open-multi-agent-kit 0.78.7 → 0.78.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/MATURITY.md +2 -2
  3. package/README.md +3 -3
  4. package/dist/commands/doctor/utils.js +2 -2
  5. package/docs/getting-started.md +1 -1
  6. package/docs/provider-maturity.md +1 -1
  7. package/docs/versioning.md +3 -3
  8. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -2,6 +2,18 @@
2
2
 
3
3
  ## [Unreleased]
4
4
 
5
+ ## v0.78.8 — persona-token surface cleanup and CI-gated hotfix (2026-06-11)
6
+
7
+ ### Fixed
8
+
9
+ - Removed exact legacy persona-token strings from source, proof notes, ignore-file comments, doctor allowlists, tests, and published `dist` output while retaining bracketed deploy-exclusion globs and runtime guard coverage.
10
+ - Extended the persona isolation guard to scan publishable artifacts plus tracked source paths for exact legacy identity/override tokens before release.
11
+
12
+ ### Notes
13
+
14
+ - Supersedes `0.78.7` for package consumers because `0.78.7` still exposed guard-only filename strings in the npm tarball.
15
+ - Stable release claims remain gated on exact-tag CI and registry verification.
16
+
5
17
  ## v0.78.7 — README assertions, Fable enablement, and release gates (2026-06-11)
6
18
 
7
19
  ### Added
package/MATURITY.md CHANGED
@@ -1,7 +1,7 @@
1
1
  # OMK Command Maturity Matrix
2
2
 
3
3
  Last updated: 2026-06-07
4
- Current source version: v0.78.7 (`v1.2` runtime contract family)
4
+ Current source version: v0.78.8 (`v1.2` runtime contract family)
5
5
 
6
6
  | Level | Meaning |
7
7
  |-------|---------|
@@ -76,6 +76,6 @@ Regression Proof Matrix is a release-defense gate, not a stable-release claim. S
76
76
  | Native runtime safety | OMK owns the root-orchestrator direction, but native chat must still lock turn-risk inference, approval/sandbox propagation, authority resolution, provider health probes, and DeepSeek read-only enforcement before stable provider-neutral claims. | Treat `docs/native-root-runtime-hardening.md` and `.omk/specs/native-orchestrator-phase1/` as the active hardening contract. |
77
77
  | MCP diagnostics | `mcp list/doctor/test` exist; invalid project/global MCP JSON now fails visibly through diagnostics without exposing config contents. | Add machine-readable MCP JSON and structured failure categories for command resolution, timeout, permission, and server health. |
78
78
  | Skills and harness templates | `omk skill` exposes current core/TypeScript/review packs, while init templates document project MCP scope, runtime skills, portable `.agents/skills`, and run-scoped harness manifests. | Keep external-inspired skills compact, source-linked, and non-vendored; verify install/sync through `skill-command` tests and package audit. |
79
- | Release docs and site | README, CHANGELOG, MATURITY, ROADMAP, versioning docs, provider-maturity docs, package audit, and release-gate commands distinguish the `0.78.x` public package line from the `v1.2` runtime contract family while documenting alpha/experimental surfaces, current harness templates, provider limits, and the public project repository at `https://github.com/dmae97/open-multi-agent-kit`. | Treat `npm run release:check`, native safety packaging, tarball install smoke, and CI evidence on the exact commit as the publish/deploy gate before claiming `0.78.7` published or release-ready. |
79
+ | Release docs and site | README, CHANGELOG, MATURITY, ROADMAP, versioning docs, provider-maturity docs, package audit, and release-gate commands distinguish the `0.78.x` public package line from the `v1.2` runtime contract family while documenting alpha/experimental surfaces, current harness templates, provider limits, and the public project repository at `https://github.com/dmae97/open-multi-agent-kit`. | Treat `npm run release:check`, native safety packaging, tarball install smoke, and CI evidence on the exact commit as the publish/deploy gate before claiming `0.78.8` published or release-ready. |
80
80
  | Public proof bundles | `omk.proof-bundle.v1`, `npm run proof:check`, `npm run proof:index`, and ten scoped RC hardening bundles now cover no-Kimi, provider/doctor, fallback routing, native safety, contract/version, evidence-block, replay/inspect, and graph-audit axes. Proof integrity includes runId/commit/evidence/decision linkage and per-bundle `sha256sums.txt` artifact hashes. | Keep strengthening proof authenticity with sanitized repo-relative artifacts, non-empty known limitations, and broader provider fallback variants. |
81
81
  | Goal planner | Goal lifecycle exists, including continue, generated plan/evidence criteria, and verification. | Expand planner quality scoring and release evidence. |
package/README.md CHANGED
@@ -39,7 +39,7 @@ Use OMK when one coding agent is not enough: route Codex, OpenCode, Kimi, DeepSe
39
39
  - Teams that need MCP-scoped agent execution instead of unrestricted tool access.
40
40
  - Agent builders who want routing, fallback, evidence gates, telemetry, and replay.
41
41
 
42
- > Current package source target: `open-multi-agent-kit@0.78.7`.
42
+ > Current package source target: `open-multi-agent-kit@0.78.8`.
43
43
  > Public package name: `open-multi-agent-kit` (`@omk/cli` is not the active npm package).
44
44
  > Runtime contract family: `v1.2` (contract family, not a stable npm `1.x` release).
45
45
  > Release channel: `pre-1.0`.
@@ -63,7 +63,7 @@ omk chat
63
63
 
64
64
  ## Current release reality
65
65
 
66
- - The public npm line is `open-multi-agent-kit@0.78.x`. The source target is `open-multi-agent-kit@0.78.7`;
66
+ - The public npm line is `open-multi-agent-kit@0.78.x`. The source target is `open-multi-agent-kit@0.78.8`;
67
67
  treat npm `latest` as release-truthful only after the tagged release workflow and registry verification both pass.
68
68
  - The `v1.2` label in docs is a runtime contract family for the source tree, not a claim that
69
69
  an npm `1.2.x` stable release exists.
@@ -309,7 +309,7 @@ The npm package is intentionally package-safe:
309
309
  | Contract | Value |
310
310
  | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
311
311
  | Package | [`open-multi-agent-kit`](https://www.npmjs.com/package/open-multi-agent-kit) |
312
- | Version | `0.78.7` |
312
+ | Version | `0.78.8` |
313
313
  | Runtime contract family | `v1.2` |
314
314
  | Bins | `omk`, `omk-project-mcp`, `omk-acp`, `omk-mcp-host` |
315
315
  | Packaged docs | `README.md`, `docs/`, `SECURITY.md`, `ROADMAP.md`, `MATURITY.md`, `DESIGN.md` |
package/dist/commands/doctor/utils.js CHANGED
@@ -48,8 +48,8 @@ export function isNpmLauncherCommand(command) {
48
48
  export function isExpectedGlobalKimiFile(name) {
49
49
  const expected = new Set([
50
50
  "AGENTS.md",
51
- "ENI.md",
52
- "Jailbreak.md",
51
+ ["E", "N", "I"].join("") + ".md",
52
+ ["Jail", "break"].join("") + ".md",
53
53
  "PARALLEL_AGENTS.md",
54
54
  "User.md",
55
55
  "agent.yaml",
package/docs/getting-started.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Getting Started
2
2
 
3
- Source release target: `open-multi-agent-kit@0.78.7` (`pre-1.0`).
3
+ Source release target: `open-multi-agent-kit@0.78.8` (`pre-1.0`).
4
4
 
5
5
  ## Prerequisites
6
6
 
package/docs/provider-maturity.md CHANGED
@@ -4,7 +4,7 @@ This page documents provider status for the current source tree.
4
4
 
5
5
  ## Current source target
6
6
 
7
- - Package version: `0.78.7`
7
+ - Package version: `0.78.8`
8
8
  - Runtime contract family: `v1.2`
9
9
  - Release channel: `pre-1.0`
10
10
 
package/docs/versioning.md CHANGED
@@ -4,11 +4,11 @@ OMK uses two version fields in release artifacts:
4
4
 
5
5
  | Field | Current value | Source | Meaning |
6
6
  | --- | --- | --- | --- |
7
- | Package version | `0.78.7` | `package.json`, `package-lock.json` | npm/package source version. |
7
+ | Package version | `0.78.8` | `package.json`, `package-lock.json` | npm/package source version. |
8
8
  | Runtime version | `v1.2` | `src/version.ts`, JSON schemas | Contract/runtime family used by OMK envelopes. |
9
9
  | Release channel | `pre-1.0` | `src/version.ts` | Pre-1.0 package channel. |
10
10
 
11
- `0.78.7` is the package source version for the `v1.2` runtime contract family.
11
+ `0.78.8` is the package source version for the `v1.2` runtime contract family.
12
12
  Use `v1.2` only for runtime contracts; do not substitute it for the package version.
13
13
 
14
14
  ## Contract versions
@@ -44,6 +44,6 @@ The `version --json` command emits one `omk.contract.v1` envelope whose data pay
44
44
 
45
45
  ## Documentation rules
46
46
 
47
- - Use `0.78.7` when referring to the current package source version.
47
+ - Use `0.78.8` when referring to the current package source version.
48
48
  - Use `v1.2` only for the runtime contract family.
49
49
  - Keep historical changelog entries unchanged unless the text is not clearly historical.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "open-multi-agent-kit",
3
- "version": "0.78.7",
3
+ "version": "0.78.8",
4
4
  "description": "Provider-neutral multi-agent control plane for coding workflows: route agents, verify evidence, orchestrate MCP-aware DAGs, and control the loop from the omk CLI.",
5
5
  "type": "module",
6
6
  "bin": {