GitHub Release: can1357/oh-my-pi v18.1.22 (14.09.2026)

@oh-my-pi/pi-ai

Fixed

• 400-request debug dumps now redact provider-specific auth headers (x-goog-api-key, x-amz-security-token, and any header whose name carries a key/token/secret), not just a fixed allow-list, so a shared dump can no longer leak a live API key (#12007).

@oh-my-pi/pi-catalog

Added

• Enabled assistant prefill support for Ollama models

Fixed

• OpenCode Zen GPT-6 Astra requests now use the Responses endpoint instead of failing through chat completions with HTTP 500 (#12030).

@oh-my-pi/pi-coding-agent

Breaking Changes

• Hub message/job waits now always use the adaptive window (5s, lengthening to 5m across back-to-back waits); removed the timeoutMs argument and async.pollWaitDuration setting.

Added

• Added a privacy warning to memory reports reminding users to review data for secrets before sharing
• omp git / /git: delete discards the selected file's changes (press twice to confirm) — in the sidebar on a file or whole directory, in the diff pane on the shown file; untracked files are removed, staged files reset to HEAD

Changed

• Pressing c on a /btw answer now shows a green "✓ Copied to clipboard" confirmation in the panel and history detail, and BTW history accepts Ctrl+/ to switch panes (#12052 by @H4vC).

Fixed

• Automatic session titles no longer draw from canned prompt examples.
• Sessions titled by a local Ollama model (e.g. LFM2.5) no longer stay unnamed when the model's chat template spends the whole output budget on reasoning.
• /debug memory reports now include numeric memory statistics instead of raw heap snapshots that could expose provider and MCP credentials.
• Multi-step logins (e.g. Perplexity email → code) now move the input field under the latest prompt instead of leaving it stuck beneath the first one.
• Todo updates made through Eval's tool.todo(...) now persist to the session, so they survive resume/rewind/fork and no longer trigger false incomplete-todo reminders.
• Native background security scans now accept provider-owned AWS authentication for Amazon Bedrock and Bedrock Mantle without requiring a stored OAuth account (#12013).

@oh-my-pi/pi-utils

Fixed

• Fixed extractRetryHint sleeping hours past the provider's stated wait when a timezone-naive reset at timestamp overshoots the relative retry hint: the skewed stamp is now ignored instead of winning longest-wins (#12070 by @H4vC).

What's Changed

• fix(catalog): route Zen Astra through Responses by @roboomp in #12032
• fix(ai): redact provider-specific auth headers in 400 dumps by @roboomp in #12010
• fix(security): support provider-native Bedrock auth by @roboomp in #12017
• feat(coding-agent): confirm /btw copies with visual feedback by @H4vC in #12052
• fix(utils): ignore zone-skewed naive reset-at past relative retry hint by @H4vC in #12070

Full Changelog: v18.1.21...v18.1.22