Skip to content

Release Notes - v0.18.0

Release Date: 2026-08-16

v0.18.0 completes the Skill Secrets initiative: skills declare the secrets they need in SKILL.md, GitHub-Actions style, and OmniAgent supplies them from global config bindings (single-operator) or a per-agent vault (team mode) — with required-secret gating, precedence between the two, a read-only admin view, and defense-in-depth log redaction end to end. This release also adds email+password authentication for team mode and redesigns the team-mode web UI with a persistent left nav plus in-composer translate and speech-to-text.

Highlights

  • Skill Secrets - Full lifecycle: requires.secrets declaration in SKILL.md, global/per-skill config bindings, injection into MCP/OpenAPI/ compiled skills, required-secret gating, and log/output redaction.
  • Team-Mode Secret Precedence - An agent's secrets now fall back through the config bindings when its own vault has no value (per-agent secret, then per-skill config binding scoped to that agent's enabled skills, then the global binding), with a superadmin-only read-only view of the global bindings.
  • Password Authentication - Email+password sign-in (argon2id) for team mode, alongside magic-link and Google/GitHub SSO.
  • Team-Mode SPA Redesign - A persistent left nav matching claude.ai/ ChatGPT/GitHub's layout, plus browser-native speech-to-text and an LLM-backed translate icon in the chat composer.

What's New

Skill Secrets

A skill declares what it needs directly in its SKILL.md frontmatter:

metadata:
  requires:
    secrets:
      - name: GITHUB_TOKEN
        description: Personal access token with repo scope
        required: true

The operator supplies it — in personal/single-operator mode, via config:

# omniagent.yaml
secrets:
  GITHUB_TOKEN: "op://Shared/github/token"   # global binding

skills:
  config:
    github:
      secrets:
        GITHUB_TOKEN: "env://GITHUB_TOKEN_OVERRIDE"  # wins over the global binding

— or in team mode, per agent from the Secrets panel on the agent's config page (write-only: the UI and API only ever report whether a value is set, never the value itself).

Resolved values are injected wherever a skill can receive them: MCP subprocess environments, OpenAPI request auth (bearer/API-key/basic), and compiled Go skills via agent.WithSecretEnv. A skill that declares a required secret with no value anywhere is excluded from the loaded skill set — with a logged reason — instead of loading and failing later at call time; this applies to markdown SKILL.md skills and to compiled skills that implement compiled.SecretRequirer (MCP does today).

In team mode, an agent's secrets resolve with a clear precedence: its own per-agent vault value first, then a per-skill config binding (scoped to exactly that agent's own enabled skills — never a skill it doesn't have), then the global config binding. Superadmins can see which global bindings are configured — names and set-state, never values — from a new Global Secret Bindings card in the Admin tab, backed by GET /api/admin/secret-bindings.

Every resolved secret value, wherever it comes from, is registered with a new internal/redact package and masked out of all log output for the life of the process — including omniagent config show, whose own "sensitive values redacted" promise had drifted out of sync with the new config fields until this release.

See Secrets, Virtual Agents → Secrets, and Team Mode → Agent-scoped secrets.

As part of this work, the never-functional keeper:// vault scheme was removed — no Keeper Secrets Manager provider was ever registered in this module's dependency tree, so it silently failed at resolve time. Prior documentation claiming otherwise (a whole "Keeper — pure Go implementation" section) has been corrected.

Password Authentication

Team mode now supports email+password sign-in alongside magic-link and SSO:

  • Passwords are hashed with argon2id; a superadmin can optionally seed their own credential at startup via team.superadmin_password (or OMNIAGENT_TEAM_SUPERADMIN_PASSWORD), set-once and never re-served.
  • Users can set or change their own password from account settings; a superadmin can set any user's password from the Admin → Members panel.
  • New endpoints: POST /api/auth/password, POST /api/users/me/password.

See Team Mode → Password login.

Team-Mode SPA Redesign

The team-mode web UI moved from a horizontal topbar to a persistent, narrow left nav — matching claude.ai, ChatGPT, and GitHub's layout — and picked up two new composer icons:

  • Speech-to-text (mic icon): dictates into the message box via the browser's native SpeechRecognition API, entirely client-side.
  • Translate (globe icon): posts the composer's text to a new one-shot POST /api/translate endpoint and replaces it with the translation (Spanish, French, German, Chinese, Japanese, Korean, Portuguese, Italian). Requires a deployment-wide LLM (agent.api_key configured) — see the new translate capability flag.

See Team Mode → Speech-to-text and translate.

Upgrade Notes

  • No breaking changes. Every new field (secrets, skills.config.<name>.secrets, team.superadmin_password) is optional and additive; existing configs work unchanged.
  • If any config used a keeper:// credential URI, it will now fail loudly at startup with an "unknown vault URI scheme" error instead of an opaque failure deep inside omnivault — switch it to a supported scheme (op://, bw://, file://, env://, or a plain value).
  • omniagent config show's redaction logic changed from a hardcoded field list to registry-based masking of every resolved secret value; output shape is otherwise unchanged.

Full Changelog

See CHANGELOG.md for the complete list of changes with commit references.