Skip to content

CHANGELOG.md

Latest commit

 

History

History
116 lines (88 loc) · 10.6 KB

CHANGELOG.md

File metadata and controls

116 lines (88 loc) · 10.6 KB
Raw

Changelog

Unreleased

v1.1.0 - 2026-07-23

  • Added first-class Pi package support with native pi.skills discovery, documented /skill:omv-* invocation, and bilingual install guidance.
  • Fixed research workspace resolution so commands run from under .omv/ (for example .omv/checkouts/<pkg>) reuse the owning project instead of creating a nested empty .omv. Supports OMV_PROJECT_ROOT / OMV_ROOT and global --root <path>.
  • Fixed omv dashboard / omv campaign list treating AttackSurfaceList sidecars (*.surfaces.yaml) as Campaign.v1 files, which produced hard validation errors after surfaces propose.
  • Confirmed evidence file:line checks now accept inclusive ranges (path/file.go:12-18) as well as column forms.
  • Verification decision.status: pass no longer fails when a review sets agrees: true but still lists nuance notes under disagreements.
  • omv review routes to /omv-repro only for missing observed_result, not merely for plausible exploitability.
  • Added ssrf-filter attack-surface pack for HTTP client SSRF filters and private-IP agents.
  • Documented allowed --mode, --goal, and --budget enums in omv help start, plus project-root resolution in top-level help.

v1.0.0 - 2026-07-11

  • Added Windows as a validated platform with Python 3 runtime discovery, shell-independent Node test execution, cross-platform Skill packaging and LOC estimation, and an Ubuntu/Windows CI matrix. Claude Code remains the default platform when --platform is omitted.
  • Reduced install overhead by replacing the static boxen and cli-table3 output layer with the built-in responsive renderer, removing 21 packages from a clean npm install.
  • Improved first-run setup with automatic platform-scoped health verification, explicit restart and Skill invocation guidance, compact install paths, accurate dry-run labels, and clearer download/upgrade documentation.
  • Froze the 1.0 CLI compatibility surface: workflow-first public help, grouped advanced automation commands, Skill-managed primitives hidden from public catalogs, and canonical start, dashboard, and review workflows replacing redundant wrappers.
  • Froze the remaining 1.0 compatibility boundaries with root-only Node package exports, inventoried runtime/type exports, required-field JSON contracts for every public automation command, parser-aware .omv contract versioning, and package-to-installed-Skill content drift checks.
  • Removed the pre-1.0 first, workspace init, findings workflow, findings doctor, findings open, and permanent findings delete routes with focused migration errors.
  • Removed the undocumented experimental omv-mcp executable and its custom line-delimited JSON protocol before the 1.0 compatibility boundary.
  • Added first-class Codex setup, doctor, and uninstall support using official ~/.agents/skills and .agents/skills discovery paths, with platform-specific manifests and repository guidance in AGENTS.md.
  • Raised the runtime baseline to Node.js 22 and added an Ink 7 / React 19 interactive research workspace.
  • Bare omv now opens the responsive workspace in a real TTY; omv tui is the explicit entry, while omv dashboard, --no-tui, pipes, CI, and JSON remain deterministic plain output.
  • Added keyboard workflow navigation, live filtering, evidence-first finding inspection, action-surface guidance, help, refresh, narrow-terminal layouts, and an interactive guided start flow.
  • Hardened detail refresh/error recovery, explicit plain-mode routing, and terminal layouts down to a bounded 52x16 minimum.
  • Expanded the TUI with Overview, Findings, Campaign, and Activity views; Summary/Evidence/Threat/History detail tabs; structured filters; and a read-only command palette.
  • Added V3 full-width wrapped finding and Activity-event detail with scrolling and range indicators, plus paged access to the latest 200 Activity entries.

v0.10.1 - npx package binary alias

  • Register oh-my-vul as a package bin alias for omv, so npx oh-my-vul setup works. Previously only omv / omv-mcp were exported, which made npx report "could not determine executable to run".

v0.10.0 - Campaign first-mile, surfaces, and research discipline

First-mile research and quality gates for evidence-first work:

  • Campaign.v1 — omv campaign init|list|show|seed and omv first. Seeding creates conservative candidate Evidence only and never overwrites existing findings or proof artifacts.
  • Attack Surface Cards — omv campaign surfaces propose|show|select turns campaign priorities into deterministic pack-based research cards; omv campaign seed uses selected cards when a surfaces sidecar exists (otherwise falls back to vuln-class lanes).
  • SourceRef.v1 + report provenance — omv sources init|show|validate and omv report provenance manifests that hash Evidence, reports, and local dependencies. Missing manifests warn; stale confirmed manifests fail artifact checks.
  • PatternPack.v1 + unified evals — 14 JSON pattern-pack manifests (including R/Lua), manifest-driven find/audit asset sync, and omv eval with human/JSON/JUnit output.
  • ThreatMap rich render — omv findings show prints full source → transforms → sink paths with confidence, bypassable guards, and summary.
  • Readiness helpers — shared isReportReady / isSubmissionScoreReady / resolveDoctorNextAction for doctor and review.
  • using-omv bootstrap — process skill for evidence-before-claims and HARD-GATEs (quality growth, not skill sprawl); audit/report/repro gain explicit verification-before-claim rules; stable evals cover premature-report refusal and process-first open.
  • Public docs policy — GitHub publishes user-facing guides only; maintainer/agent/OpenSpec/release docs stay local.
  • Install set — 10 skills (adds using-omv).

v0.9.0 - CLI command split and local findings dedup

  • Split the omv CLI dispatcher (omv.ts, 1434 lines) into one module per command under commands/, plus a commands/shared.ts arg-helper module and a commands/index.ts registry replacing the dispatch switch. The 12 duplicated command error handlers collapse into one. omv.ts is now a 7-line entry.
  • Wired three commands that were validated and advertised but previously unreachable: omv repro init, omv report artifacts, and omv findings doctor. They now dispatch to the existing domain logic (initReproArtifacts, checkReportArtifacts, doctorFinding).
  • omv-find now excludes packages that already exist in .omv/findings/ or .omv/archive/findings/; pass --include-known to override. Added a behavior eval + golden output for local dedup.
  • Updated @types/node and yaml dependencies.

v0.8.0 - Workflow readiness gates

  • Added omv repro init <id> to scaffold local reproduction artifacts and merge evidence.repro_artifacts idempotently.
  • Added omv findings doctor <id> with structured readiness issues, score deductions, JSON output, and CI-friendly exit codes.
  • Added omv report artifacts <id> and reused the same checks for strict reported archive gates.
  • Improved dashboard workflow detail with verdict, top blocker, full next actions, and richer JSON fields.
  • Added an end-to-end finding lifecycle regression test from template creation through strict reported archive.
  • Added copyable candidate, blocked, and confirmed demo Evidence.v1 examples.
  • Extracted CLI usage/help functions into usage.ts, reducing omv.ts by ~280 lines.
  • Added a Python zipfile fallback for skill packaging when the system zip binary is unavailable.
  • Expanded pattern registries to 12 ecosystems (added php, csharp, swift, dart, elixir, perl).
  • Expanded omv-audit and omv-repro eval coverage to 6 scenarios each.
  • Added CONTRIBUTING.md with full skill development template and registration guide.

v0.7.1 - Hardened evidence workflow

  • Replaced shallow CLI YAML parsing with structured parsing for Evidence.v1 and registry metadata.
  • Added stricter Evidence.v1 validation gates, CLI argument validation, install manifests, and doctor integrity warnings.
  • Added stable omv-audit and omv-repro eval checkers and release-time enforcement.
  • Improved CLI ergonomics with command help, omv version, JSON setup output, and strict validation modes.
  • Added a richer CLI/TUI output layer for setup, doctor, dashboard, findings, and validation views.
  • Split finding scoring into evidence completeness and submission readiness so unresolved blockers and missing local observations no longer look submission-ready.
  • Added verdict and evidence.repro_artifacts to Evidence.v1, plus .omv/repro/<id>/ artifact conventions for local reproduction evidence.
  • Added Chinese documentation and a full Chinese vulnerability-research best-practices guide.
  • Added npm release guards and dry-run packaging checks.

v0.7.0 - Evidence ledger workflow

  • Standardized the README as a user-facing guide for installation, target discovery, Evidence.v1 handoffs, validation, reporting, and safety boundaries.
  • Added project-scope setup, catalog-driven installs, stronger doctor checks, and metadata synchronization guards.
  • Added the .omv/findings Evidence.v1 ledger with CLI commands for list, init, validate, and promote.
  • Updated omv-find and omv-report docs so finder output flows through validated Evidence.v1 files before report generation.

v0.6 - vuldb-report eval harness

  • Added a deterministic vuldb-report eval checker for saved report outputs.
  • Added machine-readable assertions for report format, OSV JSON, blocked handoffs, duplicate CNA warnings, severity sanity, and safe PoC wording.
  • Added stable golden outputs for blocked handoff, OSV prototype pollution, and duplicate GHSA/VulDB CNA-risk scenarios.

v0.5 - report templates

  • Added reusable VulDB, GHSA, OSV, and standalone Markdown advisory templates.
  • Added more vuldb-report examples and eval scenarios for advisory format selection.
  • Kept GHSA and VulDB duplicate-CVE guidance explicit to avoid double CNA submissions.

v0.4 - vuldb-report examples and evals

  • Expanded vuldb-report behavioral coverage beyond basic XSS, traversal, and duplicate-CVE cases.
  • Added examples for registry advisory formats and vulnerability classes that are common in package ecosystems.

v0.3 - skill handoff contract

  • Added a structured handoff contract from vuln-finder research output to vuldb-report submission drafting.
  • Defined required, optional, and blocker fields so confirmed findings can be promoted without losing evidence provenance.

v0.2 - release engineering

  • Added a release check script that validates skill structure, rebuilds packages, and emits SHA-256 artifact metadata.
  • Documented the release process, version policy, and compatibility checklist.