🔧 AI Nachrichten How I’m using Codex and ChatGPT on my Mac(01.09.2026 um 00:00 Uhr)
🕵️ SicherheitslückenProFTPD mod_sql post-authentication SQLi RCE(06.09.2026 um 18:21 Uhr)
🕵️ Sicherheitslücken[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE(25.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)(31.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] CubeCart 6.7.4 - Stored XSS(31.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] CubeCart 6.7.4 - Cross-Site Scripting(31.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution(31.08.2026 um 02:00 Uhr)
🔧 AI Nachrichten How I’m using Codex and ChatGPT on my Mac(01.09.2026 um 00:00 Uhr)
🕵️ SicherheitslückenProFTPD mod_sql post-authentication SQLi RCE(06.09.2026 um 18:21 Uhr)
🕵️ Sicherheitslücken[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE(25.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)(31.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] CubeCart 6.7.4 - Stored XSS(31.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] CubeCart 6.7.4 - Cross-Site Scripting(31.08.2026 um 02:00 Uhr)
🕵️ Sicherheitslücken[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution(31.08.2026 um 02:00 Uhr)

💾 Tools 🕛 vor 2 Monaten 16 Min Lesezeit
0

v16.1.17

↗ Quelle (GitHub · github.com)
🗣️ Stimme:
📑 Inhaltsübersicht
🐙
$ git clone https://github.com/can1357/oh-my-pi.git

@oh-my-pi/pi-agent-core


Fixed



  • Hardened the agent-loop cooperative yield against backward wall-clock jumps. A stale future timestamp left in the shared yield gate (NTP step, or a fake-timer test mocking Date.now) could make yieldIfDue() gate forever and stop yielding to the event loop; the gate now treats a backward clock delta as due and re-anchors. The gate is exposed as an injectable YieldGate (with yieldIfDue() retained as the shared singleton) so it can be exercised without mocking process-global timers.


@oh-my-pi/pi-ai


Added



  • Added provider-level notes?: string[] field to UsageReport for disclaimers that apply to every limit (e.g. "OMP-observed spend only"). The field is declared in both the usage.ts schema and the auth-broker wire schema copy so it survives the "+": "reject" deserialization gate. ()

  • Fixed Anthropic rate-limit header usage cache entries retaining legacy missing account metadata after refresh.

  • Fixed Anthropic-compatible budget-effort models dropping the selected effort before request serialization, so output_config.effort is emitted alongside thinking.budget_tokens when model metadata declares mode: "anthropic-budget-effort".

  • Fixed anthropic-messages silently dropping caller-supplied Authorization / X-Api-Key from model.headers and ANTHROPIC_CUSTOM_HEADERS, blocking custom proxy auth schemes. Non-OAuth requests now honor the caller's value (matching openai-responses); the lower-level client also suppresses its X-Api-Key add when a custom Authorization is supplied for a non-official endpoint so the proxy receives a single credential. OAuth bearer + Cloudflare AI Gateway keep their pre-existing enforced auth headers. ()

  • Fixed OpenRouter Anthropic models on the Responses path omitting cache_control, so prompt caching engages without forcing Chat Completions. ()

  • Fixed OpenRouter Anthropic models on the Responses path omitting cache_control, so prompt caching engages without forcing Chat Completions. cacheRetention: "long" now upgrades the breakpoint to ttl: "1h". ()

  • Fixed GitHub Copilot business and enterprise endpoints accepting image inputs that they reject with 400 vision is not supported. The Copilot /models response advertises capabilities.supports.vision = true for Claude/GPT chat models on every host, but only the canonical personal endpoint (https://api.githubcopilot.com) actually serves them; githubCopilotModelManagerOptions now forces input: ["text"] whenever discovery resolves to a non-personal base URL, and mergeDynamicModel honours the dynamic value (instead of OR-upgrading) when the merged endpoint differs from the bundled reference. ()


@oh-my-pi/pi-coding-agent


Fixed



  • Fixed mnemopi auto-retain extracting facts/entities from assistant-authored transcript turns. MnemopiSessionState.retainMessages still stores the full multi-role window for episodic recall, but passes only user-authored turns as extractText, so assistant prose containing always/never no longer becomes durable user Instruction: memory. ()

  • Fixed profile-alias installer producing backslash-separated paths for bash/zsh/fish config files on Windows. path.join was used unconditionally, producing Windows-style paths that POSIX shells can't resolve. The installer now uses path.posix.join for non-Windows platforms and normalizes script paths to forward slashes for POSIX shell alias blocks, so omp --alias works correctly in Git Bash and WSL.

  • Fixed pasted or dragged non-image file paths in the TUI prompt staying as inert raw text; existing files now attach as clean local://attachment-N.<ext> references while image paths keep the image attachment flow. ()

  • Fixed the ask tool's "Other (type your own)" free-text editor (prompt-style HookEditorComponent) ignoring Ctrl+Q and Ctrl+Enter, so Windows Terminal users who learned the app.message.followUp chord from the main editor () got zero feedback on submit. The hook-style and main-editor surfaces honored matchesAppFollowUp; the prompt-style handler did not, leaving plain Enter as the sole submit path and Ctrl+Enter falling through to Editor as a newline (silently swallowed by WT). #handlePromptStyleInput now checks matchesAppFollowUp first — mirroring #handleHookStyleInput — and the hint reads enter or ctrl+q submit so the chord is discoverable. ()

  • Fixed /settings coercing enum/text values to display strings before handing them to the TUI list, preventing YAML numeric enum values from reaching native truncation ()

  • Fixed llama.cpp discovery to prefer per-model /v1/models meta.n_ctx/meta.n_ctx_train values, refresh selected models after lazy load, and bypass fresh-cache reuse so server restarts update context windows. ().

  • Fixed MCP tool calls forwarding empty optional placeholder arguments ("" and {}) to tools/call; optional placeholders are now omitted while required fields and meaningful falsy values are preserved. ()

  • Fixed omp usage and the /usage command duplicating provider-wide disclaimer notes (e.g. OpenCode Go's "OMP-observed spend only") once per account × limit window. Provider-level notes now render once above the per-account sections in the TUI, CLI, and ACP render paths, and identical per-limit notes are deduplicated in the TUI aggregate renderer. (). The tips section now points users at /hotkeys instead. ()

  • Fixed omp tiny-models download exiting before its unref'd worker subprocess could install the runtime or download model weights. The tiny-model client now references the worker while requests are pending so standalone CLI downloads wait for Downloaded ... / Failed ... completion. ().

  • Fixed umans requests with more than 10 live context images still sending every image despite the provider budget; outgoing provider contexts now drop the oldest images above the active provider cap while preserving text and newest images ()

  • Fixed large-session TUI stalls by tailing appended transcript JSONL and collapsing compacted history on the live display surface ().

  • Fixed extension tool_call/tool_result events for hashline edit calls to expose event.input.path for single-file edits and event.input.paths for every parsed target, so planning-mode gates can allow one markdown plan edit but still block multi-file hashline calls that cannot be represented by one path ().

  • Fixed snapcompact rasterizing transcript frames into requests bound for GitHub Copilot business and enterprise endpoints, which then rejected the session permanently with 400 vision is not supported. The snapcompact vision gate now also short-circuits whenever model.provider === "github-copilot" and the resolved baseUrl is not the canonical personal-Copilot host, protecting cached/stale Model specs that still advertise ["text","image"] on a non-personal endpoint. ()


@oh-my-pi/pi-natives


Added



  • Added setHangulCompatJamoWidthOverride(value) to override the Hangul Compatibility Jamo (U+3131..U+318E) display width at runtime via a process-global atomic, instead of relying solely on the compile-time cfg!(target_os = "macos") heuristic. The actual width is decided by the client terminal (not the host OS), so the TUI resolves it from the terminal identity and pushes the result here. Encoding: 0 = platform default (macOS narrow, otherwise UAX#11), 1 = narrow (1 cell), 2 = wide (2 cells), 3 = Unicode width (no correction). The leaf width helpers read this override, so no width/slice/truncate/wrap signatures change.


@oh-my-pi/omp-stats


Fixed



  • Stats sync counted the same provider request multiple times when a forked or branched session file copied the parent's entries verbatim. Inserts now skip rows whose (entry_id, timestamp) already exists under a different session_file, and a one-shot migration on the next omp stats run collapses any pre-existing duplicates (). Theme detection now relies on the initial startup probe plus Mode 2031 push notifications; affected terminals pick up OS-theme changes on next launch.

  • Fixed @-path autocomplete failing on Windows for paths outside the cwd. Windows absolute paths (e.g. C:\\Users\\...) were not detected as absolute — only / was checked — so they were incorrectly joined with the base directory, producing invalid search paths and empty suggestions. Path-join calls also introduced backslashes into suggestion values, breaking round-trip insertion. Absolute path detection now uses path.isAbsolute() (handles drive letters) and suggestion paths are normalized to forward slashes (valid on all platforms).

  • Fixed settings rows crashing native text truncation when a malformed config value reaches the renderer as a non-string ()


What's Changed



  • fix(coding-agent): handled <bunfs-root>/<binary> in __computeBunfsPackageRoot by

  • fix(mcp): omit unused optional tool args by

  • fix(task): treat maxConcurrency 0 as unbounded in spawn semaphore by

  • fix(providers): honor llama.cpp per-model context windows by

  • fix(tui): deliver notifications under tmux via DCS passthrough + BEL fallback by

  • fix(tui): runtime Hangul Compatibility Jamo width override + Ghostty detection by

  • fix(catalog): restore Umans GLM-5.2 max reasoning by

  • fix(agent): clamp provider context images by

  • fix(cli): register marketplace plugin installs by

  • fix(agent): size snapcompact maxFrames by the live model window by

  • fix(tui): reduce large transcript stalls by

  • fix(tui): include tiered Codex usage limits by

  • fix(cli): keep tiny-model downloads alive by

  • fix(usage): dedup provider-wide notes and add report-level notes field by

  • fix(welcome): replace stale ? shortcut with /hotkeys in tips panel by

  • fix(tui): stop OSC 11 poll from wiping text selection by

  • fix(tui): @-path autocomplete on Windows for paths outside cwd by

  • fix(cli): profile-alias installer produces correct paths for POSIX shells on Windows by

  • fix: store slash commands in input history by

  • fix(tui): theme-aware welcome tip line for light-theme legibility by

  • fix(settings): prevent numeric config values from crashing settings UI by

  • fix(tools): stream tool downloads without Bun.write Response by

  • fix(coding-agent): clamp auto thinking to undefined for models without controllable effort by

  • fix(coding-agent): honor app.message.followUp chord in ask prompt-style editor by

  • fix(stats): dedupe forked-session entries to stop double-counting by

  • fix(memory): scope mnemopi entity extraction to user turns by

  • fix(tui): attach pasted file paths as local refs by

  • fix(coding-agent): restore TUI focus to live editor-slot owner when a fullscreen overlay closes by

  • fix(catalog,coding-agent): disable vision on non-personal Copilot endpoints ( in in ) by

  • fix(ai/ollama): clamp num_predict at the Ollama Cloud 65536 cap by

  • fix(providers): strip OpenRouter Anthropic reasoning replay by

  • fix(coding-agent): expose hashline edit path to extensions by


Full Changelog: v16.1.16...v16.1.17

Vollständiger Original-Bericht
Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf github.com.
↗ Original-Artikel auf github.com lesen
Wie bewertest du diesen Beitrag?
1 Klick Feedback
Teilen mit Netzwerk & Team:

Community-Analysen & Experten-Meinungen 0

Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf Eigene Analyse verfassen“!
Community Pulse: Relevanz-Einschätzung
1 Klick Experten-Votum
🔴 Akute Relevanz 0%
🟡 In Evaluierung 0%
🟢 Keine Auswirkung 0%
Spannende Innovation 0%
Verwandte Story-Cluster & Quellen (Vektor-KI)
Port 8095 Engine
1 Quelle
The Gemini desktop app is now available for Windows
1 Quelle
ChatGPT automatically logged out [Fix]
1 Quelle
Windows 11 just dropped the tool ransomware abused, Microsoft says don’t restore WMIC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten v16.1.17

Thematisch verwandte Begriffe: v16117 · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...