Bare "403" and "forbidden" substring patterns (added in 034744cb to
retry the "Selected provider is forbidden" case from PR #3706) matched
any error message containing those tokens — tool-level 403s, file-perm
"forbidden" messages, unrelated upstream errors that happened to spell
"forbidden". The legacy model-fallback path then armed setPendingModelFallback
on those unrelated errors, jumping Sisyphus to claude-opus-4-7 (first
entry of its fallback chain) regardless of the user's configured model.
Replace the bare patterns with the specific phrases PR #3706 actually
targeted, and add regression tests asserting unrelated 403/forbidden
messages stay non-retryable.
Reported-by: ilove_borshch on Discord (#omo-help)
- Add Manual QA Gate as a non-negotiable surface-tool mapping
(interactive_bash for TUI, playwright for browser, curl for HTTP,
driver script for library) to Hephaestus, Sisyphus-Junior, and
Sisyphus' direct-execution mode.
- Restore the dig-deeper trio (tool persistence / dig deeper /
dependency checks) as orthogonal paragraphs so each carries its
own cognitive trigger instead of a fused single statement.
- Harden investigate-before-acting from a soft phrase to a dedicated
block: never speculate about unread code, re-read on every
task hand-off, the worktree may have changed.
- Add 'Parallelize aggressively' as its own block. Reads, searches,
diagnostics, and background sub-agents all batch into a single
response by default.
- Add 'No defensive code, no speculative legacy' to discourage
speculative backward-compatibility branches and unrequested
defensive validation.
- Absorb review-intent and frontend anti-slop coverage so the
prompt stays self-sufficient when the omo agent prompt replaces
the provider prompt.
- Replace literal apply_patch instructions with GPT_APPLY_PATCH_GUIDANCE
(use edit/write tools) so the prompt no longer contradicts the
apply_patch deny that the agent permission applies on GPT models.
- Sisyphus-Junior gains a Review tasks block and a default-behavior
fallback for when the runtime category context is missing or sparse.
- Sisyphus gains an explicit Hard invariants block listing type-
suppression bans, destructive-git bans, and Oracle-completion gating.
- Restore dynamic injections that round out the orchestrator/worker
context: category+skills delegation guide, delegation table,
Oracle dynamic guidance, key triggers, non-Claude planner
reminder. Hephaestus regains optional category delegation while
keeping direct execution as the default.
- Drop em dashes; search guidance points at rg directly throughout.
Empirically the npm registry returns HTTP 201 (Created) - not 200 -
when the OIDC token exchange succeeds and a fresh publish token is
issued. The preflight gate was only accepting 200 so every
correctly-configured package was flagged as missing. Accept any
2xx status; only treat 4xx/5xx as missing trust config.
The publish workflow used to bump npm latest+1 *before* attempting
the platform publishes. When a platform package was missing its
trusted-publisher config the version was already incremented but
that platform never shipped, leaving partial-publish garbage
versions on npm (this happened with v3.17.7-v3.17.9 during the
OIDC migration).
Add a preflight-trust job that runs in parallel with test/typecheck
and verifies all 24 packages have a trusted publisher configured by
calling npm's own OIDC token exchange endpoint with the workflow's
GitHub OIDC token. publish-main now needs preflight-trust, so any
missing trust config fails the workflow before the version bump.
Failure output lists the exact npm.com URLs to configure each
missing package, plus the org/repo/workflow values to enter.
After switching to npm Trusted Publishing the publish step still
returned 'PUT 404' because actions/setup-node injects an
'//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' line into
.npmrc. With NODE_AUTH_TOKEN unset that placeholder evaluates to
an empty string, so npm tries an empty token before reaching for
the OIDC ID token and the registry rejects it.
- Add a step that strips any _authToken line from both project-
local and $HOME/.npmrc before publishing, so npm CLI proceeds
to OIDC token exchange.
- Bump publish commands to --loglevel verbose so future failures
expose the actual auth path (provenance attestation, OIDC
exchange, etc.) in workflow logs.
NODE_AUTH_TOKEN expired (set 90 days ago, the npm token default
expiry) causing all publish runs to fail with 'PUT 404 Not Found'
since 2026-04-30.
Migrate publish.yml and publish-platform.yml to npm Trusted
Publishing (OIDC) so we no longer depend on long-lived secrets:
- Bump actions/setup-node v4 -> v6 (improves OIDC compatibility)
- Add 'npm install -g npm@latest' to guarantee npm CLI >= 11.5.1
(the minimum required for trusted publishing).
- Drop NODE_AUTH_TOKEN env from every publish step. The npm CLI
picks up the GitHub Actions OIDC token automatically.
- Keep --provenance / NPM_CONFIG_PROVENANCE=true (real-world
reports indicate provenance is not auto-emitted yet).
Per-package trusted publisher must still be configured on
npmjs.com (Settings -> Trusted Publisher) for all 24 packages
(oh-my-opencode + oh-my-openagent main + 11 platform packages
each, dual-published) before the next publish run.
The startup toast and `omo --version` were reading from the legacy flat install
at <CACHE_DIR>/node_modules/<pkg>/package.json, but OpenCode actually loads
plugins from a per-plugin sandbox at <CACHE_DIR>/<plugin-entry>/node_modules/
<pkg>/package.json. The two install layers can drift independently when bun
re-resolves "latest" against the flat install while the sandbox's package.json
stays pinned to a literal version baked in at first install.
In practice this means the toast can announce a version the runtime is not
running. Concrete reproduction: with `"oh-my-openagent@latest"` in the plugin
list, the sandbox stayed on 3.17.5 while the parallel flat install advanced to
3.17.6, so the startup toast confidently reported v3.17.6 even though the
loaded plugin code was 3.17.5.
Walking up from `import.meta.url` always reflects the actually-loaded module,
so reorder `getCachedVersion()` to try that first and fall back to the flat-
install candidates and execPath walk-up as before. The fallback chain is
preserved for bundled environments where the module-relative lookup may fail.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Hephaestus 5.5 was rewritten as an outcome-first delegation contract in c3fabaaf. The deep category (spawned as sisyphus-junior under gpt-5.5) now receives a matching prose-driven category context lifted from drafts/gpt-5-5/deep.md instead of the legacy gpt-5.4-era threat-frame version.
Selection happens via a new model-aware resolvePromptAppend hook on BuiltinCategoryDefinition. When the resolved category model is gpt-5.5 the new DEEP_CATEGORY_PROMPT_APPEND_GPT_5_5 is used; older models keep the legacy DEEP_CATEGORY_PROMPT_APPEND. User prompt_append remains preserved on top of either base.
All cubic-flagged P1 (stale prompt errors / stale terminal session error) and P2 (URL directory / mutable state leak) issues were resolved by @unclok in commits `2237c1acc`, `185665707`, `078e49629`, and `0dd455e72` before this final review pass. Verified locally: typecheck clean, 248 PR-related tests pass. CI green after rebasing onto current dev. Ships valuable retry observability + Forbidden-error retryability + sync delegate-task replay improvements.
Fixes#3519. Quota exhaustion now advances the runtime fallback chain instead of stopping. Surgical change with parallel test updates. Pre-existing prompt-text test mismatch on the older base disappeared after rebasing onto current dev — all checks green.
Previously each transform hook was awaited sequentially without per-hook
error handling. If contextInjectorMessagesTransform or thinkingBlockValidator
threw, toolPairValidator was silently skipped, leaving orphaned tool_use
blocks in the post-compaction API payload and producing
"messages.N: tool_use ids were found without tool_result blocks immediately
after" 400s from Anthropic.
Wraps each hook in runHookSafely so an upstream throw is logged but the
chain continues. Adds regression tests covering the isolation contract and
the consecutive-assistants compaction tail case (ses_22bd806).
The idle notification scheduler was initialized with platform 'unsupported'
before platform detection had run. This stale value was passed to send/playSound
callbacks, causing sendSessionNotification to silently no-op (no switch case for
'unsupported'). Session-idle notifications never fired as a result.
Fix: remove platform from scheduler options entirely. Callbacks now resolve
platform via ensureNotificationPlatform() which is sync, cached, and already
called by each event handler before scheduling.
Add cmux as the highest-priority notification provider on macOS.
cmux delivers notifications via native UNUserNotificationCenter,
properly attributed to the cmux app instead of Script Editor.
Notification priority: cmux > terminal-notifier > osascript
Tests cover the full fallback chain:
- cmux available: uses cmux, skips others
- cmux fails: falls back to terminal-notifier
- cmux + terminal-notifier fail: falls back to osascript
- cmux not available: skips to terminal-notifier
Fixes#3628
Root cause: the context-window-monitor hook computes actualUsagePercentage = (input + cache.read) / actualLimit and renders both 'X% used' and '(1 - X) * 100% remaining' inside a [SYSTEM DIRECTIVE: OH-MY-OPENCODE - CONTEXT WINDOW MONITOR] block that is appended to bash tool output. When resolveActualContextLimit() underestimates the model's real context window (for example a 1M-context Anthropic model that falls back to the 200K default per #3450), totalInputTokens > actualLimit and the rendered numbers go nonsensical (issue #3655 reproduces 144.7% used / -44.7% remaining at 289,370 / 200,000 tokens). Safety-tuned models recognize the >100% / negative-remaining pattern as a tell-tale prompt injection and refuse to follow the directive.
Fix: clamp actualUsagePercentage to [0, 1] before formatting. The 70% threshold check still uses the raw value so the block continues to fire above threshold, and resolveActualContextLimit() is left untouched (the deeper resolver concern is tracked separately as #3450). When totalInputTokens exceeds actualLimit the displayed numbers now read '100.0% used / 0.0% remaining' instead of the impossible >100% / negative pair, and safety-tuned models stop flagging the block as an injection attempt.
Verification: added a regression test (input 289,370, limit 200,000) that asserts usedPct in [0,100] and remainingPct in [0,100]. Test fails before the fix (Received: 144.7) and passes after. Full context-window-monitor.test.ts and context-window-monitor.model-context-limits.test.ts: 15 pass / 0 fail. Typecheck clean.
YeonGyu-Kim