open-multi-agent-kit 0.98.1 → 0.98.3

package/docs/advisory-selection.md

@@ -0,0 +1,112 @@
+# Advisory selection integrity
+
+**Introduced in v0.98.3.** This strengthens the existing explicit SDK
+`chooseWithAdvisoryJudge()` and `createModelAdvisoryJudge()` path. It does not add a default
+AgentSession/TUI judge, start subagents, or activate the separate AdaptOrch service.
+
+See [SDK usage](sdk.md#advisory-best-of-n-selection), [Run Protocol](run-protocol.md), and
+[spec 021](https://github.com/dmae97/omk/blob/v0.98.3/specs/021-advisory-selection-integrity/spec.md).
+
+## Decision path
+
+1. Parse every caller-supplied `EvaluationResult`; admit only semantic `pass` candidates.
+2. Keep the caller's unique `deterministicRank`. Zero eligible candidates select nothing;
+   one selects that candidate without a judge call.
+3. Bound and force-redact the goal, rubric and eligible material before comparing.
+4. Honor cancellation before invoking the judge and after awaiting its response.
+5. The first-party model adapter requires an explicit normal `stop`, nonempty bounded text
+   and no tool calls. Complete JSON with `length`, `aborted`, `toolUse`, `error`, missing or
+   unknown completion metadata is not a completed evaluation.
+6. Accept only a complete matrix covering exactly the known candidate and criterion IDs.
+   Each score is an integer from 0 to 4; criterion weights remain unchanged.
+7. Select the highest weighted score. If the top group ties, select its lowest deterministic
+   rank, retaining `status: "selected"` but reporting `reason: "judge-tied"` and
+   `source: "deterministic"`. A unique top reports `judge-ranked` / `llm-judge`.
+
+A tied top group is not the global fallback: if rank-zero A scores below tied B and C, choose
+B or C by their explicit ranks, never A. No content hash, majority vote, or guessed confidence
+replaces the caller's ranking policy.
+
+## Missing evidence is not a zero score
+
+The built-in chooser attaches `diagnostics` on every returned decision. The property is optional
+in the TypeScript contract so historical or caller-constructed decisions still type-check.
+
+| Field | Meaning |
+| --- | --- |
+| `submittedCandidates` | Complete validated intake, including non-passes |
+| `eligibleCandidates` | Number of deterministic passes |
+| `excludedCandidates.fail` | Excluded semantic failures |
+| `excludedCandidates.inconclusive` | Excluded unknown/incomplete semantic evaluations |
+| `comparison` | `not-compared`, `unavailable`, `invalid`, or `scored` |
+| `ranking.distinctScores` | Distinct weighted scores in an accepted matrix |
+| `ranking.topScoreTieCount` | Candidates sharing its highest score |
+| `ranking.scoreMargin` | Highest score minus second-ranked score, including ties |
+
+`ranking` exists only when `comparison === "scored"`. Skipped, unavailable and invalid
+comparisons do not invent a margin of zero. A valid all-zero matrix, by contrast, is scored
+and tied. A score or margin is a rubric preference, not a probability of correctness.
+
+Example diagnostics for two passing candidates that tie, with one failure and one unknown:
+
+```json
+{
+  "submittedCandidates": 4,
+  "eligibleCandidates": 2,
+  "excludedCandidates": { "fail": 1, "inconclusive": 1 },
+  "comparison": "scored",
+  "ranking": { "distinctScores": 1, "topScoreTieCount": 2, "scoreMargin": 0 }
+}
+```
+
+No raw candidate material or provider exception text is added to the decision. Counts do not
+establish independent corroboration: duplicate/correlated candidates are not automatically
+deduplicated or treated as independent evidence.
+
+## Cancellation and failure
+
+The first-party adapter checks cancellation before authentication, after authentication, and
+after completion. A late normal response from a non-cooperative provider cannot become a usable
+score after an observed abort. The chooser also checks before and after custom judge callbacks.
+It cannot forcibly terminate an arbitrary callback; cancellation cooperation remains the
+callback owner's responsibility.
+
+`AdvisoryJudgeModelError("completion-failed")` remains the sanitized adapter error. The chooser
+uses its existing `judge-unavailable` deterministic fallback. Malformed matrices use
+`judge-response-invalid`. Neither is a failed task or new verification result. An abort fallback
+is advice only; it does not authorize the caller to apply a patch after cancellation.
+
+A custom `AdvisoryJudge` still returns raw score JSON. Its author owns provider completion
+metadata; only `createModelAdvisoryJudge()` can enforce the first-party message envelope.
+There are still no model retries or cache retention. No extra provider call is introduced.
+
+## Authority and activation
+
+`parseEvaluationResult()` checks the record structure, not the truth of its evidence. Supply
+trusted, fresh results from `evaluateTask()` and preserve receipt, workspace-freshness, isolation,
+permission and release gates. The judge never changes an evaluation, waiver, observation or
+`RuntimeDecision`; apply a selected candidate only through the caller's existing controls and
+then rerun deterministic verification.
+
+This is a local reliability/observability improvement, not measured general accuracy or a
+calibrated publish/abstain policy. MC/scalar answer extraction, automatic continuation and
+risk-bound enforcement are deliberately not inserted into the 0–4 rubric contract.
+
+Install `open-multi-agent-kit@0.98.3` or build from the matching source tag.
+An already-running process is not hot-patched. Use a new SDK process to load the updated
+package; no setting or automatic TUI policy is enabled by this change.
+
+## Offline verification
+
+```bash
+LIVE_E2E=0 node node_modules/vitest/dist/cli.js --run \
+  packages/coding-agent/test/advisory-judge.test.ts \
+  packages/coding-agent/test/advisory-judge-model.test.ts \
+  packages/coding-agent/test/advisory-judge-integrity.test.ts \
+  packages/coding-agent/test/advisory-judge-integrity.property.test.ts \
+  packages/protocol/test/protocol.test.ts
+```
+
+These tests use injected completions and synthetic evaluations. They exercise the public SDK
+and real model adapter without provider credentials, including non-normal terminal states,
+cancellation, weighted ties, full intake accounting and seeded permutation properties.

package/docs/book-to-skill.md

@@ -44,6 +44,23 @@ The compile and update commands start an agent turn with the bundled workflow. T
 
 Generated personal skills default to `~/.omk/agent/skills/`; project skills use `.omk/skills/`. The workflow asks when scope is ambiguous.
 
+## Reading an OpenKB knowledge base
+
+The package bundles a second skill, `openkb`, for the other shape of document knowledge: a wiki compiled by the [OpenKB](https://github.com/VectifyAI/OpenKB) CLI rather than a generated skill. It resolves the active knowledge base with `openkb status`, reads `wiki/index.md` to pick relevant slugs, then reads concept, entity, and summary pages and follows their wikilinks.
+
+```text
+/skill:openkb
+!openkb
+```
+
+Routing between the two is fixed. Compiling a document into a reusable skill stays on `/book-to-skill-compile`, which produces a provenance record that `/book-to-skill-verify` checks; the `openkb` skill routes away from OpenKB's own Skill Factory so the request has one answer. Reading an already-compiled knowledge base is the `openkb` skill's job.
+
+The skill is read-only by construction. Ingest (`openkb add`), removal, `lint --fix`, and the interactive and watch modes are proposed to the user with the exact command and its effect, never run on the agent's initiative. Compiled pages are model-generated from documents the user ingested, so the skill treats them as untrusted data rather than instructions, and prefers reading pages directly over `openkb query` — routing wiki text through a second model call gives an injected instruction another chance to be obeyed.
+
+OpenKB is a separate Python CLI (3.10+) with its own model credentials. OMK installs neither, and the skill stops and says so when `openkb` is absent instead of guessing a path. Nothing is vendored from OpenKB; the skill is original prose pinned to an upstream commit, recorded in `skills/openkb/SOURCE.md` in the package.
+
+Despite the similar name, this is unrelated to OMK's own [`openwiki/`](../../../README.md#repository-understanding) corpus, which is generated from source code rather than documents.
+
 ## Provenance and verification
 
 After generation, the skill runs the upstream advisory scanner and records `.book-to-skill-provenance.json`. The bundled workflow resolves `scripts/provenance.mjs` from the skill directory, so it does not depend on an npm bin path. If `omk-book-to-skill` is on `PATH`, the standalone CLI can repeat the checks:

package/docs/docs.json

@@ -64,6 +64,10 @@
           "title": "Extensions",
           "path": "extensions.md"
         },
+        {
+          "title": "Extension Security",
+          "path": "security.md"
+        },
         {
           "title": "Skills",
           "path": "skills.md"

package/docs/index.md

@@ -49,8 +49,10 @@ For the full first-run flow, see [Quickstart](quickstart.md).
 ## Customization
 
 - [Extensions](extensions.md) - TypeScript modules for tools, commands, events, and custom UI.
+- [Extension security](security.md) - the extension runtime threat model and what a loaded extension can reach.
 - [Skills](skills.md) - Agent Skills for reusable on-demand capabilities.
 - [Book to Skill](book-to-skill.md) - optional document-to-skill compiler with local provenance checks.
+- [MCP](mcp.md) - attach Model Context Protocol servers and expose their tools to the model.
 - [Prompt templates](prompt-templates.md) - reusable prompts that expand from slash commands.
 - [Themes](themes.md) - built-in and custom terminal themes.
 - [OMK packages](packages.md) - bundle and share extensions, skills, prompts, and themes.

package/docs/mcp.md

@@ -47,6 +47,14 @@ Servers are read from three files, later wins on a name collision:
 
 ## Using it
 
+The `omk` CLI calls `attachMcpServers()` for every session it creates —
+interactive, `-p`, and RPC, including `/new`, `/resume`, and forks — so a
+configured server's tools reach the model without further setup. A server that
+fails to start is reported as a startup warning and the session continues.
+`--help` and `--list-models` never spawn servers.
+
+SDK callers attach explicitly:
+
 ```ts
 const status = await session.attachMcpServers();
 // [{ name: "playwright", state: "ready", toolCount: 24, serverVersion: "1.62.0" }]
@@ -54,8 +62,8 @@ const status = await session.attachMcpServers();
 session.getToolDefinition("playwright__navigate");
 ```
 
-- **Nothing is spawned until `attachMcpServers()` is called.** A workspace can
-  configure 25 servers without paying for them at startup.
+- **Nothing is spawned until `attachMcpServers()` is called.** An SDK session
+  can configure 25 servers without paying for them until it attaches.
 - Tools are exposed as `<server>__<tool>`, truncated to 64 characters with the
   server prefix preserved.
 - A built-in tool always wins a name collision; MCP can never shadow `bash`.

package/docs/release-audit-0.98.3.md

@@ -0,0 +1,97 @@
+# Release audit: v0.98.3
+
+Date: 2026-09-06. Target: seven lockstep npm packages, GitHub Release and a tag on `main`.
+This audit is release engineering evidence, not algorithm accuracy or correctness proof.
+
+## Source and scope
+
+The published v0.98.2 tag was `7e10858f5ecfeee1eea5364a2f21336c5c416f11`.
+The working algorithm branch at `60f520f0c103888ef27438ac5058bdfc78b3e409` had forked before
+that release and still declared 0.98.1. Its four committed evidence-library changes were
+merged with remote main `92dca0f598243a38de156bbe4d099e3e60414cb6` in a separate clean
+publication checkout. The merge preserves the original release ancestry; it does not move
+the v0.98.2 tag or rewrite published changelogs.
+
+Included new work:
+
+- the four committed trace/effect/claim-closure/VERA projection changes;
+- the reviewed advisory SDK integrity patch, tests and specification;
+- release-facing documentation, manifest/lock/shrinkwrap alignment and publication-auth truth.
+
+Excluded: unrelated uncommitted provider integrations, UI, context-init and reverse-skill
+changes, private agent-home material, the untracked algorithm-copy document, research data,
+sessions, local temporary output and optional generated wiki corpora. The original dirty
+working tree was not reset, stashed, broadly staged or copied into the release.
+
+## Public package manifest
+
+| Package | Version | Role |
+| --- | --- | --- |
+| `open-multi-agent-kit` | `0.98.3` | CLI and explicit advisory/evidence SDK |
+| `omk-ai` | `0.98.3` | Provider API; lockstep, no catalog refresh in this release |
+| `omk-agent-core` | `0.98.3` | Runtime; internal trace/effect primitives |
+| `omk-tui` | `0.98.3` | TUI; lockstep |
+| `omk-protocol` | `0.98.3` | Run and claim-closure contracts |
+| `omk-adaptorch-wpl` | `0.98.3` | Explicit WPL and proof/VERA projections |
+| `omk-book-to-skill` | `0.98.3` | Optional document compiler; lockstep |
+
+The root/workspace manifests, internal dependency ranges, root/example lockfiles,
+book compiler version constant and CLI `npm-shrinkwrap.json` are synchronized.
+Model catalogs are not fetched or regenerated. No API is intentionally removed.
+The new `judge-tied` reason and stricter normal-stop requirement are documented in
+[Advisory selection integrity](advisory-selection.md).
+
+## Changelog and document audit
+
+- Each public package has a changelog; new protocol/book changelogs explicitly state their
+  historical limits instead of fabricating entries for old versions.
+- Root/package README release links and document-compiler install pins name v0.98.3.
+- The runtime-algorithm audit distinguishes its historical v0.97.0 snapshot from subsequent
+  v0.98.0 guards and the new v0.98.3 library scope.
+- Internal agent modules are not advertised as default runtime authority or root exports.
+- The actual workflow is token-authenticated GitHub CI. The earlier constitution claimed
+  OIDC despite an existing token-only job. A failing-first test exposed that mismatch; the
+  documentation now matches the unchanged workflow. No token was read or replaced.
+
+## Local verification
+
+The first full keyless pass used an isolated temporary HOME. All affected tests passed but
+one Rust diagnostics test could not find its rustup toolchain. Supplying the non-secret
+`RUSTUP_HOME` path restored that fixture: 6/6 diagnostics tests passed. No production code
+was changed to suppress this environment failure. Final release checks are run again on the
+bumped candidate with the isolated HOME and explicit toolchain path.
+
+Final local results on the 0.98.3 candidate:
+
+| Gate | Result |
+| --- | --- |
+| Seven-workspace build | PASS |
+| `npm run check` | PASS; informational legacy switch-case findings only |
+| `check-release-consistency --release` | PASS; v0.98.2 ancestor, all surfaces 0.98.3, no drift |
+| Full keyless workspace tests | 7,124 passed, 821 skipped, 0 failed |
+| Test breakdown | WPL 116, agent 640, AI 487, book compiler 22, coding-agent 5,109, protocol 25, TUI 725 |
+| Go initcheck vet/race/shuffle + native symbol validation | PASS |
+| Committed algorithm/staged patch gitleaks | No leaks found |
+| Seven npm dry-run packs | 0.98.3, each carries CHANGELOG.md, restricted-path matches 0 |
+| Existing five changelog histories from v0.98.2 | Byte-preserved |
+| Clean-environment compiled CLI | Reports 0.98.3 |
+
+The first tarball inspection exposed that six package `files` allowlists omitted changelogs.
+A failing-first release test now requires each public package to ship its current dated
+changelog; all six allowlists were corrected. The publication helper's misleading automatic
+CI-provenance message was also corrected without changing authentication behavior.
+
+An inherited `OMK_PACKAGE_DIR` pointed the local smoke command at older package metadata.
+Unsetting only that override changed its reported version from 0.98.1 to 0.98.3, and a fully
+clean environment confirmed 0.98.3. The override was not changed globally; the isolated build
+and package manifests are the release subject.
+
+A local pass is not a completed npm publication: the matching tag workflow must still pass,
+and npm `latest` plus GitHub Release must agree on the version.
+
+## Publication boundary
+
+The existing `build-binaries.yml` workflow verifies source/tag identity, builds six platform
+archives, validates and publishes npm packages, then creates the GitHub Release. Publishing
+uses the existing environment-scoped granular token; OIDC/Sigstore provenance is not claimed.
+No local `npm publish`, credential rotation, gate bypass or force-push is part of this release.

package/docs/run-protocol.md

@@ -69,7 +69,9 @@ Required, unwaived violations reduce to `fail`. Required, unwaived missing obser
 
 Candidate material, the task goal, and rubric descriptions are forced-redacted and bounded before the judge receives them. The model adapter uses a tool-free prompt, treats candidate text as untrusted data, disables retries and cache retention, and accepts only a complete matrix of known candidate and criterion IDs. A provider error, timeout, malformed JSON, unknown ID, or incomplete score matrix selects the existing deterministic first choice and reports a sanitized fallback reason.
 
-The sidecar never creates an `Observation`, changes `EvaluationResult.semanticVerdict`, supplies independent-verifier evidence, waives a claim, or changes `RuntimeDecision`. Run fresh tests, integrity checks, security gates, and evidence freshness checks after applying the selected candidate.
+Since v0.98.3, the first-party model adapter requires a normal `stop`, cancellation discards late advice, and top-score ties report their deterministic rank source. Diagnostic counts preserve intake and missingness; they are not independent verification. See [Advisory selection integrity](advisory-selection.md).
+
+The sidecar never creates an `Observation`, changes `EvaluationResult.semanticVerdict`, supplies independent-verifier evidence, waives a claim, or changes `RuntimeDecision`. Parsing the evaluation checks structure, not the truth of its evidence. Run fresh tests, integrity checks, security gates, and evidence freshness checks after applying the selected candidate.
 
 ## Waivers
 

package/docs/runtime-algorithms.md

@@ -1,7 +1,24 @@
 # Runtime Algorithms and Direction
 
-This page separates OMK's released behavior from internal mechanisms, current
-working-tree candidates, and proposals. Source and tests remain authoritative.
+## v0.98.3 release delta (2026-09-06)
+
+The explicit advisory SDK requires normal first-party model completion, honors cancellation,
+reports caller-rank top ties, and preserves intake/missingness diagnostics. See
+[Advisory selection integrity](advisory-selection.md). No default AgentSession/TUI judge,
+additional completion calls/retries, or calibrated risk policy is activated.
+
+`omk-protocol` also exports Claim Closure Graph v1 evaluation; `omk-adaptorch-wpl` exports
+proof-result/VERA projections. They consume caller-supplied evidence, not authenticated
+runner truth. The operation-trace and Effect Journal V2 modules in `omk-agent-core` remain
+internal primitives: this release does not wire them into a new live authority loop.
+
+The dated audit below preserves the v0.97.0 baseline and its then-working-tree classifications.
+The context floors, explicit-rule compactor, resource report, settlement notifications and
+OpenWiki guards described as working-tree changes below subsequently shipped in v0.98.0.
+That does not ship a generated OpenWiki corpus or promote the blocked lane/memory policies.
+Source and tests remain authoritative.
+
+## Historical v0.97.0 baseline audit
 
 - **Snapshot date:** 2026-08-27
 - **Released baseline:** OMK `v0.97.0` (`b38a2c8c84`)

package/docs/sdk.md

@@ -1248,9 +1248,30 @@ Ledger and receipt publication are fail-closed but not one filesystem transactio
 ### Freshness, ledger load, and store hardening
 
 - **Freshness** compares only the caller-selected artifact set (`WorkspaceScope.artifactPaths`). It issues no Git command and carries no Git fingerprint.
+- **Scope completeness**: a session scope is bounded on purpose, so a receipt captured from one proves its selected paths and nothing more. `resolveSessionWorkspaceScopeReport(cwd)` returns the scope together with what it could not bind, and `SessionBashRuntime.workspaceScopeReport()` exposes the same for the current session.
 - **Ledger**: `ReplayLedgerManager` verifies an existing ledger on construction (sequence order, prev-hash chain, payload hash, event hash) and **fails closed** on any violation.
 - **Store**: `EvidenceReceiptStore` uses an owner-only directory, symlink rejection, no-overwrite hard-link publication, and identity rechecks to detect observed path replacement. These checks assume same-UID path mutation is quiescent; they are **not** filesystem sandbox isolation.
 
+### Session scope completeness
+
+`resolveSessionWorkspaceScope()` drops dirty paths two ways: a hard cap (32 by default) that keeps one enormous working tree from stalling every receipt, and the normalized-path filter the receipt parser forces, which rejects names carrying a backslash, `..`, or an empty segment. Both drops are deliberate; reporting them is what stops a partial view from reading like a whole-workspace proof.
+
+`resolveSessionWorkspaceScopeReport(cwd, options?)` returns:
+
+| Field | Meaning |
+| --- | --- |
+| `scope` | Exactly what `resolveSessionWorkspaceScope()` returns |
+| `totalDirtyPathCount` | Unique dirty entries Git reported, before the cap and the filter |
+| `selectedPathCount` | Entries the scope binds (`scope.artifactPaths.length`) |
+| `excludedPathCount` | Unique dirty entries no receipt can bind |
+| `truncated` | True when the cap, not the filter, kept an eligible path out |
+| `completeness` | `complete`, `partial_truncated`, `partial_excluded`, or `unavailable` |
+| `excludedPathSetSha256` | Digest of the sorted excluded set; absent when nothing was excluded |
+
+`unavailable` is not `complete`: outside a worktree, or when Git cannot be read, nothing was enumerated, so the empty artifact set is an absence of evidence rather than evidence of a clean tree. Truncation outranks exclusion in `completeness` because an excluded path is named by the digest while a capped one is an unbounded unknown.
+
+The report is cached per `(cwd, maxPaths)` for one second, so a capped probe never serves a later full request a truncated answer.
+
 ### Protocol-first semantic evaluation
 
 New integrations should use `TaskSpec`, `ExecutionAttempt`, `Observation`, `EvaluationResult`, `RuntimeDecision`, and `WaiverRecord` from `omk-protocol`. `evaluateTask()` derives the semantic verdict from current observations; `reduceRuntimeDecision()` derives the next runtime action. See [Run Protocol v1](run-protocol.md) for the rules and current migration boundary.
@@ -1288,7 +1309,9 @@ const decision = await chooseWithAdvisoryJudge({
 
 The sidecar makes no call when zero or one candidate passes. For multiple passing candidates it sends only bounded, forced-redacted material through a tool-free request and requires a complete 0–4 score matrix. Invalid output or provider failure returns `status: "fallback"` with the deterministic first candidate and a sanitized reason. It never persists model prose. Re-run fresh deterministic gates after applying the selected result.
 
-`createModelAdvisoryJudge()` resolves current auth through `ModelRegistry` for each explicit call, uses no cache retention, and performs no model retry. Tests can inject `AdvisoryJudgeCompletion`; production defaults to `completeSimple()`.
+**Since v0.98.3:** the first-party `createModelAdvisoryJudge()` adapter requires an explicit normal `stop`; valid JSON from truncated, aborted or missing completion metadata cannot supply scores. The chooser checks cancellation before and after judge work. Top-score ties retain the caller's deterministic rank but report `judge-tied` / `deterministic`. Additive `diagnostics` preserve submitted/eligible/excluded counts and distinguish unmeasured comparisons from scored ties. See [Advisory selection integrity](advisory-selection.md).
+
+`createModelAdvisoryJudge()` resolves current auth through `ModelRegistry` for each non-aborted explicit call, uses no cache retention, and performs no model retry. Tests can inject `AdvisoryJudgeCompletion`; production defaults to `completeSimple()`. Custom judges still own completion metadata. This remains an explicit SDK API, not a default AgentSession/TUI judge.
 
 ### Durable-goal seam checkpoints
 

package/docs/security.md

@@ -1,8 +1,6 @@
 # Extension Runtime Threat Model
 
 > **Scope**: This document covers every OMK extension. OMK does not currently provide extension permission tiers or an extension-specific OS sandbox.
->
-> **Version**: 0.96.1
 
 ## 1. Overview
 
@@ -126,10 +124,7 @@ If a malicious or compromised extension is suspected:
 
 ## 8. References
 
-- OMK Extension Manifest Specification: `packages/coding-agent/docs/extensions.md`
-- OMK Session Format: `packages/coding-agent/docs/session-format.md`
-- OMK Settings and Configuration: `packages/coding-agent/docs/settings.md`
-
----
-
-*Last updated: 2026-08-19*
+- [Extensions](extensions.md) - extension manifest, loading, and the tool/command API.
+- [Session format](session-format.md) - what a session file records on disk.
+- [Settings](settings.md) - global and project configuration.
+- [Containerization](containerization.md) - running the whole process under an OS sandbox.

package/examples/extensions/custom-provider-anthropic/index.ts

@@ -375,7 +375,10 @@ function streamCustomAnthropic(
 					accept: "application/json",
 					"anthropic-dangerous-direct-browser-access": "true",
 					"anthropic-beta": `claude-code-20250219,oauth-2025-04-20,${betaFeatures.join(",")}`,
-					"user-agent": "claude-cli/2.1.2 (external, cli)",
+					// Anthropic gates newer models on this version (400
+					// claude_code_version_too_old). Canonical value: CLAUDE_CODE_VERSION
+					// in omk-ai (packages/ai/src/utils/claude-code-identity.ts).
+					"user-agent": "claude-cli/2.1.258 (external, cli)",
 					"x-app": "cli",
 				};
 			} else {

package/examples/extensions/custom-provider-anthropic/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "omk-extension-custom-provider-anthropic",
-  "version": "0.98.1",
+  "version": "0.98.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omk-extension-custom-provider-anthropic",
-      "version": "0.98.1",
+      "version": "0.98.3",
       "dependencies": {
         "@anthropic-ai/sdk": "0.52.0"
       }

package/examples/extensions/custom-provider-anthropic/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "omk-extension-custom-provider-anthropic",
 	"private": true,
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",

package/examples/extensions/custom-provider-gitlab-duo/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "omk-extension-custom-provider-gitlab-duo",
 	"private": true,
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",

package/examples/extensions/gondolin/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "omk-extension-gondolin",
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "omk-extension-gondolin",
-			"version": "0.98.1",
+			"version": "0.98.3",
 			"dependencies": {
 				"@earendil-works/gondolin": "0.12.0"
 			}

package/examples/extensions/gondolin/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "omk-extension-gondolin",
 	"private": true,
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",

package/examples/extensions/sandbox/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "omk-extension-sandbox",
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "omk-extension-sandbox",
-			"version": "0.98.1",
+			"version": "0.98.3",
 			"dependencies": {
 				"@anthropic-ai/sandbox-runtime": "0.0.26"
 			}

package/examples/extensions/sandbox/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "omk-extension-sandbox",
 	"private": true,
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",

package/examples/extensions/with-deps/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "omk-extension-with-deps",
-  "version": "0.98.1",
+  "version": "0.98.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omk-extension-with-deps",
-      "version": "0.98.1",
+      "version": "0.98.3",
       "dependencies": {
         "ms": "2.1.3"
       },

package/examples/extensions/with-deps/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "omk-extension-with-deps",
 	"private": true,
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",

package/npm-shrinkwrap.json

@@ -1,17 +1,17 @@
 {
 	"name": "open-multi-agent-kit",
-	"version": "0.98.1",
+	"version": "0.98.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "open-multi-agent-kit",
-			"version": "0.98.1",
+			"version": "0.98.3",
 			"license": "MIT",
 			"dependencies": {
-				"omk-agent-core": "^0.98.1",
-				"omk-ai": "^0.98.1",
-				"omk-tui": "^0.98.1",
+				"omk-agent-core": "^0.98.3",
+				"omk-ai": "^0.98.3",
+				"omk-tui": "^0.98.3",
 				"@silvia-odwyer/photon-node": "0.3.4",
 				"canonicalize": "4.0.0",
 				"chalk": "5.6.2",
@@ -27,8 +27,8 @@
 				"typebox": "1.3.11",
 				"undici": "8.10.0",
 				"yaml": "2.9.0",
-				"omk-adaptorch-wpl": "^0.98.1",
-				"omk-protocol": "^0.98.1"
+				"omk-adaptorch-wpl": "^0.98.3",
+				"omk-protocol": "^0.98.3"
 			},
 			"optionalDependencies": {
 				"@mariozechner/clipboard": "0.3.9"
@@ -1285,19 +1285,19 @@
 			}
 		},
 		"node_modules/omk-adaptorch-wpl": {
-			"version": "0.98.1",
-			"resolved": "https://registry.npmjs.org/omk-adaptorch-wpl/-/omk-adaptorch-wpl-0.98.1.tgz",
+			"version": "0.98.3",
+			"resolved": "https://registry.npmjs.org/omk-adaptorch-wpl/-/omk-adaptorch-wpl-0.98.3.tgz",
 			"license": "MIT",
 			"engines": {
 				"node": ">=22.19.0"
 			}
 		},
 		"node_modules/omk-agent-core": {
-			"version": "0.98.1",
-			"resolved": "https://registry.npmjs.org/omk-agent-core/-/omk-agent-core-0.98.1.tgz",
+			"version": "0.98.3",
+			"resolved": "https://registry.npmjs.org/omk-agent-core/-/omk-agent-core-0.98.3.tgz",
 			"license": "MIT",
 			"dependencies": {
-				"omk-ai": "^0.98.1",
+				"omk-ai": "^0.98.3",
 				"ignore": "7.0.6",
 				"typebox": "1.3.11",
 				"yaml": "2.9.0"
@@ -1307,8 +1307,8 @@
 			}
 		},
 		"node_modules/omk-ai": {
-			"version": "0.98.1",
-			"resolved": "https://registry.npmjs.org/omk-ai/-/omk-ai-0.98.1.tgz",
+			"version": "0.98.3",
+			"resolved": "https://registry.npmjs.org/omk-ai/-/omk-ai-0.98.3.tgz",
 			"license": "MIT",
 			"dependencies": {
 				"@anthropic-ai/sdk": "0.91.1",
@@ -1330,16 +1330,16 @@
 			}
 		},
 		"node_modules/omk-protocol": {
-			"version": "0.98.1",
-			"resolved": "https://registry.npmjs.org/omk-protocol/-/omk-protocol-0.98.1.tgz",
+			"version": "0.98.3",
+			"resolved": "https://registry.npmjs.org/omk-protocol/-/omk-protocol-0.98.3.tgz",
 			"license": "MIT",
 			"engines": {
 				"node": ">=22.19.0"
 			}
 		},
 		"node_modules/omk-tui": {
-			"version": "0.98.1",
-			"resolved": "https://registry.npmjs.org/omk-tui/-/omk-tui-0.98.1.tgz",
+			"version": "0.98.3",
+			"resolved": "https://registry.npmjs.org/omk-tui/-/omk-tui-0.98.3.tgz",
 			"license": "MIT",
 			"dependencies": {
 				"get-east-asian-width": "1.6.0",