# Changelog ## Unreleased ## v1.1.0 - 2026-07-23 - Added first-class Pi package support with native `pi.skills` discovery, documented `/skill:omv-*` invocation, and bilingual install guidance. - Fixed research workspace resolution so commands run from under `.omv/` (for example `.omv/checkouts/`) reuse the owning project instead of creating a nested empty `.omv`. Supports `OMV_PROJECT_ROOT` / `OMV_ROOT` and global `--root `. - Fixed `omv dashboard` / `omv campaign list` treating AttackSurfaceList sidecars (`*.surfaces.yaml`) as Campaign.v1 files, which produced hard validation errors after `surfaces propose`. - Confirmed evidence `file:line` checks now accept inclusive ranges (`path/file.go:12-18`) as well as column forms. - Verification `decision.status: pass` no longer fails when a review sets `agrees: true` but still lists nuance notes under `disagreements`. - `omv review` routes to `/omv-repro` only for missing `observed_result`, not merely for `plausible` exploitability. - Added `ssrf-filter` attack-surface pack for HTTP client SSRF filters and private-IP agents. - Documented allowed `--mode`, `--goal`, and `--budget` enums in `omv help start`, plus project-root resolution in top-level help. ## v1.0.0 - 2026-07-11 - Added Windows as a validated platform with Python 3 runtime discovery, shell-independent Node test execution, cross-platform Skill packaging and LOC estimation, and an Ubuntu/Windows CI matrix. Claude Code remains the default platform when `--platform` is omitted. - Reduced install overhead by replacing the static `boxen` and `cli-table3` output layer with the built-in responsive renderer, removing 21 packages from a clean npm install. - Improved first-run setup with automatic platform-scoped health verification, explicit restart and Skill invocation guidance, compact install paths, accurate dry-run labels, and clearer download/upgrade documentation. - Froze the 1.0 CLI compatibility surface: workflow-first public help, grouped advanced automation commands, Skill-managed primitives hidden from public catalogs, and canonical `start`, `dashboard`, and `review` workflows replacing redundant wrappers. - Froze the remaining 1.0 compatibility boundaries with root-only Node package exports, inventoried runtime/type exports, required-field JSON contracts for every public automation command, parser-aware `.omv` contract versioning, and package-to-installed-Skill content drift checks. - Removed the pre-1.0 `first`, `workspace init`, `findings workflow`, `findings doctor`, `findings open`, and permanent `findings delete` routes with focused migration errors. - Removed the undocumented experimental `omv-mcp` executable and its custom line-delimited JSON protocol before the 1.0 compatibility boundary. - Added first-class Codex setup, doctor, and uninstall support using official `~/.agents/skills` and `.agents/skills` discovery paths, with platform-specific manifests and repository guidance in `AGENTS.md`. - Raised the runtime baseline to Node.js 22 and added an Ink 7 / React 19 interactive research workspace. - Bare `omv` now opens the responsive workspace in a real TTY; `omv tui` is the explicit entry, while `omv dashboard`, `--no-tui`, pipes, CI, and JSON remain deterministic plain output. - Added keyboard workflow navigation, live filtering, evidence-first finding inspection, action-surface guidance, help, refresh, narrow-terminal layouts, and an interactive guided start flow. - Hardened detail refresh/error recovery, explicit plain-mode routing, and terminal layouts down to a bounded 52x16 minimum. - Expanded the TUI with Overview, Findings, Campaign, and Activity views; Summary/Evidence/Threat/History detail tabs; structured filters; and a read-only command palette. - Added V3 full-width wrapped finding and Activity-event detail with scrolling and range indicators, plus paged access to the latest 200 Activity entries. ## v0.10.1 - npx package binary alias - Register `oh-my-vul` as a package bin alias for `omv`, so `npx oh-my-vul setup` works. Previously only `omv` / `omv-mcp` were exported, which made npx report "could not determine executable to run". ## v0.10.0 - Campaign first-mile, surfaces, and research discipline First-mile research and quality gates for evidence-first work: - **Campaign.v1** — `omv campaign init|list|show|seed` and `omv first`. Seeding creates conservative candidate Evidence only and never overwrites existing findings or proof artifacts. - **Attack Surface Cards** — `omv campaign surfaces propose|show|select` turns campaign priorities into deterministic pack-based research cards; `omv campaign seed` uses selected cards when a surfaces sidecar exists (otherwise falls back to vuln-class lanes). - **SourceRef.v1 + report provenance** — `omv sources init|show|validate` and `omv report provenance` manifests that hash Evidence, reports, and local dependencies. Missing manifests warn; stale confirmed manifests fail artifact checks. - **PatternPack.v1 + unified evals** — 14 JSON pattern-pack manifests (including R/Lua), manifest-driven find/audit asset sync, and `omv eval` with human/JSON/JUnit output. - **ThreatMap rich render** — `omv findings show` prints full `source → transforms → sink` paths with confidence, bypassable guards, and summary. - **Readiness helpers** — shared `isReportReady` / `isSubmissionScoreReady` / `resolveDoctorNextAction` for doctor and review. - **using-omv bootstrap** — process skill for evidence-before-claims and HARD-GATEs (quality growth, not skill sprawl); audit/report/repro gain explicit verification-before-claim rules; stable evals cover premature-report refusal and process-first open. - **Public docs policy** — GitHub publishes user-facing guides only; maintainer/agent/OpenSpec/release docs stay local. - **Install set** — 10 skills (adds `using-omv`). ## v0.9.0 - CLI command split and local findings dedup - Split the `omv` CLI dispatcher (`omv.ts`, 1434 lines) into one module per command under `commands/`, plus a `commands/shared.ts` arg-helper module and a `commands/index.ts` registry replacing the dispatch `switch`. The 12 duplicated command error handlers collapse into one. `omv.ts` is now a 7-line entry. - Wired three commands that were validated and advertised but previously unreachable: `omv repro init`, `omv report artifacts`, and `omv findings doctor`. They now dispatch to the existing domain logic (`initReproArtifacts`, `checkReportArtifacts`, `doctorFinding`). - `omv-find` now excludes packages that already exist in `.omv/findings/` or `.omv/archive/findings/`; pass `--include-known` to override. Added a behavior eval + golden output for local dedup. - Updated `@types/node` and `yaml` dependencies. ## v0.8.0 - Workflow readiness gates - Added `omv repro init ` to scaffold local reproduction artifacts and merge `evidence.repro_artifacts` idempotently. - Added `omv findings doctor ` with structured readiness issues, score deductions, JSON output, and CI-friendly exit codes. - Added `omv report artifacts ` and reused the same checks for strict reported archive gates. - Improved dashboard workflow detail with verdict, top blocker, full next actions, and richer JSON fields. - Added an end-to-end finding lifecycle regression test from template creation through strict reported archive. - Added copyable candidate, blocked, and confirmed demo Evidence.v1 examples. - Extracted CLI usage/help functions into `usage.ts`, reducing `omv.ts` by ~280 lines. - Added a Python `zipfile` fallback for skill packaging when the system `zip` binary is unavailable. - Expanded pattern registries to 12 ecosystems (added php, csharp, swift, dart, elixir, perl). - Expanded `omv-audit` and `omv-repro` eval coverage to 6 scenarios each. - Added CONTRIBUTING.md with full skill development template and registration guide. ## v0.7.1 - Hardened evidence workflow - Replaced shallow CLI YAML parsing with structured parsing for Evidence.v1 and registry metadata. - Added stricter Evidence.v1 validation gates, CLI argument validation, install manifests, and doctor integrity warnings. - Added stable `omv-audit` and `omv-repro` eval checkers and release-time enforcement. - Improved CLI ergonomics with command help, `omv version`, JSON setup output, and strict validation modes. - Added a richer CLI/TUI output layer for setup, doctor, dashboard, findings, and validation views. - Split finding scoring into evidence completeness and submission readiness so unresolved blockers and missing local observations no longer look submission-ready. - Added `verdict` and `evidence.repro_artifacts` to Evidence.v1, plus `.omv/repro//` artifact conventions for local reproduction evidence. - Added Chinese documentation and a full Chinese vulnerability-research best-practices guide. - Added npm release guards and dry-run packaging checks. ## v0.7.0 - Evidence ledger workflow - Standardized the README as a user-facing guide for installation, target discovery, Evidence.v1 handoffs, validation, reporting, and safety boundaries. - Added project-scope setup, catalog-driven installs, stronger doctor checks, and metadata synchronization guards. - Added the `.omv/findings` Evidence.v1 ledger with CLI commands for `list`, `init`, `validate`, and `promote`. - Updated `omv-find` and `omv-report` docs so finder output flows through validated Evidence.v1 files before report generation. ## v0.6 - vuldb-report eval harness - Added a deterministic `vuldb-report` eval checker for saved report outputs. - Added machine-readable assertions for report format, OSV JSON, blocked handoffs, duplicate CNA warnings, severity sanity, and safe PoC wording. - Added stable golden outputs for blocked handoff, OSV prototype pollution, and duplicate GHSA/VulDB CNA-risk scenarios. ## v0.5 - report templates - Added reusable VulDB, GHSA, OSV, and standalone Markdown advisory templates. - Added more `vuldb-report` examples and eval scenarios for advisory format selection. - Kept GHSA and VulDB duplicate-CVE guidance explicit to avoid double CNA submissions. ## v0.4 - vuldb-report examples and evals - Expanded `vuldb-report` behavioral coverage beyond basic XSS, traversal, and duplicate-CVE cases. - Added examples for registry advisory formats and vulnerability classes that are common in package ecosystems. ## v0.3 - skill handoff contract - Added a structured handoff contract from `vuln-finder` research output to `vuldb-report` submission drafting. - Defined required, optional, and blocker fields so confirmed findings can be promoted without losing evidence provenance. ## v0.2 - release engineering - Added a release check script that validates skill structure, rebuilds packages, and emits SHA-256 artifact metadata. - Documented the release process, version policy, and compatibility checklist.