Lead both root READMEs with the self-hosted runtime, durable approvals,
and verifiable run records instead of the coordinator. Keep the H1 and
logo block, replace only the tagline block, and add the no-telemetry,
no-hosted-control-plane paragraph after the badges.
Give durable approvals, the verifiable journal, and the governance floor
one section each with source, test files, and current case counts.
Demote multi-agent coordination to an "Optional coordinator" section,
keep "Built with OMA" with the three most visible entries and a
collapsed long tail, and drop the intro paragraph, the framework
comparison pointer, the listing call to action, and the separate
commercial support section. The Chinese README states the contact
details in text instead of a WeChat QR image, which is removed.
Sync the tagline block in the core package READMEs, set the same
description on the root and core package.json, and remove the "killer
feature" wording from the orchestrator header comments.
A library that gets installed into someone else's backend is judged partly on
what its own install pulls down. Three changes tighten that, and two questions
turned out to need no change at all.
The line this draws is what ships. Every dependency that stays inside the
repository is now pinned to the exact version the lockfile already resolved:
all 27 devDependencies across the four workspaces, plus the private release
bot's own zod. The lockfile change is 28 spec lines with no
resolution moved, no entry added or removed, and all 61 platform-specific
entries intact. A new root .npmrc sets save-exact=true so the next one arrives
pinned rather than as a range nobody notices.
What a consumer installs keeps its range: `dependencies` in packages/core, the
only published runtime block here, every `peerDependencies`, and otel's core
compatibility range. An exact version in those blocks overrides the consumer's
own resolution and stops their `npm audit fix` from reaching a patched build
until we cut a release, which is a worse trade than the install-time drift it
prevents. save-exact will still pin a new dependency added to one of them, so
the package job now asserts all three published manifests and fails when one
is left exact, next to the assertion that already covers otel's range.
min-release-age is deliberately not set. It first shipped in npm 11.10.0, and
the CI matrix runs Node 20 and 22, which bundle npm 10.8.2 and 10.9.8. Those
two accept the key, echo it back from `npm config get`, and never act on it,
so a quarantine window would hold on one leg of the matrix while silently
doing nothing on the other two. It also has no effect on `npm ci`, which
installs the lockfile verbatim.
Every `npm ci` that installs this repository's own tree now passes
--ignore-scripts, so a compromised dependency cannot run an install hook on a
runner that holds release credentials. Only three dependencies declare a
postinstall at all, and the full lint, test, build, scaffold, and example
suites pass on a tree installed that way. The `npm install` calls that stand
in for a real consumer are deliberately left alone: their job is to reproduce
what a user's install actually does, and hardening them would make the smoke
tests prove less than they claim.
A new scheduled Supply chain audit workflow asks two questions about the
dependencies that reach a consumer, an hour before the weekly release bot so a
finding lands before the release PR is drafted. --omit=dev is the point of
running it separately: auditing the full tree reports eighteen advisories,
every one of them in test and fixture tooling that never ships, and a
permanently red job is one nobody reads. The two steps fail differently.
`npm audit` reports into the run summary, because a new upstream advisory is
not this repository misbehaving and may have no fixed version yet.
`npm audit signatures` fails, because it compares served bytes against the
registry's own signature, so a mismatch is tampering rather than churn; all
27 production packages verify today.
Two things needed no change. npm provenance is already live: publish.yml
publishes through npm trusted publishing with id-token: write, which attaches
SLSA attestations on its own, and every version since core 1.16.0, otel 0.1.2,
and create-oma-app 0.8.1 carries one. And .npmrc left .gitignore in #198
because it only restated the default registry; it comes back tracked, with the
ignore rule narrowed so a contributor's own nested .npmrc stays out.
bench/ measures a multi-agent run against a single-agent baseline pursuing the
identical goal, on tokens, wall-clock, cost and judge-scored quality. Three
groups per task: A runs runTasks() with deterministic model routing and a token
budget, while B and C run one agent on the strong and the cheap tier, bracketing
A from both sides so an effect that holds against both is attributable to the
orchestration rather than to the model mix. Two tasks ship with it, both from
packages/core/examples/cookbook/: a four-role contract review DAG and a
single-pass meeting report.
Role prompts are read out of the example source at load time rather than
restated in the harness, so what gets measured cannot drift from what the
examples say. Token counts come off each provider response through a loopback
recording proxy, because TokenUsage carries no cache field and no per-model
split and so cannot price a group A run that deliberately mixes two tiers. The
framework's own counts are recorded alongside, and any disagreement lands in the
row's notes instead of being reconciled silently.
Quality is judge-scored, blind, and run in both presentation orders so position
preference cancels. A is judged once per challenger and each of those scores is
kept separately: A's score against B and its score against C are two
measurements taken under two different contrasts, and only the first belongs in
an A-minus-B comparison.
The report states only what it computed. Whether the token budget bound is read
off budget_exceeded. What dropping cache-contaminated repetitions would do to
the headline is recomputed and printed, including whether any comparison
reverses direction. Which rate schedule the invocation was billed on is checked
against the manifest's UTC window rather than assumed, because the configured
prices are peak rates and a run that happened off-peak was billed half of what
the cost column says. Vendor-specific facts are emitted only for the vendor that
actually ran, and a missing manifest is an error rather than a report whose
models and controlled variables all read unknown.
bench/ is not an npm workspace, so it is reached through explicit root scripts:
npm run lint ends with lint:bench, and npm test ends with bench:ab:test. Both
run in CI, the tests across Node 20, 22 and 24. npm run bench:ab:mock drives the
full pipeline against an offline stand-in upstream, so the wiring is checkable
without a key or a provider call.
Results (bench/REPORT.md, bench/results-*.csv, bench/runs/) are gitignored.
* chore(deps)!: upgrade OpenAI SDK to v7
Require Node.js 22 across packages, starters, and CI. Add real SDK boundary coverage and reject unsupported custom tool calls explicitly.
Refs #391
* fix(core): classify OpenAI user aborts as cancellation
Use the SDK error constructor name because OpenAI v7 APIUserAbortError retains the default Error name. Cover retry and observability classification with the real SDK class.
* chore(deps)!: target OpenAI v6 and retain Node 20
* docs: simplify Node runtime guidance
Unit tests call scaffold() directly and never exercise the packed tarball.
Add `npm run test:scaffold`: pack the scaffolder, generate a project in an
isolated temp dir, install, and run the demo to the missing-key gate, proving
the published bytes scaffold, install, and load end-to-end. Wire it into CI as
a scaffold-e2e job. Core installs from a local tarball so the test validates
the current commit and stays green during the release window.
* refactor(repo): monorepo groundwork for an easier first run
Trying OMA for the first time costs more than it should: a lot to read before anything runs, and no one-command way to watch a team actually work. The plan is to fix that with a `npm create oma` scaffold (a multi-agent demo that runs on the first try) and an npm README that leads with getting started. Neither lands cleanly until core lives in its own package, so this PR does that part first.
This is groundwork, not the payoff: nothing changes for anyone installing `@open-multi-agent/core` today. It turns the repo into an npm-workspaces monorepo with core in `packages/core/`, and splits the README into a GitHub landing page (root) and the npm package page (`packages/core/`). Doing it now, while the repo is small, avoids migrating twice.
The published package is byte-identical: same name, same three runtime dependencies, same entry points, guarded by an isolated-install smoke test. `npm ci` + lint + test (1060) + build pass; the tarball still ships only `dist/`, `README.md`, `LICENSE`, and `package.json`.
* build: restore cross-platform optional deps in package-lock.json
Regenerating the lockfile on macOS pruned the non-host rollup/esbuild optional binaries (npm/cli#4828), so Linux CI could not load @rollup/rollup-linux-x64-gnu and vitest failed to start. Rebuild the lock from the pre-migration base so every platform variant is present again. Verified with npm ci + lint + build + test (1060).
* fix(examples,docs): correct monorepo paths and anchors after the packages/core move
with-vercel-ai-sdk example (pre-existing, surfaced by the move):
- package.json: the @open-multi-agent/core file: link was file:../../, which
resolves to packages/core/examples (no manifest). Corrected to file:../../..
(packages/core); predev cd updated to match.
- package-lock.json regenerated: was linking ../.. and pinning a stale core
1.4.0; now links ../../.. at 1.7.0.
- README: setup paths and the file: note updated.
docs missed by the move:
- docs/cli.md: repo-clone build output is now packages/core/dist/cli/oma.js;
the quick-start anchor now lives in the package README.
- CONTRIBUTING.md: the architecture anchor and src/ entry-point paths now live
under packages/core/.
* inital commit for bedrock features
* fixed example
* fix readme nit
* bug fix
* fix: wire AgentConfig.region through to createAdapter for bedrock
Previously createAdapter() accepted a `region` argument but the main Agent
path only passed `(provider, apiKey, baseURL)`, so per-agent Bedrock region
overrides were unreachable. AgentConfig now accepts an optional `region`
field and agent.ts forwards it to the factory.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: JackChen <jack@yuanasi.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* docs: restructure Ecosystem section, add Engram integration
Merge Used by and Integrations into one ## Ecosystem section with three
tiers (In production, Integrations free, Featured Partner $3,000/yr).
Drop Philosophy section (covered in DECISIONS.md). Add Engram to free
tier with maintainer's original tagline verbatim. Mirror in README_zh.md.
* chore: add repository, homepage, and bugs npm metadata
Standard fields so npm and GitHub surface source links.
* docs: README consistency pass
- Architecture diagram: add AzureOpenAIAdapter (missed when #143 landed).
- Quick Start: promote CLI (oma) to ### subheading for discoverability.
- Ecosystem: drop hardcoded "5,500+ stars"; shield badge is the live source.
- Intro: bump "Opus 4.6" example to "Opus 4.7" (prose only; code defaults
unchanged, to revisit separately).
- Supported providers: drop the "Gemma 4" sentence that contradicted the
5-model list below it.
- Stats images: bump cache-buster to 20260423 for contrib.rocks and
star-history so GitHub camo refetches.
Mirror in README_zh.md.
- Replace the static fake coverage badge with codecov.
- Add npm version and bundlephobia bundle-size badges.
- Add test:coverage script and lcov reporter so CI can upload.
- Add a coverage job in CI that uploads to codecov on Node 20.
Requires CODECOV_TOKEN secret to be set in the repo for the badge to
populate; until then the badge will display "unknown".
- Add contract tests for Anthropic, OpenAI, Gemini, Copilot adapters
- Add optional E2E test suite (tests/e2e/, run with npm run test:e2e)
- Add shared test fixtures (tests/helpers/llm-fixtures.ts)
- Configure vitest to exclude e2e tests by default
- Add "files" field to package.json to reduce npm package size by 50%
- Align npm description with GitHub repo description
- Bump version to 1.0.1
- Add @google/genai to devDependencies so types are available for
lint/test in CI (stays as optional peerDependency for consumers)
- Delete package-lock.json in CI before npm install to avoid
Mac-generated lockfile missing Linux platform-specific rollup binaries
Jack Chen