Reading the end of a long session takes 42 ms and 68 MB instead of 40 s and 1.8 GB. session_read, session_search and session_info page through OpenCode's message API instead of loading the whole session: on a 23,000-message session, session_read with limit: 2, from_end: true dropped from 39.6 s and 1,848 MB peak memory to 42 ms and 68 MB, and a search that runs out its 60-second timeout now stops reading when it returns, where it used to read another 228 MB in the background (#10738, #10741).
OmO's extension no longer carries an LSP engine it never runs. The native LSP tools and post-edit diagnostics already go through the packaged LSP daemon, but the formatter's import pulled lsp-core's whole in-process engine into omo.js; importing only the helpers it uses shrinks the extension by about 82 KB, with no change in behavior. (#10659)
Every session start reads about 33 KB less of omo.js: eleven memory slash commands and memory sync's device account load on first use (#10902, #10860). The commands (/memory, /remember, /init, /recompile, /memory-repository, /sleeptime, /reflect, /dream, /search, /facts, /agreements) still appear at startup with the same names, descriptions and hints; their handlers load from extensions/omo-memory-commands.js. The signed-in device account loads from extensions/omo-device-account.js the first time a session resolves its sync, and if that file cannot load, memory sync reports sync-unavailable with the reason instead of looking signed out.
ulw-research ships a fact ledger, a fidelity state file and a claim index for research reports. They give each research run a machine-readable record of its facts and verified claims; nothing in the CLI uses them yet. (#11046, part of #11009; batch #11148)
Windows dori sidecar paths pass the extension's path checks. The omo-senpi tests accept the Windows form of the sidecar path, so the Windows suite no longer fails on a correct path. (#11111, fixes #11110)
Child-task, workflow and workpool wake sources report kind children. (#11114, part of #10782)
An unreadable workpool store no longer drops or falsely clears the children wake source. (#11118, part of #10782)
The children wake source reads the workpool store once per snapshot. (#11124, part of #10782) (batch #11148)
Child results waiting in the wake queue keep the parent from reading as done. (#11115, part of #10782)
The wake-queue count can no longer cost a delivery receipt and is re-published per session generation. (#11121, part of #10782)
A receipt that throws no longer leaves the wake-queue count up. (#11122, part of #10782)
Delivery receipts are isolated from each other, on retire too, and no receipt error is dropped. (#11123, part of #10782) (batch #11148)
A wake-queue flush settles each receipt and the child count once, and a throwing onReceiptError no longer stops the rest. (#11137, part of #10782) (batch #11148)
Windows helper tree kills are guarded against recycled parent PIDs. A QA helper no longer stops an unrelated process tree that reused a parent's PID. (#11007)
A task that a quitting session suspended says why it is still running. Quitting the owning session parks every live child, but the parked record kept its bare running status with no reason, so a restart that never resumed that session read as a running task that nothing would ever move. The quit shutdown now records session_quit on the parked record, which task_output and the task snapshot present as "resuming (session quit)", and a later resume whose reconcile defers the revival replaces it with the deferral's own reason. (senpi#3493, #10533, thanks @Bearmancer)
A project's skills can no longer reach outside the project, and their MCP servers no longer get your whole environment. A skill link in a project that points outside it is refused, and the reason shows in the skill tool's result and in OpenCode; links into skill folders you configured yourself still work. MCP servers that come from a project's skills start with a small safe base (paths, home, temp, locale, CA paths) plus the variables they declare. When one asks for a variable it didn't get, the result names it with the exact /omo-mcp-env-grant command that saves the grant for that server declaration; only names are stored, in the same file the engine uses. Skills you installed yourself, including paths in your global OpenCode configuration, keep today's environment. Task discovery keeps nested reference documents out of skills and allows links between packages in the same repository. Unreadable or missing skills report their actual file error rather than a security block. Replaced or evicted grant commands expire, and reopening the server provides a fresh command when needed. (#10716)
Computer use explains a refused macOS launch context instead of reporting a closed engine. Initial activation and later restarts now report COMPUTER_LAUNCH_CONTEXT_REQUIRED with recovery instructions when the actual engine child refuses to start. Permission errors, desktop handover, and the native launch gate keep their existing behavior. (#11073, #11086)
Thread tools check that an RPC host is the one they selected before changing a session (#10712). The client proves the host's key with a challenge-response and attaches the selected session by its durable id on the same connection, so a host that reused a routing id cannot receive another session's mutation. A draining host answers with a retryable host_draining error instead of failing the call, and a change that took effect is never reported as failed.
The build now records which files each bundled artifact is built from. packages/omo-senpi/bundle-inputs.json lists every repo file the generators of the committed bundles read. The list is traced from the recipe itself, and CI checks that it is current. Merge tooling can now tell that a skill-only change leaves the bundles untouched (#11079, #11084).
A session with telemetry off clears leftover session summaries as soon as it starts. Summary files a crashed session left behind used to stay on disk until a later session with telemetry on picked them up. A session with telemetry off now deletes them at startup when omo.json turns telemetry off for their project; an opt-out set only through an environment variable such as DO_NOT_TRACK applies to that session alone and leaves other sessions' summaries in place. Turning telemetry off in omo.json takes effect on the very next turn instead of up to five seconds later. A summary whose project cannot be told apart is never sent. (#10234) (#10267) (batch #11148)
Session summaries survive a crash at any step and are never counted twice. Each summary window now has its own id, sent as the event id, and is written to a local pending file before it is sent; the file is deleted only after delivery is confirmed, and a later OmO start re-sends anything left over under the same id. A window left open by a killed process is sent once, only after that process is gone and its once-a-minute heartbeat has stopped for 5 minutes, so a sleeping laptop keeps its own window. The session sequence survives restarts and counts within a random per-run summary_epoch, and a session continued or recovered by another process starts a new one, so two processes writing one session never send the same (epoch, sequence) pair even when one of them is wrongly taken for dead, costs are added as whole 1/10,000 USD units (cost_1e4) so summaries and raw turns agree exactly, and dropped_events counts what had to be discarded after 14 days. telemetry.rawTurnSampleRate (or OMO_TELEMETRY_RAW_TURN_SAMPLE_RATE) sets the share of sessions that also send raw turn rows, 0.05 by default. (#10198, #10225) (batch #11148)
Every session event says whether it came from a session you opened or one OmO spawned. session_started, turn_completed and session_summary carry session_role (root, child or unknown), so a delegated child's usage is not counted again on top of its parent. (#10198, #10225) (batch #11148)
Raw turn rows keep the name of a public model reached through your own gateway. turn_completed masked the model to custom whenever the provider was not one OmO ships, while session_summary and every other event already kept a published model id regardless of the routing provider. The gateway name itself is still never sent. (#10198, #10225) (batch #11148)
Plan review keeps working after a restart or a restored session (#10558). plan-consultant and plan-reviewer only spawn after you asked for ulw-plan and a plan file exists. That state used to live only in memory, so after a restart, a desktop restore or a resumed session the gate was empty and plan review was refused until you asked again. The gate is now rebuilt from the session's own transcript when it starts: plan file reads and writes count again, and a request counts only when the engine recorded you typed it (senpi 2026.10.21-2 and later), so text injected by an extension still never opens it. State handed over by a reload is kept as well (#10378).
The engine moves to senpi 2026.10.23-1: scheduled prompts and /loop ticks reach an open session mid-turn, the footer shows what subagents spent, and compaction works again on very long sessions and turns (#11126). A scheduled prompt now arrives in its open session, steered into the running turn when the agent is working, and a /loop tick that comes due mid-turn is read at the next step. Each session remembers the thinking level per model. Stop pauses the session until you type or /resume. An HTTP MCP server with no saved sign-in no longer freezes the process for up to 30 seconds, a background usage check no longer locks a healthy Claude login on a network error, and a models.json entry without a price keeps the built-in price instead of billing $0. The built-in /llama llama.cpp integration is removed upstream; a saved llama.cpp provider is ignored.
Bun-installed omo keeps its command links intact so later upgrades can succeed. Launches still start directly on Bun, and a new-version launch restores older generated wrappers to symlinks. This fixes recurring EEXIST failures on Bun 1.4.4; the first upgrade from an old wrapper may need the one-time removal described in the PR. (#11024)
The engine moves to senpi 2026.10.21-3: long 1M-context conversations stop re-writing their cached prefix, Anthropic subscription context is counted once, and "No credential slots available" no longer locks every account out (#10965). When context reduction trims a long conversation on a 1M window, the reduced prefix now stays identical and keeps its cache checkpoint, so each step writes only what changed. Anthropic subscription turns with internal SDK re-requests no longer double the context percentage or start compaction early, and a configured compaction model now does threshold, speculative and idle compaction while your session provider is healthy. The subscription lane is the only layer that picks its accounts, so one revoked or briefly rate-limited account no longer blocks the rest until you log in again. Every turn end says what happens next, a turn-end report names the hold your queued message released, the trailing "Anything else? (optional)" card is gone from clients without native questions, and moving a session between machines runs through one implementation. Forced recovery after a context overflow no longer picks the same compaction cut again when an invisible entry leads the session; an overflow still never moves a task to its next fallback model.
Tasks honour a -fast model alias that the provider config pairs with a model. Kibitzer no longer stops at a model whose start is refused; it falls back to the next one. (#10538, fixes #10536)
Child startup failures keep their cause. When a task child exits while the parent writes to stdin, its own typed failure is reported instead of a broken-pipe error. (#11097, fixes #11096)
The side panel says, once, that its column needs the fullscreen TUI. side_panel.enabled renders its right-hand column only in the fullscreen TUI (--tui-mode fullscreen, or tuiMode in senpi's settings); in the default regular mode the sections stay a block above the editor. The docs now say so at the top of the side_panel table, and the first regular-mode run with the panel on shows a one-time notice naming both ways to switch. (#10560, #10565)
A background task that wakes itself up, or reconnects after the task host restarts, keeps the right finished/running mark on the host (#11094). A task that started a new run on its own just as its previous turn finished could stay marked as finished, so a replaced task host might drop it while it was still working. A finished task whose host restarted could lose its finished mark, so the new host might reopen it. Both now keep the correct mark. (#11092)
The side panel shows subscription usage when you are signed in but the engine is serving through an environment token (#10564). It used to show nothing in that case; it still never shows a different signed-in account's numbers. (#11101)
The one-line Linux installer picks the glibc build on glibc hosts that also have the musl package installed. install.sh used to treat any /lib/ld-musl-*.so.1 loader as proof of a musl system, so Debian or Ubuntu hosts with musl-tools or musl-dev installed downloaded omo-linux-x64-musl and recorded it for later updates. A glibc host (one where getconf GNU_LIBC_VERSION answers) now always gets the glibc build. The musl check also reads ldd --version in a way that still matches under pipefail, since musl's ldd exits 1 after printing its version. (#10562, #10612)
bun run lint runs the copy check again, and Bun no longer warns on every process in the repo. The root package.json had two "lint" scripts after a merge, so the copy check was silently skipped and Bun printed a "Duplicate key" warning to stderr each time it started, which failed tests that expect a quiet child. One lint script now runs both checks, and a test rejects repeated keys in any package.json. (#11108)
Memory notes keep their exact line endings on Windows. Git for Windows converts line endings by default, so a note committed with LF or mixed endings came back with CRLF in a reflection worktree, and the description preflight that must keep every non-description byte failed there. Every memory repository now pins core.autocrlf=false, and opening an older repository restores only the working copies whose sole difference from the committed note is the converted line endings. (#11112, fixes #11109) (batch #11148)
Memory reflection and dream runs trim oversized note descriptions before completion validation. The note body is preserved, instead of the run failing again and again and parking the identity. (#10999)
The frontend skill now decides what a screen leaves out before drawing it, and visual QA proves a redesign improved and stops after a few rounds (#11023). Before code, every screen names one primary action, its information priorities, what it leaves out on purpose, and the content it must keep; after the draft renders, a subtraction pass removes what the user does not need and checks nothing required was dropped or merged. Small changes now read the project's design file and at most one reference instead of the whole library, and atmosphere and award-grade styling are built only when the brief asks. Visual QA gains a before/after mode that captures fixed cases before the first edit and compares them side by side, and its review loop now ends after 2-3 rounds: layout, function, accessibility and missing-content defects earn another round, taste notes are recorded and stop it.
Computer use refuses input while the stop chord cannot be heard. On macOS, a password field or Secure Keyboard Entry turns on Secure Event Input, which hides key presses from the stop chord's listener; computer use kept running anyway, so the chord could not stop it. Input is now refused with StopPathUnavailable (secure-input-active) until secure input ends, and resumes by itself. A type in progress now stops at the next character when the stop path stops authorizing input, instead of finishing the text, and the Linux X11 listener refuses to arm on an XInput 2.0 server, where a keyboard grab would swallow the chord. Plain Esc stays an ordinary key. (#10534, #9651, #10537)
The frontend draft guard now catches promotional copy, emoji icons, hype badges and vanity stats, not only accent stripes (#11022). One command, check-draft-guard.ts, runs the accent-stripe rules plus four checks on visible markup text: promotional filler in English and Korean copy, an emoji used as an icon, a badge whose only content is a hype label such as "New" or "AI-powered", and a stat tile holding a marketing-form number such as "10x", "500+" or "24/7"; a measured figure such as "42%" or "1.2k" passes. Code (TypeScript generics and comparisons included), scripts, styles, comments, hidden elements, bound values and badges that carry a state attribute are not flagged. React component tags such as <Badge> and <Stat value="10x">, cn() class lists, and announced attributes such as aria-label and placeholder are checked too. The frontend and visualize skills now run it before visual QA in place of check-accent-stripes.ts, which still works on its own. Both commands now skip a dangling symlink in a scanned folder instead of crashing, and report an unreadable path given on the command line with exit 2.
A memory sync that stops working now says so in the TUI, with what to do. When a sync cycle failed, the error went only to the log, and the status kept reporting the last successful sync. Now the memory footer shows sync blocked while sync is failing, and one notice says why and what to do: /memory unlock <path> for a git lock left behind by a crashed writer, sign in again for an expired sign-in, or check your connection when the sync service cannot be reached. A single dropped request still retries quietly; the offline notice appears only after three failed cycles in a row. When sync recovers, a notice says so and the footer clears. (#10637, #10958)
Agents can now reach the dori extension through the one toolkit SDK, and a retried turn never repeats a call that already ran. With the dori section on, the toolkit gains its route, reply, room, send, thread, describe, file, rules, iam, call and work namespaces, and help() lists them with their signatures; with it off they do not exist and no dori code loads. Every call carries the caller the engine stamped and a replay key, so a replayed turn gets the recorded result back, a replay with different arguments stops with a typed error, and one older than seven days is refused instead of running again. A session waiting on a dori request also wakes when a macOS file watch drops the wake event, instead of sleeping until its timeout. (#10458)
Store extensions can expose session-callable ops as real tools, and their worker no longer drags a schema library into every store. A store extension's sessionCallable declaration can now carry a toolName, description and JSON Schema parameters per op: the session's engine registers it as ext_<extension>_<toolName>, the tool takes the calling session's durable id from the engine (never from arguments), and the worker stamps caller_session_durable_id and, when the caller thread_create'd the target, caller_created_target inside the op's own transaction. Args naming either caller field are refused before validation; the public extensionCall channel refuses every declared session op. The worker validates op arguments itself against a JSON Schema subset (type, properties, required, additionalProperties true/false, enum, const, pattern, length/item/number bounds, items, anyOf), and register() refuses any other keyword, so no constraint is skipped - which also removed typebox/value from the store worker: its bundle drops from 206 KB to 115 KB and every worker spawn (and idle-retire respawn) stops paying for its module graph. A declared await with statusOp/expireOp/timeoutMs arms a wake-file wait, and thread_creations records who created which session durably across host restarts. (#9551)
Product copy uses clearer punctuation instead of em dashes (#10994). Agent prompts, notices, memory recall openers, and web metadata now use commas, colons, or parentheses, and an empty-value placeholder uses a hyphen. A source AST check prevents new em dashes in product strings, template elements, and JSX text while leaving comments, regexes, tests, generated code, and vendored sources alone. The same check now requires lint and TypeScript suppressions to explain why, inline or in the comment directly above, including Biome ignores.
Inside OmO Desktop the browser skill works as in the terminal, plus the app's built-in browser. The agent's browsers (your own through BrowserSkill, or one it starts itself) are no longer refused or changed inside the app, and connectBuiltinBrowser() adds the thread's tab in the app's built-in browser, which you can watch beside the chat (#11066).
A session in the OmO desktop app's Built-in browser mode can ask the app for its in-app browser. The browser skill told the agent to use the app's in-app browser tools, but an OmO session had none, so agents reached for whatever outside browser the machine had (sisyphuslabs/omo-desktop-app#3292). A new eval-only omo_desktop_toolkit tool asks the app for a toolkit it hosts for the session's thread, and connectBuiltinBrowser() in the browser skill uses it to attach OmOWright to that thread's tab. The app's grant names a loopback endpoint and a token file, so the token never appears in a tool result; an app that offers no toolkit is answered at once, and one that does not answer within 15 s gets a timeout. Works once the desktop app ships its side. (#10602, fixes #10601)
Parked facts leave the active queue without losing their contents. Existing backlogs migrate once, manual retry restores them, and turn-end scans read only active entries. (#11038)
The side panel's usage section reads the subscription limits the engine already keeps, so it shows the same numbers as the desktop, before the first turn, and makes no network request of its own (#10553). senpi now polls each signed-in Claude and ChatGPT subscription itself (code-yeongyu/senpi#3687); the panel only picks the serving account and draws its record. A rotation to an account the engine has not read yet shows nothing rather than the previous account's numbers. side_panel.usage_poll_seconds is retired: still accepted, now ignored.
A finished background task no longer wakes up on its own after the task host restarts (#11083). A task that ran on the shared task host kept its session loaded there after it finished, with nothing saying it was done. When the host was replaced, the new host reopened it, and the task's own follow-ups could run again with nobody watching, spending usage. The task now marks its session as finished on the host as soon as it finishes, and again before it lets go, so the new host leaves it closed even if the parent session crashed. A finished task you continue with task_send is marked running again before your message is delivered; a dropped connection that reconnects does not change the mark. (#10778)
The web-terminal visual QA driver can wait for text before it types. A slow-starting TUI used to lose its first keystrokes to the fixed start delay. Put {WaitFor:<text>} in --input and the driver polls the rendered xterm buffer until <text> appears, then continues; if it never appears within --wait-for-timeout-ms (default 10000) the capture fails with an error naming the text and the timeout, and an empty {WaitFor:} is refused. Thanks to @cynkai. (#9583, #9666)
git-master credits sisyphus-dev-ai on its commits again, once per commit, and you can turn it off. Every commit git-master writes ends with Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>. Git adds the trailer itself (git -c trailer.ifexists=addIfDifferent commit --trailer), so amending or rewording a commit that already carries it keeps a single copy, and after a squash git-master rewrites the joined message once. This needs git 2.32 or newer. git_master.include_co_authored_by in omo.json is a working switch again and defaults to true; set it to false to leave the trailer out. The commit footer stays opt-in, your own git author and committer are unchanged, and the GIT_MASTER=1 prefix applies to the commit command as before. This works the same in the Native harness (reading the skill or load_skills) and the OpenCode plugin (#10713, #10715).
The count of undelivered messages matches the messages actually dropped (#10987). When a stopped parent cancelled a task, or a task that could not be resumed was closed, its queued messages were dropped with a note saying how many. That count came from a read taken just before the queue was cleared, so a message sent in between was dropped without being counted. The count now comes from the same write that clears the queue. (#10866)
A relaunched task records its own session id, not the previous run's (#10985). When a task restarted on a new transcript (a model fallback or a revive) and its new session's first state read failed, the task kept the previous run's session id, so anything that looks a task up by its session id, such as the task tree or the cleanup when a parent stops, found the old session. The first id the new run learns now replaces it. (#10892)
The footer shows what your subagents are spending, live, next to the session's own cost (#10730). The session cost only counted the session itself, so the number stood still while subagents worked. The footer now adds the whole subagent tree's spend as (+$X), including nested children and revived runs, and updates as tasks report instead of polling (code-yeongyu/senpi#2471).
Subagent rows no longer show $0.0000 when the provider sent no usage (#10727). A turn whose provider streamed no usage block came back with an all-zero usage, and the task row counted it as a real $0, with no tok/s. Such a turn now counts as "cost not reported", so the row shows no amount, and a run where only some turns reported a cost is marked partial (#10724).
Internal: a telemetry spool lock this process could not delete no longer blocks its batch until the 14-day age limit. After a transient file error (for example on Windows), the sweep reclaims the lock once the claim lease has passed, while a lock for a move still in progress is kept (#10951).
Internal: every assistant turn opens one omo.turn OpenTelemetry span, and events emitted during the turn carry its trace and span ids. On a transport with a span sink (the OTLP collector transport; the PostHog transport has none) the Senpi adapter starts the span at turn_start and ends it ok, or error for a failed or abandoned turn, so a turn_completed row, its span and an error event join on the (trace_id, span_id) pair. A process child launched by the task engine continues the delegating turn's trace. The traceparent header goes only to our own hosts, never to a model provider, and nothing is started or written while telemetry is off. (#10358)
Internal: the telemetry spool recovers and bounds itself on every sweep, and a stalled sender never re-sends a batch it lost. Every live collector transport sweeps the spool on start and every 60 s: it recovers expired claims and the files of dead processes, applies the 5 MB cap to everything in the directory (not only to what it sealed itself), and replays oldest first; when consent has ended the sweep deletes the spool instead. Before every send attempt the sender renames its claim to a fresh lease, so a process that stalled past its lease and lost the batch to another process stops instead of sending it again, and a batch claimed when consent is withdrawn is deleted unsent. Nothing is wired to a product yet. (#10355)
The engine publishes its OpenTelemetry schema artifact. telemetry-schema.json describes exactly what an OTel client of the engine may send, generated from the event schemas and kept byte-exact by a drift gate, so the telemetry collector can pin and enforce it. It is separate from the anonymous PostHog events, which are unchanged (#10980).
The frontend skill picks a layout pattern for every layout change, and visual-qa checks it. Any change to a screen's structure (a new region, panel, split, list, sticky bar or scroll container) now fetches the matching StyleGallery pattern and writes one Layout: line in DESIGN.md naming the pattern, the element that owns the scroll and the pattern's anti-patterns, including in a project that already has a DESIGN.md. visual-qa's new A12 item checks the build against that line, with a probe for the element that really scrolls. Apple HIG hit targets, hierarchy, states, keyboard and motion are now rules for the first draft in the frontend skill, not only items in the QA checklist. (#10684, #10685)
New TypeScript and JavaScript projects default to oxlint and oxfmt. The programming skill now ships strict OXC configs and the t3code copy rules: product strings, templates, and JSX reject em dashes, and lint/type suppressions require an explanation. Existing repository toolchains are respected. (#11030)
Account commands no longer repeat a failed keychain operation while reporting the error. A native storage failure or timeout now returns exit 9 with {"error":"store-unavailable"} instead of attempting another store read, which could add a second 25-second wait. Existing success and locked-keychain outcomes are preserved; no new deadline or lock change is introduced (#11040, #11049).
A removed device ends its local account session on refresh. When the service refuses a renewal with device_revoked, omo account token clears the saved credential and returns exit 5 with that code; omo account show then reports signed out. Unknown refusal codes still retain the credential as uncertain (#11041, #11048).
Project memory reads work on Windows when a path uses a short user-directory name. Read grants now compare native canonical paths on both sides, accounting for Windows case and separator differences without granting sibling memory repositories. A granted repository that is later replaced by a link elsewhere is no longer covered, and a note that does not exist yet is still allowed so the read can report it missing. (#10982)
Each model family's current default is named once. Every builtin default, fallback rung, category gate, Claude Code alias and migration target that means "the newest Opus / Sonnet / Haiku / Fable / GPT / GLM / Kimi / Gemini" now reads its id from one table, so the next model bump is one edit. Resolved models stay the same, with one exception: the Claude Code sonnet alias now means the current Sonnet (claude-sonnet-5-5) instead of claude-sonnet-4-6. (#10483, #10141)
A builtin model profile can run on your own provider. When the only provider serving a profile's model is one you declared in models.json (for example an API-key proxy serving claude-opus-5-5), Daily · Normal and the other builtin lanes now pick it instead of reporting that no model is available. Only the models you declared for that provider count, the lane's own providers still come first, and gateways you never declared still never serve a builtin lane. Reported by 채완. (#10493, #10485)
A config with escaped non-ASCII text no longer loads the gateway -> dori migration at every start. The startup check now looks only for \u escapes of the letters in gateway, so a prompt written with escaped characters no longer imports the migration sidecar on each launch; a legacy gateway section, however it is spelled, is still migrated. (#11051, fixes #10910)
omo dori loads a separately installed dori-extension package. The loader verifies its package identity, host contract and resolved entry path before importing it. Existing gateway configuration migrates to dori, and omo gateway remains a deprecated alias for one release. Without a dori section, doctor adds no extension rows. (#10315, #10421)
/mass-ulw and run mass ulw ... now enter the mode instead of offering a pointer the model could skip. The slash command (/mass-ulw, /mulw, /ulw-research) or a prompt that starts with run, start, use, do or execute followed by the keyword (run mass ulw research on <link>; in Korean, mass ulw 돌려줘 or 실행해줘) now carries a binding instruction: read the skill before any other tool call, and run mass-ulw as workflow runs. Before, the hint asked the model to decide whether you meant it, and in a real run it skipped mass-ulw and started no workflow. Any other mention, including a prompt that only ends with mass ulw research or asks a question, still gets the hint, and quoted, relayed, negated and delegated mentions never arm it. A single-quoted name ('omo-senpi ultrawork ...') and a relay header naming several recipients ([a -> b + c]) now count as quotes and relays for ulw too, so they no longer arm ultrawork (#10810, #10822).
A session can consult the memory of a project it touches. The first successful read, edit or write under a child project with existing memory lists its note paths and descriptions, without injecting note bodies. Linked projects in a non-git workspace and linked worktrees follow the session's auto_identity mode. Kibitzer ranks up to three recently touched projects separately from the session's own notes, reserves up to half its seats for them, and uses the same persisted search-term cache for each repository. Project notes receive read-only grants; their system/ tree, git metadata, writes and enumeration remain denied. Both memory.project_scope.nudge and .recall default to true and can be disabled separately. (#10044, #10921)
omo.json can say which workspace a session belongs to (#10852). provenance.workspaces lists workspaces by name with optional git_owners and paths; messages between sessions use it to show where the sender works (#10794).
Messages between sessions start with the sender's workspace and project (#10853, #10794). The sender's environment, git owner or configured paths decide it, never the message text; older stored messages say provenance was not recorded (#10794).
A memory git command that hangs past its timeout can now leave evidence behind. With OMO_GIT_TIMEOUT_DIAGNOSTICS_DIR set, a timed-out git records the running process table (and on Windows the stuck git's thread wait states) in that directory before it is stopped; unset, nothing changes. Windows CI uses it to diagnose a rare stalled git add. (#10821, #10914)
Stopping a task no longer risks matching a task with the same id from another task store (#10903). When a task's session shuts down, it finds its own task by the task id in its session context. Task ids are unique only within one task store, so that id is now trusted only when the session's state folder is exactly this store's folder for that task; otherwise the session falls back to matching by its session id. (#10881)
Anonymous usage stats now count each person once. The anonymous id is kept once per user instead of per agent directory, so runs that use their own agent directory, and the CLI next to OmO Desktop, no longer show up as separate people; runs in CI, under a test runner, or with a temporary home directory send nothing by default (OMO_TELEMETRY_ALLOW_AUTOMATION=1 opts back in). This also holds on Windows: a temporary home folder there is recognised too, a home folder that cannot be found turns usage stats off rather than on, and a real profile under the users folder is never treated as temporary. On some machines the anonymous id changes once with this update (#10935).
Refused child tasks report startup failure without waiting for slow teardown. Shutdown still waits for pending cleanup (#10988, fixes #10402).
Fixed
-
Memory facts extraction no longer loops until its deadline when a model fills the optional
personfield on a project fact with an empty placeholder: the placeholder is dropped and the fact is recorded, while a project fact naming a real person is still refused. A model that resends a refusedrecord_factcall unchanged now ends the run with the facts it already recorded, and a parked queue entry no longer holds back that conversation's later entries (#10918). (#10924) -
1b6b9d0 test(telemetry): name summary files with "/" on every platform (#11171)
-
8fe953b chore(lint): lower the ratchet baseline for memory-core git/exec.ts (5 -> 4)
-
326ae00 Merge remote-tracking branch 'origin/dev' into rs-5145
-
bf748ed Merge pull request #11148 from code-yeongyu/batch/memsync-coord-9
-
efc8aa2 docs(batch-9): changelog line for #11046 (batch #9 review LOW)
-
a02bbb6 docs(batch-9): link the batch PR from every added Unreleased paragraph (changelog gate)
-
6f4eb05 Merge remote-tracking branch 'origin/dev' into rs-5145
-
974374f chore(batch-9): regenerate generated artifacts after all cars landed (pair eed6ca13cdf8212d)
-
1d6558b docs(batch-9): changelog line for #11137; drop the duplicated #11024 paragraph (batch #8 review LOW)
-
9c44de3 Merge pull request #11127 from code-yeongyu/batch/memsync-coord-8
-
dcaa160 test(memory): read the second launch's run by what it created, not by name order
-
0b691dc batch8: merge #10716 @6cca8b4ae5 (env-grants drift fold)
-
076ab2e Merge remote-tracking branch 'origin/dev' into b8
-
a68c8cf Merge pull request #10558 from code-yeongyu/fix/10378-plan-gate-replay
-
de74e11 Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
-
943a2cd Merge remote-tracking branch 'origin/dev' into b8
-
6f8a255 Merge pull request #11132 from code-yeongyu/test/10402-start-refusal-ordering
-
e8fd605 batch8: merge #10712 @8786644d5f (win32 occupancy test fold)
-
8786644 test(rpc): released-host occupancy expects no probe frame on win32
-
368edf4 Merge remote-tracking branch 'origin/dev' into b8
-
a1d2aa0 fix(telemetry): the live QA keeps an env-only opt-out's hands off the queue; both purges fail closed without a cwd (#10234)
-
e7dd81f Merge feat/telemetry-summary-crashsafe (29d3ca4) into fix/10234-telemetry-optout-purge
-
42164bc docs(batch-9): changelog lines for #11123/#11124 and the per-batch measured bundle ceiling rule
-
123cc20 test(telemetry): spool-bounds fixtures carry a cwd, since a record with no stored cwd fails closed (#10234)
-
b21e168 Merge feat/telemetry-summary-crashsafe (b83dd2f) into fix/10234-telemetry-optout-purge
-
b83dd2f fix(telemetry): an unreadable session context never stops registration; schema artifacts carry session_role
-
d2cbb62 Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
-
19e417f fix(telemetry): one opt-out purge, entry bundle first, sidecar only for liveness leftovers (#10234)
-
b8560a2 Merge feat/telemetry-summary-crashsafe (fe7783d) into fix/10234-telemetry-optout-purge
-
fe7783d fix(telemetry): turn spans mask provider and model independently, like turn rows
-
75d565f Merge origin/dev into feat/telemetry-summary-crashsafe
-
5d94a4a fix(memory): report a non-EPIPE git stdin error instead of dropping it
-
3b202ff chore(bundle): regenerate the bundle-inputs map for batch #8 (bun run bundle-inputs)
-
88b5b1c fix(memory): an EPIPE on a git command's stdin never crashes the process
-
a49614b Merge remote-tracking branch 'origin/dev' into takeover/11084
-
1a62c29 Merge pull request #11024 from code-yeongyu/fix/11019-bun-bin-ownership
-
595eb05 Merge branch 'dev' into fix/11019-bun-bin-ownership
-
430c439 fix(memory): a rejected git call in the line-ending repair never fails init()
-
8beac35 chore(bundle): regenerate generated artifacts for batch #8 at 6852f70
-
b6a37a7 chore(deps): regenerate the bundles on the merged dev
-
47f67b7 Merge remote-tracking branch 'refs/remotes/origin/dev' into HEAD
-
05aaa35 test(ulw-research): type the ledger grammar and kinds property tests so lint:ratchet passes (Part of #11009)
-
6852f70 fix(lint): drop the non-null assertions #10712's tests add (batch #8 integration)
-
8fe8917 fix(lint): drop the non-null assertions #10716's tests add (batch #7 integration)
-
ab8046e docs(changelog): batch #8 [Unreleased] entries; drop the duplicated long-session paragraph
-
b41b721 Merge remote-tracking branch 'origin/dev' into takeover/11084
-
0afffdc Merge pull request #11105 from code-yeongyu/batch/memsync-coord-7
-
ac8e749 Merge pull request #9666 from cynkai/fix/9583-web-terminal-waitfor-token
-
bd22aa9 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
-
9076304 Merge remote-tracking branch 'origin/dev' into takeover/11084
-
0003dc7 Merge pull request #11047 from code-yeongyu/feat/11009-t3
-
f0b1149 batch7: merge #11038 @012e6e768e (test-only pollution fix)
-
012e6e7 test(memory): count facts entry reads with a per-test spy, not a module mock
-
aa06aba chore(bundle): regenerate generated artifacts for batch #7 at 1a1b872
-
67ac721 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
-
65f99f8 Merge branch 'dev' into fix/11019-bun-bin-ownership
-
af75366 Merge remote-tracking branch 'origin/dev' into takeover/11084
-
0c3d01d Merge remote-tracking branch 'origin/dev' into fix/9583-web-terminal-waitfor-token
-
9cc6b1d Merge pull request #11120 from code-yeongyu/fix/11009-ratchet
-
e186191 test(skills): skip the mode-000 containment case on Windows
-
c8ee072 docs(changelog): drop the duplicated OpenTelemetry paragraph, unfuse two paragraphs, link #10402 (batch #7 review fold)
-
83ae04e docs(changelog): add the #10538 entry (batch #7 integration)
-
10b1d45 docs(changelog): link #11101 in its paragraph (batch #7 integration)
-
2c3f629 docs(changelog): fold the #11038 and #10988 "### Fixed" bullets into [Unreleased] paragraphs (batch #7 integration; #11038 review LOW)
-
e2036b4 fix(ulw-research): drop the non-null assertions #11045 added to two tests so dev passes lint:ratchet again (Part of #11009)
-
4054064 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
-
0e2ed1a Merge pull request #11050 from code-yeongyu/test/10972-accurate-teardown-comments
-
2b73ce9 fix(ulw-research): derive every per-kind ledger rule from one table that renders the grammar and drives the validator (review fold 6, Part of #11009)
-
e55fef2 Merge pull request #10976 from code-yeongyu/fix/telemetry-spool-recovery-test-full-proof
-
e09c1e9 Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
-
d62d16e Merge branch 'dev' into fix/11019-bun-bin-ownership
-
e1cd57b Merge remote-tracking branch 'origin/dev' into feat/11009-t3
-
b41a4f7 Merge pull request #11037 from code-yeongyu/test/10925-dump-host-commands-on-relist
-
abc39e2 Merge remote-tracking branch 'origin/dev' into fix/9583-web-terminal-waitfor-token
-
297493a Merge remote-tracking branch 'origin/dev' into takeover/11084
-
028285e Merge remote-tracking branch 'origin/dev' into test/10925-dump-host-commands-on-relist
-
5d75beb Merge pull request #11054 from code-yeongyu/feat/11009-t1
-
209041b Merge remote-tracking branch 'origin/dev' into feat/11009-t1
-
3991737 Merge pull request #11045 from code-yeongyu/feat/11009-t2
-
1165be7 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
-
769bab3 Merge pull request #11044 from code-yeongyu/feat/11009-t4
-
8dc166f fix(memory): the line-ending repair never fails opening a repository
-
f88d445 Merge remote-tracking branch 'origin/dev' into feat/11009-t1
-
15179e2 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
-
bc14bed Merge remote-tracking branch 'origin/dev' into feat/11009-t5
-
c412079 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
-
f647997 Merge remote-tracking branch 'origin/dev' into feat/11009-t4
-
d669951 Merge remote-tracking branch 'origin/dev' into feat/11009-t1
-
c27c8b5 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
-
1a65a99 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
-
ae7bb96 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
-
12b5d3b Merge pull request #10612 from cynkai/fix/10562-installer-glibc-musl-detect
-
f88fb65 Merge remote-tracking branch 'origin/dev' into feat/11009-t4
-
d613eee Merge branch 'dev' into fix/11019-bun-bin-ownership
-
354d6fb Merge branch 'dev' into fix/helper-tree-kill-audit
-
5af1903 Merge pull request #11043 from code-yeongyu/feat/11009-t17
-
74df4cb Merge branch 'dev' into fix/10562-installer-glibc-musl-detect
-
cbfc39d Merge remote-tracking branch 'origin/dev' into feat/11009-t1
-
624230b Merge remote-tracking branch 'origin/dev' into feat/11009-t3
-
42a41b5 Merge remote-tracking branch 'origin/dev' into feat/11009-t5
-
39e01d6 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
-
c5303c6 Merge remote-tracking branch 'origin/dev' into feat/11009-t4
-
6f65a0f Merge remote-tracking branch 'origin/dev' into feat/11009-t17
-
af302c4 Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
-
4878487 Merge remote-tracking branch 'origin/dev' into test/10925-dump-host-commands-on-relist
-
1209d8e Merge remote-tracking branch 'origin/dev' into test/10972-accurate-teardown-comments
-
86a7f79 Merge remote-tracking branch 'origin/dev' into takeover/11084
-
1b19dd6 Merge pull request #11108 from code-yeongyu/fix/11106-duplicate-lint-key
-
dcbb591 fix(memory): repair converted copies that the stat cache calls clean
-
024c463 fix(lint): make dev pass lint:ratchet again (drop 4 files' non-null assertions)
-
66d450f docs(changelog): link #11112 from its Unreleased entry
-
5ac9aa5 fix(memory): pin core.autocrlf=false in every memory repository
-
1379f7e docs(changelog): note the single lint script (#11108)
-
c82c1cf fix(ci): keep one "lint" script so bun stops warning on every child start (#11106)
-
8aa46e1 Merge remote-tracking branch 'origin/dev' into test/10972-accurate-teardown-comments
-
b8a4e86 Merge remote-tracking branch 'origin/dev' into takeover/11084
-
b41eda8 fix(lint): drop the non-null assertions the oxlint ratchet rejects (batch #7 integration)
-
9347fee docs(changelog): move #10565 entry back under [Unreleased]
-
985654b Merge pull request #11032 from code-yeongyu/chore/oxlint-phase1
-
ec6378a Merge origin/dev (batch #6, 1458e30) into fix/11002-facts-parked-dead-letter
-
79a18b9 docs(changelog): link #10602 and add the #11097 entry (batch #7 integration)
-
55fbc2c fix(side-panel): show the env record for a stored login the engine serves by env token; drop dead retryAt (#10564)
-
054c563 Merge origin/dev (batch #6, 1458e30) into fix/10560-side-panel-tui-notice
-
13b44dd Merge remote-tracking branch 'origin/dev' into fix/11092-task-status-windows
-
1458e30 Merge pull request #11095 from code-yeongyu/batch/memsync-coord-6
-
a7c4fa0 docs(changelog): move the #10562 entry under [Unreleased]
-
5e6526f Merge remote-tracking branch 'origin/dev' into takeover/11084
-
7415dc0 Merge pull request #11023 from code-yeongyu/feat/frontend-skill-redesign-11021
-
c6fbbd6 chore(bundle): regenerate generated artifacts for batch #6 at f9c3d39 (re-cut without #11085)
-
39fd171 Merge branch 'dev' into fix/10562-installer-glibc-musl-detect
-
f9c3d39 fix(batch6): car x dev semantic interactions found by the full receipt
-
9e15695 fix(copy): exempt the OXC em-dash rule's own EM_DASH constant (batch #6 integration)
-
c5a69f5 Merge remote-tracking branch 'origin/dev' into feat/frontend-skill-redesign-11021
-
8324e0b Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
-
d127625 Merge pull request #10537 from code-yeongyu/fix/10534-stop-path-deaf
-
131dc25 fix(visual-qa,frontend): restore #10685's scroll-owner probe and host-unreachable form
-
10c9bef test(skill-loader): assert resolved skills equal their templates, not frontend prose
-
90be661 Merge remote-tracking branch 'origin/dev' into takeover/11084
-
292cc3b Merge remote-tracking branch 'origin/dev' into fix/10534-stop-path-deaf
-
8208a55 fix(browser skill): a grant without an endpoint is invalid_grant; concurrent refreshes share one acquire (#10601)
-
c3957a7 Merge origin/dev into feat/frontend-skill-redesign-11021
-
c8291c1 Merge pull request #11022 from code-yeongyu/feat/frontend-slop-lint-11021
-
994c0b9 Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
-
304f683 docs(changelog): note task_status windows fix (#11094)
-
4664dbb fix(browser): honor refusals and refresh grant endpoint
-
779fd13 fix(memory): a parked/ read error fails enqueue instead of moving the anchor
-
3f87932 refactor(ulw-research): one ledger grammar for validator and writers, with property tests (review fold 5, Part of #11009)
-
90899ad Merge remote-tracking branch 'origin/dev' into takeover/11084
-
e62aa0e fix(memory): the facts enqueue anchor also reads parked entries
-
33859d0 docs(changelog): move #10999 out of the released [5.1.44] into [Unreleased] (batch #6 integration)
-
cb428c8 docs(changelog): link #11051 in its paragraph (batch #6 integration)
-
2ddec23 chore(lint): ratchet baseline drops dev's removed non-null assertions (new-project.ts)
-
f4b14aa Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
-
c86e8b6 fix(lint): fold #11032 review: no-string-case-mismatch reads source text like Biome; web no-console allows warn/error; array-callback-return covers useIterableCallbackReturn
-
43d9f80 fix(omo-native): resolve symlinked Bun bin directories
-
640d224 Merge remote-tracking branch 'origin/dev' into fix/11073-launch-context-error
-
985989b docs(changelog): link launch context draft PR
-
cb44a04 fix(computer): report actual child launch refusal
-
2af6ae2 Merge pull request #11074 from code-yeongyu/batch/memsync-coord-5
-
d8ca67f test(computer): verify chunk ordering and command recovery
-
3234ce3 fix(ulw-research): verified claims need a list marker; supersede needs a replacement (review fold 4, Part of #11009)
-
004275c test(doctor): preserve native launch refusal reasons
-
52f7dd7 Merge remote-tracking branch 'origin/dev' into fix/10534-stop-path-deaf
-
f61fde1 docs(changelog): note the traced bundle-inputs map (#11084)
-
87a4771 test(computer): require the native refusal exit code
-
48d6cd2 docs(frontend): say the styled sibling stands in for DESIGN.md under the small-change rule
-
198b726 test(computer): cover actual child launch refusal
-
a32a585 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
-
eee5cd1 docs(changelog): note task_status publish for finished host tasks (#11083)
-
7839784 Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
-
013d6d5 chore(bundle): regenerate generated artifacts for batch #5 at 28fff56
-
3daf041 fix(ulw-research): keep Korean quoted speech in one sentence (review fold, Part of #11009)
-
39791a0 refactor(ulw-research): split fact ledger validation into fact-ledger-schema (review fold 3, Part of #11009)
-
1eb1709 fix(codex): exclude tests from marketplace sync
-
a4ae726 fix(ulw-research): tolerate trailing whitespace and reject duplicate blocks in the fidelity brief parser (review fold, Part of #11009)
-
c6361e6 chore(bundle): regenerate generated artifacts for batch #5 at 42eb820
-
a687955 fix(frontend): read TSX const generics and nested attributes as code
-
aa8c571 chore(bundles): regenerate after merging dev
-
42eb820 docs(changelog): fold the two #10935 paragraphs into one (batch #5)
-
56d8a98 Merge origin/dev into fix/usage-panel-reads-engine-limits
-
72bf821 Merge pull request #10953 from code-yeongyu/batch/memsync-coord-4
-
18fd8aa fix(ulw-research): bound the verified-claims section and validate ledger events (review fold 2, Part of #11009)
-
7c1106c Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
-
f3c142b fix(frontend): read attribute names, not values, in the draft guard
-
9eea54f Merge pull request #11066 from code-yeongyu/fix/4227-browser-guard-routes
-
a8ada69 fix(ulw-research): parse year-shaped values, signs and ranges in parseNumeral (review fold, Part of #11009)
-
7de29ee Merge pull request #11042 from code-yeongyu/feat/11009-t6
-
8d2c90e Merge pull request #10908 from code-yeongyu/ci/10904-derive-python-warmup
-
1a63c2d fix(desktop): read macOS secure input at every status, not once per heartbeat (#10537 review)
-
81de607 Merge pull request #11013 from code-yeongyu/ci/platform-publish-fails-on-npm-error
-
28ee9e1 fix(ulw-research): verified-claims allowlist, header matching and ledger reference checks (review fold, Part of #11009)
-
2847d81 fix(frontend): judge stat numbers by form, keep TSX code out of the draft guard
-
ece9dfd fix(browser): drop the last in-app refusal from the skill; record the orphaned browser bridge (#11066 review)
-
c08c23d fix(frontend,visual-qa): resolve route and gate contradictions from review
-
2e7be0f fix(memory): the description preflight never blocks the completion gate
-
30d81b6 Merge remote-tracking branch 'origin/dev' into feat/11009-t2
-
390d89f Merge remote-tracking branch 'origin/dev' into feat/11009-t17
-
ee5713b chore(bundle): regenerate generated artifacts for batch #4 at e3c65bb
-
7d361dc fix(ulw-research): read round numbers >= 10 trillion by their 10^4 group (review fold, Part of #11009)
-
25f794c Merge remote-tracking branch 'origin/dev' into feat/11009-t4
-
67cb930 Merge remote-tracking branch 'origin/dev' into feat/11009-t1
-
d61eae9 Merge remote-tracking branch 'origin/dev' into feat/11009-t3
-
a976dea Merge remote-tracking branch 'origin/dev' into feat/11009-t5
-
36dc6c5 Merge remote-tracking branch 'origin/dev' into feat/11009-t6
-
5bac6cf Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
-
0328b3e fix(browser): inside OmO Desktop the skill is the terminal one, plus the app built-in browser
-
aca3fc3 test(browser): inside OmO Desktop the library is the terminal one plus the built-in browser (RED)
-
6214945 Merge remote-tracking branch 'origin/dev' into ci/10904-derive-python-warmup
-
5310435 Merge remote-tracking branch 'origin/dev' into ci/platform-publish-fails-on-npm-error
-
3eaf04d Merge pull request #10979 from code-yeongyu/fix/10945-hooks-fixture-no-auto-maintenance
-
07770d9 chore(bundle): regenerate telemetry schema artifacts for batch #4 at cdd5eb5
-
7ea959e docs(changes): drop stray rebase marker lines
-
bbe5df7 docs(browser skill): Built-in has no fallback browser; work the thread tab in few calls (#10601)
-
060fe3e docs(browser skill): Built-in drives the thread's one tab (listTargets + attachPage)
-
fe1b7e0 test(desktop-session): drop the now-unused Response import
-
a1ebe28 fix(desktop-session): admission before the gate keeps reporting only stop and cancel (#10534)
-
33d5d4e fix(desktop): refuse computer input while the stop chord cannot be heard (#10534)
-
6be6c76 test(desktop): RED: a deaf stop chord must refuse input (#10534)
-
cdd5eb5 Merge remote-tracking branch 'origin/dev' into b4
-
19287db Merge pull request #10980 from code-yeongyu/feat/telemetry-artifact-decoupled
-
af359db fix(copy): avoid retired agent name
-
e4b544c docs: changelog entry for the dori toolkit seam (#10458)
-
fd1818e ci(publish-platform): the helper comment names the TLOG 409 as the only retried failure
-
ed5ed68 Merge remote-tracking branch 'origin/dev' into ci/platform-publish-fails-on-npm-error
-
12f5cef Merge the updated #9551 (dev merge + idempotent schema v9) into feat/dori-toolkit-10316
-
cd9aa7a fix(copy): align shared source strings
-
732ec37 chore(lint): ratchet baseline takes dev's new counts (project-memory-recall.test.ts)
-
373e908 Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
-
302ac1e ci(publish-platform): retry the TLOG 409 with a fresh provenance signature first; stream npm output; drop the dead provenance env
-
225f62e fix(programming): make scaffold tests offline by default
-
88c7a76 merge: stack account storage fix on device_revoked branch
-
590077f Merge remote-tracking branch 'origin/dev' into feat/thread-session-callable-extension-ops
-
1f4c516 fix(copy): polish punctuation replacements
-
440ba9a Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
-
eb620ae fix(memory): no sync cycle after stop(); fold review LOWs for the #10637 series
-
38d7548 fix(lint): the parity tool reads oxlint's JSON output, so Windows paths parse
-
deaf674 Merge remote-tracking branch 'origin/dev' into test/10925-dump-host-commands-on-relist
-
3ba2d52 build: regenerate generated artifacts after dev merge (node:24-bookworm linux/amd64, bun 1.4.3)
-
b65e20f Merge remote-tracking branch 'origin/dev' into feat/telemetry-artifact-decoupled
-
0e035cb fix(telemetry): keep the vendored collector registry byte-exact on Windows checkouts (#10980)
-
0b68bd8 Merge remote-tracking branch 'origin/dev' into omo-10685-prestage3
-
880a87f Merge dev into fix/11019-bun-bin-ownership
-
df05c13 Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
-
d1245c5 chore(bundle): regenerate generated artifacts for batch #4 at bbfe404
-
05aacec test(telemetry-core): identify shutdown deadlines by arm position, not length; name every wait only the clock sees
-
c6aa849 test(sdk): a replay of a turn past the seven-day window stops as expired (#10458 review H2)
-
8f12ee0 feat(ulw-research): add fidelity defect vocabulary and gate (Part of #11009)
-
25ee090 docs(changelog): link revoked-device fix PR
-
658ebcb docs(changelog): link account storage fix to PR 11049
-
6ddd186 fix(omo-native): preserve account storage failures without rereads
-
43a4785 fix(account): end sessions for revoked devices
-
2155faf feat(ulw-research): add numeral, rational and unit primitives (Part of #11009)
-
1011c95 feat(ulw-research): add fact ledger, fidelity state and claim index modules (Part of #11009)
-
ab060a8 feat(ulw-research): add text normalization and sentence index primitives (Part of #11009)
-
5ee3659 feat(ulw-research): add bilingual fidelity lexicon and Korean particle rules (Part of #11009)
-
46263ad feat(ulw-research): add the fidelity brief parser (Part of #11009)
-
065d71f refactor(ulw-research): export static-gate context for the fidelity gate (Part of #11009)
-
dfbeeec Merge pull request #10938 from code-yeongyu/batch/memsync-coord-3
-
76aa6d6 batch3: merge dev 912c96f (test-only: #10969; no conflicts)
-
912c96f Merge pull request #10969 from code-yeongyu/test/packaged-reload-assert-tmpdir-pin
-
b580fae test(rpc): pin released-host occupancy and non-fatal prewarm on unsafe keys
-
b183359 Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
-
944f4de test(telemetry-core): check shutdown waits by timer identity, Bun.sleep and timers/promises spies; clock only for synchronous stalls
-
7c88a63 test(omo-native): refresh command audit inventory
-
a986d10 Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
-
99dea80 style(web): Prettier-format packages/web/.oxlintrc.json (web's format:check)
-
0ca0a49 fix(memory): dead-letter parked facts entries
-
67a89c5 Merge remote-tracking branch 'origin/dev' into fix/10945-hooks-fixture-no-auto-maintenance
-
9a344fe Merge origin/dev into docs/programming-skill-oxc
-
aad0603 Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
-
80854d7 test(telemetry-core): the never-settling shutdown test fails on every regression the wall-clock check caught
-
576a8a7 Merge remote-tracking branch 'origin/dev' into feat/telemetry-artifact-decoupled
-
86ab0e4 batch3: merge dev ef16402 (changelog-only conflicts: CHANGELOG.md, changes.md)
-
333d3a1 docs(changelog): link programming skill PR
-
dd7c279 Merge remote-tracking branch 'origin/feat/frontend-slop-lint-11021' into feat/frontend-skill-redesign-11021
-
c9247fe docs(changelog): side panel reads engine subscription limits (#10553)
-
ef16402 Merge pull request #11016 from code-yeongyu/fix/compiled-ca-trust-teardown-waits
-
beca740 Merge remote-tracking branch 'origin/dev' into feat/telemetry-artifact-decoupled
-
155225f Merge remote-tracking branch 'origin/dev' into feat/frontend-slop-lint-11021
-
54c35db Merge pull request #10741 from code-yeongyu/fix/10738-session-paging
-
40f9740 fix(build): copy the telemetry schema artifacts into the plugin payload (#10980)
-
dd5dff7 Merge remote-tracking branch 'origin/dev' into fix/10738-session-paging
-
ab7010a docs(programming): default TS/JS to OXC
-
e8c0ead build(omo-codex): regenerate install-local.mjs (node:24-bookworm linux/amd64, bun 1.4.3)
-
e6a428d chore(bundle): regenerate generated artifacts for batch #3 without #10712
-
eec39f6 Merge origin/dev into fix/10866-dropped-count-atomic
-
df61b66 Merge origin/dev into fix/10892-relaunch-durable-id
-
251be05 docs(changelog): record Bun bin ownership fix
-
cb0cf02 test(thread): give the byte-split decode test the win32 transport secret
-
5f3e3ea fix(telemetry): type the os.userInfo test spy; changelog paragraph for the Windows temp-home fix (#10935)
-
9bfe57a fix(telemetry): judge temp homes without reading the account home from HOME; an unresolvable HOME fails safe (#10935 review)
-
0c8b93a fix(telemetry): detect Windows temp homes through the shared path-containment helper (#10935)
-
6682b6f test(telemetry): assert the install-id 0600 mode only where POSIX modes exist; log the Windows temp-dir inputs (#10935)
-
9320efb fix(memory): deny a dangling link instead of treating it as a missing note
-
94db155 fix(memory): deny swapped grant roots, keep missing notes readable, state the resolve-then-realpath contract
-
54543e2 docs(changelog): link Windows memory grant fix
-
f6df2d7 fix(memory): canonicalize project read grants
-
b6f765a test(thread): decode one-byte reads on a simulated win32 transport
-
720b020 Merge remote-tracking branch 'origin/dev' into fix/10945-hooks-fixture-no-auto-maintenance
-
7cc16d6 fix(omo-native): preserve Bun global bin ownership
-
9b1a607 Merge pull request #11011 from code-yeongyu/test/11010-spool-lock-order
-
9d731da feat(frontend,visual-qa): restructure around brief, build, subtract, verify with before/after mode and a bounded QA loop
-
3d0bea2 fix(frontend): share one file walker between both lint CLIs and skip dangling symlinks
-
20fbc42 Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
-
634b4ed feat(frontend): draft guard lint for promo copy, emoji icons, hype badges and vanity stats
-
939740b docs(changelog): add the Unreleased entry for #10730
-
3b46cd1 docs(changelog): add the Unreleased entry for #10727
-
a64b344 Merge remote-tracking branch 'origin/dev' into fix/10738-session-paging
-
3222ebf test(memory-core): match the traced hook by its normalized path tail (Windows)
-
32658d4 test(telemetry-core): accept claims at shutdown cap
-
0b09bcb Merge branch 'dev' into lint/no-em-dash-copy
-
24eaa15 batch3: drop the stale #10965 paragraph from [Unreleased]
-
3307a2d batch3-no10712: drop #10712's changelog paragraph; take batch #3 (7347822) generated files pending regen
-
585343c batch3: fix integration of #10924 (expected facts lines carry the receipt)
-
911020a batch3: fix integration of #10421 (restore its launcher rename/dispatch hunks)
-
e7b1f01 batch3: fix integration of #10924 (pass the required exchanges in the two new facts-record-tool tests)
-
b19bb26 test(omo-native): expect the adopted session path as the host reports it
-
8dd3aef test(memory-core): every test git fixture turns off git auto-maintenance
-
644a068 test(omo-native): prove the compiled-binary probes exited before removing their folder (#11015)
-
91c6a71 ci(publish-platform): a failed npm publish fails the job; retry the Sigstore TLOG 409 once without provenance (#11012)
-
16667ed test(telemetry-core): ignore locks after shutdown cap
-
af59f4f Merge remote-tracking branch 'origin/dev' into secmed-10693-b
-
5bb22c3 Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
-
04676f5 fix(lint): the ratchet skips generated sources by path (*_pb.ts, *.generated.ts)
-
e12b20a Merge pull request #10673 from code-yeongyu/fix/10210-catalog-import-windows
-
70b1250 fix(qa): guard Windows helper tree kills against recycled parent PIDs
-
8d716a2 Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
-
8c2369d Merge pull request #10666 from code-yeongyu/docs/10665-capabilities-hand-entries
-
cb1b273 Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
-
0d2f1d6 Merge pull request #10943 from code-yeongyu/fix/packaged-reload-tmpdir-root
-
8f32696 feat(lint): require reasons for lint and type suppressions
-
a1339af Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
-
79d84ca Merge remote-tracking branch 'origin/dev' into chore/oxlint-phase1
-
8620dc6 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
-
e889b13 wip(lint): ported Biome rules are diffed against Biome's own verdicts; type-aware rules off
-
4ff6cdf fix(memory): trim reflection descriptions before validation
-
86f6434 test(lint): avoid command hit in path fixture
-
3fbad8e Merge remote-tracking branch 'origin/dev' into docs/10665-capabilities-hand-entries
-
4520ea1 fix(lint): cover product launchers and runtime helpers
-
cbc85c9 docs(thread): describe the observing protocol probe and the attach fence
-
cb06002 docs(changelog): note product copy lint adoption
-
69df6b7 Merge remote-tracking branch 'origin/dev' into fix/10402-refusal-not-held-by-teardown
-
8b400b2 feat(lint): reject em dashes in product copy
-
9a13dfd Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
-
a34331b Merge remote-tracking branch 'origin/dev' into fix/telemetry-spool-recovery-test-full-proof
-
e6f9df3 fix(task): contain shutdown teardown failures
-
8fb7c05 fix(thread): answer attach refusals as typed release and UI refusals; budget the handshake
-
0cdb3d1 Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
-
a52d1cd Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
-
e0512c3 test(rpc): pin adopt exit codes and typed release refusals over attach
-
4f50e7c Merge remote-tracking branch 'origin/dev' into secmed-10693-b
-
ce0536c docs(changelog): move the #10988 line under [Unreleased] (the gate reads CHANGELOG.md)
-
999be9a docs(changelog): undelivered-message count matches what was dropped (#10987)
-
329dd8c docs(changelog): relaunched task records its own session id (#10985)
-
036b280 fix(task): report refused starts before teardown
-
894055a Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
-
624b72e test(thread): serve rpc_host fakes on the win32 transport, as real hosts do
-
358623a Merge remote-tracking branch 'origin/fix/10637-sync-rpc-field' into fix/10637-sync-cycle-waiters
-
b31545a Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
-
85e73d1 Merge remote-tracking branch 'origin/fix/10637-sync-tui-surface' into fix/10637-sync-rpc-field
-
764cc75 docs(changelog): the engine publishes its OTel schema artifact (#10980)
-
1416f92 feat(telemetry): publish the engine OTel schema artifact, decoupled from the PostHog schema
-
1d0279f test(memory-core): fixture repos start no detached git maintenance that outlives teardown
-
cf50b39 Merge remote-tracking branch 'origin/dev' into test/packaged-reload-assert-tmpdir-pin
-
688c115 Merge remote-tracking branch 'origin/fix/10637-sync-status-change' into fix/10637-sync-tui-surface
-
42ab0b4 fix(memory-core): only a successful sync cycle clears a shown failure; a moved lock path is a change (#10637 review H1, M1, L1, L2)
-
2cec92b test(telemetry-core): the never-settling shutdown test proves a deadline ended it within the cap again
-
a73afec fix(skills): preserve grant notices across reconnects (#10693)
-
d9e7c29 Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
-
b97b06a fix(skills): identify both vendored store sources (#10693)
-
cf09d74 fix(skills): bound pending MCP grant handles (#10693)
-
5d67091 fix(skills): retain global config user authority (#10693)
-
5d2fb81 fix(memory-core): a failed sync cycle settles nextCycle() and still runs a queued request (#10637, #10968)
-
8103883 fix(skills): use worktree boundary for task links (#10693)
-
aa90ff4 Merge remote-tracking branch 'origin/fix/tests-never-replace-process-env' into test/packaged-reload-assert-tmpdir-pin
-
c6f5536 fix(skills): preserve project discovery rules (#10693)
-
cd7c5c6 fix(memory-core): neutral stranded-lock reason, and say why failing outranks paused (#10637 review LOW 1, 2)
-
1502c62 test(omo-native): setup e2e children are awaited on their exit event under a named bound
-
ed65fc5 Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
-
3c137d7 Merge remote-tracking branch 'origin/dev' into secmed-10693-b
-
0bef58a fix(memory-core): a resumed sync cycle re-syncs the index for its committed paths (#10637)
-
3ed1682 fix(memory-core): the sync commit reclaims or reports a stranded git lock like a memory write (#10637)
-
66089b8 docs(changelog): link #10958 in the sync failure entry (#10637)
-
9333e42 feat(memory-core): sync tells its owner when the shown failure appears, changes or clears (#10637)
-
8839d0a feat(memory-core): an unreachable sync service reports offline once it persists (#10637)
-
0f4e470 feat(memory-core): an expired or refused sign-in reports auth_expired with the sign-in action (#10637)
-
65ad1b2 fix(telemetry-core): a spool lock whose unlock gave up is reclaimed after the claim lease
-
9b48f9b feat(memory-core): a failed sync cycle reports a failing status with kind, reason and action (#10637)
-
5f84880 Merge remote-tracking branch 'origin/dev' into feat/telemetry-turn-span
-
933dea8 Merge remote-tracking branch 'origin/dev' into feat/telemetry-spool-lifecycle
-
0de44ac Merge remote-tracking branch 'origin/dev' into docs/10665-capabilities-hand-entries
-
9959047 test(telemetry): pin handoff_hint malformed-payload drops; untangle QA conditional-event comment
-
dc42fd0 fix(thread): read negotiation frames in the endpoint fixture; log via utils/logger
-
2a08d00 test(telemetry): isolate tests from opt-out env (#10940)
-
965f342 fix(telemetry): the automation check can never throw on the consent path (fails to telemetry off); strip agent-dir overrides from the shared name list (#10935 review)
-
ba392aa fix(telemetry): adopt the legacy install id with agent-dir overrides ignored (#10935 review)
-
71e9282 fix(telemetry): a misconfigured temp dir never marks a real home ephemeral; changelog links the PR (#10935 review)
-
a3f37f8 fix(telemetry): one anonymous install id per user, independent of the agent home; no telemetry from automated runs (#10934)
-
653d325 docs(changelog): move the plan-gate replay entry under [Unreleased]
-
2788dc2 fix(memory-core): keep the timeout diagnostics inside the windowsHide and fs-boundary audits (#10914 review)
-
62a5090 docs(changelog): note the task-store check for a session's own task id (#10903)
-
29a2116 Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
-
3e5cb38 fix(memory): a two-letter name such as Na is a real person, not a placeholder (#10918)
-
7f2cbb2 test(memory-core): fail when git-mode project lookups fall back to sync fs (#10044)
-
83b3053 test(thread): exercise every git failure class on every OS through injected git IO
-
13c62c8 fix(memory): a placeholder person on a project fact no longer loops the facts child or stalls the memory queue (#10918)
-
3b5c93e fix(memory): skip project notes the transcript already read by file path (#10044)
-
0a75d3a fix(thread): a git failure never fails a send; provenance degrades to unclassified with a logged diagnostic
-
fef73f2 fix(memory): keep project scope off the tool-result hot path (#10044)
-
40d3d56 test(thread): assert the single header line (workspace and project first), then sentence, then body
-
409f950 fix(thread): ride the new dev: idempotent provenance trigger, one header line, settled() in tests, no config loader in the thread SDK
-
530c962 fix(thread): a dangling worktree .git and the sender's git ceiling resolve as unclassified; link the Bun rejects deadlock
-
d8cd57a fix(thread): decide no-repository structurally, list the delivery fixture's receiver, settle the v4 refusal explicitly
-
cfa36c9 docs(changelog): note sender provenance on gateway deliveries (#10853)
-
213858f feat(thread): show the sender's workspace and project first on gateway deliveries
-
9736b52 chore(schema): regenerate omo.schema.json for the provenance label pattern
-
c2d4250 fix(config): give provenance labels a non-blank pattern and add the #10852 fragment
-
71d30b6 docs(changelog): note the provenance.workspaces setting (#10852)
-
9416396 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
-
74662ab feat(config): add provenance.workspaces settings for sender classification
-
f872188 docs(memory): document project scope and config schema (#10044)
-
f491d4b feat(memory): persist recall terms for touched projects (#10044)
-
3c54db5 feat(memory): surface notes on project touches (#10044)
-
f1a9957 feat(memory): grant revocable project note reads (#10044)
-
aa1195b feat(memory-core): resolve touched project memory scope (#10044)
-
1e2039b fix(memory-core): record thread states of the timed-out git and its children; keep collecting when a trace is locked (#10821 review)
-
918fe00 ci(memory-core): record the process table and git trace2 when a git times out on Windows CI (#10821)
-
caed354 fix(rpc): share the key-root rule, bound askHost by one deadline, tidy auth refusals
-
89b159f test(rpc): pin delta-review fixes: key-root rule, total deadline, auth refusals
-
8920918 ci(publish): derive the Windows eval-smoke warm-up from the kernel prelude (#10904)
-
146d1ff Merge remote-tracking branch 'origin/dev' into fix/rpc-socket-token-client
-
b24f3a6 fix(rpc): address #10712 review: session-less wake, key root, remedy, logging
-
abb5111 test(rpc): resolve askHost's default key root in a child with its own HOME
-
426f833 test(rpc): pin review fixes for v1.1 refusals, key root and logging
-
3d2369b fix(thread): type v1.1 attach refusals and never fail a mutation on release
-
e320d31 chore(bundles): regenerate generated bundles for bundle-train batch #2 (bun 1.4.3)
-
d8b0e2f fix(model-core): audit scans files directly under src/; model-core GLM rung reads the table (#10141 review)
-
905f68f fix(thread): decide no-repository structurally, list the delivery fixture's receiver, settle the v4 refusal explicitly
-
a4f7eb4 changelog: keep the #10493 entry in CHANGELOG.md Unreleased (the gate reads CHANGELOG.md, not fragments)
-
1ecb1de changelog: keep the #10483 entry in CHANGELOG.md Unreleased (the gate reads CHANGELOG.md, not fragments)
-
889a6a4 Merge origin/dev into fix/profile-custom-providers; move the changelog entry to changes/unreleased/10493.md
-
f5f73e1 Merge origin/dev into fix/10141-family-latest-models; move the changelog entry to changes/unreleased/10483.md
-
2435921 docs(changelog): note sender provenance on gateway deliveries (#10853)
-
bbdda65 feat(thread): show the sender's workspace and project first on gateway deliveries
-
f5db154 chore(schema): regenerate omo.schema.json for the provenance label pattern
-
48f7825 fix(config): give provenance labels a non-blank pattern and add the #10852 fragment
-
77126c1 Merge remote-tracking branch 'origin/dev' into fix/10378-plan-gate-replay
-
516e66d docs(changelog): note the provenance.workspaces setting (#10852)
-
7ecd9fb test(thread): pin v1.1 attach refusals and post-mutation release outcomes
-
8bdae19 feat(config): add provenance.workspaces settings for sender classification
-
4fa6eb8 wip(lint): the ratchet counts disable comments, fails on parse errors, and --update only lowers
-
6b3e609 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
-
bc3e9b9 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
-
9eae658 Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
-
c5929f9 wip(lint): port Biome noImplicitAnyLet and noStringCaseMismatch; enable no-inner-declarations and no-redeclare
-
12cdec2 wip(lint): enable consistent-type-exports and no-invalid-void-type (Biome useExportType / noConfusingVoidType)
-
541cb26 wip(lint): port Biome noEnum as omo/no-enum (local prep)
-
9968c14 wip(lint): sub-packages lint with oxlint from the root; Biome keeps formatting (local prep)
-
c4ad26d wip(lint): clear the 14 oxlint errors in the Biome sub-packages (local prep)
-
af7ac72 wip(lint): oxlint configs mapped from the sub-package Biome rule sets (local prep)
-
1ae8c64 chore(lint): ratchet the three strictness rules per file with oxlint 1.89.0
-
9953105 feat(telemetry-core): turn tracing on the gated OTLP sender; inspector loads lazily from ./otlp
-
d573947 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
-
f1f57cd test(telemetry-core): write spool fixtures through the providers, not the transport
-
a8fbb8f Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
-
7467183 Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
-
0cc47b6 Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
-
fe92a71 Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
-
38ed1d4 Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
-
ebfedf3 fix(session-manager): let a cancelled session_list stop counting (#10738)
-
917b332 fix(skill): an unreadable native skill keeps its host content and never drops the rows after it (#10693)
-
52a90e8 fix(session-manager): abort session_info walks and never truncate on a missing cursor (#10738)
-
5db2f90 fix(security): re-scope only the MCP server whose grant changed, and blame only the requested skill's link (#10693)
-
148b913 docs(changelog): note the session paging fix (#10738)
-
190bbe0 fix(session-manager): page session reads and stop a timed-out search (#10738)
-
ad301b6 docs(changelog): move the {WaitFor:} entry back under Unreleased
-
90af6ff Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
-
6c3e169 fix(get-worker): pick the glibc build on glibc hosts with the musl loader installed (#10562)
-
be3e269 fix(security): never let the skill security notice replace a containment result (#10693)
-
518fa58 fix(security): pin the authorized skill file before opening it so a swap is refused on Windows too (#10693)
-
a9a5a91 fix(security): make the CI shard green under containment (#10693)
-
76695f9 Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
-
5a7e3af fix(security): register non-project MCP connections synchronously again (#10693)
-
b29ee02 fix(security): retry the grants file replace on Windows and compare canonical paths in the swap test (#10693)
-
68a9d67 fix(security): keep the config skill entry root check in front of link containment (#10693)
-
34c7a6c Merge remote-tracking branch 'origin/dev' into secmed-10693-b
-
f482c6d fix(security): keep skill discovery and MCP env contracts green under containment (#10693)
-
c7e85f7 test(security): type the fake setInterval through the test-value helper (#10693)
-
b248ac1 test(security): stop blocking on the pending materialization before the revoke (#10693)
-
4192ac4 fix(skills): skip disabled native skills before the containment check (#10693)
-
bb8fd11 test(security): type the mocked setInterval callback (#10693)
-
4ed2d6c Merge remote-tracking branch 'origin/dev' into secmed-10693-local
-
959bc27 docs(changelog): link #10715 from the git-master co-author entry
-
efed301 fix(thread): preserve Windows RPC secret transport
-
484c6d7 test(rpc): scope challenge contract to POSIX
-
47fe05a test(rpc): use platform temp dir for contract host
-
c8b8c3e docs(changelog): record skill containment and project MCP env policy (#10693)
-
a87dbe5 test(security): pin shared grant-name acceptance (#10693)
-
7819141 fix(git-master): stop claiming a squash keeps one trailer; instruct one amend rewrite after a squash (#10713)
-
bb89712 fix(security): reuse native atomic MCP grants store (#10693)
-
cf71940 docs(git-master): document the default-on co-author trailer and regenerate config schemas (#10713)
-
c881f47 feat(git-master): restore the sisyphus-dev-ai co-author trailer as a default-on setting (#10713)
-
572ab52 test(security): prove cross-process grant revocation (#10693)
-
0074f01 test(security): pin shared store identity and writer parity (#10693)
-
099952d fix(security): key provenance and cancel targeted materializations (#10693)
-
7ab0550 test(security): exercise targeted manager invalidation (#10693)
-
58e5171 test(security): isolate user client provenance records (#10693)
-
3895daa fix(security): reconcile grant notices and exact user walks (#10693)
-
1225b79 fix(skills): A12 allows intended nested scrollers; one hit-target unit; Layout line without DESIGN.md
-
5f1fe37 test(security): exercise native host policy and user walk (#10693)
-
f0dd7ef test(security): cover grant identity and notice reuse (#10693)
-
3af729b fix(thread): authenticate RPC hosts and fence session mutations
-
c487cf2 fix(security): contain skills and scope legacy MCP env (#10693)
-
b78145d test(security): cover volume casing and pending revoke (#10693)
-
e233904 test(security): cover shared grants and legacy command flow (#10693)
-
dfdba25 test(rpc): cover authenticated fenced client mutations
-
6204a69 test(security): RED for skill link containment and MCP env policy (#10693)
-
96d27a2 chore(bundles): regenerate after merging the #10273 head f7be11c (Linux, bun 1.4.3)
-
f41be51 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
9fe42e6 Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
-
c3d2bb4 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
d8c8607 Merge remote-tracking branch 'origin/dev' into fix/10210-catalog-import-windows
-
a95bee1 test(omo-native): turn off the child's Bun transpiler cache so the #10210 leak test sees only installs
-
7e41d9b docs(changelog): frontend StyleGallery layout contract and HIG build rules (#10685)
-
472accf feat(skills): StyleGallery layout contract on every layout change, checked by visual-qa; HIG as frontend build rules
-
8cb41d4 Merge remote-tracking branch 'origin/dev' into fix/usage-panel-reads-engine-limits
-
26130f1 test(omo-native): run setup e2e children offline so the catalog import stops installing the engine (#10210)
-
c674813 docs(model-capabilities): state the refresh overwrites today and what the guardrail suite really asserts (review)
-
e526e45 docs(model-capabilities): hand-scoped snapshot entries must survive the scheduled refresh (#10665)
-
1c57575 docs(changelog): note the LSP engine leaving omo.js (#10659)
-
10ec20e chore(omo-codex): regenerate the Codex installer bundle after merging dev (Linux, bun 1.4.3)
-
56d7ce6 Merge remote-tracking branch 'origin/dev' into fix/9915-lazy-sidecar-2
-
9bb6909 Merge remote-tracking branch 'origin/dev' into tchain-10225
-
5056656 test(telemetry): the immediate-send import lives in the PostHog sidecar; pair the load spy's module mock with cleanup
-
bee343d Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
e587cec chore(bundles): regenerate after merging dev onto the lazy PostHog sidecar (Linux, bun 1.4.3)
-
34cf3d0 Merge origin/dev (48c3f53, lazy PostHog #10640) into feat/telemetry-summary-crashsafe
-
5cec309 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
b22705a chore(bundles): regenerate after the opt-out and spool-bound fixes and the dev merge (Linux, bun 1.4.3)
-
18afb7f Merge remote-tracking branch 'origin/dev' into tchain-10225
-
54d9920 fix(telemetry): telemetry turned off loads no telemetry code, and the summary spool is bounded
-
639ff84 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
-
0765d28 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
-
84f33e7 chore(bundles): regenerate after the dev merge and the lazy summary recorder (Linux, bun 1.4.3)
-
431005b fix(telemetry-core): daily active shuts its client down when the flush fails
-
ee1757d Merge remote-tracking branch 'origin/dev' into tchain-10225
-
d7a4c8a Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
7ea21a1 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
645eebc chore(bundles): regenerate after merging dev (Linux, bun 1.4.3)
-
634d2d3 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
4863ceb Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
804e85b Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
25ddd47 chore(bundles): regenerate after merging the #10273 refresh (Linux, bun 1.4.3)
-
aa0297b Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-turn-span
-
a781f71 Merge remote-tracking branch 'origin/feat/telemetry-otel-host' into feat/telemetry-spool-lifecycle
-
e354831 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
26fc8fb Merge branch 'feat/dori-extension-host-10315' into feat/dori-toolkit-10316
-
2f91848 Merge branch 'feat/dori-extension-host-10315' into feat/dori-toolkit-10316
-
9bba651 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
97a60c3 Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
87b57a7 Merge branch 'feat/dori-extension-host-10315' into feat/dori-toolkit-10316
-
312713e Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
048a145 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
115ce9c Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
f8e44fc Merge remote-tracking branch 'origin/dev' into fix/10560-side-panel-tui-notice
-
39e5543 docs(changelog): the side panel's regular-mode notice (#10560, #10565)
-
38c65c1 fix(side-panel): a rotation to an unread account draws nothing; omo.json reference describes engine-read usage
-
1a1a8f1 fix(side-panel): read subscription limits from the engine and drop the panel's own poller
-
0ced82c Merge remote-tracking branch 'origin/dev' into fix/10536-pin-check-registry-pairing
-
4579d01 chore(bundles): regenerate omo.js after merging dev 5d1d35e (#10485)
-
ed55219 chore(bundles): regenerate bundles after merging dev 5d1d35e (#10141)
-
1415f9a docs(changelog): builtin profiles resolve to a declared custom provider (#10485)
-
8c33e8c Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
-
728761e Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
-
71e4b0a Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
-
2e7d8c8 chore(bundles): regenerate after merging the refreshed base
-
ad3ce87 Merge branch 'feat/telemetry-otel-host' into t10273m-10358
-
c91a7ff Merge branch 'feat/telemetry-otel-host' into t10273m-10355
-
7d4f5e8 Merge remote-tracking branch 'origin/dev' into feat/dori-toolkit-10316
-
77f9d95 fix(gateway): commit layer-2 replay receipts with the op; off means the tools do not exist
-
3d41798 chore(bundles): regenerate after merging the refreshed base
-
4ed009b Merge branch 'feat/telemetry-otel-host' into t10273m-10355
-
0d51447 Merge branch 'feat/telemetry-otel-host' into t10273m-10358
-
eba53d2 Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
-
ba3fd18 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
b851c52 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
4717ac2 Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
-
2bf81f9 docs: changelog entry for the session-callable store extension ops
-
1e57be3 Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
-
6f10576 Merge remote-tracking branch 'origin/dev' into fix/profile-custom-providers
-
fb41e48 Merge remote-tracking branch 'origin/dev' into fix/10141-family-latest-models
-
3058e8b Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
5c05dd7 Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
-
f5fe6ea Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
-
32f3a47 refactor(model-core): name each family's latest model once (#10141)
-
1e84295 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
75c238e Merge remote-tracking branch 'origin/dev' into wt-9551-lazy
-
b03ab45 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
7fa6d95 perf(gateway): check session op arguments in the store worker without typebox
-
4519aec Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
aad35ac fix(sdk): replay identity covers arguments, expiry and program order; dori layers ship as sidecars
-
4a4f4c0 perf(gateway): import typebox/value lazily in the store worker
-
a3dc0eb fix(config): rename the dori section before the legacy plans validate the target
-
99d69a1 feat(sdk): layer-2 namespace seam with the dori gate and turn-replay idempotency
-
461d6a7 Merge remote-tracking branch 'origin/feat/thread-session-callable-extension-ops' into feat/dori-toolkit-10316
-
079fe59 fix(config): run the dori section rename after the legacy plans
-
2857a31 test(gateway): budget loaded-runner time on worker-heavy tests
-
6a665ca Merge remote-tracking branch 'origin/dev' into wt/9551-devmerge
-
ef37c60 docs(native): describe the dori-extension loader in the omo-native guide
-
a0896d4 fix(native): resolve the dori host entry from the verified package and name the upgrade
-
2e78084 test(gateway): pin the v7 whatsapp fixture to schema v6
-
441c015 Merge remote-tracking branch 'origin/dev' into feat/dori-extension-host-10315
-
df7e747 feat(native): load the dori-extension host under the dori config section
-
e38cf2f Merge remote-tracking branch 'upstream/dev' into fix/9583-web-terminal-waitfor-token
-
4a32a3e feat(gateway): internal session ops reachable only from the session's own component
-
f64ffc7 test(thread): fix two type errors in the extension-tools tests
-
f6b1405 test(thread): restore the await-finality cases next to the throw cases
-
083f966 test(thread): prove the wake touch follows the commit; split the session-call test file
-
d077195 fix(thread): a throwing status or expire never ends a session await early
-
735eee8 docs(thread): document the ext_ tool namespace, exact caller match and await finality
-
e219fb4 test(thread): a registration refused for a taken tool name leaves the schema untouched
-
ef989e1 fix(thread): session-call LOWs from review r1 (L1, L4, L6, L7)
-
e284fdc test(thread): make the hollow session-tool tests able to fail
-
c7a0f37 fix(thread): a restarted store worker never downgrades a newer persisted registration
-
deac642 refactor(thread): drop extensionSessionCall, leaving one session seam
-
94ff808 fix(thread): refuse two sessionCallable entries that declare the same op
-
739a9f7 fix(thread): resolve an extension tool's caller by exact durable id only
-
9e6ac62 test(thread): the await wake test completes from a second store after the waiter armed
-
a7372ec fix(thread): a session await ends only on a final status, else expires and says so
-
0ef50e6 fix(thread): put extension session tools in their own ext__ namespace
-
d161ca5 fix(thread): expire a session await at once when no connector has started
-
31c0f0e docs(thread): document the session-callable extension seam and log the change (omo-gateway todo 14)
-
09a300b feat(thread): one session tool per declared extension op; thread_create records its creator
-
182ebea feat(thread): session-callable store extension ops with a store-stamped caller (omo-gateway todo 14)
-
eb64194 test(thread): work-item status op follows the gateway's lead-path contract
-
48b3082 test(thread): RED tool-surface tests for session-callable extension ops (omo-gateway todo 14)
-
5109348 test(thread): RED contract for session-callable store extension ops (omo-gateway todo 14)
-
9799041 test(telemetry): review the opt-out purge's link-back of a kept claim in the consent-gate audit (#10234)
-
9f63ef6 docs(changelog): link the opt-out purge entry to its PR (#10267)
-
ddbc703 fix(telemetry): the opt-out purge loads with the recovery sidecar, so an opted-out start keeps owner liveness out of the entry bundle (#10234)
-
21f9797 test(telemetry): read the scopeless-window outcome after the recovering process shuts down, now that the recovery sweep loads on demand (#10234)
-
6acb7bb test(telemetry): an opted-out start purges a killed owner whose pid an unrelated process now holds (#10234)
-
a80dbad fix(telemetry): the opt-out purge claims a record before deleting it, so a live writer racing the purge keeps its window (#10234)
-
4cb0ccc fix(telemetry): an opted-out start purges dead owners' summaries, consent is read fresh per write, empty scope fails closed, cwd-less events keep the last cwd (#10234)
-
f3fe90f test(telemetry): RED for opted-out startup purge, consent flip, fail-closed empty scope and cwd-less events (#10234)
-
b26abaa Merge remote-tracking branch 'origin/dev' into tc10225m2
-
4bf5c35 Merge remote-tracking branch 'origin/dev' into tc10225m
-
999d2c4 chore(bundles): regenerate after merging the base and the consent fold
-
677b811 fix(telemetry): read consent fresh on every turn span ending, not only at shutdown
-
3a2ec0a Merge branch 'feat/telemetry-otel-host' into feat/telemetry-turn-span
-
7ca1063 chore(bundles): regenerate after the win32 liveness fix
-
b799545 Merge remote-tracking branch 'origin/dev' into merge-dev-9666
-
32ac851 chore(bundles): regenerate after merging dev
-
54b5c2d Merge branch 'dev' into feat/telemetry-summary-crashsafe
-
778e86c docs(changelog): note the web-terminal {WaitFor:} input token
-
2a71b73 fix(telemetry): end an open turn span at shutdown only under consent, clear its traceparent with the turn
-
068a055 docs(changelog): note the omo.turn span and turn trace context
-
215ef0e feat(telemetry): omo.turn root span with trace context on every turn event
-
e6c2189 test(telemetry-core): drain case uses the collector's exact drain reply; docs(changelog): spool lifecycle
-
7629e98 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
6a1c8c7 feat(telemetry-core): bounded disk spool with ack-gated replay
-
eaeb805 test(telemetry): RED omo.turn span, trace context on turn events, task-bridge traceparent
-
5c55440 test(telemetry-core): spool lifecycle acceptance cases (RED: cap on sweep, scheduler seam, claim re-check, replay-time opt-out)
-
3c2e29c Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
931dd86 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
0176b2a Merge branch 'dev' into fix/9583-web-terminal-waitfor-token
-
f95042e Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
c5469f5 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
090f9ed docs(changelog): note the per-run summary_epoch in the crash-safe session summary entry
-
72e7254 fix(telemetry-core): declare TelemetryDeliveryError and PostHogTransportOptions in the types entry
-
48fe42a fix(telemetry-core): resolve captureImmediate only on a 2xx answer
-
4a0b1b9 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
4a56d59 fix(telemetry): acknowledge session_summary only after an immediate send
-
c5499d5 fix(telemetry): re-send session_summary with its original timestamp
-
499bca8 Merge remote-tracking branch 'origin/dev' into feat/telemetry-summary-crashsafe
-
35e7c37 feat(telemetry): crash-safe session_summary with ownership, stable ids and ack-gated pending files
-
43ac2e9 fix(telemetry): mask provider and model independently
-
79e55f0 feat(telemetry): session_role on session/turn/summary events
-
d74cafa Merge branch 'dev' into fix/9583-web-terminal-waitfor-token
-
35ee8d9 feat(qa): add a {WaitFor:} input token to the web-terminal driver
bun add -g omo-ai