Open Multi-Agent Files

Fixed

• Symlink loops and chains longer than the kernel's link limit now fail the sandbox check with a Too many levels of symbolic links error. Earlier versions also failed these writes, with the filesystem error instead.
• A symlink target that ends in a separator or . must now name an existing directory, as the kernel requires. On macOS, earlier versions resolved such a link to the file of that name, so file_write overwrote it.

Security

• file_write can no longer create a file outside the agent's working directory through a dangling symlink (GHSA-h42w-g3ch-rjjm, CVE-2026-108600). Versions 1.5.0 through 1.21.2 are affected. The sandbox check now resolves a dangling symlink to the target it names, one path component at a time as the kernel does, so a link pointing outside the root is rejected like any other outside path and a link pointing inside it keeps working. Every built-in filesystem tool shares this check.

Compatibility

• No public export, signature, or error ToolResult shape changed; upgrading needs no code change.
• Symlinks that resolve inside the working directory work as before, including a dangling link whose in-root target file_write creates.
• Writing through a dangling symlink whose target is outside the working directory now returns the "outside the agent's working directory" error. To write there on purpose, widen AgentConfig.cwd or OrchestratorConfig.defaultCwd to include that location.
• Sandbox failures from symlink resolution use new messages that start with Could not resolve path; check isError rather than matching message text.
• @open-multi-agent/otel is not republished: it did not change and depends on core through a semver range.

Packages

• @open-multi-agent/core: 1.21.3
• @open-multi-agent/otel: remains at 0.1.4 and is not republished
• create-oma-app: 0.8.10; generated starters pin core 1.21.3

Install

:::bash
npm i @open-multi-agent/core@1.21.3
npm create oma-app@latest my-oma