oh-my-openagent

v4.17.1 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 14d AI Coding Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agents anthropic chatgpt claude claude-skills

+9 more

codex cursor gemini ide openai opencode orchestration tui typescript

Affected surfaces

breaking_upgrade auth

ReleasePort's take

Moderate signal

editorial:auto 13d

Publication provenance is now pinned to the exact source commit across npm packages, binaries, and LazyCodex, enhancing traceability.

Why it matters: Provides cryptographic assurance of artifact origin; critical for supply‑chain security when provenance verification is enabled.

Summary

AI summary

Broad release touches Commit Summary, skills, omo-codex, and agents.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Publication provenance now pinned to exact source commit across npm, binaries, and LazyCodex. Publication provenance now pinned to exact source commit across npm, binaries, and LazyCodex. Source: llm_adapter@2026-07-13 Confidence: high	—
Feature	Low	team-core adds lead unread recipient, leadSessionId, consumed‑ledger, and consumer lease capabilities. team-core adds lead unread recipient, leadSessionId, consumed‑ledger, and consumer lease capabilities. Source: llm_adapter@2026-07-13 Confidence: high	—
Dependency	Low	ultimate‑browsing runtime dependency pins bumped to latest version. ultimate‑browsing runtime dependency pins bumped to latest version. Source: llm_adapter@2026-07-13 Confidence: high	—
Bugfix
Bugfix	Medium	/publish endpoint now ships only, stopping auto‑triggered pre‑publish review. /publish endpoint now ships only, stopping auto‑triggered pre‑publish review. Source: llm_adapter@2026-07-13 Confidence: high	—
Bugfix	Medium	Release build process now constructs from the prepared installer version. Release build process now constructs from the prepared installer version. Source: llm_adapter@2026-07-13 Confidence: high	—
Bugfix	Medium	bun:test timeout increased for load‑sensitive async tests in ulw-loop. bun:test timeout increased for load‑sensitive async tests in ulw-loop. Source: llm_adapter@2026-07-13 Confidence: high	—
Bugfix	Medium	ulw-loop routing now uses uncertainty‑based planning instead of step count. ulw-loop routing now uses uncertainty‑based planning instead of step count. Source: llm_adapter@2026-07-13 Confidence: low	—
Bugfix	Low	ultrawork routing now sizes planning by design uncertainty, not step count. ultrawork routing now sizes planning by design uncertainty, not step count. Source: granite4.1:30b@2026-07-14-audit Confidence: low	—
Bugfix	Low	omo-codex plan agent and Hephaestus routing aligned with uncertainty‑based planning. omo-codex plan agent and Hephaestus routing aligned with uncertainty‑based planning. Source: granite4.1:30b@2026-07-14-audit Confidence: low	—
Bugfix	Low	ultrawork GPT variant mirrors uncertainty‑based plan trigger. ultrawork GPT variant mirrors uncertainty‑based plan trigger. Source: granite4.1:30b@2026-07-14-audit Confidence: low	—
Bugfix	Low	teammode transport chain adds tool_search check and subagent fallback. teammode transport chain adds tool_search check and subagent fallback. Source: granite4.1:30b@2026-07-14-audit Confidence: low	—
Refactor	Low	LSP daemon reuses record predicate implementation. LSP daemon reuses record predicate implementation. Source: granite4.1:30b@2026-07-14-audit Confidence: low	—

Full changelog

Safer Durable Task Recovery

Interrupted process-backed tasks now resume only from trusted current runtime state. Team members retain their scoped messaging runtime after recovery, corrupt team state fails closed, and independent team waits cannot consume one another’s messages.

Bounded, Observable Task Fan-Out

Batch task launches are capped before work is queued. A failed child start is reported per item instead of hiding already-started work, and the Senpi QA gate now requires real child completion and output.

Release and Routing Integrity

Publication is now pinned to the exact prepared source commit across npm, platform binaries, and LazyCodex, so provenance and payloads agree. Explicit GPT-5.6 Sol overrides also retain their intended reasoning level across gateway model IDs.

Minor Compatibility and Stability Release

This release carries compatibility-facing behavior changes and operational hardening. Read the summary below before upgrading or publishing.

Rename transition updates across package detection, plugin/config compatibility, and install surfaces.
Install and publish workflow hardening, including safer release sequencing and package/install fixes.

Commit Summary

ed0241d1a Merge pull request #6080 from code-yeongyu/release/v4.17.1-source-state
616d30bdd Merge pull request #6079 from code-yeongyu/fix/publish-skill-fastpath
930664124 Merge remote-tracking branch 'origin/dev' into fix/publish-skill-fastpath
e52cd8f47 test(ci): cover provenance dispatch summary
298b743f3 fix(publish): make /publish ship-only, stop auto-triggering pre-publish review
017d70c46 fix(release): pin publication provenance to source
c1a741dd9 fix(codex): align model and team spawn contracts
23312138c Merge pull request #6068 from code-yeongyu/code-yeongyu/cleanup-codex-toml-parser
848ffce93 Merge origin/dev into code-yeongyu/cleanup-codex-toml-parser
82864f8e0 Merge pull request #6070 from code-yeongyu/fix/visual-qa-tag-emission
12e2637e8 Merge origin/dev into code-yeongyu/cleanup-codex-toml-parser
e47aa9b87 fix(skills): emit [product]/[evidence] tag reviewers and unify backoff dashes
c660246be Merge pull request #6069 from code-yeongyu/fix/qa-loop-contradictions
af27b971a fix(skills): resolve QA-loop contradictions and evidence-vs-product churn
5cfa6066c Merge remote-tracking branch 'origin/dev' into code-yeongyu/cleanup-codex-toml-parser
734b1b420 refactor(omo-codex): reuse TOML string parser
6e4c82627 Merge pull request #6065 from code-yeongyu/code-yeongyu/cleanup-shared-skill-helpers
955214b12 Merge remote-tracking branch 'origin/dev' into code-yeongyu/cleanup-shared-skill-helpers
e1e09aef6 feat(team-core): lead unread recipient + leadSessionId + consumed-ledger + consumer lease
58000e267 Merge pull request #6064 from code-yeongyu/fix/ulw-loop-test-timeouts
4ccba96df fix: increase bun:test timeout for load-sensitive async tests in ulw-loop
5071a7c82 Merge pull request #6063 from code-yeongyu/fix/release-4-17-1-blockers
20887c5d4 Merge pull request #6057 from code-yeongyu/code-yeongyu/cleanup-root-contract-tests
fbb56162b docs(skills): align review and Hephaestus guidance
d66fe09e2 fix(release): build from prepared installer version
7c55a25f4 fix(skills): preserve full evidenced planning scope
8bbabd65f fix(ulw-loop): route planning by uncertainty
e38bc3fa1 fix(teammode): gate fallback on visible capabilities
b5040f937 Merge remote-tracking branch 'origin/dev' into code-yeongyu/cleanup-shared-skill-helpers
d8a71f0a0 refactor(skills): reuse path resolver
99f124606 refactor(skills-loader): reuse initiator marker
e564bd4ec refactor(utils): own skill path resolution
efc99280a Merge origin/dev into code-yeongyu/cleanup-root-contract-tests
f7eb7dd2d Merge pull request #6060 from code-yeongyu/fix/plan-prompts-scope-narrowing
19aabe5e1 fix(skills): make full-request scope the ulw-plan default
d0e2e0863 fix(agents): remove scope-narrowing MVP language from metis prompts
412405b0f Merge origin/dev into code-yeongyu/cleanup-root-contract-tests
0f69b09da Merge pull request #6059 from code-yeongyu/code-yeongyu/cleanup-lsp-record-predicate
7a9a0d005 Merge remote-tracking branch 'origin/dev' into code-yeongyu/cleanup-lsp-record-predicate
11363611b Merge remote-tracking branch 'origin/dev' into code-yeongyu/cleanup-root-contract-tests
8ca9a8804 Merge pull request #6058 from code-yeongyu/fix/hephaestus-review-gate-overtrigger
d5fa06820 fix(codex-rules): scope review-work gate to PR handoffs instead of fuzzy 'significant work'
76e7e762a Merge pull request #6056 from code-yeongyu/fix/hephaestus-sol-high-default
14c892c11 Merge remote-tracking branch 'origin/dev' into code-yeongyu/cleanup-lsp-record-predicate
7f648cace refactor(lsp-daemon): reuse record predicate
a67f3d190 test(root): remove source-shape sentinels
2c4c7f05b test(agents): preserve hephaestus override coverage
dc253ff13 fix(model-core): raise hephaestus sol default
d269b23ed Merge pull request #6052 from code-yeongyu/fix/teammode-transport-fallback
e1014230f Merge pull request #6055 from code-yeongyu/chore/ultimate-browsing-dep-bump
655f0f753 chore(ultimate-browsing): bump documented runtime dependency pins to latest
f261104b3 Merge pull request #6054 from code-yeongyu/fix/ultrawork-plan-routing
1f58a541b fix(omo-codex): align plan agent and hephaestus routing with uncertainty-based planning
22d66b0c8 fix(ultrawork): mirror uncertainty-based plan trigger in gpt variant
691e76a81 fix(ultrawork): size planning by design uncertainty, not step count
316e635db docs(omo-codex): sync teammode component AGENTS.md with transport fallback protocol
d49f5f8c5 fix(omo-codex): teammode transport chain with tool_search check and subagent fallback

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track oh-my-openagent

Get notified when new releases ship.

About oh-my-openagent

omo; the best agent harness - previously oh-my-opencode

All releases →

Related context

Related tools

Earlier breaking changes

v4.19.0 Removes legacy Ralph Loop wiring; introduces Goal feature with automatic config migration.
v4.6.0 Removed broken direct public binary entrypoints from platform launcher packages, keeping them internal.
v4.6.0 Removed legacy context-window monitor hook path from active hooks and config surfaces.
v4.4.0 Removes top‑level `lsp` config key; migration required to `.opencode/lsp.json`.