omo-ai 5.1.62

v5.1.62

on Node.js NPM

What changed

omo verifies the device service it downloads against the real release key set. The device service's release key set is now pinned to the minted Ed25519 keys, operational first and recovery second, in packages/device-service-core/src/release/release-key.json (a byte copy of the service's own release-key.json). A release signed by either key installs; one signed by neither, or with a malformed signature, is refused before anything is written. Until now the pin was a placeholder that refused every release. (#12437)

Skills and prompts no longer point at skills, files or agents that do not exist, and CI now refuses any new one. The Native ultrawork directive told sessions to read the bun-1-4 skill, which Senpi renamed to bun; it now names bun. remove-deadcode asked for a typescript-programmer skill, which made OpenCode refuse the whole task call; it now loads programming. frontend and ulw-research no longer load an open-design skill that omo never shipped and instead name the nexu-io/open-design library. The ulw-research assembly worker loads imagegen and ulw-loop only when the session lists them, and frontend loads the browser skill where it asked for OpenCode's playwright. OpenCode now ships the hyperplan skill that its hyperplan mode tells the session to load; until now only this repository's own checkout had it. Seven programming references and one frontend cross-reference that pointed at files in the wrong directory, or at a file that never existed, now open the right file. A new check in the root test suite resolves every skill name, skill-relative path, agent and category in shipped skills and prompts for each edition that ships them, and names the closest real target when one is missing. (#12484)

When omo drops the OpenSSL default certificate file (/etc/ssl/cert.pem on macOS) from the engine's trust store, it now tells you why. omo doctor prints an INFO line naming the file, the cause, the certificate block where reading stopped, and whether the drop trusts fewer certificates than plain Bun would. omo trust ensure --json reports the same facts as defaultFileDrop. It is never a warning or a failure. (#12499, part of #10762)

2026-11-05 - Name the OpenSSL default-file drop (#12499, part of #10762)

Design revision 11, 4.4 item 6. readDefaultFileCandidates takes its narrowing flags from the exported DROP_CAUSE_NARROWING table. On a drop, acquireEngineTrust records one openssl-default-file-malformed entry carrying file, cause, blockIndex and narrowing instead of two plain codes, and returns it as defaultFileDrop. runTrustStage prints it in the trust ensure --json line. trust-diagnostics.ts accepts that structured entry and still accepts the plain code for an unreadable file; it refuses another file name, an unknown cause, a non-integer block index or a narrowing flag that does not match the cause. engine-trust-doctor.ts reads the adopted generation's diagnostics.1.jsonl and diagnostics.jsonl, takes the last import-exec or ensure record of that generation, and gives omo doctor one INFO line: the drop, or default-file: kept / unreadable. A missing or torn log yields no line and never fails doctor.

Native skills no longer point Senpi sessions at OpenCode-only agents, tools and commands. A community audit of the installed skills found 16 more references that exist only in OpenCode or nowhere: refactor consulted an oracle agent and called team_list and team_status, debugging ended a team with team_shutdown_request and team_approve_shutdown, frontend loaded skills through a skill tool and addressed a Prometheus planner, ulw-loop named an explorer agent, a plan agent and a /cancel command, ulw-plan offered a git category, and ultimate-browsing named a web-search tool and Playwright MCP calls. Senpi now gets the deep-high lane in place of oracle, the task_send shutdown handshake and task_output in place of the missing team tools, and explore, the ulw-plan workflow and /goal pause or /goal clear in the Native skills. The shared skills read the same in OpenCode and Codex. (#12523)

Changed

• A Linux container matrix (Debian, Fedora, Alpine, openSUSE Leap and Tumbleweed) now checks the compiled engine's CA import on each distribution: the bundle chosen from os-release is the one the engine reads, a root installed with update-ca-certificates or update-ca-trust is trusted, and a root placed only in openSUSE's /var/lib/ca-certificates/openssl is not. (#12223, part of #10762)

• The engine CA importer's design 9.7 mutation checks now run in CI for the trust code in packages/omo-native: script/omo-native-trust-mutations.ts applies each mutation as a source patch to a disposable copy of the package, requires its named test to turn red, and requires the same test to pass on the unpatched copy. It covers 31 source mutations (trust policy, launcher trust stage, user extras, generation retention, the OpenSSL hash-directory and default-file selectors) and 2 oracle self-checks, fails when a mutation's patch no longer matches exactly once, and runs in the new Engine trust mutations workflow on every change under packages/omo-native. Rows owned by senpi, the desktop or the macOS and Windows adapters run in their own pipelines. (#12495, part of #10762)

• Senpi task and LSP tool descriptions now say what the tools do: task_cancel releases a finished child's resident session or queued messages, task_send's 32 KB cap covers team messages only and a message can queue, task_output's tail mode shares the character cap, task_id wins over name, and lsp_find_references, lsp_symbols and lsp_diagnostics state their 200-result cap and defaults. Text only; no behavior change. (#12500, fixes #12496)

Fixed

• omo trust ensure now reports trust-lease-failed when it cannot refresh the recency of a generation it reuses, instead of silently handing out a generation the retention sweep may remove next. (#12163, part of #10762)

• On Fedora, RHEL and other systems whose CA bundle carries non-ASCII comment lines between certificates (such as # NetLock Arany (Class Gold) Főtanúsítvány), the compiled engine now imports the system roots instead of discarding the whole bundle as malformed and falling back. Non-ASCII text inside a certificate block still discards the file. (#12220, part of #10762)

• A device whose memory-sync sign-in ends (revoked, signed out, omo logout, omo account forget --device, or replaced by a new sign-in) no longer keeps its sync trust pin, so omo account show --account stops reporting it as joined and re-pairing after a reset is no longer blocked. Joining again always goes through the pairing or recovery ceremony. The new omo account retire-sync --account <id> does the same for a desktop-owned session. (#12280)

• omo doctor now reports a generated omo wrapper whose cached runtime is gone instead of passing over it in silence: WARN broken omo on PATH: <file> launches <missing path>; remove it, with no repair installer offered for the broken wrapper. It also warns when two different omo-ai installs (for example bun and npm) are both on PATH, where previously only installs of different kinds were flagged. Broken detection does not run for Windows .cmd wrappers: they write rem OMO_GENERATED_RUNTIME_WRAPPER while the check looks for the # marker. (#12534, fixes #12110)

2026-11-05 - Doctor reports a broken omo wrapper and duplicate omo-ai installs (#12534)

omo doctor now reports a generated omo wrapper whose cached runtime is gone, and warns when two different omo-ai installs are both on PATH. Windows .cmd wrappers are not covered by the broken check: they write rem OMO_GENERATED_RUNTIME_WRAPPER while the check looks for the # marker.

Known issues

• Engine TLS trust v1: distrusted intermediate certificates under an allowed root are not yet blocked; tracked upstream. The compiled engine now has tests for every TLS path (global fetch, Bun.fetch, a saved fetch, a Worker fetch, node:https and WebSocket): a root outside the selected set or denied by the OS fails on all of them, a store intermediate is used only when its usage allows server authentication and it is not denied, and a test named limitation-pin: records that a denied intermediate the server itself presents under an allowed root is still accepted. (#12219, part of #10762)