omo-ai 5.1.69 on Node.js NPM

OmO runs on senpi 2026.11.10-2. A client can read and edit the workspace's instruction files over RPC through read_project_file / write_project_file (senpi#6307), a built session can be parked and handed out through claim_session (senpi#6350), the Fable 5.2 prompt preset gains the codebase-ownership sentence (senpi#6360), generate_image is eval-only like bash (senpi#6272), eval cells reach every eval-only tool through tool.<name>(...) and the agent()/output() helpers (senpi#6276), and the EQ goldens carry the new prompt (senpi#6355). (#13054)

An agent that answered a message from another agent can keep answering it in the turns the engine starts on its own, with no prompt. The reply allowance a consumed delivery grants (a reply to that sender by id or stated name, approved from the delivery alone) now lasts for the work the delivery started: the consuming turn and every later turn the engine starts by itself - an open-todo reminder, a goal continuation, a monitor wake. A settle alone no longer ends it; it ends when a new message starts work after that answer: a person's message, or any delivery, whose own sender the new group then holds (a delivery that joins running work adds its sender). A reply in a covered turn continues the delivery's chain at the next hop, so the chain limit still closes it. (#13042, part of #12996) (#13044)

omo remote send now goes through the same delivery pipeline as every other send, and --steer reads the session once. A person's message to a session on another device enters createDeliveryPipeline with the relay address book's reference for the <device>/<session> address, so the CLI no longer builds its own transport call; the relay transport reads the running turn once and steers it, where the CLI used to read it a second time first. A --steer to a session that is running nothing still sends nothing. The unused second prompt implementation (promptRemote) and its argument check are removed. Which sender kinds each device admits is unchanged. (#13038)

A message to a session on this device that waits on a question now says so, as one to another device does. The send is still queued, and its delivery now carries waiting_on: { kind: "approval", device }. device is this install's account device, and is absent when the install has no device identity. (#13035)

Every message one session sends another now names the device it was sent from, on this device and across devices alike, and a message from another device counts as the cause of the receiving run's next send the same way a local one does. When no device id can be read (no device service, or it does not answer), the message still goes and records why it names no device. (#13034, part of #13004)

A message sent or handed off to a session on another device now reports its delivery_id, effective_mode and endpoint, as one sent within this device does. The answer came from the account's session listing and dropped those fields. It now passes the relay transport's own delivery facts through. The endpoint is null because the sender knows no endpoint on that device. (#13033)

A reply to an agent on another device now reaches it by the id in the message header or by its name, with no prompt on the same account. One resolver now finds a thread across this device's threads and the account's other devices: an exact durable id, then an account alias, then the name ladder judged over every entry (two devices sharing a name are an ambiguous_target naming both devices, never a silent pick). thread_send, thread_handoff, the control tools, thread_create (open or fork) and the omo thread CLI all use it. A reply to the sender of a delivery the run took in is approved from that delivery alone - by the sender's durable id or the name it stated - and must resolve to that sender, else it is refused as reply_target_mismatch without sending. The id shown for a thread on another device is its durable id; the relay listing carries it when the device publishes one. The omo remote verbs still dispatch by the id you type as the device's session key, so pass the id the device lists under until that path moves onto the shared resolver. (#13000)

A send to an agent on another device now reports the same facts as one on this device. thread_send and thread_handoff answer delivery_id and effective_mode for a target on another device too, so a caller reads the delivery's id and the lane it took the same way whichever device holds the thread; message_seq and endpoint stay the facts of a gateway row on this device, and device names another one. The reply allowance (a run answering the agent whose delivery it took in, by that agent's id or stated name, with no prompt) is proved identical for a same-device and a cross-device delivery, and one parity table now runs every send assertion against both legs, so a rule that reads the transport fails the build instead of reaching a user. (#13006, on top of #13000)

A task child no longer starts against a senpi engine that refused its process-wide redaction registry; the start fails with SenpiEngineRestartRequiredError, which says to restart omo. The engine refuses to load next to a registry slot it did not install, and that refusal lasts for the whole process, so a restart is the only remedy. (#12991)

omo now installs the signed device service 0.1.27 instead of 0.1.3. The device service pin had stayed at 0.1.3 across every device-service release since 0.1.3, and an installed omo only replaces a service older than its pin, so no machine received a newer one. (#12981)

The thread_* tools are now eval-only, like bash: when an eval tool is present they are no longer in the model's direct tool list and are called as tool.thread_*() inside an eval cell. Behaviour, permissions and results are unchanged, and without eval they stay ordinary direct tools. (#12907, closes #12903)

A long-running engine keeps reclaiming crashed one-shot memory runs. The memory component's cleanup of abandoned one-shot runs, which runs once per engine process outside session opens, now repeats once a day in an engine that stays up, such as the desktop's or a daemon host's, instead of waiting for a restart. (#12899)

Opening a session no longer re-sweeps the memory root. The memory component's cleanup of abandoned one-shot runs now runs once per engine process, shortly after the first open, instead of inside every session open. A session that ends before that cleanup starts hands it to the next open, so crashed runs are still reclaimed. (#12896)

Fixed

The senpi barrel load-failure test imported the barrel by a pathname-derived /D:/... specifier, which failed on Windows and turned dev red (#13068). It now imports the barrel by file URL. (#13068)
Computer use reports a click or typed text that went out as window events with its real input route, and judges whether input landed only for multi-event input such as drags, so a single click whose window then closes is reported delivered. (#13055)
The actionability check no longer refuses press on a Linux button that lists only another action such as click, since the backend presses its first action. (#13055)
Computer use flags text typed into a secure field of a background window, and reports how much text was delivered when the user intervenes mid-send. (#13055)
On macOS, key priming now bounds and classifies its focus reads, so a slow or failing focus read no longer stalls background typing into a multi-window app. (#13055)
Computer use keeps holding the machine-wide interaction lock while it hands key focus back after background typing, so another session can no longer type in between. (#13055)
A steer sent to a session on another device that was held behind that session's open draft, and whose turn ended before the draft was released, was answered queued and then lost without a word (#12927). The send now records that refusal: a retry of the same send under the same idempotency_key answers turn_conflict, naming the delivery, instead of queued. (#12935)

Changed

Computer use now lets the user keep typing and clicking while it works by default (computer.intervention: "continue"); set it to "pause" to have input wait for the user and stop with UserIntervened. (#13055)
While computer use waits for an accessibility target to become actionable, other computer-use sessions of the same user can keep sending input instead of being refused InputBusy; the target is checked once more, without waiting, right before the action. (#13055)
Desktop engine: the stop-marker policy is pinned to the XPC-only path and reported by omo doctor. (#12831)

Added

Computer use waits until an accessibility target is actionable before it acts, lists the sheets, windows and menus an action opened, suggests the next call when it refuses, and refuses cmd+q, alt+f4 and win+l unless the key chord is forced. (#13055)
Wayland (Hyprland): window-targeted pointer input through libei behind a windowInput capability probe (no_eis, hyprland_ipc_missing reasons). (#12831)
Wayland (KWin): window-targeted pointer input through the same libei path, and window captures placed on the KWin frame rectangle so coordinates round-trip between capture and click. (#12831)
senpi-desktop-sdk: the typed facade package for computer-use v2 consumers (connect, Computer / Window / Element / Frame, reports and verification, typed errors), with a pinned facade manifest and a package-boundaries test. (#12831)
Desktop engine: skeleton observation (logical depth 3), the web-wrapper rule, and root: <ref> drill with sub-generations (object mode only). (#12831)
senpi-desktop-sdk: the spawn transport with the in-session refusal (spawn_inside_session); the service run facade routes windows, displays and capabilities through the SDK. (#12831)
Desktop engine host: features-gated session.open options (intervention, macosKeyPriming, trace, reportMode) sent only when the engine advertises them; ActionReport typed exec results with the 7 valid disposition pairs; reserved settings computer.run_sandbox, intervention, macos_key_priming, trace (defaults unchanged); error codes COMPUTER_AMBIGUOUS_TARGET, COMPUTER_CAPTURE_CONSENT_REQUIRED, COMPUTER_PROTECTED_PROCESS with data.reason hints. (#12831)
Desktop engine: late replies after a stop are quarantined (Suspended, disposition unknown / unknown, audited on stderr); macOS helpers (overlay, keymap, canary) gain parent-death containment. (#12831)
Desktop service: a fresh-process permission re-probe before every session open, so a capture/accessibility grant made after a denial is seen without restarting the service. (#12831)
computer.run: a QuickJS cell with wall-clock, call and payload limits and an escape battery (no host bridge yet). (#12831)
macOS capture: SkyLight-first window capture with SCK/legacy fallback, capture of windows on another Space, and a measured replayd consent probe (opt-in, never gating). (#12831)
Desktop engine: epoch sources (display change, lock, sleep, Space switch, engine restart) announced as epoch.changed; stale frames after an epoch move answer InvalidCoordinateFrame superseded. (#12831)
Desktop engine: the ref-generation store keeps 8 live generations per target and up to 65,536 retained objects; refs past their generation answer StaleRef. (#12831)
Desktop engine: object-mode ax.snapshot returns a partial observation (complete, nodesObserved, cuts) at a 3000 ms default deadline and a node budget; null mode is byte-equal to v1. (#12831)
Desktop engine: per-stage timings on action reports and a redacted trace JSONL sink, both behind the trace session option (default off). (#12831)
Wayland (KWin): window-targeted pointer input through libei behind the windowInput capability probe, plus the KDE QA driver. (#12831)
Kernel computer globals (JS and Python preludes) are generated from the SDK facade manifest; verify lives on the desktop root, drill on window handles. (#12831)
Wayland (GNOME): window-targeted pointer input through a small Shell extension that publishes the window list over the session bus. (#12831)
def0749 Merge pull request #13038 from code-yeongyu/fix/13016-one-route-senders
143aaf5 Merge pull request #13069 from code-yeongyu/fix/windows-barrel-test-import
3d5df08 chore(train/omo-or): regenerate bundles at the train top on dev 0a0213d (#13034 #13033 #13035 #13038)
ab2aa1f Merge origin/dev (0a0213d, train F) into train/omo-or - generated files regenerated at the top
075c9c5 docs(thread): AGENTS.md remote/ row - the full #13004 sender-device sentence (was cut inside a code span; composition FIX_FIRST at 7c5cb07)
7c5cb07 docs(thread): AGENTS.md remote/ row = dev row with the #13004 sender-device sentence replacing the old no-device sentence (drops the duplicated tail; composition FIX_FIRST at 09c468e)
0a0213d Merge pull request #13055 from code-yeongyu/cu-v2/train-f
051479d Merge pull request #12866 from cynkai/fix/12638-process-chain-deadline
09c468e chore(train/omo-or): regenerate bundles at the train top on dev 61e8020 (#13034 #13033 #13035 #13038)
217d10f Merge pull request #12827 from cynkai/fix/12498-sync-bunshin-ts-shell-path
99add91 docs(thread): AGENTS.md remote/ row = dev text with the #13004 sender-device sentence replacing the old no-device sentence (train merge; keeps the #12927 re-sent-steer clause)
8504a2d Merge #13038 (021b461) into train/omo-or (one-route; generated files regenerated at the top)
ab46a42 Merge #13035 (c868730) into train/omo-or (one-route; generated files regenerated at the top)
2d8677a Merge #13033 (cc664b7) into train/omo-or (one-route; generated files regenerated at the top)
0a8fb80 Merge #13034 (c10cf79) into train/omo-or (one-route; generated files regenerated at the top)
61e8020 Merge pull request #12826 from cynkai/fix/12453-memory-core-slow-test-budgets
e1dcdf6 train F: merge dev cecf1b3 (contains train E)
459d6b7 fix(desktop-session): the actionability check treats press as the element's default action (#13055 review)
cecf1b3 Merge pull request #12824 from cynkai/fix/12527-scan-eviction-coverage
2d9f4d1 train F: merge dev 74a9e08 (contains train E)
74a9e08 Merge pull request #12981 from code-yeongyu/fix/device-service-pin-0.1.25
fd59fbf train F: merge dev 0682d51 (contains train E)
8714de5 Merge remote-tracking branch 'origin/dev' into fix/device-service-pin-0.1.25
cf79b42 test(device-service-core): vendor the omo 5.1.66 decoders outside knip's entry globs
0682d51 Merge pull request #12991 from code-yeongyu/fix/12965-redaction-slot-restart
4567269 Merge origin/dev into fix/12965-redaction-slot-restart
55ef6da test(device-service-core): an omo through 5.1.66 decodes a 0.1.27 service's recorded replies
52f22bd test(eq): re-record linux-x64 E21-E24 after merging dev 555b394 (skill digest)
e136a2a fix(device-service): pin the signed device service 0.1.27
325ce38 train F: merge dev 555b394 (contains train E)
acc23cf Merge remote-tracking branch 'origin/dev' into fix/device-service-pin-0.1.25
f4fa586 Merge pull request #13024 from code-yeongyu/chore/cu-v3-row2-guards
eeaa316 Merge pull request #13059 from cynkai/test/12985-fable-52-boundary
ee23ae4 test(computer): use the hermetic git config in the v3 guard tests (row 2)
018ebc4 Merge remote-tracking branch 'origin/dev' into chore/cu-v3-row2-guards
eb230a1 train F: merge dev 26b5a8c (contains train E)
d7ab82b fix(desktop-session): wait for actionability before taking the interaction lock (#13055 review)
26b5a8c Merge pull request #13044 from code-yeongyu/fix/13042-allowance-across-engine-turns
4671a77 train F: align changes/unreleased (member fragments folded into 13055.md) with the reviewed head 4e80a04
01bb776 chore(regen): rebuild generated bundles at the train F top (node 24, canonical)
2f35f23 docs(changes): name the train F member fragment for #12768
345f46d docs(changes): add the row 29 fragment
9c6146e chore(regen): regenerate bundles and prelude assets for row 29 on train F
6fa7bc8 fix(desktop-session): refuse dangerous held chords and point refused background typing at the target window
7be4420 feat(desktop): actionability battery with auto-wait, opened surfaces, next-call hints, dangerous-chord force
4c3be46 docs(changes): name the train F member fragment for #12743
d9f7ee6 train F: merge row 23 (#12743) 1f068c7
6ca1f03 docs(changes): name the train F member fragment for #12748
2b181b3 train F: merge row 19 (#12748) 72409a4
bf409c1 docs(changes): name the train F member fragment for #12737
89ac286 train F: merge row 16 (#12737) 5df0041
d0abf5a docs(changes): name the train F member fragment for #12703
96ca7a1 train F: merge row 8 (#12703) 43c4dff
a3cde6e docs(changes): name the train F member fragment for #12687
9a5514b train F: merge row 7 (#12687) 931a5e1
a7a8ff6 chore(computer): add v3 reimplementation guards and name map (cfg_attr ignore parsed with balanced parentheses across lines)
e99b8f3 test(computer): RED guards for v3 reimplementation (row 2): cfg_attr ignore with nested arguments or across lines
abc0710 chore(computer): add v3 reimplementation guards and name map (blocker scenario edits, physical lines, stubs domain and forms, residue on disk and path names)
15d8217 test(computer): RED guards for v3 reimplementation (row 2): blocker scenario edits, physical lines, stubs domain and forms, residue on disk and path names
b0772bb chore(computer): add v3 reimplementation guards and name map (check ledger headers, report unreadable inputs)
bff7e80 test(model-core): pin the Fable 5.2 context-window boundary with non-matching ids (#12985)
4f84116 test(computer): RED guards for v3 reimplementation (row 2): ledger headers, unreadable plan, null-mode proof
9292e15 chore(13044): regenerate bundles on dev after #13000 (generated-only)
11c4109 chore(computer): add v3 reimplementation guards and name map
43ac5b6 test(computer): RED guards for v3 reimplementation (row 2)
5480840 Merge origin/dev (5a582a4, #13000 + train 3) into fix/13042-allowance-across-engine-turns - generated files regenerated next
5a582a4 Merge pull request #13000 from code-yeongyu/fix/12996-durable-id
282f9b0 docs(changes): add the 13054 release-note fragment
df44c9f chore(13000): regenerate bundles on dev after train 3 (generated-only)
60121cb Merge origin/dev (a96a51d, train 3) into fix/12996-durable-id - generated files regenerated next
a96a51d Merge pull request #13002 from code-yeongyu/fix/12996-devsvc-durable-id
84871a7 Merge pull request #13030 from code-yeongyu/fix/13018-host-bun-oracle
0c96eed chore(train/omo-3): regenerate bundles at the train top on dev 45b5740 (generated-only re-head; goldens unchanged from 6143699)
d2312e8 Merge origin/dev (45b5740, 5.1.68 source state) into train/omo-3 - generated files regenerated at the top
45b5740 Merge pull request #13053 from code-yeongyu/release/v5.1.68-source-state
c10cf79 chore(13004): regenerate service-auth.generated.js for the sender-device stamp
4e30a01 chore(train/omo-3): regenerate bundles at the train top on dev 42d5746 (#12935 #12831 #12907 #12899 #13002 #13048)
24a1294 fix(13004): keep thisDeviceId module-private (knip) and regenerate bundles
d7ad464 Merge remote-tracking branch 'origin/fix/12996-durable-id' into fix/13004-sender-device
8638659 Merge origin/dev (42d5746, 5.1.67 source state) into train/omo-3 - generated files regenerated at the top
384cc02 Merge #13048 (931bc63) into train/omo-3 (car 6: the listing asks rows 3; generated files regenerated at the top)
4ce47e0 docs(changelog): the fragment is named for the PR (#13044)
8feb6c7 fix(thread): a delivery after a final answer always starts a new group; consumed ends with the answer in every order; the peer reply sentence names the eval form (#13042 review)
8edfa8e fix(device-service-core): DeviceService.sessions asks rows 3 and steps down on invalid_request (#13045)
0b6a5b9 Merge #13002 (84b1969) into train/omo-3 (re-stage without the memory stack)
237d63f Merge #12899 (8fdbb01) into train/omo-3 (re-stage without the memory stack; omo.js regenerated at the top)
3f9e0a6 chore(13000): regenerate service-auth.generated.js at ce54247 (the regen skipped script/build-service-auth.ts)
412f71b fix(thread): the reply allowance lasts for the work a delivery started (#13042, part of #12996)
c868730 Merge remote-tracking branch 'origin/fix/13014-one-result-shape' into fix/13014-waiting-on-local
cc664b7 Merge remote-tracking branch 'origin/fix/13004-sender-device' into fix/13014-one-result-shape
021b461 Merge commit '87f1beac0b' into fix/13016-one-route-senders
ed57361 fix(remote): omo remote send stamps this device too; AGENTS.md names the sender device (#13034 review)
5010944 Merge remote-tracking branch 'origin/fix/12996-durable-id' into fix/13004-sender-device
3810f09 test(thread): the replay case names the completed-receipt replay it exercises (#13035 review LOW)
e242532 Merge remote-tracking branch 'origin/dev' into fix/13018-host-bun-oracle
ce54247 chore(13000): regenerate bundles at the #13036-merged head (212f949 sources)
ea6da9b Merge remote-tracking branch 'origin/fix/13014-one-result-shape' into fix/13014-waiting-on-local
a52efcd Merge remote-tracking branch 'origin/fix/13004-sender-device' into fix/13014-one-result-shape
d793a45 docs(changelog): fold the #13006 fragment into 13000.md (the #13036 merge left two fragments on one PR)
2d7d5e1 fix(thread): the local waiting_on names the device the production sender stamps, not one a test injects (#13035 review)
410c60c Merge remote-tracking branch 'origin/fix/13004-sender-device' into fix/13014-waiting-on-local
212f949 Merge pull request #13036 from code-yeongyu/fix/13006-reply-identity-not-transport
d2e9c56 docs(changes): #13038 fragment
903d430 fix(thread): drop the promptRemote re-export; the CLI's empty local book wakes nothing (#13016)
71d25dd docs(changes): note #13035 (part of #13008)
e606635 docs(thread): one send result on both legs and the route-parity table; changelog fragment for #13006
e77cd7d test(thread): the same send and reply-allowance assertions run against a thread on this device and one on device b (#13006)
ee7fe3f fix(thread): a local send to a session waiting on a question reports waiting_on approval, as a send to another device does (#13014)
cb597c5 fix(thread): a send to another device reports delivery_id and effective_mode like one on this device (#13006)
36b70b5 docs(changes): fragment for #13034
75e112d fix(thread): every delivery names its sender device; a consumed delivery is the run's cause on either transport (#13004)
c449416 docs(changes): note #13033 (part of #13008)
e8919ad fix(thread): a send or handoff to another device answers with its delivery_id, effective_mode and endpoint, as a local one does (#13014)
ea48665 fix(thread): omo remote send goes through the delivery pipeline; one steer preflight (#13016)
9a8a535 Merge #12907 (acc777f) into train/omo-3
3e7ac1a Merge #12831 (670e592) into train/omo-3
6b38532 Merge #12935 (ddb0208) into train/omo-3
d3a321f test(omo-native): derive CA oracle acceptance from running Bun
84b1969 Merge train-2 head 7a0e5b3 into fix/12996-devsvc-durable-id (part of #12996)
96b0c71 test(thread): the shared remote fixture keys b's row by a listing key that differs from its durable id (#13017); a cross-device fork names its source by the durable id
561e973 chore(thread): hand-off link names the durable id; split-key create test round-trips a send; fragment names the omo remote limit (review nits, #13000)
670e592 test(eq): re-record linux-x64 E21-E24 after merging dev f922d6a (skill digest)
17632a4 fix(omo-native): omo remote verbs carry the typed id as the durable id so results echo it (D2, #13000)
ddb0208 build: regenerate service-auth for the relay transport change and restore the canonical device-account marker (review HIGH x2, part of #12927)
43b527a fix(thread): a thread created or opened on another device answers with its durable id; control results too (review HIGH, D2, #13000)
5d05834 chore(thread): alias holder matches by durable id too; tidy the remote/ doc row and import tails (review LOWs, #13000)
4cca1ae fix(thread): the account listing dedupes and asks aliases by durable id, and a handoff to another device answers with it (census rows 10-11, #13010/#13014; #13000)
3f9472a train E: merge dev f922d6a
05e4f64 Merge remote-tracking branch 'origin/dev' into fix/held-steer-turn-conflict-12927
58bad1c chore(thread): split-key create test asserts the already-live answer; drop local-scope.ts and the last crossTarget comments (review nits, #13000)
e75428e fix(thread): the durable id is the only id above the ports - thread_list and every result show it, thread_create resolves through the one resolver, the old ladder is deleted (review fold, decision 0027 D2, #12996)
acc777f test(thread): drop the non-null assertion in eval-only.test.ts (lint ratchet)
e6d9585 Merge origin/dev into feat/evalonly-thread-tools (bundles rebuilt)
8fdbb01 Merge remote-tracking branch 'origin/dev' into relay-seoul/memory-sweep-rearm
b9feab1 train E: merge dev d985fa7
338daee Merge remote-tracking branch 'origin/dev' into fix/held-steer-turn-conflict-12927
b7c3b75 feat(thread): thread_create opens or forks an existing thread through the one resolver (decision 0027, #13012 class)
bfce76d feat(thread): one resolver over the local and relay address books; a reply is approved from the consumed delivery and must resolve to its sender (decision 0027, #12996)
3af8a92 test(eq): re-record linux-x64 E21-E24 after merging dev fa05c27 (skill digest)
e93c714 train E: merge dev fa05c27
75519be Merge commit 'fa05c2702c' into fix/held-steer-turn-conflict-12927
f7ea2f5 test(thread): pin reply_device_mismatch in the error-code list and cover the origin guard (review HIGH + MEDIUM, #13000)
5c3be5e fix(device-service-core): carry an optional durable_id on listing rows asked with rows: 3 (part of #12996)
21a7a3b fix(thread): a reply by durable id is routed only to the device the delivery came from (reply_device_mismatch guard, #12996)
d812eb6 docs(changes): fragment for #13000
e53c83e fix(thread): locateAcross resolves the durable id the relay listing carries, before the name ladder (part of #12996)
590f6e6 Merge remote-tracking branch 'origin/dev' into fix/12965-redaction-slot-restart
1064335 test(device-service-core): an omo through 5.1.66 decodes a 0.1.25 service's recorded replies
8537e06 test(device-service): read get.omo.dev only as the release gate (OMO_RELEASE_GATE=1)
29b16bd test(device-service): the pinned release is served by get.omo.dev on stable and beta
2fc4b1c chore(changelog): fragment for #12981
c270cd4 fix(device-service): pin the signed relayd 0.1.25 release
edb809f train E: merge dev 9d08e26
508afed fix(parity): allow the binary-only computer-use stop-persistence doctor line
727ea90 test(eq): re-record linux-x64 E21-E24 after merging dev a09b243 (skill digest)
e18f48a train E: merge dev a09b243
dda1cf7 chore(regen): rebuild generated bundles after merging dev 1b3d761
d1ce7d9 Merge remote-tracking branch 'origin/dev' into fix/held-steer-turn-conflict-12927
15f0c59 docs(changes): name the fragment for its PR (#12935)
daa8a55 chore(knip): the worker-only toolReceiptRevise op is reached through the store worker (part of #12927)
954b40b fix(thread): a held explicit steer the receiver refuses turn_conflict after the draft release revises the send's receipt (fixes #12927)
4edd6bd test(thread): a held explicit steer refused turn_conflict after the draft release is readable by the sender (RED, part of #12927)
e7fe80b train E: merge dev 1b3d761
2627cd0 Merge commit '7da58817a4' into relay-seoul/memory-sweep-rearm
428f91f Merge remote-tracking branch 'origin/dev' into feat/evalonly-thread-tools
2af3734 Merge remote-tracking branch 'origin/dev' into remote-300ms/memory-sweep-once
ee47f61 fix(thread): THREAD_TOOL_EXPOSURE is consumed (knip) and its stale knip.jsonc row is dropped (review MEDIUMs)
f7e06e3 test(thread): real-engine acceptance pair for the eval-only family (lifted from #12912)
b66cf29 Merge commit 'd2ea78d99d' into relay-seoul/memory-sweep-rearm
f192964 test(thread): keep the tool-search contract and prove the acceptance notes on the real surface
ec383c6 docs(changes): fragment for #12907
63b61a4 feat(thread): thread_* tools are eval-only, like bash (closes #12903)
d2ea78d Merge remote-tracking branch 'origin/dev' into remote-300ms/memory-sweep-once
ad735ad Merge remote-tracking branch 'origin/dev' into gf-12866
1c52c27 chore(regen): rebuild generated bundles after merging dev 27ff5de
7bf4475 train E: merge dev 27ff5de (#12893 #12887)
a0bbe43 Merge remote-tracking branch 'origin/dev' into gf-12826
4f096b3 Merge remote-tracking branch 'origin/dev' into gf-12827
98dc3aa chore(regen): rebuild generated bundles after merging dev 511dc35
6556a24 Merge remote-tracking branch 'origin/dev' into gf-12824
e08ae0b train E: merge dev 511dc35 (#12795)
a69338c chore(bundle): raise omo.js budget for the computer-use v2 SDK surface (+1.4 KB)
3a9cbb8 chore(regen): rebuild generated bundles after merging dev 865fa90
d0bab2e train E: merge dev 865fa90 (#12874 release-state)
14f2a89 test(eq): re-record the linux-x64 E21-E24 goldens for train E on dev 790a6f2
f95d42a chore(regen): rebuild generated bundles after merging dev 790a6f2
a7af5bf train E: merge dev 790a6f2 (#12839 cut + #12862)
ff8ad98 docs(changes): fold the train C and D fragments into train E (one user-facing PR to dev)
138026e chore(regen): rebuild generated bundles after merging dev 9ac8bc9
42eb777 test(desktop): the sdk builtin exception matches win32-separator paths (train C integration)
36484fa train E: merge dev 9ac8bc9 (post-#12858 lift)
cc03e32 test(conformance): use the per-process-random placeholder for every recorded resume token (train E integration)
1f068c7 docs(changes): add the row 23 fragment
1bafe78 fix(desktop-session): hold the interaction lock across background key focus hand-back
72409a4 chore(regen): regenerate bundles and prelude assets for row 19 on train E
9555abd docs(changes): add the row 19 fragment
2dac203 docs(computer): name the two continue-mode exceptions in the intervention rule
53911d6 feat(desktop-session): intervention policy with continue as default (goat way), pause selectable
5df0041 docs(changes): add the row 16 fragment
c790bb4 fix(desktop-macos): bound and classify priming's focus reads, log layer 1
43c4dff docs(changes): add the row 8 fragment
849885f test(desktop): report the delivered count when the user intervenes mid-send
f6769ab fix(desktop): flag secure-field writes into background windows
931a5e1 docs(changes): add the row 7 fragment
c327154 fix(desktop-session): judge only multi-event input, report the real ax route
1398c58 chore(gnome-extension): move the GNOME shell extension out of crates/ (train E integration)
04bfc5a fix(wayland): place GNOME captures the way KWin does so frames and clicks agree (train E integration)
e7d1ec7 docs(changes): name the train fragment for #12831
adb1a05 test(memory-core): give the slow preflight and 1,000-rotation receiver tests an explicit budget (#12453)
a9e5d97 test(prelude): refresh assets.sha256.json to the merged tree's assets (train E integration)
af8125a fix(wayland): cover the GNOME geometry variant in capture placement (train E integration)
72eb694 docs(changes): fold the train E member fragments
84ab2fa train E: #12775 edbb6cd
fde1866 train E: #12774 ac9358d
d2e6024 train E: #12730 29256d1
06d4872 train E: #12711 e581018
fa1ff00 train E: #12724 6da6eca
4feaef7 train E: #12718 fc58898
32b91d6 train E: base on train D 2a195c5
a3586af train D: re-merge train C 3ee59e1
e692dc3 docs(changes): name the KWin window-targeted input and capture placement in the train C fragment
9da3d9a test(eq): re-record darwin-arm64 E21-E24 goldens for the train D skill digest
6954bd4 Merge remote-tracking branch 'origin/dev' into cu-v2/train-c
8aee53d docs(changes): name the train fragment for #12792
5395cf4 test(eq): re-record linux-x64 E21-E24 goldens for the train D skill digest
b7b13ff train D: re-merge train C 09893ff
d2f2b2c test(eq): re-record darwin-arm64 E21-E24 goldens for the train C skill digest
0c12397 test(eq): re-record linux-x64 E21-E24 goldens for the train C skill digest
466fa3e train D: re-merge train C 08afea0
99cb99b Merge remote-tracking branch 'origin/dev' into cu-v2/train-c
92281cd fix(wayland): place KWin window captures on the KWin frame rect like KWin clicks
939fdf3 docs(changes): fold the train D member fragments
01fe3ae train D: #12746 01a42ba
8393879 train D: #12741 09eba6c
6773cec train D: #12692 4f3e33e
cd8ef29 train D: #12751 2ab2cad
fab5703 train D: #12700 91951db
6ea1424 train D: #12707 c60b282
e365c77 train D: #12684 92d7490
87ffa81 train D: base on train C bbf7689
799e47a docs(changes): name the train C fragment for #12782
0bff111 docs(changes): fold the train C member fragments
859914a train C: #12734 6d231b6
3d08fdf train C: #12745 3015783
5aec7be train C: #12710 4a20989
8387a37 train C: #12696 c69490b
c353dbb docs(changes): name the fragment for #12775
64c6a9e fix(desktop-wayland): treat GNOME Shell's own UI as covering window input
8ccd288 fix(desktop-core): keep every AX cut listed under a dropped parent role
0746dd7 fix(desktop-wayland): run the KWin geometry script on KWin 5 as well as KWin 6
7bac9ed Merge remote-tracking branch 'origin/dev' into cu-v2/task-31-stop-marker-policy-pinned-xpc-only-persi
d412d01 docs(changes): name the fragment for #12774
18297df chore(knip): list gnome-extensions and gdbus as known binaries for the GNOME QA driver
0938910 Merge remote-tracking branch 'origin/dev' into cu-v2/task-30-p15c-wayland-window-targeted-input-on-gn
02d485b docs(changes): name the fragment for #12751
c603206 Merge remote-tracking branch 'origin/dev' into cu-v2/task-22-p5b-i-quickjs-run-cell-with-limits-and-e
8b209dd docs(changes): name the fragment for #12746
ea9018f Merge remote-tracking branch 'origin/dev' into cu-v2/task-18-p10a-ref-generation-store-8-per-target-s
8288a5a Merge remote-tracking branch 'origin/dev' into cu-v2/task-18-p10a-ref-generation-store-8-per-target-s
80c1b54 docs(changes): name the fragment for #12745
b1dc97e Merge remote-tracking branch 'origin/dev' into cu-v2/task-17-p9b-skeleton-depth-3-web-wrapper-logical
e2b2ff5 docs(changes): name the fragment for #12741
b819d15 Merge remote-tracking branch 'origin/dev' into cu-v2/task-14-epoch-sources-display-change-lock-sleep-
0685b31 fix(computer-use): refuse a non-number verify intervalMs in both kernels
03e8f03 fix(computer-use): keep the SENPI_DESKTOP_HOST marker out of the host's environment
5a96728 fix(computer-use): read an expired ref from the failure code in verify
bcbfddf fix(desktop-service): keep probing while the long-lived child still caches a denial
d9eca5a docs(changes): name the fragment for #12734
ffcd554 Merge remote-tracking branch 'origin/dev' into cu-v2/task-24-p2b-spawn-transport-with-the-in-session-
595bd73 docs(changes): name the fragment for #12730
c6578c2 Merge remote-tracking branch 'origin/dev' into cu-v2/task-26-p4a-kernel-computer-globals-generated-fr
5d37b69 docs(changes): name the fragment for #12724
e13111a Merge remote-tracking branch 'origin/dev' into cu-v2/task-11-p13a-per-stage-timings-and-redacted-trac
1437362 docs(changes): name the fragment for #12718
06404d5 Merge remote-tracking branch 'origin/dev' into cu-v2/task-10-p9a-partial-ax-observation-with-per-node
9959acb docs(changes): name the fragment for #12711
c844c0a Merge remote-tracking branch 'origin/dev' into cu-v2/task-21-p15b-wayland-window-targeted-input-on-kw
6667ae8 docs(changes): name the fragment for #12710
227a5ff docs(changes): name the fragment for #12707
9686a82 Merge remote-tracking branch 'origin/dev' into cu-v2/task-12-p16a-b-helper-spawner-containment-audit-
1173e46 docs(changes): name the fragment for #12700
9392247 Merge remote-tracking branch 'origin/dev' into cu-v2/task-20-p16c-fresh-process-tcc-re-probe-in-the-s
9b002d0 docs(desktop-core): regenerate the protocol doc and schema for the capture reasons
b396361 test(qa): assert the Hyprland window move lands at the frame point
96858b9 fix(desktop-wayland): crop Hyprland window frames at the click rect
f433e91 docs(changes): name the fragment for #12696
2f6480d fix(macos): refuse a minimized window before the SkyLight read; off-space only when the Space listing says so
f55eee9 fix(macos): apply the B9 minimized refusal on the SkyLight capture route too
c0282c5 Merge remote-tracking branch 'origin/dev' into cu-v2/task-13-p15a-wayland-window-targeted-input-on-hy
4a70b8c docs(changes): name the fragment for #12692
6b4444a fix(qa): spawn the GNOME observers by literal name so the telemetry opt-out scan can judge them
45818fa fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
980aa0e fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
53ab239 fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
6b35c19 fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
4509716 fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
09c451b fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
7d80892 fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
410e59a fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
78bbe6f fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
7aedf2a fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
611e142 fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
4ad2bca fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
6f9c028 fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
62e218d fix(qa): route the capture-consent probe and the off-Space scenario env through withTelemetryOptOut
ad0a41f Merge remote-tracking branch 'origin/dev' into cu-v2/task-9-p8-skylight-first-window-capture-other-s
6c1602b docs(changes): name the fragment for #12684
5b4aaf7 docs(changes): fragment for plan row 31 (placeholder number; renamed to the PR number once it exists)
76decf2 docs(changes): fragment for plan row 30 (placeholder number; renamed to the PR number once it exists)
0a8fbe6 docs(changes): fragment for plan row 22 (placeholder number; renamed to the PR number once it exists)
a0d39fb docs(changes): fragment for plan row 18 (placeholder number; renamed to the PR number once it exists)
b38b486 docs(changes): fragment for plan row 17 (placeholder number; renamed to the PR number once it exists)
f9cdf8b docs(changes): fragment for plan row 14 (placeholder number; renamed to the PR number once it exists)
0181038 docs(changes): fragment for plan row 24 (placeholder number; renamed to the PR number once it exists)
58e3e7b docs(changes): fragment for plan row 26 (placeholder number; renamed to the PR number once it exists)
0767c6c docs(changes): fragment for plan row 11 (placeholder number; renamed to the PR number once it exists)
5aed81c docs(changes): fragment for plan row 10 (placeholder number; renamed to the PR number once it exists)
ec0fe84 docs(changes): fragment for plan row 21 (placeholder number; renamed to the PR number once it exists)
50e8a81 docs(changes): fragment for plan row 15 (placeholder number; renamed to the PR number once it exists)
354ea9b docs(changes): fragment for plan row 12 (placeholder number; renamed to the PR number once it exists)
8ab6ea8 docs(changes): fragment for plan row 20 (placeholder number; renamed to the PR number once it exists)
51b89a1 docs(changes): fragment for plan row 13 (placeholder number; renamed to the PR number once it exists)
a6a0aa0 docs(changes): fragment for plan row 9 (placeholder number; renamed to the PR number once it exists)
ec3d3bf docs(changes): fragment for the P1b host-side v1 additions (placeholder number; renamed to the PR number once it exists)
6e47450 test(desktop-engine): the TS headless StaleRef case ages a ref past the eight newest snapshots
c6c4891 fix(desktop-service): knip entries for the computer.run sandbox worker; bundle-name constants stay module-private
b8d1016 fix(desktop-wayland): knip entry for the live GNOME QA script; the GNOME Shell extension entry is GJS-only
b3f9faa Merge remote-tracking branch 'origin/dev' into cu-v2/task-6-p1b-regenerate-protocol-ts-features-gate
18a5392 feat(desktop-core): eight ref generations per target with sub-generations and retained-object generation binding
664329b feat(desktop-service): QuickJS run cell with limits behind computer.run_sandbox (default vm)
c17dc38 test(desktop-engine): pin daemon restart after stop for v1 consumers; keep stop persistence XPC-only
50c0fe1 feat(desktop-wayland): window-targeted input on GNOME through a read-only window-rect shell extension
d23fd43 feat(desktop-core): skeleton observation, web-wrapper depth skip, drill-down sub-generations
9678d5c Merge row 25 8b44842 into cu-v2/wave4-stack-reconciled (client.rs socket-dir rule, connection.rs Outbound + announce_epochs, connect.ts Transport union incl. spawn + attach, reports.test.ts kind:remote; as reviewed on cu-v2/task-25-wave4d-reconcile-backup 01069001bb)
1a3cffc Merge row 23 79dfe00 into cu-v2/wave4-stack-reconciled (FEATURES keep-both key-priming + epoch + interaction-lock; every hello-pinning fixture aligned)
48e57ad Merge row 14 3a6f9f5 into cu-v2/wave4-stack-reconciled (FEATURES keep-both key-priming + epoch; every hello-pinning fixture incl. trace-redaction and epoch-* aligned)
a63bd02 Merge row 16 dba2a9f into cu-v2/wave4-stack-reconciled (prelude assets field-wise: JS/PY/DECL from row 26, DOCUMENTATION from merged computer.md; lazy-runtime pin)
5b4f8e4 Merge row 24 34dceef into cu-v2/wave4-stack-reconciled
5cc31be Merge row 26 0abc528 into cu-v2/wave4-stack-reconciled
50795c0 Merge remote-tracking branch 'origin/dev' into cu-v2/wave4-stack-reconciled
8e06ea7 fix(desktop-sdk): keep spawn and run-facade internals module-private (knip)
8d97706 fix(desktop-prelude): keep the generator's internal helpers module-private (knip)
c2f4cd0 feat(desktop-engine): concurrent same-uid --serve clients on the shared daemon session with peer check; sdk attach transport
d417ac7 feat(desktop-session): machine-wide interaction lock in the per-user runtime directory
5226193 feat(desktop-session): epoch counter with display, lock, sleep, space and restart sources
a9739a5 feat(desktop-macos): exact-window background key priming with defocus-free records and two-layer hand-back
7a11a40 feat(desktop-sdk): spawn transport with in-session refusal; run facade over the sdk
8015d96 feat(desktop-prelude): generate kernel computer globals from the sdk facade manifest over tool.computer
735a16c Merge row 11 20d115a into cu-v2/wave3-stack-reconciled (FEATURES keep-both ax-partial + trace; hello-pinning fixtures incl. trace-redaction list both)
1bb96cd Merge row 10 5ce232e into cu-v2/wave3-stack-reconciled
ea3f0b4 Merge row 21 4a971bf into cu-v2/wave3-stack-reconciled
4849d74 Merge row 15 4088e3d into cu-v2/wave3-stack-reconciled
1632bf1 Merge row 12 d3c77ad into cu-v2/wave3-stack-reconciled
d3547a7 Merge row 8 8a5294c into cu-v2/wave3-stack-reconciled
d427d26 Merge remote-tracking branch 'origin/dev' into cu-v2/wave3-stack-reconciled
5e9672b Merge remote-tracking branch 'origin/dev' into cu-v2/task-6-p1b-regenerate-protocol-ts-features-gate
43f78b2 fix(qa): register the KWin desktop QA driver as a knip entry (knip)
9b5a6cd feat(desktop-engine): quarantine replies after stop; parent-death exit for every macOS helper spawner
0a2e276 feat(desktop-engine): opt-in per-stage timings and redacted JSONL trace
ccdbb30 feat(desktop-core): partial accessibility observation with per-node truncation and attribute evidence
2e55511 feat(desktop-wayland): window-targeted input on KWin via its D-Bus geometry
06d36f0 feat(desktop-sdk): typed SDK package over RpcPort with facade manifest and package boundaries test
a91f32f feat(desktop-macos): takeover gate before background keys; delivered counts on interrupted typing; key-priming switch plumbing
1c3874b Merge row 20 4174889 into cu-v2/wave2-stack-reconciled (fake-engine.mjs header comments keep-both; bundle regenerated next)
4f4eaf2 Merge commit 'b3d322c80d24b0d3be70bec7660aeffc3c2b1c3e' into cu-v2/wave2-stack-reconciled
fe561b3 Merge commit '990b69963a59f38b284a8e33bcff333a0d7b0338' into cu-v2/wave2-stack-reconciled
7ad8d93 Merge commit '7a648179337c77882b440badb58fa7f6fc5f11ca' into cu-v2/wave2-stack-reconciled
4925537 Merge commit '4b4b2b039e1812148e84b5b4ce448d01def1d1dd' into cu-v2/wave2-stack-reconciled
0c9ab03 Merge remote-tracking branch 'origin/dev' into cu-v2/wave2-stack-reconciled
cede0d6 Merge commit '206ce7976bf72136570ff646c03f32d3fb0f2651' into cu-v2/task-7-p6-window-identity-re-check-at-dispatch-
c5b270e feat(desktop-core): window identity re-check, per-call frame consume, hit, coordinate-frame reasons
bcb858d Merge remote-tracking branch 'origin/dev' into cu-v2/task-6-p1b-regenerate-protocol-ts-features-gate
1cb63de Merge remote-tracking branch 'origin/dev' into cu-v2/task-6-p1b-regenerate-protocol-ts-features-gate
491881c fix(qa): register the Hyprland desktop QA driver as a knip entry (knip)
1b4c6ca Merge remote-tracking branch 'origin/dev' into cu-v2/task-20-p16c-fresh-process-tcc-re-probe-in-the-s
e4409ef feat(desktop-service): fresh-process permission re-probe before session open
668e093 Merge remote-tracking branch 'origin/dev' into cu-v2/task-13-p15a-wayland-window-targeted-input-on-hy
d128fe1 feat(desktop-wayland): Hyprland window geometry and capability probe for window-targeted input
cd2739f Merge remote-tracking branch 'origin/dev' into cu-v2/task-9-p8-skylight-first-window-capture-other-s
0530ddf feat(desktop-macos): SkyLight-first window capture with off-Space support; replayd consent probe
2ff8447 Merge remote-tracking branch 'origin/dev' into cu-v2/task-6-p1b-regenerate-protocol-ts-features-gate
a00bd6e feat(desktop-protocol): regenerate for v1 additions; features-gated session options; settings reservation; new error guidance
d035a0c chore(stack): reconcile the wave-5 stack base onto dev 3826e84 (#12260 fold)
bbb097a Merge commit '3670797bbfd82922f0f835d8cbeaa56de3891014' into cu-v2/wave1-stack
2619d20 Merge commit '57d1f650580fbe7162b8977a03547f5b0ca86fa0' into cu-v2/wave1-stack
bdf9fa7 Merge commit '4074f0d97da745c6324cb37332ed454bd10d1c91' into cu-v2/wave1-stack
3af7097 Merge origin/dev 62e97f2 into cu-v2/task-1
3e37948 fix(desktop-session): keep the delivered count when a refusal-class error ends input mid-action
8b116fa Merge origin/dev cacedd9 into cu-v2/task-1
27b896b Merge origin/dev daa1ab2 into cu-v2/task-1
664b4ff Merge origin/dev 7d511d1 into cu-v2/task-1
e59f7eb Merge origin/dev 5487861 into cu-v2/task-1
03c2364 Merge origin/dev 7adadfb into cu-v2/task-1 (resolve with #11530 display-awake, keep both)
de556d3 Merge origin/dev (e281809) into cu-v2/task-1
4d656b1 fix(desktop-session): report the mode the session thread applied, not the last one queued
3410a05 Merge origin/dev (8c08758) into cu-v2/task-1
f47d240 fix(desktop-protocol): type the epoch.changed notification for the TS host
9853a8c Merge origin/dev (be3cde8) into cu-v2/task-1
8c9fda6 docs(changes): changelog fragment for #12260
cc0189f feat(desktop-core): additive protocol vocabulary for action reports, session options, ax evidence, epoch, 3 error codes

Thank you to 2 community contributors:

@Nowaker:
- fix(delegate-task): stop treating error: null as a failed foreground child
- changes: fragment for #13076
@cynkai:
- test(model-core): pin the Fable 5.2 context-window boundary with non-matching ids (#12985)

bun add -g omo-ai

omo-ai 5.1.69 v5.1.69 on Node.js NPM

Fixed

Changed

Added

omo-ai 5.1.69
v5.1.69

on Node.js NPM