fix(setup): avoid termios setup crash on Windows

.gitattributes

@@ -1,2 +1,9 @@
 # Treat the AppIcon bundle's contents as binary and never merge them.
 web/electron/icons/AppIcon.icon/** binary -merge
+
+# Protobuf bindings regenerated by scripts/gen_routing_pb2.py from the .proto
+# schema. Mark them generated so review/code-quality tooling skips them (ruff
+# and mypy already exclude them in pyproject.toml); the protoc output isn't
+# hand-editable, so its unused-import/global artifacts are expected.
+omnigent/api/**/*_pb2.py linguist-generated=true
+omnigent/api/**/*_pb2.pyi linguist-generated=true

.github/MAINTAINER

@@ -15,9 +15,11 @@ mahesh-venkatachalam
 mateiz
 newfront
 PattaraS
+rahulrav1
 SabhyaC26
 serena-ruan
 shivam5
 TomeHirata
 xq-yin
 hzub
+zhengwin

.github/actions/run-omnigent-agent/action.yml

@@ -0,0 +1,124 @@
+name: Run Omnigent agent
+description: >-
+  Set up uv + the Claude Code CLI + an Omnigent gateway provider, run a tools-less
+  Omnigent agent headlessly on a prompt file, and secret-scan its output. Shared by
+  the release-cut (draft-release-notes) and publish (publish-changelog) workflows so
+  the LLM-runner scaffold lives in one place. The caller mints no write-token until
+  after this action returns — the only secret here is the model key.
+
+inputs:
+  workdir:
+    description: >-
+      Repo checkout dir relative to the workspace (`.` when checked out at the
+      root, `omnigent` when checked out into a subdir). Drives the venv path, the
+      cache key, and the uv --project / agent paths.
+    required: false
+    default: "."
+  agent:
+    description: Agent directory name under <workdir>/.github/agents/.
+    required: true
+  prompt-file:
+    description: Absolute path to the file holding the agent prompt.
+    required: true
+  output-file:
+    description: Absolute path to write the agent's stdout to.
+    required: true
+  stderr-file:
+    description: Absolute path to write the agent's stderr to.
+    required: false
+    default: /tmp/omnigent-agent-stderr.log
+  gateway-base-url:
+    description: Base URL of the Anthropic-compatible gateway.
+    required: true
+  llm-api-key:
+    description: Model API key (referenced by the provider config, used to scan output).
+    required: true
+  claude-code-version:
+    description: "@anthropic-ai/claude-code npm version to install."
+    required: false
+    default: 2.1.170
+
+runs:
+  using: composite
+  steps:
+    - name: Set up uv
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      with:
+        enable-cache: true
+
+    - name: Cache virtualenv
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ inputs.workdir }}/.venv
+        key: venv-${{ runner.os }}-${{ hashFiles(format('{0}/.python-version', inputs.workdir)) }}-${{ hashFiles(format('{0}/uv.lock', inputs.workdir)) }}
+
+    - name: Install dependencies
+      shell: bash
+      working-directory: ${{ inputs.workdir }}
+      run: uv sync --extra all --extra dev
+
+    - name: Install Claude Code CLI
+      shell: bash
+      env:
+        NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
+        CLAUDE_CODE_VERSION: ${{ inputs.claude-code-version }}
+      run: |
+        set -euo pipefail
+        mkdir -p "${GITHUB_WORKSPACE}/.cc-cli"
+        cd "${GITHUB_WORKSPACE}/.cc-cli"
+        npm install --ignore-scripts --no-audit --no-fund "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
+        node node_modules/@anthropic-ai/claude-code/install.cjs
+        echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+
+    - name: Write Omnigent provider config
+      shell: bash
+      env:
+        GATEWAY_BASE_URL: ${{ inputs.gateway-base-url }}
+      run: |
+        set -euo pipefail
+        mkdir -p "$HOME/.omnigent"
+        python3 -c "
+        import pathlib, os, json
+        gw = os.environ['GATEWAY_BASE_URL']
+        cfg = {'providers': {'databricks-gateway': {
+            'kind': 'gateway', 'default': ['anthropic'],
+            'anthropic': {
+                'base_url': gw + '/anthropic',
+                'api_key_ref': 'env:LLM_API_KEY',
+                'models': {'default': 'databricks-claude-opus-4-8'},
+            }}}}
+        pathlib.Path.home().joinpath('.omnigent', 'config.yaml').write_text(json.dumps(cfg, indent=2))
+        "
+
+    - name: Run the agent
+      shell: bash
+      env:
+        LLM_API_KEY: ${{ inputs.llm-api-key }}
+        WORKDIR: ${{ inputs.workdir }}
+        AGENT: ${{ inputs.agent }}
+        PROMPT_FILE: ${{ inputs.prompt-file }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        STDERR_FILE: ${{ inputs.stderr-file }}
+      run: |
+        set -euo pipefail
+        project="${GITHUB_WORKSPACE}/${WORKDIR}"
+        prompt="$(cat "$PROMPT_FILE")"
+        uv run --project "$project" omnigent run \
+          "${project}/.github/agents/${AGENT}" \
+          -p "$prompt" --no-session \
+          2>"$STDERR_FILE" | tee "$OUTPUT_FILE" \
+          || { echo "::warning::agent exited non-zero — caller keeps its fallback"; cat "$STDERR_FILE"; }
+
+    # ::add-mask:: only redacts rendered logs; the caller still redacts artifact
+    # files before upload. This aborts the run outright if the key leaked to stdout.
+    - name: Scan agent output for secrets
+      shell: bash
+      env:
+        LLM_API_KEY: ${{ inputs.llm-api-key }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+        if [ -n "${LLM_API_KEY:-}" ] && grep -qF "$LLM_API_KEY" "$OUTPUT_FILE" 2>/dev/null; then
+          echo "::error::Agent output contains LLM_API_KEY — aborting."
+          exit 1
+        fi

.github/agents/doc-drafter/config.yaml

@@ -91,7 +91,9 @@ prompt: |
   Read `DIFF_FILE` (with `sys_os_read`) carefully — it is your source of truth.
   Pull exact facts (flags, defaults, harness ids, CLI names, config keys) from the
   diff itself. Never invent a fact; if the diff doesn't settle something a doc must
-  state, flag it for manual review rather than guessing.
+  state, flag it for manual review rather than guessing. Note whether the PR
+  **adds**, **changes**, or **removes/deprecates** a user-facing feature — that
+  decides whether you add, edit, or delete docs (Step 3).
 
   ## Step 2 — Inspect the live site and decide placement
   This is why you have the whole site checked out. Read
@@ -116,7 +118,23 @@ prompt: |
   ## Step 3 — Write the edit (scoped, grounded, in-style)
   Make the change. Editing an existing `page.mdx` in place is best when one fits;
   otherwise create the new page and wire it into the nav. Keep the change scoped
-  to what this PR introduced. Be accurate and concise — no marketing fluff.
+  to what this PR introduced, changed, or removed. Be accurate and concise — no
+  marketing fluff.
+
+  When the PR **removes or deprecates** a user-facing feature, the docs must
+  shrink to match — treat this as first-class as adding docs, never as a no-op:
+  - **Feature removed**: delete the now-untrue content. If a whole page documented
+    only that feature, delete the `page.mdx` (with `sys_os_shell` `git rm`) AND
+    remove its entry from the `SECTIONS` array in
+    `components/DocsSidebarFull.js`. If it was one section of a larger page, cut
+    that section and any references, table rows, or links pointing at it. Leave
+    no dangling nav entry or cross-link to a page you deleted.
+  - **Feature deprecated (not yet gone)**: keep the page but mark it deprecated in
+    the site's usual style and state the replacement/removal timeline if the diff
+    gives one; don't delete prematurely.
+  Ground the removal in the diff: only delete docs for what the PR actually
+  removed. If you're unsure whether a doc references the removed feature elsewhere
+  on the site, flag it under "Manual review needed" rather than guessing.
 
   Match the site's conventions by mirroring a real file:
   - **Existing page**: preserve its `pageMeta(...)` frontmatter and JSX component
@@ -141,10 +159,17 @@ prompt: |
   the affected `<img>` (MDX supports JSX comments; the build is unaffected).
 
   ## Output contract (your final assistant text)
-  After a line containing exactly `<!-- DOC_DRAFT_SUMMARY -->`, emit:
-  - `## Changes documented` — one bullet per file you created or edited (pages and
-    `components/DocsSidebarFull.js`): `path — what changed`. If you made no edits,
-    write `_No edits made._` and explain under the next section.
+  On the line IMMEDIATELY BEFORE `<!-- DOC_DRAFT_SUMMARY -->`, emit a single
+  `DOC_PR_TITLE:` line — a concise, imperative summary of what the docs now cover,
+  grounded in the diff (e.g. `DOC_PR_TITLE: document SMALLINT enum-column storage`).
+  Keep it under 60 characters, no trailing period, and do NOT prefix it with
+  `docs:` (the workflow adds that). This becomes the docs PR title.
+
+  Then, after a line containing exactly `<!-- DOC_DRAFT_SUMMARY -->`, emit:
+  - `## Changes documented` — one bullet per file you created, edited, or deleted
+    (pages and `components/DocsSidebarFull.js`): `path — what changed` (say
+    "deleted" / "removed section" for removals). If you made no edits, write
+    `_No edits made._` and explain under the next section.
   - `## Manual review needed` — a checklist: `- [ ] <doc path or area> — <why>`.
     Use this for things you genuinely cannot do well: stale screenshots/GIFs (you
     can't regenerate binaries), or a placement decision you're truly unsure about.