oh-my-opencode 5.1.44 → 5.1.46

package/dist/oh-my-opencode.schema.json

@@ -9603,7 +9603,7 @@
     "git_master": {
       "default": {
         "commit_footer": false,
-        "include_co_authored_by": false,
+        "include_co_authored_by": true,
         "git_env_prefix": "GIT_MASTER=1"
       },
       "type": "object",
@@ -9616,7 +9616,7 @@
           ]
         },
         "include_co_authored_by": {
-          "default": false,
+          "default": true,
           "type": "boolean"
         },
         "git_env_prefix": {

package/dist/plugin/command-execute-before.d.ts

@@ -1,4 +1,5 @@
 import type { CreatedHooks } from "../create-hooks";
+import type { SkillMcpManager } from "../features/skill-mcp-manager";
 type CommandExecuteBeforeInput = {
     command: string;
     sessionID: string;
@@ -16,5 +17,7 @@ export declare function consumeNativeGoalCommandMarker(parts: CommandExecuteBefo
 export declare function createCommandExecuteBeforeHandler(args: {
     directory: string;
     hooks: CreatedHooks;
+    mcpManager?: SkillMcpManager;
+    notify?: (message: string) => void;
 }): (input: CommandExecuteBeforeInput, output: CommandExecuteBeforeOutput) => Promise<void>;
 export {};

package/dist/plugin/skill-context.d.ts

@@ -3,6 +3,7 @@ import type { OhMyOpenCodeConfig } from "../config";
 import type { BrowserAutomationProvider } from "../config/schema/browser-automation";
 import type { LoadedSkill } from "../features/opencode-skill-loader/types";
 import { collectDisabledSkillAliases } from "../features/opencode-skill-loader";
+import { type SkillDiagnosticSink } from "@oh-my-opencode/skills-loader-core/opencode-skill-loader/skill-provenance";
 export type SkillContext = {
     mergedSkills: LoadedSkill[];
     availableSkills: AvailableSkill[];
@@ -22,4 +23,5 @@ export declare function createSkillContext(args: {
         paths?: string[];
         urls?: string[];
     };
+    onDiagnostic?: SkillDiagnosticSink;
 }): Promise<SkillContext>;

package/dist/plugin/skill-security-notice.d.ts

@@ -0,0 +1,3 @@
+import type { PluginContext } from "./types";
+import type { SkillDiagnostic } from "@oh-my-opencode/skills-loader-core/opencode-skill-loader";
+export declare function showSkillSecurityNotice(ctx: Pick<PluginContext, "client">, message: string, category?: SkillDiagnostic["category"]): void;

package/dist/plugin-config/omo-config-chain.d.ts

@@ -4,6 +4,7 @@ export type OmoOpenCodeConfigView = {
     /** Where the view sits in its file (`[opencode].`, `profiles.<P>.`), so a diagnostic names the full key. */
     readonly keyPrefix: string;
     readonly path: string;
+    readonly scope?: "project" | "user";
 };
 export type OmoOpenCodeConfigChain = {
     readonly diagnostics: readonly (OmoConfigDiagnostic | OmoModelReferenceDiagnostic)[];

package/dist/skills/ast-grep/AGENTS.md

@@ -4,7 +4,7 @@
 
 ## OVERVIEW
 
-Vendored skill teaching agents ast-grep (`sg`) structural search/rewrite, plus a stdlib-Python helper CLI that wraps the `sg` binary. Vendoring pin in `SOURCE`: upstream `code-yeongyu/ast-grep-skill @ 3148c69` (ast-grep 0.45.0), "vendored as a sync; do not fork-drift". Earned this file: own executable surface (749-LOC helper + installers + smoke tests) and a no-fork-drift upstream contract that has no analogue elsewhere in `shared-skills`.
+Vendored skill teaching agents ast-grep (`sg`) structural search/rewrite, plus a stdlib-Python helper CLI that wraps the `sg` binary. Upstream pin in `SOURCE`: upstream `code-yeongyu/ast-grep-skill @ 3148c69` (ast-grep 0.45.0), "vendored as a sync; do not fork-drift". Earned this file: own executable surface (749-LOC helper + installers + smoke tests) and a no-fork-drift upstream contract that has no analogue elsewhere in `shared-skills`.
 
 ## STRUCTURE
 

package/dist/skills/browser/SKILL.md

@@ -18,29 +18,28 @@ one where a human is a single call away. Never substitute one engine for the oth
 the attached engine is not set up, run the onboarding script and tell the user its one remaining
 step.
 
-## Step 0 — which engine this session is allowed to use
+## Step 0 — inside OmO Desktop: everything above, plus the app's built-in browser
 
-When `OMO_BROWSER_ENGINE` is set (the OmO desktop app sets it for every session), it wins over the table above:
+When `OMO_BROWSER_ENGINE` is set (the OmO desktop app sets it for every session), everything above works exactly
+as in the terminal: `connectBrowserSkill()` for the user's own browser, `connectPipe()` / `connectCloakProfile()` /
+`connect()` for a browser of your own, with the same table to choose between them. The app adds one more option:
 
-| Value | What you do |
-|---|---|
-| `connected` | Use `connectBrowserSkill()` only. If the user's browser is not connected you get a "Connect your browser" error: relay it and stop. Never open another browser |
-| `builtin` | Do not call `connectBrowserSkill()`; use the app's in-app browser tools |
-| `none` | Do not do browser work. Say that agent browser access is off for this project |
-| unset | The table above, as before (terminal use) |
-
-While any engine is set, `loadOmowright()` returns a guarded library. The owned engine (`connectPipe`,
-`connectCloakProfile`, `connect`) and every other export that acts on a browser is refused, so the table above
-does not apply: do not look for a way around it, and tell the user what the session allows. Under `connected`
-the app sees what the browser is doing, and before a click, Enter or script that sends, posts, pays, orders,
-subscribes, deletes or closes an account, and before Enter in a message box, it asks the user first. A "No" fails the action with
-`BrowserActionDeclinedError`: report that, never retry it or go around it (`session.tool()` lets only reads
-through; `evaluate` is guarded too). If the user presses Stop, the next call throws `BrowserUserStoppedError`: tell
-the user browser use was stopped and start no new session this turn.
-
-The guard prevents mistakes by a cooperating agent. It is not a security boundary: code that imports the raw
-entry (`resolveOmowrightEntry()`) is not guarded, and a host without the `omo_browser_bridge` tool cannot show state or
-honor Stop, though questions are still asked.
+| Option | What it is | Use it when |
+|---|---|---|
+| `connectBuiltinBrowser()` | OmO's built-in browser for this thread: the tab the user sees beside the chat, which they can watch, take over and share | the user should see the page while you work, the task is QA of something in the app, or a sign-in the user should do themselves in a visible tab |
+
+```js
+const browser = await omowright.connectBuiltinBrowser()
+const [tab] = await browser.listTargets()
+const page = await browser.attachPage(tab.id)
+await page.goto(url)
+```
+
+It is an OmOWright connection like `connect()`. Work in few calls: take `page.snapshot()` once, act on its refs,
+and chain several actions in one eval cell (`page.locator(ref).fill()`, `.click()`, `.selectOption(value)`,
+`.setInputFiles(path)`), snapshotting again only after the page changed. It has one tab: navigate it rather than
+opening new ones. `BuiltinBrowserUnavailableError` permits another engine only for `unavailable`, `timeout`, or
+`invalid_grant`. For `user_stopped` or any other app refusal, stop browser work and report it; do not open another browser.
 
 ## Step 1 — load omowright and prove the stack
 
@@ -118,7 +117,7 @@ changing the extension's automation settings.
   out everywhere. No flow here needs it.
 - **`focused: false` by default.** The browser belongs to someone who is probably using it.
 - **One short, named session per task,** always stopped.
-- **Bot-scored or WAF targets go to the owned engine** (not while `OMO_BROWSER_ENGINE` is set: then say the site needs a browser the session does not allow). The attached engine's daemon enables console
+- **Bot-scored or WAF targets go to the owned engine**, in the terminal and inside OmO Desktop alike. The attached engine's daemon enables console
   capture on every tab it drives, which is a known automation signal; CloakBrowser through
   `connectCloakProfile()` is the stealth path.
 

package/dist/skills/browser/references/commands.md

@@ -98,17 +98,10 @@ Every refusal is a `BskRpcError` with the daemon's own `code`:
 | `invalid_params` | wrong option shape | fix the call, do not retry as-is |
 | `permission_denied` | `evaluate` on a tab outside the Agent Window, or a denied borrow | stop; the user said no |
 | `timeout` | the tool did not finish in its budget | read the page state before retrying once |
-| `user_aborted` | the user pressed Stop in the browser | stop the task and report; under `OMO_BROWSER_ENGINE` this surfaces as `BrowserUserStoppedError` and no session starts again this turn |
+| `user_aborted` | the user pressed Stop in the browser | stop the task and report |
 | `cdp_failed` | the page cannot be attached (restricted URL, DevTools open) | say which page and why |
 
-Typed errors under `OMO_BROWSER_ENGINE` (see SKILL.md Step 0):
-
-| Error | `code` | Meaning |
-|---|---|---|
-| `BrowserNotConnectedError` | `browser_not_connected` | the user's browser is not connected; ask them to connect it |
-| `BrowserEngineRefusal` | `browser_engine_none` / `browser_engine_builtin` / `browser_engine_unsupported` / `browser_tool_blocked` | this engine setting does not allow that call |
-| `BrowserActionDeclinedError` | `user_declined` | the user said no, or no question could be asked; do not retry |
-| `BrowserUserStoppedError` | `user_stopped` | the user stopped browser use |
+Inside OmO Desktop (`OMO_BROWSER_ENGINE` set), `connectBuiltinBrowser()` throws `BuiltinBrowserUnavailableError` (`code` `browser_builtin_unavailable`). Reasons `unavailable`, `timeout`, and `invalid_grant` mean the built-in browser is unavailable; `invalid_grant` includes a missing or unreadable token file. For `user_stopped` or any other app refusal, stop browser work and report it without opening another browser. Refresh uses the new grant's endpoint and token together; every other call behaves as in the terminal.
 
 Long calls can be cancelled: `const h = session.client.callWithHandle("tool.navigate", {...})`
 then `await session.client.cancel(h.rpcId)`.

package/dist/skills/browser/references/install.md

@@ -11,8 +11,7 @@ Three pieces. The onboarding script prepares all three; a human finishes exactly
 ## Inside the OmO desktop app
 
 The app installs the `bsk` CLI and starts its daemon itself, and keeps the daemon running when the app closes.
-Do not run `browser-install.mjs` there unless the doctor says the app's engine is missing; a session set to
-`OMO_BROWSER_ENGINE=builtin` or `none` never uses this skill's attached engine at all. `BSK_HOME` and `BSK_BIN`
+Do not run `browser-install.mjs` there unless the doctor says the app's engine is missing. `BSK_HOME` and `BSK_BIN`
 still decide where the CLI and daemon are found, here and everywhere else.
 
 ## Supported

package/dist/skills/browser/runtime/omowright/manifest.json

@@ -5,5 +5,5 @@
     "index.js": "d67d3a847fe0bbc43e824feded48b280890d31879538309e671cd5f671133995",
     "page-bundle.js": "bfd51e8383cf47200d57387bbbed258bce5a3a3d00c38fc108034d2888e23f0c"
   },
-  "stagedAtUtc": "2026-10-23T05:06:58.473Z"
+  "stagedAtUtc": "2026-10-25T01:01:55.641Z"
 }

package/dist/skills/browser/scripts/browser-doctor.mjs

@@ -19,7 +19,7 @@ const state = report.ready
 
 const REMEDIES = {
   ready: "Attached engine is live: const { connectBrowserSkill } = await import(omowrightEntry); const session = await connectBrowserSkill({ name: \"<task>\", focused: false })",
-  "no-cli": "Run node \"<skill-root>/scripts/browser-install.mjs\" — it installs the CLI, starts the daemon and registers the extension; then tell the user the single step it prints.",
+  "no-cli": "Run node \"<skill-root>/scripts/browser-install.mjs\". It installs the CLI, starts the daemon and registers the extension; then tell the user the single step it prints.",
   "no-daemon": "Run node \"<skill-root>/scripts/browser-install.mjs\" (it starts the daemon through `bsk status`), then re-run this doctor.",
   "no-extension": report.nextStep ?? "Register the extension with browser-install.mjs, then relay its human step to the user and re-run this doctor.",
   "choose-browser": `Do not install anything yet. First check your memory for the browser this user works in; if it names one of the candidates, re-run with --browser=<id>. Otherwise ask the user which browser they actually use (${report.identification.reason}), record the answer in memory, then run node "<skill-root>/scripts/browser-install.mjs" --browser=<id>.`,
@@ -47,7 +47,7 @@ if (process.argv.includes("--json")) {
   console.log(`state: ${state}`)
   console.log(`omowright: ${entry}`)
   console.log(`cli: ${report.cli.installed ? `${report.cli.bskBin} (${report.cli.version})` : "not installed"}`)
-  console.log(`daemon: ${report.daemon.running ? `running (${report.daemon.version}, protocol ${report.daemon.protocolVersion})` : `not running${report.daemon.error ? ` — ${report.daemon.error}` : ""}`}`)
+  console.log(`daemon: ${report.daemon.running ? `running (${report.daemon.version}, protocol ${report.daemon.protocolVersion})` : `not running${report.daemon.error ? ` - ${report.daemon.error}` : ""}`}`)
   console.log(`browser the user uses: ${summary.browser ? `${summary.browser.label} [${summary.browser.id}] (${summary.browser.reason})` : `not identified (${report.identification.reason})`}`)
   console.log(`candidates: ${summary.candidates.map((c) => `${c.id}${c.signals.length ? ` (${c.signals.join(", ")})` : ""}`).join(", ") || "none"}`)
   if (summary.registeredElsewhere.length > 0) console.log(`extension entries left in other browsers: ${summary.registeredElsewhere.join(", ")} (not removed automatically)`)