fix(opencode-native): stop leaking opencode serve processes across teardown paths

Opencode-native has the same process-leak shape codex-native did (fixed in
#3925): each session runs a runner-owned `opencode serve` subprocess tracked
in _AUTO_OPENCODE_SERVERS plus the opencode TUI pane. Only DELETE /v1/sessions
cancelled the forwarder (whose finally closes the server); the other ways the
TUI pane goes away left the server orphaned for the runner's lifetime:

- the idle pane reaper closed the tmux pane but never touched
  _AUTO_OPENCODE_SERVERS,
- an unexpected TUI exit (crash / OOM / host recycle) evicted the pane
  without cancelling the forwarder, and
- a graceful host/runner stop tore the runner down without a per-session
  DELETE, so _stop_pm never closed the servers.

Mirror the codex fix: add teardown_opencode_native_server (cancel the
forwarder, close any leftover registered server; no-op when none is
registered) and teardown_all_opencode_native_servers (shutdown sweep). Wire
them into the idle-reaper reap, the terminal-exit publisher, and _stop_pm
alongside the codex calls.

No boot-time reconcile: opencode has no crash-safe process registry and
`opencode serve` is a plain Popen (not start_new_session=True), so it shares
the runner's process group and dies with a hard runner death — the
graceful-stop + reaper + exit paths cover the observed leak.

Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>

.claude/skills/antigravity-native-e2e-dev/SKILL.md

@@ -71,8 +71,10 @@ Three transports, easy to confuse:
    agy models   # exits 0 and lists models only when signed in; else 'Please sign in'
    ```
    `False` / non-zero → run `agy` once and sign in. agy's token lives under
-   `~/.gemini` (`oauth_creds.json` on macOS, `antigravity-cli/antigravity-oauth-token`
-   on Linux).
+   `~/.gemini` (`oauth_creds.json` on macOS through 1.0.10,
+   `antigravity-cli/antigravity-oauth-token` on Linux); agy 1.1.7+ on macOS
+   writes no token file and keeps the credential in the Keychain, which is why
+   `gemini_login_detected()` falls back to `agy models` there.
 4. **`tmux` is on PATH.** The agy terminal is a runner-owned tmux pane; the CLI
    attaches to it and the executor drives it via `tmux send-keys`
    (`_preflight_local_tools` hard-fails without tmux).

.claude/skills/harness-integration-guide/SKILL.md

@@ -115,6 +115,19 @@ All capabilities are **required** for a complete harness integration:
 - [ ] Unit tests cover tool bridging, auth, model routing
 - [ ] Mock LLM tests cover the happy path without real API calls
 
+### Shortcut: ACP CLI harnesses are one catalog row
+
+If the vendor CLI speaks the Agent Client Protocol on stdio (the
+`goose acp` / `qwen --acp` family), do NOT write a new inner module, registry
+entries, or a spawn-env builder. Add one row to `ACP_CLI_HARNESSES` in
+`omnigent/acp_cli_harnesses.py` (label, binary, ACP argv, aliases, install
+hint or npm package, vendor login command) plus docs. Validity, module
+routing, picker label, capabilities, install spec, readiness, setup steps,
+spawn env, and the live e2e-matrix exclusion all derive from the row;
+`tests/test_acp_cli_harnesses.py` asserts the wiring per row automatically.
+These rows run through `omnigent/inner/acp_harness.py` and `AcpExecutor`, own
+their auth and model selection, and reject `/model` overrides up front.
+
 ---
 
 ## Part 2 — Native harnesses

.claude/skills/run-load-test/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: run-load-test
+description: Run the Omnigent load test and produce a results file explaining the latencies. Load when the user wants to load-test / stress-test / benchmark Omnigent under concurrency ("load test omnigent", "stress test the server", "how many hosts/sessions/turns can it handle", "load test real agent turns / conversations", "run a load test"). The test makes each simulated user a real omnigent host that creates host-bound sessions and drives real multi-turn conversations with a mocked LLM; it boots its own local stack (dev/loadtest/run.py). Gather inputs, run it, then read the generated summary.md and explain the latency distribution (avg/median/p95/p99, throughput, failures). NOT for single-request latency micro-benchmarks (that is dev/benchmarks/).
+---
+
+# Run the Omnigent load test
+
+Drives `dev/loadtest/` end to end: collect inputs → run → read `summary.md` →
+explain the latencies. **Each Locust user is a real `omnigent host`** that
+registers over the host tunnel, creates host-bound sessions, and drives **real
+multi-turn conversations** — every turn is a genuine post→idle loop through the
+host's runner, with the **LLM mocked** (zero latency) so the numbers are
+Omnigent's own overhead. `-u N` scales the number of hosts.
+
+It **boots its own local stack** (server + mock LLM), so there is no server to
+point at, and it runs **from a repo checkout** only. For single-request latency
+micro-benchmarks (not concurrency), that is a different tool: `dev/benchmarks/`.
+
+## 1. Ensure deps (repo checkout)
+
+```bash
+pip install -e '.[loadtest,dev,agents-sdk]'   # or: uv sync --extra loadtest --extra dev --extra agents-sdk
+```
+
+Run with that same interpreter (e.g. `.venv/bin/python`), from the repo root.
+
+## 2. Gather inputs
+
+Ask the user (AskUserQuestion when several are unknown); all have defaults.
+
+| Input | Flag | Default | Notes |
+|---|---|---|---|
+| Hosts | `--users` | 4 | Concurrent hosts (N) — the main scale knob. |
+| Spawn rate | `--spawn-rate` | 1 | Hosts started per second. |
+| Run time | `--run-time` | 120s | `40s` / `5m` / `1h`. |
+| Sessions/host | `--sessions-per-user` | 2 | Host-bound sessions each host drives. |
+| Turns/session | `--turns-per-session` | 4 | Turns per session — history grows across them. |
+| Reply length | `--reply-words` | 60 | Words in the mocked (streamed) reply per turn. |
+
+**Capacity caveat — say this to the user if they ask for large N:** turns run on
+real host + runner subprocesses, so N hosts × M sessions = N×M runner processes
+on *this* box. It is capacity-limited by design (real turns, not faked). Start at
+`--users 2 --sessions-per-user 1 --turns-per-session 2 --run-time 40s` to confirm
+the stack boots (~10-30s), then ramp to a few dozen hosts at most. At high N the
+load box saturates before the server (Locust warns about CPU).
+
+## 3. Run
+
+```bash
+python dev/loadtest/run.py \
+    --users <N> --spawn-rate <R> --run-time <T> \
+    --sessions-per-user <S> --turns-per-session <TU>
+```
+
+It boots the stack, prints the server URL + registered agent, runs Locust, and
+writes `dev/loadtest/results/omnigent_load_test-<timestamp>/`.
+
+## 4. Read and explain
+
+`Read` the `summary.md` and relay it. Focus on:
+
+- **Outcome / failures** first. Exit 0 + 0 failures = PASS. Non-zero failures are
+  the headline — check `console.log` and, for a host that failed to register,
+  the per-host `results/.../host-workspaces/<name>/host.log`. At high N, failures
+  usually mean the *load box* saturated, not the server.
+- **turn** — the headline latency: one full post→idle agent turn on a host's
+  runner (mocked LLM), so it is Omnigent's per-turn overhead. It **grows across a
+  conversation** as history accumulates, so a rising p95/p99 with larger
+  `--turns-per-session` is expected and is the interesting signal.
+- **host online** — host tunnel registration cost; **session create** — the
+  host-bound create; **Ops/s** — aggregate throughput at this concurrency.
+
+If failures appeared or the tail looks high, suggest a concrete next step (lower
+N if the load box is saturated, raise `--turns-per-session` to study history
+growth, lengthen `--run-time` for steady state, or check server logs/metrics).
+
+## Notes
+
+- Scenario file: `dev/loadtest/omnigent_load_test.py`; driver + report:
+  `dev/loadtest/run.py`. Full reference: `dev/loadtest/README.md`.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,7 +1,7 @@
 name: Feature Request
 description: Suggest a new feature or improvement
 title: "[Feature] "
-labels: ["enhancement", "needs-triage"]
+labels: ["Feature", "needs-triage"]
 body:
   - type: textarea
     id: problem

.github/MAINTAINER

@@ -10,6 +10,7 @@ dhruv0811
 Edwinhe03
 fanzeyi
 kerryspchang
+kunyuchen
 lisancao
 mahesh-venkatachalam
 mateiz
@@ -23,3 +24,4 @@ TomeHirata
 xq-yin
 hzub
 zhengwin
+ajayalfred

.github/actions/integration-run/action.yml

@@ -145,8 +145,6 @@ runs:
         OMNIGENT_CLAUDE_SDK_NO_SANDBOX: ${{ inputs.harness == 'claude-sdk' && '1' || '' }}
         PYTEST_PROGRESS_LOG_DIR: ${{ github.workspace }}/artifacts/progress-${{ inputs.harness }}
         OMNIGENT_TOKEN_USAGE_JSON: ${{ github.workspace }}/artifacts/tokens-${{ inputs.harness }}.json
-        OMNIGENT_TEST_MODEL_SPREAD: "1"
-        OMNIGENT_TEST_MODEL_POOL_GPT: "databricks-gpt-5-5,databricks-gpt-5-4-mini"
       run: |
         set -euo pipefail
         mkdir -p artifacts "$INTEGRATION_TMP_BASE"

.github/actions/run-omnigent-agent/action.yml

@@ -7,6 +7,9 @@ description: >-
   after this action returns — the only secret here is the model key.
 
 inputs:
+  model:
+    description: Provider-configured model id.
+    required: true
   workdir:
     description: >-
       Repo checkout dir relative to the workspace (`.` when checked out at the
@@ -36,7 +39,7 @@ inputs:
   claude-code-version:
     description: "@anthropic-ai/claude-code npm version to install."
     required: false
-    default: 2.1.170
+    default: 2.1.212
 
 runs:
   using: composite
@@ -64,18 +67,24 @@ runs:
         CLAUDE_CODE_VERSION: ${{ inputs.claude-code-version }}
       run: |
         set -euo pipefail
-        mkdir -p "${GITHUB_WORKSPACE}/.cc-cli"
-        cd "${GITHUB_WORKSPACE}/.cc-cli"
+        # Install outside the checked-out tree: a repo-root package.json would
+        # otherwise capture this bare `npm install` and hoist it there, leaving
+        # this dir's node_modules empty.
+        CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+        mkdir -p "$CC_CLI_DIR"
+        cd "$CC_CLI_DIR"
         npm install --ignore-scripts --no-audit --no-fund "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
         node node_modules/@anthropic-ai/claude-code/install.cjs
-        echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+        echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
     - name: Write Omnigent provider config
       shell: bash
       env:
         GATEWAY_BASE_URL: ${{ inputs.gateway-base-url }}
+        OMNIGENT_AGENT_MODEL: ${{ inputs.model }}
       run: |
         set -euo pipefail
+        : "${OMNIGENT_AGENT_MODEL:?Set the action model input}"
         mkdir -p "$HOME/.omnigent"
         python3 -c "
         import pathlib, os, json
@@ -85,7 +94,7 @@ runs:
             'anthropic': {
                 'base_url': gw + '/anthropic',
                 'api_key_ref': 'env:LLM_API_KEY',
-                'models': {'default': 'databricks-claude-opus-4-8'},
+                'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
             }}}}
         pathlib.Path.home().joinpath('.omnigent', 'config.yaml').write_text(json.dumps(cfg, indent=2))
         "

.github/actions/setup-node/action.yml

@@ -1,37 +0,0 @@
-name: "setup-node"
-description: "Set up Node and pin npm, with npm dependency caching keyed on the web lockfile."
-
-# Single source of truth for the JS toolchain across CI. Pins npm to the
-# EXACT version that regenerates the lockfile in oss-regenerate-and-smoke.yml
-# (npm 11.12.1); without this, jobs use whatever npm Node 20 bundles
-# (npm 10.x) and the `package-lock.json` freshness gate in lint.yml would
-# flake on version-skew churn (dev/extraneous flags, metadata). Keep this
-# version in lockstep with the regen workflow so generation and
-# verification never diverge.
-
-inputs:
-  node-version:
-    description: "Node version to use."
-    default: "20"
-    required: false
-  cache:
-    description: "Package-manager cache to enable (passed to actions/setup-node)."
-    default: "npm"
-    required: false
-  cache-dependency-path:
-    description: "Lockfile path used as the cache key."
-    default: "web/package-lock.json"
-    required: false
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
-      with:
-        node-version: ${{ inputs.node-version }}
-        cache: ${{ inputs.cache }}
-        cache-dependency-path: ${{ inputs.cache-dependency-path }}
-
-    - name: Pin npm
-      shell: bash
-      run: npm install -g npm@11.12.1

.github/actions/setup-pnpm/action.yml

@@ -0,0 +1,21 @@
+name: "setup-pnpm"
+description: "Set up Node + pnpm for the web workspace"
+
+inputs:
+  node-version:
+    description: "Node version to use."
+    default: "22"
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      with:
+        standalone: true
+
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: pnpm
+        cache-dependency-path: pnpm-lock.yaml

.github/agents/release-post-formatter/config.yaml

@@ -83,6 +83,23 @@ prompt: |
   Full Changelog: <copy the exact `Full Changelog:` line from the input, verbatim>
   <!-- /RELEASE_POST -->
 
+  Then, AFTER the closing `<!-- /RELEASE_POST -->` marker, emit a machine-readable
+  map of which PRs back each feature section you wrote, so the workflow can build
+  a per-feature demo-video reference table for the reviewer. Emit it between its
+  own markers, as a JSON array in the SAME ORDER as your numbered sections — one
+  object per section, `title` matching the section's title text exactly (without
+  the `N. ` prefix), `pr_refs` the numbers from the `(#123, #456)` refs on the
+  release-body bullets you folded into that feature (integers, no `#`). Include
+  ONLY features you wrote up; omit bullets/PRs you dropped. This block is metadata,
+  NOT part of the post — never put PR numbers back into the RELEASE_POST prose.
+
+  <!-- RELEASE_POST_PRS -->
+  [
+    {"title": "<Feature 1 title>", "pr_refs": [123, 456]},
+    {"title": "<Feature 2 title>", "pr_refs": [789]}
+  ]
+  <!-- /RELEASE_POST_PRS -->
+
   ## The MLflow 3.14.0 style (match this)
   - CURATE, don't mirror. Pick only the ~4-6 OUTSTANDING, headline features and
     give each its own numbered section. DROP minor features, small tweaks, and
@@ -113,7 +130,9 @@ prompt: |
   placeholder immediately under EACH feature heading:
     `![TODO: add a demo screenshot or GIF for "<feature title>"](TODO)`
   Use the literal token `TODO` so a reviewer can grep for it. Never fabricate a
-  real-looking image path.
+  real-looking image path. (The workflow adds a table of the release's feature
+  PRs and their existing demo videos to the PR description, so a reviewer can drop
+  an already-recorded clip into these placeholders — you do not reference it.)
 
   ## Docs links (link to the most specific real page/section, or omit the line)
   The "## Available docs pages and sections" input lists every real docs URL and

.github/areas.json

@@ -97,13 +97,12 @@
       "owners": [
         "dhruv0811",
         "TomeHirata",
-        "SabhyaC26",
         "bbqiu",
         "fanzeyi",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -117,10 +116,10 @@
         "dhruv0811",
         "bbqiu",
         "fanzeyi",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -134,10 +133,10 @@
         "dhruv0811",
         "bbqiu",
         "fanzeyi",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -150,13 +149,12 @@
       "owners": [
         "dhruv0811",
         "TomeHirata",
-        "SabhyaC26",
         "bbqiu",
         "fanzeyi",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -167,7 +165,6 @@
         "omnigent/onboarding/"
       ],
       "owners": [
-        "SabhyaC26",
         "dhruv0811",
         "fanzeyi"
       ]
@@ -195,10 +192,7 @@
       ],
       "owners": [
         "TomeHirata",
-        "SabhyaC26",
-        "bbqiu"
-      ],
-      "owners_paused": [
+        "bbqiu",
         "dbczumar"
       ]
     },
@@ -211,8 +205,7 @@
       ],
       "owners": [
         "dhruv0811",
-        "PattaraS",
-        "SabhyaC26"
+        "PattaraS"
       ]
     },
     {
@@ -225,9 +218,7 @@
       "owners": [
         "fanzeyi",
         "dhruv0811",
-        "bbqiu"
-      ],
-      "owners_paused": [
+        "bbqiu",
         "dbczumar"
       ]
     },
@@ -239,10 +230,7 @@
         "omnigent/sandbox/"
       ],
       "owners": [
-        "SabhyaC26",
-        "fanzeyi"
-      ],
-      "owners_paused": [
+        "fanzeyi",
         "dbczumar"
       ]
     },
@@ -255,13 +243,12 @@
       ],
       "owners": [
         "bbqiu",
-        "aravind-segu",
         "fanzeyi",
         "dhruv0811",
-        "SabhyaC26"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -273,16 +260,15 @@
       ],
       "owners": [
         "bbqiu",
-        "aravind-segu",
         "fanzeyi",
         "dhruv0811",
-        "SabhyaC26",
         "serena-ruan",
         "daniellok-db",
-        "TomeHirata"
+        "TomeHirata",
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -295,12 +281,11 @@
       "owners": [
         "fanzeyi",
         "dhruv0811",
-        "aravind-segu",
         "bbqiu",
-        "SabhyaC26"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -313,13 +298,12 @@
       "owners": [
         "dhruv0811",
         "TomeHirata",
-        "SabhyaC26",
         "bbqiu",
         "fanzeyi",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -345,9 +329,7 @@
         "dhruv0811",
         "fanzeyi",
         "serena-ruan",
-        "daniellok-db"
-      ],
-      "owners_paused": [
+        "daniellok-db",
         "dbczumar"
       ]
     },
@@ -374,9 +356,6 @@
       "owners": [
         "dhruv0811",
         "PattaraS",
-        "SabhyaC26"
-      ],
-      "owners_paused": [
         "dbczumar"
       ]
     },
@@ -390,13 +369,12 @@
       "owners": [
         "dhruv0811",
         "fanzeyi",
-        "SabhyaC26",
         "TomeHirata",
         "bbqiu",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -410,13 +388,12 @@
       "owners": [
         "dhruv0811",
         "TomeHirata",
-        "SabhyaC26",
         "bbqiu",
         "fanzeyi",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -432,13 +409,12 @@
       "owners": [
         "dhruv0811",
         "TomeHirata",
-        "SabhyaC26",
         "bbqiu",
         "fanzeyi",
-        "aravind-segu"
+        "dbczumar"
       ],
       "owners_paused": [
-        "dbczumar"
+        "aravind-segu"
       ]
     },
     {
@@ -450,10 +426,7 @@
         "omnigent/cursor_native"
       ],
       "owners": [
-        "SabhyaC26",
-        "dhruv0811"
-      ],
-      "owners_paused": [
+        "dhruv0811",
         "dbczumar"
       ]
     },
@@ -468,8 +441,8 @@
         "omnigent/onboarding/gemini_auth.py"
       ],
       "owners": [
-        "SabhyaC26",
-        "TomeHirata"
+        "TomeHirata",
+        "PattaraS"
       ]
     },
     {
@@ -496,7 +469,6 @@
       ],
       "owners": [
         "dhruv0811",
-        "SabhyaC26",
         "TomeHirata"
       ]
     },
@@ -509,9 +481,11 @@
         "omnigent/kimi_native"
       ],
       "owners": [
-        "aravind-segu",
         "dhruv0811",
         "fanzeyi"
+      ],
+      "owners_paused": [
+        "aravind-segu"
       ]
     },
     {
@@ -524,7 +498,6 @@
       ],
       "owners": [
         "PattaraS",
-        "SabhyaC26",
         "TomeHirata",
         "dhruv0811"
       ]
@@ -542,9 +515,6 @@
         "dhruv0811",
         "PattaraS",
         "TomeHirata",
-        "SabhyaC26"
-      ],
-      "owners_paused": [
         "dbczumar"
       ]
     },
@@ -557,7 +527,6 @@
         "omnigent/pi_native"
       ],
       "owners": [
-        "SabhyaC26",
         "TomeHirata",
         "dhruv0811"
       ]
@@ -585,7 +554,6 @@
         "omnigent/onboarding/copilot_auth.py"
       ],
       "owners": [
-        "SabhyaC26",
         "PattaraS",
         "TomeHirata",
         "dhruv0811"

.github/ci-deps/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "description": "Pinned npm CLIs the e2e workflow installs (claude-code, codex, pi).",
   "dependencies": {
-    "@anthropic-ai/claude-code": "2.1.163",
+    "@anthropic-ai/claude-code": "2.1.212",
     "@earendil-works/pi-coding-agent": "0.79.0",
     "@openai/codex": "0.139.0"
   }

.github/scripts/changelog/generate.py

@@ -174,7 +174,7 @@ def render_section(tag: str, date: str, results: list[HarvestResult]) -> str:
 
 
 # Multi-section draft for the GitHub Release body: the Type-of-change tags collapse
-# into the sections the release coordinator curates by hand (see RELEASING.md /
+# into the sections the release coordinator curates by hand (see the maintainer release runbook /
 # the release-notes-drafter agent). This is the deterministic scaffold — the AI
 # drafter refines it, and it is also the fallback when the LLM is unavailable.
 # Values are "Type of change" checkbox labels (see _md.TYPE_TAGS).

.github/scripts/ci/backcompat-pairwise-matrix.sh

@@ -3,7 +3,7 @@
 # `e2e_matrix` and `integration_matrix`.
 #
 # We test `main` (the checked-out code = client + tests, always) against each
-# non-rc release tag AT OR ABOVE the backcompat floor (MIN_VERSION, default
+# final (non-prerelease) release tag AT OR ABOVE the backcompat floor (MIN_VERSION, default
 # 0.2.0 — the first release with the mock-LLM e2e infra; see below), on BOTH
 # axes — and ONLY those cells:
 #   (server=main,      runner=<release>)  — new server vs a previously-shipped runner
@@ -17,8 +17,9 @@
 #
 # Env in:
 #   VERSIONS    optional comma-separated override of the version set used for
-#               BOTH axes (e.g. "main,v0.2.0"). Empty = main + all non-rc tags.
-#               Blank entries are dropped and surrounding whitespace trimmed.
+#               BOTH axes (e.g. "main,v0.2.0"). Empty = main + all final
+#               (non-prerelease) tags. Blank entries are dropped and
+#               surrounding whitespace trimmed.
 #   NUM_SHARDS  e2e shard count per cell (default 4).
 # Out (GITHUB_OUTPUT):
 #   e2e_matrix={"include":[{"server":..,"runner":..,"shard_id":..,"num_shards":..}, ...]}
@@ -61,9 +62,12 @@ if [ -n "${VERSIONS:-}" ]; then
   IFS=',' read -ra raw <<<"$VERSIONS"
 else
   raw=("main")
-  # `[^a-z]rc[0-9]` so we drop vX.Y.ZrcN without over-excluding tags that merely
-  # contain the substring "rc" (e.g. a hypothetical "...march").
-  while IFS= read -r tag; do raw+=("$tag"); done < <(git tag --sort=-v:refname | grep -viE '(^|[^a-z])rc[0-9]')
+  # Drop pre-release tags (vX.Y.ZrcN / .devN / preN — same trio github-release.yml
+  # skips): they are snapshots of main, so main-vs-them is not a compat signal, and
+  # under the 256-job cap they would evict the oldest FINAL releases from coverage.
+  # `[^a-z]` guards against over-excluding tags that merely contain the substring
+  # (e.g. a hypothetical "...march"). An explicit VERSIONS override still accepts them.
+  while IFS= read -r tag; do raw+=("$tag"); done < <(git tag --sort=-v:refname | grep -viE '(^|[^a-z])(rc|dev|pre)[0-9]')
 fi
 
 # Trim whitespace, drop blanks, reject invalid tokens, drop below-floor releases.
@@ -105,7 +109,7 @@ done
 # The integration suite runs a single openai-agents leg in mock mode (matches
 # integration-matrix.sh); the model name is unused under the mock LLM.
 integ_harness="openai-agents"
-integ_model="databricks-gpt-5-4-mini"
+integ_model="mock-model"
 integ_workers="4"
 
 e2e_items=()

.github/scripts/ci/integration-matrix.sh

@@ -34,7 +34,7 @@ fi
 
 read -r -d '' matrix <<'JSON' || true
 {"include":[
-{"name":"openai-agents","harness":"openai-agents","model":"databricks-gpt-5-4-mini","workers":4}
+{"name":"openai-agents","harness":"openai-agents","model":"mock-model","workers":4}
 ]}
 JSON
 # Collapse to one line so the GITHUB_OUTPUT key=value contract holds.

.github/scripts/homebrew/generate_formula.py

@@ -10,9 +10,12 @@ Resolution: `uv pip compile` computes the exact transitive closure of
 `omnigent[<extras>]==<version>` for each target platform (macOS arm + intel by
 default — the brew tap's `brew test-bot` matrix). The per-platform closures are
 unioned; for each package we then fetch the sdist URL + sha256 from the PyPI JSON
-API and emit a `resource` stanza. Packages with no sdist (e.g. `cel-expr-python`,
-which is Bazel-built and has no PyPI sdist) are skipped — omnigent degrades
-gracefully without them, matching the hand-tuned formula.
+API and emit a `resource` stanza. Every package in the closure must publish an
+sdist: the formula builds each resource from source, so one dropped for lack of
+an sdist ships a venv missing that dependency, which surfaces as an ImportError
+(or a silently disabled feature) at runtime rather than a red build. A missing
+sdist is therefore a hard error; `--allow-no-sdist NAME` waives it for a package
+omnigent genuinely works without.
 
 Excluded from `resource` generation (provided by the brewed Python environment,
 NOT built as virtualenv resources — keep in sync with the template's
@@ -69,6 +72,66 @@ BREWED_EXCLUSIONS = {
 # omnigent is the stable `url` itself, so it's never a resource.
 SELF_EXCLUSIONS = {"omnigent"}
 
+# Packages pinned to an upstream platform wheel instead of the sdist, emitted as
+# an arch-conditional `resource` (the template's install block pip-installs any
+# `.whl` resource from its cached download).
+#
+# google-re2 (required by cel-python, which backs CEL policy evaluation) has an
+# sdist that cannot be built here: its setup.py shells out to `bazel` whenever
+# GITHUB_ACTIONS is set — always true under `brew test-bot` — and the non-bazel
+# path needs re2 + abseil + pybind11 headers and C++17, which it never requests.
+# The upstream macOS wheels statically link re2 and abseil, so they need no build
+# toolchain and no brewed `abseil` (whose ABI breaks on most releases, which
+# would force a formula `revision` bump every time it moved).
+WHEEL_REQUIRED = {"google-re2"}
+
+# Compiled extensions we PREFER to take as an upstream wheel, falling back to the
+# sdist when no compatible wheel exists (e.g. right after a python@X.Y bump,
+# before upstream publishes cpXY wheels). Building these is the bulk of the
+# formula's cost -- grpcio alone dwarfs everything else on a 3-core bottle
+# builder -- and every wheel here has enough Mach-O header padding for Homebrew
+# to rewrite its install name during keg relocation.
+#
+# jiter, tiktoken and watchfiles are deliberately NOT here: their wheels are
+# maturin-built with no install-name padding, so relocation dies with "Failed
+# changing dylib ID" (omnigent issue #866). They are built from source with
+# -headerpad_max_install_names instead, which is how every bottled release up to
+# 0.6.0 shipped them. Verify with:
+#   install_name_tool -id <long Cellar path> <extracted .so>
+PREFER_WHEEL = {
+    "argon2-cffi-bindings",
+    "grpcio",
+    "httptools",
+    "markupsafe",
+    "protobuf",
+    "pyyaml",
+    "regex",
+    "uvloop",
+    "zstandard",
+}
+
+# Packages pinned to the PURE-PYTHON (`py3-none-any`) wheel on purpose.
+#
+# pendulum is the awkward case: its maturin wheel cannot be relocated (see
+# above), and its sdist does not link against python 3.14 -- pyo3 leaves
+# _Py_NoneStruct/_Py_Dealloc/_Py_TrueStruct undefined and the arm64 link fails.
+# Its pure-Python wheel ships no extension module at all, so there is nothing to
+# relocate and nothing to build. Only cel-python pulls it in, for CEL timestamp
+# arithmetic, so the slower implementation is not on any hot path.
+PURE_WHEEL = {"pendulum"}
+
+# uv target platform -> (Homebrew arch block, wheel platform-tag arch suffix).
+_ARCH_BLOCKS = {
+    "aarch64-apple-darwin": ("on_arm", "arm64"),
+    "x86_64-apple-darwin": ("on_intel", "x86_64"),
+}
+
+# name-version[-build]-pytag-abitag-platformtag.whl (PEP 427).
+_WHEEL_RE = re.compile(
+    r"^(?P<name>.+?)-(?P<version>[^-]+?)(?:-(?P<build>\d[^-]*))?"
+    r"-(?P<py>[^-]+)-(?P<abi>[^-]+)-(?P<plat>[^-]+)\.whl$"
+)
+
 _PLACEHOLDERS = (
     "__OMNIGENT_URL__",
     "__OMNIGENT_SHA256__",
@@ -124,6 +187,73 @@ def pick_sdist(files: list[dict]) -> tuple[str, str] | None:
     return f["url"], f["digests"]["sha256"]
 
 
+def _abi_compatible(py: str, abi: str, python_tag: str) -> bool:
+    """Is a wheel's (pytag, abitag) usable by CPython `python_tag` (e.g. cp314)?
+
+    Accepts the exact CPython tag, a stable-ABI (`abi3`) wheel built for that
+    version or older, and pure-Python `py3-none`. Free-threaded builds (`cp314t`)
+    are excluded: the brewed python is not free-threaded, and equality on the abi
+    tag keeps them out.
+    """
+    if abi == python_tag:
+        return True
+    if abi == "abi3" and py.startswith("cp") and py[2:].isdigit():
+        return int(py[2:]) <= int(python_tag[2:])
+    return py == "py3" and abi == "none"
+
+
+def _wheel_arches(plat: str) -> tuple[frozenset[str], tuple[int, int]] | None:
+    """Arches a macOS wheel platform tag covers, plus its deployment target."""
+    if plat == "any":
+        return frozenset({"arm64", "x86_64"}), (0, 0)
+    m = re.match(r"macosx_(\d+)_(\d+)_(arm64|x86_64|universal2|intel)$", plat)
+    if not m:
+        return None
+    arches = {
+        "arm64": {"arm64"},
+        "x86_64": {"x86_64"},
+        "intel": {"x86_64"},
+        "universal2": {"arm64", "x86_64"},
+    }[m.group(3)]
+    return frozenset(arches), (int(m.group(1)), int(m.group(2)))
+
+
+def pick_macos_wheels(
+    files: list[dict], python_tag: str, arches: list[str]
+) -> dict[str, tuple[str, str]] | None:
+    """Best macOS wheel per arch: {arch: (url, sha256)}, or None if any is missing.
+
+    Ranked by (native before pure-Python, then lowest deployment target). A wheel
+    built for an older `macosx_<major>_<minor>` minimum installs on every newer
+    macOS the tap builds for while the reverse is not true. Pure-Python
+    `py3-none-any` wheels sort last on purpose: when a package ships both (e.g.
+    protobuf, pendulum) the `any` wheel is the slow fallback implementation, and
+    it would otherwise always win by having no deployment target at all.
+
+    A `universal2` (or `any`) wheel satisfies both arches with one file, which the
+    caller renders as a single unconditional url.
+    """
+    best: dict[str, tuple[tuple[int, int, int], str, str]] = {}
+    for f in files:
+        if f.get("packagetype") != "bdist_wheel":
+            continue
+        m = _WHEEL_RE.match(f["filename"])
+        if not m or not _abi_compatible(m.group("py"), m.group("abi"), python_tag):
+            continue
+        covered = _wheel_arches(m.group("plat"))
+        if not covered:
+            continue
+        covered_arches, target = covered
+        pure = 1 if m.group("abi") == "none" else 0
+        rank = (pure, *target)
+        for arch in arches:
+            if arch in covered_arches and (arch not in best or rank < best[arch][0]):
+                best[arch] = (rank, f["url"], f["digests"]["sha256"])
+    if any(arch not in best for arch in arches):
+        return None
+    return {arch: (url, sha) for arch, (_, url, sha) in best.items()}
+
+
 def rewrite_url(url: str, rewrites: list[tuple[str, str]]) -> str:
     """Apply `from -> to` substitutions to a download URL, in order.
 
@@ -145,6 +275,25 @@ def resource_stanza(name: str, url: str, sha256: str, indent: int = 2) -> str:
     return f'{pad}resource "{name}" do\n{pad}  url "{url}"\n{pad}  sha256 "{sha256}"\n{pad}end'
 
 
+def wheel_resource_stanza(name: str, per_arch: list[tuple[str, str, str]], indent: int = 2) -> str:
+    """An arch-conditional `resource` stanza: one `on_arm`/`on_intel` block each.
+
+    `per_arch` is [(brew_block, url, sha256), ...]. `Resource` includes
+    `OnSystem::MacOSAndLinux`, so these blocks are valid inside a resource.
+    """
+    pad = " " * indent
+    lines = [f'{pad}resource "{name}" do']
+    for block, url, sha256 in per_arch:
+        lines += [
+            f"{pad}  {block} do",
+            f'{pad}    url "{url}"',
+            f'{pad}    sha256 "{sha256}"',
+            f"{pad}  end",
+        ]
+    lines.append(f"{pad}end")
+    return "\n".join(lines)
+
+
 def resolve_closure(
     version: str,
     platforms: list[str],
@@ -253,6 +402,7 @@ def generate(
     index_url: str,
     uv: str,
     exclude: set[str],
+    allow_no_sdist: set[str] | None = None,
     api_base: str = PYPI_JSON_API,
     url_rewrites: list[tuple[str, str]] | None = None,
 ) -> str:
@@ -290,24 +440,96 @@ def generate(
     # a sdist resource stanza. `exclude` is the caller-supplied set (CLI --exclude);
     # it augments the built-in brewed set and the always-excluded self package.
     excluded = BREWED_EXCLUSIONS | exclude | SELF_EXCLUSIONS
-    resources: list[tuple[str, str, str]] = []
+    waived = allow_no_sdist or set()
+    python_tag = "cp" + python_version.replace(".", "")
+    resources: list[tuple[str, str]] = []
+    missing_sdist: list[str] = []
     for name, ver in sorted(closure.items()):
         if name in excluded:
             continue
         files = pypi_release_files(name, ver, api_base)
-        sdist = pick_sdist(files)
-        if not sdist:
-            # No sdist (e.g. cel-expr-python, Bazel-built) — skip. omnigent
-            # degrades gracefully without it, matching the hand-tuned formula.
-            print(
-                f"::warning::{name}=={ver} has no sdist on PyPI — skipping (no resource).",
-                file=sys.stderr,
+
+        # Wheel-pinned packages. One `universal2`/`abi3` wheel usually covers both
+        # arches, so emit a plain url and only fall back to on_arm/on_intel blocks
+        # when upstream ships separate per-arch wheels.
+        # Deliberate pure-Python wheel: no extension module, nothing to relocate.
+        if name in PURE_WHEEL:
+            pure = next((f for f in files if f["filename"].endswith("-py3-none-any.whl")), None)
+            if not pure:
+                raise RuntimeError(
+                    f"{name}=={ver} publishes no py3-none-any wheel, but it is in "
+                    f"PURE_WHEEL because neither its platform wheel nor its sdist "
+                    f"is usable here. Re-check the comment on PURE_WHEEL."
+                )
+            resources.append(
+                (
+                    name,
+                    resource_stanza(
+                        name, rewrite_url(pure["url"], rewrites), pure["digests"]["sha256"]
+                    ),
+                )
             )
             continue
-        resources.append((name, rewrite_url(sdist[0], rewrites), sdist[1]))
+
+        if name in WHEEL_REQUIRED or name in PREFER_WHEEL:
+            wheels = pick_macos_wheels(files, python_tag, [_ARCH_BLOCKS[p][1] for p in platforms])
+            if wheels is None:
+                if name in WHEEL_REQUIRED:
+                    raise RuntimeError(
+                        f"{name}=={ver} has no macOS wheel for {python_tag} on every "
+                        f"target arch. It is in WHEEL_REQUIRED because its sdist is "
+                        f"unbuildable here, so upstream must publish one or the "
+                        f"dependency has to go."
+                    )
+                # PREFER_WHEEL is best-effort: fall through and build the sdist.
+                print(
+                    f"::warning::{name}=={ver} has no macOS wheel for {python_tag} on "
+                    f"every target arch — falling back to a source build (slow).",
+                    file=sys.stderr,
+                )
+            elif len({url for url, _ in wheels.values()}) == 1:
+                url, sha = next(iter(wheels.values()))
+                resources.append((name, resource_stanza(name, rewrite_url(url, rewrites), sha)))
+                continue
+            else:
+                per_arch = [
+                    (
+                        _ARCH_BLOCKS[p][0],
+                        rewrite_url(wheels[_ARCH_BLOCKS[p][1]][0], rewrites),
+                        wheels[_ARCH_BLOCKS[p][1]][1],
+                    )
+                    for p in platforms
+                ]
+                resources.append((name, wheel_resource_stanza(name, per_arch)))
+                continue
+
+        sdist = pick_sdist(files)
+        if not sdist:
+            # Wheel-only dependency: Homebrew can't build it as a resource.
+            # Dropping it silently yields a formula that installs green and is
+            # missing an import, so fail unless the caller waived it.
+            if name in waived:
+                print(
+                    f"::warning::{name}=={ver} has no sdist on PyPI — waived, no resource.",
+                    file=sys.stderr,
+                )
+                continue
+            missing_sdist.append(f"{name}=={ver}")
+            continue
+        resources.append((name, resource_stanza(name, rewrite_url(sdist[0], rewrites), sdist[1])))
+
+    if missing_sdist:
+        raise RuntimeError(
+            "no sdist on PyPI for: "
+            + ", ".join(missing_sdist)
+            + "\nHomebrew builds every resource from source, so these would be "
+            "absent from the installed venv. Drop the dependency, move it to an "
+            "extra that isn't bundled (see DEFAULT_EXTRAS), or pass "
+            "--allow-no-sdist <name> if omnigent works without it."
+        )
 
     # No trailing newline: the template's blank lines frame the resource block.
-    resources_str = "\n".join(resource_stanza(n, u, s) for n, u, s in resources)
+    resources_str = "\n".join(stanza for _, stanza in resources)
 
     return render_template(template, stable_url, stable_sha, resources_str)
 
@@ -385,6 +607,13 @@ def main(argv: list[str]) -> int:
         help="Package name to exclude from resources (repeatable; "
         "added to the built-in brewed set).",
     )
+    ap.add_argument(
+        "--allow-no-sdist",
+        action="append",
+        default=None,
+        help="Package allowed to have no PyPI sdist (repeatable). Without this, a "
+        "wheel-only dependency fails the run instead of vanishing from the formula.",
+    )
     ap.add_argument("--uv", default="uv", help="uv binary path.")
     args = ap.parse_args(argv)
 
@@ -408,6 +637,7 @@ def main(argv: list[str]) -> int:
         index_url=index_url,
         uv=args.uv,
         exclude={normalize_name(n) for n in (args.exclude or [])},
+        allow_no_sdist={normalize_name(n) for n in (args.allow_no_sdist or [])},
         api_base=api_base,
         url_rewrites=url_rewrites,
     )

.github/scripts/homebrew/omnigent.rb.template

@@ -5,7 +5,8 @@
 # spliced into this file via three placeholders that live ONLY in the class body
 # below — keep them out of this comment or the splicer will mangle it:
 #   * the stable `url` / `sha256` lines  -> the released omnigent sdist on PyPI
-#   * the per-dependency `resource` stanzas (one per PyPI sdist in the closure)
+#   * the per-dependency `resource` stanzas (one per package in the closure: the
+#     PyPI sdist, or a pinned wheel for WHEEL_REQUIRED / PREFER_WHEEL)
 #
 # Edit the hand-tuned STRUCTURAL parts here (desc, depends_on, install, test).
 # Edit the dependency set in omnigent-ai/omnigent's `pyproject.toml`
@@ -27,7 +28,10 @@ class Omnigent < Formula
   sha256 "__OMNIGENT_SHA256__"
   license "Apache-2.0"
 
-  # The Rust toolchain builds jiter and watchfiles from source.
+  # Most compiled extensions come from upstream wheels (see PREFER_WHEEL in
+  # generate_formula.py). jiter, tiktoken and watchfiles still build here, because
+  # their maturin wheels have no Mach-O install-name padding and Homebrew cannot
+  # relocate them -- hence the Rust toolchain and the RUSTFLAGS below.
   depends_on "pkgconf" => :build
   depends_on "rust" => :build
   # certifi, cryptography, pydantic (which bundles pydantic-core), and rpds-py
@@ -49,18 +53,25 @@ __RESOURCES__
   def install
     venv = virtualenv_create(libexec, "python3.14")
 
-    # The Rust extensions (jiter, watchfiles) must leave Mach-O header padding so
-    # Homebrew can rewrite their install names to the Cellar path during
-    # relocation (macOS only; the flag breaks Linux ld).
+    # jiter, tiktoken and watchfiles are the only Rust builds left. Their
+    # extensions must leave Mach-O header padding so Homebrew can rewrite install
+    # names to the Cellar path during relocation (macOS only; the flag breaks
+    # Linux ld). Everything else compiled is a prebuilt wheel.
     ENV.append_to_rustflags "-C link-args=-Wl,-headerpad_max_install_names" if OS.mac?
 
-    # argon2-cffi-bindings' sdist ships an unprocessed .git_archival.txt that the
-    # (build-isolated, latest) setuptools-scm parses instead of falling back to
-    # PKG-INFO, so version detection fails. Pin the version it should report.
-    ENV["SETUPTOOLS_SCM_PRETEND_VERSION_FOR_ARGON2_CFFI_BINDINGS"] =
-      resource("argon2-cffi-bindings").version.to_s
-
-    venv.pip_install resources
+    # Pure-Python resources are sdists Homebrew builds in place. Every other
+    # compiled extension is pinned to an upstream wheel (WHEEL_REQUIRED /
+    # PREFER_WHEEL in generate_formula.py), which is what keeps this formula out of
+    # cc/rustc on a 3-core bottle builder. Homebrew only auto-installs
+    # `py3-none-any` wheels, so copy each platform wheel's cached download back to
+    # its real filename and pip-install the file directly.
+    wheels, sdists = resources.partition { |r| r.url.end_with?(".whl") }
+    venv.pip_install sdists
+    wheels.each do |r|
+      whl = buildpath/r.url.split("/").last
+      cp r.cached_download, whl
+      venv.pip_install whl
+    end
 
     venv.pip_install_and_link buildpath
 
@@ -79,5 +90,10 @@ __RESOURCES__
     # provided by Homebrew formulae and imported from the brewed python through
     # the virtualenv's system site-packages; confirm they resolve in the venv.
     system libexec/"bin/python", "-c", "import certifi, cryptography, pydantic, rpds"
+
+    # celpy imports re2 at module scope and omnigent imports celpy behind a
+    # try/except, so a google-re2 that failed to build disables inline policies
+    # silently instead of failing. Import both so the gap is caught at build time.
+    system libexec/"bin/python", "-c", "import re2, celpy"
   end
 end

.github/scripts/merge-ready/required.sh

@@ -33,6 +33,7 @@ REQUIRED=(
   "E2E UI Tests (shard 0/3)"
   "E2E UI Tests (shard 1/3)"
   "E2E UI Tests (shard 2/3)"
+  "UI Snapshot (visual baselines)"
   "Integration (claude-sdk)"
   "Integration (openai-agents)"
   "Integration (codex)"
@@ -63,6 +64,7 @@ ALLOW_SKIP=(
   "E2E UI Tests (shard 0/3)"
   "E2E UI Tests (shard 1/3)"
   "E2E UI Tests (shard 2/3)"
+  "UI Snapshot (visual baselines)"
   "Integration (claude-sdk)"
   "Integration (openai-agents)"
   "Integration (codex)"
@@ -80,6 +82,7 @@ workflow_for() {
     "Pytest ("*)             echo "CI" ;;
     "E2E Tests (shard "*)    echo "E2E Tests" ;;
     "E2E UI Tests (shard "*) echo "E2E UI Tests" ;;
+    "UI Snapshot (visual baselines)") echo "UI Snapshot" ;;
     "Integration ("*)        echo "Integration Tests" ;;
     *)                       echo "" ;;
   esac

.github/scripts/rotation_roster.json

@@ -21,9 +21,7 @@
     "Dhruv Gupta": { "slack_id": "U0A76097E1F", "tz": "America/Los_Angeles" },
     "Edwin He": { "slack_id": "U077B1V6WQJ", "tz": "America/Los_Angeles" },
     "Pat Sukprasert": { "slack_id": "U05HRKWFY81", "tz": "Asia/Singapore" },
-    "Sabhya Chhabria": { "slack_id": "U07A1KQDXAB", "tz": "America/Los_Angeles" },
     "Serena Ruan": { "slack_id": "U0571L5KNLR", "tz": "Asia/Singapore" },
-    "Shivam Mittal": { "slack_id": "U09FZKX9S6B", "tz": "America/Los_Angeles" },
     "Tomu Hirata": { "slack_id": "U07TX4PR5MZ", "tz": "Asia/Singapore" },
     "Zeyi (Rice) Fan": { "slack_id": "U09L5HT4CH0", "tz": "America/Los_Angeles" }
   }

.github/scripts/rotation_schedule.json

@@ -12,69 +12,13 @@
     "name -> slack_id + timezone mapping)."
   ],
   "schedule": [
-    {
-      "date": "2026-07-14",
-      "name": "Edwin He"
-    },
-    {
-      "date": "2026-07-15",
-      "name": "Pat Sukprasert"
-    },
-    {
-      "date": "2026-07-16",
-      "name": "Sabhya Chhabria"
-    },
-    {
-      "date": "2026-07-17",
-      "name": "Serena Ruan"
-    },
-    {
-      "date": "2026-07-20",
-      "name": "Shivam Mittal"
-    },
-    {
-      "date": "2026-07-21",
-      "name": "Tomu Hirata"
-    },
-    {
-      "date": "2026-07-22",
-      "name": "Zeyi (Rice) Fan"
-    },
-    {
-      "date": "2026-07-23",
-      "name": "Aravind Segu"
-    },
-    {
-      "date": "2026-07-24",
-      "name": "Bryan Qiu"
-    },
-    {
-      "date": "2026-07-27",
-      "name": "Daniel Lok"
-    },
-    {
-      "date": "2026-07-28",
-      "name": "Dhruv Gupta"
-    },
-    {
-      "date": "2026-07-29",
-      "name": "Edwin He"
-    },
-    {
-      "date": "2026-07-30",
-      "name": "Pat Sukprasert"
-    },
-    {
-      "date": "2026-07-31",
-      "name": "Sabhya Chhabria"
-    },
     {
       "date": "2026-08-03",
       "name": "Serena Ruan"
     },
     {
       "date": "2026-08-04",
-      "name": "Shivam Mittal"
+      "name": "Aravind Segu"
     },
     {
       "date": "2026-08-05",
@@ -110,7 +54,7 @@
     },
     {
       "date": "2026-08-17",
-      "name": "Sabhya Chhabria"
+      "name": "Bryan Qiu"
     },
     {
       "date": "2026-08-18",
@@ -118,7 +62,7 @@
     },
     {
       "date": "2026-08-19",
-      "name": "Shivam Mittal"
+      "name": "Daniel Lok"
     },
     {
       "date": "2026-08-20",
@@ -154,7 +98,7 @@
     },
     {
       "date": "2026-09-01",
-      "name": "Sabhya Chhabria"
+      "name": "Dhruv Gupta"
     },
     {
       "date": "2026-09-02",
@@ -162,7 +106,7 @@
     },
     {
       "date": "2026-09-03",
-      "name": "Shivam Mittal"
+      "name": "Edwin He"
     },
     {
       "date": "2026-09-04",
@@ -198,7 +142,7 @@
     },
     {
       "date": "2026-09-16",
-      "name": "Sabhya Chhabria"
+      "name": "Tomu Hirata"
     },
     {
       "date": "2026-09-17",
@@ -206,7 +150,7 @@
     },
     {
       "date": "2026-09-18",
-      "name": "Shivam Mittal"
+      "name": "Zeyi (Rice) Fan"
     },
     {
       "date": "2026-09-21",
@@ -242,7 +186,7 @@
     },
     {
       "date": "2026-10-01",
-      "name": "Sabhya Chhabria"
+      "name": "Aravind Segu"
     },
     {
       "date": "2026-10-02",
@@ -250,7 +194,7 @@
     },
     {
       "date": "2026-10-05",
-      "name": "Shivam Mittal"
+      "name": "Bryan Qiu"
     },
     {
       "date": "2026-10-06",
@@ -286,7 +230,47 @@
     },
     {
       "date": "2026-10-16",
-      "name": "Sabhya Chhabria"
+      "name": "Daniel Lok"
+    },
+    {
+      "date": "2026-10-19",
+      "name": "Dhruv Gupta"
+    },
+    {
+      "date": "2026-10-20",
+      "name": "Edwin He"
+    },
+    {
+      "date": "2026-10-21",
+      "name": "Pat Sukprasert"
+    },
+    {
+      "date": "2026-10-22",
+      "name": "Serena Ruan"
+    },
+    {
+      "date": "2026-10-23",
+      "name": "Tomu Hirata"
+    },
+    {
+      "date": "2026-10-26",
+      "name": "Zeyi (Rice) Fan"
+    },
+    {
+      "date": "2026-10-27",
+      "name": "Aravind Segu"
+    },
+    {
+      "date": "2026-10-28",
+      "name": "Bryan Qiu"
+    },
+    {
+      "date": "2026-10-29",
+      "name": "Daniel Lok"
+    },
+    {
+      "date": "2026-10-30",
+      "name": "Dhruv Gupta"
     }
   ]
 }

.github/scripts/sync_pr_priority.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""Mirror a linked issue's priority label onto the pull request that closes it.
+
+A PR only inherits a priority when it *closes* an issue via a closing keyword
+(``closes``/``fixes``/``resolves`` #n); a plain "related to #n" mention never
+creates a closing link, so it is ignored. When a PR closes several issues with
+different priorities the highest one wins, and stale priority labels left by an
+earlier run are dropped. Pure stdlib so it runs without an install and the
+label logic is unit-tested directly.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+CANONICAL_REPO = "omnigent-ai/omnigent"
+
+# Priority labels from most to least urgent; the earliest match wins.
+PRIORITY_ORDER = ("P0-critical", "P1-high", "P2-medium", "P3-low")
+PRIORITY_LABELS = frozenset(PRIORITY_ORDER)
+
+_CLOSING_ISSUES_QUERY = """
+query($owner: String!, $name: String!, $number: Int!) {
+  repository(owner: $owner, name: $name) {
+    pullRequest(number: $number) {
+      closingIssuesReferences(first: 50) {
+        nodes {
+          number
+          labels(first: 50) { nodes { name } }
+        }
+      }
+    }
+  }
+}
+"""
+
+
+def desired_priority(closing_issue_labels: list[list[str]]) -> str | None:
+    """Highest-priority label across the issues a PR closes, or None."""
+    present = {label for labels in closing_issue_labels for label in labels}
+    for priority in PRIORITY_ORDER:
+        if priority in present:
+            return priority
+    return None
+
+
+def label_changes(current: list[str], desired: str | None) -> tuple[str | None, list[str]]:
+    """Return the priority to add (if missing) and stale priorities to remove."""
+    current_priorities = [label for label in current if label in PRIORITY_LABELS]
+    to_remove = [label for label in current_priorities if label != desired]
+    to_add = desired if desired is not None and desired not in current_priorities else None
+    return to_add, to_remove
+
+
+class GitHubAPI:
+    def __init__(self, token: str, repo: str) -> None:
+        self.token = token
+        self.repo = repo
+        self.owner, _, self.name = repo.partition("/")
+
+    def _request(self, url: str, body: dict[str, Any] | None, method: str) -> Any:
+        data = None if body is None else json.dumps(body).encode()
+        request = urllib.request.Request(
+            url,
+            data=data,
+            method=method,
+            headers={
+                "Accept": "application/vnd.github+json",
+                "Authorization": f"Bearer {self.token}",
+                "Content-Type": "application/json",
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+        )
+        with urllib.request.urlopen(request, timeout=30) as response:
+            raw = response.read()
+            return json.loads(raw.decode()) if raw else None
+
+    def closing_issue_labels(self, pull_number: int) -> list[list[str]]:
+        payload = {
+            "query": _CLOSING_ISSUES_QUERY,
+            "variables": {"owner": self.owner, "name": self.name, "number": pull_number},
+        }
+        result = self._request("https://api.github.com/graphql", payload, "POST")
+        if result and result.get("errors"):
+            raise RuntimeError(f"GraphQL error: {result['errors']}")
+        # GitHub may return null for data or any intermediate node (e.g. an
+        # unknown PR number), so treat each missing level as empty.
+        data = (result or {}).get("data") or {}
+        repository = data.get("repository") or {}
+        pull_request = repository.get("pullRequest") or {}
+        nodes = (pull_request.get("closingIssuesReferences") or {}).get("nodes") or []
+        return [
+            [label["name"] for label in (node.get("labels") or {}).get("nodes") or []]
+            for node in nodes
+        ]
+
+    def pull_labels(self, pull_number: int) -> list[str]:
+        result = self._request(
+            f"https://api.github.com/repos/{self.repo}/issues/{pull_number}/labels",
+            None,
+            "GET",
+        )
+        return [label["name"] for label in result or []]
+
+    def add_label(self, pull_number: int, label: str) -> None:
+        self._request(
+            f"https://api.github.com/repos/{self.repo}/issues/{pull_number}/labels",
+            {"labels": [label]},
+            "POST",
+        )
+
+    def remove_label(self, pull_number: int, label: str) -> None:
+        quoted = urllib.parse.quote(label, safe="")
+        try:
+            self._request(
+                f"https://api.github.com/repos/{self.repo}/issues/{pull_number}/labels/{quoted}",
+                None,
+                "DELETE",
+            )
+        except urllib.error.HTTPError as error:
+            if error.code != 404:
+                raise
+
+
+def sync_pull(api: GitHubAPI, pull_number: int) -> None:
+    desired = desired_priority(api.closing_issue_labels(pull_number))
+    to_add, to_remove = label_changes(api.pull_labels(pull_number), desired)
+    for label in to_remove:
+        api.remove_label(pull_number, label)
+        print(f"Removed stale priority {label} from #{pull_number}.")
+    if to_add:
+        api.add_label(pull_number, to_add)
+        print(f"Applied {to_add} to #{pull_number} from its closing-linked issue(s).")
+    if not to_add and not to_remove:
+        print(f"#{pull_number} priority already in sync ({desired or 'none'}).")
+
+
+def run(repo: str, pull_number: int, api: GitHubAPI) -> None:
+    if repo != CANONICAL_REPO:
+        print(f"Skipping {repo}; priority sync only runs for {CANONICAL_REPO}.")
+        return
+    sync_pull(api, pull_number)
+
+
+def main() -> int:
+    repo = os.environ.get("GITHUB_REPOSITORY", "")
+    token = os.environ.get("GITHUB_TOKEN")
+    pull_number = os.environ.get("PR_NUMBER")
+    if not token:
+        print("GITHUB_TOKEN is required", file=sys.stderr)
+        return 1
+    if not pull_number:
+        print("PR_NUMBER is required", file=sys.stderr)
+        return 1
+    try:
+        pull_number_int = int(pull_number)
+    except ValueError:
+        print(f"PR_NUMBER must be an integer, got {pull_number!r}", file=sys.stderr)
+        return 1
+    run(repo, pull_number_int, GitHubAPI(token, repo))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/sync_pr_priority_test.py

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""Offline tests for sync_pr_priority.py."""
+
+from __future__ import annotations
+
+import importlib.util
+import pathlib
+import unittest
+
+SCRIPT_PATH = pathlib.Path(__file__).with_name("sync_pr_priority.py")
+SPEC = importlib.util.spec_from_file_location("sync_pr_priority", SCRIPT_PATH)
+sync_pr_priority = importlib.util.module_from_spec(SPEC)
+assert SPEC and SPEC.loader
+SPEC.loader.exec_module(sync_pr_priority)
+
+
+class FakeAPI:
+    def __init__(self, *, closing: list[list[str]], current: list[str]) -> None:
+        self._closing = closing
+        self._current = current
+        self.added: list[tuple[int, str]] = []
+        self.removed: list[tuple[int, str]] = []
+
+    def closing_issue_labels(self, pull_number: int) -> list[list[str]]:
+        assert pull_number
+        return self._closing
+
+    def pull_labels(self, pull_number: int) -> list[str]:
+        assert pull_number
+        return self._current
+
+    def add_label(self, pull_number: int, label: str) -> None:
+        self.added.append((pull_number, label))
+
+    def remove_label(self, pull_number: int, label: str) -> None:
+        self.removed.append((pull_number, label))
+
+
+class DesiredPriorityTest(unittest.TestCase):
+    def test_no_closing_issue_yields_none(self) -> None:
+        self.assertIsNone(sync_pr_priority.desired_priority([]))
+
+    def test_closing_issue_without_priority_yields_none(self) -> None:
+        self.assertIsNone(sync_pr_priority.desired_priority([["Bug", "comp:server"]]))
+
+    def test_single_priority_is_returned(self) -> None:
+        self.assertEqual(sync_pr_priority.desired_priority([["P2-medium"]]), "P2-medium")
+
+    def test_highest_priority_wins_across_issues(self) -> None:
+        self.assertEqual(
+            sync_pr_priority.desired_priority([["P3-low"], ["P1-high"], ["P2-medium"]]),
+            "P1-high",
+        )
+
+    def test_highest_priority_wins_within_one_issue(self) -> None:
+        self.assertEqual(
+            sync_pr_priority.desired_priority([["P0-critical", "P3-low"]]),
+            "P0-critical",
+        )
+
+
+class LabelChangesTest(unittest.TestCase):
+    def test_adds_missing_priority(self) -> None:
+        self.assertEqual(sync_pr_priority.label_changes(["Bug"], "P1-high"), ("P1-high", []))
+
+    def test_noop_when_already_correct(self) -> None:
+        self.assertEqual(sync_pr_priority.label_changes(["P1-high", "Bug"], "P1-high"), (None, []))
+
+    def test_replaces_stale_priority(self) -> None:
+        self.assertEqual(
+            sync_pr_priority.label_changes(["P3-low"], "P1-high"), ("P1-high", ["P3-low"])
+        )
+
+    def test_removes_priority_when_no_longer_desired(self) -> None:
+        self.assertEqual(
+            sync_pr_priority.label_changes(["P2-medium"], None), (None, ["P2-medium"])
+        )
+
+    def test_leaves_non_priority_labels_untouched(self) -> None:
+        self.assertEqual(sync_pr_priority.label_changes(["Bug", "python"], None), (None, []))
+
+
+class SyncPullTest(unittest.TestCase):
+    def test_applies_priority_from_closing_issue(self) -> None:
+        api = FakeAPI(closing=[["P1-high"]], current=["Bug"])
+        sync_pr_priority.sync_pull(api, 7)
+        self.assertEqual(api.added, [(7, "P1-high")])
+        self.assertEqual(api.removed, [])
+
+    def test_swaps_stale_priority(self) -> None:
+        api = FakeAPI(closing=[["P0-critical"]], current=["P2-medium"])
+        sync_pr_priority.sync_pull(api, 7)
+        self.assertEqual(api.added, [(7, "P0-critical")])
+        self.assertEqual(api.removed, [(7, "P2-medium")])
+
+    def test_related_only_pr_gets_nothing(self) -> None:
+        # No closing references -> no priority, and nothing to strip.
+        api = FakeAPI(closing=[], current=["Bug"])
+        sync_pr_priority.sync_pull(api, 7)
+        self.assertEqual(api.added, [])
+        self.assertEqual(api.removed, [])
+
+
+class ClosingIssueLabelsParseTest(unittest.TestCase):
+    """GraphQL response parsing tolerates null nodes and surfaces errors."""
+
+    def _api_returning(self, response: object) -> sync_pr_priority.GitHubAPI:
+        api = sync_pr_priority.GitHubAPI("token", "owner/name")
+
+        def stub_request(*_args: object, **_kwargs: object) -> object:
+            return response
+
+        api._request = stub_request  # type: ignore[method-assign]
+        return api
+
+    def test_parses_labels(self) -> None:
+        response = {
+            "data": {
+                "repository": {
+                    "pullRequest": {
+                        "closingIssuesReferences": {
+                            "nodes": [{"labels": {"nodes": [{"name": "P1-high"}]}}]
+                        }
+                    }
+                }
+            }
+        }
+        self.assertEqual(self._api_returning(response).closing_issue_labels(1), [["P1-high"]])
+
+    def test_null_data_yields_empty(self) -> None:
+        self.assertEqual(self._api_returning({"data": None}).closing_issue_labels(1), [])
+
+    def test_null_pull_request_yields_empty(self) -> None:
+        response = {"data": {"repository": {"pullRequest": None}}}
+        self.assertEqual(self._api_returning(response).closing_issue_labels(1), [])
+
+    def test_errors_raise(self) -> None:
+        response = {"data": None, "errors": [{"message": "boom"}]}
+        with self.assertRaises(RuntimeError):
+            self._api_returning(response).closing_issue_labels(1)
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/waiting_on_author.py

@@ -0,0 +1,318 @@
+#!/usr/bin/env python3
+"""Keep the waiting-on-author pull request label actionable."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import UTC, datetime
+from email.message import Message
+from typing import Any
+
+LABEL = "waiting-on-author"
+WAITING_DAYS = 7
+CANONICAL_REPO = "omnigent-ai/omnigent"
+MAX_CLOSURES_PER_RUN = 30
+
+
+def label_names(item: dict[str, Any]) -> list[str]:
+    return [
+        label.get("name", label) if isinstance(label, dict) else label
+        for label in item.get("labels", [])
+    ]
+
+
+def has_waiting_label(item: dict[str, Any]) -> bool:
+    return LABEL in label_names(item)
+
+
+def parse_time(value: str) -> datetime:
+    return datetime.fromisoformat(value.replace("Z", "+00:00"))
+
+
+def days_between(start: str, end: datetime) -> int:
+    return int((end - parse_time(start)).total_seconds() // 86400)
+
+
+def latest_waiting_label_at(timeline: list[dict[str, Any]]) -> str | None:
+    latest: str | None = None
+    for event in timeline:
+        if event.get("event") != "labeled" or not event.get("created_at"):
+            continue
+        label = event.get("label") or {}
+        name = label.get("name") if isinstance(label, dict) else label
+        if name != LABEL:
+            continue
+        if latest is None or parse_time(event["created_at"]) > parse_time(latest):
+            latest = event["created_at"]
+    return latest
+
+
+def close_message(label_applied_at: str) -> str:
+    return "\n".join(
+        [
+            f"Closing this PR because it has been labeled `{LABEL}` for "
+            f"{WAITING_DAYS} days without an author reply or new commit.",
+            "",
+            f"The label was last applied on {label_applied_at}. If you are "
+            "ready to continue, please reopen this PR or open a new one.",
+        ]
+    )
+
+
+class GitHubAPI:
+    def __init__(self, token: str, repo: str):
+        self.token = token
+        self.repo = repo
+
+    def request(
+        self, method: str, path: str, body: dict[str, Any] | None = None
+    ) -> tuple[Any, Message]:
+        data = None if body is None else json.dumps(body).encode()
+        request = urllib.request.Request(
+            f"https://api.github.com{path}",
+            data=data,
+            method=method,
+            headers={
+                "Accept": "application/vnd.github+json",
+                "Authorization": f"Bearer {self.token}",
+                "Content-Type": "application/json",
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+        )
+        with urllib.request.urlopen(request) as response:
+            raw = response.read()
+            parsed = json.loads(raw.decode()) if raw else None
+            return parsed, response.headers
+
+    def paginated(self, path: str) -> list[dict[str, Any]]:
+        items: list[dict[str, Any]] = []
+        next_path: str | None = path
+        while next_path:
+            page, headers = self.request("GET", next_path)
+            items.extend(page or [])
+            next_path = next_link(headers.get("Link", ""))
+        return items
+
+    def get_pull(self, pull_number: int) -> dict[str, Any]:
+        pull, _ = self.request("GET", f"/repos/{self.repo}/pulls/{pull_number}")
+        return pull
+
+    def remove_label(self, issue_number: int, label: str) -> bool:
+        quoted = urllib.parse.quote(label, safe="")
+        try:
+            self.request("DELETE", f"/repos/{self.repo}/issues/{issue_number}/labels/{quoted}")
+        except urllib.error.HTTPError as error:
+            if error.code == 404:
+                return False
+            raise
+        return True
+
+    def list_waiting_issues(self) -> list[dict[str, Any]]:
+        query = urllib.parse.urlencode({"state": "open", "labels": LABEL, "per_page": 100})
+        return self.paginated(f"/repos/{self.repo}/issues?{query}")
+
+    def list_timeline(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/issues/{issue_number}/timeline?per_page=100")
+
+    def list_issue_comments(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/issues/{issue_number}/comments?per_page=100")
+
+    def list_review_comments(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/pulls/{pull_number}/comments?per_page=100")
+
+    def list_reviews(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/pulls/{pull_number}/reviews?per_page=100")
+
+    def list_commits(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/pulls/{pull_number}/commits?per_page=100")
+
+    def close_pull(self, pull_number: int) -> None:
+        self.request("PATCH", f"/repos/{self.repo}/pulls/{pull_number}", {"state": "closed"})
+
+    def create_comment(self, issue_number: int, body: str) -> None:
+        self.request("POST", f"/repos/{self.repo}/issues/{issue_number}/comments", {"body": body})
+
+
+def next_link(link_header: str) -> str | None:
+    for part in link_header.split(","):
+        url_part, _, rel_part = part.partition(";")
+        if 'rel="next"' not in rel_part:
+            continue
+        url = url_part.strip()[1:-1]
+        parsed = urllib.parse.urlparse(url)
+        return f"{parsed.path}?{parsed.query}"
+    return None
+
+
+def remove_waiting_label(api: GitHubAPI, issue_number: int, reason: str) -> bool:
+    removed = api.remove_label(issue_number, LABEL)
+    if removed:
+        print(f"Removed {LABEL} from #{issue_number}: {reason}")
+    else:
+        print(f"#{issue_number} no longer has {LABEL}; nothing to remove.")
+    return removed
+
+
+def user_login(item: dict[str, Any]) -> str | None:
+    login = item.get("user", {}).get("login")
+    return login.lower() if login else None
+
+
+def is_after(timestamp: str | None, since: str) -> bool:
+    return bool(timestamp and parse_time(timestamp) > parse_time(since))
+
+
+def authored_after(items: list[dict[str, Any]], author: str, since: str, key: str) -> bool:
+    return any(user_login(item) == author and is_after(item.get(key), since) for item in items)
+
+
+def commit_after(commits: list[dict[str, Any]], since: str) -> bool:
+    for commit in commits:
+        authored_at = commit.get("commit", {}).get("author", {}).get("date")
+        committed_at = commit.get("commit", {}).get("committer", {}).get("date")
+        if is_after(authored_at, since) or is_after(committed_at, since):
+            return True
+    return False
+
+
+def author_activity_since_label(api: GitHubAPI, pull: dict[str, Any], since: str) -> str | None:
+    author = pull.get("user", {}).get("login")
+    if not author:
+        return None
+    author = author.lower()
+    pull_number = pull["number"]
+
+    if authored_after(api.list_issue_comments(pull_number), author, since, "created_at"):
+        return "the author commented"
+    if authored_after(api.list_review_comments(pull_number), author, since, "created_at"):
+        return "the author replied to a review comment"
+    if authored_after(api.list_reviews(pull_number), author, since, "submitted_at"):
+        return "the author submitted a review response"
+    if commit_after(api.list_commits(pull_number), since):
+        return "new commits were pushed"
+    return None
+
+
+def clear_on_author_activity(event_name: str, payload: dict[str, Any], api: GitHubAPI) -> bool:
+    pull_number: int | None = None
+    actor: str | None = None
+    reason: str | None = None
+    author_activity = False
+
+    if event_name in {"pull_request", "pull_request_target"} and payload.get("pull_request"):
+        if payload.get("action") != "synchronize":
+            return False
+        pull_number = payload["pull_request"]["number"]
+        reason = "new commits were pushed"
+        author_activity = True
+    elif event_name == "issue_comment" and "pull_request" in payload.get("issue", {}):
+        pull_number = payload["issue"]["number"]
+        actor = payload.get("comment", {}).get("user", {}).get("login")
+        reason = "the author commented"
+    elif event_name == "pull_request_review_comment" and payload.get("pull_request"):
+        pull_number = payload["pull_request"]["number"]
+        actor = payload.get("comment", {}).get("user", {}).get("login")
+        reason = "the author replied to a review comment"
+    elif event_name == "pull_request_review" and payload.get("pull_request"):
+        pull_number = payload["pull_request"]["number"]
+        actor = payload.get("review", {}).get("user", {}).get("login")
+        reason = "the author submitted a review response"
+    else:
+        return False
+
+    if pull_number is None or reason is None:
+        return False
+    pull = api.get_pull(pull_number)
+    if pull.get("state") != "open" or not has_waiting_label(pull):
+        return False
+
+    if not author_activity:
+        author = pull.get("user", {}).get("login")
+        author_activity = bool(actor and author and actor.lower() == author.lower())
+
+    if not author_activity:
+        return False
+    return remove_waiting_label(api, pull_number, reason)
+
+
+def close_stale_waiting_prs(api: GitHubAPI, now: datetime | None = None) -> int:
+    now = now or datetime.now(UTC)
+    closed = 0
+    for issue in api.list_waiting_issues():
+        if closed >= MAX_CLOSURES_PER_RUN:
+            break
+        if "pull_request" not in issue or not has_waiting_label(issue):
+            continue
+
+        try:
+            label_applied_at = latest_waiting_label_at(api.list_timeline(issue["number"]))
+            if label_applied_at is None:
+                print(
+                    f"::warning::#{issue['number']} has {LABEL} but no label timestamp "
+                    "in the timeline; skipping."
+                )
+                continue
+
+            pull = api.get_pull(issue["number"])
+            reason = author_activity_since_label(api, pull, label_applied_at)
+            if reason:
+                remove_waiting_label(api, issue["number"], reason)
+                continue
+
+            if days_between(label_applied_at, now) < WAITING_DAYS:
+                continue
+
+            api.close_pull(issue["number"])
+            api.create_comment(issue["number"], close_message(label_applied_at))
+            closed += 1
+            print(f"Closed #{issue['number']}; {LABEL} was applied at {label_applied_at}.")
+        except Exception as error:  # noqa: BLE001 - keep the sweep moving across PRs.
+            print(f"::warning::Could not close #{issue['number']}: {error}")
+    print(f"Closed {closed} PR(s) labeled {LABEL}.")
+    return closed
+
+
+def run(
+    event_name: str,
+    payload: dict[str, Any],
+    api: GitHubAPI,
+    repo: str,
+    now: datetime | None = None,
+) -> None:
+    if repo != CANONICAL_REPO:
+        print(f"Skipping {repo}; waiting-on-author hygiene only runs for {CANONICAL_REPO}.")
+        return
+
+    if event_name in {"schedule", "workflow_dispatch"}:
+        close_stale_waiting_prs(api, now=now)
+        return
+
+    clear_on_author_activity(event_name, payload, api)
+
+
+def load_event_payload() -> dict[str, Any]:
+    path = os.environ.get("GITHUB_EVENT_PATH")
+    if not path:
+        return {}
+    with open(path, encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+def main() -> int:
+    repo = os.environ.get("GITHUB_REPOSITORY", "")
+    token = os.environ.get("GITHUB_TOKEN")
+    if not token:
+        print("GITHUB_TOKEN is required", file=sys.stderr)
+        return 1
+    event_name = os.environ.get("GITHUB_EVENT_NAME", "")
+    run(event_name, load_event_payload(), GitHubAPI(token, repo), repo)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/waiting_on_author_test.py

@@ -0,0 +1,235 @@
+#!/usr/bin/env python3
+"""Offline tests for waiting_on_author.py."""
+
+from __future__ import annotations
+
+import importlib.util
+import pathlib
+import unittest
+from datetime import UTC, datetime
+from typing import Any
+
+SCRIPT_PATH = pathlib.Path(__file__).with_name("waiting_on_author.py")
+SPEC = importlib.util.spec_from_file_location("waiting_on_author", SCRIPT_PATH)
+waiting_on_author = importlib.util.module_from_spec(SPEC)
+assert SPEC and SPEC.loader
+SPEC.loader.exec_module(waiting_on_author)
+
+
+def pr(
+    number: int = 12, author: str = "alice", labels: list[str] | None = None, state: str = "open"
+) -> dict[str, Any]:
+    labels = [waiting_on_author.LABEL] if labels is None else labels
+    return {
+        "number": number,
+        "state": state,
+        "user": {"login": author},
+        "labels": [{"name": label} for label in labels],
+    }
+
+
+def issue(number: int, labels: list[str] | None = None, is_pr: bool = True) -> dict[str, Any]:
+    labels = [waiting_on_author.LABEL] if labels is None else labels
+    item: dict[str, Any] = {"number": number, "labels": [{"name": label} for label in labels]}
+    if is_pr:
+        item["pull_request"] = {}
+    return item
+
+
+def labeled_at(iso: str, label: str | None = None) -> dict[str, Any]:
+    return {
+        "event": "labeled",
+        "label": {"name": label or waiting_on_author.LABEL},
+        "created_at": iso,
+    }
+
+
+class FakeAPI:
+    def __init__(
+        self,
+        *,
+        pull: dict[str, Any] | None = None,
+        issues: list[dict[str, Any]] | None = None,
+        timeline_by_issue: dict[int, list[dict[str, Any]]] | None = None,
+        issue_comments: dict[int, list[dict[str, Any]]] | None = None,
+        review_comments: dict[int, list[dict[str, Any]]] | None = None,
+        reviews: dict[int, list[dict[str, Any]]] | None = None,
+        commits: dict[int, list[dict[str, Any]]] | None = None,
+    ):
+        self.pull = pull or pr()
+        self.issues = issues or []
+        self.timeline_by_issue = timeline_by_issue or {}
+        self.issue_comments = issue_comments or {}
+        self.review_comments = review_comments or {}
+        self.reviews = reviews or {}
+        self.commits = commits or {}
+        self.removed: list[tuple[int, str]] = []
+        self.closed: list[int] = []
+        self.comments: list[tuple[int, str]] = []
+
+    def get_pull(self, pull_number: int) -> dict[str, Any]:
+        return self.pull | {"number": pull_number}
+
+    def remove_label(self, issue_number: int, label: str) -> bool:
+        self.removed.append((issue_number, label))
+        return True
+
+    def list_waiting_issues(self) -> list[dict[str, Any]]:
+        return self.issues
+
+    def list_timeline(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.timeline_by_issue.get(issue_number, [])
+
+    def list_issue_comments(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.issue_comments.get(issue_number, [])
+
+    def list_review_comments(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.review_comments.get(pull_number, [])
+
+    def list_reviews(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.reviews.get(pull_number, [])
+
+    def list_commits(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.commits.get(pull_number, [])
+
+    def close_pull(self, pull_number: int) -> None:
+        self.closed.append(pull_number)
+
+    def create_comment(self, issue_number: int, body: str) -> None:
+        self.comments.append((issue_number, body))
+
+
+class WaitingOnAuthorTest(unittest.TestCase):
+    def test_latest_waiting_label_at_uses_latest_matching_label(self) -> None:
+        self.assertEqual(
+            waiting_on_author.latest_waiting_label_at(
+                [
+                    labeled_at("2026-07-01T00:00:00Z"),
+                    labeled_at("2026-07-10T00:00:00Z", "other"),
+                    labeled_at("2026-07-12T00:00:00Z"),
+                ]
+            ),
+            "2026-07-12T00:00:00Z",
+        )
+
+    def test_author_issue_comment_removes_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="Alice"))
+        waiting_on_author.clear_on_author_activity(
+            "issue_comment",
+            {"issue": {"number": 12, "pull_request": {}}, "comment": {"user": {"login": "alice"}}},
+            api,
+        )
+        self.assertEqual(api.removed, [(12, waiting_on_author.LABEL)])
+
+    def test_author_review_thread_reply_removes_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="alice"))
+        waiting_on_author.clear_on_author_activity(
+            "pull_request_review_comment",
+            {"pull_request": {"number": 12}, "comment": {"user": {"login": "alice"}}},
+            api,
+        )
+        self.assertEqual(api.removed, [(12, waiting_on_author.LABEL)])
+
+    def test_maintainer_comment_keeps_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="alice"))
+        waiting_on_author.clear_on_author_activity(
+            "issue_comment",
+            {
+                "issue": {"number": 12, "pull_request": {}},
+                "comment": {"user": {"login": "maintainer"}},
+            },
+            api,
+        )
+        self.assertEqual(api.removed, [])
+
+    def test_new_commits_remove_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="alice"))
+        waiting_on_author.clear_on_author_activity(
+            "pull_request_target",
+            {"action": "synchronize", "pull_request": {"number": 12}},
+            api,
+        )
+        self.assertEqual(api.removed, [(12, waiting_on_author.LABEL)])
+
+    def test_scheduled_sweep_closes_pr_after_7_days(self) -> None:
+        api = FakeAPI(
+            issues=[issue(20)], timeline_by_issue={20: [labeled_at("2026-07-17T00:00:00Z")]}
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.closed, [20])
+        self.assertEqual(len(api.comments), 1)
+        self.assertIn(waiting_on_author.LABEL, api.comments[0][1])
+
+    def test_scheduled_sweep_removes_label_after_author_comment(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=23, author="alice"),
+            issues=[issue(23)],
+            timeline_by_issue={23: [labeled_at("2026-07-01T00:00:00Z")]},
+            issue_comments={
+                23: [{"user": {"login": "alice"}, "created_at": "2026-07-20T00:00:00Z"}]
+            },
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [(23, waiting_on_author.LABEL)])
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_keeps_label_after_maintainer_comment(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=24, author="alice"),
+            issues=[issue(24)],
+            timeline_by_issue={24: [labeled_at("2026-07-18T00:00:00Z")]},
+            issue_comments={
+                24: [{"user": {"login": "maintainer"}, "created_at": "2026-07-20T00:00:00Z"}]
+            },
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [])
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_removes_label_after_new_commit(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=25, author="alice"),
+            issues=[issue(25)],
+            timeline_by_issue={25: [labeled_at("2026-07-01T00:00:00Z")]},
+            commits={25: [{"commit": {"author": {"date": "2026-07-20T00:00:00Z"}}}]},
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [(25, waiting_on_author.LABEL)])
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_ignores_author_comment_before_label(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=26, author="alice"),
+            issues=[issue(26)],
+            timeline_by_issue={26: [labeled_at("2026-07-17T00:00:00Z")]},
+            issue_comments={
+                26: [{"user": {"login": "alice"}, "created_at": "2026-07-10T00:00:00Z"}]
+            },
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [])
+        self.assertEqual(api.closed, [26])
+
+    def test_scheduled_sweep_leaves_6_day_pr_open(self) -> None:
+        api = FakeAPI(
+            issues=[issue(21)], timeline_by_issue={21: [labeled_at("2026-07-18T00:00:00Z")]}
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.closed, [])
+        self.assertEqual(api.comments, [])
+
+    def test_scheduled_sweep_skips_missing_label_timestamp(self) -> None:
+        api = FakeAPI(issues=[issue(22)], timeline_by_issue={22: []})
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_caps_closures_per_run(self) -> None:
+        issues = [issue(100 + idx) for idx in range(waiting_on_author.MAX_CLOSURES_PER_RUN + 3)]
+        timeline = {item["number"]: [labeled_at("2026-07-01T00:00:00Z")] for item in issues}
+        api = FakeAPI(issues=issues, timeline_by_issue=timeline)
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(len(api.closed), waiting_on_author.MAX_CLOSURES_PER_RUN)
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/triage/config.yaml

@@ -31,7 +31,7 @@ prompt: |
 
   ```
   {
-    "type": "bug" | "enhancement" | "documentation" | null,
+    "type": "bug" | "Feature" | "Docs" | null,
     "components": ["comp:server" | "comp:runner" | "comp:repr" | "comp:web-ui" | "comp:tui" | "comp:policies" | "comp:harnesses" | "comp:infra"],
     "priority": "P0-critical" | "P1-high" | "P2-medium" | "P3-low" | null,
     "needs_info": true | false,
@@ -49,9 +49,9 @@ prompt: |
   repro steps for a bug). When `true`, leave type/component/priority as
   `null`.
 
-  **type** — the issue templates add `bug` or `enhancement` labels
+  **type** — the issue templates add `bug` or `Feature` labels
   automatically; if the existing labels already include one, set the
-  matching type. Otherwise determine from content. Use `documentation`
+  matching type. Otherwise determine from content. Use `Docs`
   for docs-only issues.
 
   **components** — list of affected subsystems (one or more):

.github/workflows/auto-assign-reviewer.yml

@@ -83,11 +83,16 @@ jobs:
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          ROUTER_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
         run: |
           if [ -z "${LLM_API_KEY:-}" ] || [ -z "${GATEWAY_BASE_URL:-}" ]; then
             echo "::notice::No LLM credentials; reviewer ranking skipped (load-balanced fallback)."
             exit 0
           fi
+          if [ -z "${ROUTER_MODEL:-}" ]; then
+            echo "::warning::Repository variable OMNIGENT_CI_FAST_ANTHROPIC_MODEL is empty; reviewer ranking skipped (load-balanced fallback)."
+            exit 0
+          fi
           # Skip maintainer-authored PRs: the assign step (auto-assign-reviewer.js)
           # no-ops on them, so ranking them would spend a gateway call whose result
           # is discarded. Mirror that step's author-is-maintainer guard here
@@ -141,7 +146,7 @@ jobs:
           # /anthropic/messages + x-api-key path 401s / 400s on this gateway.)
           url = os.environ["GATEWAY_BASE_URL"].rstrip("/") + "/chat/completions"
           payload = json.dumps({
-              "model": "databricks-claude-sonnet-4-6",
+              "model": os.environ["ROUTER_MODEL"],
               "max_tokens": 512,
               "temperature": 0,
               "messages": [

.github/workflows/benchmark-pr.yml

@@ -158,12 +158,20 @@ jobs:
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          gh pr comment "${{ github.event.pull_request.number }}" \
-            --edit-last \
-            --body-file comment_body.md || \
-          gh pr comment "${{ github.event.pull_request.number }}" \
-            --body-file comment_body.md
+          COMMENT_MARKER="<!-- benchmark-pr-comment -->"
+          COMMENT_ID=$(gh api --paginate \
+            "repos/${REPO}/issues/${PR_NUMBER}/comments" \
+            --jq ".[] | select(.body | startswith(\"$COMMENT_MARKER\")) | .id" \
+            | head -1)
+          if [ -n "$COMMENT_ID" ]; then
+            gh api "repos/${REPO}/issues/comments/${COMMENT_ID}" \
+              -X PATCH -f body="$(cat comment_body.md)"
+          else
+            gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file comment_body.md
+          fi
 
       - name: Upload candidate results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/bump-version.yml

@@ -84,7 +84,12 @@ jobs:
             python scripts/update_versions.py "$MODE" --new-version "$NEW_VERSION"
 
       - name: Regenerate lockfile
-        run: uv lock
+        run: |
+          uv lock
+          # uv may emit non-canonical lockfile fields (e.g. size on file
+          # entries); normalize like the pre-commit fixer, then hard-verify.
+          python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+          python3 scripts/normalize_uv_lock_registry.py --check uv.lock
 
       - name: Verify all locations agree
         run: uv run --no-project --python 3.12 --with packaging python scripts/update_versions.py check
@@ -139,6 +144,6 @@ jobs:
             --title "Bump version to ${resolved}" \
             --body "Automated version bump via \`.github/workflows/bump-version.yml\` (mode: \`${MODE}\`, input: \`${NEW_VERSION}\`).
 
-          Rewrote \`[project].version\` and sibling \`==\` pins across all three packages (\`pyproject.toml\`, \`sdks/python-client\`, \`sdks/ui\`), the runtime \`VERSION\` constant in \`omnigent/version.py\`, and regenerated \`uv.lock\`.
+          Rewrote \`[project].version\` and sibling \`==\` pins across all four packages (\`pyproject.toml\`, \`sdks/python-client\`, \`sdks/ui\`, \`integrations/slack\`), the runtime \`VERSION\` constant in \`omnigent/version.py\`, and regenerated \`uv.lock\`.
 
           Generated by \`scripts/update_versions.py\`. Opened via the omnigent-ci App when configured (CI runs automatically); on the GITHUB_TOKEN fallback, re-open or push to kick CI."

.github/workflows/ci.yml

@@ -370,14 +370,14 @@ jobs:
           path: .tmp-codex-parity-target/debug/codex-parity-sidecar
           key: codex-parity-bin-${{ runner.os }}-${{ steps.rustc.outputs.version }}-${{ hashFiles('tests/codex_parity/sidecar/**') }}
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-        with:
-          node-version: 20
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install codex CLI
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm install --ignore-scripts --prefix .github/ci-deps
+          pnpm install --frozen-lockfile --ignore-scripts --filter e2e-ci-deps
           echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Cache virtualenv

.github/workflows/discord-watch-rotation-maintain.yml

@@ -3,9 +3,11 @@ name: Discord watch rotation - maintain schedule
 # Monthly housekeeping for rotation_schedule.json: prune elapsed dates and
 # extend the horizon ~3 months out. Opens a PR rather than pushing to main, so
 # the change is reviewable and no write to a protected branch is needed.
+# Schedule paused: runs only on manual dispatch for now.
+# To resume, restore the `schedule:` block below.
+#   schedule:
+#     - cron: "0 8 1 * *" # 08:00 UTC on the 1st of each month
 on:
-  schedule:
-    - cron: "0 8 1 * *" # 08:00 UTC on the 1st of each month
   workflow_dispatch: {} # manual "Run workflow" button
 
 # Needs to push a branch and open a PR; no other write scope.

.github/workflows/discord-watch-rotation.yml

@@ -1,13 +1,14 @@
 name: Discord watch rotation
 
-# Wakes up only at the UTC times that are ~08:00 in an assignee's timezone.
+# Schedule paused: the rotation ping only runs on manual dispatch for now.
+# To resume, restore the `schedule:` block below.
+#   schedule:
+#     - cron: "0 0 * * *" # 08:00 Asia/Singapore (UTC+8, no daylight saving)
+#     - cron: "0 15 * * *" # 08:00 SF in summer (PDT); 07:00 in winter (PST)
 # Note: a single fixed UTC time can't track San Francisco's daylight saving,
 # so the SF ping lands at 08:00 in summer (PDT) and 07:00 in winter (PST).
 on:
-  schedule:
-    - cron: "0 0 * * *" # 08:00 Asia/Singapore (UTC+8, no daylight saving)
-    - cron: "0 15 * * *" # 08:00 SF in summer (PDT); 07:00 in winter (PST)
-  workflow_dispatch: {} # manual "Run workflow" button for testing
+  workflow_dispatch: {} # manual "Run workflow" button
 
 # Only needs to check out the repo; nothing is written back.
 permissions:

.github/workflows/doc-sync.yml

@@ -254,16 +254,22 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Write Omnigent provider config
         if: steps.plan.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_AGENT_MODEL: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
         run: |
+          : "${OMNIGENT_AGENT_MODEL:?Set OMNIGENT_CI_ANTHROPIC_MODEL}"
           mkdir -p "$HOME/.omnigent"
           python3 -c "
           import pathlib, os, json
@@ -273,7 +279,7 @@ jobs:
               'anthropic': {
                   'base_url': gw + '/anthropic',
                   'api_key_ref': 'env:LLM_API_KEY',
-                  'models': {'default': 'databricks-claude-opus-4-8'},
+                  'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
               }}}}
           pathlib.Path.home().joinpath('.omnigent', 'config.yaml').write_text(json.dumps(cfg, indent=2))
           "

.github/workflows/docker-build.yml

@@ -31,7 +31,8 @@ on:
       - 'pyproject.toml'
       - 'setup.py'
       - 'uv.lock'
-      - 'web/package-lock.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
       - '.github/workflows/docker-build.yml'
 
 permissions:

.github/workflows/draft-release-notes.yml

@@ -89,14 +89,14 @@ jobs:
           base="${INPUT_BASE:-}"
           proceed=false; dry_run=false
 
-          # Does the tag look like a final release (vX.Y.Z, not rc/dev/alpha/beta)?
+          # Does the tag look like a final release (vX.Y.Z, not a pre-release)?
           is_version=true
           case "$tag" in
             v[0-9]*.[0-9]*.[0-9]*) ;;
             *) is_version=false ;;
           esac
           case "$tag" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_version=false ;;
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*) is_version=false ;;
           esac
 
           if [ "$EVENT_NAME" = "workflow_run" ]; then
@@ -245,6 +245,7 @@ jobs:
           stderr-file: /tmp/draft-stderr.log
           gateway-base-url: ${{ secrets.GATEWAY_BASE_URL }}
           llm-api-key: ${{ secrets.LLM_API_KEY }}
+          model: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
 
       - name: Extract synthesized notes (fall back to mechanical)
         if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'

.github/workflows/e2e-ui-required.yml

@@ -71,5 +71,7 @@ jobs:
           # OpenAI-compatible gateway (same secrets the e2e suites use).
           OPENAI_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
           OPENAI_API_KEY: ${{ secrets.LLM_API_KEY }}
-          E2E_UI_JUDGE_MODEL: databricks-gpt-5-4
-        run: bash .github/scripts/e2e-ui-required/check.sh
+          E2E_UI_JUDGE_MODEL: ${{ vars.OMNIGENT_CI_E2E_JUDGE_MODEL }}
+        run: |
+          : "${E2E_UI_JUDGE_MODEL:?Set OMNIGENT_CI_E2E_JUDGE_MODEL repository variable}"
+          bash .github/scripts/e2e-ui-required/check.sh

.github/workflows/e2e-ui.yml

@@ -168,8 +168,8 @@ jobs:
         with:
           python-version-file: ".python-version"
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -225,14 +225,11 @@ jobs:
       - name: Build web SPA
         # Build BEFORE pytest: Vite's emptyOutDir clobbers the static dir,
         # so never run it under xdist or alongside the live server.
-        # --legacy-peer-deps avoids re-resolving the known React 19 peer
-        # conflict under @emoji-mart/react.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       # Native coding-agent harness enablement: the next steps let the
       # native render-parity tests boot a real Claude Code / Codex CLI. The
@@ -241,15 +238,17 @@ jobs:
         # claude-code 2.1.170, NOT the 2.1.124 in .github/ci-deps: 2.1.124
         # doesn't recognise the hook events the native bridge configures and
         # shows a blocking startup modal that swallows the first message.
-        # --ignore-scripts then run install.cjs explicitly (audited: platform
-        # detect + same-tree hardlink, no network/exec) and put its bin on PATH.
+        # Runs the package's install script so the platform-specific binary is
+        # linked into the temporary CLI directory and put on PATH.
+        # (The install.cjs script was removed in the same version the upstream
+        # npm package no longer ships it, so lifecycle scripts are required.)
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
-          node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Install Codex CLI
         # @openai/codex at the .github/ci-deps pin (same build as e2e.yml's
@@ -259,9 +258,10 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
+          CODEX_CLI_DIR="${RUNNER_TEMP}/omnigent-codex-cli"
+          mkdir -p "$CODEX_CLI_DIR" && cd "$CODEX_CLI_DIR"
           npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
-          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CODEX_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Run UI e2e tests
         # --ui-skip-build: the SPA was built in the previous step.

.github/workflows/electron-build.yml

@@ -55,48 +55,27 @@ jobs:
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
 
-      - name: Set up Node
-        uses: ./.github/actions/setup-node
-        with:
-          # Node 22.x per web/electron/README.md ("Prerequisites").
-          node-version: "22"
-          cache-dependency-path: web/electron/package-lock.json
-
-      - name: Verify lockfile uses public registry
-        # Fail fast (in seconds, not minutes) if any package-lock.json
-        # resolved URL points at an internal proxy that public CI runners
-        # can't reach — e.g. npm-proxy.cloud.databricks.com. Without this
-        # guard, npm ci silently times out mid-install on Windows/Linux.
-        # Uses the shared normalize_package_lock_registry.py script (same
-        # one wired into pre-commit) so CI and local checks stay in sync.
-        working-directory: web/electron
-        shell: bash
-        run: |
-          python3 ../../scripts/normalize_package_lock_registry.py --check package-lock.json
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install dependencies
-        working-directory: web/electron
-        run: npm ci --no-audit --no-fund
-
-      # The shell-owned update overlay reuses the web UpdateBanner component; it
-      # is built from the web app into electron/overlay/ (gitignored) and shipped
-      # by electron-builder (build.files). The build:<platform> scripts run it
-      # automatically via their `prebuild:*` hook (see web/electron/package.json)
-      # — this step only needs to install the web app's deps so that hook works.
-      - name: Install web deps (for the update overlay build)
-        working-directory: web
-        run: npm ci --legacy-peer-deps --no-audit --no-fund
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
+        run: |-
+          pnpm install --frozen-lockfile --filter @omnigent/electron
+          pnpm install --frozen-lockfile --filter web
 
       - name: Build ${{ matrix.platform }} app
         working-directory: web/electron
         env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
           # No signing credentials in CI: force an unsigned build instead of
           # letting electron-builder fail hunting for a certificate.
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
           # electron-builder downloads Electron/tooling from GitHub; the token
           # lifts the anonymous rate limit that otherwise flakes downloads.
           GH_TOKEN: ${{ github.token }}
-        run: npm run ${{ matrix.build-script }} -- --publish never
+        run: pnpm run ${{ matrix.build-script }} -- --publish never
 
       # One artifact per platform bundling the COMPLETE electron-updater feed —
       # the installer(s), the .blockmap electron-updater needs for differential

.github/workflows/feature-blog.yml

@@ -242,6 +242,7 @@ jobs:
           stderr-file: ${{ github.workspace }}/scout-stderr.log
           gateway-base-url: ${{ secrets.GATEWAY_BASE_URL }}
           llm-api-key: ${{ secrets.LLM_API_KEY }}
+          model: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
 
       - name: Parse candidates
         id: candidates
@@ -360,7 +361,7 @@ jobs:
             # markdown code fences aren't shell-evaluated — index and repo come in
             # via env (CAND_INDEX / SOURCE_REPO), never interpolated into the body.
             CAND_INDEX="$i" python3 -u <<'PYEOF'
-          import json, os, pathlib, subprocess
+          import json, os, pathlib, re, subprocess
           repo = os.environ["SOURCE_REPO"]
           idx = int(os.environ["CAND_INDEX"])
           cand = json.load(open("/tmp/candidates.json"))[idx]
@@ -381,6 +382,21 @@ jobs:
           mergers, authors = Counter(), Counter()
           def _usable(login):
               return bool(login) and not login.endswith("[bot]") and login != "omnigent-ci"
+          # Detect a demo VIDEO already attached to a PR body so the reviewer can
+          # reuse it instead of re-recording. GitHub renders uploaded videos as bare
+          # asset links (user-attachments/assets or the older <owner>/<repo>/assets),
+          # and video files by extension. Images (user-images.githubusercontent /
+          # ![](...) / .png|.jpg) are NOT counted — the marker asks for a recording.
+          video_re = re.compile(
+              r"https?://github\.com/user-attachments/assets/[0-9a-f-]+"
+              r"|https?://github\.com/[^/\s)]+/[^/\s)]+/assets/\d+/[0-9a-f-]+"
+              r"|https?://[^\s)]+\.(?:mp4|mov|webm|m4v)\b"
+              r"|<video\b",
+              re.IGNORECASE)
+          def _title_cell(t):
+              # Keep the table one row per PR: collapse newlines and pipe chars.
+              return (t or "").replace("|", "\\|").replace("\n", " ").strip()
+          rows = []  # (number, title, url, has_video) for the reviewer table
           for pr in refs:
               try:
                   diff = subprocess.run(
@@ -389,10 +405,11 @@ jobs:
               except Exception as e:
                   diff = f"(diff unavailable: {e})"
               parts += [f"### PR #{pr}", f"{fence}diff", diff[:BUDGET], fence]
+              title, url, has_video = "", f"https://github.com/{repo}/pull/{pr}", False
               try:
                   meta = json.loads(subprocess.run(
                       ["gh", "pr", "view", str(pr), "--repo", repo,
-                       "--json", "mergedBy,author"],
+                       "--json", "title,body,url,mergedBy,author"],
                       capture_output=True, text=True, timeout=60).stdout or "{}")
                   mb = (meta.get("mergedBy") or {}).get("login", "")
                   au = (meta.get("author") or {}).get("login", "")
@@ -400,9 +417,21 @@ jobs:
                       mergers[mb] += 1
                   if _usable(au):
                       authors[au] += 1
+                  title = _title_cell(meta.get("title", ""))
+                  url = meta.get("url") or url
+                  has_video = bool(video_re.search(meta.get("body") or ""))
               except Exception as e:
-                  print(f"::notice::Could not read merger/author for PR #{pr}: {e}")
+                  print(f"::notice::Could not read metadata for PR #{pr}: {e}")
+              rows.append((pr, title, url, has_video))
           pathlib.Path(f"/tmp/material_{idx}.txt").write_text("\n".join(parts))
+          # Reviewer reference table: which contributing PRs already ship a demo
+          # video (✅, linked) vs. still need one (—). Written even when none have a
+          # video, so the reviewer always sees the source PRs behind the marker.
+          table = ["| PR | Title | Demo video? |", "| --- | --- | --- |"]
+          for pr, title, url, has_video in rows:
+              cell = f"[✅ video]({url})" if has_video else "—"
+              table.append(f"| [#{pr}]({url}) | {title} | {cell} |")
+          pathlib.Path(f"/tmp/demo_table_{idx}.md").write_text("\n".join(table))
           # Most-frequent merger wins; ties broken by Counter insertion order (PR
           # order). Fall back to the most-frequent author, then empty.
           reviewer = (mergers.most_common(1)[0][0] if mergers
@@ -499,6 +528,7 @@ jobs:
               # env), so the unsandboxed drafter run above never sees it and it
               # can't reach the drafter's scanned stdout.
               GATEWAY_BASE_URL='${{ secrets.GATEWAY_BASE_URL }}' \
+              IMAGE_MODEL='${{ vars.OMNIGENT_CI_IMAGE_MODEL }}' \
               IMAGE_PROMPT="$image_prompt" SLUG="$slug" SITE="$SITE" POST="$post" \
               python3 -u <<'PYEOF' || echo "::warning::hero image generation failed for ${slug}; leaving heroArt blank"
           import base64, json, os, pathlib, re, urllib.request
@@ -511,7 +541,9 @@ jobs:
           m = re.match(r"(https?://[^/]+)", gw)
           if not m:
               raise SystemExit(f"cannot parse gateway host from {gw!r}")
-          model = os.environ.get("IMAGE_MODEL", "databricks-gemini-3-pro-image")
+          model = os.environ.get("IMAGE_MODEL", "").strip()
+          if not model:
+              raise SystemExit("repository variable OMNIGENT_CI_IMAGE_MODEL is empty")
           url = f"{m.group(1)}/serving-endpoints/{model}/invocations"
           style = (" Flat vector illustration, dark navy tech background with subtle "
                    "circuit lines, teal and pink accents, 16:9 wide, no text, no words, "
@@ -660,7 +692,16 @@ jobs:
             # the source-repo maintainer isn't an omnigent-site collaborator), so
             # it must be written on BOTH the create and force-push-update paths.
             summary="$(sed -n '/<!-- BLOG_DRAFT_SUMMARY -->/,$p' "/tmp/drafter_out_${idx}.txt" | tail -n +2 || true)"
-            body="$(printf 'Drafts a feature-blog post for **%s**, selected by `feature-blog-scout` at the %s release cut.\n\n> **This is a DRAFT.** Before merging, a human must: record the mandatory demo (replace the `DEMO REQUIRED` marker) and do a final voice pass. The hero image and `author: omnigent` byline are auto-generated — review and optionally replace them.\n\n%s\n\nSource release: %s%s\n<sub>Generated by omnigent `.github/workflows/feature-blog.yml`. Review for accuracy before merging.</sub>' "$title" "$TAG" "$summary" "$TAG" "$mention")"
+
+            # Reference table of the contributing PRs and whether each already
+            # ships a demo video (built in the Draft posts step). Reviewers can pull
+            # an existing recording from a ✅ PR to replace the `DEMO REQUIRED`
+            # marker instead of re-recording. Omitted if the table wasn't produced.
+            demo_table=""
+            if [ -f "/tmp/demo_table_${idx}.md" ]; then
+              demo_table="$(printf '\n\n### Source PRs — demo videos\nCheck a ✅ PR for a recording you can drop into the `DEMO REQUIRED` marker.\n\n%s\n' "$(cat "/tmp/demo_table_${idx}.md")")"
+            fi
+            body="$(printf 'Drafts a feature-blog post for **%s**, selected by `feature-blog-scout` at the %s release cut.\n\n> **This is a DRAFT.** Before merging, a human must: record the mandatory demo (replace the `DEMO REQUIRED` marker) and do a final voice pass. The hero image and `author: omnigent` byline are auto-generated — review and optionally replace them.\n\n%s%s\n\nSource release: %s%s\n<sub>Generated by omnigent `.github/workflows/feature-blog.yml`. Review for accuracy before merging.</sub>' "$title" "$TAG" "$summary" "$demo_table" "$TAG" "$mention")"
 
             existing="$(gh pr list --repo "$SITE_REPO" --head "$branch" --state open --json url --jq '.[].url' | head -n1)"
             if [ -n "$existing" ]; then
@@ -722,5 +763,6 @@ jobs:
             /tmp/candidates.json
             /tmp/drafter_out_*.txt
             /tmp/post_*.mdx
+            /tmp/demo_table_*.md
           retention-days: 7
           if-no-files-found: ignore

.github/workflows/finalize-release.yml

@@ -2,19 +2,22 @@
 # run after the prod PyPI publish succeeded and the draft notes are curated
 # (designs/RELEASE-AUTOMATION.md).
 #
-# Deterministic gates first (all fail with actionable links):
-#   * the tag is a final vX.Y.Z with an unpublished draft release,
+# Deterministic gates first (each fails with actionable links):
+#   * the tag is a final vX.Y.Z (input is normalized: `0.7.0` -> `v0.7.0`)
+#     with an unpublished draft release; a draft whose tag binding was lost
+#     to a web-UI edit (tag_name became `untagged-…`) is rebound automatically,
 #   * PyPI serves all three lockstep packages at the version (never advertise
 #     a release that isn't installable),
-#   * the auto/changelog/vX.Y.Z CHANGELOG PR isn't sitting open,
-#   * the docs sweep: no open PRs against omnigent-site's X.Y-docs staging
-#     branch (every doc staged this cycle is reviewed + merged/closed).
+#   * the auto/changelog/vX.Y.Z CHANGELOG PR isn't sitting open.
+# The docs sweep (open PRs against omnigent-site's X.Y-docs staging branch) is
+# ADVISORY only: it lists what is still unmerged but never blocks the publish —
+# docs can land after the release, any time before the docs-publish PR merges.
 #
 # The publish job binds the `publish-release` environment (one-time setup:
 # create it in repo settings with required reviewers). Approving it is the
 # human attestation "I reviewed the draft notes". The publish itself uses the
 # App token — GITHUB_TOKEN-published releases emit no `release: published`
-# event, and publish-changelog.yml + update-homebrew.yml hang off it — and
+# event, and publish-changelog.yml + homebrew-tap-pr.yml hang off it — and
 # sets make_latest explicitly, which API publishes don't do on their own.
 #
 # rc tags never finalize: their drafts deliberately stay unpublished.
@@ -64,16 +67,23 @@ jobs:
     outputs:
       release_id: ${{ steps.draft.outputs.release_id }}
       already_published: ${{ steps.draft.outputs.already_published }}
+      tag: ${{ steps.tag.outputs.tag }}
     steps:
       - name: Require a final vX.Y.Z tag
+        id: tag
         env:
-          TAG: ${{ inputs.tag }}
+          RAW_TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
+          # Normalize the input: trim whitespace, add the leading v if omitted
+          # (`0.7.0` -> `v0.7.0`), so a bare version doesn't fail the dispatch.
+          TAG="$(printf '%s' "$RAW_TAG" | tr -d '[:space:]')"
+          case "$TAG" in v*) ;; *) TAG="v${TAG}" ;; esac
           if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::${TAG} is not a final vX.Y.Z tag — rc/dev/alpha/beta releases never finalize."
+            echo "::error::${RAW_TAG} is not a final vX.Y.Z tag — rc/dev/pre releases never finalize."
             exit 1
           fi
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
 
       # Drafts are invisible to read-only tokens and unaddressable by tag
       # (the get-by-tag endpoint 404s on drafts) — resolve by listing with the
@@ -93,11 +103,32 @@ jobs:
         id: draft
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          TAG: ${{ inputs.tag }}
+          TAG: ${{ steps.tag.outputs.tag }}
         run: |
           set -euo pipefail
           match="$(gh api "repos/${GITHUB_REPOSITORY}/releases" --paginate \
             --jq 'map(select(.tag_name == env.TAG)) | first // empty')"
+          if [ -z "$match" ]; then
+            # Editing a draft in the web UI can silently drop its tag binding
+            # (tag_name becomes `untagged-…` while the name stays vX.Y.Z; bit
+            # v0.5.0 and v0.7.0). Recover: match the DRAFT by name and rebind —
+            # only ever onto a tag that already exists, so publishing can never
+            # mint a new tag at main.
+            match="$(gh api "repos/${GITHUB_REPOSITORY}/releases" --paginate \
+              --jq 'map(select(.draft == true and .name == env.TAG)) | first // empty')"
+            if [ -n "$match" ]; then
+              if ! gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq .object.sha >/dev/null 2>&1; then
+                echo "::error::Draft named ${TAG} exists but the git tag does not — push the tag before finalizing."
+                exit 1
+              fi
+              rebind_id="$(printf '%s' "$match" | jq -r '.id')"
+              gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${rebind_id}" \
+                -f tag_name="$TAG" > /dev/null
+              match="$(gh api "repos/${GITHUB_REPOSITORY}/releases/${rebind_id}")"
+              echo "Rebound draft ${rebind_id} to ${TAG} (tag binding was lost, usually to a web-UI edit)." \
+                | tee -a "$GITHUB_STEP_SUMMARY"
+            fi
+          fi
           if [ -z "$match" ]; then
             echo "::error::No GitHub release found for ${TAG}. Did the tag push run github-release.yml?"
             exit 1
@@ -118,7 +149,7 @@ jobs:
       - name: Assert PyPI serves all three packages
         if: steps.draft.outputs.already_published != 'true'
         env:
-          TAG: ${{ inputs.tag }}
+          TAG: ${{ steps.tag.outputs.tag }}
         run: |
           set -euo pipefail
           version="${TAG#v}"
@@ -134,7 +165,7 @@ jobs:
         if: steps.draft.outputs.already_published != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
-          TAG: ${{ inputs.tag }}
+          TAG: ${{ steps.tag.outputs.tag }}
         run: |
           set -euo pipefail
           open_pr="$(gh pr list --repo "$GITHUB_REPOSITORY" --head "auto/changelog/${TAG}" \
@@ -145,11 +176,14 @@ jobs:
           fi
           echo "CHANGELOG PR for ${TAG}: merged or not needed."
 
-      - name: Docs sweep — no open PRs against the X.Y-docs staging branch
+      # Advisory only: docs frequently land after the release. The list tells
+      # the coordinator what must merge into X.Y-docs before the docs-publish
+      # PR does — it never blocks the publish itself.
+      - name: Docs sweep — list open PRs against the X.Y-docs staging branch
         if: steps.draft.outputs.already_published != 'true'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          TAG: ${{ inputs.tag }}
+          TAG: ${{ steps.tag.outputs.tag }}
           SITE_REPO: ${{ github.repository_owner }}/omnigent-site
         run: |
           set -euo pipefail
@@ -158,16 +192,17 @@ jobs:
           open="$(gh pr list --repo "$SITE_REPO" --base "$docs_branch" --state open \
             --json url,title --jq '.[] | "- \(.url)  \(.title)"')"
           if [ -n "$open" ]; then
+            count="$(printf '%s\n' "$open" | grep -c .)"
             {
-              echo "## Docs sweep failed for ${TAG}"
+              echo "## Docs sweep for ${TAG} — ${count} open PR(s) still target \`${docs_branch}\`"
               echo ""
-              echo "Open PRs still target \`${docs_branch}\` on ${SITE_REPO} — review and merge/close them, then re-dispatch:"
+              echo "Advisory, not blocking. Merge/close these before merging the docs-publish PR:"
               echo "$open"
             } | tee -a "$GITHUB_STEP_SUMMARY"
-            echo "::error::Open doc PRs still target ${docs_branch} — see the run summary."
-            exit 1
+            echo "::warning::${count} open doc PR(s) still target ${docs_branch} (non-blocking) — see the run summary."
+          else
+            echo "Docs sweep clean: no open PRs against ${docs_branch}." | tee -a "$GITHUB_STEP_SUMMARY"
           fi
-          echo "Docs sweep clean: no open PRs against ${docs_branch}." | tee -a "$GITHUB_STEP_SUMMARY"
 
   # Approving this environment attests "I reviewed the curated draft notes".
   publish:
@@ -189,7 +224,7 @@ jobs:
       - name: Publish the draft as Latest
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          TAG: ${{ inputs.tag }}
+          TAG: ${{ needs.checks.outputs.tag }}
           RELEASE_ID: ${{ needs.checks.outputs.release_id }}
         run: |
           set -euo pipefail
@@ -202,5 +237,5 @@ jobs:
             echo ""
             echo "The \`release: published\` event now fires (App-token publish):"
             echo "- **publish-changelog.yml** opens the omnigent-site release-post PR and the docs-publish PR — review and merge both."
-            echo "- **update-homebrew.yml** opens the homebrew-tap bump PR — review the resource diff, then apply the \`pr-pull\` label."
+            echo "- **homebrew-tap-pr.yml** opens the homebrew-tap bump PR — review the resource diff, then apply the \`pr-pull\` label."
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/flake-stress-e2e.yml

@@ -238,22 +238,26 @@ jobs:
         # executor adapters import at collection time.
         run: uv sync --extra all --extra dev
 
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
+
       - name: Install binary dependencies
         # Mirrors e2e.yml. ripgrep: Grep fallback for inner tests. tmux +
         # bubblewrap: the e2e runner runs real agents under the linux_bwrap
         # sandbox, which fails loud if `bwrap` is missing. The apparmor
         # sysctl mirrors ci.yml (Ubuntu 24.04 blocks unprivileged user
-        # namespaces, which bwrap's unshare(CLONE_NEWUSER) needs). npm install
-        # with --ignore-scripts blocks postinstall; the claude-code stub needs
-        # its audited install.cjs run explicitly (platform detect + same-tree
-        # hardlink, no network/exec) for claude-sdk harness rows.
-        working-directory: .github/ci-deps
+        # namespaces, which bwrap's unshare(CLONE_NEWUSER) needs). pnpm
+        # install with --ignore-scripts blocks postinstall; the claude-code
+        # stub needs its audited install.cjs run explicitly (platform detect +
+        # same-tree hardlink, no network/exec) for claude-sdk harness rows.
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
           sudo apt-get update
           sudo apt-get install -y ripgrep tmux bubblewrap
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          npm install --ignore-scripts
-          node node_modules/@anthropic-ai/claude-code/install.cjs
+          pnpm install --frozen-lockfile --ignore-scripts --filter e2e-ci-deps
+          node .github/ci-deps/node_modules/@anthropic-ai/claude-code/install.cjs
           echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Run pytest target
@@ -274,7 +278,7 @@ jobs:
           # low-quota gpt-5-4 model, so sustained 429s don't masquerade as
           # flakes (mirrors e2e.yml).
           OMNIGENT_TEST_MODEL_SPREAD: "1"
-          OMNIGENT_TEST_MODEL_POOL_GPT: "databricks-gpt-5-5,databricks-gpt-5-4-mini"
+          OMNIGENT_TEST_MODEL_POOL_GPT: ${{ vars.OMNIGENT_CI_E2E_MODEL_POOL_GPT }}
         run: |
           mkdir -p artifacts "artifacts/basetemp-${{ matrix.attempt }}"
           # --junitxml emits per-test results eagerly so diagnostics survive a

.github/workflows/flake-stress-ui.yml

@@ -15,7 +15,11 @@ name: Flake stress (E2E UI)
 # but needs the full UI toolchain: a built SPA, Playwright Chromium, and — for
 # the native render-parity / Codex goal-mode tests — the Claude Code / Codex
 # CLIs and the Rust parity sidecar. This workflow mirrors e2e-ui.yml's setup
-# exactly, then runs ONE target N times instead of the sharded full suite.
+# exactly (including the dedicated build-sidecar job that compiles the
+# codex-parity sidecar ONCE and hands each attempt the prebuilt binary via
+# CODEX_PARITY_SIDECAR_BIN — otherwise the fixture's inline cargo build runs on
+# every attempt and blows past the per-test timeout on a cold Rust cache), then
+# runs ONE target N times instead of the sharded full suite.
 #
 # Examples:
 #   gh workflow run flake-stress-ui.yml --ref main \
@@ -140,9 +144,58 @@ jobs:
           echo "attempts_json=$ARR" >> "$GITHUB_OUTPUT"
           echo "Will run $ATTEMPTS attempts of: $TEST_TARGET  extra='$EXTRA_ARGS'"
 
+  build-sidecar:
+    # Build the Codex-parity sidecar ONCE and publish the binary, exactly like
+    # e2e-ui.yml. The mocked_native_codex_goal_session fixture needs it, but
+    # compiling it pulls openai/codex's core_test_support (~1100 crates). Done
+    # lazily inside pytest it runs ~7 min cold — past the per-test --timeout, so
+    # every attempt would die at fixture setup on a cold Rust cache. Building it
+    # here once and handing every attempt the ~10MB binary (via the artifact +
+    # CODEX_PARITY_SIDECAR_BIN below) keeps the sidecar off the attempt's
+    # critical path. Checks out target_branch so the sidecar matches the code
+    # under test.
+    name: build codex-parity sidecar
+    needs: prep
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          ref: ${{ github.event.inputs.target_branch }}
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+        with:
+          toolchain: stable
+      - name: Capture Rust version
+        id: rustc
+        run: echo "version=$(rustc --version | tr ' ' '-')" >> "$GITHUB_OUTPUT"
+      # Same cache key as e2e-ui.yml / ci.yml so a main-populated cache restores:
+      # the binary is a pure function of sidecar/** + the toolchain, so cache the
+      # built binary (not the 1.6 GB target dir) and skip the compile on a hit.
+      - name: Cache parity sidecar binary
+        id: sidecar-cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v4
+        with:
+          path: .tmp-codex-parity-target/debug/codex-parity-sidecar
+          key: codex-parity-bin-${{ runner.os }}-${{ steps.rustc.outputs.version }}-${{ hashFiles('tests/codex_parity/sidecar/**') }}
+      - name: Build parity sidecar
+        if: steps.sidecar-cache.outputs.cache-hit != 'true'
+        run: |
+          cargo build \
+            --manifest-path tests/codex_parity/sidecar/Cargo.toml \
+            --target-dir .tmp-codex-parity-target
+      - name: Upload sidecar binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: codex-parity-sidecar
+          path: .tmp-codex-parity-target/debug/codex-parity-sidecar
+          if-no-files-found: error
+          retention-days: 1
+
   repro:
     name: Attempt ${{ matrix.attempt }}
-    needs: prep
+    needs: [prep, build-sidecar]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
@@ -162,8 +215,8 @@ jobs:
         with:
           python-version-file: ".python-version"
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -190,20 +243,17 @@ jobs:
           sudo apt-get install -y bubblewrap tmux
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
 
-      - name: Set up Rust toolchain
-        # The mocked_native_codex_goal_session fixture builds the Codex parity
-        # sidecar via `cargo build`; pin the toolchain for a stable cache key
-        # (mirrors e2e-ui.yml / ci.yml's codex-parity job).
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: Download codex-parity sidecar binary
+        # Prebuilt once by the build-sidecar job. The goal-mode fixture uses this
+        # (via CODEX_PARITY_SIDECAR_BIN on the pytest step) instead of running a
+        # multi-minute cargo build on each attempt's critical path.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
-          toolchain: stable
+          name: codex-parity-sidecar
+          path: .tmp-codex-parity-target/debug
 
-      - name: Cache Rust build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v4
-        with:
-          path: .tmp-codex-parity-target
-          # Identical key to e2e-ui.yml / ci.yml so a populated cache restores.
-          key: codex-parity-sidecar-${{ runner.os }}-${{ hashFiles('tests/codex_parity/sidecar/Cargo.lock') }}
+      - name: Make sidecar binary executable
+        run: chmod +x .tmp-codex-parity-target/debug/codex-parity-sidecar
 
       - name: Cache Playwright browsers
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
@@ -222,20 +272,20 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Install Claude Code CLI
         # Pinned to match e2e-ui.yml (2.1.170 recognises the native bridge
-        # hook events). --ignore-scripts then run the audited install.cjs.
+        # hook events). Runs lifecycle scripts so the platform-specific binary
+        # is linked and put on PATH.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
-          node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Install Codex CLI
         # @openai/codex pinned to match e2e-ui.yml; goal-mode app-server APIs
@@ -243,9 +293,10 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
+          CODEX_CLI_DIR="${RUNNER_TEMP}/omnigent-codex-cli"
+          mkdir -p "$CODEX_CLI_DIR" && cd "$CODEX_CLI_DIR"
           npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
-          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CODEX_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Run pytest target
         # Inputs validated by prep. Word-splitting on $TEST_TARGET / $EXTRA_ARGS
@@ -258,6 +309,10 @@ jobs:
         env:
           TEST_TARGET: ${{ github.event.inputs.test_target }}
           EXTRA_ARGS: ${{ github.event.inputs.extra_pytest_args }}
+          # Prebuilt sidecar from build-sidecar; the codex goal-mode fixture uses
+          # this instead of running cargo build. Absolute path: the fixture
+          # resolves it as-is, and pytest may run from a different cwd.
+          CODEX_PARITY_SIDECAR_BIN: ${{ github.workspace }}/.tmp-codex-parity-target/debug/codex-parity-sidecar
         run: |
           mkdir -p artifacts "artifacts/basetemp-${{ matrix.attempt }}"
           # shellcheck disable=SC2086

.github/workflows/github-release.yml

@@ -1,9 +1,9 @@
 # Create a GitHub Release entry (the `…/releases` page) when a version tag is
 # pushed. This is METADATA ONLY — it does NOT build or publish any installable
-# artifact. PyPI publishing lives in the central secure-release repo
-# (databricks/secure-public-registry-releases-eng → `omnigent` workflow), on
-# hardened runners with OIDC Trusted Publishing and a mandatory dependency
-# scan. Keeping those concerns separate is deliberate (see RELEASING.md):
+# artifact. PyPI publishing lives in a Databricks-internal secure-release repo
+# (its `omnigent` workflow), on hardened runners with OIDC Trusted Publishing
+# and a mandatory dependency scan. Keeping those concerns separate is
+# deliberate (see the maintainer release runbook):
 #
 #   * This job runs NO project or third-party code — no build, no `pip
 #     install`/`npm ci`, no tests. Its only action is SHA-pinned
@@ -28,7 +28,10 @@ on:
   push:
     tags:
       # Version tags only (v0.2.0, v0.2.0rc1, …) — `v[0-9]*` avoids triggering
-      # on non-release tags like `v-infra-*`.
+      # on non-release tags like `v-infra-*`. Pre-release tags (rcN / devN /
+      # preN) still match the glob but are skipped in the job below — no
+      # GitHub release is created for them; their installable artifacts live
+      # only on PyPI, and a curated release page is reserved for the final cut.
       - "v[0-9]*"
 
 # Least privilege: creating a release requires `contents: write`; nothing here
@@ -43,9 +46,30 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      - name: Skip pre-release tags (rcN / devN / preN)
+        id: tag
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Pre-release tags (rcN / devN / preN) get NO GitHub release — they
+          # live on PyPI only, and a curated release page is reserved for the
+          # final cut. The tag glob above still matches them, so gate here.
+          # A trailing digit is required so a substring like 'dev' or 'pre' in a
+          # mistyped tag name can't trigger a skip by accident.
+          case "$TAG" in
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*)
+              echo "Pre-release tag ${TAG} — not creating a GitHub release (rc/dev/pre releases live on PyPI only)." \
+                | tee -a "$GITHUB_STEP_SUMMARY"
+              echo "skip=true" >> "$GITHUB_OUTPUT" ;;
+            *)
+              echo "skip=false" >> "$GITHUB_OUTPUT" ;;
+          esac
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        if: steps.tag.outputs.skip != 'true'
 
       - name: Draft release with a placeholder body
+        if: steps.tag.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
@@ -57,20 +81,11 @@ jobs:
             echo "Release $TAG already exists — skipping." | tee -a "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
-          # rc / dev / alpha / beta tags are flagged as pre-releases.
-          pre=""
-          case "$TAG" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) pre="--prerelease" ;;
-          esac
-          # $pre is intentionally UNQUOTED: it word-splits to nothing when empty,
-          # and is only ever "" or "--prerelease" (set just above, never from
-          # external input). Quoting it would pass an empty positional arg.
           gh release create "$TAG" \
             --repo "$GITHUB_REPOSITORY" \
             --draft \
             --verify-tag \
             --notes "_Release notes are being drafted automatically — check back shortly._" \
-            --title "$TAG" \
-            $pre
+            --title "$TAG"
           echo "Drafted release $TAG — curated notes will be filled in by draft-release-notes.yml; review and publish from the Releases page." \
             | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/homebrew-tap-pr.yml

@@ -14,13 +14,18 @@ name: Homebrew tap PR
 # We trigger on `release: published` (not the tag push) for the same reason as
 # publish-changelog.yml: that's the moment the version is installable from PyPI
 # — the secure-release repo publishes to PyPI before the GitHub Release goes
-# public (see RELEASING.md), so the sdist we pin the formula to actually exists.
+# public (see the maintainer release runbook), so the sdist we pin the formula to actually exists.
 #
 # Cross-repo writes can't use the workflow's own GITHUB_TOKEN (scoped to this
 # repo), so we mint a short-lived token from the omnigent-ci GitHub App scoped to
 # homebrew-tap — the same App used by publish-changelog.yml / doc-sync.yml. One
 # prerequisite: the omnigent-ci App must be installed on omnigent-ai/homebrew-tap
 # with contents:write + pull-requests:write.
+#
+# This is the only workflow that touches the tap. It replaced update-homebrew.yml,
+# which regenerated resources with `brew update-python-resources` and asserted on
+# hand-maintained stanzas this template no longer emits, so it failed on every
+# run while racing this workflow on the same `release: published` event.
 
 on:
   release:
@@ -61,14 +66,14 @@ jobs:
           echo "tag=${tag}" >> "$GITHUB_OUTPUT"
           echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
           is_final=true
-          # Only final vX.Y.Z tags; exclude rc/dev/alpha/beta and the event's
-          # prerelease flag (homebrew users get stable releases from the tap).
+          # Only final vX.Y.Z tags; exclude rcN/devN/preN pre-releases and
+          # the event's prerelease flag (homebrew users get stable releases).
           case "$tag" in
             v[0-9]*.[0-9]*.[0-9]*) ;;
             *) is_final=false ;;
           esac
           case "$tag" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_final=false ;;
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*|*a[0-9]*|*b[0-9]*) is_final=false ;;
           esac
           if [ "${PRERELEASE}" = "true" ]; then is_final=false; fi
           echo "is_final=${is_final}" >> "$GITHUB_OUTPUT"
@@ -86,8 +91,29 @@ jobs:
       TAP_REPO: ${{ github.repository_owner }}/homebrew-tap
       BRANCH: auto/formula/${{ needs.resolve.outputs.tag }}
     steps:
+      - name: Require admin/maintain role (manual dispatches)
+        # The release-event path is already gated by the tag checks above; only a
+        # human dispatch needs an actor-role check, since workflow_dispatch is
+        # runnable by anyone with write access.
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          role="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq .role_name)"
+          case "$role" in
+            admin|maintain)
+              echo "Dispatcher ${ACTOR} has role ${role} — authorized." ;;
+            *)
+              echo "::error::Release workflows require the admin or maintain role (dispatcher ${ACTOR} has '${role}')."
+              exit 1 ;;
+          esac
+
       - name: Checkout omnigent (template + generator)
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

.github/workflows/issue-triage.yml

@@ -13,6 +13,10 @@ name: Issue Triage
 # exfiltrate secrets. All GitHub mutations happen in steps the LLM
 # cannot influence.
 #
+# Runs on issue open, and again when someone removes the `needs-info` label —
+# the re-triage path reads the reporter's follow-up comments and classifies +
+# assigns the issue (re-adding `needs-info` only if it is still too vague).
+#
 # What the bot does:
 #   1. Removes `needs-triage`, adds `triaged`
 #   2. Classifies component — one `comp:*` label
@@ -24,12 +28,21 @@ name: Issue Triage
 
 on:
   issues:
-    types: [opened]
+    # `unlabeled` re-runs triage when someone removes `needs-info` (see the job
+    # `if:` below) — that removal is the signal the issue now has enough detail
+    # to classify and assign.
+    types: [opened, unlabeled]
 
 permissions:
   issues: write
   contents: read
 
+# One triage run per issue at a time; a newer event supersedes an in-flight one
+# (e.g. a re-label right after open won't race with the initial run).
+concurrency:
+  group: issue-triage-${{ github.event.issue.number }}
+  cancel-in-progress: true
+
 env:
   OMNIGENT_SKIP_WEB_UI: "true"
   UV_INDEX_URL: https://pypi.org/simple
@@ -39,9 +52,25 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    # Skip issues opened by bots to avoid feedback loops.
+    # Run on:
+    #   - a newly opened issue by a non-bot author (initial triage), OR
+    #   - the `needs-info` label being REMOVED from an open issue (re-triage:
+    #     the removal signals the issue now has enough detail to classify).
+    # The `unlabeled` path intentionally allows a bot actor: the removal is made
+    # by the omnigent-ci App (see needs-info-response.yml) whose login ends in
+    # `[bot]`, and only an App-token/human removal re-triggers at all — this
+    # workflow's own label edits use the default GITHUB_TOKEN, which never emits
+    # re-triggering events, so there is no loop to guard against here.
     if: >-
-      !endsWith(github.event.issue.user.login, '[bot]')
+      (
+        github.event.action == 'opened' &&
+        !endsWith(github.event.issue.user.login, '[bot]')
+      ) ||
+      (
+        github.event.action == 'unlabeled' &&
+        github.event.label.name == 'needs-info' &&
+        github.event.issue.state == 'open'
+      )
     steps:
       - name: Check LLM credentials available
         id: creds
@@ -107,8 +136,11 @@ jobs:
           set -euo pipefail
 
           # Fetch issue metadata to a file — never interpolated into shell.
+          # `comments` is included so the re-triage path (needs-info removed) can
+          # see the detail the reporter added in comments, not just the original
+          # body.
           gh issue view "$ISSUE_NUMBER" --repo "$REPO" \
-            --json number,title,body,labels,author \
+            --json number,title,body,labels,author,comments \
             > /tmp/issue.json
 
           # Extract key terms for duplicate search (first 200 chars of title+body).
@@ -179,10 +211,14 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Set LLM credentials
         if: steps.creds.outputs.available == 'true'
@@ -210,7 +246,9 @@ jobs:
         if: steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_AGENT_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
         run: |
+          : "${OMNIGENT_AGENT_MODEL:?Set OMNIGENT_CI_FAST_ANTHROPIC_MODEL}"
           mkdir -p "$HOME/.omnigent"
           python3 -c "
           import pathlib, os, json
@@ -224,7 +262,7 @@ jobs:
                       'anthropic': {
                           'base_url': gw + '/anthropic',
                           'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-sonnet-4-6'},
+                          'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
                       },
                   }
               }
@@ -252,6 +290,22 @@ jobs:
           body = (issue.get("body") or "")[:8192]
           labels = [l["name"] for l in issue.get("labels", [])]
 
+          # Follow-up comments by the issue author — the reporter often supplies
+          # the missing detail here, so the re-triage path must read them. Only
+          # the author's own comments count as clarification (others' comments
+          # are noise for this purpose and are dropped). Capped to 4 KB total.
+          author_login = issue.get("author", {}).get("login")
+          comment_section = "None."
+          if author_login:
+              author_comments = [
+                  c.get("body", "")
+                  for c in issue.get("comments", [])
+                  if c.get("author", {}).get("login") == author_login and c.get("body")
+              ]
+              if author_comments:
+                  joined = "\n\n---\n\n".join(author_comments)[:4096]
+                  comment_section = joined
+
           dupe_section = "None found."
           if dupes:
               lines = [f"- #{d['number']}: {d['title']}" for d in dupes[:5]]
@@ -269,6 +323,10 @@ jobs:
           Body:
           {body}
 
+          ## AUTHOR FOLLOW-UP COMMENTS (UNTRUSTED — later clarification from the reporter)
+
+          {comment_section}
+
           ## CANDIDATE DUPLICATES
 
           {dupe_section}
@@ -336,6 +394,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
+          EVENT_ACTION: ${{ github.event.action }}
         run: |
           set -euo pipefail
 
@@ -344,7 +403,7 @@ jobs:
           # All GitHub mutations are built in Python with proper escaping
           # — no eval, no shell interpolation of model output.
           python3 <<'PYEOF'
-          import json, pathlib, sys, shlex
+          import json, os, pathlib, sys, shlex
 
           raw = pathlib.Path("/tmp/triage_output.txt").read_text()
 
@@ -369,7 +428,7 @@ jobs:
               sys.exit(1)
 
           # Validate fields against allowed values to prevent label injection.
-          ALLOWED_TYPES = {"bug", "enhancement", "documentation"}
+          ALLOWED_TYPES = {"bug", "Feature", "Docs"}
           # Component labels come from .github/areas.json (single source of truth),
           # so the validator can never drift from the area definitions.
           ALLOWED_COMPONENTS = set(json.loads(pathlib.Path("/tmp/components.json").read_text()))
@@ -385,12 +444,18 @@ jobs:
           dup = None
 
           if result.get("needs_info"):
-              labels_add.append("needs-info")
+              if "needs-info" not in existing_labels:
+                  labels_add.append("needs-info")
               if "needs-triage" in existing_labels:
                   labels_remove.append("needs-triage")
               # needs-info issues are still triaged — they just need more info.
               labels_add.append("triaged")
           else:
+              # No longer needs info. On the re-triage path the label is already
+              # gone (its removal triggered this run); this is a safety net for
+              # any case where it lingers.
+              if "needs-info" in existing_labels:
+                  labels_remove.append("needs-info")
               # Type
               t = result.get("type")
               if t and t in ALLOWED_TYPES:
@@ -413,16 +478,22 @@ jobs:
                   labels_add.append("help wanted")
 
               # Duplicate — only accept if the issue number is in our
-              # pre-fetched candidate list (prevents hallucinated refs).
+              # pre-fetched candidate list (prevents hallucinated refs). Only on
+              # the initial open: on re-triage we neither re-label nor re-comment
+              # (the duplicate call was already made at open time), so the label
+              # and its explanatory comment stay consistent.
               dup = result.get("duplicate_of")
               candidates = json.loads(
                   pathlib.Path("/tmp/duplicates.json").read_text()
               )
               candidate_numbers = {d["number"] for d in candidates}
-              if dup and isinstance(dup, int) and dup in candidate_numbers:
+              if (
+                  dup and isinstance(dup, int) and dup in candidate_numbers
+                  and os.environ.get("EVENT_ACTION") == "opened"
+              ):
                   labels_add.append("duplicate")
               else:
-                  dup = None  # discard hallucinated duplicate
+                  dup = None  # discard hallucinated / re-triage duplicate
 
               if "needs-triage" in existing_labels:
                   labels_remove.append("needs-triage")
@@ -451,12 +522,12 @@ jobs:
               "ranked_owners": ranked_owners,
               "duplicate_of": dup if isinstance(dup, int) else None,
               "priority": result.get("priority") if result.get("priority") in ALLOWED_PRIORITIES else None,
+              "needs_info": bool(result.get("needs_info")),
               "reasoning": result.get("reasoning", ""),
           }
           pathlib.Path("/tmp/triage_result.json").write_text(json.dumps(output))
 
           # Build a shell script with properly escaped arguments — no eval.
-          import os
           issue = os.environ["ISSUE_NUMBER"]
           repo = os.environ["REPO"]
           cmds = []
@@ -470,8 +541,10 @@ jobs:
           if labels_add or labels_remove:
               cmds.append(" ".join(shlex.quote(a) for a in args))
 
-          # Duplicate comment.
-          if output["duplicate_of"]:
+          # Duplicate comment — only on the initial open. On the re-triage path
+          # (needs-info removed) any duplicate note was already posted at open
+          # time, so we skip it to avoid re-commenting.
+          if output["duplicate_of"] and os.environ.get("EVENT_ACTION") == "opened":
               comment_args = [
                   "gh", "issue", "comment", issue, "--repo", repo,
                   "--body", f"Potential duplicate of #{output['duplicate_of']}. React 👎 to contest.",
@@ -503,12 +576,14 @@ jobs:
             maintainer_assigned=true
           fi
 
-          # Otherwise, assign an owner for P0/P1 issues: the least-loaded area
-          # owner, with LLM rank as a tiebreaker (load primary, rank secondary).
-          # Symmetric with the PR reviewer path. Skipped if the maintainer-author
-          # was already assigned above.
-          priority=$(jq -r '.priority // empty' /tmp/triage_result.json)
-          if [ "$maintainer_assigned" = "false" ] && { [ "$priority" = "P0-critical" ] || [ "$priority" = "P1-high" ]; }; then
+          # Otherwise, assign an owner: the least-loaded area owner, with LLM
+          # rank as a tiebreaker (load primary, rank secondary). Symmetric with
+          # the PR reviewer path. Skipped if the maintainer-author was already
+          # assigned above. Every triaged issue gets an owner — the only issues
+          # left unassigned are needs_info ones (too vague to route until the
+          # reporter adds detail).
+          needs_info=$(jq -r '.needs_info // false' /tmp/triage_result.json)
+          if [ "$maintainer_assigned" = "false" ] && [ "$needs_info" != "true" ]; then
             # Open-issue load per candidate (fewest assigned open issues wins ties).
             # One trusted query; the LLM never sees GH_TOKEN.
             gh issue list --repo "$REPO" --state open --limit 500 \
@@ -520,8 +595,8 @@ jobs:
           owners = json.loads(pathlib.Path("/tmp/owners.json").read_text())
 
           # Candidates: the validated ranked owners (LLM preference order). If the
-          # LLM gave none, fall back to the full owner pool so a P0/P1 is never
-          # left unassigned — load then picks the least-loaded owner.
+          # LLM gave none, fall back to the full owner pool so a triaged issue is
+          # never left unassigned — load then picks the least-loaded owner.
           ranked = triage.get("ranked_owners") or []
           candidates = ranked if ranked else owners
           rank_of = {u: i for i, u in enumerate(ranked)}  # unranked -> +inf below

.github/workflows/lint.yml

@@ -1,9 +1,10 @@
 name: Lint
 
-# Runs the project's pre-commit hooks (ruff, mypy, custom anti-pattern grep
-# hooks, etc.) on every non-draft PR and on push to main. Surfaces as the
-# `Pre-commit checks` check, a REQUIRED gate entry in merge-ready.yml. Draft PRs
-# are skipped; `ready_for_review` refires so the check doesn't strand pending.
+# Runs the project's pre-commit hooks (ruff, Pyrefly, TypeScript lint/type-check, custom
+# anti-pattern grep hooks, etc.) on every non-draft PR and on push to main.
+# Surfaces as the `Pre-commit checks` check, a REQUIRED gate entry in
+# merge-ready.yml. Draft PRs are skipped; `ready_for_review` refires so the
+# check doesn't strand pending.
 
 on:
   pull_request:
@@ -76,35 +77,40 @@ jobs:
         # a stale lockfile). Fix locally with `uv lock`.
         run: uv sync --locked --extra dev
 
-      # Sets up Node 20 and pins npm to the same major that regenerates
-      # the lockfile in the OSS-regen workflows, so the freshness gate
-      # below doesn't flake on npm version-skew churn.
-      - name: Set up Node.js
-        uses: ./.github/actions/setup-node
+      # Sets up Node 20 + pnpm, with pnpm dependency caching keyed on the
+      # workspace lockfile. pnpm is pinned in .github/actions/setup-pnpm.
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
-      - name: Install web dependencies
-        working-directory: web
-        # Pin the npm registry to the npmjs default.
+      - name: Install TypeScript dependencies
+        # Pin the npm registry to the npmjs default; limit installs to packages
+        # checked here so Electron's large native devDependencies are not fetched.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
-        run: npm ci --legacy-peer-deps
+        run: pnpm install --frozen-lockfile --filter web --filter omnigent-vscode
 
-      # The npm equivalent of the `uv sync --locked` gate above. `npm ci`
-      # only checks the lockfile is CONSISTENT with package.json; it
-      # tolerates cosmetic drift (dev/extraneous flags, metadata) that a
-      # fresh resolution would rewrite. Regenerate the lockfile and fail
-      # if it differs from the committed one.
-      - name: Check web/package-lock.json is up to date
-        working-directory: web
+      # The pnpm equivalent of the `uv sync --locked` gate above.
+      # `pnpm install --frozen-lockfile` only checks the lockfile is CONSISTENT
+      # with package.json; it tolerates cosmetic drift that a fresh resolution
+      # would rewrite. Regenerate the lockfile and fail if it differs from the
+      # committed one.
+      - name: Check pnpm-lock.yaml is up to date
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund
-          git diff --exit-code package-lock.json || {
-            echo "::error::web/package-lock.json is out of date. Run 'npm install --package-lock-only --legacy-peer-deps' in web/ and commit the result."
+          pnpm install --lockfile-only
+          git diff --exit-code pnpm-lock.yaml || {
+            echo "::error::pnpm-lock.yaml is out of date. Run 'pnpm install --lockfile-only' at the repo root and commit the result."
             exit 1
           }
 
+      # A `--frozen-lockfile` / lockfile-regen gate can't catch an override that
+      # pins a version outside a package.json range: overrides outrank
+      # package.json, so the declared version is silently ignored and the lock
+      # stays internally consistent for the pin. Check overrides directly.
+      - name: Check pnpm overrides satisfy declared ranges
+        run: .venv/bin/python dev/lint/lint_pnpm_override_consistency.py
+
       # ktlint is invoked by the android-ktlint-* pre-commit hooks. The wrapper
       # script (web/android/bin/ktlint.sh) exits 0 if ktlint is absent, so we
       # install it here before pre-commit runs to ensure the check is enforced.
@@ -122,14 +128,10 @@ jobs:
           chmod +x /tmp/ktlint
           sudo mv /tmp/ktlint /usr/local/bin/ktlint
 
-      - name: Run formatting, lint, and typing checks
+      - name: Run formatting, lint, and type checks
         run: uv run pre-commit run --all-files --show-diff-on-failure
 
-      - name: Type-check web
-        working-directory: web
-        run: npm run type-check
-
-  # The three packages release in lockstep (identical versions + `==` sibling
+  # The four packages release in lockstep (identical versions + `==` sibling
   # pins). Assert agreement on every change so drift from a bad merge or
   # cherry-pick — however it happened — is caught before it reaches a release.
   version-lockstep:

.github/workflows/merge-ready.yml

@@ -27,7 +27,7 @@ on:
   pull_request_target:
     types: [labeled]
   workflow_run:
-    workflows: [PR Template, CI, Lint, Docker build, E2E UI Tests, E2E Tests, Integration Tests]
+    workflows: [PR Template, CI, Lint, Docker build, E2E UI Tests, E2E Tests, Integration Tests, UI Snapshot]
     types: [completed]
   check_run:
     types: [completed]

.github/workflows/needs-info-response.yml

@@ -0,0 +1,78 @@
+name: Clear needs-info on author response
+
+# When the issue AUTHOR comments on an issue that carries `needs-info`, remove
+# the label — the reporter has (presumably) supplied the missing detail. That
+# removal is the signal the rest of the pipeline is built around:
+#
+#   author comments  ->  this workflow removes `needs-info`
+#                     ->  issue-triage.yml's `unlabeled` trigger re-triages
+#                         (reads the follow-up comments, classifies + assigns,
+#                          or re-adds `needs-info` if it is still too vague)
+#   author never responds  ->  stale.yml closes the issue after inactivity
+#
+# CRITICAL: the label MUST be removed with the omnigent-ci App token, not the
+# default GITHUB_TOKEN. GitHub does not re-trigger workflows from events made
+# by GITHUB_TOKEN, so a default-token removal would NOT fire issue-triage's
+# `unlabeled` re-triage. The App token is a distinct actor, so its `unlabeled`
+# event does re-trigger. If the App isn't configured, we skip (fail-closed):
+# leaving the label is safer than removing it and stranding the issue.
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  issues: write
+
+concurrency:
+  group: needs-info-response-${{ github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  clear-needs-info:
+    runs-on: ubuntu-latest
+    # Only when a NON-bot commenter who IS the issue author comments on an OPEN
+    # issue (not a PR — issue_comment fires for PRs too) that still carries
+    # `needs-info`.
+    if: >-
+      !endsWith(github.event.sender.login, '[bot]') &&
+      !github.event.issue.pull_request &&
+      github.event.issue.state == 'open' &&
+      github.event.comment.user.login == github.event.issue.user.login &&
+      contains(github.event.issue.labels.*.name, 'needs-info')
+    steps:
+      - name: Mint omnigent-ci App token
+        id: app-token
+        if: vars.OMNIGENT_BOT_APP_ID != ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+
+      - name: Warn when the omnigent-ci App is unconfigured
+        # The feature no-ops without the App (see above). Surface it so a dormant
+        # setup is distinguishable from a broken one.
+        if: steps.app-token.outputs.token == ''
+        run: echo "::notice::omnigent-ci App not configured; needs-info re-triage is dormant (label left in place)."
+
+      - name: Remove needs-info label
+        # Skip when the App isn't configured: removing with GITHUB_TOKEN would
+        # not re-trigger re-triage, so the label would just silently vanish.
+        if: steps.app-token.outputs.token != ''
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          set -euo pipefail
+          # Re-check the live labels before removing: the job gate reads the
+          # (possibly stale) event payload, and `gh --remove-label` errors on a
+          # label that is already gone. This keeps the step idempotent under a
+          # race (e.g. two quick comments, or a concurrent removal).
+          if gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json labels \
+               --jq '.labels[].name' | grep -qx needs-info; then
+            echo "Author responded on #$ISSUE_NUMBER; removing needs-info to re-triage."
+            gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label needs-info
+          else
+            echo "needs-info already cleared on #$ISSUE_NUMBER; nothing to do."
+          fi

.github/workflows/nightly-failure-monitor.yml

@@ -7,10 +7,13 @@ name: Nightly Failure Monitor
 # the maintainer; it comments-and-closes that issue when a later nightly is
 # green. A single flake (one red run) is ignored -- the real-LLM legs are
 # 429-sensitive -- so only a sustained break pages.
+#
+# Nightly Release is watched for the same reason: it is fully unattended, so a
+# broken cut blocks nobody and consumers just silently stop getting new builds.
 
 on:
   workflow_run:
-    workflows: ["E2E Tests", "E2E UI Tests"]
+    workflows: ["E2E Tests", "E2E UI Tests", "Nightly Release"]
     types: [completed]
 
 permissions:

.github/workflows/nightly-release.yml

@@ -0,0 +1,259 @@
+# Cut the nightly prerelease build: a stamped, tagged snapshot of main.
+#
+# Every night (or on manual dispatch) this picks the newest commit on main
+# with green CI, stamps the lockstep version to `X.Y.Z.devYYYYMMDD` (today's
+# UTC date appended to main's `X.Y.Z.dev0` line), commits that stamp DETACHED
+# on top of the base commit, tags it `vX.Y.Z.devYYYYMMDD`, and pushes ONLY the
+# tag with the omnigent-ci App token (GITHUB_TOKEN-pushed tags fire no
+# workflows; the image build hangs off the tag push).
+#
+# Deliberately NOT the release.yml flow: no release/vX.Y branch is created,
+# bump-version.yml is never dispatched (a nightly must not walk main's
+# version), and there is no benchmark gate (benchmark.yml already measures
+# main nightly). Downstream is already quiet for dev tags: github-release.yml
+# and draft-release-notes.yml skip `*dev[0-9]*` tags, update-check ignores
+# dev releases, a default `pip install` never resolves them, and
+# oss-publish-images.yml publishes the immutable
+# `:vX.Y.Z.devYYYYMMDD` image (only `:latest-rc` follows it, by design).
+#
+# The datestamp is FIXED-WIDTH (YYYYMMDD, one nightly per UTC day): PEP 440
+# compares the dev segment as a plain integer, so a longer stamp would sort
+# above every shorter one forever. A same-day re-run finds the tag and no-ops.
+#
+# Nightlies are NOT published to PyPI. Consumers install straight from the
+# tag with uv (scripts/update_nightly.sh resolves and installs the newest
+# one), which pins all lockstep packages to the tagged commit.
+name: Nightly Release
+
+on:
+  schedule:
+    # 04:30 UTC: after the 00:00 UTC scheduled suites drain, well before the
+    # 07:00 UTC image rebuild (its concurrency is per-SHA, so a tag build
+    # racing it would cold-race the layer cache).
+    - cron: "30 4 * * *"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Plan only: print the base commit and version, push nothing."
+        required: false
+        type: boolean
+        default: true
+
+# Nothing here writes with GITHUB_TOKEN; the tag push uses the App token.
+permissions:
+  contents: read
+
+# Share release.yml's group: a nightly cut must never interleave with a real
+# release dispatch.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  plan:
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      base_sha: ${{ steps.resolve.outputs.base_sha }}
+      version: ${{ steps.resolve.outputs.version }}
+      tag: ${{ steps.resolve.outputs.tag }}
+      should_cut: ${{ steps.resolve.outputs.should_cut }}
+    steps:
+      # Manual dispatches are maintainer-only, same rule as release.yml.
+      # Scheduled runs have no meaningful actor and skip the check.
+      - name: Require admin/maintain role (dispatch only)
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          role="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq .role_name)"
+          case "$role" in
+            admin|maintain)
+              echo "Dispatcher ${ACTOR} has role ${role} — authorized." | tee -a "$GITHUB_STEP_SUMMARY" ;;
+            *)
+              echo "::error::Nightly dispatches require the admin or maintain role (dispatcher ${ACTOR} has '${role}')."
+              exit 1 ;;
+          esac
+
+      - name: Checkout main history and tags
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Resolve base commit, version, and whether to cut
+        id: resolve
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          DRY_RUN_INPUT: ${{ inputs.dry_run }}
+        run: |
+          set -euo pipefail
+
+          # Boolean inputs arrive as strings on CLI dispatches and are empty
+          # on schedule — gate in shell, not in `if:` expressions. A schedule
+          # fire is always a real run; a dispatch is dry unless explicitly not.
+          if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ "$DRY_RUN_INPUT" != "false" ]; then
+            dry_run=true
+          else
+            dry_run=false
+          fi
+
+          # Walk main newest-first to the first commit whose CI is complete
+          # and green. A fixed-hour cron can't demand HEAD be green (the last
+          # merge of the day is often mid-CI); walking back keeps the nightly
+          # cadence without ever building a red commit. Check runs from this
+          # workflow's own runs are excluded (a schedule run parks a pending
+          # check on the HEAD it triggered from — it must not mask HEAD).
+          base_sha=""
+          for sha in $(git rev-list -n 20 origin/main); do
+            own_runs="$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/nightly-release.yml/runs?head_sha=${sha}&per_page=100" \
+              --jq '.workflow_runs[].id' 2>/dev/null | paste -sd, -)"
+            runs="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${sha}/check-runs?per_page=100" \
+              --paginate --jq '.check_runs[] | [.name, .status, .conclusion // "-", .details_url] | @tsv')"
+            runs="$(printf '%s' "$runs" | awk -F'\t' -v rel="$own_runs" '
+              BEGIN { n=split(rel, a, ","); for (i=1; i<=n; i++) if (a[i]!="") own[a[i]]=1 }
+              { o=0; for (r in own) if (index($4, "/runs/" r "/")) { o=1; break }
+                if (!o) print $1 "\t" $2 "\t" $3 }')"
+            total="$(printf '%s' "$runs" | grep -c . || true)"
+            pending="$(printf '%s' "$runs" | awk -F'\t' '$2 != "completed"' || true)"
+            bad="$(printf '%s' "$runs" | awk -F'\t' '$3 ~ /^(failure|timed_out|action_required|startup_failure)$/' || true)"
+            if [ "$total" -gt 0 ] && [ -z "$bad" ] && [ -z "$pending" ]; then
+              base_sha="$sha"
+              break
+            fi
+            echo "skipping ${sha}: $([ "$total" -eq 0 ] && echo 'no check runs' || { [ -n "$bad" ] && echo 'failing checks' || echo 'checks still running'; })"
+          done
+
+          should_cut=false
+          version=""
+          tag=""
+          reason=""
+          if [ -z "$base_sha" ]; then
+            reason="no commit with completed green CI in the newest 20 on main"
+          else
+            # Main must carry the `X.Y.Z.dev0` marker (the repo's versioning
+            # invariant). The nightly replaces the dev segment with today's
+            # UTC date; anything else on main is a broken state to fail loudly on.
+            main_version="$(git show "${base_sha}:pyproject.toml" | sed -n 's/^version = "\(.*\)"$/\1/p' | head -1)"
+            if ! [[ "$main_version" =~ ^([0-9]+\.[0-9]+\.[0-9]+)\.dev0$ ]]; then
+              echo "::error::main's version at ${base_sha} is '${main_version}', expected X.Y.Z.dev0 — refusing to derive a nightly version."
+              exit 1
+            fi
+            version="${BASH_REMATCH[1]}.dev$(date -u +%Y%m%d)"
+            tag="v${version}"
+
+            if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
+              reason="tag ${tag} already exists (nightly already cut today)"
+            else
+              # Skip quiet nights: the newest nightly tag's commit is the
+              # stamp on top of its base, so parent = the base it built. If
+              # our base is that commit (or older, after a red-HEAD walk),
+              # there is nothing new to ship.
+              last_tag="$(git for-each-ref --sort=-creatordate --format='%(refname:short)' 'refs/tags/v[0-9]*' \
+                | grep -E '\.dev[0-9]{8}$' | head -1 || true)"
+              if [ -n "$last_tag" ] && { [ "$base_sha" = "$(git rev-parse "${last_tag}^")" ] \
+                  || git merge-base --is-ancestor "$base_sha" "$(git rev-parse "${last_tag}^")"; }; then
+                reason="no new commits on main since ${last_tag}"
+              elif [ "$dry_run" = "true" ]; then
+                reason="dry run — would cut ${tag} from ${base_sha}"
+              else
+                should_cut=true
+              fi
+            fi
+          fi
+
+          {
+            echo "## Nightly plan"
+            echo ""
+            echo "| | |"
+            echo "| --- | --- |"
+            echo "| Base commit | \`${base_sha:-—}\` |"
+            echo "| Version | \`${version:-—}\` |"
+            echo "| Cutting | ${should_cut} |"
+            [ -n "$reason" ] && echo "| Reason | ${reason} |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          {
+            echo "base_sha=${base_sha}"
+            echo "version=${version}"
+            echo "tag=${tag}"
+            echo "should_cut=${should_cut}"
+          } >> "$GITHUB_OUTPUT"
+
+  cut:
+    needs: plan
+    if: needs.plan.outputs.should_cut == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      # Clean public resolution for `uv lock` — the committed lockfile must
+      # reference https://pypi.org/simple (never a proxy).
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
+    steps:
+      - name: Mint App token (omnigent)
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent
+
+      - name: Checkout base commit
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ needs.plan.outputs.base_sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: false
+
+      - name: Stamp the lockstep version
+        env:
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          set -euo pipefail
+          uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py pre-release --new-version "$VERSION"
+          uv lock
+          # uv may emit non-canonical lockfile fields (e.g. size on file
+          # entries); normalize like the pre-commit fixer, then hard-verify.
+          python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+          python3 scripts/normalize_uv_lock_registry.py --check uv.lock
+          uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py check --expect "$VERSION"
+
+      - name: Commit, tag, and push the tag
+        env:
+          PUSH_TOKEN: ${{ steps.app-token.outputs.token }}
+          TAG: ${{ needs.plan.outputs.tag }}
+        run: |
+          set -euo pipefail
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+
+          # Stage everything the stamp touched: update_versions.py owns the
+          # file set (same staging as release.yml and bump-version.yml).
+          git add -A
+          git commit -s -m "nightly: ${TAG}"
+          git tag "$TAG"
+
+          # Tag only — the stamp commit stays off every branch, reachable via
+          # the tag. The App token push fires the tag-triggered workflows.
+          push_url="https://x-access-token:${PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git push "$push_url" "refs/tags/${TAG}"
+          echo "Pushed ${TAG} at $(git rev-parse HEAD) (base $(git rev-parse HEAD^))." \
+            | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/oss-publish-images.yml

@@ -50,8 +50,10 @@ permissions:
   contents: read
 
 concurrency:
-  # Key by SHA so back-to-back merges each build; don't cancel mid-push.
-  group: oss-publish-images-${{ github.sha }}
+  # One build at a time: rc and final tags land minutes apart at a release cut,
+  # and built concurrently they race each other's layer cache cold and blow the
+  # job timeout. Serialized, the later build reuses the earlier one's layers.
+  group: oss-publish-images
   cancel-in-progress: false
 
 jobs:
@@ -67,9 +69,10 @@ jobs:
     runs-on: ubuntu-latest
     # Multi-arch: the linux/arm64 leg cross-builds under QEMU emulation on this
     # amd64 runner, which roughly doubles the host-image build time (emulated
-    # npm/pip native steps). 30m was tight for two native amd64 builds; give the
-    # four-variant (server+host × amd64+arm64) build headroom.
-    timeout-minutes: 60
+    # npm/pip native steps). A cold-cache four-variant (server+host × amd64+
+    # arm64) build can exceed 60m, and hitting the timeout loses the release's
+    # images silently — give it real headroom.
+    timeout-minutes: 120
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

.github/workflows/oss-regen-on-comment.yml

@@ -1,11 +1,11 @@
 # A maintainer comments `/regen` on a PR to regenerate the repo's lockfiles
-# (uv.lock + web/package-lock.json) against public PyPI/npm and commit them
+# (uv.lock + pnpm-lock.yaml) against public PyPI/npmjs.org and commit them
 # ONTO that PR's branch. Use when the PR itself moved a dependency; complements
 # oss-regenerate-and-smoke.yml (standalone rolling PR on dispatch).
 #
 # Two forms:
-#   /regen                      re-resolve, preserving existing pins.
-#   /regen upgrade <pkg> [pkg]  additionally force uv to take the newest allowed
+#   /regen                      re-resolve BOTH lockfiles, preserving existing pins.
+#   /regen upgrade <pkg> [pkg]  uv.lock ONLY: force uv to take the newest allowed
 #                               version of each named package (uv lock
 #                               --upgrade-package). Use for a transitive pip
 #                               security bump Dependabot can't land on this uv
@@ -164,28 +164,14 @@ jobs:
         with:
           enable-cache: false
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
-      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`), recorded as
-      # a relative span; an env-var cutoff would stamp an absolute date and break
-      # later `uv sync --locked`. npm's cooldown (web/.npmrc min-release-age=7)
-      # is only honored by npm >= 11.10.0; node 20 ships npm 10.x which ignores it.
-      # Pin the EXACT version (not a range) and keep it in lockstep with
-      # .github/actions/setup-node (npm 11.12.1): this workflow generates the
-      # lockfile and that action verifies it, so a version gap would fail the
-      # freshness gate in lint.yml.
-      - name: Ensure npm honors the dependency cooldown
-        run: npm install -g npm@11.12.1
-      # Delete package-lock.json so npm RESOLVES from scratch: min-release-age
-      # only filters during resolution, and --package-lock-only keeps an existing
-      # in-range pin without re-applying the cooldown.
-      # --legacy-peer-deps is REQUIRED and MUST match the flag lint.yml verifies
-      # with (React 18 runtime vs React 19 peers would otherwise ERESOLVE-fail,
-      # and a flag mismatch rewrites dev/extraneous flags, failing the gate).
-      - name: Regenerate lockfiles against public PyPI/npm
+      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`) and from
+      # pnpm-workspace.yaml (`minimumReleaseAge: 10080`), recorded as a relative
+      # span; an env-var cutoff would stamp an absolute date and break later
+      # `uv sync --locked` / `pnpm install --frozen-lockfile`.
+      - name: Regenerate lockfiles against public PyPI/npmjs.org
         env:
           REGEN_MODE: ${{ needs.authorize.outputs.mode }}
           UPGRADE_PKGS: ${{ needs.authorize.outputs.pkgs }}
@@ -203,7 +189,17 @@ jobs:
           else
             uv lock
           fi
-          ( cd web && rm -f package-lock.json && npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund )
+          # uv may emit non-canonical lockfile fields (e.g. size on file
+          # entries); normalize like the pre-commit fixer, then hard-verify.
+          python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+          python3 scripts/normalize_uv_lock_registry.py --check uv.lock
+          # `/regen upgrade <py pkgs>` is a targeted Python bump: leave the npm
+          # lockfile alone so the PR diff stays reviewable. Plain `/regen`
+          # refreshes both lockfiles, as before.
+          if [ "$REGEN_MODE" != "upgrade" ]; then
+            rm -f pnpm-lock.yaml
+            pnpm install --lockfile-only
+          fi
 
       # Mint the App token only AFTER `uv lock` so untrusted PR build backends
       # never see it. Skipped when the App isn't configured (push then falls back
@@ -229,12 +225,12 @@ jobs:
           git config user.name "omnigent-ci[bot]"
           git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
           # --porcelain (not git diff) so first-time UNTRACKED lockfiles count too.
-          if [ -z "$(git status --porcelain -- uv.lock web/package-lock.json)" ]; then
+          if [ -z "$(git status --porcelain -- uv.lock pnpm-lock.yaml)" ]; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "Lockfiles already current — nothing to commit."
             exit 0
           fi
-          git add uv.lock web/package-lock.json
+          git add uv.lock pnpm-lock.yaml
           git commit -m "chore(oss): regenerate public lockfiles against public PyPI/npm"
           git push "https://x-access-token:${PUSH_TOKEN}@github.com/${REPO}.git" "HEAD:$HEAD_REF"
           echo "changed=true" >> "$GITHUB_OUTPUT"
@@ -256,7 +252,7 @@ jobs:
             upgraded=" (upgraded: $UPGRADE_PKGS)"
           fi
           if [ "$CHANGED" = "true" ]; then
-            base="✅ Regenerated \`uv.lock\`$upgraded + \`web/package-lock.json\` against public PyPI/npm and pushed to this PR."
+            base="✅ Regenerated \`uv.lock\`$upgraded + \`pnpm-lock.yaml\` against public PyPI/npmjs.org and pushed to this PR."
             if [ "$APP_USED" = "true" ]; then
               body="$base CI will re-run on the new commit."
             else

.github/workflows/oss-regenerate-and-smoke.yml

@@ -1,10 +1,15 @@
-# Regenerate the repo's lockfiles against PUBLIC PyPI/npm, then validate via
+# Keep the repo's public lockfiles consistent with the manifests, validated via
 # a Docker build + CLI smoke. Runs on GitHub-hosted ubuntu-latest so resolution
 # sees public registries directly (lockfiles must record public sources, never
 # a proxy). Exists because sync PRs land manifest changes without lockfile
-# updates and the Dockerfile COPYs web/package-lock.json, so the tree is not
-# Docker-buildable until lockfiles are (re)generated here. Runs every 12h (and
-# on manual dispatch); opens a PR with any regenerated lockfiles.
+# updates and the Dockerfile COPYs pnpm-lock.yaml, so the tree is not
+# Docker-buildable until lockfiles are (re)generated here.
+#
+# Check-first: a consistency check (`uv lock --check` / pnpm `--frozen-lockfile`)
+# gates the work. When the lockfiles already satisfy the manifests the job exits
+# clean and opens no PR — even if newer in-range versions exist upstream — so
+# routine transitive drift never becomes a churn PR. Only a real manifest/lock
+# desync triggers regeneration and a PR. Runs every 12h (and on manual dispatch).
 name: OSS regenerate lockfiles + smoke
 
 on:
@@ -40,43 +45,62 @@ jobs:
         with:
           enable-cache: false
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
-      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`), recorded as
-      # a relative span; an env-var cutoff would stamp an absolute date and break
-      # later `uv sync --locked`.
+      # Check-first: does each lockfile already satisfy its manifests? These
+      # checks pass on a consistent-but-not-latest lock, so routine in-range
+      # transitive drift does NOT trigger a regen; only a real manifest/lock
+      # desync (the case this job exists to catch) flips a flag.
+      #
+      # Per-ecosystem flags: gating each regen on its own flag keeps a desync in
+      # one ecosystem from forcing a from-scratch re-resolve of the other, which
+      # would reintroduce the in-range transitive churn this job avoids. `any`
+      # drives the shared token/PR steps below.
+      - name: Check lockfile consistency
+        id: check
+        run: |
+          drifted_uv=false
+          drifted_pnpm=false
+          uv lock --check || drifted_uv=true
+          # --lockfile-only: verify the lock satisfies the manifests without a
+          # full node_modules install; --frozen-lockfile fails on any desync.
+          pnpm install --frozen-lockfile --lockfile-only || drifted_pnpm=true
+          any=false
+          if [ "$drifted_uv" = "true" ] || [ "$drifted_pnpm" = "true" ]; then
+            any=true
+          fi
+          echo "drifted_uv=$drifted_uv" >> "$GITHUB_OUTPUT"
+          echo "drifted_pnpm=$drifted_pnpm" >> "$GITHUB_OUTPUT"
+          echo "drifted=$any" >> "$GITHUB_OUTPUT"
+          echo "uv.lock drifted=$drifted_uv, pnpm-lock.yaml drifted=$drifted_pnpm"
+
+      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`) and from
+      # pnpm-workspace.yaml (`minimumReleaseAge: 10080`), recorded as a relative
+      # span; an env-var cutoff would stamp an absolute date and break later
+      # `uv sync --locked` / `pnpm install --frozen-lockfile`.
       - name: Regenerate uv.lock
+        if: steps.check.outputs.drifted_uv == 'true'
         run: uv lock
 
-      # npm's cooldown (web/.npmrc `min-release-age=7`) is only honored by
-      # npm >= 11.10.0; node 20 ships npm 10.x which silently ignores it.
-      # Pin the EXACT version (not a range) and keep it in lockstep with
-      # .github/actions/setup-node: this workflow generates the lockfile and
-      # that action verifies it, so a version gap would fail the freshness
-      # gate in lint.yml. 11.12.1 satisfies the >= 11.10.0 cooldown floor.
-      - name: Ensure npm honors the dependency cooldown
-        run: npm install -g npm@11.12.1
-      # Delete the lockfile so npm RESOLVES from scratch: min-release-age only
-      # filters during resolution, and --package-lock-only keeps an existing
-      # in-range pin without re-applying the cooldown.
-      #
-      # --legacy-peer-deps is REQUIRED: the tree pins React 18 at runtime while
-      # much of the UI stack (and @types/react) peer-requires React 19, so npm's
-      # strict resolver would ERESOLVE-fail without it. It MUST match the flag the
-      # freshness gate in lint.yml verifies with; generating without it resolves
-      # the peer graph differently and rewrites the dev/devOptional/extraneous
-      # flags, failing that byte-exact gate.
-      - name: Regenerate package-lock.json
-        working-directory: web
+      # pnpm's cooldown is configured in pnpm-workspace.yaml and respected by
+      # the workspace root. Delete the lockfile so pnpm RESOLVES from scratch:
+      # --lockfile-only keeps an existing in-range pin without re-applying the
+      # cooldown, so we drop it first.
+      - name: Regenerate pnpm-lock.yaml
+        if: steps.check.outputs.drifted_pnpm == 'true'
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          rm -f package-lock.json
-          npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund
+          rm -f pnpm-lock.yaml
+          pnpm install --lockfile-only
 
-      # Validate BEFORE committing: the Docker build proves the regenerated
-      # locks + public registries produce a working image.
+      # Always run, on both paths: when drifted, this validates the freshly
+      # regenerated locks BEFORE they're committed; when not drifted, it's the
+      # ongoing 12h proof that the committed locks + public registries still
+      # build a working image (catches buildability regressions independent of
+      # manifest state — e.g. a yanked package that still satisfies the lock's
+      # specifiers, or a Dockerfile change).
       - name: Docker build (FE + Python, public registries)
         run: docker build -f deploy/docker/Dockerfile -t omnigent-smoke .
 
@@ -87,7 +111,7 @@ jobs:
       # own CI. Skipped when the App isn't configured (falls back to GITHUB_TOKEN).
       - name: Mint App token
         id: app-token
-        if: vars.OMNIGENT_BOT_APP_ID != ''
+        if: steps.check.outputs.drifted == 'true' && vars.OMNIGENT_BOT_APP_ID != ''
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
         with:
           app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
@@ -98,7 +122,7 @@ jobs:
       # blocked by the org PR-creation restriction and the PR runs its own CI;
       # falls back to GITHUB_TOKEN if the App isn't configured.
       - name: Open lockfile-regen PR
-        if: github.event_name != 'pull_request'
+        if: steps.check.outputs.drifted == 'true' && github.event_name != 'pull_request'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
@@ -106,15 +130,15 @@ jobs:
           git config user.name "omnigent-ci[bot]"
           git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
           # --porcelain (not git diff) so first-regen UNTRACKED lockfiles count too.
-          if [ -z "$(git status --porcelain -- uv.lock web/package-lock.json)" ]; then
+          if [ -z "$(git status --porcelain -- uv.lock pnpm-lock.yaml)" ]; then
             echo "Lockfiles already current — nothing to PR."
             exit 0
           fi
           # One rolling branch, force-pushed each run, so regens update a single PR.
           BRANCH="automation/oss-lockfile-regen"
           git checkout -b "$BRANCH"
-          git add uv.lock web/package-lock.json
-          git commit -m "chore(oss): regenerate public lockfiles against public PyPI/npm"
+          git add uv.lock pnpm-lock.yaml
+          git commit -m "chore(oss): regenerate public lockfiles against public PyPI/npmjs.org"
           git push --force "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "$BRANCH"
           # An already-open PR just picks up the force-pushed update.
           if [ -n "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number // empty')" ]; then
@@ -126,7 +150,7 @@ jobs:
           # exempts gh from `set -e`, so a non-zero exit hits the else branch.)
           if gh pr create --base main --head "$BRANCH" \
               --title "chore(oss): regenerate public lockfiles against public PyPI/npm" \
-              --body "Automated: regenerated uv.lock + web/package-lock.json against public PyPI/npm, validated by a Docker build + omnigent --help smoke (run ${{ github.run_id }}). Merge to keep the public lockfiles current and buildable."; then
+              --body "Automated: the lockfiles were out of sync with the manifests, so uv.lock + pnpm-lock.yaml were regenerated against public PyPI/npm and validated by a Docker build + omnigent --help smoke (run ${{ github.run_id }}). Merge to keep the public lockfiles consistent and buildable."; then
             echo "Opened the regen PR."
           else
             echo "::warning::Could not open the regen PR automatically (the GITHUB_TOKEN may be disallowed from creating PRs). The branch '$BRANCH' is pushed with the regenerated lockfiles — open the PR by hand:"

.github/workflows/polly-review.yml

@@ -171,19 +171,26 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Install Codex CLI
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
+          # Install outside the checked-out tree so a repo-root package.json
+          # can't capture this bare `npm install` and hoist it away from here.
+          CODEX_CLI_DIR="${RUNNER_TEMP}/omnigent-codex-cli"
+          mkdir -p "$CODEX_CLI_DIR" && cd "$CODEX_CLI_DIR"
           npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
-          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CODEX_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Set LLM credentials
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
@@ -213,7 +220,11 @@ jobs:
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_ANTHROPIC_MODEL: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
+          OMNIGENT_OPENAI_MODEL: ${{ vars.OMNIGENT_CI_OPENAI_MODEL }}
         run: |
+          : "${OMNIGENT_ANTHROPIC_MODEL:?Set OMNIGENT_CI_ANTHROPIC_MODEL}"
+          : "${OMNIGENT_OPENAI_MODEL:?Set OMNIGENT_CI_OPENAI_MODEL}"
           mkdir -p "$HOME/.omnigent"
           # Use python to write the config safely — avoids interpolating
           # secrets/URLs into a heredoc where special chars could break YAML.
@@ -231,13 +242,13 @@ jobs:
                       'anthropic': {
                           'base_url': gw + '/anthropic',
                           'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-opus-4-8'},
+                          'models': {'default': os.environ['OMNIGENT_ANTHROPIC_MODEL']},
                       },
                       'openai': {
                           'base_url': host + '/ai-gateway/codex/v1',
                           'api_key_ref': 'env:LLM_API_KEY',
                           'wire_api': 'responses',
-                          'models': {'default': 'databricks-gpt-5-5'},
+                          'models': {'default': os.environ['OMNIGENT_OPENAI_MODEL']},
                       },
                   }
               }

.github/workflows/publish-changelog.yml

@@ -75,14 +75,14 @@ jobs:
           echo "dry_run=${dry_run}" >> "$GITHUB_OUTPUT"
 
           is_final=true
-          # Only final vX.Y.Z tags; exclude rc/dev/alpha/beta and the
-          # event's prerelease flag.
+          # Only final vX.Y.Z tags; exclude rcN/devN/preN pre-releases and
+          # the event's prerelease flag.
           case "$tag" in
             v[0-9]*.[0-9]*.[0-9]*) ;;
             *) is_final=false ;;
           esac
           case "$tag" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_final=false ;;
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*) is_final=false ;;
           esac
           if [ "${PRERELEASE}" = "true" ]; then
             is_final=false
@@ -264,6 +264,7 @@ jobs:
           stderr-file: /tmp/format-stderr.log
           gateway-base-url: ${{ secrets.GATEWAY_BASE_URL }}
           llm-api-key: ${{ secrets.LLM_API_KEY }}
+          model: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
 
       - name: Extract narrative post (fall back to raw body)
         if: steps.creds.outputs.available == 'true'
@@ -282,6 +283,130 @@ jobs:
               print("::warning::No RELEASE_POST block parsed — publishing the raw release body.")
           PYEOF
 
+      # Reviewer reference table of the PRs behind each feature and whether each
+      # already ships a demo video, so a human filling the `TODO` demo placeholders
+      # can reuse an existing recording instead of re-recording. Grouped to MATCH
+      # THE POST: when the formatter ran it curated the body down to a few headline
+      # features and emitted a per-feature RELEASE_POST_PRS map — group by that so
+      # the table covers only the PRs behind the features that made the post. With
+      # no map (raw-body fallback), the post keeps every feature, so fall back to
+      # the raw `## Major new features` / `## Breaking changes` sections. Runs
+      # unconditionally (helps the fallback too); best-effort, empty table on error.
+      - name: Build demo-video reference table
+        id: demotable
+        continue-on-error: true
+        working-directory: omnigent
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_REPO: ${{ env.SOURCE_REPO }}
+        run: |
+          set -euo pipefail
+          python3 -u <<'PYEOF'
+          import json, os, pathlib, re, subprocess
+          repo = os.environ["SOURCE_REPO"]
+          body = pathlib.Path("/tmp/release_body.md").read_text(encoding="utf-8", errors="replace")
+
+          # PR refs from the raw body's FEATURE sections, per section — the set of
+          # PRs the table is allowed to name (bug fixes are dropped from the post,
+          # so from the table too), and the fallback grouping when no formatter map.
+          # Match a feature section by its heading TEXT at any level (the release
+          # body uses ### here, older ones ##) — startswith, so "Bug fixes &
+          # hardening" is excluded but "Major new features" matches.
+          FEATURE = ("major new features", "breaking changes")
+          ref_re = re.compile(r"#(\d+)")
+          raw_sections, current, allowed = [], None, set()
+          for ln in body.splitlines():
+              h = re.match(r"#{2,}\s+(.*\S)", ln)
+              if h:
+                  name = h.group(1).strip()
+                  low = name.lower()
+                  current = (name, []) if any(low.startswith(f) for f in FEATURE) else None
+                  if current:
+                      raw_sections.append(current)
+                  continue
+              if current and ln.lstrip().startswith(("-", "*")):
+                  for n in ref_re.findall(ln):
+                      pr = int(n)
+                      allowed.add(pr)
+                      if pr not in current[1]:
+                          current[1].append(pr)
+
+          # Prefer the formatter's curated feature -> PRs map so the table's groups
+          # match the post's numbered features. The formatter is fed injectable PR
+          # prose, so validate: keep only pr_refs that appear in the harvested body.
+          groups = []  # (feature title, [pr, ...])
+          fmt = pathlib.Path("/tmp/format_out.txt")
+          if fmt.is_file():
+              raw = fmt.read_text(encoding="utf-8", errors="replace")
+              mm = re.search(r"<!--\s*RELEASE_POST_PRS\s*-->(.*?)<!--\s*/RELEASE_POST_PRS\s*-->",
+                             raw, re.DOTALL)
+              if mm:
+                  try:
+                      for feat in json.loads(mm.group(1).strip()):
+                          if not isinstance(feat, dict):
+                              continue
+                          title = str(feat.get("title", "")).strip()
+                          prs, seen = [], set()
+                          for r in feat.get("pr_refs", []):
+                              try:
+                                  n = int(r)
+                              except (TypeError, ValueError):
+                                  continue
+                              if n in allowed and n not in seen:
+                                  seen.add(n)
+                                  prs.append(n)
+                          if title and prs:
+                              groups.append((title, prs))
+                  except json.JSONDecodeError as e:
+                      print(f"::warning::Could not parse RELEASE_POST_PRS — falling back to raw sections: {e}")
+          if not groups:
+              print("::notice::No curated feature map — grouping the table by raw release sections.")
+              groups = [(name, prs) for name, prs in raw_sections if prs]
+
+          # Same demo-VIDEO detection as feature-blog.yml: GitHub uploaded-asset
+          # links, bare video URLs, and <video> tags. Images are NOT counted — the
+          # placeholder asks for a recording (a screenshot is a weaker fallback).
+          video_re = re.compile(
+              r"https?://github\.com/user-attachments/assets/[0-9a-f-]+"
+              r"|https?://github\.com/[^/\s)]+/[^/\s)]+/assets/\d+/[0-9a-f-]+"
+              r"|https?://[^\s)]+\.(?:mp4|mov|webm|m4v)\b"
+              r"|<video\b",
+              re.IGNORECASE)
+          def _cell(t):
+              return (t or "").replace("|", "\\|").replace("\n", " ").strip()
+
+          meta_cache = {}
+          def _meta(pr):
+              if pr in meta_cache:
+                  return meta_cache[pr]
+              m = {"title": "", "url": f"https://github.com/{repo}/pull/{pr}", "video": False}
+              try:
+                  d = json.loads(subprocess.run(
+                      ["gh", "pr", "view", str(pr), "--repo", repo,
+                       "--json", "title,body,url"],
+                      capture_output=True, text=True, timeout=60).stdout or "{}")
+                  m["title"] = _cell(d.get("title", ""))
+                  m["url"] = d.get("url") or m["url"]
+                  m["video"] = bool(video_re.search(d.get("body") or ""))
+              except Exception as e:
+                  print(f"::notice::Could not read metadata for PR #{pr}: {e}")
+              meta_cache[pr] = m
+              return m
+
+          out, total = [], 0
+          for name, prs in groups:
+              out += [f"### {_cell(name)}", "", "| PR | Title | Demo video? |",
+                      "| --- | --- | --- |"]
+              for pr in prs:
+                  total += 1
+                  m = _meta(pr)
+                  cell = f"[✅ video]({m['url']})" if m["video"] else "—"
+                  out.append(f"| [#{pr}]({m['url']}) | {m['title']} | {cell} |")
+              out.append("")
+          pathlib.Path("/tmp/demo_table.md").write_text("\n".join(out).rstrip() + ("\n" if out else ""))
+          print(f"Built demo table for {total} PR(s) across {len(groups)} feature(s).")
+          PYEOF
+
       - name: Render the release post to MDX
         working-directory: omnigent
         run: |
@@ -305,6 +430,10 @@ jobs:
             echo '```markdown'; cat /tmp/site_body.md; echo '```'
             echo "### Rendered \`app/releases/${VERSION}/page.mdx\`"
             echo '```mdx'; cat /tmp/site_page/page.mdx; echo '```'
+            if [ -s /tmp/demo_table.md ]; then
+              echo "### Source PRs — demo videos (for the \`TODO\` demo placeholders)"
+              cat /tmp/demo_table.md
+            fi
           } | tee -a "$GITHUB_STEP_SUMMARY"
           echo "Dry-run: no token minted, no PR opened."
 
@@ -354,6 +483,11 @@ jobs:
             exit 0
           fi
           body="$(printf 'Publishes the **%s** release post at `/releases/%s` — the curated GitHub Release notes reformatted into the site'"'"'s narrative, prose-driven style.\n\nGenerated by omnigent `.github/workflows/publish-changelog.yml`. Edit the GitHub Release, not this file.' "$TAG" "$VERSION")"
+          # Append the demo-video reference table: which feature PRs already ship a
+          # recording a reviewer can drop into the post'"'"'s `TODO` demo placeholders.
+          if [ -s /tmp/demo_table.md ]; then
+            body="$(printf '%s\n\n### Source PRs — demo videos\nCheck a ✅ PR for a recording to replace a `TODO` demo placeholder in the post.\n\n%s' "$body" "$(cat /tmp/demo_table.md)")"
+          fi
           gh pr create \
             --repo "$SITE_REPO" \
             --base main \
@@ -435,5 +569,6 @@ jobs:
             /tmp/format-stderr.log
             /tmp/format_out.txt
             /tmp/site_body.md
+            /tmp/demo_table.md
           retention-days: 7
           if-no-files-found: ignore

.github/workflows/release-omnigent.yml

@@ -71,24 +71,21 @@ jobs:
         with:
           enable-cache: false
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       # 1. Build the web UI FIRST into the package tree, clean. Ordering is
       #    load-bearing: the wheel packages on-disk files, so the bundle must
       #    exist before `uv build`. `rm -rf` backstops Vite's emptyOutDir
-      #    against stale bundles; `npm ci` installs the exact locked deps.
-      #    `--legacy-peer-deps` matches how web's lockfile is generated and
-      #    validated everywhere else (lint, e2e-ui, web-tests, the regen
-      #    jobs) — required for the React 19 peer conflict; without it `npm ci`
-      #    rejects the lockfile ("Missing: yaml@1.10.3 from lock file").
+      #    against stale bundles; `pnpm install --frozen-lockfile --filter web`
+      #    installs the exact locked deps for the web workspace package.
       - name: Build web UI (clean, fresh)
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
           rm -rf omnigent/server/static/web-ui
-          npm --prefix web ci --legacy-peer-deps
-          npm --prefix web run build # Vite outDir -> omnigent/server/static/web-ui
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build # Vite outDir -> omnigent/server/static/web-ui
 
       # 2. Tag-driven: the tag must match the version in all three pyprojects
       #    and the core package's `==` sibling-SDK pins, so the lockstep

.github/workflows/release.yml

@@ -11,7 +11,7 @@
 # oss-publish-images.yml) hangs off the tag push.
 #
 # PyPI publishing does NOT happen here — after this run, dispatch the secure
-# release repo on the tag (see RELEASING.md). Everything here is idempotent:
+# release repo on the tag (see the maintainer release runbook). Everything here is idempotent:
 # re-dispatch with identical inputs after any failure and it converges
 # (branch exists -> reused; version stamped -> no new commit; tag at the
 # converged commit -> no-op; tag anywhere else -> loud failure).
@@ -103,13 +103,13 @@ jobs:
           VERSION: ${{ inputs.version }}
         run: |
           set -euo pipefail
-          # Final X.Y.Z or a PEP 440 pre-release (a/b/rc). No dev/post here.
-          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?$ ]]; then
+          # Final X.Y.Z or a PEP 440 pre-release (rc). No dev/post/alpha/beta here.
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$ ]]; then
             echo "::error::Invalid release version: ${VERSION} (expect 0.6.0 or 0.6.0rc1)"; exit 1
           fi
           major="${VERSION%%.*}"; rest="${VERSION#*.}"; minor="${rest%%.*}"
           prerelease=false
-          case "$VERSION" in *a[0-9]*|*b[0-9]*|*rc[0-9]*) prerelease=true ;; esac
+          case "$VERSION" in *rc[0-9]*) prerelease=true ;; esac
           {
             echo "version=${VERSION}"
             echo "tag=v${VERSION}"
@@ -164,7 +164,7 @@ jobs:
               echo "Tag ${TAG} already at the converged release commit ${base_sha} — nothing to do." \
                 | tee -a "$GITHUB_STEP_SUMMARY"
             else
-              echo "::error::Tag ${TAG} already exists at ${tag_sha} (stamped version: ${stamped:-unknown}), which is not the converged branch head ${base_sha}. Delete the tag first if this is recovery (see RELEASING.md)."
+              echo "::error::Tag ${TAG} already exists at ${tag_sha} (stamped version: ${stamped:-unknown}), which is not the converged branch head ${base_sha}. Delete the tag first if this is recovery (see the maintainer release runbook)."
               exit 1
             fi
           fi
@@ -600,6 +600,10 @@ jobs:
             uv run --no-project --python 3.12 --with packaging \
               python scripts/update_versions.py pre-release --new-version "$VERSION"
             uv lock
+            # uv may emit non-canonical lockfile fields (e.g. size on file
+            # entries); normalize like the pre-commit fixer, then hard-verify.
+            python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+            python3 scripts/normalize_uv_lock_registry.py --check uv.lock
           fi
           uv run --no-project --python 3.12 --with packaging \
             python scripts/update_versions.py check --expect "$VERSION"
@@ -615,8 +619,10 @@ jobs:
           git config user.name "omnigent-ci[bot]"
           git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
 
-          git add pyproject.toml sdks/python-client/pyproject.toml sdks/ui/pyproject.toml \
-            omnigent/version.py uv.lock
+          # Stage everything the stamp touched: update_versions.py owns the
+          # file set, and a hand-kept path list here goes stale whenever a
+          # package joins the lockstep (bump-version.yml stages the same way).
+          git add -A
           if git diff --cached --quiet; then
             echo "No version changes to commit (already stamped)."
           else
@@ -639,15 +645,18 @@ jobs:
           {
             echo "## Next steps"
             echo ""
-            echo "1. Dispatch the secure-release repo on this tag:"
+            # Run summaries are world-readable on a public repo, so the
+            # secure-release repo is a placeholder here; the runbook names it.
+            echo "1. Dispatch the secure-release repo on this tag. Substitute the repo"
+            echo "   name from the maintainer release runbook, then run:"
             echo '   ```'
-            echo "   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \\"
+            echo "   gh workflow run omnigent.yml --repo <secure-release-repo> \\"
             echo "     -f ref=${TAG} -f destination=pypi -f dry-run=true    # gates rehearsal"
-            echo "   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \\"
+            echo "   gh workflow run omnigent.yml --repo <secure-release-repo> \\"
             echo "     -f ref=${TAG} -f destination=pypi -f dry-run=false   # real publish"
             echo '   ```'
             if [ "$PRERELEASE" = "true" ]; then
-              echo "2. Validate the rc from PyPI (see RELEASING.md). The GitHub draft for ${TAG} stays unpublished."
+              echo "2. Validate the rc from PyPI (see the maintainer release runbook). No GitHub release is created for rc tags (rcs live on PyPI only) — skip straight to the next rc or the final cut."
             else
               echo "2. Merge the CHANGELOG PR, curate the ${TAG} draft notes, then dispatch finalize-release.yml (tag=${TAG})."
             fi
@@ -657,7 +666,6 @@ jobs:
   # never re-freezes and doc-sync keeps deriving the right X.Y-docs branch.
   bump-main:
     needs: [authorize, plan, cut]
-    if: ${{ !inputs.dry_run && needs.plan.outputs.branch_exists == 'false' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
@@ -667,8 +675,24 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ needs.plan.outputs.version }}
+          DRY_RUN: ${{ inputs.dry_run }}
+          BRANCH_EXISTS: ${{ needs.plan.outputs.branch_exists }}
         run: |
           set -euo pipefail
+          # Gate in shell, not a job-level `if`: a CLI/API dispatch delivers
+          # boolean inputs as the STRING "false", which is truthy in an
+          # expression, so `!inputs.dry_run` silently skipped this job at the
+          # v0.7.0 cut. Shell string comparison is dispatch-channel-proof and
+          # logs its decision instead of vanishing from the run.
+          if [ "$DRY_RUN" = "true" ]; then
+            echo "Dry run — not dispatching the main bump." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          if [ "$BRANCH_EXISTS" != "false" ]; then
+            echo "Release branch pre-existed (not the first cut of this cycle) — main bump not needed." \
+              | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
           # A cut below main's current line (a throwaway rehearsal rc, or
           # resurrecting an old series for a backport) must not walk main's
           # version backwards.

.github/workflows/rerun-ci.yml

@@ -0,0 +1,134 @@
+# A contributor comments `/rerun` on a PR to re-run its failed CI **on the
+# existing head commit** -- no empty commit, no rebase, so no push event and
+# thus no dismissed approvals (branch protection keeps dismiss-stale-reviews
+# on to block approve-then-swap). Use for flaky-test recovery instead of
+# pushing a throwaway commit to re-trigger checks.
+#
+# CI here runs entirely against the in-process mock LLM (no gateway spend), so
+# a re-run costs only Actions minutes; `cancel-in-progress` on each suite caps
+# concurrent burn. Polly AI Review (the one real-LLM path) is gated by
+# maintainer approval elsewhere and is intentionally NOT re-run here.
+#
+# Authorization: the PR author (so fork contributors can re-run their own PR)
+# OR a write-access commenter (OWNER/MEMBER/COLLABORATOR). `issue_comment` runs
+# from the base repo, so its token is writable even for fork PRs and is not
+# held behind the fork-approval gate -- unlike `pull_request_target`, this
+# needs no privileged `workflow_run` relay (cf. rerun-security-gate*.yml).
+name: Rerun CI on /rerun comment
+
+on:
+  issue_comment:
+    types: [created]
+
+# Read-only at the top level; write scopes live on the job below.
+permissions:
+  contents: read
+
+concurrency:
+  # One re-run in flight per PR; a second `/rerun` supersedes the first.
+  group: rerun-ci-${{ github.event.issue.number }}
+  cancel-in-progress: false
+
+jobs:
+  rerun:
+    name: Re-run failed CI for the PR head
+    permissions:
+      actions: write        # gh run rerun
+      pull-requests: read   # resolve the PR head SHA
+      issues: write         # react to the comment + post the result
+    # PR comment, body starts with `/rerun`, not a bot, in this repo, AND the
+    # commenter is the PR author or has write access. `issue.user.login` is the
+    # PR author; `comment.user.login` is the commenter.
+    if: >-
+      github.repository == 'omnigent-ai/omnigent'
+      && github.event.issue.pull_request != null
+      && startsWith(github.event.comment.body, '/rerun')
+      && !endsWith(github.actor, '[bot]')
+      && (
+        github.event.comment.author_association == 'OWNER'
+        || github.event.comment.author_association == 'MEMBER'
+        || github.event.comment.author_association == 'COLLABORATOR'
+        || github.event.comment.user.login == github.event.issue.user.login
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # The job `if` startsWith() also matches `/rerunfoo`; re-validate `/rerun`
+      # as a command (first non-space token is exactly `/rerun`, optional args).
+      - name: Validate command
+        id: cmd
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          if ! grep -qE '^[[:space:]]*/rerun([[:space:]]|$)' <<<"$COMMENT_BODY"; then
+            echo "::notice::Comment mentions '/rerun' but not as a command; skipping."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Acknowledge
+        if: steps.cmd.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/$REPO/issues/comments/$COMMENT_ID/reactions" \
+            -f content=eyes --silent || true
+
+      - name: Re-run failed CI runs for the PR head
+        if: steps.cmd.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          # Integer from the payload, but sanitised to digits before shell use.
+          PR_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          set -euo pipefail
+          PR_NUMBER="$(tr -dc '0-9' <<<"$PR_NUMBER")"
+          [ -n "$PR_NUMBER" ] || { echo "::error::Empty PR number."; exit 1; }
+
+          # Resolve the PR's CURRENT head SHA (a push could have superseded any
+          # SHA recorded at comment time).
+          SHA="$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')"
+          echo "PR #$PR_NUMBER head $SHA"
+
+          # Latest run per workflow for this SHA, restricted to `pull_request`
+          # events -- this is the test-suite set (CI, Lint, E2E, E2E UI,
+          # Integration, Docker build, web Tests). It deliberately EXCLUDES the
+          # merge machinery (Merge Ready, Maintainer Approval, Polly) which run
+          # on pull_request_target / workflow_run / issue_comment, so `/rerun`
+          # never re-triggers a gate or the real-LLM review.
+          mapfile -t FAILED < <(
+            gh api "repos/$REPO/actions/runs?head_sha=$SHA&per_page=100" --paginate \
+              --jq '[.workflow_runs[] | select(.event=="pull_request")]
+                    | group_by(.name)
+                    | map(sort_by(.created_at) | last)
+                    | .[] | select(.conclusion=="failure")
+                    | "\(.id)\t\(.name)"'
+          )
+
+          if [ "${#FAILED[@]}" -eq 0 ]; then
+            echo "No failed pull_request CI runs for $SHA."
+            gh pr comment "$PR_NUMBER" --repo "$REPO" \
+              --body "🔁 \`/rerun\`: no failed CI runs on the current head (\`${SHA:0:7}\`) to re-run. If a check is stuck *pending*, it needs a push or a maintainer, not a re-run."
+            exit 0
+          fi
+
+          RERAN=""
+          while IFS=$'\t' read -r id name; do
+            [ -n "$id" ] || continue
+            echo "• Re-running failed jobs in '$name' (run $id)"
+            # --failed: re-run only the failed jobs (cheapest path for a flake).
+            # --repo is REQUIRED: this job has no checkout, so `gh run rerun`
+            # cannot infer the repo from a git remote and would fail client-side.
+            if gh run rerun "$id" --repo "$REPO" --failed; then
+              RERAN="$RERAN"$'\n'"- $name"
+            else
+              echo "::warning::Could not re-run '$name' (run $id) -- may be in progress."
+              RERAN="$RERAN"$'\n'"- $name ⚠️ (skipped: already running or not re-runnable)"
+            fi
+          done < <(printf '%s\n' "${FAILED[@]}")
+
+          NOTE="The \`Merge Ready\` gate re-evaluates automatically when these complete."
+          gh pr comment "$PR_NUMBER" --repo "$REPO" \
+            --body "🔁 \`/rerun\`: re-running failed jobs on \`${SHA:0:7}\`:${RERAN}"$'\n\n'"$NOTE"

.github/workflows/security-triage.yml

@@ -195,10 +195,14 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Write gateway profile (~/.databrickscfg)
         if: steps.creds.outputs.available == 'true'
@@ -222,7 +226,9 @@ jobs:
         if: steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_AGENT_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
         run: |
+          : "${OMNIGENT_AGENT_MODEL:?Set OMNIGENT_CI_FAST_ANTHROPIC_MODEL}"
           mkdir -p "$HOME/.omnigent"
           python3 -c "
           import pathlib, os, json
@@ -235,7 +241,7 @@ jobs:
                       'anthropic': {
                           'base_url': gw + '/anthropic',
                           'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-sonnet-4-6'},
+                          'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
                       },
                   }
               }

.github/workflows/server-compat.yml

@@ -4,7 +4,7 @@ name: Backwards-Compat
 # suites, over the FULL pairwise (server, runner) version matrix.
 #
 # The version universe is `main` (the checked-out code = client + tests, always)
-# plus every non-rc release tag; we cross every server version with every runner
+# plus every final (non-prerelease) release tag; we cross every server version with every runner
 # version. Each cell pins the server and/or runner subprocess to that build
 # (a "main" axis value leaves that component on the checked-out code) while the
 # client and tests stay on main. The (main, main) cell is omitted — it pins
@@ -18,13 +18,13 @@ name: Backwards-Compat
 #
 # Triggers:
 #   workflow_dispatch   manual; optional `versions` CSV overrides the set.
-#   schedule            every 12h; full pairwise over main + all non-rc tags.
+#   schedule            every 12h; full pairwise over main + all final tags.
 
 on:
   workflow_dispatch:
     inputs:
       versions:
-        description: "Comma-separated version set for BOTH axes (e.g. 'main,v0.2.0'). Empty = main + all non-rc tags."
+        description: "Comma-separated version set for BOTH axes (e.g. 'main,v0.2.0'). Empty = main + all final (non-prerelease) tags."
         required: false
         default: ""
   schedule:

.github/workflows/sync-pr-priority.yml

@@ -0,0 +1,118 @@
+name: Sync PR Priority
+
+# Mirrors a linked issue's priority label (P0-P3) onto the PR that closes it.
+# Only closing links (closes/fixes/resolves #n) count -- a plain "related to
+# #n" mention is ignored. Runs on PR events and re-syncs when an issue's labels
+# change. Uses only default-branch code and never checks out or executes PR
+# files; it edits labels through the API.
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+      - ready_for_review
+  issues:
+    types:
+      - labeled
+      - unlabeled
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to sync"
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sync-pr-priority-${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    # On issue label events, only react when the changed label is a priority
+    # (P0-P3) label; other label edits (Bug, triaged, ...) never affect sync.
+    if: >-
+      github.repository == 'omnigent-ai/omnigent' &&
+      (github.event_name != 'issues' ||
+       contains(fromJSON('["P0-critical", "P1-high", "P2-medium", "P3-low"]'), github.event.label.name))
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Checkout default-branch script
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/scripts/sync_pr_priority.py
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      # For issue label events, find open PRs that close this issue so we can
+      # re-sync each of them. For PR / dispatch events we already know the PR.
+      - name: Resolve PR numbers to sync
+        id: resolve
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_FROM_PR: ${{ github.event.pull_request.number }}
+          PR_FROM_DISPATCH: ${{ github.event.inputs.pr_number }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${EVENT_NAME}" == "issues" ]]; then
+            # Only relevant when a priority label was (un)set on the issue.
+            # On lookup failure, warn and treat as no PRs rather than failing
+            # the whole workflow.
+            if ! prs=$(
+              gh api graphql -f query='
+                query($owner:String!,$name:String!,$number:Int!){
+                  repository(owner:$owner,name:$name){
+                    issue(number:$number){
+                      closedByPullRequestsReferences(first:50, includeClosedPrs:false){
+                        nodes { number }
+                      }
+                    }
+                  }
+                }' \
+                -f owner="${REPO%/*}" -f name="${REPO#*/}" -F number="${ISSUE_NUMBER}" \
+                --jq '.data.repository.issue.closedByPullRequestsReferences.nodes[].number'
+            ); then
+              echo "::warning::Failed to resolve PRs closing issue #${ISSUE_NUMBER}; skipping sync."
+              prs=""
+            fi
+          elif [[ "${EVENT_NAME}" == "workflow_dispatch" ]]; then
+            prs="${PR_FROM_DISPATCH}"
+          else
+            prs="${PR_FROM_PR}"
+          fi
+
+          echo "prs<<EOF" >> "${GITHUB_OUTPUT}"
+          echo "${prs}" >> "${GITHUB_OUTPUT}"
+          echo "EOF" >> "${GITHUB_OUTPUT}"
+
+      - name: Sync priority labels
+        if: steps.resolve.outputs.prs != ''
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          PRS: ${{ steps.resolve.outputs.prs }}
+        run: |
+          set -euo pipefail
+          while read -r pr; do
+            [[ -z "${pr}" ]] && continue
+            echo "Syncing PR #${pr}"
+            PR_NUMBER="${pr}" python3 .github/scripts/sync_pr_priority.py
+          done <<< "${PRS}"

.github/workflows/ui-preview.yml

@@ -106,7 +106,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
         with:
           enable-cache: true
-      - uses: ./.github/actions/setup-node
+      - uses: ./.github/actions/setup-pnpm
 
       - name: Build wheels (no UI)
         # Build the wheels WITHOUT the SPA so they stay small (Databricks Apps
@@ -120,10 +120,11 @@ jobs:
         run: bash deploy/databricks/build.sh
 
       - name: Build UI
-        working-directory: web
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Package UI assets
         run: |

.github/workflows/ui-snapshot-update.yml

@@ -80,8 +80,18 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
           persist-credentials: false
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      # The pinned Playwright image doesn't ship Node, so install Node before
+      # the pnpm action (pnpm/action-setup's self-installer needs a Node binary).
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.15.1
+          standalone: true
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -106,9 +116,8 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Compare the baselines (no --update-snapshots)
         # Deliberately NOT --update-snapshots: that rewrites EVERY PNG, churning

.github/workflows/ui-snapshot.yml

@@ -95,7 +95,7 @@ jobs:
           if ! files=$(gh api "repos/$REPO/pulls/$PR/files" --paginate --jq '.[].filename'); then
             echo "ui=true" >> "$GITHUB_OUTPUT"; echo "file list unavailable -> render"; exit 0
           fi
-          pattern='^(web/|tests/e2e_ui/visual/|tests/e2e_ui/conftest\.py|\.github/actions/setup-node/|\.github/workflows/ui-snapshot\.yml|pyproject\.toml|uv\.lock)'
+          pattern='^(web/|tests/e2e_ui/visual/|tests/e2e_ui/conftest\.py|\.github/actions/setup-pnpm/|\.github/workflows/ui-snapshot\.yml|pnpm-lock\.yaml|pnpm-workspace\.yaml|pyproject\.toml|uv\.lock)'
           if printf '%s\n' "$files" | grep -qE "$pattern"; then
             echo "ui=true" >> "$GITHUB_OUTPUT"
             echo "render-affecting files changed:"
@@ -106,7 +106,7 @@ jobs:
           fi
 
   ui-snapshot:
-    name: UI Snapshot (visual baselines) [non-blocking]
+    name: UI Snapshot (visual baselines)
     needs: detect
     # Skipped (not failed) when no render input changed -> reports SUCCESS, so a
     # non-UI PR neither runs the render nor blocks a required check.
@@ -130,8 +130,18 @@ jobs:
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      # The pinned Playwright image doesn't ship Node, so install Node before
+      # the pnpm action (pnpm/action-setup's self-installer needs a Node binary).
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.15.1
+          standalone: true
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -156,14 +166,12 @@ jobs:
 
       - name: Build web SPA
         # Build BEFORE pytest: Vite's emptyOutDir clobbers the static dir, so
-        # never run it alongside the live server. --legacy-peer-deps avoids
-        # re-resolving the known React 19 peer conflict under @emoji-mart/react.
+        # never run it alongside the live server.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Compare (PR) or regenerate (dispatch) the visual snapshots
         id: snapshot

.github/workflows/update-homebrew.yml

@@ -1,247 +0,0 @@
-# Open the omnigent-ai/homebrew-tap version-bump PR when a FINAL release is
-# published (designs/RELEASE-AUTOMATION.md). This is the missing link that let
-# the tap freeze while PyPI moved on: the tap already builds bottles on every
-# PR (brew test-bot) and publishes them on the `pr-pull` label — nobody was
-# opening the bump PR.
-#
-# What it does: wait for the new sdist on PyPI, rewrite the formula's
-# url/sha256 (dropping any bottle `revision`), regenerate the pinned Python
-# resources with `brew update-python-resources`, sanity-check that the
-# hand-maintained sections survived, and open the tap PR. A human reviews the
-# resource diff and applies `pr-pull`; the tap's own automation bottles and
-# merges. The omnigent-desktop cask is `version :latest` and needs nothing.
-#
-# Pre-releases never reach the tap. The `release: published` trigger fires
-# from finalize-release.yml's App-token publish; `workflow_dispatch` covers
-# retries and catch-up (e.g. jumping the formula straight to the newest
-# version after a missed cycle).
-name: Update Homebrew tap
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Final release tag to bump the tap to, e.g. v0.6.0."
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: update-homebrew-${{ github.event.release.tag_name || inputs.tag }}
-  cancel-in-progress: false
-
-jobs:
-  resolve:
-    name: Resolve release tag
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      tag: ${{ steps.r.outputs.tag }}
-      is_final: ${{ steps.r.outputs.is_final }}
-    steps:
-      - name: Resolve tag and finality
-        id: r
-        env:
-          EVENT_TAG: ${{ github.event.release.tag_name }}
-          PRERELEASE: ${{ github.event.release.prerelease }}
-          INPUT_TAG: ${{ inputs.tag }}
-        run: |
-          set -euo pipefail
-          tag="${INPUT_TAG:-$EVENT_TAG}"
-          is_final=true
-          case "$tag" in
-            v[0-9]*.[0-9]*.[0-9]*) ;;
-            *) is_final=false ;;
-          esac
-          case "$tag" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_final=false ;;
-          esac
-          if [ "${PRERELEASE}" = "true" ]; then
-            is_final=false
-          fi
-          {
-            echo "tag=${tag}"
-            echo "is_final=${is_final}"
-          } >> "$GITHUB_OUTPUT"
-          echo "Resolved tag=${tag} is_final=${is_final}" | tee -a "$GITHUB_STEP_SUMMARY"
-
-  bump:
-    name: Open tap bump PR
-    needs: resolve
-    # Canonical repo only; skip cleanly where the App isn't configured. The
-    # release-event path is already gated by finalize-release's environment
-    # approval; only manual dispatches need the role check below.
-    if: >-
-      needs.resolve.outputs.is_final == 'true' &&
-      github.repository == 'omnigent-ai/omnigent' &&
-      vars.OMNIGENT_BOT_APP_ID != ''
-    # macOS: `brew update-python-resources` evaluates the formula (with its
-    # on_macos blocks) in a real Homebrew.
-    runs-on: macos-latest
-    timeout-minutes: 30
-    env:
-      TAG: ${{ needs.resolve.outputs.tag }}
-      TAP_REPO: ${{ github.repository_owner }}/homebrew-tap
-    steps:
-      - name: Require admin/maintain role (manual dispatches)
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ACTOR: ${{ github.actor }}
-        run: |
-          set -euo pipefail
-          role="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq .role_name)"
-          case "$role" in
-            admin|maintain)
-              echo "Dispatcher ${ACTOR} has role ${role} — authorized." ;;
-            *)
-              echo "::error::Release workflows require the admin or maintain role (dispatcher ${ACTOR} has '${role}')."
-              exit 1 ;;
-          esac
-
-      - name: Wait for the sdist on PyPI
-        id: sdist
-        run: |
-          set -euo pipefail
-          version="${TAG#v}"
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-          for _ in $(seq 1 30); do
-            if json="$(curl -fsS "https://pypi.org/pypi/omnigent/${version}/json" 2>/dev/null)"; then
-              url="$(printf '%s' "$json" | jq -r '.urls[] | select(.packagetype == "sdist") | .url')"
-              sha="$(printf '%s' "$json" | jq -r '.urls[] | select(.packagetype == "sdist") | .digests.sha256')"
-              if [ -n "$url" ] && [ -n "$sha" ]; then
-                {
-                  echo "url=${url}"
-                  echo "sha=${sha}"
-                } >> "$GITHUB_OUTPUT"
-                echo "sdist for ${version}: ${url}"
-                exit 0
-              fi
-            fi
-            echo "omnigent==${version} not visible on PyPI yet — retrying in 20s…"
-            sleep 20
-          done
-          echo "::error::omnigent==${version} never appeared on PyPI (is the secure-repo publish done?)."
-          exit 1
-
-      - name: Mint App token (homebrew-tap)
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
-          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: homebrew-tap
-
-      - name: Checkout the tap
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: ${{ env.TAP_REPO }}
-          token: ${{ steps.app-token.outputs.token }}
-          path: tap
-          persist-credentials: false
-
-      - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@18fcb8e3e06b4247c676c506750dc95ea7226479 # 2026-07-10
-        with:
-          token: ${{ github.token }}
-
-      - name: Rewrite the formula's stable url/sha256
-        working-directory: tap
-        env:
-          SDIST_URL: ${{ steps.sdist.outputs.url }}
-          SDIST_SHA: ${{ steps.sdist.outputs.sha }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PYEOF'
-          import os, pathlib, re
-          path = pathlib.Path("Formula/omnigent.rb")
-          text = path.read_text(encoding="utf-8")
-          # The formula's own url/sha256 sit at 2-space indent; resource and
-          # bottle entries are deeper, so first-match at this indent is safe.
-          text, n_url = re.subn(r'(?m)^  url ".*"$', f'  url "{os.environ["SDIST_URL"]}"', text, count=1)
-          text, n_sha = re.subn(r'(?m)^  sha256 ".*"$', f'  sha256 "{os.environ["SDIST_SHA"]}"', text, count=1)
-          text, _ = re.subn(r'(?m)^  revision \d+\n', "", text, count=1)
-          assert n_url == 1 and n_sha == 1, f"unexpected formula shape (url={n_url}, sha={n_sha})"
-          path.write_text(text, encoding="utf-8")
-          PYEOF
-          git diff --stat
-
-      - name: Regenerate the pinned Python resources
-        env:
-          HOMEBREW_NO_AUTO_UPDATE: "1"
-          HOMEBREW_NO_INSTALL_FROM_API: "1"
-        run: |
-          set -euo pipefail
-          # Make the checkout visible to brew as the real tap.
-          tap_root="$(brew --repository)/Library/Taps/omnigent-ai"
-          mkdir -p "$tap_root"
-          ln -sfn "${GITHUB_WORKSPACE}/tap" "${tap_root}/homebrew-tap"
-          # Excluded packages stay hand-maintained in the formula: the brewed
-          # deps (certifi/cryptography/pydantic/rpds-py and their transitive
-          # cffi/pycparser) and the platform-conditional google-antigravity
-          # wheel stanzas.
-          brew update-python-resources \
-            --exclude-packages=certifi,cryptography,pydantic,rpds-py,cffi,pycparser,google-antigravity \
-            omnigent-ai/tap/omnigent
-          brew style omnigent-ai/tap/omnigent
-
-      - name: Assert the hand-maintained sections survived
-        working-directory: tap
-        run: |
-          set -euo pipefail
-          fail=0
-          for needle in 'resource "google-antigravity"' 'depends_on "pydantic"' 'depends_on "cryptography"'; do
-            if ! grep -qF "$needle" Formula/omnigent.rb; then
-              echo "::error::update-python-resources dropped: ${needle} — fix the formula by hand this cycle."
-              fail=1
-            fi
-          done
-          [ "$fail" -eq 0 ]
-          # The lockstep siblings must have moved with the release. Match the
-          # sdist filename (PEP 503-normalized name + version) in the resource
-          # url, not a bare version substring.
-          version="${TAG#v}"
-          for sib in omnigent-client omnigent-ui-sdk; do
-            if ! grep -A2 "resource \"${sib}\"" Formula/omnigent.rb | grep -q "${sib//-/_}-${version}"; then
-              echo "::error::resource ${sib} did not update to ${version}."
-              exit 1
-            fi
-          done
-
-      - name: Open or update the tap bump PR
-        working-directory: tap
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          VERSION: ${{ steps.sdist.outputs.version }}
-        run: |
-          set -euo pipefail
-          if [ -z "$(git status --porcelain -- Formula/omnigent.rb)" ]; then
-            echo "Formula already at ${VERSION} — nothing to do." | tee -a "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-          BRANCH="bump-omnigent-${VERSION}"
-          git config user.name "omnigent-ci[bot]"
-          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
-          PUSH_URL="https://x-access-token:${GH_TOKEN}@github.com/${TAP_REPO}.git"
-          git switch -C "$BRANCH"
-          git add Formula/omnigent.rb
-          git commit -m "omnigent ${VERSION}"
-          git push --force "$PUSH_URL" "$BRANCH"
-
-          if [ -n "$(gh pr list --repo "$TAP_REPO" --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
-            echo "Bump PR already open for ${BRANCH} — force-push updated it." | tee -a "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-          body="$(printf 'Bumps the omnigent formula to **%s** (new sdist url/sha256, resources regenerated via `brew update-python-resources`).\n\ntest-bot builds the bottles on this PR. Review the resource diff — especially that the extras'"'"' deps survived — then apply the `pr-pull` label to publish bottles and merge.\n\nOpened by omnigent `.github/workflows/update-homebrew.yml`.' "$VERSION")"
-          gh pr create \
-            --repo "$TAP_REPO" \
-            --base main \
-            --head "$BRANCH" \
-            --title "omnigent ${VERSION}" \
-            --body "$body"
-          echo "Opened tap bump PR for omnigent ${VERSION}." | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/vscode-extension-release.yml

@@ -9,8 +9,8 @@
 # match the input), so the tag and the packaged version can't diverge.
 #
 # This produces the ARTIFACT ONLY — it does NOT publish to the VS Code
-# Marketplace or Open VSX. That runs from the central secure-release repo
-# (databricks/secure-public-registry-releases-eng), on hardened runners, where
+# Marketplace or Open VSX. That runs from a Databricks-internal secure-release
+# repo, on hardened runners, where
 # a workflow downloads this `.vsix`, verifies its `.sha256`, scans it, and
 # publishes. Keeping the two halves separate is deliberate: this job only
 # builds and uploads; the secured half holds the marketplace tokens and scan
@@ -68,15 +68,16 @@ jobs:
         with:
           ref: release/vscode-v${{ inputs.version }}
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install, build, and package
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm ci
-          npm run build
-          npm run package
+          pnpm install --frozen-lockfile --filter omnigent-vscode
+          pnpm --filter omnigent-vscode run build
+          pnpm --filter omnigent-vscode run package
 
       - name: Resolve tag and verify package.json version
         id: meta

.github/workflows/vscode-release-pr.yml

@@ -62,6 +62,9 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
+
       - name: Validate version
         env:
           VERSION: ${{ inputs.version }}
@@ -80,10 +83,10 @@ jobs:
         working-directory: editors/vscode
         env:
           VERSION: ${{ inputs.version }}
-        # `npm pkg set` edits ONLY package.json (unlike `npm version`, which also
-        # rewrites package-lock.json). Keeps the release PR to package.json +
+        # `pnpm pkg set` edits ONLY package.json (unlike `pnpm version`, which
+        # also rewrites the lockfile). Keeps the release PR to package.json +
         # CHANGELOG.md.
-        run: npm pkg set version="$VERSION"
+        run: pnpm pkg set version="$VERSION"
 
       - name: Add the CHANGELOG section (placeholder)
         working-directory: editors/vscode
@@ -167,6 +170,7 @@ jobs:
         env:
           LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          DRAFTER_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
           VERSION: ${{ inputs.version }}
         run: |
           set -euo pipefail
@@ -174,6 +178,10 @@ jobs:
             echo "::warning::No LLM credentials — keeping the CHANGELOG placeholder."
             exit 0
           fi
+          if [ -z "${DRAFTER_MODEL:-}" ]; then
+            echo "::warning::Repository variable OMNIGENT_CI_FAST_ANTHROPIC_MODEL is empty — keeping the CHANGELOG placeholder."
+            exit 0
+          fi
           echo "::add-mask::${LLM_API_KEY}"
           python3 - "$VERSION" <<'PY'
           import json, os, re, pathlib, sys, urllib.request
@@ -201,7 +209,7 @@ jobs:
 
           url = os.environ["GATEWAY_BASE_URL"].rstrip("/") + "/chat/completions"
           payload = json.dumps({
-              "model": "databricks-claude-sonnet-4-6",
+              "model": os.environ["DRAFTER_MODEL"],
               "max_tokens": 1024,
               "temperature": 0,
               "messages": [

.github/workflows/waiting-on-author-test.yml

@@ -0,0 +1,31 @@
+name: Waiting on Author Test
+
+# Offline unit test for waiting-on-author hygiene. Runs on PR head without
+# secrets or network and only when the workflow logic changes.
+
+on:
+  pull_request:
+    paths:
+      - .github/scripts/waiting_on_author.py
+      - .github/scripts/waiting_on_author_test.py
+      - .github/workflows/waiting-on-author.yml
+      - .github/workflows/waiting-on-author-test.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: waiting-on-author-test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run waiting-on-author unit test
+        run: python3 .github/scripts/waiting_on_author_test.py

.github/workflows/waiting-on-author.yml

@@ -0,0 +1,46 @@
+name: Waiting on Author Hygiene
+
+# Keeps the `waiting-on-author` PR label actionable: author activity clears it,
+# and PRs that sit in that state for 7 days are closed. The workflow runs from
+# trusted default-branch code and never checks out PR-authored files.
+
+on:
+  pull_request_target:
+    types: [synchronize]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+  schedule:
+    - cron: "0 */12 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: waiting-on-author-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  hygiene:
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Check out .github
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github
+          persist-credentials: false
+      - name: Update waiting-on-author state
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: python3 .github/scripts/waiting_on_author.py

.github/workflows/web-tests.yml

@@ -24,14 +24,14 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Security precondition gate: npm ci/test runs the PR's own install hooks and
+  # Security precondition gate: pnpm install/test runs the PR's own install hooks and
   # test code, so untrusted PRs are held until the scan passes (security-gate.yml).
   # Trusted authors and non-PR events pass through.
   gate:
     uses: ./.github/workflows/security-gate.yml
 
-  npm-test:
-    name: npm test
+  web-test:
+    name: web test
     needs: gate
     if: ${{ !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
@@ -41,31 +41,29 @@ jobs:
       - name: Check out repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - name: Set up Node.js
-        uses: ./.github/actions/setup-node
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install dependencies
-        working-directory: web
-        # Pin the npm registry to the npmjs default.
+        # Pin the npm registry to the npmjs default; limit to the web package
+        # so the Electron package's large native devDependencies are not fetched.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
-        run: npm ci --legacy-peer-deps
+        run: pnpm install --frozen-lockfile --filter web
 
       - name: Check formatting
-        working-directory: web
-        run: npm run format:check
+        run: pnpm --filter web run format:check
 
       - name: Run tests with coverage
-        working-directory: web
-        run: npm run test:coverage
+        run: pnpm --filter web run test:coverage
 
       # Distill the v8 json-summary into a single total.txt, mirroring the
       # backend's coverage-report job. ui-code-coverage.yml (privileged
       # workflow_run) consumes this artifact and posts the report-only status.
       - name: Summarize coverage
         if: always()
-        working-directory: web
         run: |
+          cd web
           mkdir -p ui-coverage-summary
           if [[ ! -f coverage/coverage-summary.json ]]; then
             echo "::warning::No coverage-summary.json; skipping UI coverage report."

.gitignore

@@ -2,6 +2,8 @@
 build/
 dist/
 node_modules/
+.pnpm-store/
+.pnpm-debug.log*
 reviews/
 
 # Generated artifact; never committed.

.pre-commit-config.yaml

@@ -1,6 +1,5 @@
-# Pre-commit hooks for this repository: ruff (format + check) plus standard
-# file-hygiene checks. Heavier validation (typing, lockfile freshness,
-# OpenAPI drift) runs in CI rather than as commit-time hooks.
+# Pre-commit hooks for this repository: ruff, Pyrefly, project-specific lint,
+# and standard file-hygiene checks.
 #
 # A built web-UI bundle may be committed at this path (vendored, minified
 # JS/CSS) — never lint or "fix" it.
@@ -20,6 +19,13 @@ repos:
         entry: .venv/bin/python -m ruff check --fix --force-exclude
         types: [python]
 
+      - id: pyrefly
+        name: pyrefly
+        language: system
+        entry: .venv/bin/pyrefly check
+        pass_filenames: false
+        files: ^(omnigent/.*\.pyi?|sdks/python-client/.*\.py|pyproject\.toml|pyrefly\.toml|uv\.lock)$
+
       # Project-specific test-quality lint rules (dev/lint/). Run on test
       # files only — the patterns never occur in production code.
       - id: no-global-asyncio-patch
@@ -36,16 +42,45 @@ repos:
         types: [python]
         files: ^tests/
 
+      - id: no-hardcoded-models
+        name: no new hardcoded LLM model ids
+        language: system
+        entry: .venv/bin/python dev/lint/lint_no_hardcoded_models.py
+        pass_filenames: false
+        files: \.(py|ya?ml|json|toml|sh)$
+        exclude: (^|/)tests/|^openapi\.json$
+
       - id: web-prettier
         name: web prettier
         language: system
-        entry: npm --prefix web exec -- prettier --write
+        entry: bash -c 'test -x web/node_modules/.bin/prettier && web/node_modules/.bin/prettier --write "$@"' --
         files: ^web/.*\.(css|html|js|jsx|json|md|mdx|ts|tsx|yaml|yml)$
         # Exclude generated assets: web-ui build output, Xcode asset catalogs,
         # and Apple Icon Composer `.icon` bundles (machine-formatted; prettier
         # fights the tooling).
         exclude: ^(omnigent/server/static/web-ui/assets/|web/.*\.xcassets/|web/.*\.icon/)
 
+      - id: web-oxlint
+        name: web oxlint
+        language: system
+        entry: bash -c 'test -x web/node_modules/.bin/oxlint && cd web && node_modules/.bin/oxlint --deny-warnings --report-unused-disable-directives .'
+        files: ^(web/.*\.[cm]?[jt]sx?|web/\.oxlintrc\.json|web/package\.json|pnpm-lock\.yaml)$
+        pass_filenames: false
+
+      - id: web-tsc
+        name: web TypeScript type check
+        language: system
+        entry: bash -c 'test -x web/node_modules/.bin/tsc && cd web && node_modules/.bin/tsc -b'
+        files: ^(web/.*\.[cm]?[jt]sx?|web/tsconfig(?:\.[^.]+)?\.json|web/package\.json|pnpm-(?:lock|workspace)\.yaml)$
+        pass_filenames: false
+
+      - id: vscode-tsc
+        name: VS Code extension TypeScript type check
+        language: system
+        entry: bash -c 'test -x editors/vscode/node_modules/.bin/tsc && cd editors/vscode && node_modules/.bin/tsc --noEmit'
+        files: ^(editors/vscode/.*\.[cm]?[jt]sx?|editors/vscode/tsconfig\.json|editors/vscode/package\.json|pnpm-(?:lock|workspace)\.yaml)$
+        pass_filenames: false
+
       # Android Kotlin formatting + linting via ktlint (config:
       # web/android/.editorconfig). The wrapper no-ops when ktlint is absent,
       # so local machines without ktlint installed skip cleanly. CI installs
@@ -105,20 +140,6 @@ repos:
         files: ^uv\.lock$
         pass_filenames: true
 
-      # Local `npm install` rewrites every `resolved` URL in
-      # package-lock.json to whatever registry is configured on the
-      # developer's machine (e.g. the Databricks npm proxy via a global
-      # ~/.npmrc). This OSS repo must always commit the public npm registry
-      # (registry.npmjs.org), so normalize it back before it lands — a
-      # proxy URL would make `npm ci` time out on public CI runners. Fixer:
-      # re-stage if it changes. Mirrors normalize-uv-lock-registry above.
-      - id: normalize-package-lock-registry
-        name: normalize package-lock.json registry to npmjs.org
-        language: system
-        entry: .venv/bin/python scripts/normalize_package_lock_registry.py
-        files: ^(web|web/electron|editors/vscode)/package-lock\.json$
-        pass_filenames: true
-
       # Fail if routing.proto changed without regenerating the committed
       # bindings (or vice versa). Verify-only, not a fixer: regen needs
       # grpcio-tools, so CI's `uv sync --extra dev` enforces it (like ktlint).

AGENTS.md

@@ -9,6 +9,17 @@ Run the `pre-commit` hook before committing (`pre-commit run --all-files`, or
 let it run on staged files via `git commit`). Fix any issues it reports so the
 commit lands clean — CI runs the same checks.
 
+## Local development shortcuts
+
+Use `just` for common tasks; run `just --list` for grouped recipes.
+
+- `just ensure` — install/check prerequisites
+- `just run-ios` / `just run-android` — build/run mobile apps
+- `just dev` / `just dev-mobile` — start the omnigent dev pod
+- `just electron-dev` / `just electron-build` — Electron desktop shell
+- `just lint` / `just lint-all` — run pre-commit
+- `just normalize-locks` — rewrite lockfile registries to PyPI/npmjs.org
+
 ## Pull requests
 
 When you open a pull request, fill in the repo's PR template at
@@ -56,6 +67,15 @@ Keep comments short and focused on the code, not on the change history.
   issue numbers, or ticket IDs (e.g. `#1646`, `fixes JIRA-123`); the scenario
   should be clear without chasing external links.
 
+## Database query names
+
+Application stores use `make_named_managed_session_maker` and give every
+session a stable semantic operation name. The session-level name must describe
+the caller's intent rather than repeat SQL syntax; use a nested
+`query_name_scope` only when one transaction needs distinct names for important
+subqueries. Because the named session covers implicit flush and commit, don't
+add an explicit `flush()` only to make a query name observable.
+
 ## Framework-owned instructions
 
 Keep runtime lifecycle and metadata instructions separate from portable agent

CHANGELOG.md

@@ -5,12 +5,476 @@ generated at release time from each PR's `## Changelog` section, tagged by the
 PR's `Type of change` (e.g. `[UI]`); the concise, curated highlights live on the
 website under `/releases`.
 
-## [Unreleased]
+## [v0.8.1] — 2026-08-03
 
-### Features
+- [UI] Reverted the v0.8.0 "Chat/Terminal switcher in the header" change; the
+  switcher returns to its previous location. (#3931)
 
-- [UI / Feature] Added a Nord color theme (arctic frost-blue palette) to the Appearance settings palette picker.
-- [Feature] Per-harness startup command/args overrides via a polymorphic `harness:` key in `config.yaml`. The `harness:` key now accepts a mapping with a `default` plus per-harness `command`/`args` overrides (e.g. `harness: {default: claude-sdk, codex: {command: /usr/local/bin/codex, args: [--config, approval_policy=on-request]}}`). The legacy scalar form (`harness: claude-sdk`) still works and auto-migrates to the mapping form on the next config write. Harness binary-path precedence: `OMNIGENT_<NAME>_PATH` env var > config `harness.<id>.command` > built-in default; `args` follow the same precedence with config `args` as the base and CLI pass-through args appended. The `OMNIGENT_<NAME>_PATH` env var (base id, `-native` suffix stripped) is the canonical per-binary override, standardizing the headless `HARNESS_<NAME>_PATH` and native `OMNIGENT_*_PATH` conventions into one namespaced name; the legacy `HARNESS_<NAME>_PATH` is still read as a deprecated fallback that logs a one-time warning + a CLI startup notice, and is slated for removal in v0.8.0. The pre-existing `omnigent claude --command` flag is deprecated (warns on use, pointing to `OMNIGENT_CLAUDE_PATH`/config) and will be removed in a future release; no other native command gained a `--command` flag — override via env or config.
+## [v0.8.0] — 2026-08-03
+
+- [Bug fix] Cursor YOLO sessions no longer stall piloted parents on mirrored tool-approval cards when Cursor leaves a lingering pending gate. (#2338)
+- [Feature] codex-native startup-timeout errors now name the resolved provider/model routing (and the login-fallback case) instead of pointing at the runner log (#2843)
+- [UI / Bug fix / Feature] Pi can now create task plans and display them in the shared Tasks panel without requiring an optional Pi extension. (#2884)
+- [Feature] `detect_loop` builtin policy catches agents stuck retrying the same tool call and prompts for approval to break the loop (#3158)
+- [Feature] New `detect_thrashing` builtin policy detects when an agent is stuck in a failure loop and alerts the user to intervene. (#3160)
+- [Bug fix] kimi sub-agents now report completion to a parent orchestrator instead of leaving the fan-out waiting forever. (#3166)
+- [UI / Bug fix / Chore / Test/CI] Conversations show their newest messages immediately, pin the latest turn below the header, and load older context smoothly near the top. (#3228)
+- [Docs / Chore / Breaking] The `run_<x>_native` launchers accept a uniform `extra_args`; the per-harness `<x>_args` keyword is deprecated and will be removed in 0.9.0. (#3244)
+- [Bug fix] Intelligent routing no longer drops the first message on a new claude-native session (#3257)
+- [Feature] `linux_bwrap` sandboxes and their egress rules now run on the Databricks Lakebox backend. (#3258)
+- [Feature] `sandbox.kubernetes.secret_mounts` projects a Secret as a rotation-friendly read-only file volume on the runner (#3280)
+- [Bug fix] Session cost panel now shows a per-model breakdown for sub-agents/second heads (e.g. Debby's GPT head, Polly's codex sub-agents) running on an unpinned codex model, instead of folding their usage into the total with no per-model entry. (#3287)
+- [Bug fix] Fix `antigravity-native` readiness detection for `agy` CLI installs on macOS where OAuth credentials live in Keychain (#3289)
+- [Bug fix] Fixed a race condition where deleting two admins at nearly the same time could leave a deployment with zero admins and no way to recover through the API. (#3304)
+- [Docs / Chore] Resuming a goose / hermes / antigravity / qwen / opencode native session now attaches to the live TUI instead of double-posting each message through the Omnigent REPL. (#3314)
+- [UI / Feature] Workspace rail now shows files and shells as editor-style tabs, opens shells in-rail instead of replacing the chat, adds a full-screen toggle, and adds a "+" menu for creating shells with a remembered type picker (#3333)
+- [UI / Bug fix / Feature / Test/CI] `omnigent setup` can import OpenClaw/acpx coding agents from an auto-detected or user-selected config into the generic ACP harness picker, and `omnigent run --from-openclaw <agent>` can try one without saving it. (#3354)
+- [Feature] Polly can launch supported Claude and Codex implementation children in goal mode. (#3362)
+- [Bug fix] Claude sessions started with a model alias (e.g. Opus) no longer fail on gateway setups that can't pin the alias — the launch resolves to a routable model id. (#3378)
+- [Feature] `omni setup` now supports signing in to Antigravity with Google OAuth through `agy`, alongside Gemini API keys. (#3391)
+- [UI / Feature] Archived sessions in Settings are now grouped by date (Today, Yesterday, Previous 7/30 days, month/year) for easier browsing. (#3394)
+- [UI / Bug fix] Subagent graph view nodes are now clickable and navigate to the selected session. (#3395)
+- [Bug fix] Dedupe codex-native's per-session plugin cache to reclaim disk (#3401)
+- [Bug fix / Test/CI] Shared-session sub-agent completion notices are attributed to the collaborator who dispatched the sub-agent. (#3409)
+- [Bug fix / Test/CI] N/A — test-only change. (#3410)
+- [Bug fix / Test/CI] Codex sessions keep their selected permission mode when resumed on a replacement host. (#3411)
+- [Bug fix] Only session owners can approve tools that run with owner credentials in shared sessions. (#3416)
+- [Bug fix] Fixed a bug where a malformed or unrecognized tool-call payload on certain harnesses (notably OpenCode) could silently bypass a configured tool-call policy instead of being blocked or asked. (#3418)
+- [Bug fix / Feature / Docs / Test/CI] ACP agents can opt out of Omnigent’s MCP relay with `omnigent_mcp: false`, enabling compatible OpenClaw Gateway ACP registrations. (#3420)
+- [Feature / Docs] Shared-session agents can distinguish who wrote each message without changing whose credentials execute the session; operators can hide model-visible author labels with an environment flag. (#3422)
+- [Bug fix] `/model` and the startup header no longer name an Omnigent provider and model for ACP-backed sessions, which run on the agent's own auth and model. (#3431)
+- [Bug fix] Session tokens saved by `omnigent login` are now created owner-only, so a JWT is never briefly world-readable on first login, and an interrupted write no longer discards every stored token. (#3441)
+- [Feature / Docs / Chore / Test/CI] Model selection can now represent provider choices through stable intents and normalized capability metadata. (#3443)
+- [UI / Feature] Session owners can grant trusted collaborators permission to approve privileged actions without transferring ownership; ordinary editors can reject but cannot approve. (#3446)
+- [Bug fix / Feature / Docs / Chore / Test/CI] Default model selection now follows the active provider catalog instead of release-specific model names baked into runtime harnesses, while retaining general-purpose selection policy and Databricks gateway routability. In cold-cache Databricks environments without GitHub egress, configure `executor.model` or a provider `models.default`. (#3448)
+- [Feature / Docs / Chore / Test/CI] Smart routing now chooses only from models discovered on the active runner instead of falling back to release-specific model names. (#3450)
+- [Feature / Docs / Chore / Test/CI] The Kiro model picker now follows the models and metadata reported by the installed Kiro CLI. (#3452)
+- [Feature / Docs] Minimal `omnigent run` agents now discover their default model instead of using a release-specific built-in endpoint. (#3455)
+- [Feature / Docs / Test/CI] Provider setup and unconfigured provider runtimes now select current catalog models instead of release-specific built-in defaults, and fail with explicit configuration guidance when discovery is unavailable. (#3456)
+- [Docs / Chore] The Kimi launcher example now respects the default model configured in Kimi Code. (#3457)
+- [Bug fix] `omni resume` now accepts a conversation id pasted with stray punctuation (trailing period, quotes, backticks) instead of crashing (#3465)
+- [UI / Bug fix] Sidebar New session, Automations, and Inbox icons now sit on the same left column (#3468)
+- [Chore] Android app now targets Android 16 (API 36) to stay compliant with Google Play's (#3470)
+- [Feature / Test/CI] Nightly prerelease builds: every night a `X.Y.Z.devYYYYMMDD` tag of main is cut automatically; install or update with `scripts/update_nightly.sh` or `omni upgrade --nightly` (#3475)
+- [Bug fix / Breaking] Agent CLIs (qwen, goose, kimi, hermes, and generic ACP agents) no longer receive unrelated host credentials such as cloud tokens and other providers' API keys; an agent that authenticates from a variable outside its own family now declares it in `os_env.sandbox.env_passthrough`. (#3479)
+- [UI / Bug fix] Conversation sidebar text now scales with the Interface font size setting (#3480)
+- [Bug fix] Fixed two `claude-sdk` steering bugs: messages sent during an active turn were answered one turn late (a permanent chat desync), and steering several messages at once dropped all but the last. Steered messages are now buffered correctly and all of them reach the model. (#3484)
+- [Bug fix] Fix the first message being silently dropped when a session resumes on a managed sandbox / lakebox (#3488)
+- [UI / Bug fix] The workspace file view keeps its scroll position — both the file tree and the open file — when you switch between sessions (#3490)
+- [UI / Bug fix] Deleting a pinned session now removes it from the sidebar's Pinned section immediately, and sidebar rows no longer grow or shift while being deleted or renamed (#3492)
+- [Chore] Faster initial load — syntax-highlighting language grammars now load on demand instead of all upfront. (#3496)
+- [UI / Feature] Markdown file previews render fenced Mermaid diagrams. (#3498)
+- [Bug fix / Feature] Antigravity (`agy`) sub-agents now reliably receive their first turn, get their approvals dismissed in the terminal, and stop showing as still-running after they have finished. (#3499)
+- [Docs / Chore] qwen-native's terminal-start error label now reads "Qwen Code" (consistent with the other native harnesses) instead of "qwen". (#3500)
+- [UI / Bug fix] Terminal view scrolling now works with macOS trackpads and with TUIs that enable mouse tracking at startup (OpenCode, Claude Code) (#3510)
+- [Bug fix] Runners now retry login-page redirects with refreshed credentials instead of exiting, so a hosted session survives an expired bearer (e.g. after the machine slept through a token's lifetime) and reconnects on its own. (#3511)
+- [UI / Bug fix] The chat view shows the "Starting up…" spinner while a message is waking a disconnected runner, instead of nothing until the runner boots; the sidebar row shows a spinner while a session is starting up (#3514)
+- [UI / Bug fix] Renaming a session in the sidebar no longer hits the wrong row when the list reorders — row order holds while the pointer is over the list or a rename is in progress (#3515)
+- [UI] Collapsed tool runs in the chat view are labeled by what they did ("Ran 1 shell command, read 2 files") instead of "See N steps" (#3518)
+- [Feature] Sandbox dotfile hiding is now top-level only by default (opt into the full-tree walk with `cwd_hidden_scan_recursive: true`), and `mask_paths` hides named files or folders. Untrusted-tree sandboxes that relied on recursive masking should set `cwd_hidden_scan_recursive: true` on upgrade. (#3519)
+- [UI / Bug fix] Cloning a session that runs in a git worktree now pre-fills the original repo with the worktree branch (instead of the worktree path as the working directory), and the clone dialog blocks creation when the picked working directory doesn't exist on the host (#3521)
+- [Bug fix] `omnigent sandbox create --provider openshell` no longer crashes against openshell SDK >=0.0.86; workspace is configurable via `sandbox.openshell.workspace` or `$OMNIGENT_OPENSHELL_WORKSPACE` (defaults to `"default"`). (#3524)
+- [Bug fix] Shared-session agents distinguish speakers without treating claimed roles as authorization. (#3527)
+- [Bug fix] Direct `omnigent.llms.Client` Anthropic reasoning requests now select adaptive or fixed-budget thinking from live model capabilities. (#3529)
+- [Chore / Test/CI] N/A — internal lint cleanup. (#3545)
+- [Bug fix / Chore / Test/CI] N/A — internal lint cleanup. (#3546)
+- [Chore / Test/CI] N/A — internal lint cleanup. (#3548)
+- [Chore / Test/CI] N/A — internal lint cleanup. (#3549)
+- [Bug fix / Docs / Chore] Model context limits now follow live provider catalog maximum-input metadata instead of adding output capacity or relying on stale built-in model IDs. (#3551)
+- [Test/CI] N/A — internal CI enforcement only. (#3552)
+- [Bug fix] User messages no longer risk a React hook-order crash when changing from a system marker to regular content. (#3553)
+- [Chore] N/A — internal code-quality cleanup only. (#3554)
+- [UI / Feature / Test/CI] Choose a Codex model before starting a Web UI session (#3556)
+- [Chore] N/A — internal code-quality cleanup only. (#3571)
+- [Bug fix / Docs / Chore] Pi now routes Databricks models through the API advertised by the live model catalog instead of a release-specific model allowlist. (#3572)
+- [Bug fix] Bulk conversation actions now report structured errors when only some items fail. (#3573)
+- [Chore] N/A — internal code-quality cleanup only. (#3574)
+- [Chore] N/A — internal code-quality cleanup only. (#3575)
+- [Feature] `omnigent import --force` replaces a previously imported chat with the latest local transcript. (#3576)
+- [UI / Feature] Subagent graph panel now has zoom in, zoom out, and fit-to-view buttons for easier navigation of large agent trees (#3583)
+- [UI / Bug fix] Change a session's model and effort from the config gear while the session is asleep — the change is saved immediately and applies when the next message wakes it. (#3584)
+- [Feature / Test/CI] Add a Locust WebSocket load test (`dev/loadtest/`) with a one-command runner and result summary (#3591)
+- [Feature] Sandbox now hides dotfiles (`.env`, `.aws`, `.ssh`, ...) under `write_paths` roots, not just `cwd` and `read_paths` (#3596)
+- [Test/CI] N/A — internal CI enforcement only. (#3600)
+- [Feature] GitHub policy blocks destructive operations (deletes) by default across MCP tools, `git push --delete`, and `gh * delete`; opt in with `allow_destructive: true`. (#3622)
+- [Feature / Chore] The Cursor model picker now follows the models advertised by your installed Cursor CLI. (#3624)
+- [Feature / Docs / Chore] Pi gateway sessions now list the models currently available from the workspace instead of a release-specific bundled menu. (#3629)
+- [Docs / Chore] Setup and tool help no longer recommend release-specific model ids. (#3630)
+- [Feature / Docs / Chore] Static model catalog responses now identify fallback ownership and advertise the current GPT 5.6 Sol, Luna, Terra, and GPT 5.5 Codex aliases. (#3632)
+- [Feature] Catalog-backed model defaults now reuse a validated last-known-good provider catalog during transient upstream outages or empty responses. (#3641)
+- [Chore] N/A — internal typing cleanup only. (#3643)
+- [Chore] N/A — internal typing cleanup only. (#3645)
+- [Chore] N/A — internal typing cleanup only. (#3646)
+- [Docs / Chore / Test/CI] Repository lint now permits unavoidable static model aliases only through auditable owned fallback records. (#3647)
+- [Chore] N/A — internal typing cleanup only. (#3649)
+- [Chore] N/A — internal typing cleanup only. (#3650)
+- [Chore] N/A — internal typing cleanup only. (#3651)
+- [Chore] N/A — internal type cleanup only. (#3652)
+- [Chore] N/A — internal type cleanup only. (#3653)
+- [Chore] N/A — internal type-safety refactor. (#3655)
+- [Chore] N/A — internal type-safety refactor. (#3657)
+- [Chore] N/A — internal type-safety refactor. (#3659)
+- [Bug fix] An undeclared sub-agent name on session create is now rejected instead of silently running the child as the parent agent (#3662)
+- [Chore] N/A — internal type-safety refactor. (#3663)
+- [Chore] N/A — internal type-safety cleanup. (#3664)
+- [Chore] N/A — internal type-safety refactor. (#3665)
+- [Chore] N/A — internal type-safety cleanup. (#3666)
+- [Chore] N/A — internal type-safety cleanup. (#3667)
+- [Bug fix] The Codex model picker now hides OpenAI models that the installed Codex CLI cannot run. (#3668)
+- [Chore] N/A — internal type-safety cleanup. (#3669)
+- [Chore] N/A — internal type-safety cleanup. (#3671)
+- [Chore] N/A — internal type-safety cleanup. (#3674)
+- [Chore] N/A — internal type-safety cleanup. (#3675)
+- [Chore] N/A — internal type-safety cleanup. (#3676)
+- [UI / Feature] Redesigned the sidebar's bulk-select bar and added per-section selection: pick sessions from the flat list or from within project folders (#3677)
+- [Chore] N/A — internal type-safety cleanup. (#3678)
+- [Chore] N/A — internal type-safety cleanup. (#3679)
+- [Chore] N/A — internal type-safety cleanup. (#3680)
+- [Chore] N/A — internal type-safety cleanup. (#3681)
+- [Chore] N/A — internal type-safety cleanup. (#3683)
+- [Chore] N/A — internal type-safety cleanup. (#3684)
+- [Chore] N/A — internal type-safety cleanup. (#3686)
+- [Chore] N/A — internal type-safety cleanup. (#3687)
+- [Chore] N/A — internal type-safety cleanup. (#3689)
+- [Chore] N/A — internal type-safety cleanup. (#3691)
+- [Chore] N/A — internal type-safety cleanup. (#3695)
+- [Chore] N/A — internal type-safety cleanup. (#3696)
+- [Chore] Malformed tools, retry, and MCP YAML now fails with actionable parser errors instead of leaking untyped values. (#3705)
+- [Chore] N/A — internal type-safety cleanup with no user-facing behavior change. (#3706)
+- [Chore] N/A — internal ASGI type cleanup with no user-facing behavior change. (#3707)
+- [Chore] N/A — internal migration decoding hardening with no supported-input behavior change. (#3708)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3729)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3734)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3735)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3736)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3737)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3739)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3740)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3741)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3742)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3743)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3744)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3745)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3746)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3747)
+- [Bug fix / Chore] Managed Islo hosts now receive configured provider gateways during startup. (#3748)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3751)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3752)
+- [Bug fix] Antigravity sessions without an explicit model now follow the installed SDK's current default. (#3762)
+- [UI / Bug fix] Moving a session into a project updates the sidebar instantly instead of after a multi-second wait (#3784)
+- [UI / Feature] `omnigent --help` now groups launch commands under a **Harnesses** section, colorizes the output, hides harnesses whose optional extra isn't installed (with a notice pointing at `omnigent setup`), drops the duplicate `update` alias line, and tidies the command descriptions (#3795)
+- [Feature] `omni upgrade` now preserves requested extras for `uv tool` and `pipx` installs, supports `--extra`, `--target-version`, and `--dry-run`, and refuses to auto-upgrade `pip` / `uv pip` installs because those installers don't record extras. (#3796)
+- [UI / Chore] `omnigent --help` command descriptions are tidied (harness rows read "Launch <Name> with Omnigent"), and the duplicate `update` alias line is hidden from the listing (#3797)
+- [Bug fix] Prevent `list_files` from running without a conversation scope. (#3804)
+- [Bug fix] Reject stale harness continuation requests that cannot resolve an agent model. (#3806)
+- [Chore] N/A (internal type cleanup) (#3830)
+- [Chore] N/A (internal type cleanup) (#3831)
+- [Chore] N/A (internal type cleanup) (#3832)
+- [Chore] N/A (internal type cleanup) (#3833)
+- [Chore] N/A (internal type cleanup) (#3835)
+- [Chore] N/A (internal type cleanup) (#3836)
+- [Chore] N/A (internal type cleanup) (#3837)
+- [Chore] N/A (internal type cleanup) (#3838)
+- [UI / Bug fix] New sessions created inside a project appear under that project immediately instead of briefly showing under "Sessions" (#3869)
+- [Bug fix / Breaking] The "GitHub Repo & Branch Access" and "Block Working Directory & Worktree (#3888)
+- [Feature] claude-native sessions now derive their Working/idle status from Claude Code's own session file for faster, more accurate turn-edge detection (falls back to the terminal watcher on older Claude versions) (#3906)
+- [UI] Tightened the sidebar's spacing so nav, sections, and session rows sit on a consistent vertical rhythm (#3908)
+- [UI / Bug fix] Sidebar rows no longer stay highlighted in "Select sessions" mode unless explicitly selected (#3912)
+- [UI / Feature] Opening a shell on a sleeping session now wakes its runner automatically instead of failing with "no runner available" (#3919)
+- [Bug fix] Pi-native sessions now retain Omnigent system tools and the comment relay. (#3920)
+- [Chore] N/A — no user-facing behavior change. (#3923)
+- [Bug fix] Fixed a leak where native Codex sub-agents left orphaned `codex app-server` processes after idle reaping, TUI exit, runner shutdown, or a hard host/runner death (#3925)
+- [Bug fix / Chore] OpenCode-native model options now fall back to the authenticated server catalog when CLI discovery fails. (#3926)
+- [UI / Bug fix] The sidebar's My sessions / Shared with me switch stays visible while bulk-selecting sessions (#3927)
+- [Feature] `omnigent diagnose` prints a secret-free environment snapshot (CLI/server versions, OS, auth mode) for bug reports (#3928)
+- [UI / Bug fix] Hide the empty Projects header menu (⋯) when you have no projects (#3930)
+- [UI] Moved the Chat/Terminal switcher for terminal-first sessions from the composer into the session header (#3931)
+- [UI / Bug fix / Feature] Recent conversations reopen instantly while catching up without reordering live response output. (#3932)
+- [Bug fix] `pip install` / `uv sync` no longer hangs when pnpm is provided by a corepack (#3986)
+
+## [v0.7.0] — 2026-07-27
+
+- [Bug fix] Hermes thinking now appears in mirrored web conversations. (#1645)
+- [Bug fix] Image and file attachments now survive session relaunches on remote host runners; attachments that fail to load show a visible marker instead of silently disappearing. (#2085)
+- [UI / Feature] Voice dictation in the composer now works in Electron, Firefox, and Chromium via optional server-side transcription (`omnigent[dictation]`) — local models, live streaming partials, audio never leaves your server. (#2093)
+- [UI / Bug fix / Test/CI] Hide Claude task completion control messages from conversation history while preserving them for resume context. (#2104)
+- [Bug fix / Feature / Docs] Operators can mount pre-created PersistentVolumeClaims (NFS/SMB/SAN) into Kubernetes sandbox runners via `sandbox.kubernetes.pvc_mounts` (read-only by default) (#2435)
+- [Bug fix / Test/CI] `/compact` no longer races when multiple compact requests hit the same session at once (#2585)
+- [Bug fix / Test/CI] `sys_call_async` / `sys_cancel_async` now consistently use `handle_id` as the cancel identifier. (#2586)
+- [Bug fix / Test/CI] Runner idle timeout no longer kills sessions waiting on async tools, timers, or approval prompts (#2588)
+- [Bug fix] Misconfigured runner tool policies deny tool calls instead of silently allowing them (#2589)
+- [UI / Feature] Slash-command menus now match any part of a command's name, so `/using-superpowers` finds `/superpowers:using-superpowers` (#2655)
+- [Bug fix] Host-launched runners now reuse delegated credentials instead of repeating Databricks authentication during startup. (#2762)
+- [Feature] Projects are now a first-class entity with a `/v1/projects` CRUD API (create, list, rename, delete) and per-session membership. (#2765)
+- [Bug fix] Hermes forwarder introspects state.db columns to survive cross-version schema drift (#2774)
+- [Feature] `omni usage` reports your LLM cost for today / the last 7 / 30 days, with a per-session per-model cost breakdown (#2787)
+- [Feature / Chore] Native Claude sessions start faster by coalescing runner initialization into one handshake. (#2793)
+- [UI / Bug fix / Feature / Docs / Test/CI] Claude-native launch and in-session pickers now share the selected host's live model catalog, including Claude Code's managed routes. (#2831)
+- [Bug fix] Managed BoxLite sandboxes remain available after provisioning so agent launches can execute commands reliably. (#2846)
+- [Feature] Server-side smart routing can now call an external `routes:select` router via `routing.provider: external`, with provider-agnostic auth (`api_key`) and model-name mapping (`model_prefix`) (#2864)
+- [UI] Chat code blocks no longer load the syntax-highlighter engine until the first (#2886)
+- [UI / Bug fix] The main chat "Working…" indicator now clears reliably when the session goes idle, instead of occasionally staying lit after a reply completes. (#2900)
+- [Bug fix] The performance benchmark harness now records HTTP failures and continues the rest of the suite instead of aborting, and excludes fully-failed runs from the summary averages. (#2917)
+- [Feature / Test/CI] Scheduled tasks can now be created without a workspace or a pinned host for non-code work (research, summaries, chat-only, MCP-only); an unset host runs on your live host at fire time, and an unset workspace defaults to the host's home directory. A pinned host is now authorized (existence + ownership) at create time rather than only at fire time. (#2946)
+- [Chore / Test/CI] N/A — internal benchmark/dev tooling; no user-facing impact. (#2947)
+- [Feature] Set `OMNIGENT_CONTAINER_RUNTIME=podman` to use Podman (or another supported runtime) globally instead of Docker, without editing every agent's YAML. (#2949)
+- [Bug fix] Sending a message to a session whose Claude Code terminal crashed no longer (#2951)
+- [Bug fix] The desktop app now always quits within a few seconds even if its background cleanup stalls or the OS re-quit is dropped. (#2972)
+- [UI / Bug fix] Messages send immediately when a session's only remaining work is a background job, instead of being held in the queue until it finishes (#2974)
+- [UI / Feature] Desktop update notifications now appear in a native corner toast that works (#2975)
+- [Bug fix / Chore] Runner startup no longer waits several seconds for Git's optional untracked-file cache probe. (#2976)
+- [Feature / Test/CI] `omnigent` benchmark harness gains `--network-delay-ms` and per-journey HTTP request counts (#2977)
+- [UI / Bug fix] Pi sessions now show reasoning while it streams and after conversation history reloads. (#2979)
+- [Feature] The runner log now records why the runner exited (crash traceback, signal, idle timeout, tunnel close, or parent death) (#2985)
+- [UI / Feature] Set up a missing agent from the New Chat dialog with a guided, step-by-step checklist (#2987)
+- [UI / Bug fix / Feature] HTTP headers can now be set and edited for HTTP MCP servers in the session agent info panel. (#2989)
+- Capped unbounded DB list queries in the permission store and reduced session opens in `check_access`/`get_permission_level` from 2–3 to 1. (#2995)
+- Deleting a conversation with many descendants now issues a single FTS DELETE instead of one per descendant. (#2999)
+- [UI / Bug fix] Android auto theme and system-bar icons now stay readable with both device themes and explicit in-app theme overrides. (#3006)
+- [UI / Feature] 3D model files (STL, 3MF, OBJ) now render an interactive preview in the file browser (#3007)
+- [UI / Bug fix] Subagents panel Graph View now shows the same status dot colors as List View (#3009)
+- [Feature / Test/CI] Scheduled-task runs now transition to a terminal state (`succeeded`/`failed`) as soon as the dispatched turn finishes, instead of staying `running` forever; run history is readable at `GET /v1/scheduled-tasks/{id}/runs`. (#3014)
+- [Feature / Chore] When enabled, new sessions receive concise semantic titles in the background without adding work or latency to the active agent turn. (#3024)
+- [Feature] Offload dictation speech-to-text to a remote worker with (#3025)
+- [Bug fix / Docs / Test/CI] Codex-native subagents now appear in the Agents panel with their live conversations. (#3028)
+- [Bug fix] Credential proxy no longer attaches injected credentials to TRACE/OPTIONS requests, and the egress proxy now honors Max-Forwards as a conformant intermediary. (#3029)
+- [Docs] N/A — internal documentation cleanup. (#3031)
+- [Feature] Import local Qwen, Kiro, Pi, and Kimi coding chats into Omnigent (#3032)
+- [UI / Feature] Press ⌘⌥V (Ctrl+Alt+V) to toggle voice dictation from anywhere; while dictating, Enter keeps the text and Esc discards it (#3044)
+- [UI / Feature] Added: "Auto · smart routing" harness option in the new-chat picker — lets the intelligent router pick both harness and model based on the task description (#3045)
+- [Feature] Import existing OpenCode chats, including files and tool activity, with `omnigent import` (#3046)
+- [Bug fix] Dictation streams now reliably release their worker slot when a browser disconnects abruptly. (#3048)
+- [UI] New-session composer moves harness configuration into a gear-icon modal, with a cleaner agent picker (needs-setup and custom agents folded into flyouts) and Smart Routing offered as a model option. (#3050)
+- [Bug fix / Feature] The Slack bot can now run against an Omnigent server deployed on Databricks Apps, (#3051)
+- [Feature] Sessions can now be filed into first-class projects via `PATCH /v1/sessions/{id}` and listed with `GET /v1/sessions?project=<name>`, which dual-reads first-class membership and legacy project labels. (#3053)
+- [Bug fix / Test/CI] Fixed SDK session telemetry always recording `harness: null` in server deployments not started via the CLI. (#3054)
+- [Test/CI] N/A — test-only reliability change. (#3056)
+- [Bug fix] Databricks OAuth CLI profiles no longer fail with a misleading "malformed profile" error; the message now explains the real fix (install `omnigent[databricks]` or refresh the OAuth session). (#3059)
+- [Bug fix] An idle runner shutting down after inactivity no longer shows a scary "disconnected" error — just send a message to wake it back up. (#3060)
+- [UI / Feature] The sidebar now uses first-class projects: create empty projects, rename and delete them, and file sessions into them — while existing label-based projects keep working. (#3061)
+- [UI / Bug fix] The "Host is offline — click to reconnect" prompt now appears in the composer's host badge instead of a separate banner below the composer (#3062)
+- [Test/CI] N/A (test-only change) (#3063)
+- [Feature / Docs / Test/CI] New `databricks_cli` credential-proxy type lets sandboxed agents use the Databricks CLI without the real token entering the sandbox (#3080)
+- [UI / Feature / Test/CI] Polly sessions running on Claude SDK can start Goal mode from the chat composer. (#3084)
+- [UI / Bug fix] The Configure agent modal's footer no longer shows a gray background band behind Cancel/Save (#3089)
+- [UI / Feature] The Sidebar is more compact and polished, with clearer status indicators and richer session details on hover. (#3092)
+- [UI] Reordered the project-folder header buttons (new-session before the menu), (#3096)
+- [Chore / Breaking] `omni server start` is removed; use `omni server --background` to launch the (#3105)
+- [Bug fix] `omnigent server --host 0.0.0.0` now enables accounts (login) mode automatically instead of silently 401-ing every request (#3107)
+- [Feature] Projects can store default session settings (host, workspace, harness, model, …) via a new `config` field on the projects API. (#3108)
+- [Bug fix] Databricks-served Claude models no longer break non-streaming responses (prompt-policy and smart routing) when returning typed content blocks (#3109)
+- [Feature] `omnidev omnigent <args…>` runs an omnigent command against the current checkout's pod via `uv run omnigent`, with the pod's isolated env applied (#3110)
+- [UI / Feature] Configure a session's model, effort, and smart routing mid-chat from a new gear icon in the composer (#3111)
+- [UI / Feature / Test/CI] Add the `/tasks` Scheduled Tasks page with sidebar navigation, task rows, empty states, suggestion chips, create-dialog entry points, and Playwright E2E coverage. (#3112)
+- [Bug fix] Reading image files in a Claude Code native session no longer bloats conversation history and breaks resume/compaction on large sessions (#3113)
+- [Bug fix / Test/CI] The iOS app no longer follows cross-origin redirects when probing a newly approved server for the Databricks workspace mount, so a consented host can't redirect the probe to a different origin. (#3115)
+- [Bug fix] Forked native sessions (Claude Code, Codex, Pi, Qwen) again resume with their prior conversation history. (#3116)
+- [UI / Feature / Test/CI] Workspace pane icons now explain themselves on hover, with a cleaner right-side session layout and compact Share action. (#3122)
+- [UI / Bug fix / Feature] Add a dialog for creating recurring scheduled agent tasks. (#3123)
+- [UI] Sidebar session hover flyouts and rows now align with the project rows — matching flyout style, title size, and right-edge padding. (#3124)
+- [Bug fix] Resuming a session with large images stored in history no longer overflows the context window or breaks compaction, on both the SDK and native Claude Code paths (#3133)
+- [Feature] `omnigent session import` loads a `session export` JSONL back into a server as a new session (#3141)
+- [Feature] Telemetry now records the agent name for Polly and Debby sessions. (#3152)
+- [Chore / Breaking] `omni integration slack start` is removed; use `omni integration slack --background` to launch the (#3153)
+- [UI / Bug fix / Docs / Chore] Slack device login now requires a fresh password at the consent screen, closing a device-code phishing gap where an already-signed-in user could approve a login by reflex. (#3156)
+- [Feature] `omnigent claude` keeps tool search enabled when launched with `CLAUDE_CODE_USE_GATEWAY=1`. (#3161)
+- [Test/CI] Fix `test_session_stream_emits_heartbeat_on_idle` after `_session_labels_for_runner_spawn` was extracted into `omnigent.runner.native.orchestration`; patch the heartbeat cadence on `omnigent.runner.app` where it is defined and consumed. (#3163)
+- [Bug fix] Crash reports are no longer lost when a process crashes more than once in the same second. (#3173)
+- [Bug fix] Custom codex-native agents launch on the model declared in the agent spec (`executor.model`) instead of silently falling back to the provider default (#3175)
+- [Bug fix] Single-file agent YAMLs that nest the executor under `type:`/`config:` (the bundle config.yaml shape) now fail at load time with the correct flat spelling, instead of silently running a harness inferred from the model prefix (#3178)
+- [UI / Bug fix / Feature] Use native Codex goal mode from Polly's Goal control (#3181)
+- [UI / Bug fix] Renaming a session now updates the name in the sidebar instantly instead of after a short delay. (#3185)
+- [UI / Bug fix / Feature / Test/CI] Edit scheduled tasks and type exact run times, with a scrollable time picker and a consistent, fully-visible dialog. (#3186)
+- [UI / Feature] Pinned sessions now persist server-side per user, so pins follow you across devices and browsers. (#3189)
+- [Feature] New sessions now receive concise semantic titles automatically without additional configuration. (#3191)
+- [Test/CI] `/rerun` PR comment re-runs failed CI on the current commit without dismissing approvals (#3195)
+- [Feature] Native Codex sessions can now receive concise automatic background titles. (#3199)
+- [Bug fix] Qwen3, inkling, and other non-OpenAI models now work in the Pi SDK executor harness (#3203)
+- [Chore / Breaking] Slack-on-Databricks deploy: renamed `OMNIGENT_SLACK_WEBAUTH_BASE_URL` to `OMNIGENT_SLACK_DATABRICKS_APP_URL` (`--app-url`), removed the `WEBAUTH_PORT` / `DATABRICKS_WORKSPACE_HOST` overrides, and dropped deploy-time `uv lock` in favor of in-container `uv run`. (#3206)
+- [UI / Bug fix] Sidebar session titles use the available space cleanly and reveal branch and action details only when needed. (#3208)
+- [UI / Bug fix] Removed the redundant "Create new project" option from the sidebar project picker — create projects with the + icon next to Projects (#3210)
+- [Feature] Smart routing now activates automatically when a server `llm:` block or an external `routing:` block is configured — no `OMNIGENT_SMART_ROUTING` env var needed (#3215)
+- [UI / Feature / Test/CI] Scheduled task rows now show when each task will next run ("Next run in 15h") and a "Run now" action in the ⋯ menu to fire a task immediately, with refreshed row styling. (#3218)
+- [UI / Feature] Projects now carry default session settings (host, working directory, agent, optional git worktree) that pre-fill the new-session composer. (#3221)
+- [Bug fix] Fixed per-model cost attribution for native harnesses so a session's per-model (#3223)
+- [UI / Bug fix] Codex task plans now stay in Tasks instead of being duplicated in chat. (#3249)
+- [UI / Bug fix] Smart Routing no longer appears in the model dropdown for native terminal sessions (Claude Code, Codex, Pi), where it had no effect (#3259)
+- [Bug fix] Sandboxed agents can now run tools managed by update-alternatives (awk, python3, editor, and similar) on Linux. (#3263)
+- [Bug fix] Egress proxy now trusts corporate/MDM CA roots installed under the system `capath` directory, so TLS to hosts behind a corporate MITM works from a sandboxed agent. (#3264)
+- [Bug fix] Large historical attachments no longer inflate replay and compaction context as inline base64 text. (#3267)
+- [Docs] Contributors can now use `omnidev` as the documented worktree-safe local testing flow. (#3277)
+- [Bug fix] Custom OpenAI Agents can use Unity AI Gateway Model Services with fully qualified model names when a Databricks provider or profile is configured. (#3288)
+- [UI / Bug fix / Feature] Configure recoverable dangerous shell commands to ask for approval or deny execution, while always blocking catastrophic operations. (#3297)
+- [Bug fix / Feature] Pi harness now routes kimi, inkling, GLM, qwen3, Gemini 3+, and Llama through the correct AI Gateway endpoints, fixing "Stream ended without finish_reason" errors and ensuring `system.ai.*` ids are used throughout. (#3307)
+- [Feature] Add a top-level `justfile` with recipes for launching the iOS Simulator, running the Android debug build, starting the omnigent dev pod, and running pre-commit/lockfile normalization. (#3310)
+- [UI / Bug fix] Sidebar header action buttons are now vertically centered with section titles. Session row hover is smoother, and active items no longer flash when hovered. (#3311)
+- [UI / Bug fix] Aligns project folder icons and color with the rest of the sidebar. (#3317)
+- [Bug fix] Unsupported Claude Code slash commands are now escaped and sent as regular user messages instead of leaving the native terminal in an undriveable state. (#3319)
+- [Feature] `omnigent server` now tells users they can set `OMNIGENT_AUTH_ENABLED=0` to override automatic multi-user mode when binding to a non-loopback interface. (#3320)
+- [Chore / Breaking] [Breaking] The deprecated `OMNIGENT_ACCOUNTS_ENABLED` environment variable has been removed; use `OMNIGENT_AUTH_ENABLED` instead. (#3322)
+- [UI / Bug fix] Fixed pinned sessions being lost when the web UI was updated before the server. (#3323)
+- [UI / Feature] Automations list: tasks now render as cards and show a live-updating relative next-run time ("Next run in 3 hours"). (#3324)
+- [UI] Settings → Appearance no longer has a separate Sidebar font size control, and a new "Reset to defaults" button restores every appearance preference after confirmation. (#3326)
+- [UI] Starting a session inside a project now names the project in the new-session (#3327)
+- [UI] The Files workspace tab now uses a stacked-files icon. (#3329)
+- [UI / Feature] Automations: scheduled tasks can now pick a model and reasoning effort in the create/edit dialog (defaults to the agent's settings). (#3331)
+- [UI / Bug fix] Fixed sessions pinned in the updated web UI being lost after the server was updated. (#3332)
+- [UI / Feature] Native harness setup now checks the installed CLI version and prompts to upgrade if it is too old. Cursor's missing-binary case is normalized to the same structured `binary-missing` signal as the other CLI-backed native harnesses. (#3335)
+- [Bug fix] Pi sessions now show a clear error when their Databricks login has expired, instead of silently accepting messages with no reply (#3336)
+- [Test/CI] N/A (internal CI change). (#3338)
+- [Bug fix] claude-sdk harness now surfaces harness-level failures (expired login, auth error) as structured errors instead of storing them as assistant messages. (#3342)
+- [UI] Align the sidebar brand row with the rest of the navigation. (#3346)
+- [UI / Bug fix] Short links like `#3090` in chat markdown tables no longer stack one character per line (#3350)
+
+## [v0.6.0] — 2026-07-21
+
+- [Bug fix] `sys_os_shell` commands no longer inherit omnigent's own `PYTHONPATH` entry, so project subprocesses resolve their own installed packages instead of omnigent's. (#1861)
+- [Bug fix] Stopping a Goose turn no longer leaves stale ACP session state behind when the subprocess is terminated. (#1928)
+- [Bug fix] Cancelling or deleting a session during agent cold start no longer leaks the harness subprocess. (#1982)
+- [Bug fix] macOS sign-in with a hardware security key (e.g. YubiKey) works again. (#2036)
+- [UI / Bug fix] Tool-call cards keep their live spinner when a superseded response terminates mid-turn (fixes a first-turn "no spinner" on native-terminal harnesses). (#2045)
+- [Bug fix] hermes-native tool-call cards now show a live spinner and elapsed timer while a tool runs, including on the first turn. (#2046)
+- [Bug fix] Fix blank white page on Safari/iPadOS older than 16.4 caused by regex lookbehinds on the web UI boot path (#2105)
+- [UI / Feature / Chore] A project's "new session" pencil now prefills the composer from the project's latest session — host, repo, agent, and a fresh git worktree branch — so starting a new chat in a project is one prompt away. (#2133)
+- [UI / Feature] Filter the Archived sessions view by project (#2134)
+- [Bug fix / Docs / Test/CI] Polly now verifies pytest test-count discrepancies against collected cases before recording miscount/fabrication claims. (#2140)
+- [Bug fix] Evict the cached claude-sdk client when a turn is cancelled so the session recovers on the next turn (#2169)
+- [UI / Bug fix] Tapping an Android notification now opens the waiting session (or the inbox). (#2210)
+- [Bug fix] Fixed the headless Hermes harness registering no Omnigent MCP server (agent had no builtin tools). (#2216)
+- [Feature / Breaking] Ids are now bare 32-character hex (no `conv_`/`ag_`/`host_` prefixes) stored as 16-byte binary; existing prefixed ids in URLs, configs, and clients keep working. (#2228)
+- [Bug fix] `sys_list_models` no longer misreports codex `cli-config` providers and cursor workers as having no usable model provider. (#2237)
+- [Bug fix] Cursor sessions now run shell tools in the declared workspace directory instead of the runner's working directory (#2244)
+- [UI / Bug fix / Feature] Conversation view gains a turn-rail minimap for jumping between messages (#2285)
+- [Feature / Docs] `sandbox.host_config` in the server config injects verbatim host `config.yaml` content (e.g. a `providers:` gateway block) into managed sandboxes before the host starts (#2306)
+- [Bug fix] `omnigent server` now accepts documented boolean server-config values like `sandbox.kubernetes.in_cluster: false` instead of rejecting them at startup. (#2314)
+- [Bug fix] Chat sessions now recover automatically from a brief reverse-proxy 404 during a backend restart, instead of freezing until a manual page refresh. (#2316)
+- [UI / Bug fix] Bulk select-all/delete/archive in the sidebar now correctly handles collapsed sections (#2377)
+- [Bug fix / Feature] `omnigent run --harness <name>-native` now launches every registered native harness with matching prompt and model behavior. (#2379)
+- [Feature / Docs / Test/CI] Harness bench now reports Omnigent MCP relay support separately from vendor-native tool calling. (#2380)
+- [Bug fix] Sessions are now stopped server-side before archive or delete, so SDK and API callers get the same stop-first behavior the web UI provides. (#2400)
+- [UI / Bug fix / Test/CI] Sidebar session tabs no longer overflow their background on narrow widths. (#2425)
+- [Bug fix] Local server startup now works when a system proxy intercepts loopback traffic. (#2433)
+- [Bug fix] Native TUI harnesses (opencode, pi, hermes) no longer render multibyte UTF-8 as mojibake on deployments whose environment lacks a UTF-8 `LANG`/`LC_ALL`. (#2440)
+- [Bug fix] Claude native sessions now back off rejected cost updates instead of retrying on every poll. (#2453)
+- [Feature] Server now collects opt-out usage telemetry for session created, stopped, and deleted events to help understand product usage patterns. (#2457)
+- [UI / Bug fix] Confirming a Japanese IME conversion with Enter no longer submits the session rename or new-project name inputs (#2459)
+- [Feature] Server `llm:` config accepts an optional `fallback_models:` list; LLM-backed policies now retry alternate models before failing closed. (#2462)
+- [Feature] Harden the LLM prompt-classifier policy against prompt injection by spotlighting untrusted content behind an unguessable per-evaluation marker. (#2463)
+- [Feature / Docs / Test/CI] Harness bench now reports whether forked sessions retain and replay their source conversation history. (#2472)
+- [Bug fix / Test/CI] Harness benchmark live tables now distinguish not-applicable capabilities from skipped probes. (#2475)
+- [UI / Bug fix] New sessions respond faster to their first message, and the "Working…" indicator now appears immediately on the first turn instead of staying dark while the runner finishes connecting (#2478)
+- [Bug fix] A policy-denied message (e.g. hitting the cost budget) now shows immediately instead of only after a page refresh (#2481)
+- [Bug fix / Feature / Docs / Test/CI] Codex sessions using Databricks custom model aliases can surface reasoning summaries, and the harness benchmark now reports observable reasoning support. (#2482)
+- [Feature / Docs / Test/CI] The harness benchmark can run selected capability dimensions and pin an exact model directly in each harness argument. (#2485)
+- [Bug fix / Test/CI] Polly Cursor workers no longer ask for tool permissions by default (YOLO / auto) (#2493)
+- [Feature] Polly defaults to Sonnet 5 for its brain and Claude Code workers, and Cursor Grok 4.5 for Cursor workers (#2500)
+- [Bug fix] Polly Cursor workers default to grok-4.5 (#2503)
+- [Bug fix] Polly Claude brain and Claude Code workers default to the sonnet alias (#2504)
+- [Bug fix] Polly Claude brain and Claude Code workers inherit the provider default model again (#2507)
+- [Bug fix] Codex-harness sub-agents no longer crash on macOS when the runner inherits a read-only working directory (e.g. `/` from the desktop app). (#2512)
+- [UI / Feature / Test/CI] New chats can start with the Workspace panel collapsed via Appearance settings (#2516)
+- [Bug fix] `sys_advise_models` is only offered to agents when intelligent routing is configured on the server. (#2517)
+- [UI / Feature / Test/CI] OpenCode-native sessions now show their available models in the web model picker. (#2519)
+- [Bug fix] Pi's `/model` command now shows all LLM models available on your Databricks workspace (fetched live from the serving-endpoints API) instead of a hardcoded list (#2525)
+- [UI / Feature] The changed-files panel now shows a per-file line-change count (`+N −M`) beside each file. (#2526)
+- [Bug fix] Telemetry rollout percentages now honor 0% and 100% exactly. (#2528)
+- [Bug fix] Pi no longer shows a blocking "Trust project folder?" dialog when launched via Omnigent in a project with `.pi/` settings or extensions (requires Pi 0.79+) (#2529)
+- [Feature / Docs / Test/CI] Harness metadata can now declare resume, steering, live queue, image, and compaction support for capability conformance checks. (#2530)
+- [UI] Admin Settings pages (Members, Policies, Sharing) now share the same left and top alignment as the rest of Settings. (#2532)
+- [Bug fix] Pi's `/model` command now shows GLM, Llama, Qwen, and other non-GPT Databricks models alongside Claude and GPT models (#2534)
+- [UI / Bug fix] The Members and Sharing settings pages and the Share buttons are hidden in single-user mode (#2536)
+- [Bug fix] Pi's `/model` command now correctly lists all available Databricks models when using the AI Gateway (cli-config) setup — the NXDOMAIN error that caused single-model fallback is fixed (#2540)
+- [UI / Feature] Native Pi sessions can now switch model mid-session from the web composer, with the picker scoped to your logged-in models and synced to in-terminal `/model` changes (#2543)
+- [UI / Feature] Add an opt-in "Hide unconfigured harnesses" setting that filters the new-chat picker to harnesses set up on the selected host (#2544)
+- [Bug fix] Sending a message to an idle native Pi session no longer gets stuck in the "queued" state until you switch tabs (#2545)
+- [Feature / Docs / Test/CI] Add `omnigent uninstall` for safely removing the CLI, installer-managed shell/config edits, and optionally local Omnigent state. (#2550)
+- [Bug fix] Pi's `/model` command now shows all available Databricks models for ucode / Codex app profile-switched setups (#2552)
+- [UI / Feature] Added a Nord color theme (arctic frost-blue palette) to the Appearance settings palette picker. (#2561)
+- [Bug fix] Fix `uv tool install` of the `databricks` extra failing to build pyarrow from source on Python 3.14 (#2563)
+- [Bug fix] Sessions list no longer does a workspace-wide id pre-fetch for the archived filter, restoring the single indexed query on the sidebar path. (#2568)
+- [Bug fix] The CLI now shows a clear error instead of a raw traceback when the server is too slow or unreachable while starting a session. (#2572)
+- [Bug fix] Pi harness: Databricks GLM/DeepSeek reasoning models no longer fail with "Stream ended without finish_reason" (#2573)
+- [UI / Bug fix] Clicking a pinned session that belongs to a project no longer re-opens the project section after you've collapsed it. (#2583)
+- [Bug fix] Claude-native messages that fail to reach Claude (or stall unsent) now surface the failure instead of silently disappearing. (#2591)
+- [UI / Bug fix] The file editor now follows Omnigent's selected web and desktop color theme instead of the operating-system theme. (#2594)
+- [UI / Feature] Hovering a pinned session now shows its project name in a flyout (#2595)
+- [UI] Sidebar rows, section headers, and nav items now line up on a consistent grid (#2596)
+- [Bug fix] Queued follow-up messages in the Pi web UI now dispatch immediately when Pi finishes replying (#2597)
+- [UI / Bug fix] Pinned-session project flyout no longer opens (and gets stuck over the chat) when tapping a session on mobile (#2599)
+- [UI / Feature] Diff viewer gains a "Wrap lines" toggle, and Find / Download / diff toggles now live in a single "⋯" View settings menu (#2600)
+- [UI / Bug fix] Mobile session menu opens the project picker in place instead of an off-screen side flyout (#2602)
+- [Bug fix] `sys_session_send` now reliably accepts model overrides when spawning named sub-agent sessions with a specific model (#2603)
+- [Chore / Breaking] `omnigent[memory]` is renamed to `omnigent[hindsight]`; the Hindsight memory extra is now the canonical name. (#2605)
+- [Bug fix] `omnigent host status` now hides the session table by default (use `--sessions` to show it), making the command significantly faster. (#2606)
+- [Feature] `omnigent://<hostname>/c/<session_id>` links open that session in the desktop app, reusing an open window on that server in-place (#2607)
+- [Bug fix] Fix native Claude sessions overflowing the context limit on reconnect when the conversation contained screenshots (#2609)
+- [Feature] Session creation requests from the web UI now send an explicit `X-Omnigent-Client` header, enabling the server to record the exact client surface (web/desktop/ios/android) in telemetry without relying on User-Agent parsing. (#2615)
+- [UI / Bug fix] Mobile: the Chat/Terminal toggle no longer reappears over the sidebar when opening a session's kebab menu (#2617)
+- [UI] Project sidebar headers show a chevron in place of the folder icon on hover instead of a persistent caret next to the name (#2618)
+- [UI / Feature] PDF files now preview inline in the file viewer, with scrollable pages and zoom (#2619)
+- [UI / Bug fix] Find in file now toggles the editor's find bar closed on a second click, and its close button no longer shows a stray keyboard-hint tooltip (#2621)
+- [UI / Bug fix / Feature] Find in file now works in the markdown editor — highlights and cycles matches, including terms split across bold/italic formatting (#2628)
+- [Bug fix] Clicking an Omnigent session URL printed inside the embedded terminal now stays in the web app instead of opening a duplicate browser tab/window. (#2639)
+- [Docs] Clarify optional install extras in the quick-start docs. (#2640)
+- [Bug fix] `use_responses: false` now correctly selects the Chat Completions API in standard `config.yaml` bundles. (#2641)
+- [Bug fix / Feature] Import existing Claude Code or Codex chats with `omni import`. (#2649)
+- [UI / Feature] Customize a built-in color theme with shared light/dark accent, tint, contrast, and two-rail sidebar translucency controls. (#2650)
+- [UI / Bug fix] Pinned sessions no longer show duplicate rows after upgrading — legacy pin ids are migrated to the new id format automatically. (#2651)
+- [UI / Feature] Long-running Codex commands now stream their output into the web tool card while they run. (#2652)
+- [UI / Feature] Randomize accent and background tint colors with a playful new dice button. (#2653)
+- [Feature] `omnigent://<hostname>/c/<session_id>` links open that session in the iOS app, reusing the open window on that server in-place (#2661)
+- [Bug fix] Pi's `/model` command now shows and correctly routes GPT, Kimi, Llama, GLM, and Gemini 3.x models alongside Claude (#2665)
+- [UI / Bug fix] The Add Global Policy dialog now shows all available policies, including ones already applied. (#2668)
+- [UI / Bug fix] The Add Policy dialog for sessions now shows all available policies, including ones already applied. (#2670)
+- [Bug fix] Deleting or archiving a session now also stops any still-running sub-agent children, instead of leaving them running as unreachable orphans. (#2673)
+- [UI / Feature] Find in file now works in the markdown and notebook preview — highlights and cycles matches in the rendered document (#2674)
+- [Bug fix] Codex sessions through a Databricks gateway profile no longer fail with "Invalid Token" when the environment's `DATABRICKS_HOST` points at a different workspace than the profile (#2675)
+- [UI / Feature] The file panel (changed files, browsing, diffs, and file contents) stays viewable when a session's runner is offline but its host is still connected — no need to send a message to wake it. (#2676)
+- [UI / Feature] Select text in a PDF preview to add review comments with inline highlight overlays. (#2677)
+- [UI / Feature] Codex plans now show up in the Tasks panel, the same way Claude Code todos do (#2678)
+- [UI / Bug fix] Token expiration and other harness startup errors now appear immediately in the chat transcript instead of requiring a page reload. (#2681)
+- [UI / Feature] Switching back to a recently-opened chat now renders instantly from cache instead of blanking and reloading over the network. (#2688)
+- [UI / Bug fix] Fixed the comment box being hidden behind the keyboard when commenting on a file in the iOS app (#2694)
+- [Bug fix] Host-bound sessions relaunch immediately after a Stop or host restart instead of waiting out the runner-connect grace. (#2699)
+- [Test/CI] Add a `checkout_sha` input to the Benchmark workflow so nightly benchmarks can be run ad-hoc against a specific commit. (#2700)
+- [Bug fix / Test/CI] Fresh installs no longer resolve an OpenAI SDK combination that crashes every OpenAI Agents harness turn. (#2713)
+- [Feature] `omni import --harness <claude|codex> --last N` can now import up to 50 recent local chats at once. (#2724)
+- [UI / Bug fix] Cursor setup now distinguishes CLI readiness from SDK API-key configuration and shows install/login guidance before web chat launch. (#2733)
+- [UI] The Gateway option in model setup no longer cites OpenRouter as an example — use the dedicated OpenRouter option instead (#2738)
+- [Bug fix] Sandboxed (`darwin_seatbelt`) agents now boot when the helper interpreter or the wrapped CLI is reached through symlinks — uv-installed Pythons and the standalone Claude CLI no longer die with `Operation not permitted`. (#2743)
+- [Bug fix] A sandboxed claude-sdk agent no longer dies at connect time when its sandbox can't wrap the Claude CLI — it starts with native tools disabled (file/shell access stays sandboxed via the `sys_os_*` tools) and logs why. (#2749)
+- [Feature] `omnigent setup` can now install Hermes directly before configuring its model provider. (#2751)
+- [Bug fix] Sandboxed (`darwin_seatbelt`) agents no longer die at startup with "No usable temporary directory" — the private scratch tmpdir is now granted in the sandbox profile before the process is jailed. (#2759)
+- [Feature / Docs / Test/CI] Benchmark reports now measure cold restarts of existing sessions whose runner is offline. (#2761)
+- [Docs / Chore / Test/CI] Website release posts now use the narrative, prose-driven MLflow style (#2764)
+- [Bug fix] opencode-native carries the user config's model default into the synthesized config when no model is pinned (#2775)
+- [Feature] New sessions automatically get concise, useful titles generated by the agent already handling the conversation. (#2778)
+- [Bug fix] Forking a Claude Code session onto pi (or other CLIs) no longer fails to start with `required_terminal_exited` (#2780)
+- [Bug fix] Native Codex and Claude now resolve their CLI from common global install dirs and an `OMNIGENT_CODEX_PATH` / `OMNIGENT_CLAUDE_PATH` override when it isn't on the host daemon's PATH (#2788)
+- [Feature] Nightly benchmark report now includes server CPU% and RSS memory usage (mean/min/max) alongside latency metrics. (#2795)
+- [Bug fix] The changed-files panel now shows per-file line-change counts even when the list is served by the host (runner offline). (#2802)
+- [Bug fix] Harness readiness now finds CLIs installed in common global dirs (nvm/npm/homebrew) that aren't on the host daemon's PATH, matching what the launch resolves (#2805)
+- [UI / Bug fix / Feature] Config-file policies (declared via `omni server -c`) now appear in the admin Global Policies page as read-only entries labeled "Config". (#2807)
+- [Bug fix] Codex sessions now inherit global `AGENTS.md` instructions. (#2809)
+- [UI / Feature] Switching back to a recently-opened chat now renders instantly from cache instead of blanking and reloading over the network. (#2810)
+- [Bug fix] Allow the ACP prompt deadline to be configured without changing its default. (#2817)
+- [Feature] The Slack bot now handles tool approvals and questions inline — Approve/Deny (#2820)
+- [UI / Feature] The Share dialog now shows a QR code so you can open a session in the mobile app by scanning it with your phone. (#2824)
+- [Bug fix] Harness setup warnings now clear automatically without reconnecting the host. (#2828)
+- [UI / Feature] Android app shows a floating server switcher pill with a dropdown menu for quick server switching (#2829)
+- [Feature] Crash reports now show a calm, branded screen with a compact traceback and a one-tap prompt to file a pre-filled GitHub issue (#2841)
+- [UI / Bug fix] Parallel sub-agent dispatch now explains when to use distinct task titles instead of accidentally reusing and serializing one child session. (#2860)
+- [Bug fix] Fixed a context-window overflow on a live-streamed turn, leaking its harness process instead of ending the turn cleanly. (#2869)
+- [Bug fix] Fixed `/model show` (and `list`/`status`/`current`) bricking the session. (#2888)
+- [Bug fix] Clicking "Stop session" no longer shows a spurious "runner disconnected" error (#2903)
+- [UI / Bug fix] New-session Send button shows a spinner while the session is being created, instead of looking frozen (#2907)
+- [Feature / Breaking] Per-harness startup command/args overrides via a polymorphic `harness:` config key + `OMNIGENT_<NAME>_PATH` env-var standardization (legacy `HARNESS_*_PATH` deprecated, slated for v0.8.0 removal) (#2933)
+- [Bug fix] `omnigent[memory]` is restored as a backwards-compat alias for `omnigent[hindsight]` (the `memory` extra was dropped by #2605); it will be removed in 0.70. (#2938)
+- [Feature] `OMNIGENT_SESSION_RENAME=on` re-enables the automatic first-turn session rename (disabled by default) (#2944)
+
+## [v0.5.1] — 2026-07-10
+
+- [UI] The desktop Browser tab is now hidden on older desktop builds that don't support the embedded browser, instead of showing a tab that does nothing (#2393)
 
 ## [v0.5.0] — 2026-07-10
 

CONTRIBUTING.md

@@ -28,7 +28,9 @@ Install local prerequisites first:
 - `bubblewrap` (`bwrap`), **Linux only**, used to OS-sandbox those native
   Claude/Codex/Pi terminals (`apt install bubblewrap` on Debian/Ubuntu). macOS
   uses the built-in `seatbelt` sandbox and needs nothing extra.
-- Node.js 22 LTS or newer with `npm` when working on `web/`.
+- Node.js 22 LTS or newer with `pnpm` (install via `corepack enable` or
+  `npm install -g pnpm`) when working on `web/`.
+- A Rust toolchain for the recommended `omnidev` local development supervisor.
 
 ```bash
 git clone https://github.com/omnigent-ai/omnigent.git
@@ -42,33 +44,91 @@ source .venv/bin/activate    # or prefix commands with `uv run`
 
 Common checks:
 
+Pyrefly is the canonical Python type checker for the repository.
+
 ```bash
 uv run pytest                      # Python tests (e2e/live skipped by default)
 uv run ruff check . && uv run ruff format --check .
+uv run --no-sync pyrefly check     # Python type checking (core and client SDK)
 uv run pre-commit run --all-files
 ```
 
 When touching `web/`:
 
 ```bash
-cd web && npm install && npm run lint && npm run build
+cd web && pnpm install && pnpm run lint && pnpm run type-check && pnpm run build
+```
+
+When touching `editors/vscode/`:
+
+```bash
+cd editors/vscode && pnpm install && pnpm run type-check && pnpm run test && pnpm run build
 ```
 
 ## Running locally
 
-To try your changes, start a local server, register your machine as a host,
-and run the frontend dev server. Use three separate terminals:
+Start with the smallest relevant automated test described in [Tests](#tests).
+For full-stack manual testing, use `omnidev`.
+
+### Recommended: worktree-safe testing with `omnidev`
+
+`omnidev` runs the current checkout's server, host, and Vite frontend in one
+terminal. Each checkout path, including each worktree, gets isolated state,
+configuration, database, artifacts, logs, and automatically allocated ports,
+so it can run alongside your normal Omnigent installation and other worktrees.
+
+Install the supervisor once from an up-to-date checkout:
+
+```bash
+cargo install --path dev/omnidev --force
+```
+
+Then run it from anywhere inside the branch checkout or worktree you want to
+test. A fresh worktree needs its own Python environment first:
+
+```bash
+cd /path/to/omnigent-worktree
+uv sync --extra all --extra dev
+omnidev
+```
+
+Open the exact `ui` URL displayed in the header; do not assume the Vite port is
+`5173`. Python changes under `omnigent/` reload the server and host, while
+frontend changes use Vite HMR.
+
+Run CLI commands against the development pod through the passthrough so they
+use that checkout and its isolated state instead of a globally installed
+`omnigent`:
+
+```bash
+omnidev omnigent config show
+omnidev omnigent agent list
+```
+
+Keep `omnidev` in the foreground and quit with `q` or `Ctrl-C` so it tears down
+all three processes. An interactive terminal inside an existing Omnigent
+session also works; use `git rev-parse --show-toplevel` to confirm that its
+current checkout is the one you intend to test.
+
+See [`dev/omnidev/README.md`](dev/omnidev/README.md) for log controls,
+clean-state testing, backend-only and LAN modes, and other options.
+
+### Manual three-terminal fallback
+
+Use the manual flow when you need to run or debug each component separately.
+Unlike `omnidev`, it does not isolate state or allocate ports. These commands
+assume the default ports are free:
 
 ```bash
 # Terminal 1: local server on :6767
-omnigent server
+uv run omnigent server
 
 # Terminal 2: register your machine as a host
-omnigent host --server http://localhost:6767
+uv run omnigent host --server http://localhost:6767
 
 # Terminal 3: frontend dev server
 cd web
-npm run dev
+pnpm run dev
 ```
 
 Open the Vite URL from the frontend dev server, usually
@@ -81,7 +141,7 @@ The host URL can also be passed positionally (`omnigent host
 http://localhost:6767`). See the [README](README.md) for more on hosts,
 harnesses, and credentials.
 
-### Backend-only local development validation
+### Disposable backend-only validation
 
 Use this when you want to validate the Python backend and local API server from
 a source checkout without building the web UI, configuring provider
@@ -169,7 +229,7 @@ Two cross-cutting suites sit on top of these:
 Frontend changes follow the same expectation with a different toolchain:
 
 - Add or update a **colocated Vitest test** — a `*.test.ts`/`*.test.tsx` file
-  next to the component or module you changed — and run it with `npm test`.
+  next to the component or module you changed — and run it with `pnpm test`.
 - A change to **user-facing UI behaviour** also needs a Playwright test under
   `tests/e2e_ui/`. This one is enforced mechanically by the `E2E UI Required`
   check, so a UI PR won't merge without a covering test (or a maintainer
@@ -177,10 +237,27 @@ Frontend changes follow the same expectation with a different toolchain:
 - Styling/formatting-only changes, copy tweaks with no flow change, and
   refactors with no behaviour change are exempt, same as the backend.
 
+## Developer Certificate of Origin
+
+To contribute to this repository, you must sign off your commits to certify
+that you have the right to contribute the code and that it complies with the
+open source license. If you can certify the contents of the [DCO](DCO), add a
+`Signed-off-by` line to each commit message:
+
+```
+Signed-off-by: Joe Smith <joe.smith@email.com>
+```
+
+Please use your real name — pseudonymous/anonymous contributions are not
+accepted. If your `user.name` and `user.email` git configs are set, `git
+commit -s` adds the sign-off automatically. The DCO check on every pull
+request enforces this, so unsigned commits will block merging.
+
 ## Pull requests
 
 - Branch from `main`, keep changes focused, and include tests or docs when relevant.
-- Sign off your commits with `git commit -s` (Developer Certificate of Origin).
+- Sign off your commits with `git commit -s` (see
+  [Developer Certificate of Origin](#developer-certificate-of-origin) above).
 - Fill in the PR template. For **UI / frontend changes**, check the
   "UI / frontend change" box and attach a **video or images** in the `Demo`
   section showing the new behaviour, so reviewers can see it without checking

DCO

@@ -0,0 +1,34 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.

README.md

@@ -122,10 +122,10 @@ uv tool install -q --python 3.12 git+https://github.com/omnigent-ai/omnigent.git
 - **`uv`** (required). https://docs.astral.sh/uv/getting-started/installation/
   The installer offers to set this up for you.
 - **`git`** (required).
-- **Node.js 22 LTS or newer** with **`npm`**, for the npm-installed coding
-  harnesses (Claude, Codex, OpenCode, Pi). `omnigent run` installs the
-  harness CLI you pick.
-  https://docs.npmjs.com/downloading-and-installing-node-js-and-npm
+- **Node.js 22 LTS or newer** with **`npm`** (for the coding-harness CLIs
+  installed by `omnigent run`) and **`pnpm`** (for the web UI). You can get
+  both from a single Node install; pnpm is available via
+  `corepack enable` or `npm install -g pnpm`.
 - **Kiro CLI** (optional), for `omnigent kiro`: install with
   `curl -fsSL https://cli.kiro.dev/install | bash`, then sign in with Kiro.
   Kiro tool approvals stay answerable in the embedded Terminal; supported
@@ -267,6 +267,9 @@ omnigent hermes                      # Hermes Agent (Nous Research)
 omnigent pi                          # Pi
 ```
 
+Using OpenClaw? See the [OpenClaw integration guide](docs/openclaw.md) to import
+its coding agents or drive a live OpenClaw Gateway session over ACP.
+
 #### 🐙 Polly and 🟠🔵 Debby
 
 Two example agents ship with the repo, and they make good first sessions:
@@ -274,6 +277,7 @@ Two example agents ship with the repo, and they make good first sessions:
 ```bash
 omnigent run examples/polly/
 omnigent run examples/debby/
+omnigent run examples/deep-research/
 
 # ...or on a different harness (sub-agents keep their own):
 omnigent run examples/polly/ --harness <harness>
@@ -291,6 +295,12 @@ side by side. Type `/debate` and the heads critique each other for a few
 rounds before converging. (She needs both a Claude and an OpenAI credential;
 see step 3.)
 
+**🔎 Deep Research** is a single agent that answers a question with a cited,
+cross-checked report. It plans sub-queries, searches the live web and reads
+full pages through an MCP search server, and verifies each claim across
+independent sources. It's also the simplest example to copy from: one agent
+plus one `tools/mcp/*.yaml` server, no sub-agents.
+
 **Prefer the browser?** Start a server and register your machine as a host:
 
 ```bash
@@ -414,6 +424,11 @@ and they're in. Signup is invite-only.
   omnigent run --fork <session_id>
   ```
 
+Shared sessions identify model-visible messages with `[account]:` labels by
+default. Set `OMNIGENT_SHARED_MESSAGE_ATTRIBUTION_ENABLED=0` to hide those
+labels. This does not change stored authors, UI avatars, or who may approve or
+run privileged actions.
+
 > [!TIP]
 > Want your team to sign in with the logins they already have (**Google,
 > GitHub, Okta, Microsoft**)? Set `OMNIGENT_OIDC_ISSUER` plus a client ID

RELEASING.md

@@ -1,307 +0,0 @@
-# Releasing omnigent
-
-omnigent ships **three PyPI packages that version-lock together**:
-
-| Package | What it is |
-| --- | --- |
-| `omnigent` | core wheel (bundles the `web` web UI) |
-| `omnigent-client` | Python client SDK |
-| `omnigent-ui-sdk` | terminal UI SDK |
-
-`pip install omnigent==X` must resolve `omnigent-client==X` and
-`omnigent-ui-sdk==X`. The pins are **lockstep** (the three packages co-version and
-pin each other with `==`), so every release builds and publishes **all three at
-one identical version**.
-
-Releases are driven by **workflow dispatches, not by hand** (design:
-`designs/RELEASE-AUTOMATION.md`). Every workflow below is idempotent —
-re-dispatch with identical inputs after any failure and it converges — and
-every dispatch requires the **admin or maintain** role on this repo.
-
-## Where things run
-
-- **Source of truth** (versions, tags, GitHub Releases): **`omnigent-ai/omnigent`**
-  — use the **OSS GitHub account** (the personal account with push/release rights
-  on the public repo).
-- **Publishing to PyPI**: the central **secure-release repo**
-  **`databricks/secure-public-registry-releases-eng`**, `omnigent` workflow —
-  use whichever account has access to that repo. Publishing runs on hardened runner
-  groups with **OIDC Trusted Publishing (no stored secrets)** and a **mandatory
-  dependency scan**. This is why we don't publish from `omnigent-ai/omnigent`,
-  and why the pipeline is two dispatches per phase rather than one.
-
-> The exact account handles — and how to request publish access — live in the
-> internal release wiki; this public runbook refers to them only by role.
-
-The legacy `.github/workflows/release-omnigent.yml` in this repo is a
-**deprecated manual fallback only** — its tag-push trigger was removed so a tag
-never double-publishes. Use the secure repo for real releases.
-
-## Versioning model
-
-- `main` always carries the **next** version with a `.dev0` suffix
-  (e.g. `0.6.0.dev0`) — never a clean released number. This matches
-  MLflow / Delta / Unity Catalog and keeps every `main` build PEP 440-ordered as
-  "ahead of the last release, not yet the next one".
-- Releases are cut on **per-minor release branches** (`release/vX.Y.0`) and tagged
-  there (`vX.Y.Z`, rc tags `vX.Y.ZrcN`); patches (`vX.Y.1`, `vX.Y.2`, …) are
-  cherry-picked onto the same `release/vX.Y.0`. `main` is never tagged.
-- Every release ships as an **rc first** (`0.6.0rc1` → … → `0.6.0`). rcs go to
-  **real PyPI** as PEP 440 pre-releases — a default `pip install omnigent`
-  never resolves them, and testers install with exact pins. TestPyPI is no
-  longer part of the standard flow.
-
-## Docs staging
-
-Because `main` carries the **next** version, the docs generated from merged PRs
-describe a release that isn't out yet — so they must **not** deploy to the live
-site on merge. Two workflows enforce this by staging onto a **per-minor docs
-branch** on `omnigent-site` instead of `main`:
-
-- **`doc-sync.yml`** — drafts prose docs for each merged PR that needs them.
-- **`sync-openapi-to-site.yml`** — syncs the API reference (`openapi.json`).
-
-Both derive the branch name from `omnigent/version.py` (`0.6.0.dev0` → `0.6-docs`)
-and create it off site `main` the first time a doc PR lands in the cycle. All docs
-for the `0.6` line — including patches — accumulate on `0.6-docs`. Each PR still
-gets its own review, but merging one only lands it on the staging branch, not the
-live site. At finalize time, the whole batch goes live at once (step 4 below).
-
----
-
-## Standard flow
-
-### rc phase (example: `0.6.0rc1`)
-
-**1. Cut + tag — dispatch `Release` (`release.yml`), OSS account.**
-
-```bash
-gh workflow run release.yml --repo omnigent-ai/omnigent \
-  -f version=0.6.0rc1 -f dry_run=false
-# optional: -f ref=<sha> to cut release/v0.6.0 from a specific commit (rc1 only);
-# dry_run defaults to true — run once without -f dry_run to preview the plan.
-```
-
-What it does (all idempotent):
-
-- asserts green CI on the base commit (escape hatch: `-f skip_ci_check=true`,
-  use deliberately — needed for a flaky check, or when the base commit ran no
-  checks at all, e.g. a cherry-pick that only touched `paths-ignore`d files);
-- creates `release/v0.6.0` from `ref` (rc1) or reuses the existing branch head
-  (rc2+, final, patches — `ref` is ignored then);
-- stamps the lockstep version via `scripts/update_versions.py` and regenerates
-  `uv.lock` with a clean public-PyPI resolution — **never hand-edit `uv.lock`
-  or run `uv lock` behind a proxy**; the workflow owns this now;
-- commits `release: v0.6.0rc1`, tags, and pushes branch + tag with the
-  omnigent-ci App token, which fires the downstream automation:
-  `github-release.yml` (draft GH release, pre-release flagged),
-  `draft-release-notes.yml`, and `oss-publish-images.yml` (Docker);
-- on the **first** cut of a cycle (rc1), dispatches `bump-version.yml`
-  (post-release) — **review and merge the `main → 0.7.0.dev0` bump PR
-  promptly**, so `doc-sync` keeps staging to the right docs branch.
-
-**2. Publish to PyPI — dispatch the secure repo (EMU account).**
-
-```bash
-gh auth switch --user <secure-repo-account>
-gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
-  -f ref=v0.6.0rc1 -f destination=pypi -f dry-run=true    # gates rehearsal
-gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
-  -f ref=v0.6.0rc1 -f destination=pypi -f dry-run=false   # real publish
-```
-
-The dry run exercises build + dependency scan + the gates (lockstep
-version/pins, web-UI-in-wheel, `twine check`, smoke-install) and the OIDC
-token exchange without uploading. The real run binds the per-package
-Trusted-Publisher environments (may gate on reviewer approval) and re-verifies
-that `ref` is exactly the tag and points at the built commit.
-
-**3. Validate from PyPI** (clean venv; exact pins resolve pre-releases;
-behind a corporate network, point `--index-url` at your PyPI mirror
-instead — this is a manual step on purpose: the secure repo's runners
-cannot see a fresh index view, so no CI job can do it):
-
-```bash
-python -m venv /tmp/omni-rc && /tmp/omni-rc/bin/pip install \
-  --index-url https://pypi.org/simple/ \
-  omnigent==0.6.0rc1 omnigent-client==0.6.0rc1 omnigent-ui-sdk==0.6.0rc1
-/tmp/omni-rc/bin/omnigent --version    # expect 0.6.0rc1
-```
-
-The rc's GitHub draft stays **unpublished** — rc drafts are never published.
-Need another candidate? Repeat with `0.6.0rc2` (fixes land on `release/v0.6.0`
-first, via cherry-pick PRs or direct pushes; CI runs on `release/v*` pushes).
-
-### Final phase (example: `0.6.0`)
-
-1. **Cut + tag**: `gh workflow run release.yml -f version=0.6.0 -f dry_run=false`
-   — same as above; builds from the `release/v0.6.0` head.
-2. **Publish to PyPI**: same secure-repo dispatches on `ref=v0.6.0`.
-3. **Curate**: merge the `CHANGELOG.md` PR that `draft-release-notes.yml`
-   opened, and review/trim the curated notes in the `v0.6.0` draft on the
-   Releases page — whatever you leave becomes the website post.
-4. **Finalize — dispatch `Finalize release` (`finalize-release.yml`)**:
-
-   ```bash
-   gh workflow run finalize-release.yml --repo omnigent-ai/omnigent -f tag=v0.6.0
-   ```
-
-   It verifies PyPI serves all three packages, the CHANGELOG PR isn't open,
-   and the **docs sweep**: no open PRs against `0.6-docs` on `omnigent-site`
-   (it lists any stragglers — get them reviewed and merged/closed, then
-   re-dispatch). Then it pauses on the **`publish-release` environment**;
-   approving it attests "I reviewed the draft notes". It publishes the release
-   as **Latest**, which fires:
-   - `publish-changelog.yml` → the site **release-post PR** and the
-     **`0.6-docs → main` docs-publish PR** — review and merge both;
-   - `update-homebrew.yml` → the **homebrew-tap bump PR** (new sdist pin +
-     regenerated resources; test-bot builds the bottles on it) — review the
-     resource diff, then apply the **`pr-pull`** label to bottle + merge.
-
-### Patch release (example: `0.6.1`)
-
-Cherry-pick the fixes onto `release/v0.6.0` (CI runs on the push), then run the
-same flow with `version=0.6.1` — an rc first if the patch warrants one. `main`
-does not change for a patch, and a patch never needs a new branch.
-
----
-
-## One-time setup (repo admin)
-
-- **`publish-release` environment** on `omnigent-ai/omnigent` with required
-  reviewers = the release managers. Without it the finalize publish job runs
-  ungated.
-- **omnigent-ci App** installed on `omnigent-ai/homebrew-tap` (it already
-  covers `omnigent` and `omnigent-site`).
-- **Tag ruleset** (recommended): restrict `v[0-9]*` create/update/delete to
-  the omnigent-ci App + admins, so no write-access account can start the
-  tag-push automation by hand.
-
-## If a publish goes wrong (recovery)
-
-**PyPI releases can't be deleted, only _yanked_**, and a version number once used
-can never be reused. So:
-
-- **Any workflow failed mid-run:** fix the cause and **re-dispatch with the
-  same inputs** — every step converges (branch exists → reused; version
-  stamped → no new commit; tag at the converged commit → no-op) or fails
-  loudly (tag elsewhere) rather than duplicating work.
-- **Wrong commit tagged, nothing published yet:** delete the tag and draft
-  (`gh release delete vX.Y.Z`, `git push origin :refs/tags/vX.Y.Z`), then
-  re-dispatch `release.yml`.
-- **rc is bad:** just cut the next rc — rcs are cheap and invisible to
-  default installs.
-- **Prod publish partially succeeded** (e.g. two of three packages uploaded):
-  **yank** the published version(s) on PyPI (each affected project → *Manage* →
-  *Releases* → *Yank*) so installs don't resolve a half-published set, then cut
-  the next version with the fix. Don't try to overwrite — Trusted Publishing /
-  `twine` rejects re-uploading an existing version.
-- Publishing uses **OIDC Trusted Publishing (no stored secrets)**, so a failed
-  run leaks nothing — fix forward to the next version.
-
----
-
-## Rehearsing the pipeline (throwaway rc release)
-
-To exercise the whole flow end to end without touching users, release a
-deliberately **below-latest** rc on the dead `0.0` line. A below-latest rc is
-inert everywhere that matters: the GitHub draft stays unpublished, Docker
-publishes only the immutable version image tag (`:latest` / `:latest-rc` only
-move for the highest version), the notes/site/homebrew workflows ignore rc
-tags, `bump-main` skips itself (the version sorts below main's), and a
-PEP 440 pre-release is never resolved by a default `pip install` — on real
-PyPI or TestPyPI alike.
-
-**Pick a version that has never touched the destination index.** PyPI
-filenames are burned forever — even for yanked releases — so reusing a number
-fails the upload with "File already exists". (`0.0.1rc1` itself is spent: it
-reserved the PyPI project names in June 2026.) Confirm before starting; a 404
-means the version is free:
-
-```bash
-curl -fsS https://pypi.org/pypi/omnigent/0.0.1rc2/json   # expect 404
-```
-
-The examples below use `0.0.1rc2`; substitute the next free number.
-
-1. **Plan (read-only)** — dry run is the default:
-
-   ```bash
-   gh workflow run release.yml --repo omnigent-ai/omnigent -f version=0.0.1rc2
-   ```
-
-2. **Execute**: re-run with `-f dry_run=false`. Expect `release/v0.0.0` + tag
-   `v0.0.1rc2` pushed, the tag firing the draft-release and image workflows,
-   and CI running on the branch push. If the CI gate rejects main's head
-   (failing or still-pending checks), that's the gate working — wait, or
-   re-dispatch with `-f ref=<green sha>` / `-f skip_ci_check=true`.
-   Cancelled (superseded) runs only warn.
-3. **Idempotency**: dispatch the exact same command again — it must no-op
-   ("already at the converged release commit").
-4. **Secure-repo publish.** Real PyPI is safe for a below-latest rc and
-   exercises the full prod path (the tag gate + the per-package reviewer
-   environments; approve all three) — so rehearse against
-   `destination=pypi`. `destination=test-pypi` also works, but skips the
-   prod tag gate and needs TestPyPI Trusted Publishers configured. Then
-   validate the published rc manually, exactly like a real release (step 3
-   of the standard flow).
-
-   ```bash
-   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
-     -f ref=v0.0.1rc2 -f destination=pypi -f dry-run=true    # gates only
-   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
-     -f ref=v0.0.1rc2 -f destination=pypi -f dry-run=false   # real publish
-   ```
-
-5. **No-double-publish check** (optional): re-dispatching step 4's second
-   command must FAIL every leg with "File already exists" — PyPI
-   immutability doing its job. The publish is deliberately **write-only**:
-   the release runners cannot read the index, so there is no
-   already-published skip (a curl probe and twine's `--skip-existing` both
-   failed live for exactly that reason). A real partial publish is recovered
-   by yank + next version (see "If a publish goes wrong").
-6. **Finalize gates (no side effects)**:
-   `gh workflow run finalize-release.yml -f tag=v0.0.1rc2` must fail fast
-   ("not a final tag"), and `-f tag=v0.5.1` (any already-published release)
-   must no-op as already published.
-
-Cleanup — delete everything the rehearsal minted on GitHub:
-
-```bash
-gh release delete v0.0.1rc2 --repo omnigent-ai/omnigent --cleanup-tag --yes
-gh api -X DELETE 'repos/omnigent-ai/omnigent/git/refs/heads/release/v0.0.0'
-```
-
-Optionally delete the rehearsal image versions from GHCR. The PyPI side needs
-no cleanup: the rc is invisible to default installs and only the version
-number is spent — optionally yank it (*Manage → Releases → Yank*) for
-tidiness.
-
----
-
-## Break-glass appendix (manual fallback)
-
-If the workflows are unavailable, the flow can be driven by hand — but keep two
-rules even then:
-
-1. **Never hand-edit `uv.lock` and never run `uv lock` behind a proxy.** Use
-   `bump-version.yml` (mode `pre-release`, `base_branch=release/vX.Y.0`) to
-   produce the bump as a PR with a cleanly regenerated lockfile, and merge it.
-2. **Push tags from an account, not automation you improvised** — the tag push
-   must fire `github-release.yml` et al., which a `GITHUB_TOKEN`-authored push
-   would not.
-
-```bash
-gh auth switch --user <oss-account>
-git fetch origin && git checkout -b release/v0.6.0 origin/main   # rc1 only
-gh workflow run bump-version.yml -f mode=pre-release -f new_version=0.6.0rc1 \
-  -f base_branch=release/v0.6.0                                  # then merge the PR
-git fetch origin && git checkout release/v0.6.0 && git pull
-git tag v0.6.0rc1 && git push origin release/v0.6.0 v0.6.0rc1    # explicit tag, NOT --tags
-```
-
-Then continue from step 2 of the standard flow (secure-repo dispatches). If the
-GH draft wasn't created, `gh release create vX.Y.Z --draft --verify-tag
---title vX.Y.Z` recreates it. To re-run the notes/site halves for an existing
-tag, dispatch `draft-release-notes.yml` or `publish-changelog.yml` with the
-`tag` input; for the tap, dispatch `update-homebrew.yml`.

config.yaml

@@ -1,3 +0,0 @@
-llm:
-  model: databricks-claude-haiku-4-5
-  profile: oss

deploy/README.md

@@ -177,6 +177,39 @@ remote DB.
 256 MB default does not, so the Fly config pins a 1 GB machine, and the
 Modal app pins `memory=1024` for the same reason.
 
+## Serving: put an HTTP/2 proxy in front for many concurrent views
+
+Each open session in the web UI holds a long-lived streaming HTTP
+response (`GET /v1/sessions/{id}/stream`, `text/event-stream`) for as
+long as the view is on screen. Over **HTTP/1.1 browsers cap concurrent
+connections at ~6 per origin**, and every open stream occupies one of
+those slots. Open a handful of windows or tabs against the same server
+and the pool fills with held-open streams — then every *other* request
+the UI makes (sending a message, the session list, `/health`, auth)
+queues behind the cap and never fires. The symptom is the whole UI
+appearing to freeze across all windows while the server itself is idle;
+in DevTools → Network the stuck requests sit in **Stalled/Queued**, not
+"waiting for server".
+
+**Fix: serve over HTTP/2.** HTTP/2 multiplexes every stream over one
+connection, so the per-origin cap stops mattering. `uvicorn` (the
+server's ASGI server) speaks HTTP/1.1 only, so HTTP/2 comes from a
+reverse proxy that terminates TLS in front of it — which most real
+deploys already have:
+
+- **The bundled Caddy overlay** (`docker/docker-compose.https.yaml`)
+  gives you this for free — Caddy negotiates HTTP/2 (and HTTP/3) over
+  TLS via ALPN with no extra config. See
+  [`docker/README.md`](docker/README.md#multi-user-mode-oidc).
+- **The one-click platforms** (Render, Railway, Fly, Cloudflare) and
+  managed **Databricks** terminate TLS with HTTP/2 at their edge, so
+  they're already covered.
+
+The gap is only when you expose the raw `:8000` HTTP/1.1 port directly
+to browsers (e.g. `docker compose up` with no proxy, reached over
+plain HTTP). That's fine for a single window; put a proxy in front once
+you or your team routinely open several.
+
 ## Execution model
 
 Omnigent runs in two pieces that talk to each other over a

deploy/boxlite/README.md

@@ -83,6 +83,7 @@ sandbox:
   boxlite:
     image: docker.io/me/omnigent-host:latest     # optional, shared; default: official
     env: [OPENAI_API_KEY, GIT_TOKEN]             # optional, shared; SERVER env var NAMES
+    disk_size_gb: 100                            # optional, shared; default: SDK default
     cloud:
       endpoint: https://boxlite.example.com:8100 # selects CLOUD mode
 ```

deploy/cloudflare/README.md

@@ -68,8 +68,8 @@ browser ───────────────►  Worker (src/index.js)
 
 ```bash
 cd deploy/cloudflare
-npm install
-npx wrangler login
+pnpm install
+pnpm exec wrangler login
 ```
 
 ## Deploy

deploy/databricks/build.sh

@@ -28,10 +28,8 @@ rm -rf omnigent/server/static/web-ui dist build omnigent.egg-info
 
 if [[ "${SKIP_WEB_UI:-}" != "1" ]]; then
     echo "==> Building web SPA into omnigent/server/static/web-ui/"
-    cd web
-    npm install
-    npm run build
-    cd "${REPO_ROOT}"
+    pnpm install --frozen-lockfile --filter web
+    pnpm --filter web run build
 else
     echo "==> SKIP_WEB_UI=1: skipping web build"
 fi

deploy/databricks/src/app.py

@@ -153,6 +153,9 @@ try:
         SqlAlchemyPermissionStore,
     )
     from omnigent.stores.policy_store.sqlalchemy_store import SqlAlchemyPolicyStore
+    from omnigent.stores.project_store.sqlalchemy_store import (
+        SqlAlchemyProjectStore,
+    )
     from omnigent.stores.scheduled_task_store.sqlalchemy_store import (
         SqlAlchemyScheduledTaskStore,
     )
@@ -182,6 +185,7 @@ try:
     file_comment_store = SqlAlchemyCommentStore(DB_URI)
     permission_store = SqlAlchemyPermissionStore(DB_URI)
     policy_store = SqlAlchemyPolicyStore(DB_URI)
+    project_store = SqlAlchemyProjectStore(DB_URI)
     host_store = HostStore(DB_URI)
     scheduled_task_store = SqlAlchemyScheduledTaskStore(DB_URI)
 
@@ -215,6 +219,7 @@ try:
         comment_store=file_comment_store,
         permission_store=permission_store,
         policy_store=policy_store,
+        project_store=project_store,
         host_store=host_store,
         scheduled_task_store=scheduled_task_store,
         auth_provider=auth_provider,

deploy/docker/.env.example

@@ -34,13 +34,19 @@ POSTGRES_PASSWORD=change-me-please
 # instance.
 #
 #   A) Built-in accounts (DEFAULT — no env needed for laptop testing).
-#      First boot auto-creates an admin user (named after the OS
-#      user, falling back to "admin"), prints the password to
-#      `docker compose logs omnigent`, and saves it to
-#      /data/admin-credentials on the persistent volume. Admin
-#      invites teammates via the web UI Members page.
+#      No credentials are auto-generated. First boot prints a
+#      "No admin yet" line pointing at the base URL; you create the
+#      first admin (username + password) via the web Create-admin
+#      form, or pre-seed it with OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD.
+#      Admin invites teammates via the web UI Members page.
 #      For any deploy behind a public domain you MUST set
 #      OMNIGENT_ACCOUNTS_BASE_URL — see below.
+#      Security note for public deployments: POST /auth/setup is
+#      intentionally unauthenticated while no password-bearing account
+#      exists, so an instance exposed before its operator reaches the
+#      form can be claimed by the first visitor. Pre-seed
+#      OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD, or keep the service
+#      private until setup completes.
 #
 #   B) Native OIDC (for shops with an existing IdP).
 #      Set the OMNIGENT_OIDC_* vars below (at minimum
@@ -82,9 +88,14 @@ POSTGRES_PASSWORD=change-me-please
 # omnigent:8000 container address.
 # OMNIGENT_ACCOUNTS_BASE_URL=https://omnigent.example.com
 #
-# Optional: pre-seed the initial admin password instead of the
-# auto-generated one. Useful for headless / CI deploys where
-# the operator can't read `docker compose logs`.
+# Optional: pre-seed the initial admin password so bootstrap creates
+# the first admin directly, instead of waiting for someone to claim it
+# through the web Create-admin form. Useful for headless / CI deploys
+# where that form can't be reached interactively. Nothing is ever
+# auto-generated: without this (and without an OIDC issuer) a fresh
+# instance stays in the needs-setup state and prints the setup URL to
+# stderr — no password appears in the logs. See the security note under
+# section A above for public deployments.
 # OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD=
 #
 # Optional: session/invite/magic TTLs. Defaults shown.

deploy/docker/Caddyfile

@@ -5,6 +5,13 @@
 # over the internal docker network — the omnigent container is no
 # longer directly exposed to the host.
 #
+# Fronting the server with Caddy also gives you HTTP/2 (negotiated over
+# TLS via ALPN, no extra config). That matters beyond HTTPS: each open
+# session in the web UI holds a long-lived event-stream connection, and
+# HTTP/1.1's ~6-connections-per-origin cap makes the UI stall once a
+# user opens several windows/tabs. HTTP/2 multiplexes them over one
+# connection, so this proxy is the fix. See ../README.md ("Serving").
+#
 # No ACME email is required: Let's Encrypt allows anonymous account
 # registration, so the cert issues without one. If you WANT expiry /
 # renewal notices, add a global email option above the site block:

deploy/docker/Dockerfile

@@ -55,7 +55,7 @@
 
 # Must satisfy pyproject requires-python (>=3.12); 3.11 fails dependency resolution.
 ARG PYTHON_VERSION=3.12
-ARG NODE_VERSION=20
+ARG NODE_VERSION=22
 
 # ── Web UI builder ──────────────────────────────────────
 # Builds the web SPA so `docker build` works from a clean checkout —
@@ -70,12 +70,20 @@ ARG NODE_VERSION=20
 FROM node:${NODE_VERSION}-slim AS web-builder
 ARG NPM_CONFIG_REGISTRY=
 ENV NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}
-WORKDIR /web/web
-# Manifests first so the install layer caches across pure source edits.
-COPY web/package.json web/package-lock.json ./
-RUN npm install --no-audit --no-fund
-COPY web/ ./
-RUN npm run build
+WORKDIR /web
+
+# Workspace manifests + lockfile first so the install layer caches across pure
+# source edits. The electron package JSON is included so the root workspace is
+# structurally complete, but we --filter web to avoid downloading Electron.
+COPY pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY web/package.json ./web/
+COPY web/electron/package.json ./web/electron/
+
+RUN npm install -g pnpm@11.15.1
+RUN pnpm install --frozen-lockfile --filter web
+
+COPY web/ ./web/
+RUN pnpm --filter web run build
 
 # ── Python builder (shared: server + host) ──────────────
 # Installs the package (and its transitive native-extension deps) into

deploy/docker/Dockerfile.ubi

@@ -13,7 +13,7 @@
 #                -f deploy/docker/Dockerfile.ubi .
 
 ARG PYTHON_VERSION=3.12
-ARG NODE_VERSION=20
+ARG NODE_VERSION=22
 
 # ── Web UI builder ──────────────────────────────────────
 FROM registry.access.redhat.com/ubi9/nodejs-${NODE_VERSION} AS web-builder
@@ -21,11 +21,20 @@ ARG NPM_CONFIG_REGISTRY=
 ENV NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}
 
 USER 0
-WORKDIR /web/web
-COPY web/package.json web/package-lock.json ./
-RUN npm install --no-audit --no-fund
-COPY web/ ./
-RUN npm run build
+WORKDIR /web
+
+# Workspace manifests + lockfile first so the install layer caches across pure
+# source edits. The electron package JSON is included so the root workspace is
+# structurally complete, but we --filter web to avoid downloading Electron.
+COPY pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY web/package.json ./web/
+COPY web/electron/package.json ./web/electron/
+
+RUN npm install -g pnpm@11.15.1
+RUN pnpm install --frozen-lockfile --filter web
+
+COPY web/ ./web/
+RUN pnpm --filter web run build
 
 # ── Python builder (shared: server + host) ──────────────
 FROM registry.access.redhat.com/ubi9/python-312 AS builder

deploy/docker/README.md

@@ -43,40 +43,47 @@ docker compose down -v
 
 Built-in accounts auth: no IdP to register, no proxy to host.
 This is the default — `docker compose up -d` brings it up with no
-extra env wiring. First boot creates an admin user (named after the
-operator's OS user, falling back to `admin` in headless containers)
-with a random password that lands in the container logs and on the
-persistent volume at `/data/admin-credentials`.
+extra env wiring. No credentials are auto-generated. On first boot,
+when no admin exists yet and none was pre-seeded, the server creates
+nothing and prints:
+
+```
+→ No admin yet. Open <base_url> to create the first admin account (choose a username + password).
+```
+
+You then open the web UI's **Create admin** form (it appears while no
+admin exists) and pick your own username + password.
 
 For any deploy reachable through a public domain, also set the
-external URL so invite links resolve correctly:
+external URL so the printed link and invite links resolve correctly:
 
 ```bash
 # Add to .env (bootstrap.sh already minted the cookie secret for you):
 OMNIGENT_ACCOUNTS_BASE_URL=https://omnigent.example.com
 
 docker compose up -d
-docker compose logs omnigent | grep -A4 "Created initial admin"
+docker compose logs omnigent      # shows the "No admin yet" line with your base URL
 ```
 
-Copy the random `password` from the log line into the web UI's
-login form, then:
+Once you've created the admin and signed in:
 
 - Click your username in the top-right → **Members** → **Invite member**.
 - Share the single-use URL with the teammate; they pick their own
   username and password when they redeem it.
 - Sign-out lives in the same account menu.
 
-Headless deploy (CI, Cloud Run, etc.) where you can't read the
-logs? Pre-seed the password:
+Headless deploy (CI, Cloud Run, etc.) where you can't reach the
+Create-admin form? Pre-seed the admin password so first boot creates
+the admin directly:
 
 ```bash
 OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD=<your-strong-password>
 ```
 
-The persistent password file is at `/data/admin-credentials` on
-the `artifact-data` volume — survives `docker compose restart`,
-deleted by `docker compose down -v`.
+`OMNIGENT_ADMIN_CREDENTIALS_PATH` (set to `/data/admin-credentials`
+in `docker-compose.yaml`) anchors the persistent state directory on
+the `artifact-data` volume — it survives `docker compose restart` and
+is deleted by `docker compose down -v`.
 
 ## Multi-user mode (OIDC)
 

deploy/docker/bootstrap.sh

@@ -94,8 +94,9 @@ echo
 echo "✓ deploy/docker/.env is ready. Next:"
 echo "    docker compose up -d && docker compose logs omnigent"
 echo
-echo "  Accounts mode is the default — the first-boot admin password"
-echo "  lands in the logs and in /data/admin-credentials on the"
-echo "  persistent volume. For any public-domain deploy also set:"
+echo "  Accounts mode is the default — no credentials are auto-generated."
+echo "  First boot prints a 'No admin yet' line; open that URL and create"
+echo "  the first admin (username + password) via the web form. For any"
+echo "  public-domain deploy also set:"
 echo "    OMNIGENT_ACCOUNTS_BASE_URL=<your public URL>"
-echo "  in .env so invite links resolve to the right host."
+echo "  in .env so that link and invite links resolve to the right host."

deploy/docker/docker-compose.yaml

@@ -8,9 +8,11 @@
 #   open http://localhost:8000  # web UI; start a local runner per the prompt
 #
 # Auth modes (OMNIGENT_AUTH_PROVIDER):
-#   - accounts (DEFAULT) — built-in accounts, no IdP needed. First
-#     boot prints the admin password to `docker compose logs` and
-#     saves it to /data/admin-credentials. Set
+#   - accounts (DEFAULT) — built-in accounts, no IdP needed. No
+#     credentials are auto-generated; first boot prints a "No admin
+#     yet" line and you create the first admin (username + password)
+#     via the web Create-admin form, or pre-seed it with
+#     OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD. Set
 #     OMNIGENT_ACCOUNTS_BASE_URL for any deploy reachable behind
 #     a public domain (defaults to http://<HOST>:<PORT> otherwise).
 #   - oidc — bring your own IdP. Set OMNIGENT_OIDC_* vars — see
@@ -60,9 +62,15 @@ services:
       ARTIFACT_DIR: /data/artifacts
       HOST: 0.0.0.0
       PORT: "8000"
-      # Pin the admin-credentials path to the persistent volume so
-      # the file survives container restarts. Empty/unset would
-      # write to /root/.omnigent/ inside the ephemeral container.
+      # Anchor the server's data dir on the persistent volume so
+      # file-backed operator config survives container restarts:
+      # the admin roster (/data/admins) and allowed-domains file
+      # (/data/allowed_domains), plus artifacts mounted elsewhere
+      # in the same volume. Account rows and password hashes live in
+      # PostgreSQL (the postgres-data volume), not here. The server
+      # resolves its data dir from this path's parent (/data);
+      # empty/unset would fall back to /root/.omnigent/ inside the
+      # ephemeral container.
       OMNIGENT_ADMIN_CREDENTIALS_PATH: /data/admin-credentials
 
       # ── Auth ─────────────────────────────────────────

deploy/docker/entrypoint.py

@@ -21,7 +21,7 @@ module importable for testing / tooling without a live database.
 Configuration is via environment variables:
 
   DATABASE_URL          Required. SQLAlchemy URL. Both PaaS-style URLs
-                        (``postgresql://user:pw@host:5432/db``,
+                        (``postgresql://<user>:<password>@host:5432/db``,
                         ``postgres://...``) and the explicit psycopg3
                         form (``postgresql+psycopg://...``) are accepted;
                         the prefix is normalized automatically.
@@ -254,6 +254,25 @@ def _select_artifact_store(resolved_config: _ResolvedConfig) -> ArtifactStore:
     return LocalArtifactStore(str(resolved_config.artifact_dir))
 
 
+def _build_local_llm_routing_client(
+    server_llm: Any,  # type: ignore[explicit-any]  # LLMConfig | None
+) -> Any | None:  # type: ignore[explicit-any]  # LLMRoutingClient | None
+    if server_llm is None:
+        return None
+    from omnigent.runtime.policies.builder import (
+        _build_policy_llm_client,
+        _resolve_server_llm_connection,
+    )
+
+    conn = _resolve_server_llm_connection(server_llm)
+    policy_client = _build_policy_llm_client(server_llm, conn)
+    if policy_client is None:
+        return None
+    from omnigent.server.smart_routing import LLMRoutingClient
+
+    return LLMRoutingClient(policy_client)
+
+
 def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
     """Resolve config if needed, wire the stores, and build the app.
 
@@ -290,6 +309,7 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
         SqlAlchemyPermissionStore,
     )
     from omnigent.stores.policy_store.sqlalchemy_store import SqlAlchemyPolicyStore
+    from omnigent.stores.project_store.sqlalchemy_store import SqlAlchemyProjectStore
     from omnigent.stores.scheduled_task_store.sqlalchemy_store import (
         SqlAlchemyScheduledTaskStore,
     )
@@ -304,6 +324,7 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
     host_store = HostStore(database_url)
     policy_store = SqlAlchemyPolicyStore(database_url)
     scheduled_task_store = SqlAlchemyScheduledTaskStore(database_url)
+    project_store = SqlAlchemyProjectStore(database_url)
     # Fail startup loud on a malformed `sandbox:` section (an operator
     # typo should not surface as a runtime 502 on the first managed
     # session); the startup catch-all below logs it.
@@ -315,9 +336,56 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
         cache_dir=artifact_dir / ".cache",
     )
 
+    from omnigent.spec import parse_default_policies, parse_server_llm
+
+    server_llm = parse_server_llm(cfg.get("llm"))
+
+    routing_cfg = cfg.get("routing")
+    if isinstance(routing_cfg, dict) and routing_cfg.get("provider") == "external":
+        from omnigent.server.smart_routing import ExternalRoutingClient, _bearer_auth
+
+        base_url = (routing_cfg.get("base_url") or "").strip()
+        router_name = (routing_cfg.get("router_name") or "").strip()
+        api_key_raw = (routing_cfg.get("api_key") or "").strip()
+        profile = (routing_cfg.get("profile") or "").strip()
+        raw_prefixes = routing_cfg.get("model_prefix")
+        if isinstance(raw_prefixes, str):
+            raw_prefixes = [raw_prefixes]
+        model_prefixes = (
+            [p.strip() for p in raw_prefixes if isinstance(p, str) and p.strip()]
+            if isinstance(raw_prefixes, list)
+            else []
+        )
+        if base_url and router_name:
+            auth = None
+            databricks_profile: str | None = None
+            if api_key_raw:
+                from omnigent.spec import expand_env_vars
+
+                auth = _bearer_auth(expand_env_vars({"api_key": api_key_raw})["api_key"])
+            elif profile:
+                databricks_profile = profile
+            routing_client = ExternalRoutingClient(
+                base_url=base_url,
+                router_name=router_name,
+                auth=auth,
+                databricks_profile=databricks_profile,
+                model_prefixes=model_prefixes,
+            )
+        else:
+            routing_client = None
+    else:
+        routing_client = _build_local_llm_routing_client(server_llm)
+
+    caps = RuntimeCaps(
+        default_policies=parse_default_policies(cfg.get("policies")),
+        llm=server_llm,
+        routing_client=routing_client,
+    )
+
     init_runtime(
         agent_cache=agent_cache,
-        caps=RuntimeCaps(),
+        caps=caps,
         agent_store=agent_store,
         file_store=file_store,
         conversation_store=conversation_store,
@@ -353,6 +421,7 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
         policy_store=policy_store,
         host_store=host_store,
         scheduled_task_store=scheduled_task_store,
+        project_store=project_store,
         auth_provider=auth_provider,
         account_store=account_store,
         # Non-secret auth settings from the config file (admins are the

deploy/fly/README.md

@@ -35,14 +35,23 @@ Then:
 1. **Memory** — `fly.toml` pins a **1 GB** machine (`[[vm]] memory = "1gb"`).
    The server idles around ~275 MB RSS, so Fly's 256 MB default OOM-loops.
    Keep it at 1 GB (or `fly scale memory 1024 -a <your-app>` if you changed it).
-2. **Admin password** prints once in the first-boot logs:
+2. **Create the first admin.** No credentials are auto-generated. First boot
+   prints a "No admin yet" line pointing at your `*.fly.dev` URL:
    ```bash
    fly logs -a <your-app>
    ```
-   Look for `Created initial admin account ... password: <generated>` (also
-   written to `/data/admin-credentials` on the volume).
-3. Open `https://<your-app>.fly.dev`, log in as `admin`. The cookie secret and
-   base URL (`FLY_APP_NAME` -> `<app>.fly.dev`) are handled automatically.
+   Open `https://<your-app>.fly.dev` and use the web Create-admin form to pick
+   your own username + password. For a headless deploy, pre-seed
+   `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` (`fly secrets set …`) before first
+   boot to create the admin directly instead.
+3. Log in with the admin you just created. The cookie secret and base URL
+   (`FLY_APP_NAME` -> `<app>.fly.dev`) are handled automatically.
+
+> **Security note for public deployments:** `POST /auth/setup` is
+> unauthenticated while no password-bearing account exists, so an instance
+> exposed before you reach the Create-admin form can be claimed by the first
+> visitor. Pre-seed `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD`, or complete setup
+> promptly after the deploy goes live.
 
 ## Deploy (Fly web-UI Launch)
 

deploy/hf-spaces/README.md

@@ -35,15 +35,21 @@ files plus two secrets.
    | `DATABASE_URL` | variable | `sqlite:////data/artifacts/chat.db` |
    | `OMNIGENT_ACCOUNTS_COOKIE_SECRET` | secret | `openssl rand -hex 32` (pin it: ephemeral disk would otherwise drop sessions on restart) |
 
-4. The Space builds + boots. Admin password is in the Space **Logs** on first
-   boot. The base URL is auto-detected from `SPACE_HOST`, so it needs no manual
-   set.
+4. The Space builds + boots. No admin credential is auto-generated: first boot
+   prints a "No admin yet" line to the Space **Logs**, and the Space serves a
+   web Create-admin form where you pick your own username + password. The base
+   URL is auto-detected from `SPACE_HOST`, so it needs no manual set. To create
+   the admin directly instead, add `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` as a
+   Space secret before first boot.
 5. **Log in via the direct URL** `https://<user>-<space>.hf.space` in its own
    tab — not HF's embedded preview. The session cookie is `SameSite=Lax`, which
    browsers won't send inside HF's cross-origin iframe, so logging in from the
    embedded view loops back to `/login`. The direct URL is top-level
    (same-site), so login sticks. Make the Space **Public** so the direct URL
-   isn't gated.
+   isn't gated — but note the Create-admin form is unauthenticated until the
+   first admin is claimed, so a public Space can be claimed by the first
+   visitor. Pre-seed `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` (step 4) or claim
+   the admin immediately after it goes public.
 
 ## Want persistence / multi-user later?
 

deploy/kubernetes/overlays/sandbox-runners/README.md

@@ -138,6 +138,38 @@ writing nothing to disk — use HTTPS repository URLs. Details by provider match
 | `resources` | Optional `requests` / `limits` (`cpu` / `memory`) override. |
 | `in_cluster` | Optional cluster-config source: `true` (in-cluster SA only), `false` (kubeconfig only), omit (try in-cluster, then kubeconfig). |
 | `kubeconfig` | Optional kubeconfig path for the out-of-cluster fallback (env: `OMNIGENT_KUBERNETES_KUBECONFIG`). |
+| `pvc_mounts` | Optional pre-created PersistentVolumeClaims mounted into every runner Pod — see [Persistent storage mounts](#persistent-storage-mounts-pvc_mounts). |
+
+## Persistent storage mounts (`pvc_mounts`)
+
+Runner Pods are ephemeral by design — the workspace lives on an `emptyDir` and
+dies with the Pod. To expose durable data (datasets, model caches, shared
+output directories) mount pre-created PersistentVolumeClaims:
+
+1. Create the PV/PVC **in the runner namespace** (`omnigent-sandboxes`) out of
+   band — via your GitOps repo, with whatever backend your cluster provides
+   (NFS/SMB CSI drivers, SAN, cloud disks). Omnigent only references the claim;
+   it never creates volumes, so the server RBAC stays unchanged.
+2. List the claims under `sandbox.kubernetes.pvc_mounts` (see
+   `sandbox-config.yaml`). Mount paths may not overlap `/home/omnigent`, the
+   OS directories, or their ancestors (e.g. `/home`, `/var`) — the server
+   rejects such config at startup.
+
+Caveats:
+
+- **Multiple runners share writable claims concurrently** — use a
+  `ReadWriteMany`-capable backend (NFS/SMB/CephFS) for anything writable, and
+  prefer `read_only: true` (the default) everywhere else: a writable shared
+  mount lets one session's agent read and modify what another session wrote,
+  and anything written there outlives the Pod and its launch token.
+- Runner Pods run as uid/gid 1000660000 with `fsGroup`. NFS `root_squash` and
+  SMB ownership mapping must permit that identity (export to the uid, or use
+  CSI mount options like `uid=`/`gid=` for SMB); `fsGroupChangePolicy:
+  OnRootMismatch` avoids re-chowning large exports on every start.
+- `ReadWriteOnce` claims pin all runners to one node — combine with
+  `node_selector` deliberately, or the second Pod sits `Pending`.
+- A mount visible in the Pod is not automatically visible to a harness's own
+  OS-level sandbox (OmniBox path grants are separate).
 
 To verify `host_config` end to end against a live cluster, run
 `python tests/e2e/integrations/deploy/kubernetes/e2e_managed_host_config.py

deploy/kubernetes/overlays/sandbox-runners/sandbox-config.yaml

@@ -45,5 +45,9 @@ data:
         # resources:                 # runner Pod sizing (defaults: 0.5-2 cpu / 1-4Gi)
         #   requests: {cpu: "500m", memory: "1Gi"}
         #   limits: {cpu: "2", memory: "4Gi"}
+        # pvc_mounts:                # pre-created PVCs (in the runner namespace) mounted into every runner Pod
+        #   - claim_name: omnigent-datasets
+        #     mount_path: /mnt/datasets
+        #     read_only: true        # default true; set false only for claims meant as shared scratch
         # in_cluster: true           # config source: true=in-cluster SA only, false=kubeconfig only, omit=try both
         # kubeconfig: /path/to/config  # out-of-cluster kubeconfig (env: OMNIGENT_KUBERNETES_KUBECONFIG)

deploy/modal/README.md

@@ -50,23 +50,26 @@ the secret and redeploy.
 
 The first boot runs DB migrations over the network (~1 minute on Neon).
 
-**Get the admin password:** the first boot prints it to the app log:
+**Create the first admin.** No credentials are auto-generated. First boot
+prints a "No admin yet" line pointing at your `*.modal.run` URL:
 
 ```bash
 modal app logs omnigent
 ```
 
-```
-✓ Created initial admin account (accounts auth provider).
-    password: <generated>
-```
+Open that URL and use the web Create-admin form to pick your own username +
+password, then invite teammates from **Members** in the web UI.
 
-Log in as the admin and invite teammates from **Members** in the web UI.
-
-> To set a known admin password instead, add
-> `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD=<password>` to the
+> To create the admin directly instead of claiming it through the web form,
+> add `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD=<password>` to the
 > `omnigent-deploy` secret before the first deploy.
 
+> **Security note for public deployments:** `POST /auth/setup` is
+> unauthenticated while no password-bearing account exists, so an instance
+> exposed before you reach the Create-admin form can be claimed by the first
+> visitor. Pre-seed `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD`, or complete setup
+> promptly after the deploy goes live.
+
 ### Modal-specific caveats
 
 - **2 MiB WebSocket message cap.** Modal's ingress limits WebSocket

deploy/railway/README.md

@@ -47,14 +47,12 @@ steps below are validated end-to-end:
    reference value simply hadn't propagated yet — **redeploy** and it resolves.
    (To confirm, the app service should have a `DATABASE_URL` variable
    referencing the Postgres service, e.g. `${{Postgres.DATABASE_URL}}`.)
-3. **Get the admin password** from the first-boot **Deploy logs** (printed once;
-   idempotent — later boots don't reprint):
-   ```
-   ✓ Created initial admin account (accounts auth provider).
-       password: <generated>
-   ```
-   It's also written to `/data/admin-credentials`.
-4. Open the URL, log in as `admin`, invite teammates from **Members**.
+3. **Create the first admin.** No credentials are auto-generated. The
+   first-boot **Deploy logs** print a "No admin yet" line pointing at your
+   `*.up.railway.app` URL (printed once; idempotent — later boots don't
+   reprint). Open that URL and use the web Create-admin form to pick your own
+   username + password.
+4. Log in with the admin you just created, invite teammates from **Members**.
 
 > **`HOST` is handled automatically.** Railway injects `HOST=[::]`, which a
 > socket bind can't use and which Railway's IPv4 edge can't reach; the
@@ -69,6 +67,12 @@ steps below are validated end-to-end:
 > pin a known admin password, set `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD`
 > before first boot.
 
+> **Security note for public deployments:** `POST /auth/setup` is
+> unauthenticated while no password-bearing account exists, so an instance
+> exposed before you reach the Create-admin form can be claimed by the first
+> visitor. Pre-seed `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD`, or complete setup
+> promptly after the deploy goes live.
+
 ## Use your own IdP instead (OIDC)
 
 Prefer GitHub / Google / Okta login over built-in accounts? Switch the provider

deploy/render/README.md

@@ -23,8 +23,9 @@ The `render.yaml` blueprint at the repo root defines:
 - **omnigent-db** (`basic-256mb` managed Postgres) — `DATABASE_URL` is injected
   into the service automatically
 - **artifact-data** (10 GB persistent disk) — mounted at `/data` so server
-  config, first-boot credentials, cookie secrets, and agent artifacts survive
-  redeploys. Artifacts live under `/data/artifacts`.
+  config, the auto-minted cookie secret, and agent artifacts survive redeploys.
+  Artifacts live under `/data/artifacts`. (Account rows and password hashes
+  live in the managed Postgres, not on the disk.)
 
 ## Quickstart (built-in accounts — the default)
 
@@ -34,18 +35,22 @@ mints its own cookie secret and auto-detects its public URL from Render.
 
 1. Click the Deploy to Render button above → **Apply**. Wait ~3–5 min for the
    image pull + health check.
-2. **Get the admin password:** open the service → **Logs** and find the
-   first-boot block:
-   ```
-   ✓ Created initial admin account (accounts auth provider).
-       password: <generated>
-   ```
-   (also written to `/data/admin-credentials` on the disk; printed once).
-3. Open your `https://<service>.onrender.com` URL, log in as the admin, and
-   invite teammates from **Members** in the web UI.
+2. **Create the first admin.** No credentials are auto-generated. Open your
+   `https://<service>.onrender.com` URL — a fresh instance shows a
+   Create-admin form where you pick your own username + password. (First-boot
+   **Logs** also print a "No admin yet" line with that URL.)
+3. Log in as the admin you just created, and invite teammates from **Members**
+   in the web UI.
 
-> To set a known admin password instead of the generated one, add
-> `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` in the dashboard before first boot.
+> To create the admin directly instead of claiming it through the web form
+> (e.g. a headless deploy), add `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` in the
+> dashboard before first boot.
+
+> **Security note for public deployments:** `POST /auth/setup` is
+> unauthenticated while no password-bearing account exists, so an instance
+> exposed before you reach the Create-admin form can be claimed by the first
+> visitor. Pre-seed `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD`, or complete setup
+> promptly after the deploy goes live.
 
 ## Use your own IdP instead (OIDC)
 

designs/CUJ-ANALYSIS.md

@@ -339,7 +339,7 @@ injection (agent holds a placeholder, proxy swaps the real secret). Mapped under
 
 ### 2.G  Onboarding, credentials & auth (incl. token refresh) ✅
 
-**First-run setup** — `omnigent setup` wizard (`onboarding/wizard.py`): provider picker, **ambient detection**
+**First-run setup** — `omnigent setup` (`cli.py` / `cli_config.py`): provider picker, **ambient detection**
 (`onboarding/ambient.py` scans installed CLIs — Claude.app, Codex, LM Studio), saves `~/.omnigent/config.yaml`.
 Databricks profile aliasing reuses same-host profiles to avoid redundant OAuth (`onboarding/setup.py:_alias_profile`).
 

designs/DEVICE_AUTH.md

@@ -46,19 +46,12 @@
 
 The Slack integration (`integrations/slack/`) is a standalone Socket-Mode
 process that calls each user's Omnigent server over HTTP + SSE
-(`OmnigentClient` / `OmnigentClientPool`). Today it sends **every request
-unauthenticated**: the pool is *"one unauthenticated client per server URL"*
-(`omnigent.py:337`), and any server with auth enabled returns 401, which the
-bot converts into a dead-end *"authentication … isn't supported yet"* setup
-error (`omnigent.py:23`, `setup.py:144`).
-
-So the bot only works against auth-disabled servers, and when it does work the
-server sees a single shared anonymous identity — it cannot tell one Slack user
-from another, cannot scope permissions, and cannot audit who did what.
-
-We want each Slack user's turns to reach the Omnigent server **as that user's
-own authenticated identity**, without the Slack process ever handling the
-user's Omnigent credentials.
+(`OmnigentClient` / `OmnigentClientPool`). Each Slack user's turns must reach
+the Omnigent server **as that user's own authenticated identity** — so the
+server can scope permissions and audit who did what — **without the Slack
+process ever handling the user's Omnigent credentials**. An unauthenticated
+client can only reach auth-disabled servers, and would present one shared
+anonymous identity the server can't distinguish per user.
 
 ## Topology and trust
 
@@ -85,28 +78,25 @@ Role mapping:
 | Resource Owner           | The Slack user, authenticating in their browser |
 | Out-of-band channel      | Slack (delivers the verification link only)     |
 
-## What already exists (reused, not rebuilt)
+## Shared substrate (reused, not rebuilt)
 
-RFC 8628 primitives are absent (no `device_code` / `user_code` /
-`verification_uri` anywhere), but the substrate is all present:
+The device grant builds on existing server primitives:
 
-- **Poll-endpoint shape** — `POST /auth/cli-login` + `GET /auth/cli-poll` with
-  202-pending / 200-done / 410-expired semantics (`routes/auth.py:484`).
 - **Atomic single-use token redemption** — `SqlAlchemyAccountStore.redeem_token`
   uses `UPDATE … WHERE redeemed_at IS NULL` + rowcount so at most one caller
-  wins under concurrency (`accounts_store.py:329`). The new grant store copies
-  this pattern.
+  wins under concurrency (`accounts_store.py`). The grant store follows the
+  same pattern.
 - **Session JWT minting** — `mint_session_token(user_id, secret, ttl, provider)`
-  (`oidc.py:53`), HS256 with `sub`/`iat`/`exp`/`provider`.
-- **Bearer validation** — `UnifiedAuthProvider._check_cookie` already accepts
+  (`oidc.py`), HS256 with `sub`/`iat`/`exp`/`provider`.
+- **Bearer validation** — `UnifiedAuthProvider._check_cookie` accepts
   `Authorization: Bearer <jwt>` and validates the same claim shape
-  (`auth.py:477`). Delegated access tokens validate through this path unchanged.
-- **Browser consent under accounts mode** — the `accounts` provider already
+  (`auth.py`). Delegated access tokens validate through this path unchanged.
+- **Browser consent under accounts mode** — the `accounts` provider
   establishes the browser identity via its session cookie; the consent page
   runs behind it. (This is why the grant mounts in accounts mode only — see
   the mount restriction below.)
-- **Open-redirect hardening** — `_sanitize_return_to` (`routes/auth.py:150`) is
-  reused for the post-login bounce back to the consent page.
+- **Open-redirect hardening** — `_sanitize_return_to` (`routes/auth.py`) guards
+  the post-login bounce back to the consent page.
 
 ## Design decisions (agreed)
 
@@ -120,14 +110,10 @@ RFC 8628 primitives are absent (no `device_code` / `user_code` /
    only an authorized client can drive the flow. The **browser** endpoints
    (consent GET / approve / deny) are never gated by it — the user's browser
    doesn't hold the secret; their trust is the session cookie + Origin check.
-   Unset ⇒ endpoints stay public (backward compatible).
-
-   *History:* the secret was implemented, removed, then reintroduced as
-   opt-in. It was removed when the Slack client accepted a **user-supplied**
-   server URL — shipping a shared secret to an arbitrary user-typed host was a
-   secret-exfiltration/SSRF path. That objection is now gone: the Slack socket
-   server's target is a **fixed operator config** (`OMNIGENT_SERVER_URL`), not
-   a user-supplied URL, so the secret only ever travels to the trusted server.
+   Unset ⇒ endpoints stay public (backward compatible). Shipping the secret to
+   the Slack client is safe because its target is a **fixed operator config**
+   (`OMNIGENT_SERVER_URL`), not a user-supplied URL, so the secret only ever
+   travels to the trusted server.
 2. **Refresh tokens** — short-lived access tokens (≤ 1 h) plus a rotating,
    revocable refresh token, with a 30-day absolute grant lifetime. The Slack
    server refreshes silently; a stolen access token expires quickly and a grant
@@ -149,15 +135,21 @@ RFC 8628 primitives are absent (no `device_code` / `user_code` /
          verification_uri_complete,   # verification_uri?user_code=XYZ
          expires_in: 600, interval: 5 }
 
- 3. Slack server shows the verification link in the setup modal (initiator
-       only). The device_code is NOT included — it never leaves the server
-       pair; only the user_code (in verification_uri_complete) does.
+ 3. Slack server shows the verification link (verification_uri_complete,
+       code prefilled for one-click) in the setup modal (initiator only),
+       plus the user_code so the user can confirm the match. The
+       device_code is NOT included — it never leaves the server pair.
 
  4. User clicks → Omnigent consent page (verification_uri).
-       Browser authenticates via the server's accounts provider.
-       Page shows: "<client_id> is requesting permission to act as YOU
-       (alice@example.com) on this Omnigent server.  [Approve] [Deny]"
-       plus a warning to approve only a login the user personally started.
+       The page REQUIRES a login started for THIS flow: if the browser's
+       session predates the grant (session iat < grant.created_at), it
+       bounces through the login page with ?reauth=1 — which forces a fresh
+       password entry even for an already-signed-in user — and returns here.
+       Once re-authenticated, the page shows: "<client_id> is requesting
+       permission to act as YOU (alice@example.com) on this Omnigent server.
+       [Approve] [Deny]" plus a warning to approve only a self-started login.
+       The forced re-auth means a grant can't be approved by one reflexive
+       click on a link the user didn't personally start (see threat #2).
 
  5. User approves → the grant is bound to the authenticated identity
        (alice@…). client_id is recorded for display/audit only, never as
@@ -197,9 +189,8 @@ cli-ticket flow and never mounts these routes; header mode has no
 server-mintable identity — see `create_device_auth_router`, which raises if
 constructed for any other source). The `device_grants` table is created
 unconditionally by the migration regardless of the flag; only the router
-mount is gated. This router also **owns** `mint_delegated_token` and
-`DELEGATED_SCOPE` (moved here from `oidc.py`, which retains only
-`mint_session_token` / `mint_session_cookie`).
+mount is gated. This router **owns** `mint_delegated_token` and
+`DELEGATED_SCOPE`.
 
 - `POST /oauth/device/authorize` — **public** (rate-limited). Generates a
   high-entropy `device_code` (`secrets.token_urlsafe`, stored **hashed**), a
@@ -275,9 +266,8 @@ HS256 shape (so `_check_cookie` accepts them) plus four delegated-only claims:
 
 ## Slack-side changes
 
-- **`oauth.py` (new)** — device-authorize → post ephemeral link → poll token
-  endpoint (respecting `interval` / `slow_down`) → store tokens. Replaces the
-  `AuthRequiredError` dead-end.
+- **`oauth.py`** — device-authorize → post ephemeral link → poll token
+  endpoint (respecting `interval` / `slow_down`) → store tokens.
 - **`omnigent.py`** — attach `Authorization: Bearer` per
   `(server_url, slack_user_id)`; on 401, refresh once and retry; on refresh
   failure, surface a re-login prompt. `OmnigentClientPool` keys clients by
@@ -285,8 +275,8 @@ HS256 shape (so `_check_cookie` accepts them) plus four delegated-only claims:
 - **`store.py`** — new `oauth_tokens` table `(team_id, user_id, server_url)` →
   access/refresh **encrypted at rest** (key from env / secret manager, never in
   the DB). `/omnigent logout` → `POST /oauth/revoke` + local delete.
-- **`setup.py`** — validation uses the user's token; auth-enabled servers become
-  supported rather than rejected.
+- **`setup.py`** — validation uses the user's token, so auth-enabled servers
+  are supported.
 - **`config.py`** — holds the local encryption key for token storage.
 
 ## Security analysis
@@ -294,7 +284,7 @@ HS256 shape (so `_check_cookie` accepts them) plus four delegated-only claims:
 | # | Threat | Mitigation |
 |---|--------|-----------|
 | 1 | `device_code` leak → token theft | Never transits Slack or the user — only `verification_uri_complete` (a `user_code`) does. Stored hashed; single-use. |
-| 2 | Link misdelivery / phishing another user | Link shown to the initiator only (in their own setup modal). Consent page names the exact Omnigent identity the grant will act as and the requesting `client_id`, and warns to approve only a self-initiated login. |
+| 2 | Link misdelivery / phishing another user | Link shown to the initiator only (in their own setup modal). **Consent requires a login started FOR this flow: the consent page rejects a session whose `iat` predates the grant and bounces through the login page with `reauth=1`, forcing a fresh password entry even for an already-signed-in user.** So an attacker-initiated flow can't be approved by a single reflexive click — the victim must deliberately re-enter their password against a screen naming the exact Omnigent identity and requesting `client_id`. The gate is enforced on both the consent GET and the approve POST. |
 | 3 | Anyone can initiate/poll (public client) | Cheap `pending` state grants nothing until an authenticated user approves. `POST /oauth/device/authorize` is rate-limited per client IP (10/60s → 429 `slow_down`); short (10 min) `device_code` expiry; `slow_down` enforced server-side on aggressive polling; expired grants purged opportunistically. |
 | 4 | Slack SQLite exfiltration → mass impersonation | Tokens **encrypted at rest**; access tokens short-lived (≤ 1 h); refresh tokens revocable. Bounded, centrally killable window. |
 | 5 | Compromised Slack server acts as all users (inherent to delegation) | Reduced scope (no admin), short TTL + refresh rotation, per-grant revocation, **absolute grant lifetime (30 d) enforced on refresh** so even an un-revoked grant dies, and an `act`-claim audit trail. |
@@ -315,6 +305,17 @@ token.
 When no client secret is configured the endpoints are **public**, so
 initiation is open — the defense is layered, not a gate:
 
+- **Forced re-authentication at consent.** Consent requires a login started for
+  THIS flow: the consent page (and the approve POST) reject a session whose
+  `iat` predates the grant's `created_at` and bounce through the login page with
+  `reauth=1`, which forces a fresh password entry even for an already-signed-in
+  user. This defeats the reflex-approve variant of the attack — a victim handed a
+  one-click link (even one with the code prefilled) still can't bind the grant
+  without deliberately re-entering their password against a screen naming the
+  exact identity and client. (`device_auth.py` `_session_iat` + the
+  `reauth=1` bounce; `LoginPage.tsx` suppresses its already-signed-in
+  auto-return under `reauth=1`.) The prefilled one-click link is therefore
+  retained for convenience — the re-auth step, not code handling, is the gate.
 - The consent page prominently **warns** the user to approve only a login they
   personally started and to match the code shown by the application.
 - The delegated scope excludes admin / user-management endpoints.
@@ -322,6 +323,11 @@ initiation is open — the defense is layered, not a gate:
   grant self-expires even if never revoked.
 - Initiation is rate-limited per IP; nothing is granted until a real user
   authenticates and approves in their own browser.
+- **Startup warning.** When the grant is mounted on a multi-user (accounts)
+  server with `OMNIGENT_DEVICE_CLIENT_SECRET` unset, the server logs a loud
+  warning at startup that the authorize endpoint is public — nudging the
+  operator to opt into the secret rather than leaving initiation open unknowingly
+  (`app.py`, at the device-router mount).
 
 Setting `OMNIGENT_DEVICE_CLIENT_SECRET` closes initiation entirely to
 unauthorized callers: without the matching `X-Omnigent-Client-Secret` header,