733b54865f
fix(config): handle tuple-format plugin entries in opencode.json ( fixes #3122 )
...
OpenCode supports plugin entries as [string, object] tuples for passing
options, but loadOpencodePlugins assumed all entries were strings.
When a tuple entry hit matchesKnownPlugin, it called .toLowerCase()
on an array, crashing the plugin on startup.
Extract the string name from tuple entries and skip non-string values.
Add regression test covering the tuple plugin format.
2026-04-04 16:44:40 +09:00
cba9c25543
Merge pull request #3111 from code-yeongyu/fix/prepublish-config-regression
...
fix(config): use canonical path after legacy migration and make writes atomic
2026-04-04 14:56:52 +09:00
726d19c3cc
fix(security): make tar parser strictly fail-closed on any unparsed line
2026-04-04 14:48:44 +09:00
0c6907adc3
fix(config): use canonical path after legacy migration and make writes atomic
2026-04-04 14:46:29 +09:00
d368f77fcd
fix(security): make tar archive preflight fail-closed on unparsed entries
2026-04-04 14:27:46 +09:00
6acca09bd0
fix(ci): resolve mock.module() cross-file leakage in test suite
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 02:35:23 +09:00
f547cd013d
refactor(shared): consolidate plugin entry migration and detection utilities
2026-04-04 02:10:27 +09:00
fd252ea82e
refactor: remove AI-generated code smells from prepublish changes
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 02:02:12 +09:00
e4d7fdb7e9
Merge pull request #3092 from code-yeongyu/fix/prepublish-legacy-config
...
fix(shared): close legacy config migration gaps
2026-04-04 01:46:52 +09:00
f03c6700d4
fix(hooks): reuse shared legacy plugin migration helper
...
Replace the legacy toast regex writer with the shared atomic helper and route legacy plugin call sites through small wrappers so existing mock.module tests stop leaking across the suite.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:32:59 +09:00
290f7f9543
fix(shared): merge project and user opencode plugin detection
...
Stop dropping user-level plugin conflicts when an empty project config exists by collecting plugin entries from every supported OpenCode config path.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:32:42 +09:00
fedb73c736
fix(shared): migrate legacy config files atomically
...
Write the canonical config through a temp file and remove the legacy dual-file trap by archiving or deleting the old basename after migration.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:32:31 +09:00
d60ca63ed4
test(config): add regression coverage for legacy migration bugs
...
Lock the current legacy config and plugin migration failures in place before the fixes land so the three regressions stay covered.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:32:17 +09:00
ccbd646a29
fix(shared): validate tar hard-link targets during preflight
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:16:37 +09:00
553a961338
fix(shared): emit PowerShell zip entries as json lines
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:16:30 +09:00
0c5deac232
test(shared): add archive preflight security regressions
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:16:21 +09:00
53eeac3f31
fix(ci): simplify test runner to plain bun test by fixing mock.module() leakage
...
- Add afterAll(() => { mock.restore() }) to 52 test files missing cleanup
- Rewrite create-tool-guard-hooks.test.ts to use spyOn instead of barrel mock
- Fix skill-mcp-manager OAuth tests with missing mockTokens/mockLogin definitions
- Fix start-work hook: show worktree active block on resume with existing worktree_path
- Extract createWorktreeActiveBlock to worktree-block.ts to avoid circular import
- Replace 80-line isolated test runner CI config with single `bun test` command
2026-04-04 00:34:03 +09:00
e0feb16dab
refactor(shared,config): remove redundant null checks and AI slop from code comments
2026-04-03 19:39:55 +09:00
d0f795dd8f
refactor(shared): decompose model-capabilities into focused modules
2026-04-03 19:38:26 +09:00
3cc9e8bc30
refactor(shared): extract shared cache factory to deduplicate cache patterns
2026-04-03 19:36:56 +09:00
3180389dea
Merge pull request #3052 from code-yeongyu/fix/p0-1-task-system-default-split-brain
...
fix: resolve task_system default split-brain
2026-04-03 18:52:40 +09:00
71b8110ff0
fix(zip): parse zipinfo file entries with preserved filenames
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:38:14 +09:00
2b43558349
fix(tar): surface traversal extraction failures as blocked entries
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:34:22 +09:00
a4f436c116
fix(tar): classify traversal tar listing errors as blocked entries
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:34:12 +09:00
2288988f28
fix(zip): use zipinfo to preflight zip extraction on unix
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:34:12 +09:00
d65714eba0
fix(shared): avoid archive test batch regression
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:31:26 +09:00
2ba2f8f5f7
fix(shared): add task_system resolver
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:31:26 +09:00
83acafce48
Merge pull request #3058 from code-yeongyu/fix/p1-11-remove-as-any-tests
...
fix(tests): remove as any from new test files
2026-04-03 18:30:30 +09:00
071f6c334d
Merge pull request #3055 from code-yeongyu/fix/p1-8-legacy-config-canonical-priority
...
fix: prefer canonical plugin config files
2026-04-03 18:30:19 +09:00
f369971db9
fix(tests): type tmux fetch mocks
...
Model the tmux fetch test doubles with the fetch shape Bun expects so the tests drop without changing assertions.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:37:17 +09:00
b2b8f73d0d
Fix tar traversal error normalization
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:28:22 +09:00
22c8e8388f
Fix Linux ZIP preflight entry listing
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:23:09 +09:00
b096e6f751
fix: prefer canonical plugin config files
2026-04-03 17:15:08 +09:00
88b84a8517
test: cover canonical plugin config detection
2026-04-03 17:15:03 +09:00
f269d2fcc5
Fix local MCP scope path containment
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:14:40 +09:00
156c1f4aeb
fix(models): mark gpt-4.1-mini and gpt-4.1-nano as supporting tool calls
...
Fixes #2923
2026-04-02 15:45:39 +09:00
9a7bb5eeb7
Merge pull request #3024 from code-yeongyu/fix/security-tar-containment
...
fix(security): add archive extraction containment validation
2026-04-02 15:09:52 +09:00
d861d51959
fix(security): add archive extraction containment validation
...
Validate tar and zip entries before extraction to prevent path traversal:
- Reject absolute paths in archives
- Reject .. traversal paths
- Reject symlinks pointing outside extraction dir
- New archive-entry-validator module with comprehensive tests
Addresses: security audit finding for unsafe archive extraction.
2026-04-02 15:01:15 +09:00
98659783c0
fix(security): confine file resolution to project roots
...
Block traversal, out-of-root absolute path, and symlink escapes for @file references, file:// URIs, and config skill file loading while logging rejected attempts.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-02 14:55:35 +09:00
9418927162
fix(config): make plugin entry migration atomic with temp-file + rename
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-01 18:33:29 -07:00
3d56df4e1b
feat(deep): upgrade default model from gpt-5.3-codex to gpt-5.4
...
Deep category now uses gpt-5.4 as its default model across all providers
(openai, github-copilot, venice, opencode), matching Hephaestus's GPT 5.4
upgrade. The requiresModel constraint is removed since gpt-5.4 is widely
available. Adds openai/gpt-5.3-codex -> openai/gpt-5.4 config migration
for existing user configs. Deep category prompt optimized for GPT 5.4's
stronger native capabilities (leaner, less verbose).
2026-03-31 17:26:30 -07:00
ce0d3581f0
fix: revert delegate-task to string category schema, fix mock isolation and restore UB7 originals
2026-03-31 17:25:00 -07:00
11ee88f28f
fix: use jsonc-parser for safe JSONC migration and add project-local config detection
2026-03-31 17:06:46 -07:00
e2e57bb2dd
fix(agents): use list display names for ordered agent config
2026-03-31 15:11:00 -07:00
33c8b7f675
fix(tests): resolve 6 test isolation failures in full suite
...
3 failures in fallback.cliproxyapi-matrix.test.ts:
- Root cause: leaked spyOn(getMainSessionID) in
tool-execute-before-session-notification.test.ts was never restored,
poisoning module state for subsequent tests in the same worker
- Added mockRestore() call and _resetModelFallbackForTesting in afterEach
3 failures in background-agent/manager.test.ts:
- Root cause: connected-providers-cache memConnected/memProviderModels
persisted across test files, making isReachable() skip fallback
candidates in retry tests
- Added mock.module for connected-providers-cache at file level
- Added _resetMemCacheForTesting export and global beforeEach cleanup
Full suite: 4638/4638 pass, 0 fail
2026-04-01 04:30:34 +09:00
44c6a2ad5c
Merge pull request #2931 from sjawhar/feat/tmux-session-isolation
...
feat(tmux): add session isolation mode for subagent panes
2026-03-29 18:44:29 -07:00
a3cc2d1c95
feat(tmux): add session isolation mode for subagent panes
2026-03-29 17:53:30 +00:00
4314a3e482
fix: permanently resolve agent name duplication yo-yo bug
2026-03-29 15:13:47 +00:00
b2497f1327
fix: resolve 3 community-reported bugs ( #2915 , #2917 , #2918 )
...
- background_output: snapshot read cursor before consuming, restore on
/undo message removal so re-reads return data (fixes #2915 )
- MCP loader: preserve oauth field in transformMcpServer, add scope/
projectPath filtering so local-scoped MCPs only load in matching
directories (fixes #2917 )
- runtime-fallback: add 'reached your usage limit' to retryable error
patterns so quota exhaustion triggers model fallback (fixes #2918 )
Verified: bun test (4606 pass / 0 fail), tsc --noEmit clean
2026-03-29 04:53:43 +09:00
d2c576c510
fix: resolve 25 pre-publish blockers
...
- postinstall.mjs: fix alias package detection
- migrate-legacy-plugin-entry: dedupe + regression tests
- task_system: default consistency across runtime paths
- task() contract: consistent tool behavior
- runtime model selection, tool cap, stale-task cancellation
- recovery sanitization, context-limit gating
- Ralph semantic DONE hardening, Atlas fallback persistence
- native-skill description/content, skill path traversal guard
- publish workflow: platform awaited via reusable workflow job
- release: version edits reapplied before commit/tag
- JSONC plugin migration: top-level plugin key safety
- cold-cache: user fallback models skip disconnected providers
- docs/version/release framing updates
Verified: bun test (4599 pass), tsc --noEmit clean, bun run build clean
2026-03-28 15:24:18 +09:00
YeonGyu-Kim