open-multi-agent-kit 0.98.1 → 0.98.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.98.2] - 2026-09-02
+
+### Added
+
+- The `omk` CLI now connects configured MCP servers. `AgentSession.attachMcpServers()` was complete and tested but had no caller outside the SDK, so a `~/.omk/mcp.json` or `.omk/mcp.json` written by a CLI user spawned nothing and the control-panel MCP rows only ever showed the config inventory. The single CLI session factory now attaches on every session it creates — interactive, `-p`, RPC, `/new`, `/resume`, and forks — while `--help` and `--list-models` still spawn nothing. A server that fails to start becomes a startup warning naming the server and the reason (never an env value); the session continues with the servers that did connect.
+
+### Fixed
+
+- A dirty working-tree entry whose name the receipt parser rejects no longer kills every verified bash call in the session. `resolveSessionWorkspaceScope` handed the whole `git status` set to `captureWorkspaceFingerprint`, which throws on any path containing a backslash, `..`, or an empty segment; a mangled `\wsl.localhost\...` directory left in a repo root therefore failed each bash invocation with `workspace scope artifactPaths[N] must be a normalized root-relative path`, and subagent lanes lost their shell entirely. The scope builder now filters with the same `isNormalizedArtifactPath` predicate the parser enforces, which also subsumes the earlier one-off trailing-slash and nested-repository exclusions.
+- A credential-less install no longer tells the user to `Run /login unknown`. The placeholder model resolved when no provider is configured carries the literal provider `unknown`, and the `provider_auth` recovery hint interpolated it verbatim; the hint now omits an unknown provider and mentions the API-key environment variable path for headless `-p` runs where `/login` is not available.
+- Classified Anthropic's `claude_code_version_too_old` rejection (HTTP 400 carrying `invalid_request_error`) as a permanent configuration fault: it no longer enters the transient retry/failover loop, and the session failure cause reports `configuration`/`invalid` instead of the retryable protocol default. The usage and quota probes now read the spoofed Claude Code client version from omk-ai's single `CLAUDE_CODE_VERSION` constant, so every request presents the same user-agent as the messages API.
+- Compaction now recovers from an OAuth token the provider rejects as expired while the stored expiry still lies ahead. ChatGPT/Codex answers `401 token_expired` days before the JWT `exp`, and because `compaction.model` can differ from the session model (`openai-codex/gpt-5.6-sol` under an `xai/grok-4.6` session), every turn kept succeeding while every compaction failed with "Provided authentication token is expired" — and the transient-retry classifier rightly never replays a 401. `AuthStorage.refreshRejectedOAuthToken()` now force-refreshes the rejected credential under the storage lock (skipping the refresh when another omk process already rotated it), and manual and automatic compaction retry the summarization once with the new token. A failed refresh names `/login <provider>`. Compaction failures are now attributed to the compaction model instead of the session model.
+- Compaction now asks for an OAuth access token with at least ten minutes of remaining validity. Compaction resolves auth once and reuses it for a summarization that can stream for minutes with retries, so a token accepted seconds before expiry came back as a provider 401 mid-run. `AuthStorage.getApiKey()` accepts `minRemainingMs` and refreshes proactively, falling back to the still-valid token when that early refresh fails.
+
 ## [0.98.1] - 2026-08-30
 
 ## [0.98.0] - 2026-08-28

package/README.md

@@ -47,7 +47,7 @@ OMK stores user configuration under `~/.omk/agent/` and project configuration un
 Install `omk-book-to-skill` to compile documents into reusable skills without adding Python extractors to OMK core:
 
 ```bash
-omk install npm:omk-book-to-skill@0.98.1
+omk install npm:omk-book-to-skill@0.98.2
 ```
 
 It provides compile, update, and verification commands plus a local SHA-256 provenance manifest. See [Book to Skill](https://github.com/dmae97/omk/blob/main/packages/coding-agent/docs/book-to-skill.md).
@@ -247,7 +247,7 @@ npm test
 
 See [Development](https://github.com/dmae97/omk/blob/main/packages/coding-agent/docs/development.md) and [CONTRIBUTING.md](https://github.com/dmae97/omk/blob/main/CONTRIBUTING.md).
 
-Release notes: [v0.98.1](https://github.com/dmae97/omk/blob/main/.github/RELEASE_NOTES_v0.98.1.md).
+Release notes: [v0.98.2](https://github.com/dmae97/omk/blob/main/.github/RELEASE_NOTES_v0.98.2.md).
 
 ## License
 

package/dist/cli/mcp-attach.d.ts

@@ -0,0 +1,15 @@
+export interface McpAttachStatus {
+    readonly name: string;
+    readonly state: string;
+    readonly error?: string;
+}
+/**
+ * Startup diagnostics for `AgentSession.attachMcpServers()` results. A ready
+ * server is silent; anything else becomes a warning so one broken server is
+ * visible without taking the session down. Error text never carries env values.
+ */
+export declare function mcpAttachDiagnostics(statuses: readonly McpAttachStatus[]): Array<{
+    type: "warning";
+    message: string;
+}>;
+//# sourceMappingURL=mcp-attach.d.ts.map

package/dist/cli/mcp-attach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-attach.d.ts","sourceRoot":"","sources":["../../src/cli/mcp-attach.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,SAAS,eAAe,EAAE,GAClC,KAAK,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAM7C","sourcesContent":["// Structural shapes on purpose: importing the core types here would put cli/ in an import cycle.\nexport interface McpAttachStatus {\n\treadonly name: string;\n\treadonly state: string;\n\treadonly error?: string;\n}\n\n/**\n * Startup diagnostics for `AgentSession.attachMcpServers()` results. A ready\n * server is silent; anything else becomes a warning so one broken server is\n * visible without taking the session down. Error text never carries env values.\n */\nexport function mcpAttachDiagnostics(\n\tstatuses: readonly McpAttachStatus[],\n): Array<{ type: \"warning\"; message: string }> {\n\treturn statuses.flatMap((status) => {\n\t\tif (status.state === \"ready\") return [];\n\t\tconst reason = status.error ? `: ${status.error}` : \"\";\n\t\treturn [{ type: \"warning\", message: `MCP server \"${status.name}\" ${status.state}${reason}` }];\n\t});\n}\n"]}

package/dist/cli/mcp-attach.js

@@ -0,0 +1,14 @@
+/**
+ * Startup diagnostics for `AgentSession.attachMcpServers()` results. A ready
+ * server is silent; anything else becomes a warning so one broken server is
+ * visible without taking the session down. Error text never carries env values.
+ */
+export function mcpAttachDiagnostics(statuses) {
+    return statuses.flatMap((status) => {
+        if (status.state === "ready")
+            return [];
+        const reason = status.error ? `: ${status.error}` : "";
+        return [{ type: "warning", message: `MCP server "${status.name}" ${status.state}${reason}` }];
+    });
+}
+//# sourceMappingURL=mcp-attach.js.map

package/dist/cli/mcp-attach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-attach.js","sourceRoot":"","sources":["../../src/cli/mcp-attach.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CACnC,QAAoC,EACU;IAC9C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IAAA,CAC9F,CAAC,CAAC;AAAA,CACH","sourcesContent":["// Structural shapes on purpose: importing the core types here would put cli/ in an import cycle.\nexport interface McpAttachStatus {\n\treadonly name: string;\n\treadonly state: string;\n\treadonly error?: string;\n}\n\n/**\n * Startup diagnostics for `AgentSession.attachMcpServers()` results. A ready\n * server is silent; anything else becomes a warning so one broken server is\n * visible without taking the session down. Error text never carries env values.\n */\nexport function mcpAttachDiagnostics(\n\tstatuses: readonly McpAttachStatus[],\n): Array<{ type: \"warning\"; message: string }> {\n\treturn statuses.flatMap((status) => {\n\t\tif (status.state === \"ready\") return [];\n\t\tconst reason = status.error ? `: ${status.error}` : \"\";\n\t\treturn [{ type: \"warning\", message: `MCP server \"${status.name}\" ${status.state}${reason}` }];\n\t});\n}\n"]}

package/dist/core/agent-session.d.ts

@@ -805,6 +805,13 @@ export declare class AgentSession {
      * Used when the primary model's quota is exhausted (same-model retry is
      * useless until reset; another provider can still save the compaction).
      */
+    /**
+     * Summarize for manual and automatic compaction alike. If the provider
+     * rejects the OAuth token as expired despite a still-future stored expiry
+     * (ChatGPT `401 token_expired`), the credential is force-refreshed once and
+     * the summarization retried; the retry classifier rightly never replays a 401.
+     */
+    private _summarizeCompaction;
     private _compactionFailoverModels;
     /**
      * Manually compact the session context.