This release adds 5 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+9 more
Affected surfaces
Summary
AI summaryBroad release touches Commit Summary, omo-config-core, utils, and codex.
Full changelog
v4.16.0: Leaner Prompts, Safer Installs, Faster Release Flow
LazyCodex for Codex now injects a minimal ultrawork prompt on startup. The full directive lives in the bundled skill; the session context stays below the truncation cliff.
CodeGraph handles long-running Codex sessions without leaking state. Temporary roots are excluded by default, orphaned processes are swept, and cleanup failures are isolated so indexing errors stay out of unrelated work.
OMO config handling gets safer with the new omo.json loader. It supports walked precedence, preserves JSON comments on write, rejects unsafe symlinked paths, and avoids backup filename collisions.
Frontend skill artifacts sync with the lazyweb research lane, including the curl-only research flow and the Stitch worked example.
The release pipeline verifies npm payload containment, excludes stale component residue, skips unnecessary pack-time rebuilds, and runs a faster parallel build.
No breaking migration is expected for OpenCode or LazyCodex users.
Release scale: 300 commits since v4.15.1, 1,556 files changed, 138,701 insertions, and 2,648 deletions.
Minor Compatibility and Stability Release
This release carries compatibility-facing behavior changes and operational hardening. Read the summary below before upgrading or publishing.
- Rename transition updates across package detection, plugin/config compatibility, and install surfaces.
- Task and tool behavior updates, including delegate-task contract and runtime registration behavior.
- Install and publish workflow hardening, including safer release sequencing and package/install fixes.
Commit Summary
- be590a169 Merge pull request #5967 from code-yeongyu/release/v4.16.0-source-state
- 0b4583c1c Merge pull request #5939 from code-yeongyu/fix/prepublish-gate-cleanup
- cd0a047e5 test(publish): record prepublish gate cleanup QA evidence
- e6de97e80 fix(publish): exclude nested node_modules and stale component residue from npm payloads
- 4e2b92048 chore(codegraph): track serve.js bundle as executable to match build output
- c3c72d6bd fix: make BOTH-targets task error state the call hard-fails instead of claiming subagent_type is ignored
- fb5c67bf8 Merge branch 'mt-category' into mt-agents
- 7d8a645a3 Merge branch 'mt-scaffold' into mt-category
- 86db4238d Merge branch 'mt-category' into mt-agents
- 7a715f89f Merge branch 'mt-scaffold' into mt-category
- 644412be0 Merge pull request #5919 from code-yeongyu/hotfix/frontend-builtin-skill-artifact-sync
- 4b3eb76bc Merge branch 'mt-scaffold' into mt-category
- b75dcd090 Merge branch 'mt-loader' into mt-scaffold
- d8bdf180f Merge branch 'mt-schema' into mt-loader
- c5dd95a6a Merge branch 'mt-category' into mt-agents
- 441f34723 fix(skills-loader-core): sync frontend builtin-skill artifacts with lazyweb lane
- 20126682f fix(skills-loader-core): sync frontend builtin-skill artifacts with lazyweb lane
- d479b17d0 Merge branch 'mt-category' into mt-agents
- 505487faa Merge branch 'mt-scaffold' into mt-category
- 2f6877616 Merge branch 'mt-scaffold' into mt-agents
- 6dc43ad7a Merge branch 'mt-loader' into mt-scaffold
- da6117721 Merge branch 'mt-schema' into mt-loader
- f511d61e3 fix: restore omo-config-core registration lost in dev merge resolution
- 11c79d6fd Merge branch 'mt-loader' into mt-scaffold
- 83b4a4abe Merge branch 'mt-schema' into mt-loader
- aa5bd35e0 Merge remote-tracking branch 'origin/dev' into mt-schema
- b2ceab68a feat(shared-skills): add curl-only lazyweb research lane to frontend skill
- 527cf06ae refactor(omo-codex): trim hephaestus session-start rule to under 2k tokens
- 5d84554c3 fix(omo-config-core): ignore symlinked project config files
- e6a462179 test(omo-config-core): clean loader symlink evidence
- 7859a8791 fix(omo-config-core): ignore symlinked project omo dirs
- 34460a107 fix(omo-config-core): merge partial team layers
- 318464dba test(omo-config-core): record final backup collision verification
- 28c1d079a test(omo-config-core): record backup collision push
- 656432d6e fix(omo-config-core): avoid backup filename collisions
- b0b757e5f test(omo-config-core): record recovery clean status
- ce253e519 test(omo-config-core): record repeat symlink verification
- 94c37d6af Merge pull request #5908 from code-yeongyu/fix/ulw-plan-review-sequencing
- 741d99729 test(omo-config-core): record stop-hook symlink verification
- 93533771f test(omo-config-core): clean symlink evidence whitespace
- 828122360 fix(omo-config-core): reject symlinked project config dirs
- 953f8f9b4 fix(prompts): condition ulw-plan stop rule on recorded review receipts
- dfadc622c fix(omo-config-core): preserve json config writes safely
- b2deda4ca test(shared-skills): pin ulw-plan review sequencing contract
- 5039ff957 fix(prompts): sequence ulw-plan Metis/Momus review dispatch rules
- cac0cfc2b test(omo-config-core): record third stop-hook verification
- 90c3b73d1 test(omo-config-core): record second stop-hook verification
- bbc9ef39b test(omo-config-core): record stop-hook verification
- a32630007 test(omo-config-core): clean review evidence whitespace
- 1c477631c fix(omo-config-core): harden config write safety
- 6f11cfe1a fix(omo-config-core): load user omo json files
- a7ac217ae Merge pull request #5907 from code-yeongyu/fix/build-orchestrator-killgroup-lead
- 5713f7c62 fix(build): kill the whole process tree when a build step fails
- a13f88bbd feat(omo-config-core): omo.json loader with walked precedence and comment-preserving writer
- 514ca17b1 feat(omo-config-core): scaffold omo.json schema with category drift guard
- 5079b7ba9 Merge pull request #5903 from code-yeongyu/perf/build-orchestrator-robustness
- 56002e8a3 Merge pull request #5901 from code-yeongyu/perf/sync-race-await-flush
- c572b2663 test(team-mode): bump integration test timeouts 15s→30s above LOCK_WAIT_TIMEOUT_MS
- 76309286b test(background-agent): replace ~23 blind launch→sleep waits with waitUntil polls
- da4edbf48 test(cli-run): inject a virtual clock into pollForCompletion to kill the wall-clock race
- 3980c29a5 test(background-agent): await real flush-settle signal instead of blind sleeps
- bec69b799 Merge pull request #5902 from code-yeongyu/sisyphus-bot/codegraph-zombie-sweep
- 9fb498c79 fix(utils): normalize codegraph sweep roots by target platform
- 0bec91feb test(utils): pin codegraph sweep fixtures to posix platform
- 35e2d3a75 fix(build): harden orchestrator failure and output handling
- 5398fa66a feat(codex): sweep orphaned codegraph processes
- c6dc7d39d feat(utils): add codegraph zombie sweep primitives
- e8d2da0c1 Merge pull request #5898 from code-yeongyu/perf/publish-pack-ignore-scripts
- b01404e9c Merge pull request #5900 from code-yeongyu/test-speed/config-handler-timeout
- 0d26c2ac5 test(publish): align workflow guard with ignore-scripts publish command
- f8c2aeda1 perf(omo-opencode): lower plugin_load_timeout_ms in config-handler timeout test
- 4db4cf6ae Merge pull request #5897 from code-yeongyu/sisyphus-bot/codegraph-tmpdir-defaults
- 10c4ec23e ci(publish): skip pack-time rebuild on the npm publish commands
- b6222b689 test(codegraph): record final gate approval
- 7ec72e750 Merge pull request #5895 from code-yeongyu/perf/memoize-package-layout-pack
- f0784c44d test(codegraph): record post-fix review coverage
- e0bc1d2bf test(package-layout): memoize the pack dry-run per file
- 5512121e4 test(codegraph): clean qa evidence artifacts
- ec02616c0 test(codegraph): record tmpdir exclusion qa evidence
- 670cfe367 docs(codex): document codegraph exclusions
- 7960abb16 chore(codegraph): restore serve bundle file mode
- cdc3d1246 fix(codegraph): exclude os temp roots by default
- c4be75190 Merge pull request #5891 from code-yeongyu/perf/ci-drop-test-lsp-daemon-build
- f6defc67a Merge pull request #5888 from code-yeongyu/perf/build-orchestrator
- 17ff63ffd perf(ci): drop the test job's redundant lsp-daemon build step
- 6d6874e40 fix(build): add missing orchestrator dependency edges
- 45578cd17 Merge pull request #5890 from code-yeongyu/perf/ci-prune-vendored-builds
- 29d32f4c7 test(ci): update workflow-structure meta-test for pruned vendored builds
- 23e8b592a Merge pull request #5836 from code-yeongyu/code-yeongyu/fix-codegraph-ephemeral-gc-5834
- 2f76530b6 perf(ci): drop redundant vendored-package build steps
- 7bca1e51a test(build): point build-chain guards at the orchestrator
- 2b52562dc Merge pull request #5889 from code-yeongyu/fix/windows-flake-durable-fixes
- d92cc9f6a Merge pull request #5885 from code-yeongyu/fix/test-home-isolation-flakes
- e239ba3c8 test(codex): record codegraph live qa evidence
- 2d3103945 Merge pull request #5886 from code-yeongyu/test-speed/session-resolver-retry-delay
- cb7117808 Merge remote-tracking branch 'origin/dev' into verify/pr-5836
- 5d8f241a0 fix(skills-loader): resolve HOME via env-honoring helper for hermetic discovery
- f790e55a8 test(flaky): bound dependency-security git-grep spawn and uniquify session-plan tmpdir
- 3a3e85f9e perf(build): run bun run build through a parallel DAG orchestrator
- 355f0f660 build(codex): gate materialize behind OMO_SKIP_MATERIALIZE
- 73b116405 Merge pull request #5883 from code-yeongyu/perf/publish-ignore-scripts
- 9f2dff638 Merge pull request #5884 from code-yeongyu/test-speed/ralph-loop-more-cuts
- 59b2864ae perf(omo-opencode): make session-create retry delay injectable for tests
- 8fd516f0b Merge pull request #5877 from code-yeongyu/perf/ci-ignore-scripts
- 5ce2709b9 Merge pull request #5881 from code-yeongyu/feature/tasteskill-embedding
- 8d2208c01 Merge pull request #5880 from code-yeongyu/perf/publish-parallel
- e9a7c753c Merge pull request #5882 from code-yeongyu/fix/bunfig-ignore-dist-tests
- 7a6a65a3b perf(omo-opencode): zero idle-settle in two more ralph-loop test files
- 84e1864c1 chore(builtin-skills): sync checked-in frontend SKILL.md artifacts with shared source
- e74d1f602 Merge pull request #5879 from code-yeongyu/test-speed/blind-delay-cuts
- 904c0184c ci(publish): skip prepare build on installs that do not need dist
- 0261e0f4c Merge pull request #5876 from code-yeongyu/fix/prometheus-implement-by-proxy
- 277dd05dd test(bunfig): ignore built dist/ test copies in discovery
- c33aeec48 Merge pull request #5878 from code-yeongyu/perf/parallel-component-build
- f34a46493 docs(shared-skills): route the stitch worked example in frontend routing docs
- f59817d89 feat(shared-skills): materialize stitch-skill worked-example DESIGN.md
- c1d773233 chore(shared-skills): bump taste-skill upstream pin and refresh attribution
- b90a8fea1 perf(ci): skip lifecycle scripts on bun install (except the test job)
- 2e928c205 ci(publish-platform): raise publish max-parallel 2 -> 6
- a6b4924cb perf(omo-opencode): cut default idle-settle/defer waits in slow hook tests
- eaf326028 perf(codex-build): parallelize component builds
- ea4c7ec21 Merge remote-tracking branch 'origin/dev' into verify/pr-5836
- d66c372b6 fix(ulw-plan): exclusive read-only delegation roles + harness-neutral bootstrap exception
- 6ddae58ab fix(prometheus): close the implement-by-proxy loophole in the planner prompt
- d0d219b2e fix(prometheus-md-only): stop instructing implement-by-subagent on blocked writes
- 141e90f1d Merge pull request #5868 from code-yeongyu/sisyphus-bot/fix-4163
- aea99b5f9 fix(omo-opencode): wait for pending parent wake
- 94f740498 Merge pull request #4421 from PeterPonyu/fix/team-member-fallback-retry
- e465d1934 fix(team-mode): guard stale member error side effects
- a1b9a16ca Merge remote-tracking branch 'origin/dev' into takeover/pr-4421
- 163a10c33 Merge pull request #5161 from Eric-GoodBoy-Tech/fix/tmux-pane-auth-env
- 3b4558853 test(tmux-core): tolerate auth env in pane argv tests
- 6abb7d957 fix(tmux-core): pass auth env to subagent panes
- 029874d38 Merge remote-tracking branch 'origin/dev' into takeover/pr-5161
- 7084aa0f9 Merge pull request #5861 from code-yeongyu/sisyphus-bot/fix-5608
- f079d19dd Merge pull request #5858 from code-yeongyu/sisyphus-bot/fix-5596
- ab3d9c25e Merge pull request #5856 from code-yeongyu/sisyphus-bot/fix-5815
- 1ae8f7497 test(tmux-core): skip unix shell argv checks on windows
- 77d69c7ba fix(delegate-task): unblock sync tmux readiness
- 44827fcf6 Merge pull request #5860 from code-yeongyu/sisyphus-bot/fix-5751
- 707c47978 Merge pull request #5859 from code-yeongyu/sisyphus-bot/fix-5786
- fd89d3e15 test(omo-opencode): align tmux command shim expectations
- f960bd930 Merge pull request #5857 from code-yeongyu/sisyphus-bot/fix-5788
- ebda8b8f8 fix(omo-codex): preserve unreadable config on install
- 7c7b9235e fix(doctor): handle tuple TUI plugin entries
- c61de2545 fix(tmux-core): quote attach command arguments
- 4a32ad54b fix(model-core): recognize claude-sonnet-5 context
- 9737daf84 fix(model-core): retry free usage fallback errors
- 0d9ceebc1 Merge pull request #5855 from code-yeongyu/feature/programming-logging-methodology
- 62f66680f feat(shared-skills): bridge debugging fix phase to logging methodology
- c9867c8eb feat(shared-skills): add cross-language logging methodology to programming skill
- 8bfd6f950 fix(codex): narrow codegraph gc failures
- 9e3b3cfe0 fix(utils): narrow codegraph metadata errors
- a6176e76e fix(codex): refresh codegraph runtime gate fixes
- d88d35381 refactor(utils): split oversized codegraph helpers
- 464c728d3 fix(utils): harden codegraph cleanup policy
- 263180bf7 test(utils): isolate codegraph custom root fixture
- 6cc1e3117 test(codex): avoid tmp roots in codegraph positive fixtures
- 99ba2c37a fix(codex): skip codegraph ephemeral roots
- c03355471 fix(utils): add codegraph project exclusion policy
- 3f51596ac Merge pull request #5831 from code-yeongyu/fix/pr5792-skill-test-size-gate
- a32347c77 test(skill): split skill description suites by behavior
- 91841897d docs(agents-md): regenerate hierarchical AGENTS.md knowledge base
- f184ecaf4 Merge pull request #5792 from code-yeongyu/fix/shared-skill-description-dedup
- f078fd89e fix(skill): preserve built-in native skill aliases
- 8c8303263 fix(skill): preserve opencode native skill aliases
- 243908804 fix(skill): preserve builtin commands for distinct qualified skills
- cc4caff1a fix(skill): preserve distinct shared skill entries
- cf261a2b3 fix(skill): suppress path-alias duplicates from injected description
- 25bb0d5ac Merge pull request #5830 from code-yeongyu/fix/5828-ultrawork-skill-pointer
- e789e26cf feat(omo-codex/plugin): ship the ultrawork skill and pin pointer invariants
- fe7d43e3e feat(omo-codex/ulw-loop): mirror the ultrawork skill pointer in standalone injection
- a865c5c07 feat(omo-codex/ultrawork): inject compact skill pointer instead of full directive
- e8ea7faf2 Merge pull request #5819 from code-yeongyu/fix/windows-ci-flakiness
- d98d23009 test(utils): mock exhausted port range
- beb0b0963 test(ci): relax windows-heavy test timeouts
- 4b300e06b Merge pull request #5812 from changeroa/codex/ulw-research-epistemic-instrumentation
- d26330493 docs(reference): split the ulw-research feature row into readable sentences
- 4e56acd3c test(skills): pin the claim graph as the single ulw-research claim store
- 98e2c6edc fix(skills): replace the ulw-research claim ledger with the claim graph
- 8b1435f41 Merge pull request #5814 from code-yeongyu/fix-ulw-plan-announce-delimiter
- 25cc57d5e fix(ulw-plan): normalize ANNOUNCE example delimiter to hyphen in OpenCode flavor
- 1724636c6 Merge pull request #5813 from code-yeongyu/worktree-ulw-plan-high-accuracy-trigger
- f839a6869 fix(ulw-plan): make high-accuracy modifier fire the review gate in any turn
- 3726ff72f fix(skills): require ulw research epistemic instrumentation
- 25a696fef Merge branch 'dev' into fix/team-member-fallback-retry
- 2655bf18e fix: pass OPENCODE_SERVER_PASSWORD/USERNAME to tmux sub-agent panes
- d9803202e fix(team-mode): skip errored transition when fallback retry replaced member sessionId (#4420)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v4.19.0 Removes legacy Ralph Loop wiring; introduces Goal feature with automatic config migration.
- v4.6.0 Removed broken direct public binary entrypoints from platform launcher packages, keeping them internal.
- v4.6.0 Removed legacy context-window monitor hook path from active hooks and config surfaces.
- v4.4.0 Removes top‑level `lsp` config key; migration required to `.opencode/lsp.json`.
Beta — feedback welcome: [email protected]