open-multi-agent-kit 0.92.0 → 0.94.0

package/CHANGELOG.md

@@ -1,6 +1,43 @@
 # Changelog
 
-## [Unreleased]
+## [0.94.0] - 2026-07-27
+
+### Added
+
+- **`diagnostics` is now a default-active tool** for new sessions (LLM-callable alongside `read`/`bash`/`edit`/`write`). It stays registered-but-inactive for sessions that pin their own tool list; opt out per session via `activeToolNames` or `excludedToolNames`.
+- **Persistent skill-catalog cache** (`src/core/skills-catalog-cache.ts`): per-dir fingerprint walk (readdir/stat only) gates a JSON catalog at `<agentDir>/cache/skill-catalog-v1.json`. Repeat session starts skip all SKILL.md reads on unchanged trees (measured on this host: 105 ms cold → 41 ms warm for the full scan). Any add/edit/delete under a scanned tree invalidates exactly that dir; corrupt cache degrades to a clean miss. Atomic tmp+rename writes.
+- **Hermetic test environment** (`test/setup-env.ts`): machine-level `OMK_*` and provider credential variables are scrubbed before every worker, so test results no longer depend on the developer shell (safety-gate suites saw env-disabled gates; live e2e suites ran against expired credentials instead of skipping). `LIVE_E2E=1` keeps provider keys when running the live suites on purpose.
+- **`diagnostics` tool** (`src/core/tools/diagnostics.ts`): compiler-backed diagnostics via the project's own checkers — `tsc --noEmit`, `pyright`/`ruff`, `go vet`, `cargo check` — normalized to `SEVERITY path:line:col message`, per-language fail-soft (`skipped` instead of tool errors), 5 s TTL cache, 50-item cap, path/language auto-detect. Registered in `createAllToolDefinitions` and exported from the SDK (`createDiagnosticsTool`, `createDiagnosticsToolDefinition`).
+- **Interactive sandbox promotion**: `session.setBashSandboxMode("audit" | "enforce" | "off")` switches the session sandbox at runtime (next spawn), with a `sandbox_audit` mode-change ledger entry; `session.bashSandboxMode` reads the effective mode. `SessionBashRuntime.setSandboxMode` backs it.
+- **Default-on bash sandbox (opt-out).** Session bash now carries a default `audit`-mode sandbox preflight (workspace-write rooted at the session cwd, OS temp dir as extra write target). Spawns stay unwrapped but every decision lands in the replay ledger as a `sandbox_audit` event — a tamper-evident trail no other harness ships. `OMK_BASH_SANDBOX=enforce` activates the real OS backend (macOS `sandbox-exec` / Linux `bwrap`, auto-detected) and fails closed when unavailable; `=0` disables. New `onSpawnDecision` observer on `BashSandboxPreflight`, plus `createWorkspaceSandboxPolicy()` / `resolveBashSandboxMode()` SDK exports.
+- **Git-aware verified-bash scope.** Session bash receipts now bind the git toplevel plus the sorted dirty set (staged/modified/untracked, capped at 32 paths, 1 s TTL cache) instead of an empty artifact set, so `captureWorkspaceFingerprint` records HEAD and a scope-limited dirty digest. Exported as `resolveSessionWorkspaceScope()`.
+
+### Fixed
+
+- **API provider registry is now a process-wide singleton** (`globalThis`-anchored in `omk-ai/api-registry`). Symlinked workspace dist copies consumed natively and the same files inlined by vite-node used to keep separate registries, so `registerFauxProvider` (and any runtime registration) was invisible to streamers resolving through the other copy — surfacing as "No API provider registered for api: ..." in agent loops. Also removed a stale nested `packages/agent/node_modules/omk-ai` copy (0.92.0) that shadowed the workspace build.
+
+### Changed
+
+- **Extracted `SessionCompactionService`** (`src/core/session-compaction-service.ts`): the compaction state machine — capture/lock, barrier evaluation, emergency tail repair, provenance capture, transaction begin, envelope commit — moved out of `AgentSession` (5,271 → 4,911 lines), which now delegates through thin one-line wrappers. Transaction symbols import from `compaction/transaction.ts` directly so the `compaction/index.js` vi.mock pattern in suites keeps working.
+- **Extracted `SessionBashService`** (`src/core/session-bash-service.ts`): the full bash surface — `executeBash` (prefix/loadout/safety-floor/headless gate), `recordBashResult` with the streaming-deferral queue, `abortBash`, `flushPending` — moved out of `AgentSession`, which now delegates one line each. Ordering contract (queue while streaming, flush on turn end) is pinned by the bash-persistence suite.
+- **Extracted `SessionBashRuntime`** (`src/core/session-bash-runtime.ts`) from `AgentSession`: verified-evidence executor, default sandbox preflight (audit/enforce), git-aware workspace scope, and the receipt-bound bash orchestration (`executeVerified`) now live in one lazily-initialized unit; the session delegates. No behavior change.
+
+- **Verified bash is default-on (opt-out).** When an AgentSession has a replay ledger, LLM-callable `bash` and interactive/RPC `executeBash` bind through `executeVerifiedBash` (`executor: "bash-tool"`, receipts under `<sessionFile>.evidence`). Set `OMK_VERIFIED_BASH=0` for the legacy unverified path. Adapter gains `env`/`onData` fan-out and `createVerifiedBashOperations()` so session PI_* env and live streaming stay intact without import cycles. See [SDK — Evidence](docs/sdk.md#evidence-and-verification) and [Environment Variables](docs/environment-variables.md).
+
+## [0.93.0] - 2026-07-26
+
+### Added
+
+- Ported upstream Pi 0.82.0 bash session environment: the LLM-callable bash tool now receives `PI_SESSION_ID`, `PI_SESSION_FILE`, `PI_PROVIDER`, `PI_MODEL`, and `PI_REASONING_LEVEL` (parent-env spoofing is stripped; disable per tool via `createBashTool(cwd, { exposeSessionEnvironment: false })`). See [Environment Variables](docs/environment-variables.md).
+- Ported upstream Pi 0.82.0 `bash_execution_update` session events: direct RPC `bash` commands stream output chunks correlated with the command `id`. See [RPC](docs/rpc.md).
+- Ported upstream Pi 0.81.1/0.82.0 summarization resilience: compaction and branch-summary calls now follow `retry` settings with exponential backoff (new `summarization_retry_scheduled` / `summarization_retry_attempt_start` / `summarization_retry_finished` session events, surfaced in TUI and RPC), run with prompt caching disabled, and use fresh routing session IDs. See [Compaction](docs/compaction.md).
+- Ported upstream Pi 0.82.0 abortable provider retries in `omk-ai`: SDK-level retries are replaced by `retryProviderRequest` with abortable backoff sleeps, retry-after caps now fail fast instead of clamping, and transient DNS/transport errors are classified retryable.
+- Subagent capability enforcement: agent frontmatter may declare `skills`/`mcp`/`hooks` plus `enforceCapabilities: true` to spawn with `--no-skills` + resolved `--skill` paths; `enforceCapabilities` now correctly parses YAML booleans/numbers/strings (`parseEnforceFlag`), the skill catalog scan skips archived corpus trees (e.g. `system-prompts-leaks`) so real skill names resolve to their real paths, and the MCP allowlist is synced to the live configured server set. Includes deterministic OMK-native domain profiles for the capability router and 16 coercion unit tests (`examples/extensions/subagent/agents.test.ts`).
+
+### Fixed
+
+- Fixed persisted compaction envelope validation rejecting every session compacted two or more times: the writer attests the kept-window slice from the previous compaction's `firstKeptEntryId`, but reopen validation required the full parent branch, so any twice-compacted session crashed on open with `Invalid compaction envelope source`. Validation now accepts either exact form (tamper-evidence unchanged); regression tests in `test/session-file-compaction-window.test.ts`.
+- Ported upstream Pi 0.82.0 clipboard fix: await `wl-copy` exit status and fall through to xclip/OSC 52 on failure instead of claiming success fire-and-forget.
 
 ## [0.92.0] - 2026-07-23
 

package/README.md

@@ -15,7 +15,7 @@
 <p align="center">
   <a href="https://discord.com/invite/3cU7Bz4UPx"><img alt="Discord" src="https://img.shields.io/badge/discord-community-5865F2?style=flat-square&logo=discord&logoColor=white" /></a>
   <a href="https://www.npmjs.com/package/open-multi-agent-kit"><img alt="npm" src="https://img.shields.io/npm/v/open-multi-agent-kit?style=flat-square" /></a>
-  <a href="https://github.com/dmae97/omk/releases/tag/v0.92.0"><img alt="Release" src="https://img.shields.io/badge/release-v0.92.0-00d7ff?style=flat-square" /></a>
+  <a href="https://github.com/dmae97/omk/releases/tag/v0.94.0"><img alt="Release" src="https://img.shields.io/badge/release-v0.94.0-00d7ff?style=flat-square" /></a>
 </p>
 
 > New issues and PRs from new contributors are auto-closed by default. Maintainers review auto-closed issues daily. See [CONTRIBUTING.md](https://github.com/dmae97/open-multi-agent-kit/blob/v0.90.4/CONTRIBUTING.md).
@@ -43,7 +43,7 @@ This feature release moves footer resource metrics to whole-machine telemetry, s
 | AdaptOrch | `omk-adaptorch-wpl` promoted to stable as a CLI runtime dependency; opt-in global-only `adaptorchBridge` advisory hints for the auto thinking-level resolver (default off). |
 | Providers | New built-in subscription providers under `/login`: Qwen (Qwen Code Subscription) and Grok (xAI OAuth Proxy). |
 
-GitHub-focused release notes live in [RELEASE_NOTES_v0.92.0.md](https://github.com/dmae97/omk/blob/v0.92.0/.github/RELEASE_NOTES_v0.92.0.md). The GitHub release workflow also extracts the canonical release body from [packages/coding-agent/CHANGELOG.md](https://github.com/dmae97/omk/blob/v0.92.0/packages/coding-agent/CHANGELOG.md).
+GitHub-focused release notes live in [RELEASE_NOTES_v0.94.0.md](https://github.com/dmae97/omk/blob/v0.94.0/.github/RELEASE_NOTES_v0.94.0.md). The GitHub release workflow also extracts the canonical release body from [packages/coding-agent/CHANGELOG.md](https://github.com/dmae97/omk/blob/v0.94.0/packages/coding-agent/CHANGELOG.md).
 
 ## Release v0.90.8
 

package/dist/core/agent-session.d.ts

@@ -12,10 +12,10 @@
  *
  * Modes use this class and add their own I/O layer on top.
  */
-import { type Agent, type AgentEvent, type AgentMessage, type AgentState, type AgentTool, type ThinkingLevel } from "omk-agent-core";
+import type { Agent, AgentEvent, AgentMessage, AgentState, AgentTool, ThinkingLevel } from "omk-agent-core";
 import type { ImageContent, Model, TextContent } from "omk-ai";
 import type { ReplayLedgerManager } from "../guardrails/evidence-system.ts";
-import { type BashResult } from "./bash-executor.ts";
+import type { BashResult } from "./bash-executor.ts";
 import { type CompactionResult } from "./compaction/index.ts";
 import { type ContextCacheInvalidationSnapshot } from "./context-budget-v2-cache-invalidation.ts";
 import { type ContextUsage, type ExtensionCommandContextActions, type ExtensionErrorListener, type ExtensionMode, ExtensionRunner, type ExtensionUIContext, type InputSource, type ReplacedSessionContext, type SessionStartEvent, type ShutdownHandler, type ToolDefinition, type ToolInfo } from "./extensions/index.ts";
@@ -86,6 +86,25 @@ export type AgentSessionEvent = Exclude<AgentEvent, {
     success: boolean;
     attempt: number;
     finalError?: string;
+} | {
+    type: "bash_execution_update";
+    id?: string;
+    delta: string;
+} | {
+    type: "summarization_retry_scheduled";
+    attempt: number;
+    maxAttempts: number;
+    delayMs: number;
+    errorMessage: string;
+} | {
+    type: "summarization_retry_attempt_start";
+    source: "branchSummary";
+} | {
+    type: "summarization_retry_attempt_start";
+    source: "compaction";
+    reason: "manual" | "threshold" | "overflow";
+} | {
+    type: "summarization_retry_finished";
 } | {
     type: "session_termination";
     termination: SessionTermination;
@@ -170,6 +189,8 @@ export interface ExtensionBindings {
 }
 interface ExecuteBashOptions {
     excludeFromContext?: boolean;
+    /** Optional identifier echoed in `bash_execution_update` events (RPC request correlation). */
+    id?: string;
     operations?: BashOperations;
     safetyGate?: "headless";
     /** Trusted internal/test override for local bash sandboxing. */
@@ -268,10 +289,9 @@ export declare class AgentSession {
     private _branchSummaryAbortController;
     private _retryAbortController;
     private _retryAttempt;
-    private _bashAbortController;
-    private _pendingBashMessages;
-    private _configuredBashSandboxPreflight;
-    private _detectedBashSandboxBackend;
+    private _refusedModels;
+    private readonly _bashService;
+    private readonly _compactionService;
     private _extensionRunner;
     private _turnIndex;
     private _resourceLoader;
@@ -301,6 +321,7 @@ export declare class AgentSession {
     private readonly _replayLedger;
     private readonly _replayGoalId;
     private readonly _replayLaneId;
+    private readonly _bashRuntime;
     private _transcriptRepair;
     private _sessionRiskLevel;
     private _workspaceMutationCount;
@@ -336,6 +357,8 @@ export declare class AgentSession {
     private _recordEvidenceReceiptInvalidation;
     private _sessionRevision;
     private _appendReplayEvent;
+    /** Lazy verified-bash executor bound to this session's replay ledger (default-on path). */
+    private _getVerifiedEvidenceExecutor;
     /** Append one required durable audit record. Persistence failures propagate. */
     private _appendRunJournalAudit;
     private _terminationMessage;
@@ -700,15 +723,7 @@ export declare class AgentSession {
      * Saves to settings.
      */
     setFollowUpMode(mode: "all" | "one-at-a-time"): void;
-    private _captureCompactionState;
-    private _captureCompactionStateLocked;
-    private _captureCompactionProvenance;
-    private _barrierError;
-    private _evaluateCompactionBarrier;
-    private _repairEmergencyCompactionTail;
-    private _priorCommittedCompactionSourceDigests;
     private _beginCompactionTransaction;
-    private _detailsWithCompactionEnvelope;
     private _commitCompaction;
     private _pendingToolResultReserve;
     private _compactionHysteresisConfig;
@@ -755,6 +770,13 @@ export declare class AgentSession {
      * Context overflow errors are NOT retryable (handled by compaction instead).
      */
     private _isRetryableError;
+    /**
+     * Retry policy + callbacks shared by compaction and branch-summary summarization calls.
+     * Uses the same `settings.retry` budget/backoff as agent-turn retries so a single transient
+     * stream drop no longer fails the whole operation. `source` carries the context
+     * the TUI needs to render the retry and recreate the underlying indicator.
+     */
+    private _summarizationRetryCallbacks;
     private _ejectStickySafetyModelIfNeeded;
     private _maybeFailoverFromSafetyStop;
     private _prepareRetry;