This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
ReleasePort's take
Light signalv0.18.1 ships safer plugin hooks with pinned launchers and closed failure on malformed pins, plus fixes for Windows native shell UTF-8 forwarding and runtime resource leaks.
Why it matters: Plugin installations more resilient to misconfiguration. Windows SparkShell and tmux/HUD integrations stabilized. Test in dev if using Windows automation or plugin-heavy workflows; otherwise safe to deploy.
Summary
AI summaryUpdates Verification, Also included since v0.18.0, and Highlights across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Plugin hook failures are safer with closed failure on malformed pins Plugin hook failures are safer with closed failure on malformed pins Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Plugin installs now use a pinned OMX launcher Plugin installs now use a pinned OMX launcher Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Release metadata is synchronized across npm, Cargo, and plugin manifest Release metadata is synchronized across npm, Cargo, and plugin manifest Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Autopilot now defaults to Ultragoal and keeps quality gates returning to ralplan Autopilot now defaults to Ultragoal and keeps quality gates returning to ralplan Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Lore co-author enforcement defaults to opt-in Lore co-author enforcement defaults to opt-in Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Ultragoal state mutations are serialized behind a mutation lock Ultragoal state mutations are serialized behind a mutation lock Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Performance | Medium |
Ralph, performance-goal, autoresearch, and stale runtime stop-loop handling were tightened Ralph, performance-goal, autoresearch, and stale runtime stop-loop handling were tightened Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Release packaging excludes crate-local .omx runtime caches Release packaging excludes crate-local .omx runtime caches Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
SparkShell diagnostics gained team-aware pane observation and more stable output SparkShell diagnostics gained team-aware pane observation and more stable output Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Windows native hook UTF-8 forwarding and Windows SparkShell native shell mode were fixed Windows native hook UTF-8 forwarding and Windows SparkShell native shell mode were fixed Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Notification, HUD/tmux, sidecar, and resource-leak cleanup fixes landed across the runtime Notification, HUD/tmux, sidecar, and resource-leak cleanup fixes landed across the runtime Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Plugin-scoped hook setup and verifier behavior were stabilized Plugin-scoped hook setup and verifier behavior were stabilized Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
Full changelog
oh-my-codex v0.18.1
0.18.1 is a release-readiness patch for the 0.18.x train. It keeps the 0.18 API/SparkShell/runtime work intact while fixing the blockers found during the final dev-to-main release review.
Highlights
- Plugin installs now use a pinned OMX launcher — materialized plugin caches include
hooks/omx-command.json, so native plugin hooks invoke the installed package CLI instead of whateveromxhappens to be onPATH. - Plugin hook failures are safer — malformed launcher pins fail closed; ambient
omxis only used for compatibility when no pin file exists. - Ultragoal state mutations are serialized — goal creation, steering, checkpointing, and review-blocker writes now run behind a mutation lock, with atomic plan writes to reduce race/corruption risk.
- Release packaging is cleaner — npm package contents now exclude crate-local
.omxruntime caches, and the release smoke path verifies the packed install surface. - Release metadata is synchronized — npm, Cargo workspace, lockfiles, and the bundled plugin manifest all declare
0.18.1.
Also included since v0.18.0
- Lore co-author enforcement defaults to opt-in.
- Autopilot now defaults to Ultragoal and keeps quality gates returning to ralplan.
- SparkShell diagnostics gained team-aware pane observation and more stable output.
- Windows native hook UTF-8 forwarding and Windows SparkShell native shell mode were fixed.
- Plugin-scoped hook setup and verifier behavior were stabilized.
- Ralph, performance-goal, autoresearch, and stale runtime stop-loop handling were tightened.
- Notification, HUD/tmux, sidecar, and resource-leak cleanup fixes landed across the runtime.
Verification
npm run buildnpm run verify:plugin-bundle- Targeted Node release-blocker tests for plugin layout, setup install mode, native hooks, sparkshell packaging, package bin contract, ultragoal artifacts, and tmux pane behavior
cargo check --workspacenpm pack --dry-run --jsonconfirmedoh-my-codex-0.18.1.tgzwith zero.omxcache leaks- Main CI: https://github.com/Yeachan-Heo/oh-my-codex/actions/runs/26205946646
- Release CI: https://github.com/Yeachan-Heo/oh-my-codex/actions/runs/26205946935
Release verdict
Code review verdict: APPROVE. Architect release gate: CLEAR.
Full Changelog: v0.18.0...v0.18.1
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Oh My Codex
All releases →Related context
Related tools
Earlier breaking changes
- v0.18.5 Ultragoal completion now requires independent reviewer and architect evidence before marking complete.
Beta — feedback welcome: [email protected]