Skip to content

oh-my-openagent

v4.16.1 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 17d AI Coding Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agents anthropic chatgpt claude claude-skills
+9 more
codex cursor gemini ide openai opencode orchestration tui typescript

Affected surfaces

breaking_upgrade deps

Summary

AI summary

Broad release touches Commit Summary, codex, shared-skills, and runtime-fallback.

Changes in this release

Feature Low

Adds xterm.js‑based TUI evidence rendering, replacing tmux usage in QA harness.

Adds xterm.js‑based TUI evidence rendering, replacing tmux usage in QA harness.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Feature Low

Generates `omo.schema.json` artifact with freshness gate in omo‑config‑core.

Generates `omo.schema.json` artifact with freshness gate in omo‑config‑core.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Dependency Medium

Pins npm to version 11.18.0, fixing provenance sigstore crash caused by broken [email protected].

Pins npm to version 11.18.0, fixing provenance sigstore crash caused by broken [email protected].

Source: llm_adapter@2026-07-16

Confidence: low

 —
Bugfix Medium

Prevents ulw-loop status command from wedging on a full stderr pipe by running detached with a 30‑second timeout.

Prevents ulw-loop status command from wedging on a full stderr pipe by running detached with a 30‑second timeout.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Warns when a pinned plugin version differs from the running version (addresses issue #4734).

Warns when a pinned plugin version differs from the running version (addresses issue #4734).

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Requires a non‑empty value for explicit `--session-id` in ulw-loop, fixing issue #5752.

Requires a non‑empty value for explicit `--session-id` in ulw-loop, fixing issue #5752.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Fixes ulw-loop fork‑bomb infinite recursion by adding a one‑hop sentinel.

Fixes ulw-loop fork‑bomb infinite recursion by adding a one‑hop sentinel.

Source: llm_adapter@2026-07-16

Confidence: low

 —
Bugfix Medium

Reduces ulw-loop ledger size from ~189 KB to 7.8 KB (~24× smaller) by storing only changed goals.

Reduces ulw-loop ledger size from ~189 KB to 7.8 KB (~24× smaller) by storing only changed goals.

Source: llm_adapter@2026-07-16

Confidence: low

 —
Bugfix Medium

Routes Bun runtime calls through shims to resolve regression (#3824).

Routes Bun runtime calls through shims to resolve regression (#3824).

Source: llm_adapter@2026-07-16

Confidence: low

 —
Bugfix Low

Shows version information in codex hook statuses for better observability.

Shows version information in codex hook statuses for better observability.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Full changelog

🩹 The ulw-loop Memory Leak Is Fixed

If a long ultrawork run ever ballooned your RAM or spun up a swarm of stuck bun processes, this release is for you. What looked like one "memory leak" was actually two separate bugs, and both are now gone:

  • Fork-bomb stopped. A broken install could make the omo runtime wrapper call itself in an infinite loop — wrapper → CLI → wrapper → … — spawning thousands of wedged processes until memory ran out. Delegation now carries a one-hop sentinel and refuses to target a generated wrapper, so the chain can never recurse.
  • Ledger no longer bloats. Every steering entry used to embed the full plan four times, so .omo/ulw-loop/ledger.jsonl grew quadratically over a long run. Entries now store a compact snapshot of only the goals that changed — a real 189 KB entry dropped to 7.8 KB (~24× smaller), and reads/dedup stream the file instead of loading it all into memory.
  • No more stuck child processes. The senpi ulw-loop status spawn no longer wedges on a full stderr pipe; it runs detached with a 30-second hard timeout.

🛠️ Release Pipeline Hardening

This version also repairs the publish pipeline itself: npm is pinned off a broken [email protected] (which crashed provenance publishing), and the release process now keeps the omo-senpi package version in lockstep with the root on every bump.

Plus the accumulated fixes since 4.16.0 — Bun runtime regression (#3824), planner correctness (#5481), pinned-version mismatch warnings (#4734), and more (see below).

Minor Compatibility and Stability Release

This release carries compatibility-facing behavior changes and operational hardening. Read the summary below before upgrading or publishing.

  • Rename transition updates across package detection, plugin/config compatibility, and install surfaces.
  • Install and publish workflow hardening, including safer release sequencing and package/install fixes.

Commit Summary

  • 9036899c0 fix(codex): show version in hook statuses
  • c754caba8 fix(codex): limit git bash hooks to windows
  • a4e29f509 Merge pull request #5993 from code-yeongyu/ci/pin-npm-sigstore
  • 828999711 ci(publish): pin npm to 11.18.0 to fix provenance sigstore crash
  • 06c8a710d Merge pull request #5990 from code-yeongyu/release/v4.16.1-source-state
  • f4b0dad7f Merge pull request #5989 from code-yeongyu/fix/ulw-loop-memory-fork-bomb
  • 0cbb0a533 fix(codex): guard ulw-loop delegation against fork bomb recursion
  • f7ea72962 fix(codex): compact ulw-loop steering ledger to end quadratic growth
  • 7421e1bcf Merge pull request #5980 from code-yeongyu/code-yeongyu/fix-3824-bun-runtime-regression
  • 997d802fe test(omo-opencode): audit raw bun module imports
  • 216301f1e Merge pull request #5979 from code-yeongyu/feature/xterm-tui-qa-harness
  • e3082fde2 fix(opencode): route Bun runtime calls through shims
  • 0806e4161 docs(qa): route TUI visual evidence to the xterm.js web terminal, forbid tmux
  • 406ccdf5b feat(qa): render TUI evidence through real xterm.js + node-pty, not tmux
  • 8fe6674ef Merge pull request #5974 from code-yeongyu/code-yeongyu/frontend-skill-research-contract
  • 0526d7cea fix(shared-skills): scope the non-negotiable line to the design-system gate and tighten contract pins
  • 6aa29c713 fix(shared-skills): align stale 7-section pointers and unify the designpowers load condition
  • 8ec538b41 feat(shared-skills): promote the primitive-showcase gate and wire ui-ux-db sanity checks
  • 59748e645 feat(shared-skills): fold designpowers lane-c and a11y/debt schema into the default frontend flow
  • f21aff74f feat(shared-skills): make frontend greenfield research a logged deliverable contract
  • fa8e5bf0c Merge pull request #5965 from MoerAI/fix/lazycodex-ulw-planner-result
  • f39cc5bf7 Merge pull request #5930 from MoerAI/fix/pretooluse-bash-command-cwd
  • baf722bc1 Merge pull request #5783 from MoerAI/fix/version-check-warn-pinned-mismatch
  • 25ba30637 Merge pull request #5755 from MoerAI/fix/ulw-loop-require-session-id-value
  • 8082b5114 Merge pull request #5570 from MoerAI/fix/start-work-atlas-label
  • 66e826d7e Merge pull request #5357 from BenjaminHalko/fix/model-fallback
  • c4dfcdee4 docs(omo-json): add a $schema-bearing example so the freshness gate validates it
  • 95370921d fix(codex): mirror planner barrier into ulw-loop (fixes #5481)
  • 8ad8a4f39 fix(codex): keep planner liveness guidance (fixes #5481)
  • bd99a5e38 fix(codex): preserve parallel planner waves (fixes #5481)
  • a70e667f0 fix(codex): prevent planning from outrunning spawned agents
  • 2fbc4b098 feat(omo-config-core): generated omo.schema.json artifact with freshness gate
  • 05288db93 Preserve Bash hook validation in the active worktree
  • d857891ed Merge remote-tracking branch 'upstream/dev' into fix/model-fallback
  • 5684dc837 fix(runtime-fallback): clear internallyAbortedSessions on session teardown
  • ff5ee4625 Merge remote-tracking branch 'origin/dev' into fix/start-work-atlas-label
  • 4bdb2a7b5 fix(cli): warn when a pinned plugin version differs from the running version (fixes #4734)
  • f2ed3b10e fix(ulw-loop): require a value for explicit --session-id (fixes #5752)
  • 4e1a4d7b2 Merge remote-tracking branch 'origin/dev' into fix/start-work-atlas-label
  • e7f500210 fix(start-work): name Atlas (not Sisyphus) in /start-work template and labels (fixes #5499)
  • 4e788f6e2 fix(runtime-fallback): stop subagent stall on provider auto-retry signal

Thank you to 2 community contributors:

  • @BenjaminHalko:
    • fix(runtime-fallback): stop subagent stall on provider auto-retry signal
    • fix(runtime-fallback): clear internallyAbortedSessions on session teardown
    • Merge remote-tracking branch 'upstream/dev' into fix/model-fallback
  • @MoerAI:
    • fix(start-work): name Atlas (not Sisyphus) in /start-work template and labels (fixes #5499)
    • Merge remote-tracking branch 'origin/dev' into fix/start-work-atlas-label
    • fix(ulw-loop): require a value for explicit --session-id (fixes #5752)
    • fix(cli): warn when a pinned plugin version differs from the running version (fixes #4734)
    • Merge remote-tracking branch 'origin/dev' into fix/start-work-atlas-label
    • Preserve Bash hook validation in the active worktree
    • fix(codex): prevent planning from outrunning spawned agents
    • fix(codex): preserve parallel planner waves (fixes #5481)
    • fix(codex): keep planner liveness guidance (fixes #5481)
    • fix(codex): mirror planner barrier into ulw-loop (fixes #5481)
    • Merge pull request #5357 from BenjaminHalko/fix/model-fallback
    • Merge pull request #5570 from MoerAI/fix/start-work-atlas-label
    • Merge pull request #5755 from MoerAI/fix/ulw-loop-require-session-id-value
    • Merge pull request #5783 from MoerAI/fix/version-check-warn-pinned-mismatch
    • Merge pull request #5930 from MoerAI/fix/pretooluse-bash-command-cwd
    • Merge pull request #5965 from MoerAI/fix/lazycodex-ulw-planner-result
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track oh-my-openagent

Get notified when new releases ship.

Sign up free

About oh-my-openagent

omo; the best agent harness - previously oh-my-opencode

All releases →

Related context

Earlier breaking changes

  • v4.19.0 Removes legacy Ralph Loop wiring; introduces Goal feature with automatic config migration.
  • v4.6.0 Removed broken direct public binary entrypoints from platform launcher packages, keeping them internal.
  • v4.6.0 Removed legacy context-window monitor hook path from active hooks and config surfaces.
  • v4.4.0 Removes top‑level `lsp` config key; migration required to `.opencode/lsp.json`.

Beta — feedback welcome: [email protected]