Skip to content

oh-my-openagent

v4.7.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1d AI Coding Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agents anthropic chatgpt claude claude-skills
+9 more
codex cursor gemini ide openai opencode orchestration tui typescript

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Broad release touches Commit Summary, omo-codex, postinstall, and ralph-loop.

Changes in this release

Feature Medium

New Codex installs default to autonomous permissions.

New Codex installs default to autonomous permissions.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Feature Medium

Adds `lcx-report-bug` skill for structured issue reports.

Adds `lcx-report-bug` skill for structured issue reports.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Feature Medium

LazyCodex now checks for updates from the Codex startup hook.

LazyCodex now checks for updates from the Codex startup hook.

Source: llm_adapter@2026-06-02

Confidence: low

 —
Feature Low

LazyCodex now checks for updates from the Codex startup hook, with throttling, lock protection, recursion guards, and manual disable via env vars.

LazyCodex now checks for updates from the Codex startup hook, with throttling, lock protection, recursion guards, and manual disable via env vars.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Feature Low

`omo ulw-loop` is now routed through the root CLI, with fallback to cached component, removing dependency on internal install paths.

`omo ulw-loop` is now routed through the root CLI, with fallback to cached component, removing dependency on internal install paths.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Feature Low

LazyCodex ships a model catalog and provides managed config migration for fresh installs while preserving existing user‑customized reasoning values.

LazyCodex ships a model catalog and provides managed config migration for fresh installs while preserving existing user‑customized reasoning values.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Dependency Low

Removes direct `effect` dependency.

Removes direct `effect` dependency.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Bugfix Medium

Warns when platform binary version mismatches the main package.

Warns when platform binary version mismatches the main package.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Bugfix Medium

Deduplicates discovered skills before prompt rendering.

Deduplicates discovered skills before prompt rendering.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Bugfix Medium

Injects server authentication on fresh `oh-my-opencode run` starts.

Injects server authentication on fresh `oh-my-opencode run` starts.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Bugfix Medium

Escapes quotes in tmux placeholder commands.

Escapes quotes in tmux placeholder commands.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Bugfix Medium

Blocks synthetic background reminders from GPT‑5.5.

Blocks synthetic background reminders from GPT‑5.5.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Bugfix Medium

Normalizes tmux sub‑agent status maps.

Normalizes tmux sub‑agent status maps.

Source: llm_adapter@2026-06-02

Confidence: high

 —
Bugfix Low

Cleans stale `codex-lsp` shims during upgrades to avoid lingering artifacts.

Cleans stale `codex-lsp` shims during upgrades to avoid lingering artifacts.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Fixes model fallback routing issues for reliable model selection.

Fixes model fallback routing issues for reliable model selection.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Tightens telemetry environment parsing, making `OMO_DISABLE_POSTHOG` case‑insensitive and trim‑tolerant.

Tightens telemetry environment parsing, making `OMO_DISABLE_POSTHOG` case‑insensitive and trim‑tolerant.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Exposes inline team specification schema for team mode configurations.

Exposes inline team specification schema for team mode configurations.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Resolves Windows executable shims for `ast-grep-mcp` to ensure proper execution on Windows.

Resolves Windows executable shims for `ast-grep-mcp` to ensure proper execution on Windows.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Rejects non‑file shim candidates in `ast-grep-mcp` validation, improving robustness.

Rejects non‑file shim candidates in `ast-grep-mcp` validation, improving robustness.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Keeps Context7 MCP plugin‑scoped, maintaining correct plugin boundaries.

Keeps Context7 MCP plugin‑scoped, maintaining correct plugin boundaries.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Avoids duplicate keyword mode injection during prompt rendering.

Avoids duplicate keyword mode injection during prompt rendering.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Updates Windows LSP wrapper resolution for accurate path handling.

Updates Windows LSP wrapper resolution for accurate path handling.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Preserves inferred WSL username casing during installer operations.

Preserves inferred WSL username casing during installer operations.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Avoids fallback to WSL homedir when not needed, respecting user configuration.

Avoids fallback to WSL homedir when not needed, respecting user configuration.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Keeps existing WSL config on Linux home directories during upgrades.

Keeps existing WSL config on Linux home directories during upgrades.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Groups background agent fallback retries by provider concurrency limits, respecting configured caps.

Groups background agent fallback retries by provider concurrency limits, respecting configured caps.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Marks synthetic 'continue' fallback as internal to prevent unintended exposure.

Marks synthetic 'continue' fallback as internal to prevent unintended exposure.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Rejects spoofed verification text in Ralph loop processing for security.

Rejects spoofed verification text in Ralph loop processing for security.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Recovers oracle tool‑result verification in Ralph loop, ensuring correct outcomes.

Recovers oracle tool‑result verification in Ralph loop, ensuring correct outcomes.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Logs completion toast failures in Ralph loop for better observability.

Logs completion toast failures in Ralph loop for better observability.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Bugfix Low

Waits for pending background tasks before proceeding in Ralph loop execution.

Waits for pending background tasks before proceeding in Ralph loop execution.

Source: granite4.1:30b@2026-06-02-audit

Confidence: low

 —
Full changelog

LazyCodex Can Keep Itself Fresh

LazyCodex now checks for updates from the Codex startup hook. The check is throttled, lock-protected, and runs with recursion guards so ordinary sessions do not repeatedly invoke the installer. Users who prefer manual control can disable it with LAZYCODEX_AUTO_UPDATE_DISABLED=1 or OMO_CODEX_AUTO_UPDATE_DISABLED=1.

Autonomous Codex by Default

New Codex installs now default to autonomous permissions, including non-TUI installs. The explicit escape hatch remains: pass --no-codex-autonomous to leave existing Codex permission settings untouched.

ULW Loop from the Expected Command Path

omo ulw-loop is now wired through the root CLI, and LazyCodex passes ulw-loop through to OMO. The router finds the Codex-local binary first and falls back to the newest cached component, so durable goal execution no longer depends on knowing internal install paths.

Better Codex Defaults and Migration

LazyCodex now ships a model catalog and managed config migration path for Codex. Fresh installs get deterministic default model and reasoning settings, while existing user-customized reasoning values stay intact.

Built-In LazyCodex Bug Reports

The new lcx-report-bug skill gives LazyCodex users a packaged way to produce structured issue reports with the right context. The publish workflow also has a default LazyCodex marketplace sync path when the required GitHub secret is available, keeping npm and the Codex plugin bundle ready to move together.

Smoother Upgrades

This release also cleans stale managed codex-lsp shims during upgrades, warns when a platform binary version does not match the main package, injects auth for fresh oh-my-opencode run servers, deduplicates discovered skills before prompt rendering, fixes model fallback routing, and tightens runtime edge cases around telemetry env parsing, team inline specs, tmux placeholder quoting, background task cleanup, hook timeouts, and Look At answer extraction.

Minor Compatibility and Stability Release

This release carries compatibility-facing behavior changes and operational hardening. Read the summary below before upgrading or publishing.

  • Rename transition updates across package detection, plugin/config compatibility, and install surfaces.
  • Task and tool behavior updates, including delegate-task contract and runtime registration behavior.
  • Task-system default behavior alignment so omitted configuration behaves consistently across runtime paths.
  • Install and publish workflow hardening, including safer release sequencing and package/install fixes.

Commit Summary

  • 2a5ce623f Merge remote-tracking branch 'origin/dev' into dev
  • 21760a974 feat(omo-codex): add lcx report bug skill
  • 180f1adfa fix(omo-codex): migrate managed codex model config
  • 8bab866b9 fix(omo-codex): read codex defaults from model catalog
  • 68ce5ec79 Merge pull request #4693 from code-yeongyu/code-yeongyu/codex-installer-model-defaults
  • f6704aeb5 fix(codex): set installer model defaults
  • 723a25c54 test(omo-codex): harden aggregate compatibility assertions
  • c30adf4bb Merge remote-tracking branch 'origin/dev' into dev
  • e5745de4a fix(omo-codex): configure codex default model
  • f75cb6388 fix(omo-codex): harden lazycodex workflow compatibility
  • 36f095cb7 Merge pull request #4690 from code-yeongyu/code-yeongyu/bug-3757-deprecated-opencode-models
  • e15acfdf1 Merge pull request #4688 from code-yeongyu/code-yeongyu/bug-3648-look-at-thinking
  • cb20b8ea4 fix(model-fallback): avoid retired opencode model routes
  • d2ee8d0f9 Merge pull request #4264 from YOMXXX/fix/todowrite-disabler-allow-write
  • 41301346d ci(lazycodex): sync marketplace by default
  • b0b71ac7a fix(omo-codex): harden lazycodex orchestration prompts
  • 793ba1909 fix(look-at): extract thinking model answers
  • 11f070b13 Merge pull request #4335 from YOMXXX/fix/transcript-cache-no-grow-postooluse
  • effe5d65e Merge pull request #4687 from code-yeongyu/code-yeongyu/bug-3562-anthropic-hyphen
  • 665396620 fix(model-core): preserve anthropic hyphen IDs
  • 2814bb1f5 Merge pull request #4686 from code-yeongyu/code-yeongyu/bug-3362-ralph-pending-bg
  • 5ba3cf1b3 Merge pull request #4685 from code-yeongyu/code-yeongyu/bug-3315-comment-checker-path
  • 338010ba3 fix(ralph-loop): wait for pending background tasks
  • b25bac939 fix(comment-checker): resolve path-only binary
  • 76f0e6c27 Merge pull request #4684 from code-yeongyu/code-yeongyu/bug-3250-skill-description
  • 18ba56ae8 fix(skill): avoid duplicate skill listings
  • 9dddab202 Merge pull request #4683 from code-yeongyu/code-yeongyu/bug-3212-oracle-tool-result
  • adedbb41f fix(ralph-loop): log completion toast failures
  • 44ce4883b fix(ralph-loop): reject spoofed verification text
  • 4c7aa0851 fix(ralph-loop): recover oracle tool-result verification
  • 2ea3835d7 Merge pull request #4682 from code-yeongyu/code-yeongyu/fix-2926-start-work-explicit-miss
  • 7cac1e728 fix: auto-select single plan after start-work name miss
  • cec3f255a Merge pull request #4415 from PeterPonyu/fix/tmux-status-map-normalization
  • 594b4462b Merge pull request #4354 from Yeachan-Heo/fix/issue-3787-skills-paths-discovery
  • b8c9213c0 Merge branch 'dev' into fix/tmux-status-map-normalization
  • 192831836 Merge pull request #4355 from Yeachan-Heo/fix/issue-3772-epipe-log-bloat
  • 0faff4f93 Merge branch 'dev' into fix/issue-3787-skills-paths-discovery
  • d57ac14b0 Merge pull request #4678 from code-yeongyu/code-yeongyu/bug-3975-wsl-config
  • 95089438e Merge pull request #4681 from code-yeongyu/code-yeongyu/bug-3945-k2p6-thinking
  • 8ffb9214a Merge branch 'dev' into fix/issue-3772-epipe-log-bloat
  • 24707cb81 Merge branch 'dev' into fix/issue-3787-skills-paths-discovery
  • 579c5fcf7 Merge pull request #4680 from code-yeongyu/code-yeongyu/bug-3968-provider-concurrency
  • 255fb4593 fix(model-core): also exclude k2-p6/k2.p6 separated forms, fix comment formatting
  • a2974272c fix(installer): preserve inferred WSL username casing
  • ba6a7b92b fix(background-agent): group fallback retries by provider concurrency
  • 58e5a1e10 Honor provider-level background concurrency limits
  • 66df6f819 fix(installer): avoid WSL homedir fallback
  • a8c2b9f87 fix(installer): keep WSL config on Linux home
  • 35e793d56 Merge pull request #4677 from code-yeongyu/code-yeongyu/fix-4085-internal-continue
  • 5cd23dee6 fix(runtime-fallback): mark synthetic 'continue' fallback as internal (#4085)
  • 6135753e7 Merge pull request #4296 from SpencerJung/fix/issue-4105-command-hang-timeout
  • 7a65af28f Merge pull request #4676 from code-yeongyu/fix/issue-4144-background-reminder-contract
  • de87e45cf Merge pull request #4675 from code-yeongyu/fix/4670-cli-agent-id
  • 7ddef679c Merge remote-tracking branch 'origin/dev' into fix/issue-4144-background-reminder-contract
  • d4eb6f50b Merge remote-tracking branch 'origin/dev' into fix/4670-cli-agent-id
  • a3b43f7fa fix(cli): dispatch run agents by id
  • 5393547f9 Merge pull request #4294 from SpencerJung/fix/issue-4130-connect-agent-registry
  • 6427f75e5 Merge pull request #4673 from code-yeongyu/code-yeongyu/fix-ast-grep-4188-validation
  • f9ac67187 fix(ast-grep-mcp): reject non-file shim candidates
  • a7475e8f0 fix(ast-grep-mcp): resolve Windows executable shims
  • 35281e36a Merge pull request #4273 from YOMXXX/fix/doctor-reasoning-effort-max
  • 31c46b531 Merge pull request #4667 from code-yeongyu/fix/4598-tui-plugin-export-detection
  • bc1b5cc69 Merge pull request #4668 from code-yeongyu/fix/4262-lsp-windows-pathext
  • 9fdfeec01 Merge pull request #4669 from code-yeongyu/fix/4251-keyword-idempotent
  • a298c0d30 Merge pull request #4671 from code-yeongyu/code-yeongyu/context7-default-mcp
  • 12fa52394 fix(codex): keep Context7 MCP plugin-scoped
  • 068e40ce0 fix: avoid duplicate keyword mode injection
  • f29364b40 fix(lsp): update Windows wrapper resolution
  • 0286a68ea Merge pull request #4485 from MoerAI/fix/posthog-env-permissive-parsing
  • 8fe5af71c fix(doctor): allow file tui registrations
  • 41714ea55 Merge pull request #4577 from Hungdoan565/fix/inject-auth-on-fresh-server-start-4572
  • 4d5373de2 Merge pull request #4666 from code-yeongyu/fix/team-create-inline-schema-4656
  • 6764d991e fix(doctor): gate tui advice on package export
  • 6a05e09e1 fix(team-mode): expose inline team spec schema
  • 0c67eab02 Merge pull request #4665 from code-yeongyu/feature/lazycodex-full-access-installer
  • 98990d934 LazyCodex: delegate autonomous installs by default
  • e3612e8a3 Codex: propagate autonomous installer default
  • d593e46b2 Codex: skip autonomous permissions prompt
  • ead80ebd5 Codex: default installs to autonomous permissions
  • bf863b596 Merge pull request #4663 from code-yeongyu/code-yeongyu/remove-effect-dependency
  • fe28e0f76 fix(lazycodex): wire startup auto update
  • 5760892a9 Merge pull request #4537 from MoerAI/fix/platform-binary-version-mismatch-warning
  • 1fb5e3569 Merge pull request #4574 from MoerAI/fix/skills-deduplicate-discovered-array
  • 847b7f9cc Merge pull request #4575 from Hungdoan565/fix/available-skills-dedup-4573
  • 48eaefdd6 Merge pull request #4639 from dihak/fix/tmux-placeholder-shell-quoting
  • 48efdfe76 refactor(deps): remove direct effect dependency
  • 61fd97ef4 fix(install): honor non-tui provider setup
  • be422db31 fix(postinstall): remove em dash from version-mismatch.js JSDoc per AGENTS.md
  • d2bc0d1c7 fix(postinstall): compare full semver including prerelease suffix
  • c8befcd38 fix(postinstall): warn when platform binary version differs from main package (fixes #3918)
  • b74758a17 fix(tmux): escape quotes in placeholder command
  • d74a0b35e fix(cli/run): inject server auth into client on fresh server start
  • e67df0a29 fix(agents): deduplicate availableSkills to prevent double rendering in prompts
  • d6351473b fix(agents): deduplicate discovered skills before agent prompt render (fixes #4573)
  • b3c593f31 fix(posthog): make OMO_DISABLE_POSTHOG env parsing case-insensitive and trim-tolerant (fixes #4368)
  • 5ba1278e7 Normalize tmux subagent status maps
  • d4b53d11e fix(background-agent): narrow EPIPE/ECONNRESET filter to stdio-or-shutdown
  • b9f5c6238 fix(skills): host opencode.jsonc wins over plugin config; drop unmaterialized urls
  • 70c7791c4 fix(background-agent): swallow EPIPE/ECONNRESET in shutdown error listeners (#3772)
  • 5f1a8bd38 fix(skills): respect host opencode.jsonc skills.paths in plugin discovery (#3787)
  • c7ae1b3e5 fix(transcript): keep cached baseEntries pinned to last session fetch (#3647)
  • 1c16bb65b docs: list reasoningEffort xhigh and max in features.md / configuration.md (#4165)
  • 02096c0ab fix(command-executor): settle timed-out hook commands
  • 66fefc3b9 fix(agent-config): refresh agent registry on config apply
  • e78e87244 fix(session-state): reset registered agent aliases
  • 2feef132d fix(gpt-5.5): block synthetic background reminders
  • 2a3933f81 test(doctor,schema): lock reasoningEffort 'max' acceptance against #4165 regression
  • 3b4c93b88 fix(tasks-todowrite-disabler): stop blocking TodoWrite to keep todo panel live (#3764)

Thank you to 9 community contributors:

  • @YOMXXX:
    • fix(tasks-todowrite-disabler): stop blocking TodoWrite to keep todo panel live (#3764)
    • test(doctor,schema): lock reasoningEffort 'max' acceptance against #4165 regression
    • docs: list reasoningEffort xhigh and max in features.md / configuration.md (#4165)
    • fix(transcript): keep cached baseEntries pinned to last session fetch (#3647)
    • fix(runtime-fallback): mark synthetic 'continue' fallback as internal (#4085)
  • @SpencerJung:
    • fix(gpt-5.5): block synthetic background reminders
    • fix(session-state): reset registered agent aliases
    • fix(agent-config): refresh agent registry on config apply
    • fix(command-executor): settle timed-out hook commands
    • fix(ast-grep-mcp): resolve Windows executable shims
  • @Yeachan-Heo:
    • fix(skills): host opencode.jsonc wins over plugin config; drop unmaterialized urls
    • fix(background-agent): narrow EPIPE/ECONNRESET filter to stdio-or-shutdown
  • @PeterPonyu:
    • Normalize tmux subagent status maps
    • Honor provider-level background concurrency limits
  • @MoerAI:
    • fix(posthog): make OMO_DISABLE_POSTHOG env parsing case-insensitive and trim-tolerant (fixes #4368)
    • fix(agents): deduplicate discovered skills before agent prompt render (fixes #4573)
    • fix(postinstall): warn when platform binary version differs from main package (fixes #3918)
    • fix(postinstall): compare full semver including prerelease suffix
    • fix(postinstall): remove em dash from version-mismatch.js JSDoc per AGENTS.md
    • Merge pull request #4639 from dihak/fix/tmux-placeholder-shell-quoting
    • Merge pull request #4575 from Hungdoan565/fix/available-skills-dedup-4573
    • Merge pull request #4574 from MoerAI/fix/skills-deduplicate-discovered-array
    • Merge pull request #4537 from MoerAI/fix/platform-binary-version-mismatch-warning
  • @Hungdoan565:
    • fix(agents): deduplicate availableSkills to prevent double rendering in prompts
    • fix(cli/run): inject server auth into client on fresh server start
  • @dihak:
    • fix(tmux): escape quotes in placeholder command
  • @wolfkill:
    • fix: avoid duplicate keyword mode injection
  • @Ruifeng-Zhang:
    • fix(model-core): also exclude k2-p6/k2.p6 separated forms, fix comment formatting

Breaking Changes

  • LazyCodex now defaults to autonomous permissions; existing installs keep current settings unless `--no-codex-autonomous` is passed.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track oh-my-openagent

Get notified when new releases ship.

Sign up free

About oh-my-openagent

omo; the best agent harness - previously oh-my-opencode

All releases →

Related context

Earlier breaking changes

  • v4.6.0 Removed broken direct public binary entrypoints from platform launcher packages, keeping them internal.
  • v4.6.0 Removed legacy context-window monitor hook path from active hooks and config surfaces.
  • v4.4.0 Removes top‑level `lsp` config key; migration required to `.opencode/lsp.json`.

Beta — feedback welcome: [email protected]