01 / 12
OrchestKit · 2026-05-10 → 05-11

7 Releases in 24 Hours.

A Claude Code floor bump (2.1.132 → 2.1.138), two adoption milestones closed at 100%, and a cc-watch pipeline that is finally self-healing.

v7.86.0 v7.86.1 v7.86.2 v7.86.3 v7.86.4 v7.86.5 v7.86.6
github.com/yonatangross/orchestkit · v7.86 release window
02 / 12
The window

Every release in the v7.86 train.

7.86.0
5-10 14:07 UTC
CC floor bump 2.1.132 → 2.1.138
7.86.1
5-10 20:33 UTC
cc-watch hardening + GH App token
7.86.2
5-11 06:11 UTC
codeql-action 4.35.3 → 4.35.4
7.86.3
5-11 06:40 UTC
claude-code-action 1.0.111 → 1.0.119
7.86.4
5-11 09:16 UTC
M132 Groups F + G
7.86.5
5-11 12:31 UTC
M132 Group H · final 3
7.86.6
5-11 ~13 UTC
Vercel Labs thorough sync

Two through five were release-please patch bumps fired automatically as fix/feat commits landed. The whole train was driven by exactly one human decision: "upgrade to latest".

03 / 12
The headline · M134

2.1.132 → 2.1.138

Six minor versions in one bump. The Claude Code floor was lifted as part of the M134 epic — 26 of 26 workstream issues closed.

2.1.138
New CC floor
was 2.1.132
26/26
M134 issues closed
100%
6
CC versions adopted
133, 136, 137, 138 (134/135 N/A)
04 / 12
The plugin · post-release

OrchestKit by the numbers.

107
Skills
27 user-invocable
37
Agents
specialized roles
188
Hooks
120 global · 46 agent · 22 skill
12
2.1.133 matrix entries
across Groups F + G + H
05 / 12
Milestone closeout · M131

CC 2.1.132 adoption — done at 36/36.

The whole 2.1.128/129/132 surface, finally documented and shipped.

Group A — Foundation

  • CC version matrix · base doc
  • Hook/agent format updates

Group B — MCP hygiene

  • MCP audit runbook
  • Manifest restructure

Group C — OAuth + perm

  • Plan-mode resume perm-mode honored
  • MCP unauth connector status

Group D — bash + plugin URL

  • mkdir/touch allow rules
  • plugin-dir .zip + plugin-url

Group E — OTEL/MCP/SDK

  • Subprocess env isolation
  • MCP reconnect summarization
  • SDK localSettings hint
06 / 12
Milestone closeout · M132

CC 2.1.133 adoption — done at 14/14.

Three groups, all shipped today. 12 new entries in the CC version matrix.

Group F

OAuth + session + network

  • parallel-session refresh-token race fix
  • MCP OAuth proxy + mTLS
  • Remote Control stop/interrupt
  • Windows mapped network drives

Group G

perms + sandbox + settings

  • worktree.baseRef setting (⚠ default flip)
  • sandbox.bwrapPath / socatPath
  • parentSettingsBehavior admin key
  • Edit/Write drive-root allow rules

Group H

effort + skill discovery

  • Hooks get $CLAUDE_EFFORT env
  • /effort is session-scoped now
  • Subagents discover skills again
07 / 12
Pipeline · now self-healing

cc-watch — Anthropic ships → we adopt automatically.

Anthropic ships X.Y.Z+1 ↓ Daily cron @ 14:00 UTC ↓ ┌────────────────────────────────────────────┐ │ cc-release-watch.mjs │ │ ├── snapshot detection W1b ✓ │ │ └── cc-triage with retry W1d ✓ │ │ ├── ≥ floor: LLM │ │ └── < floor: skip W1h ✓ │ │ └── file adoption issues W1e ✓ │ └────────────────┬───────────────────────────┘ ↓ peter-evans → release-bot GH App token (W1a ✓) ↓ PR opens → CI fires → auto-merges 🎉

Yesterday this chain had three silent failure modes. Today all three are guarded by tests (Step 3 integration test landed in v7.86.5).

08 / 12
⚠ Behavior-changing

worktree.baseRef default flipped back to "fresh".

Upstream CC 2.1.133 reverted the 2.1.128 behavior: EnterWorktree now branches from origin/<default> again — silently dropping unpushed commits.

OrchestKit's response

Documented in chain-patterns/worktree-agent-pattern as a required setting:

{ "worktree": { "baseRef": "head" } }

Action required Anyone running CC ≥ 2.1.133 with OrchestKit's worktree-isolation flow must set this or lose work.

09 / 12
Security

Two CVEs patched same-day.

CVE-2026-6321

fast-uri path traversal via percent-encoded dot segments. High severity.

CVE-2026-6322

fast-uri host confusion via percent-encoded authority delimiters. High severity.

Mitigation

fast-uri ^3.1.2 added to package.json overrides. fast-uri reaches orchestkit as a transitive (agentation-mcp → @modelcontextprotocol/sdk → ajv → fast-uri) — overrides bypass the long dependency chain.

CLAUDE_CODE_OAUTH_TOKEN renewed Also done today: stale token detected in cc-watch logs, rotated via claude setup-token.

10 / 12
Vercel Labs upstream sync

Three packages, thorough body updates.

agent-browser

0.26 → 0.27

  • React DevTools tree/inspect/renders/suspense
  • vitals command
  • pushstate, --init-script
  • Network --resource-type
  • Dashboard proxy, doctor dedupe fix

json-render

0.18 → 0.19

  • defineDirective custom API
  • New @json-render/directives
  • 7 directives: $format, $math, $concat, $count, $truncate, $pluralize, $join
  • I18n + standardDirectives

portless

0.12 → 0.13

  • OS startup service (launchd, systemd, Task Scheduler)
  • Tailscale readiness preflight fix
  • portless service install/status/uninstall
11 / 12
What's queued

M135 — CC 2.1.136 adoption.

The W3 recovery agent pre-filed 20 issues. Whenever someone has bandwidth, the same Group-F/G/H pattern carries it home.

0/20
M135 closed
CC 2.1.136 — the big release
50+
Upstream bullets in 2.1.136
includes autoMode.hard_deny, plugin slug case, MCP reconnect

M133 (CC 2.1.138) is intentionally empty — that release was "Internal fixes only".

12 / 12
Ship log · 2026-05-11

That's the v7.86 train.

Floor lifted, two milestones closed, the cc-watch pipeline becomes the first piece of infrastructure that recovers on its own from upstream drops.

Reading list

Use ← → to navigate · f for fullscreen · esc to exit
01 / 12