Osmedeus Core Engine Files

This release introduces the agent-acp step type, enabling Osmedeus workflows to spawn and orchestrate external AI coding agents via the Agent Communication Protocol (ACP). Delegate tasks to real agent binaries — Claude Code, Codex, OpenCode, or Gemini — directly from your workflow YAML.

Built-in agents: | Agent | Command | |-------|---------| | claude-code | npx -y @zed-industries/claude-code-acp@latest | | codex | npx -y @zed-industries/codex-acp | | opencode | opencode acp | | gemini | gemini --experimental-acp |

Workflow example:

:::yaml
steps:

  - name: analyze
    type: agent-acp
    agent: claude-code
    cwd: "{{Output}}"
    messages:
      - role: user
        content: "Analyze the scan results and create a summary report."
    exports:
      analysis: "{{acp_output}}"

CLI usage:

:::bash
osmedeus agent "analyze this codebase"
osmedeus agent --agent codex "explain main.go"
osmedeus agent --list

API endpoint: POST /osm/api/agent/chat/completions — OpenAI-compatible chat format with concurrency control.

Agentic LLM Executor

• LLM-based agentic loop with tool calling, max iterations, and stop conditions
• 20+ preset tools: bash, read_file, http_get, grep_regex, run_module, run_flow, and more
• Sub-agent orchestration via spawn_agent with recursive depth limits
• Agent memory management with sliding window, summarization, and session persistence
• Structured output via JSON schema enforcement

SARIF Integration

• Parse and import SAST results from Semgrep, Trivy, Kingfisher, and Bearer
• db_import_sarif() for database ingestion with severity mapping and deduplication
• convert_sarif_to_markdown() for human-readable vulnerability reports

Workflow Engine Improvements

• Decision routing — Conditional branching with switch/case syntax and param-based JS evaluation
• Linter enhancements — Comprehensive undefined variable detection with built-in variable awareness
• Webhook triggers — UUID-based run execution with authentication key support
• Snapshot improvements — Workspace export/import with replay support
• Workflow help metadata — Artifact optional flag, search/filter improvements

Utility Functions

• Nmap integration — nmap_to_jsonl(), run_nmap(), db_import_port_assets() for port scan processing
• Tmux sessions — tmux_run(), tmux_capture(), tmux_send() for background process management
• Agent functions — run_agent() for executing ACP agents from JS context within workflows

Cloud Infrastructure (Still WIP)

• Multi-provider support: DigitalOcean, AWS, GCP, Linode, Azure with Pulumi integration
• Distributed scanning with osmedeus cloud run -f <flow> -t <target> --instances N
• Cost controls and automatic infrastructure cleanup

Enhanced UI Dashboard

• Updated dashboard build with latest Next.js artifacts

Full Changelog: https://github.com/j3ssie/osmedeus/compare/v5.0.0...v5.0.1