code-yeongyu/oh-my-openagent v5.1.63 on GitHub

The macOS keychain helper's lookup paths and tests are correct on Windows CI. The macOS install locations (the OmO.app runtime and helper copies) are built with POSIX separators on every host, and the #11262 keychain-helper tests use platform-correct paths, so dev's Windows test legs pass again. (#12690, part of #11262)

Fixed: the first device listing no longer waits about 10 seconds for each signed-out or otherwise unsupported device; the bunshin SDK answers such a device's tool list as empty at once instead of trying to describe it. (#12680)

Internal: the vendored bunshin SDK imports its own pinned typebox through omo-senpi's #bunshin-ts-dep/ imports instead of the bare package name, so senpi's extension registry can no longer hand it a different typebox; no user-visible change. (#12676) (#12680)

Thread ops on another device spend fewer relay round trips: the session's attach is kept across ops, and the session's model catalog is held on it, so a model switch to an exact provider/id that catalog lists is one set_model. A set that may have run is still reported as idempotency_uncertain; a refused one re-reads the catalog and answers as a fresh catalog would. Status and transcript reads (get_state, get_messages) still go to the device every time, because the engine's in-memory state changes without a record on the attach. (#12672)

Starting omo no longer reinstalls and restarts a running device service that is only slow to answer: on macOS and Linux a handshake timeout is retried once and then reported as degraded, instead of being treated as a stopped service. (#12665)

A message sent to a thread on another device whose engine answers started without a turn id (senpi 2026.11.2) is now confirmed with the running turn that get_state reports, instead of idempotency_uncertain. (#12660)

Fixed: closing a thread on another device answers closed instead of uncertain (reply_lost); the close was applied there, but its answer was dropped when the other device ended the session's attachment. (#12655)

Fixed: a thread created on another device (thread_create with a device, or a fork there) is named by the id that device lists it by, so reading, messaging, interrupting, switching the model of and closing it work instead of answering session_not_found. (#12651)

Internal: knip ignores the closed-device-login preload fixture (a --preload test file, nothing imports it); no behavior change. (#12648)

A delegated child whose own model chain has no connected provider now fails with one message that names every model in that chain and the exact fix, instead of an opaque "no available model". The chain is listed in order with the providers each model needs, the refusal says which providers are not connected, and it names the key the app's Settings editor writes (categories.<name>.model for a category, agents.<name>.model for an agent), so the parent session can act on the first line instead of retrying a dead binding. The same refusal now covers a lane pinned to a model this machine's registry does not serve, naming the pin and the Settings key. Nothing is substituted and no child is spawned (#12634). (#12636)

Internal (tests only): in the omo-native trust-stage TLS probe, a channel that hangs now reports "timeout" instead of false, so a hang can no longer pass an assertion that expects a TLS rejection. (#12629)

The skills audit's third pass corrects three search commands and one retired category name in the shipped skills (#12525).

Three rg examples used rg -iE. In ripgrep -E is --encoding, not a pattern-type flag, so the combined form consumes the next argument and the examples did not do what they claimed; they now use rg -i.
One refactor guidance line told an agent to fall back from deep; that category was split into deep-low / deep-high, so it now names deep-high. (#12615)

The refactor-squad member prompts keep team_send_message + team_task_update. The team-mode surface does not expose task_send to members, so an earlier draft of this change that rewrote those prompts to task_send({ to: "lead" }) was wrong and has been reverted here. (#12615)

The skills audit's second pass fixed 24 more places where shipped text disagreed with the code. The 591-row community audit left 213 rows "partial"; re-reading them against the current sources, plus the 83 reference rows an earlier pass rejected, found these real ones (#12525). ast-grep's examples now put the search path before --lang (the helper rejects it after, on the Python 3.9 that stock macOS ships) and describe $$$ as the lazy matcher ast-grep 0.51 actually is. refactor's ast-grep call sites now say the helper lives in the ast-grep skill, and mass-ulw's graph example uses new Bun.Glob(...) instead of a glob() the eval kernel does not have. Contradictions inside one surface are gone too: the refactor trigger threshold, browser's WAF routing, ulw-loop's different-goal and self-execution rules, ulw-plan's review-round count and git category, ulw-execute's next-wave amend, mass-ulw's SDK surface and delivery-gate list, ulw-research's sum context fields, visual-qa's 1920 captures, debugging's post-cleanup evidence line, the accent-on-two-primaries line, and git-master's commit gate versus the workflows that mandate commits. (#12614)

Shipped skills no longer give agents contradictory instructions or describe commands that do not work. A community audit of the installed skills listed 591 places where two skills, or a skill and the code, disagree; two model families confirmed 118 root causes in this repo, and 117 are fixed (#12525). The ultrawork verification gate now spawns omo-native-gate-reviewer instead of plan-reviewer, which only reviews plan files. ulw-execute --make-pr hands off with the PR URL and merges only when asked, while --ship merges. ultrawork, review-work, ulw-execute and ulw-loop now agree on who runs final QA. Skills now use the real task_send({ to }) shape, codexGoalJson, session-scoped .omo/ulw-loop/<session-id>/ paths, the lsp_* tool names and LSP config paths each harness reads, ast-grep commands and rule shapes that ast-grep accepts, and the dag SDK's result envelope. The 250-line split rule, the no-refactor rules for bugfixes and legacy code, the Miri ship gate, the SIZE_OK and catch opt-out markers, the ulw-research gate order, and the visual-qa spacing and motion checks no longer contradict each other. (#12528)

Computer use is ready for the tool side of a split session: there the audit file goes to the call owner's audit directory on the device, audit records carry the calling session's id, and capture sizing follows the policy sent with the call instead of a model the device does not have; local sessions behave exactly as before. (#12452)

omo-senpi sessions on macOS no longer wake for every file write in HOME. The config watch added a "a .omo may appear here" target for the cwd and every parent up to and including HOME, and a directory watch on macOS receives every change beneath it, so each session handled every write in HOME. Those creation targets now stop at the project root (the first parent holding .git), and never include the user config directory's parent (HOME, which the user-config target already covers), any directory that contains it, or the filesystem root. .omo directories that already exist are still watched up to HOME; a brand-new .omo above the project root is picked up at the next session start. (#12397)

omo remote attach forwards every engine command to the remote session and shows the engine's own answer. The attach view no longer keeps its own list of allowed commands: apart from its handshake, every record the attach TUI sends goes unchanged to the remote device, whose engine decides it. The engine's reply comes back on the same request with its data (a large reply is reassembled and checked first), refusals are shown exactly as the remote side states them, and dialogs and events the engine sends for those commands reach the TUI. The device-service client speaks the current local API: one engine record per command, the delegated command channel, session.endpoints, listing rows with kind and parent, and the newer refusal and detach reasons. (#12261)

Desktop memory sync now uses the desktop's account instead of the CLI's. An engine the desktop launches claims its private memory-sync channel at startup, answers with the bootstrap handshake and resolves the sync account through the desktop. A launch without that channel still uses the account omo login keeps, and a declared channel that fails reports memory sync as unavailable rather than falling back to CLI credentials. Windows keeps refusing the channel until its pipe-pair path lands. (#12008) (#12064)

Desktop memory sync now attaches on Windows. The engine's receiver no longer refuses win32: it uses the stream senpi hands over for the declared memory-sync channel, which senpi builds from two one-way pipes with their inherit flag already cleared, so the omo side opens no descriptor and spawns nothing. A declared channel that senpi did not adopt still reports memory sync as unavailable, never falling back to CLI credentials. This replaces the Windows refusal that #12008 noted. (#12025) (#12064)

macOS sign-in gets the client side of its signed keychain owner. New modules check the keychain helper's Developer ID signature (an unsigned or ad-hoc copy is never run), find a verified copy, talk to it under the session lock, and keep one approval per process; sign-in uses them through the keychain store below. (#11586, part of #11262) (#11613)

Session locks can be handed to a child process for one call. withLock now gives its callback a lease: handOver(pid) makes a child the lock's live holder and restore() takes it back, aborting the critical section if the lock changed meanwhile. The macOS keychain helper uses it so no other writer can enter while a keychain change is landing. (#11578, part of #11262) (#11613)

macOS sign-in stops asking for keychain access again and again. With OmO's signed keychain helper installed, the sign-in item moves to the helper the first time a token is used, after which reads need no dialog; an item another app created asks at most once per machine with a plain dialog, never a password dialog. Windows and Linux are unchanged. (#11589, part of #11262) (#11613)

omo doctor checks the macOS keychain helper. It reports a missing or damaged helper as a warning (sign-in keeps working through the previous path), and an item the OmO desktop app created is now moved to the helper by the app itself before the CLI would ask for keychain access. (#11613, part of #11262)

Changed

thread_send and thread_handoff to a session on another device no longer read the session's state before the prompt: the prompt goes out first as a follow-up, and the other device's engine decides whether it starts a turn or waits behind the running one. On today's engines a send takes two sequential relay round trips instead of three: the prompt, then one state read for the started turn's id (idle session) or for the queue position (busy session). A send that starts a turn drops to one round trip once the other device's engine carries senpi#6135 (which fixes senpi#5999). A send that arrives while the other session has claimed a turn but not yet started it now answers queued instead of failing as unsupported. A steer still reads the session's state first. (#12679)
The visualize, data-scientist and frontend skills now teach how to build a chart page shown inline beside a reply. Figures are computed at their source (SQL in the database the data lives in, DuckDB or Polars over files). An inline chart is drawn in HTML instead of a matplotlib PNG, with :root { color-scheme: light dark; } so light-dark() fallbacks follow the theme. Bars are HTML elements in a fixed-height container, the first and last axis labels are aligned to the chart edges so neither clips at 390 px, days are cut in the reader's time zone with a partial day marked on its own bar, and one figure is cross-checked against a second source. The preview step now measures each chart's largest bar and legend colours in dark and light at the reply width and 390 px. frontend exempts an inline page from its DESIGN.md gate, Lighthouse audit and research lanes, which visualize already assumed. (#12612)
Internal: the memory component's launch classification is one shared function, so the compiled-executable desktop-sync test exercises the same check omo.js runs. No behavior change. (#12053) (#12064)
Internal: a test now guards that the memory component's shared launch classification module imports nothing, so omo.js's registration half cannot pick up sidecar or private-fds code through it. No behavior change. (#12064)

Fixed

A thread create or fork whose endpoint lookup on the other device times out or loses its connection is now reported as refused, since nothing was sent, instead of uncertain. A timeout after the command was sent stays uncertain. (#12650, part of #12320)
omo login --device and omo login --no-browser now sign in while OmO accounts are still closed, so a computer with no browser or desktop app (for example a server you reach over SSH) can sign in by approving a code on another device. Plain omo login, omo logout and omo whoami still point you to the desktop app. (#12640)
A published omo build can no longer ship the all-zero device-service release key placeholder: the service-auth release step now refuses a key set that is not a strict ed25519 set, and a build with no usable key reports the build defect instead of telling a current user to update. (#12602)
A received memory-sync key naming a path that exists as a FIFO (or another non-regular file) no longer hangs the cycle: the leaf is refused with a receipt before it is read, so the rest of the batch still applies. (#12568, refs #12158)
The memory-core exec-timeout diagnostics case no longer fails under host load: the record's process table is asserted by contract (a table naming the timed-out git, or the process snapshot failed: <reason> form when the snapshot itself times out) instead of requiring the table (#12145). (#12545)
The onboarding context no longer embeds the absolute filesystem path of the installed built-in skills root, so the session context is identical for identical builds whatever the install location. The tour now names the built-in onboarding skill, which the skills listing resolves by name (#12150). (#12544)
When a user or project skill named onboarding shadows the built-in in the skills listing, the tour falls back to the built-in skill's absolute path instead of silently following the shadowing skill; the EQ goldens are re-recorded for the new pointer text (#12544 review). (#12544)
Contributed skills (computer-use, x-search) again yield to any loaded same-name skill, even when the listing carries no path for it, so no duplicate surfaces as a skill-conflict collision; with onboarding in disabled_skills the tour falls back to the built-in path instead of naming a hidden skill (#12544 review). (#12544)
With only your own memory identity on disk, ls, find, grep and glob on ~/.omo, ~/.omo/memory or any other folder above the memory area are no longer refused as "belongs to another memory identity", including when Finder or Explorer left a .DS_Store or desktop.ini there. The guard now refuses a search from above the memory area only while another identity's directory (durable, repo-less, or a live task run) exists there, and the refusal says that one was found without naming it. (#12301) (#12476)

Added

Thread tools use this device's device service to reach your other devices, on in every session with no setting; a device without the service keeps today's local behavior. (#12336, part of #12320)
Thread tools take a thread's account-wide alias and a device to create a thread on, the groundwork for reaching your other signed-in devices: every call answers exactly as it would on this device, and a Free account gets a clear error. Reaching another device arrives with the device-service wiring that follows. A new thread_close ends a session on this device or on another one for every client that holds it; a thread with no live session answers closed: false, and a terminal's own session stays with its terminal. (#12335, part of #12320)
The headless desktop fake backend (senpi-desktop-backend-fake) can script window identity and identity changes, key-priming focus reads and focus-record outcomes, hit reads, a timed user-input history with the frontmost pid, an accessibility deadline and dense-tree knob, epoch events, a display change, and a stop marker. Every new hook records a sink op, every field defaults to today's behavior, and a timeline that could never fire (nth: 0, a press more than an hour away) is rejected at load. (#12313, part of #12232)
The desktop engine protocol gains an opt-in action-report vocabulary on protocol 1, with no version or ABI change. engine.hello lists features: ["action-report"], and a session opened with reportMode: "object" gets an ActionReport from every mutating request. The report says whether input reached the target and whether retrying is safe: one of seven {delivery, retry} pairs. Errors from those requests carry the same disposition. Sessions that don't opt in see the same replies as before, apart from the new features list. The protocol also gains the error codes AmbiguousTarget, CaptureConsentRequired and ProtectedProcess, the epoch.changed notification, and optional window-identity and accessibility-evidence fields that later changes will fill in. Frame ids are now unique per engine process, so a frame id from before a session re-open can never match a new capture. (#12260, part of #12234)
omo Native eval cells can reach this user's machines through the bunshin TypeScript SDK: the plugin bundles @sisyphuslabs/bunshin-ts and @sisyphuslabs/bunshin-ts-relay (vendored build output pinned per file, not npm dependencies) into runtime/bunshin-ts/sdk.js, publishes its directory as OMO_BUNSHIN_TS_SDK_ROOT at activation, and the installer requires it. pickTransport (BUNSHIN_TS_TRANSPORT = auto, relay or hub) uses the local device service when it reports connected; this build bundles no hub transport. Over the relay, one device that is slow, offline or refused on machine.describe no longer fails connect(), listMachines() or fanout() for every machine: it is listed unsupported with attention naming why and after how long, fanout skips it, and the device the cell runs on is listed too (unsupported, since the service runs no machine operation on its own device). A bunshin skill pointer and removed-tool hint teach the import. (#12258, fixes #12251)
629f2ad Merge pull request #12690 from code-yeongyu/fix/11262-windows-keychain-tests
e655775 Merge pull request #12544 from surlymochan/fix/12150-onboarding-context-install-path
3dae0cd Merge pull request #12736 from cynkai/fix/12733-registrant-wait-diagnostics
80cb4ab test(device-service-core): name the registrant events seen when a recorder wait runs out (refs #12733)
208502f Merge pull request #12727 from cynkai/fix/12693-redact-pem-time-bound
fb81108 Merge pull request #12653 from code-yeongyu/feat/omodev-renewal-draft
b2fe6ed test(memory-core): assert the malformed-PEM scan scales linearly instead of a wall-clock bound (#12693)
a21b4b0 Merge pull request #12726 from cynkai/fix/12609-audit-skip-changes-md
45c66fa test(memory-core): give the malformed-PEM redaction bound room for loaded runners (#12693)
a4fd0b2 fix(audit): keep changes.md logs out of the agent-command-string scan (#12609)
51085f9 Merge pull request #12679 from code-yeongyu/perf/remote-send-one-rtt
fdc60ea Merge origin/dev (c5932ec) into perf/remote-send-one-rtt
f6dd82d Merge origin/dev (2b589cd) into perf/remote-send-one-rtt
c5932ec Merge pull request #12680 from code-yeongyu/chore/revendor-bunshin-ts-696
b1941d4 Merge remote-tracking branch 'origin/dev' into feat/omodev-renewal-draft
8b1baeb Merge remote-tracking branch 'origin/dev' into fix/11262-windows-keychain-tests
cacd346 Merge pull request #12697 from code-yeongyu/fix/12694-memory-selection-test-win32-paths
9948ae3 Merge remote-tracking branch 'origin/dev' into gh-feed-regen-12544a
2b589cd Merge pull request #12545 from surlymochan/fix/12145-exec-timeout-diagnostics-flake
7667172 Merge remote-tracking branch 'origin/dev' into gh-feed-regen-12545b
cd26f01 Merge remote-tracking branch 'origin/dev' into feat/omodev-renewal-draft
1dc315f Merge pull request #12672 from code-yeongyu/feat/remote-thread-one-rtt
6e87f2f Merge remote-tracking branch 'origin/dev' into perf/remote-send-one-rtt
fa658d9 Merge remote-tracking branch 'origin/dev' into chore/revendor-bunshin-ts-696
d990289 Merge dev into feat/remote-thread-one-rtt (generated bundles regenerated)
3fb0bbc test(memory): run the three POSIX inherited-socket cases on POSIX only (#12694, win32 versions #12698)
e166755 test(memory): spawn the selection and engine fixtures by native path on win32 (#12694)
ee0d0de docs(changes): fragment for #12690
bec7d96 fix(service-auth): make the #11262 keychain-helper code and tests correct on Windows CI
4edeb9e changes: #12672's fragment is 12672.md and names only what it does (no session_key: relayd never hands it to a local client)
2ccb13a Merge remote-tracking branch 'origin/dev' into fix/12145-exec-timeout-diagnostics-flake
9afd6e6 Merge pull request #12681 from code-yeongyu/fix/changelog-fragment-names
e692141 Merge remote-tracking branch 'origin/dev' into fix/changelog-fragment-names
e248136 Merge pull request #12064 from code-yeongyu/fix/11997-launch-classification-guard
5b1d565 fix(changes): name fragments by PR number so the release stamp parses
65c08c1 docs(changes): name #12679's fragment by PR number and state today's round trips
fa9ecde Merge remote-tracking branch 'origin/dev' into feat/omodev-renewal-draft
86d8e92 docs(changes): add the 12680 fragment (with the missing #12676 internal note)
e25b69b Merge remote-tracking branch 'origin/dev' into stack/12064
dc80987 Merge pull request #12676 from code-yeongyu/fix/bunshin-vendor-typebox-isolation
0a0354a perf(thread): a remote thread_send is one relay round trip (no get_state before the prompt)
afb3ea1 fix(thread): fold review of #12672 (uncertain set, unused page cache, later-rung match)
c18787d fix(thread): keep get_state and get_messages remote
73ada10 Merge remote-tracking branch 'origin/dev' into stack/12064
a8ad98e Merge pull request #12568 from surlymochan/fix/12158-memory-sync-non-regular-leaf
109eb24 fix(web): keep the phone menu on screen and the header inside 320 px
d4bfd6d fix(thread): a held model catalog decides only an exact provider/id
1355614 fix(thread): one relay round trip per remote thread op
a68c13f Merge remote-tracking branch 'origin/dev' into stack/12064
91c2965 Merge pull request #12671 from code-yeongyu/fix/bunshin-sdk-raw-tls-guard
0e0899d Merge commit 'c57458fdbc8826f0207c1f93cf178a128edd77d2' into gh-feed-regen-12568a
c57458f Merge pull request #12397 from viiqswim/fix/config-watch-creation-scope
367ceda fix(web): lower the lint baseline, keep the nav stars live, scope color-scheme to the root
7289f9e test(security): reviewed TLS-guard entry for the embedded bunshin SDK's transport.connect() (local unix socket / loopback, no TLS)
3cc73f5 Merge dev into fix/config-watch-creation-scope
206ce79 Merge pull request #12668 from code-yeongyu/fix/packed-plugin-sdk-artifact
aa97998 test(script): stage the bunshin-ts SDK runtime in the packed-layout fixture (#12258 made it a required artifact)
d08370e Merge pull request #12660 from code-yeongyu/fix/remote-prompt-started-no-turnid
7484141 Merge origin/dev into fix/remote-prompt-started-no-turnid (generated bundles regenerated)
b2af1d1 Merge pull request #12667 from code-yeongyu/fix/knip-ended-command-wait
1355375 fix(device-service-core): ENDED_COMMAND_WAIT_MS is module-internal (knip unused export)
6a12c07 Merge pull request #12665 from code-yeongyu/fix/device-service-handshake-timeout-not-stopped
81ca7eb fix(device-service-core): a handshake timeout from a running service is not a stopped service (no reinstall)
2f49a4c Merge pull request #12313 from code-yeongyu/cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
3dc6cec Merge pull request #12258 from code-yeongyu/feat/bunshin-ts-sdk-embed
9182621 Merge origin/dev into feat/bunshin-ts-sdk-embed (generated bundles regenerated)
3826e84 Merge pull request #12650 from code-yeongyu/fix/endpoint-lookup-not-sent
1e957d2 Merge origin/dev into fix/endpoint-lookup-not-sent (generated bundles regenerated)
f387817 Merge pull request #12655 from code-yeongyu/fix/remote-close-reply
61d96a4 Merge origin/dev into fix/remote-close-reply (generated bundles regenerated)
4e3f35d fix(web): keep language links on the current page, translate the home, add the phone menu
1bf0ee6 test(backend-fake): initialize DesktopWindow.identity after #12260
e42dff3 Merge remote-tracking branch 'origin/dev' into cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
38da142 feat(web): carry the doriterm theme across the whole site and keep the workflow graph
1e245ee Merge pull request #12260 from code-yeongyu/cu-v2/task-1-p1a-protocol-v1-wire-vocabulary-result-e
65bcdec Merge remote-tracking branch 'origin/dev' into fix/remote-close-reply
bcc0208 Merge remote-tracking branch 'origin/dev' into adopt-12650
a4a926d Merge pull request #12654 from code-yeongyu/fix/regen-service-auth-locate
37b6ed6 docs(changes): add the 12655 fragment (#12320)
26aadb4 fix(device-service-core): settle a command that ends its own attach
b0ea846 fix(omo-native): regenerate service-auth.generated.js for session.locate (#12651)
7bfd166 Merge remote-tracking branch 'origin/dev' into fix/12258-settle-per-machine
a5dd4f0 Merge dev into fix/config-watch-creation-scope
12d383d feat(web): omo.dev home renewal draft in the doriterm.com landing system
ff88fe8 Merge remote-tracking branch 'origin/dev' into cu-v2/task-1-p1a-protocol-v1-wire-vocabulary-result-e
a3f7877 Merge pull request #12652 from code-yeongyu/fix/knip-endpoint-wait
f5eb777 fix(device-service-core): ENDPOINT_COMMAND_WAIT_MS is module-internal (knip unused export)
b7cb23d docs(device-service-core): endpointCommand rejects pre-send lookup failures as not_sent
6dcd86d Merge remote-tracking branch 'origin/dev' into stack/12064
757f32f Merge pull request #12651 from code-yeongyu/fix/12320-remote-followup-session-id
8c6bc8d Merge remote-tracking branch 'origin/dev' into stack/12064
f728bd3 docs(changes): add the 12651 fragment (#12320)
9ad4828 fix(thread): address a session created on another device by its listing key
e5476a5 docs(changes): note the endpoint lookup refusal
1897b71 Merge remote-tracking branch 'origin/dev' into cu-v2/task-1-p1a-protocol-v1-wire-vocabulary-result-e
a222fb8 Merge remote-tracking branch 'origin/dev' into fix/12258-settle-per-machine
53dc8ae Merge pull request #12336 from code-yeongyu/feat/12320-thread-device-service
c075cae Merge remote-tracking branch 'origin/dev' into cu-v2/task-1-p1a-protocol-v1-wire-vocabulary-result-e
27e3f2a Merge pull request #12649 from code-yeongyu/fix/knip-threadcloseparams
556ec6c fix(thread): ThreadCloseParams is module-internal (knip unused export)
b5b14ac Merge remote-tracking branch 'origin/dev' into cu-v2/task-1-p1a-protocol-v1-wire-vocabulary-result-e
3f9cdc0 Merge remote-tracking branch 'origin/dev' into w12336-endpoint
9904d2e Merge pull request #12235 from code-yeongyu/cu-v2/task-2-p3a-threat-model-for-serve-multi-connect
2ca5305 Merge remote-tracking branch 'origin/dev' into w12336-endpoint
9ca4dcf Merge pull request #12335 from code-yeongyu/feat/12320-thread-cross-device
b95d179 Merge pull request #12648 from code-yeongyu/fix/knip-closed-device-login-fixture
54bf500 Merge remote-tracking branch 'origin/dev' into w12336-endpoint
354e562 Merge remote-tracking branch 'origin/feat/12320-thread-cross-device' into w12336-endpoint
c225276 changes: fragment for #12648
4875c2d fix(knip): ignore the closed-device-login preload fixture (#12639 follow-up)
8a5f3af Merge pull request #12263 from code-yeongyu/cu-v2/task-3-p5a-threat-model-and-compatibility-matri
97558e2 Merge remote-tracking branch 'origin/dev' into stack/12064
463059d Merge remote-tracking branch 'origin/dev' into HEAD
bf84cca Merge remote-tracking branch 'origin/feat/12320-thread-cross-device' into w12336-endpoint
cf67f9b Merge pull request #12636 from code-yeongyu/fix/child-inherit-session-model
05e2328 Merge pull request #12640 from code-yeongyu/fix/closed-device-login
0ba4b8d Merge origin/dev into fix/child-inherit-session-model
93afb42 Merge dev into fix/config-watch-creation-scope
a1ca465 Merge remote-tracking branch 'origin/dev' into w12336-endpoint
b8cf44e Merge remote-tracking branch 'origin/dev' into cu-v2/task-1-p1a-protocol-v1-wire-vocabulary-result-e
294defc Merge pull request #12644 from code-yeongyu/fix/11262-lint-ratchet-nonnull
b43cfe4 Merge remote-tracking branch 'origin/dev' into fix/closed-device-login
f7eaaac test(service-auth): replace the non-null assertion in approval-cache.test.ts with an explicit guard (#11262)
4338921 Merge pull request #11613 from code-yeongyu/feat/11262-keychain-handoff
15d44d1 Merge commit '81ed5934013aeb173fa87b190e357e0ad8bdc4c7' into kc11262-handoff
ef6d152 docs(changes): unreleased note for #12640
81ed593 Merge pull request #12261 from code-yeongyu/feat/ds2b-remote-attach-forward-all
e86ede6 fix(service-auth): run the device-code login while accounts are closed (#12639)
93bdf9b feat(thread): add thread_close for a session on this device or another one (#12320)
8f84a8e test(service-auth): closed accounts run the device-code login (#12639), RED first
67c6426 fix(thread): confirm a remote start only from the engine started disposition and its turn id (#12320)
e07954f Merge pull request #12629 from code-yeongyu/fix/10762-probe-timeout-distinct
e269534 Merge remote-tracking branch 'origin/dev' into o-12261
e260376 test(thread): split remote fixtures and send cases
5189346 Merge remote-tracking branch 'origin/dev' into o-12335
8ba8481 Merge remote-tracking branch 'origin/dev' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
a2ef565 Merge pull request #12612 from code-yeongyu/skills/learn-from-aside-viz
e748e73 chore(changes): add fragment for #12629
d785f1c test(omo-native): report a hung TLS probe channel as a timeout, never a rejection (#10762)
2e1b80e Merge remote-tracking branch 'origin/dev' into skills/learn-from-aside-viz
f13e1ee feat(desktop-core): protocol v1 wire vocabulary and result envelope (P1a)
5df8d1c Merge pull request #12615 from code-yeongyu/fix/skill-conflicts-12525-pass3
881b9f7 Merge commit '45665ef24291d3dc94ed554db3ca236215f28a9e' into kc11262-handoff
45665ef Merge pull request #12602 from code-yeongyu/fix/12601-release-key
206e993 docs(changes): list the package-log sections newest first
164ed9b Merge remote-tracking branch 'origin/dev' into stack/12064
6f49c29 chore(changes): name the real cause of the rg -iE fix
e825568 chore(changes): describe the third pass accurately
b98a091 fix(skills): keep team-mode calls in the refactor squad prompts
d9ea72d chore(changes): add the fragment for the third skills pass
621a009 merge dev into fix/skill-conflicts-12525-pass3
acfeacc Merge pull request #12614 from code-yeongyu/fix/skill-conflicts-12525-pass2
8a36a00 Merge pull request #12610 from code-yeongyu/fix/12580-release-key-followups
d7744c9 Merge remote-tracking branch 'origin/dev' into fix/12580-release-key-followups
d3750f7 merge dev into fix/skill-conflicts-12525-pass2
2b12d2f Merge pull request #12528 from code-yeongyu/fix/skill-context-conflicts-12525
7bb76f4 Merge commit 'f920436f216ca870a91b50a5b5635e7321babadb' into kc11262-handoff
193cc4f Merge remote-tracking branch 'origin/dev' into cu-v2/task-2-p3a-threat-model-for-serve-multi-connect
ac52627 Merge remote-tracking branch 'origin/dev' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
f920436 Merge pull request #12595 from code-yeongyu/fix/12557-o01-probe-suite-order
509da9e Merge remote-tracking branch 'origin/dev' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
58a5bf8 Merge pull request #12447 from code-yeongyu/feat/o9-telemetry-hand-context
e3c2852 Merge pull request #12446 from code-yeongyu/feat/o5-lsp-scope
02ce8bc Merge dev into fix/config-watch-creation-scope
d86f571 Merge origin/dev f2a520f into fix/12601-release-key
04d750d Merge remote-tracking branch 'origin/dev' into fix/12580-release-key-followups
a5c3399 Merge remote-tracking branch 'origin/dev' into feat/o9-telemetry-hand-context
9b430f2 Merge remote-tracking branch 'origin/dev' into feat/o5-lsp-scope
f2a520f Merge pull request #12452 from code-yeongyu/feat/o13-computer-use-hand-audit-scope
eaf945f Merge remote-tracking branch 'origin/dev' into fix/12557-o01-probe-suite-order
299fe14 Merge remote-tracking branch 'origin/dev' into fix/skill-context-conflicts-12525
a577841 Merge origin/dev into fix/12601-release-key
f17d582 Merge pull request #12476 from code-yeongyu/fix/12301-guard-ancestor-root
2e6972a chore(bundle): regenerate O13 computer use on the dev merge
eff4a35 fix(skills): say create-goals, not createGoals, in the shared define-goal copy
79afa33 fix(skills): give refactor members the tools they actually have, and fix the rg examples
12609e6 fix(skills): run the ast-grep helper examples in the order python 3.9 accepts
ae7d3ae Merge origin/dev into fix/12601-release-key
78ed39b fix(skills): fold the #12614 review findings
8a0b227 test(eq): re-record the EQ.omo linux goldens for the computer-use skill hash
7ff3b56 docs(skills): mention visualize only where it ships; rewrap placement rule
cddbca5 Merge remote-tracking branch 'origin/dev' into feat/o13-computer-use-hand-audit-scope
8e0e0df fix(skills): name the create-goals handoff harness-neutrally in both define-goal copies
a388be8 Merge remote-tracking branch 'origin/dev' into fix/12301-guard-ancestor-root
9921870 Merge pull request #12607 from code-yeongyu/release/v5.1.62-source-state
cfdc22f docs(changes): note the second-pass skills audit fixes
e313b72 fix(skills): correct the second-pass audit rows the first fold left behind
4c6d576 docs(changes): add fragment for #12612
0472192 docs(skills): fold inline-chart review lessons into visualize, data-scientist and frontend
5802018 test(device-service-core): keep the release key pin and drop the bundle-input edit (#12580)
5f35884 test(device-service-core): pin the release key set and assert the whole bin dir stays absent (#12580)
0922b96 Merge remote-tracking branch 'origin/dev' into feat/o9-telemetry-hand-context
ab0afeb Merge remote-tracking branch 'origin/dev' into feat/o5-lsp-scope
355fe03 Merge remote-tracking branch 'origin/dev' into fix/skill-context-conflicts-12525
c327e5c fix(skills): fold the #12528 review findings for the Codex edition
4a1f3f1 docs(changelog): add the #12602 fragment
44ea435 fix(device-service): fail the release on a placeholder key and stop advising an update that cannot help
d41e35b Merge dev into fix/config-watch-creation-scope
cf9d32c Merge remote-tracking branch 'origin/dev' into fix/12301-guard-ancestor-root
a82ad13 Merge remote-tracking branch 'origin/dev' into fix/skill-context-conflicts-12525
a5e8495 fix(desktop-backend-fake): keep the user-press record in press order when take runs late
56fc8f0 Merge remote-tracking branch 'origin/dev' into feat/bunshin-ts-sdk-embed
c093047 docs(threat-model): fold review nits (exit path step 0, Start retry scope, glossary + WHERE TO LOOK row)
4235add Merge remote-tracking branch 'origin/dev' into cu-v2/task-2-p3a-threat-model-for-serve-multi-connect
e06537b docs(changes): fold the stack members fragments into one for the landing PR
506878d Merge remote-tracking branch 'origin/dev' into fix/12301-guard-ancestor-root
87cbf9e docs(changes): the folded #11586 entry no longer says the modules are unwired (#11262)
6aaf30d fix(service-auth): report the unreadable discard before row 8b retires the old keychain item (#11262)
d1ec714 Merge remote-tracking branch 'origin/dev' into stack/12064
2ccff34 test(service-auth): pass beforeKeysDiscarded to the fake keychain session after merging dev (#11262)
be8ac94 Merge commit '4ab979a883132b998676853e63edf4cd61c9a5e5' into kc11262-handoff
27b2acf fix(memory): run the ancestor re-check from the guard's existing tool_result hook (#12301)
dfcc50d Merge remote-tracking branch 'origin/dev' into kc11262-handoff
39ae5fe chore(bundle): regenerate O13 computer use after sync
c1ca9bc Merge remote-tracking branch 'origin/dev' into feat/o13-computer-use-hand-audit-scope
5085e53 fix(memory-core): narrow exec-timeout snapshot excuse to ETIMEDOUT, parameterize snapshot-contract cases
49a50e2 Merge commit '03b7812e9dd5a032bc7fc243a1bb22e7dd0c32f9' into kc11262-handoff
4126f4a Merge commit 'efb4259f15e62010d6a4a21494e012a2acce86f7' into kc11262-handoff
5de2e6c test(memory-core): clear the landing race timer once prepareLanding wins (#12568 review)
36e43a8 test(audit): allowlist the keychain helper doctor test's omo doctor label
f93cb13 docs(changes): fold the keychain stack's fragments into #11613
0c38add fix(memory-sync): refuse non-regular leaf files on landing
13ee710 fix(memory): clear tool details on a replaced ancestor result and release pending checks when a call ends (#12301)
6265718 fix(memory-core): assert the timeout-diagnostics contract, not the host's snapshot
92e0d4b docs(changes): add the #12528 fragment
f78e95c fix(skills): resolve the context conflicts from the community skills audit
2a795c8 fix(memory): skip regular files and list memory areas by canonical form in the ancestor scan (#12301)
a2edfa5 chore(bundle): regenerate O13 computer use after sync
ed9edc2 fix(memory): deny ancestor enumeration only when a foreign identity exists (#12301)
bccdba8 Merge remote-tracking branch 'origin/dev' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
20316dd Merge remote-tracking branch 'origin/dev' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
6316786 Merge remote-tracking branch 'origin/dev' into feat/o13-computer-use-hand-audit-scope
281b221 Merge remote-tracking branch 'origin/dev' into feat/12320-thread-cross-device
d76c508 chore(changes): fragment for #12452
d9bc46b Merge branch 'dev' into feat/ds2b-remote-attach-forward-all (#12261)
703cea9 feat(desktop-tool): audit file and capture policy from a hand's execution scope (O13)
eed7d59 Merge remote-tracking branch 'origin/dev' into feat/bunshin-ts-sdk-embed
dd17f89 test(desktop-tool): audit file and capture policy from a hand's execution scope (O13, RED)
c4af9ee Merge remote-tracking branch 'origin/dev' into feat/bunshin-ts-sdk-embed
fc76a9a Merge branch 'kc11262-store' into kc11262-handoff
c271974 Merge branch 'kc11262-lease' into kc11262-store
c0c1702 Merge branch 'kc11262-client' into kc11262-store
ee81554 Merge remote-tracking branch 'origin/dev' into kc11262-lease
246e489 Merge remote-tracking branch 'origin/dev' into kc11262-client
adebd53 Merge remote-tracking branch 'origin/dev' into feat/12320-thread-cross-device
7c7bba8 fix(service-auth): a throwing signature check is a typed result at every call site (#11262)
445c2ba Add changelog fragment for #12397
dd7af71 fix(service-auth): an older helper skipped retire gets the old-slots-full guidance on re-login (#11262)
51de6c4 fix(service-auth): a throwing signature check is a typed unavailable, not a cached rejection (#11262)
37441f1 Merge branch 'kc11262-store' into kc11262-handoff
2b7929b fix(service-auth): register the helper beside the runtime and accept older helper answers (#11262)
aa049b2 Merge branch 'kc11262-store' into kc11262-handoff
13325a3 Merge branch 'kc11262-client' into kc11262-store
5c93533 fix(service-auth): keep pin failures typed and the approval clock runtime-neutral (#11262)
f1d56c2 Merge branch 'kc11262-store' into kc11262-handoff
b17e9d6 Merge branch 'kc11262-lease' into kc11262-store
6a0683e Merge branch 'kc11262-client' into kc11262-store
a18d52e Merge remote-tracking branch 'origin/dev' into kc11262-lease
3270acb Merge remote-tracking branch 'origin/dev' into kc11262-client
3ccb1d8 Merge remote-tracking branch 'origin/dev' into feat/bunshin-ts-sdk-embed
387cd79 Merge remote-tracking branch 'origin/dev' into feat/ds2b-remote-attach-forward-all
1fc95bb Merge remote-tracking branch 'origin/dev' into feat/ds2b-remote-attach-forward-all
931cbee Merge commit '7d511d1b7dc70e01d7834418de04751fbf5cd81d' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
57d1f65 Merge remote-tracking branch 'origin/dev' into cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
688fbea Merge remote-tracking branch 'origin/dev' into cu-v2/task-2-p3a-threat-model-for-serve-multi-connect
ea36ddd Merge branch 'stack/12053' into stack/12064
4e5c2ef Merge branch 'stack/12025' into stack/12053
9b5bb80 Merge branch 'stack/12008' into stack/12025
0573928 Merge remote-tracking branch 'origin/dev' into stack/12008
2aae713 Merge remote-tracking branch 'origin/dev' into cu-v2/task-2-p3a-threat-model-for-serve-multi-connect
96e707f Merge commit '5487861bd8fa24390a1ac6a07896ee6fc9de0043' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
f81eac8 Merge remote-tracking branch 'origin/dev' into cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
db12c5a fix(device-service-core): drop PATH_MAX_CHARS from knip's unused-export rows
6997ffe Merge remote-tracking branch 'origin/dev' into feat/12320-thread-cross-device
ceae7f0 style(desktop-backend-fake): rustfmt the new scripting files
988c774 Merge remote-tracking branch 'origin/dev' into cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
7bc6e06 docs(desktop): re-pin the run sandbox matrix to dev 7adadfb
aa957fd Merge commit '7adadfb805cf0fa309db8c44cd41686d9a0fd317' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
41b0b72 Merge remote-tracking branch 'origin/dev' into cu-v2/task-2-p3a-threat-model-for-serve-multi-connect
a0240f9 Merge branch 'feat/12320-thread-cross-device' of https://github.com/code-yeongyu/oh-my-openagent into feat/12320-thread-device-service
3d27bac Merge branch 'feat/12320-thread-cross-device' of https://github.com/code-yeongyu/oh-my-openagent into feat/12320-thread-device-service
0ef1770 fix(desktop-backend-fake): fold #12313 review - frontmost sink op, bounded timeline, nth 0 rejected, focus read window check
db2f210 docs(desktop): mark the client start retry as a required P3b change, not current behavior
2078851 Merge remote-tracking branch 'origin/dev' into cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
3b6d7d4 Merge remote-tracking branch 'origin/feat/12320-thread-cross-device' into feat/12320-thread-device-service
3baebe2 Merge branch 'o8-12335-prestage' of https://github.com/code-yeongyu/oh-my-openagent into feat/12320-thread-device-service
de0f857 Merge remote-tracking branch 'origin/feat/12320-thread-cross-device' into feat/12320-thread-device-service
42d97dc chore(bundle): raise omo.js budget for the cross-device thread contracts (+5.4 KB)
5522382 Merge branch 'o8-12320c-prestage' of https://github.com/code-yeongyu/oh-my-openagent into feat/12320-thread-device-service
78f0a71 Merge branch 'o8-12320c-prestage' of https://github.com/code-yeongyu/oh-my-openagent into feat/12320-thread-device-service
4517c59 docs(changes): fragment for #12336
c240da3 Merge remote-tracking branch 'origin/feat/12320-thread-cross-device' into feat/12320-thread-device-service
47a7787 docs(changes): fragment for #12335
3741ac6 Merge commit '46d0ceb8d2abccb1b93d77926ff0d157cf2d9238' into cu-v2/task-3-p5a-threat-model-and-compatibility-matri
4492a8e Merge remote-tracking branch 'origin/dev' into cu-v2/task-2-p3a-threat-model-for-serve-multi-connect
5202f74 Merge branch 'feat/12320-thread-cross-device' into feat/12320-thread-device-service
142a4a2 docs(desktop): fold review nits into the run sandbox threat model
58ca085 build(omo-native): regenerate service-auth.generated.js for the delegated-channel fix
b836abc fix(device-service-core): the delegated channel rides the attach's own event listener
918029c Merge remote-tracking branch 'origin/dev' into cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
11a3a8a feat(device-service-core,omo-native): delegated replies for remote attach; local API client synced (DS2b D5)
145f44e Merge origin/dev (8c08758767) into feat/ds2b-remote-attach-forward-all
e9f7e11 docs(changes): add unreleased fragment for #12313
ed2ab37 Merge remote-tracking branch 'origin/dev' into cu-v2/task-5-fake-backend-scripting-surface-for-v2-sc
67f3cb9 docs(desktop): one non-blocking instance-lock semantics through idle exit
f53a08e Merge remote-tracking branch 'origin/feat/11262-keychain-store' into feat/11262-keychain-handoff
7bc2045 Merge remote-tracking branch 'origin/feat/11262-session-lock-lease' into feat/11262-keychain-store
52ae9e4 Merge remote-tracking branch 'origin/feat/11262-keychain-client' into feat/11262-keychain-store
08e3827 Merge remote-tracking branch 'origin/dev' into feat/11262-session-lock-lease
72489d7 Merge remote-tracking branch 'origin/dev' into feat/11262-keychain-client
6b91d87 Merge remote-tracking branch 'origin/feat/11262-keychain-store' into feat/11262-keychain-handoff
37d3739 fix(service-auth): the hermetic test store is never helper-eligible; locked reads stay on the view (#11589 review)
4a91c7d Merge remote-tracking branch 'origin/feat/11262-keychain-store' into feat/11262-keychain-handoff
928bbb9 fix(service-auth): a launcher-injected Bun.secrets never counts as the real macOS store (#11262)
551500a docs(desktop): fold #12235 review receipt (stale-socket race, UDS stop restart test, client server-uid check)
625cc6d Merge remote-tracking branch 'origin/feat/11262-keychain-store' into feat/11262-keychain-handoff
8f6f76b Merge remote-tracking branch 'origin/feat/11262-keychain-base' into feat/11262-keychain-store
affc79b Merge remote-tracking branch 'origin/feat/11262-session-lock-lease' into feat/11262-keychain-base
a43f98f Merge remote-tracking branch 'origin/dev' into feat/11262-session-lock-lease
78ea421 Merge remote-tracking branch 'origin/dev' into feat/11262-keychain-client
00e2218 test(release): run the chained restore and verify steps in their own shells, as CI does (#11262 RULING-77)
d44c1aa fix(service-auth): hand-off spawns through the runtime shims; #11613 tests on the merged lock and session contracts (#11262)
6586b20 docs(desktop): cover already-running daemons in the threat model startup order
9f6c700 Merge remote-tracking branch 'origin/feat/11262-keychain-store' into feat/11262-keychain-handoff
a38323d fix(service-auth): keep keychain helper switches module-private for knip (#11262)
c6e9c29 Merge remote-tracking branch 'origin/feat/11262-keychain-client' into feat/11262-keychain-store
49e6a35 fix(service-auth): keep the helper path on dev's credential contracts (#11262)
3429f57 fix(service-auth): spawn the helper and codesign through the shared runtime shims (#11262)
dafef61 fix(service-auth): load the keychain interaction switch through the bun-ffi shim (#11262)
c387722 Merge remote-tracking branch 'origin/feat/11262-session-lock-lease' into feat/11262-keychain-store
ca75f44 Merge remote-tracking branch 'origin/feat/11262-keychain-client' into feat/11262-keychain-store
4db6b4a Merge remote-tracking branch 'origin/dev' into feat/11262-session-lock-lease
6973a21 fix(service-auth): keep module-private helpers unexported until a consumer lands (#11262)
e337947 Merge remote-tracking branch 'origin/dev' into feat/11262-keychain-client
ee84143 feat(omo-native): remote attach forwards every non-plumbing record to the host (DS2b G1, M6)
38521ea docs(changes): name the bunshin-ts SDK fragment after #12258
902957b docs(desktop): re-pin the run sandbox matrix to dev 7ad7757
6648324 docs(desktop): fold advisory review round 2 into the run sandbox threat model
bc1958e docs(desktop): fold advisory review round 1 into the run sandbox threat model
3abab5e docs(desktop): computer.run QuickJS sandbox threat model and compatibility matrix
8bbf92a feat(desktop-backend-fake): scripting surface for identity, focus reads, hits, user input, epochs
10caee8 docs(desktop): fold threat model review round 2 (fd-based daemon check, startup order, notifications, attach guard)
78575b8 docs(desktop): fold threat model review round 1 (squatting, Windows pipe, citations)
ce06efc docs(desktop): attach and --serve multi-connection threat model
11b2ee2 fix(team-core): write the process-start line when a lock is handed over
e2d66a2 test(team-core): await the async lock record builder the base now returns
d36ddc1 Merge remote-tracking branch 'origin/dev' into bw-redbatch/11578-merge
5a8c2f2 Merge remote-tracking branch 'origin/fix/11997-fixture-classifier' into wt12064
83988f9 Merge remote-tracking branch 'origin/feat/11997-win32-memsync-channel' into wt12053
66e9118 chore(knip): register the compiled channel fixture as a by-path entry (#11997)
7bfd74a docs(changes): add the #12064 fragment (#11997)
5c57e55 Merge remote-tracking branch 'origin/fix/11997-fixture-classifier' into wt12064
a4952f0 Merge remote-tracking branch 'origin/feat/11997-win32-memsync-channel' into fix/11997-fixture-classifier
a7a3604 chore(bundle): raise omo.js budget for the win32 memsync channel stack
0da9847 Merge #12053 head 0ead4ee into the launch-classification guard (#11997)
3500f5d Merge #12025 top 6b81eb6 (dev ebaf17c) into the #12053 follow-up (#11997)
ca3db0a Merge dev (ebaf17c) into the #12008 <- #12025 stack top (#11997)
067e9df test(memory): guard that the launch classification module imports nothing (#11997)
855a023 docs(changes): fragment for #12053
d01a4c9 refactor(memory): share the launch classification between omo.js and the compiled fixture (#11997)
76940ff Merge dev (6385b29) into the #12008 <- #12025 stack top (#11997)
b955297 test(memory): compiled-engine fixture uses #12008's sidecar selection API (#11997)
b04fb32 Merge #12008 (67758ea: dev merge + omo.js slim) into the #11997 win32 receiver
65786dd fix(memory): move the Worker-port answer and launch read out of omo.js
c95a112 Merge remote-tracking branch 'origin/dev' into feat/memsync-host-source-selector
75a225e refactor(memory): drop the unreachable platform_not_supported reason; channel tests stop overriding process.platform (#11997 review LOWs)
3a81453 test(memory): compiled-engine fixture claims through #12008's lazy desktop claim (#11997)
cd95702 Merge #12008 (8006d93) into the #11997 win32 receiver
83ef8c0 fix(memory): keep the memory-sync selector out of omo.js
2e5271c fix(memory): changelog fragment, drained fixture exit, ignored spare fds in the compiled test (#11997 review)
4da2860 docs(changes): note desktop memory sync selecting the desktop account
e4a5351 chore(knip): name the engine fixture's default export as loaded by path
c534a44 test(memory): launch the real engine with a fresh environment
b2788fe test(memory): prove the real engine claims the desktop memory-sync channel at startup
ee54959 fix(memory): observe workers with injected accounts
42c9958 feat(memory): prestage host account source selection
4f8d888 Merge remote-tracking branch 'origin/dev' into feat/11262-session-lock-lease
9be8431 Merge remote-tracking branch 'origin/dev' into feat/11262-session-lock-lease
e794cfa Merge remote-tracking branch 'origin/dev' into feat/11262-session-lock-lease
70e99d0 Merge remote-tracking branch 'origin/dev' into feat/11262-session-lock-lease
d8660ba test(service-auth): pin the in-flight attach and the release order directly (#11262)
e87aa7a ci(release): omo-runtime-capabilities.json is an unconditionally required release asset (#11262 RULING-77)
6ab56a8 Merge remote-tracking branch 'origin/feat/11262-keychain-ci' into feat/11262-keychain-handoff
f02ea5a fix(service-auth): #11589 delta folds; merges after #11580 (RULING-75) (#11262)
965b336 Merge remote-tracking branch 'origin/feat/11262-keychain-ci' into feat/11262-keychain-handoff
8e0d0cc fix(service-auth): RULING-74 desktop layout and a runtime-declared hand-off capability (#11262)
37788fe test(service-auth): an already-shipped runtime gets no hand-off and the CLI shows exactly one dialog (#11262)
ad35b88 Merge remote-tracking branch 'origin/feat/11262-keychain-store' into feat/11262-keychain-handoff
e63d9b6 fix(service-auth): regenerate bundles from this worktree; race-free prompt lock; tests for every fold (#11262)
5b918d4 fix(service-auth): hand off only to a runtime that ships the helper; a marked child never prompts (#11262)
cdedc60 fix(service-auth): verify the whole desktop bundle before a hand-off; the hand-off child never prompts (#11262)
d1a807d Merge remote-tracking branch 'origin/feat/11262-keychain-store' into feat/11262-keychain-handoff
d509403 fix(service-auth): one keychain state per process; rotating retire slots; compiled helper for every command (#11262)
1bd153c docs(changes): fragment for #11613
1a55509 feat(service-auth): creator hand-off before any prompt; omo doctor keychain helper line (#11262)
7ce3af4 test(service-auth): a no-UI approve answering locked is never remembered as a Deny (#11262)
1b2ab0c fix(service-auth): typed pin failures, no cached failure; folds from the #11586 delta (#11262)
f2f180d Merge remote-tracking branch 'origin/feat/11262-keychain-client' into feat/11262-keychain-store
55349b7 test(service-auth): label the native-build hook budget a backstop, cause unconfirmed (#11607)
f641e99 Merge remote-tracking branch 'origin/feat/11262-keychain-helper' into feat/11262-keychain-client
1996fa3 refactor(service-auth): move the helper wiring out of keystore.ts; exact lease temp names (#11262)
cfb083c Merge remote-tracking branch 'origin/feat/11262-keychain-client' into feat/11262-keychain-store
d2cf502 fix(service-auth): reuse one pinned helper copy and report pin failures as a typed result (#11262)
662d274 test(service-auth): give the keychain-fixture hooks a native-build budget (#11262)
20dd678 fix(service-auth): run only a pinned helper copy, re-checked before every spawn (#11262)
e612f58 feat(service-auth): read and write the macOS sign-in through the signed keychain helper (#11262)
fd4a155 Merge remote-tracking branch 'origin/feat/11262-session-lock-lease' into feat/11262-keychain-store
75993ef docs(changes): fragment for #11586
2ffb19e test(service-auth): pin verified fall-through past an invalid helper copy (#11262)
450101b feat(service-auth): keychain helper client modules (#11262)
1154fb2 fix(team-core): restore a handed-over lock under the record's reclaim guard (#11262)
c0f9bf7 docs(changes): fragment for #11578
b4f4260 feat(team-core): session-lock lease that hands the lock to a child process (#11262)

Thank you to 1 community contributor:

@cynkai:
- fix(audit): keep changes.md logs out of the agent-command-string scan (#12609)
- test(memory-core): give the malformed-PEM redaction bound room for loaded runners (#12693)
- test(memory-core): assert the malformed-PEM scan scales linearly instead of a wall-clock bound (#12693)
- test(device-service-core): name the registrant events seen when a recorder wait runs out (refs #12733)
- test(device-service-core): time each registrant event relative to the wait in a run-out message (#12733)

bun add -g omo-ai