🕵️ SicherheitslückenKARR Security vulnerability(02.09.2026 um 03:15 Uhr)
⚠️ Malware / Trojaner / VirenThe Problem with LG TVs Spyware and Its Vulnerabilities(07.09.2026 um 02:02 Uhr)
⚠️ Malware / Trojaner / VirenNew Android malware encrypts files, steals data, and harasses victims(10.09.2026 um 23:40 Uhr)
⚠️ Malware / Trojaner / VirenConti ransomware gang member sentenced to 4 years in prison(11.09.2026 um 08:48 Uhr)
🕵️ SicherheitslückenGitLab urges users to patch max severity path traversal flaw(11.09.2026 um 13:15 Uhr)
⚠️ Malware / Trojaner / VirenHow Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface(11.09.2026 um 16:01 Uhr)
⚠️ Malware / Trojaner / VirenArtifactory flaws chained in attacks deploying backdoor malware(11.09.2026 um 18:29 Uhr)
🕵️ SicherheitslückenDutch NCSC: Critical Check Point VPN flaws exploitation is imminent(12.09.2026 um 16:14 Uhr)
🕵️ SicherheitslückenHackers exploit Tencent app flaw to deploy GrayRabbit malware(13.09.2026 um 16:26 Uhr)
🕵️ SicherheitslückenKARR Security vulnerability(02.09.2026 um 03:15 Uhr)
⚠️ Malware / Trojaner / VirenThe Problem with LG TVs Spyware and Its Vulnerabilities(07.09.2026 um 02:02 Uhr)
⚠️ Malware / Trojaner / VirenNew Android malware encrypts files, steals data, and harasses victims(10.09.2026 um 23:40 Uhr)
⚠️ Malware / Trojaner / VirenConti ransomware gang member sentenced to 4 years in prison(11.09.2026 um 08:48 Uhr)
🕵️ SicherheitslückenGitLab urges users to patch max severity path traversal flaw(11.09.2026 um 13:15 Uhr)
⚠️ Malware / Trojaner / VirenHow Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface(11.09.2026 um 16:01 Uhr)
⚠️ Malware / Trojaner / VirenArtifactory flaws chained in attacks deploying backdoor malware(11.09.2026 um 18:29 Uhr)
🕵️ SicherheitslückenDutch NCSC: Critical Check Point VPN flaws exploitation is imminent(12.09.2026 um 16:14 Uhr)
🕵️ SicherheitslückenHackers exploit Tencent app flaw to deploy GrayRabbit malware(13.09.2026 um 16:26 Uhr)

💾 Tools 🕛 vor 3 Monaten 16 Min Lesezeit
0

v15.9.0

↗ Quelle (GitHub · github.com)
🗣️ Stimme:
📑 Inhaltsübersicht
🐙
$ git clone https://github.com/can1357/oh-my-pi.git

@oh-my-pi/pi-ai


Fixed



  • Fixed MiniMax-compatible OpenAI-completions hosts (e.g. minimax-code-cn/MiniMax-M3) losing tool-call arguments when the stream delivers function.arguments as a complete object instead of the OpenAI JSON-string contract. The streaming buffer previously concatenated the object into a string, coercing it to [object Object] and leaving bash/edit calls with empty or malformed inputs; the tool-call block now holds the object payload directly. (. Skills using this field are now hidden from the system prompt listing, matching the behavior of hide: true.


Changed



  • Changed the task tool description to tag read-only agents and explicitly forbid assigning them file edits/commands or offloading reasoning to quick_task/explore.

  • Changed Redis and SQL session storage initialization to load only indexed metadata (size, mtimeMs) instead of full session content

  • Changed SessionStorage read paths to rely on backend-backed metadata/indexed storage, so session content is fetched on demand rather than cached as full in-memory mirrors

  • Changed session-list slice reads to go through SessionStorage.readTextSlices across all backends, removing the file-only single-open branch and caller-managed buffers. FileSessionStorage now reads both windows via peekFileEnds, while Redis and SQL backends encode session content once per combined read.

  • Changed the ask tool transcript renderer to mark single-choice questions with circular radio glyphs (/) instead of the rectangular checkbox glyphs (/) it shares with multi-select questions, so a "pick one" combo box visually reads as a radio group rather than a checklist. Multi-select questions keep checkboxes. Added a radio.selected/radio.unselected symbol pair across the unicode, nerd-font, and ASCII presets.

  • Changed the ask tool transcript renderer to mark the chosen answer inside the question form rather than re-listing the questions in a detached summary block below it. Once a question is answered, the standalone prompt preview is dropped and the result redraws the same form — every offered option still shown, with the selected one(s) filled in (/, highlighted) and the rest dimmed (/); custom free-text answers and cancellations render in place as the final entry. This removes the duplicate question/option listing that previously appeared once as the call preview and again as the result.

  • Changed task-completion and ask desktop notifications to structured terminal notifications (title, body, type, and a focus-on-click action). On Kitty these render through OSC 99 as a proper title/body with click-to-focus; terminals without confirmed OSC 99 support collapse them to the previous single-line message (BEL/OSC 9).

  • Updated the "each kitty/tmux split" tip to include cmux.


Fixed



  • Fixed tiny-model startup in compiled binaries by resolving @huggingface/transformers and its runtime dependencies from the installed cache using package.json exports/main metadata, preventing module-resolution failures when launching models

  • Fixed tiny runtime installation flow in compiled binaries by using the build-time resolved @huggingface/transformers version and ensuring the runtime lock directory’s parent exists before acquiring the install lock, preventing mismatch and setup failures on fresh installs

  • Fixed the terminal protocol debug probe reusing one stable Kitty graphics id across repeated panels, which could move/replace an earlier swatch instead of rendering a new one.

  • Fixed selector dialogs (the ask tool, hook prompts) collapsing to a single visible option on shorter terminals when options carried long descriptions: the highlighted option's wrapped description consumed the entire row budget, hiding every other option and making the menu feel unnavigable (down moved the lone visible entry, left/right did nothing). When the fully-expanded list overflows, HookSelectorComponent now renders a compact list — every option label stays on screen and only the highlighted option expands its description, truncated to the remaining rows — so the whole menu is always visible and the detail pane follows the cursor.

  • Fixed read failing with "Path not found" on web URLs whose scheme // collapsed to a single / (e.g. https:/github.com/...), which happens when a URL is routed through Node's path.normalize/path.resolve. The fetch URL recognizer now accepts a single-slash scheme and repairs it back to // before fetching, so collapsed URLs resolve instead of falling through to filesystem lookup.

  • Fixed subagent slow-model priority falling through to older Claude Opus aliases when Opus 4.8 is available by adding Opus 4.8 and 4.7 aliases ahead of older Opus fallbacks ().

  • Fixed wrapTextWithAnsi hanging (infinite loop) on text containing a BEL-terminated string escape — DCS/SOS/PM/APC (ESC P/ESC X/ESC ^/ESC _) closed by BEL instead of ST. ansi_seq_len_u16 only accepted the ST (ESC \) terminator for these (OSC already accepted both), so a BEL-terminated APC such as the TUI cursor marker (ESC _ pi:c BEL) was left unclassified: it was miscounted as visible width and break_long_word's non-ESC scan could not advance past the ESC, spinning forever. The terminator set now matches OSC (ST or BEL), and break_long_word defensively emits and steps over any escape it cannot classify so a malformed/unknown sequence can never wedge the wrap loop.


@oh-my-pi/swarm-extension


Fixed



  • Fixed swarm /swarm run failing with authStorage/modelRegistry identity error () and would drop the background entirely. Scrollback-bound rows and the append/scroll paths always keep the padded representation so native history preserves colored cells, and the PI_NO_DECCARA kill switch (plus tmux/screen/zellij detection) forces the fallback.

  • Added CMUX_SURFACE_ID environment variable support to getTerminalId(), so cmux terminal surfaces get a stable identifier alongside kitty, tmux, macOS Terminal.app, and Windows Terminal — enabling per-surface session breadcrumbs for omp -c in cmux.


Changed



  • Changed TUI tests to use Ghostty's VT engine (ghostty-web) instead of @xterm/headless.

  • Changed the default inline-image live graphics budget from 3 to 8 images.


Fixed




  • Fixed the DECCARA background-fill optimizer rejecting or repainting the wrong cells when a trailing fill crossed from default-background spaces into colored spaces.




  • Fixed DEC private-mode reports with DECRPM status 3/4 being treated as unsupported, so permanent 2026/2048 reports stay recognized.




  • Fixed OSC 66 text-sizing width and slicing edge cases, including ZWJ emoji payloads and partial slices through scaled spans.




  • Fixed focused Input components following TUI#setShowHardwareCursor, so single-line prompts render either the terminal cursor or software cursor consistently with the editor.




  • Fixed the DECCARA background-fill optimizer painting fills on the wrong rows ("split into unaligned halves") in the differential repaint path. When a diff grew the transcript past the viewport, writing the rewritten rows scrolled the terminal, but the absolute DECCARA rectangle coordinates were derived from the pre-scroll viewport top, so every fill landed scrollAmount rows too low while the relatively-positioned text settled correctly; rows scrolled into history were also shortened, dropping their background padding from native scrollback. Rectangles now target the post-scroll rows and only rows remaining in the final viewport are optimized.




  • Fixed native scrollback desynchronization after terminal width or height changes reflowed overflowing content while the viewport was not at the bottom




  • Fixed a notification chip (or any injected block) rendering on top of an actively streaming tool render on ED3-risk terminals (Ghostty/kitty/Alacritty/iTerm2). While a foreground tool streams, its header's elapsed-time counter ticks every frame; once output scrolls the header above the viewport top, each tick is an offscreen edit that — because the eager scrollback-rebuild opt-in is gated off on these terminals — repaints the viewport in place and advances the rendered line count without committing the new overflow to native history. #scrollbackHighWater then lagged the logical viewport top, so a later content shrink whose changes landed in the visible region slipped past the shrink-across-boundary guard and reached the differential emitter, which is anchored to #maxLinesRendered - height: it rewrote only the suffix, dropped the newly exposed top row, and left a blank at the bottom, drifting every row below the edit one line up so it painted over the rows above. Such shrinks now re-anchor the bottom of the viewport with a non-destructive repaint, and the foreground-streaming shrink-across-boundary case repaints the live tail instead of padding and pinning the pre-shrink viewport.




  • Fixed a terminal resize during foreground-tool streaming on an unknown-viewport / ED3-risk host (Ghostty/kitty/Alacritty/iTerm2/WSL) leaving native scrollback permanently out of sync, so scrolling back after the turn showed missing rows. A pure geometry resize (no content change) takes the in-place viewport-repaint path, which — unlike a content-bearing resize that rebuilds via the geometry branch — never flagged native history. Because the prompt-submit checkpoint (refreshNativeScrollbackIfDirty) only rebuilds when scrollback is marked dirty on these hosts, the discrepancy was never reconciled. Overflowing geometry repaints whose viewport is not known to be at the bottom now mark scrollback dirty so the next checkpoint rebuilds an exact copy of the transcript.




@oh-my-pi/pi-utils


Added




  • Added color helpers colorLuma (perceptual luma), relativeLuminance (WCAG, linearized sRGB), and hslToHex to the color utilities. The luminance helpers parse #rgb/#rrggbb hex and 256-color palette indices, returning undefined for unparseable values.




  • Added peekFileEnds, a single-open head-and-tail file peek helper that reuses the head bytes for the tail when the file fits the head window.




  • Added peekFileTail, the tail mirror of peekFile: reads up to the last maxBytes of a file ending at EOF, reusing the same pooled-buffer strategy (no per-call allocation for small reads).




What's Changed



  • fix(search): default paths to workspace root instead of hard-failing by

  • fix: recognize disable-model-invocation from Agent Skills spec by

  • fix(coding-agent/mcp): handle async broken-pipe rejections in stdio transport by

  • Fix slow agent Opus priority by

  • fix(swarm): remove redundant authStorage discovery from swarm pipeline ( in in in in in in made their first contribution in made their first contribution in made their first contribution in made their first contribution in made their first contribution in

    Vollständiger Original-Bericht
    Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf github.com.
    ↗ Original-Artikel auf github.com lesen
Wie bewertest du diesen Beitrag?
1 Klick Feedback
Teilen mit Netzwerk & Team:

Community-Analysen & Experten-Meinungen 0

Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf Eigene Analyse verfassen“!
Community Pulse: Relevanz-Einschätzung
1 Klick Experten-Votum
🔴 Akute Relevanz 0%
🟡 In Evaluierung 0%
🟢 Keine Auswirkung 0%
Spannende Innovation 0%
Verwandte Story-Cluster & Quellen (Vektor-KI)
Port 8095 Engine
1 Quelle
You might want to watch what you say.
1 Quelle
A beast by any other name.
1 Quelle
Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten v15.9.0

Thematisch verwandte Begriffe: v1590 · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...