* feat(core): add unified run viewer
* feat(cli): export run viewer from trace store
* docs(core): add deterministic run viewer demo
* fix(examples): resolve workspace paths in typecheck
* fix(dashboard): center detail status labels
* fix(dashboard): remove DAG status rails
* fix(dashboard): enlarge DAG task cards
* fix(dashboard): clarify run summary header
* docs: align readmes with run viewer
Redaction stopped at the observability layer, so secrets an agent emitted into its answer were persisted verbatim to shared memory and on-disk checkpoints. Add RedactingStore, a MemoryStore decorator that scrubs values on write, plus optional custom patterns on the redaction utilities. One wrap of the durable store closes both persistence sinks.
Closes#339.
Closes#340.
add spanId and optional parentId to every TraceEventBase
generate stable agent span IDs so LLM/tool spans can point to their owning agent span
link team-run worker agents under task spans, stream events under worker agent spans, and plan_ready under coordinator decomposition
document the trace parentage model and add focused tests for span linkage
Co-authored-by: sanhuo11 <tlysanhuo@gmail.com>
Error-aware task retry (opt-in via maxRetries > 0):
- Skip retries on provably-terminal failures (4xx client errors except
408/409/429, token-budget, invalid-message, aborted calls).
- Equal jitter on backoff to avoid lockstep retries against a rate-limited
provider.
- Honor abortSignal between attempts (no full-backoff sleep or extra attempt
after cancel).
- Non-streaming path preserves the structured error on AgentRunResult.error so
classification works off the default runTeam path; test-covered.
Off by default; behavior changes only when retry is enabled.
Closes#337
* refactor(repo): monorepo groundwork for an easier first run
Trying OMA for the first time costs more than it should: a lot to read before anything runs, and no one-command way to watch a team actually work. The plan is to fix that with a `npm create oma` scaffold (a multi-agent demo that runs on the first try) and an npm README that leads with getting started. Neither lands cleanly until core lives in its own package, so this PR does that part first.
This is groundwork, not the payoff: nothing changes for anyone installing `@open-multi-agent/core` today. It turns the repo into an npm-workspaces monorepo with core in `packages/core/`, and splits the README into a GitHub landing page (root) and the npm package page (`packages/core/`). Doing it now, while the repo is small, avoids migrating twice.
The published package is byte-identical: same name, same three runtime dependencies, same entry points, guarded by an isolated-install smoke test. `npm ci` + lint + test (1060) + build pass; the tarball still ships only `dist/`, `README.md`, `LICENSE`, and `package.json`.
* build: restore cross-platform optional deps in package-lock.json
Regenerating the lockfile on macOS pruned the non-host rollup/esbuild optional binaries (npm/cli#4828), so Linux CI could not load @rollup/rollup-linux-x64-gnu and vitest failed to start. Rebuild the lock from the pre-migration base so every platform variant is present again. Verified with npm ci + lint + build + test (1060).
* fix(examples,docs): correct monorepo paths and anchors after the packages/core move
with-vercel-ai-sdk example (pre-existing, surfaced by the move):
- package.json: the @open-multi-agent/core file: link was file:../../, which
resolves to packages/core/examples (no manifest). Corrected to file:../../..
(packages/core); predev cd updated to match.
- package-lock.json regenerated: was linking ../.. and pinning a stale core
1.4.0; now links ../../.. at 1.7.0.
- README: setup paths and the file: note updated.
docs missed by the move:
- docs/cli.md: repo-clone build output is now packages/core/dist/cli/oma.js;
the quick-start anchor now lives in the package README.
- CONTRIBUTING.md: the architecture anchor and src/ entry-point paths now live
under packages/core/.
* fix: redact secrets in traces, bash env, and dashboard payloads
Adds src/utils/redaction.ts and applies best-effort redaction at three
sinks where sensitive data could leak:
- tool_call trace events (input, output)
- the bash tool's output buffer
- the post-run dashboard's embedded JSON payload
The bash tool no longer inherits the parent process.env. Child processes
receive a fixed allowlist (HOME, LANG, LC_ALL, LOGNAME, PATH, SHELL,
TEMP, TERM, TMP, TMPDIR, USER), so provider API keys and similar
secrets are no longer visible to spawned shells.
The post-run dashboard no longer loads Tailwind CDN, Google Fonts, or
Material Symbols at view time. The page is self-contained and renders
without network access.
llmMessagesToAiSdkModelMessages no longer concatenates the opaque
redactedData payload into the reasoning text emitted to the AI SDK; it
emits only the [redacted_thinking] marker.
The MCP GitHub example uses --no-install instead of -y and passes an
explicit env allowlist instead of spreading process.env.
* fix(redaction): consume full value for quoted and unquoted assignments
The single ASSIGNMENT_PATTERN stopped at the first whitespace inside a
value, so values with spaces were only partially redacted and the
remainder leaked into trace events, dashboard payloads, and the bash
output buffer. Three reviewer-reported cases on PR #263:
password=secret value -> password=[redacted] value
password="secret value" -> password="[redacted]" value"
apiKey: "abc def" -> apiKey: "[redacted]" def"
Splits the single pattern into two passes. The quoted pass consumes
to the back-referenced closing quote so password="my pass" is fully
matched. The unquoted pass consumes to the next structural delimiter
(comma, semicolon, brace, bracket, newline) so password=my pass is
fully matched.
Adds tests/redaction.test.ts covering the three reviewer cases, the
existing Authorization orphan-bracket regression, common token literal
patterns, and idempotence.
* docs: align Chinese README with English version, optimize translations
- Restructure Chinese README to match English section order
- Add demo image, CI badge, Core Concepts section, AgentPool.runParallel
- Optimize 20+ translations for natural Chinese tech writing
- Tone adjustment: reduce colloquial language, unify terminology
- Remove feature-dump tagline and Grok/Groq disclaimer from both versions
- Clean up English README: fix awkward phrasing, missing article, extra blank line
- Add docs/observability.md and docs/providers.md
* Update README hero animation
* docs: use package-safe README hero URL
Jack Chen