   `.github/PULL_REQUEST_TEMPLATE.md`. Add a CHANGELOG entry under
+   `## [Unreleased]` describing the OMP version bump.
+
+4. **Merge** — after CI passes, merge the PR. This does not trigger a
+   Bizar release; the compatibility update ships independently of the version
+   schedule.
+
+5. **Release when ready** — once the maintainer decides the new OMP baseline
+   should ship, run `npm run release -- <kind>` per
+   `docs/development/contributing-and-releasing.md`. The release script
+   references the now-current `SUPPORTED_OMP` and `QUALIFIED_OMP_VERSIONS`.
+
+## Rollback
+
+If the compatibility update causes problems, revert the PR branch. The
+`previouslyQualifiedVersions` list in `baseline.json` records all past tested
+versions; the test suite (`tests/install.test.ts`) pins specific OMP versions
+that must be updated alongside this script.

package/docs/releases/0.7.1.md

@@ -0,0 +1,15 @@
+# 0.7.1
+
+- Avoid redundant lockfile-only npm install during release preparation, which fails under project script-approval policy.
+- Generate and commit versioned GitHub release notes from the promoted changelog during release preparation.
+- Restructure CI into generated runtime matrices and validation, packaging, native qualification, release, and publication phases; publish verified release artifacts to npm and GitHub Packages with isolated permissions.
+- Make session actions generation-checked, show unhosted journals as liveness-unknown unless their native PID is confirmed, bind tmux recovery to native session identity, expose independent host/activity/outcome fields, and reject stale settings writes.
+- OMP compatibility bump: 18.2.8 → 18.2.11 (commit e415159).
+- CI/release migration (per `docs/development/ci-release-implementation-guide.md`): unified `.github/workflows/ci.yml` with verify / package-contract / bun-compatibility / release jobs; the release job is gated on the `chore: bump version to *` commit-message prefix and trusts an existing `v<version>` tag rather than creating one; legacy `immutable-tag.yml` and `release.yml` removed.
+- Local release orchestrator (`scripts/release.mjs` + `scripts/release-lib.mjs`) owns the version bump, lockfile regeneration, baseline.json, CHANGELOG `[Unreleased]` promotion, and the atomic push of `main` and `refs/tags/v<version>`. CI only verifies.
+- Preflight gate (`scripts/verify-release-state.mjs --strict-network`); immutable release-receipt generator (`scripts/create-release-receipt.mjs`); OMP-only compatibility updater (`scripts/update-omp-compatibility.mjs`) that no longer bumps the Bizar package version.
+- PR template (`.github/PULL_REQUEST_TEMPLATE.md`) and contributor runbook (`docs/development/contributing-and-releasing.md`).
+- Contract tests for the workflow (`tests/workflow-contract.test.ts`) and the release library (`tests/release.test.ts`).
+- OMP compatibility bump: 18.2.8 → 18.2.10 (commit `da58b16`).
+
+- OMP compatibility bump: 18.2.8 → 18.2.9 (commit 8cd6f8c6).

package/docs/releases/native-stable.md

@@ -1,3 +1,13 @@
 # Native release policy
 
-The package is releasable when typecheck, tests, packed-install qualification, and documentation checks pass against the supported OMP/Bun baseline. A GitHub release is created from an exact `v<version>` tag; npm publication uses trusted publishing. See npm-publishing.md for setup and 0.6.8.md for the current release notes. A passing release gate does not imply every native provider or worker route has been tested.
+The package is releasable when `make check:full` passes against the
+supported OMP/Bun baseline, `scripts/verify-release-state.mjs --strict-network`
+passes, and the local release script has run successfully.
+
+The current stable release is recorded in `package.json` (npm-published),
+`docs/compatibility/baseline.json -> package.version` (verified at every
+release), and the `v<version>` tag on `main`.
+
+The release script owns this pointer; do not hand-edit it. CI verifies it.
+
+See `docs/development/contributing-and-releasing.md` for the runbook.

package/docs/releases/npm-publishing.md

@@ -1,4 +1,4 @@
-# npm publishing
+# Package publishing
 
 Package: `@polderlabs/bizar-omp` (public). Repository remains private.
 
@@ -9,14 +9,33 @@ Configure the package's npm **Trusted Publisher** as:
 | Provider | GitHub Actions |
 | Organization or user | `PolderLabs` |
 | Repository | `BizarHarness-OMP` |
-| Workflow filename | `release.yml` |
+| Workflow filename | `ci.yml` |
 | Environment | Leave blank |
 | Allowed actions | Direct `npm publish` |
 
-The first release uses the authenticated maintainer CLI to create the package. After npm configuration, `.github/workflows/release.yml` uses GitHub-hosted runners, Node 24, npm 11.16.0, and `id-token: write`; no npm token secret is required. Do not use `npm whoami` to test OIDC: token exchange happens during publication.
+The repository is linked through `package.json#repository`. npm remains the public distribution registry. The unified `.github/workflows/ci.yml` release pipeline uses GitHub-hosted runners, a policy-selected Node line, npm `>=11.5.1`, and `id-token: write` in the npm publication job; no npm token secret is required. Do not use `npm whoami` to test OIDC: token exchange happens during publication.
 
-Release procedure: increment package/package-lock/baseline versions together, update notes, open a PR, pass CI, merge, then push an exact `vX.Y.Z` tag from main. The release job checks tag/version identity and main ancestry, typechecks, tests, verifies docs, and exercises the packed installer before publishing. Only the tag release job compares the rebuilt package with an existing registry version, so ordinary CI can contain post-release documentation changes. Published versions cannot be overwritten. A manual workflow dispatch must select an existing release tag.
+The same validated tarball is also published to GitHub Packages as
+`@polderlabs/bizar-omp`. The first GitHub package inherits this private
+repository's visibility and permissions. Its workflow job receives
+`packages: write` and uses `GITHUB_TOKEN`; no personal access token is stored
+as a repository secret. GitHub Packages consumers outside Actions need a
+Personal Access Token (classic) with package read access and a scoped npm
+registry entry such as:
+
+```ini
+@polderlabs:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
+```
+
+Keep the token in the user's environment, not in a committed `.npmrc`. Verify
+that the first package is linked to this repository and inherits its access
+permissions; organization policy can disable automatic inheritance. Do not
+change package visibility as part of an ordinary release.
+
+Release procedure: the operator runs `npm run release -- <kind|version>` locally (e.g. `patch`, `minor`, `0.7.1`). The local orchestrator (`scripts/release.mjs`) atomically increments `package.json`, regenerates the lockfile, updates `docs/compatibility/baseline.json -> package.version`, promotes the CHANGELOG `[Unreleased]` section, commits `chore: bump version to <version>`, and pushes `main` + `refs/tags/v<version>` atomically. CI never creates tags. The release pipeline discovers the tag at HEAD on `main`, runs strict release preflight, tests and qualifies one packed artifact, then publishes that artifact to both registries. Each publisher refuses to replace an existing version with different integrity. A partial registry failure is retried by rerunning CI after correcting the cause; the successful registry's immutable version is verified and retained. Published versions cannot be overwritten.
 
 The repository is private, so npm provenance is disabled; OIDC authentication still works. Do not advertise provenance for this release. If repository visibility changes, reevaluate provenance separately.
 
 Reference: [npm trusted publishing documentation](https://docs.npmjs.com/trusted-publishers/).
+GitHub's npm registry setup: [Working with the npm registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry).

package/docs/releases/support-matrix.md

@@ -4,7 +4,7 @@
 | --- | --- |
 | Node | 22.x and 24.x in CI |
 | Bun | 1.3.14 compatibility job |
-| OMP | 18.2.8 at release commit `5e0fc867f8a58dfe8812b5e99b2e7b6a0313da6c`; 18.2.7 remains regression-qualified |
+| OMP | 18.2.9 at release commit `8cd6f8c619e89e935b6c6c5c91f6a4d20f6d7a75`; 18.2.8 remains regression-qualified |
 | Install | `npx --yes @polderlabs/bizar-omp setup` is the supported full install; `omp plugin install <package-spec>` is extension-only and `omp plugin link <checkout>` is for development |
 | Security | Trusted in-process extension; native task isolation required for managed editing |
 | Workflow state | Journal v2 validation, candidate-bound acceptance, bounded inspection/projection, and offline evidence bundles are locally qualified; v1 state remains legacy input |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar-omp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Native oh-my-pi engineering workflow extension with typed evidence and serialized integration.",
   "type": "module",
   "engines": {
@@ -40,6 +40,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
+    "release": "node scripts/release.mjs",
     "verify:package": "npm run build && node scripts/verify-package.mjs",
     "verify:docs": "node scripts/check-generated-docs.mjs",
     "verify:security": "node scripts/check-secrets.mjs",

package/rules/oflow-gitlab.md

@@ -0,0 +1,6 @@
+# oflow GitLab rules
+- Treat `oflow` CLI JSON output as the only GitLab story-context surface; never call GitLab REST/GraphQL directly from Bizar work when an `.oflow` contract exists in the repository.
+- Refresh (`--refresh`) at session and mutation boundaries; cached reads are orientation only and never proof of current remote state.
+- Every remote GitLab write goes through `oflow plan -> approve -> apply -> verify`; a runtime MCP server does not bypass the gates.
+- If a refresh fails, stop remote mutations; report the failure instead of planning against stale data.
+- Never read, copy, or persist the oflow GitLab token; it lives outside the repository by design.

package/skills/oflow-gitlab-context/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: oflow-gitlab-context
+description: Use the oflow CLI as the GitLab story-context and guarded-write layer for Bizar work in repositories that carry an .oflow contract. Covers session rhythm (work --mine, sync --summary, cached reads), story context and acceptance evidence, and the plan -> approve -> apply -> verify mutation gates. Trigger when the repository has .oflow/WORKFLOW.md, the task mentions GitLab stories/iterations/boards, or a Bizar objective needs current remote planning truth as acceptance evidence.
+---
+# oflow GitLab context
+
+`oflow` is a host-neutral CLI that turns GitLab planning data into compact
+agent context and guards every remote write. OMP hosts discover its contract
+through the managed `.omp/AGENTS.md` bridge and `/oflow-*` commands that
+`oflow install` writes. This skill uses the CLI; it never talks to GitLab HTTP
+directly.
+
+## Session rhythm
+
+1. At a session or mutation boundary, refresh: `oflow work --mine --refresh
+   --json` and `oflow sync --summary --refresh --json`.
+2. While exploring, read cache only: `oflow work --mine --cached --json` and
+   `oflow sync --summary --cached --json`. A cache miss for the exact query
+   returns an error, never a different snapshot.
+3. Load focused evidence only when needed: `oflow context --story <iid> --json`
+   and `oflow assess --story <iid> --json`.
+4. After any apply, refresh again before planning the next change.
+
+If a refresh fails, continue local analysis but never apply a remote mutation;
+cached data is orientation, not proof of current remote state.
+
+## Writes
+
+Every supported remote write goes through `oflow plan <op> ...`, `oflow approve
+<plan-file>`, `oflow apply <plan-file>`, `oflow verify --plan <plan-file>`.
+Plans capture target state and `updated_at` preconditions; apply re-reads the
+target immediately before writing and refuses to overwrite a newer change.
+MCP tools, if the runtime has a GitLab MCP server, do not bypass these gates.
+
+## Evidence for Bizar
+
+Use `oflow verify --story <iid> --json` as host-observed acceptance evidence
+when an objective's criteria reference GitLab delivery state: it checks
+acceptance evidence lines and the latest successful pipeline matching the MR
+head SHA. Report the command and its output digest; do not paraphrase GitLab
+state from memory.
+
+## Boundaries
+
+- The token lives in the user's oflow config directory, never in the repo.
+- The GitLab MCP endpoint (`/api/v4/mcp`) needs the fine-grained
+  `MCP tool: Execute` permission; without it the endpoint answers
+  `403 insufficient_granular_scope`. oflow's own reads never require it.
+- `oflow` does not push source code; repository work still flows through git.

package/skills/omp-native-development/SKILL.md

@@ -9,7 +9,7 @@ Treat this skill as a source-grounded engineering procedure, not an assertion of
 
 ## Establish the target before implementing
 
-Read [accuracy-and-versioning.md](references/accuracy-and-versioning.md) first. The current qualification target is `can1357/oh-my-pi` v18.2.8 at commit `5e0fc867f8a58dfe8812b5e99b2e7b6a0313da6c`; OMP 18.2.6, 18.2.5, and 18.2.4 remain separately tested compatibility versions. The bundled research corpus remains pinned to main commit `dbf3afad4894bde827d90f965e77b3fe1c5a95e5`, dated 2026-09-17, and must not be presented as the current release source.
+Read [accuracy-and-versioning.md](references/accuracy-and-versioning.md) first. The current qualification target is `can1357/oh-my-pi` v18.2.9 at commit `8cd6f8c619e89e935b6c6c5c91f6a4d20f6d7a75`; OMP 18.2.6, 18.2.5, and 18.2.4 remain separately tested compatibility versions. The bundled research corpus remains pinned to main commit `dbf3afad4894bde827d90f965e77b3fe1c5a95e5`, dated 2026-09-17, and must not be presented as the current release source.
 
 Record the developer's actual OMP package version, lockfile/integrity, source commit when available, Bun version, execution mode, profile, cwd, and relevant settings. Never print secrets. Verify the exact exports and behavior of that target, rather than assuming these snapshots apply unchanged. A missing environment or unrun test means UNKNOWN or NOT RUN, never PASS.
 

package/skills/omp-native-development/references/accuracy-and-versioning.md

@@ -18,7 +18,7 @@ Separate five kinds of statement: DOCUMENTED, SOURCE-OBSERVED, TESTED, PROPOSED
 
 ## Target fingerprint
 
-Current qualification target: `v18.2.8@5e0fc867f8a58dfe8812b5e99b2e7b6a0313da6c`, npm integrity `sha512-I8JXVNLJb8PfGS6mRGSKNq73+EX+R/GoaRBoMj8HTtOiwF112QXH72UP2klTwoCiR2gTsACbAIWjD0JdrR3A3g==`.
+Current qualification target: `v18.2.9@8cd6f8c619e89e935b6c6c5c91f6a4d20f6d7a75`, npm integrity `sha512-VnU6Udlp9sjmZI2WuwIJmKV2MP3Y1sCkwES2Yiq9MAhlSlLLRhXIx2Ijn2I1nHtYur9WoU/OQGvjN8+FH3Z9xg==`.
 Previous compatibility targets: `v18.2.6@78b753124d11f8dd3ae73e2524125890ff7c977e`, `v18.2.5@37273117021129e96bd05d8277b140ec3fd61990` and `v18.2.4@1c0303b1f2ec515cbf4b44a9a49d68a029531aac`.
 Research source: `can1357/oh-my-pi@dbf3afad4894bde827d90f965e77b3fe1c5a95e5`; it remains a source/documentation corpus pin, not a claim about the current package release. Compare artifacts/commits, not just a semver string.
 

package/skills/omp-native-development/references/source-manifest.json

@@ -5,9 +5,9 @@
   "reference_date": "2026-09-17",
   "docs_tree_sha": "c0055f49ceb172ff6da9490cf74773e9b187966b",
   "current_qualification": {
-    "tag": "v18.2.8",
-    "commit": "5e0fc867f8a58dfe8812b5e99b2e7b6a0313da6c",
-    "npm_integrity": "sha512-I8JXVNLJb8PfGS6mRGSKNq73+EX+R/GoaRBoMj8HTtOiwF112QXH72UP2klTwoCiR2gTsACbAIWjD0JdrR3A3g==",
+    "tag": "v18.2.9",
+    "commit": "8cd6f8c619e89e935b6c6c5c91f6a4d20f6d7a75",
+    "npm_integrity": "sha512-VnU6Udlp9sjmZI2WuwIJmKV2MP3Y1sCkwES2Yiq9MAhlSlLLRhXIx2Ijn2I1nHtYur9WoU/OQGvjN8+FH3Z9xg==",
     "qualification": "Runtime-qualified by the Bizar packed-install contract; the bundled docs/source inventory remains pinned to the research commit below."
   },
   "comparison_release": {

package/dist/src/cli/agents-ink.d.ts

@@ -1,25 +0,0 @@
-import { type OmbSessionInfo } from "../omp/omb-sessions.js";
-import type { OmbSettings } from "../omp/omb-settings.js";
-export type AgentsHubAction = {
-    type: "quit";
-} | {
-    type: "attach";
-    session: OmbSessionInfo;
-} | {
-    type: "new";
-    projectCwd: string;
-    task: string;
-    sessionId: string;
-} | {
-    type: "rename";
-    session: OmbSessionInfo;
-    nextId: string;
-} | {
-    type: "delete";
-    session: OmbSessionInfo;
-    nextSessionName?: string;
-} | {
-    type: "settings";
-    settings: OmbSettings;
-};
-export declare function runInkAgentsHub(cwd: string, env: NodeJS.ProcessEnv, sessions: OmbSessionInfo[], settings: OmbSettings, initialSelectedName?: string, openNewSession?: boolean): Promise<AgentsHubAction>;