Resolve built-in local MCP runtime executables before handing command arrays to OpenCode so lsp and ast_grep do not depend on a bare node or bun lookup in the host PATH.
Keep source, dist, bootstrap, workspace-safety, and disabled_mcps behavior covered by focused tests and real OpenCode MCP status QA.
Plan: plans/fix-built-in-mcp-runtime-executables.md
- Apply mcp_env_allowlist to plugin hooks: intersect HTTP allowedEnvVars
with MCP allowlist, set command allowedEnvVars to full MCP allowlist
- Scrub process.env in executeHookCommand when allowedEnvVars provided
- Add PluginHooksState class with per-directory Map storage
- Add PluginHooksConfig interface for typed boundary layer
- Pass directory context through hook-config-handler
- Add 16 tests across 4 files (40 assertions) covering allowlist
filtering, env scrubbing, directory isolation, and edge cases
- Remove unnecessary 'as' type assertions, use discriminated union
narrowing instead
Todo continuation could reinject with a lowercase built-in config key such as hephaestus when no registered alias was available. OpenCode prompt dispatch expects the prompt-facing agent name, so the continuation failed with an agent-not-found error.
Normalize the dispatch fallback through the existing prompt agent display-name resolver and pin the lowercase Hephaestus regression.
OpenAI streaming responses can surface mid-stream errors with type
'server_error' or with the prose message 'An error occurred while processing
your request'. Neither matched any entry in RETRYABLE_MESSAGE_PATTERNS, so
shouldRetryError returned false and the runtime-fallback / fallback-retry
code paths skipped retry. The result was that GPT-5.5 subagent (and main)
turns silently stalled until the stale timeout fired.
The maintainer's diagnosis on issue #3799 explicitly recommends adding
these two patterns to model-error-classifier.ts; this commit does exactly
that and adds two regression tests covering the JSON envelope and the
prose form.
Gate idle ready notifications on the existing background-task continuation marker so cmux does not receive premature ready alerts while delegated work is still active.
Constraint: Reuse marker state from background task lifecycle without adding new notification config
Rejected: Patch cmux directly | notification readiness belongs upstream in OMO
Confidence: high
Scope-risk: narrow
- Drop the back-import of src/shared/logger so @oh-my-opencode/rules-core
stays free of host-adapter dependencies (ROADMAP package layering
invariant). Expose setSisyphusRuleDeprecationLogger(logger) for hosts to
inject their own logger; default is a noop.
- Wire the host injection in src/hooks/rules-injector/rule-file-finder.ts
as a module-level side effect so existing behavior is preserved.
- Add realpath boundary check to findRuleFilesRecursive and
validFileRealPath. Project rule scanners now refuse entries whose
realpath escapes the rule-source root, closing the symlink-escape
vector where a malicious repo could point .github/copilot-instructions.md
(or any .omo/rules/* entry) at ~/.ssh/id_rsa and have the rule injector
pull the secret into model context.
Accept apply_patch edits from nested result/metadata file lists and from raw patchText args when OpenCode does not provide direct metadata.files.
Forward tool args through the after-hook pipeline so comment-checker can inspect raw apply_patch inputs while preserving existing write, edit, and multiedit routing.
Tests: bun test src/hooks/comment-checker/hook.apply-patch.test.ts src/hooks/comment-checker/hook.before-after.test.ts src/plugin/tool-execute-after.test.ts
Tests: bun test src/hooks/comment-checker
Tests: bun run typecheck
Tests: bun run build
The full Bun suite can remove the shared rules-injector storage directory between a parent-directory check and the file write. Save operations now create the directory immediately before writing and retry once if ENOENT still wins the race.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
OpenCode now treats session.status idle as the durable completion boundary, but the plugin only dispatched the synthetic session.idle through the main hook chain. Idle-only side effects such as tmux forwarding and team member idle continuations were skipped.
Route synthetic idle through the same idle-only hook path used by real session.idle events and pin the behavior with a regression test.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ports the codex-rules transcript-aware dedup strategy: when a session cache is fresh (process restart or compaction-cleared cache), the injector now scans prior tool outputs for the `[Rule: <relativePath>]` banner and pre-populates the cache so duplicate rule injections are suppressed even when the persistent JSON has been lost. Hydration runs at most once per session per process, fails open on transport errors, and is short-circuited when the same banner reappears.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Reduce the ralph loop continuation prompt from ~15 lines to ~3 lines:
- Keep system directive prefix for proper identification
- Keep the essential 'output <promise>DONE</promise>' instruction
- Keep the original task prompt (needed context)
- Remove verbose boilerplate about reviewing progress and not stopping
When both default_mode.ultrawork and default_mode.ralph_loop are true,
the ralph loop handles ultrawork behavior via its continuation mechanism
(prepends 'ultrawork' to each iteration prompt). Injecting the ultrawork
system prompt on top would be redundant — the continuation prompt
re-triggers keyword detection, which defeats the purpose of invisible
system prompt injection.
The ultrawork flag still controls loop behavior (500 max iterations +
Oracle verification gate) via chat-message.ts startLoop({ ultrawork }).
When default_mode.ultrawork is enabled, inject the ultrawork behavioral
instructions into the system prompt (experimental.chat.system.transform)
instead of prepending them to the user's visible chat message.
- system-transform.ts: No-op handler now injects ultrawork message into
output.system[] when defaultMode.ultrawork is active. Checks for existing
<ultrawork-mode> tag to avoid re-injection after compaction.
- keyword-detector/hook.ts: Removes the visible text injection
(output.parts[].text prepend) for default_mode.ultrawork path. Only
shows the toast as the user-facing indicator.
- plugin-interface.ts: Wires getUltraworkMessage from keyword-detector
into createSystemTransformHandler.
Result: Ultrawork mode activates silently via system prompt — the chat
stays clean, and only a toast shows 'Ultrawork Mode Active'.
Add new `default_mode` config section with two boolean fields:
- `ultrawork`: Auto-inject ultrawork mode prompt on main session start
without requiring the "ultrawork"/"ulw" keyword. Wired through the
keyword-detector hook — injects once per session, respects existing
guards (non-OMO agents, planner agents, subagent sessions).
- `ralph_loop`: Auto-start ralph loop on first main session message
without requiring /ralph-loop or /ulw-loop commands. When ultrawork
is also enabled, the loop starts in ultrawork mode.
Usage:
```jsonc
{
"default_mode": {
"ultrawork": true, // Always get ultrawork prompt on start
"ralph_loop": true // Auto-start ralph loop
}
}
```
Files: 7 modified/added, ~65 LOC added.
Also fix CI test isolation: run each test file in its own bun process to prevent
mock.module() leaks across files that were introduced by upstream commit 6acca09b.
YeonGyu-Kim