This release includes 1 security fix for security teams reviewing exposed deployments.
Published 1mo
AI & Machine Learning
✓ No known CVEs patched
This release patches 1 known CVE
Topics
agent-orchestration
agent-runtime
ai-coding
claude-code
cli
code-review
+14 more
codex
coding-agent
developer-tools
devtools
evidence
local-first
local-llm
mcp
model-context-protocol
multi-agent
opencode
software-engineering
typescript
workflow-automation
Affected surfaces
auth
deps
Summary
AI summaryFixed stored XSS in HTML session exports and made HTTP timeout setting apply to all providers.
Full changelog
Added
- Added GitHub-focused v0.80.8 release notes and README release documentation for the OMK hard-fork release.
- Added source-backed public hooks fail-closed primitives for the
./hooksexport. - Added containerization documentation and a Gondolin extension example for routing built-in tools into a local micro-VM.
- Added Ant Ling provider selection and setup documentation.
- Added NVIDIA NIM provider selection, setup documentation, and direct NIM request attribution headers.
- Added
ctx.modeto extension contexts so extensions can distinguish TUI, RPC, JSON, and print mode. - Added
ctx.getSystemPromptOptions()for extension commands to inspect the current base system prompt inputs. - The interactive control footer now shows sampled process CPU% and RSS memory (width-adaptive segment).
- Two new built-in themes
omk-controlandomk-control-light. - The working loader now exposes the model thinking level while streaming.
- The OMK//CONTROL startup dashboard now displays the package-backed
omk v0.80.8 · OMK//CONTROLrelease header.
Changed
- Changed internal runtime package dependencies to OMK-scoped packages and publish them before
open-multi-agent-kitso installedomkcan resolve its runtime imports. - Changed published coding-agent package metadata and source config defaults to use OMK/Open Multi-Agent Kit names,
omkConfig,.omk, and the OMK repository. - Changed release metadata to lockstep OMK publishable packages at v0.80.8.
- 256-color theme quantization generalizes the cube/grayscale selection for near-neutral colors (colors with channel spread < 10 keep byte-identical output).
Fixed
- Fixed auto-compaction to trigger before provider requests when the projected prompt would exceed the configured context headroom.
- Fixed temporary extension package installs to use a private
~/.omk/agent/tmp/extensionsdirectory with0700permissions instead of a shared OS temp extension directory. - Fixed git package source handling to reject unsafe host/path components and keep managed clone paths inside install roots.
- Fixed stored XSS in HTML session exports by sanitizing Markdown link and image URLs with a scheme allow-list after stripping control characters.
- Fixed SDK embedding in bundled Node apps failing with
ENOENTwhenpackage.jsonis not present next to the bundle entrypoint. The package metadata reader now gracefully handles missingpackage.jsonby using defaults, enablingcreateAgentSession()without requiring package-adjacent files at runtime (#5226). - Fixed HTTP timeout setting not being respected for non-Codex providers (e.g., llama.cpp via OpenAI-compatible API). The
httpIdleTimeoutMssetting (set via/settingsHTTP timeout) now applies as the default SDK request timeout for all providers that support it, not just OpenAI Codex Responses. Disabling the timeout (HTTP timeout = false) now correctly disables SDK timeouts for all supported providers by sending a maximum int32 value (effectively infinite) instead of 0, since SDKs treat timeout=0 as an immediate timeout (#5294). - Fixed opening and listing very large JSONL session files by reading session entries line-by-line instead of materializing the full file as one string (#5231).
- Fixed
renderShell: "self"tool renderers that emit no component lines leaving a blank chat row (#5299).
Security Fixes
- Fixed stored XSS in HTML session exports by sanitizing Markdown link/image URLs with a scheme allow‑list after stripping control characters
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About OMK
Provider-neutral CLI control plane for coding agents: routes runtimes, scopes MCP, runs DAG workers, and verifies evidence before completion. MIT.
Related context
Related tools
Beta — feedback welcome: [email protected]