GitHub Release: can1357/oh-my-pi v18.20.0 (13.11.2026)

@oh-my-pi/pi-agent-core

Changed

• prepareCompaction() runs as the compaction.prepare loop phase, so a ui.loop-blocked stall from a cold token walk over a long branch names compaction instead of "unknown" (#15027, #18867 by @wolfiesch)

@oh-my-pi/pi-ai

Added

• Added the google-decisions judgment API for Google's Gemini Decisions API (gemini-decision-1), with text and image input (#19060 by @kevcube)


• Added apiKey to successful OAuthAccessResolution results from oauth.accessById() and oauth.accessAll(): the key normal requests send for that account, which differs from accessToken for providers with structured credentials (#19030 by @Xytronix)


• Added an optional exemptionAlias to ToolCallLoopGuard so transport calls can match the dispatched tool's name in exemptTools (#18860)


• Added the liquid-systemone judgment API for Liquid AI's decision models, which rejects image sets over Liquid's 10,000 32×32-patch request cap before sending (#18076, #18100 by @SuperUserA)


• Added the nace-systemone judgment API for Nace's Drex decision models, which sends images as Drex's top-level images data URLs and replaces the base64 image, audio, video and PDF data URLs that Drex rejects in judged text with a description (#18950 by @alphastorm)

Fixed

• Fixed a spent Codex account retrying every minute for days when its siblings were only refused the requested model: their short model-policy blocks no longer count as a sibling becoming available, so the usage-limit wait follows the spent account's reset and model fallback can take over (#17637, #19019 by @wolfiesch)


• Auth-gateway client tokens (serve --clients) can no longer set who a request is from, who pays, or how the gateway reaches the provider: chat routes drop their request headers, userProfileId, initiatorOverride, metadata, serviceTier, cacheRetention and the other gateway-only options, while the gateway token keeps them (#19067 by @alphastorm)


• Fixed the auth gateway's /v1/pi/stream dropping taskBudget, include and anthropicPrefixMismatchBehavior, which its other chat routes accept (#19067 by @alphastorm)


• Fixed requests to Vertex AI Mistral partner models (mistral-medium-3, mistral-small-2503, codestral-2) failing because they were sent in Anthropic's request format (#19010, #19022 by @yuzu-octopus)


• Added Gemini's xhigh thinking level, sent on the Gemini API and Vertex for models whose ladder exposes it (Gemini 4 Hydrogen).


• Fixed omp failing to start with ENOTDIR: not a directory, stat '~/.aws/credentials' when ~/.aws is a file instead of a directory (#19083 by @iamshatter)

@oh-my-pi/pi-catalog

Added

• Added the Gemini Decision 1 judge model (google/gemini-decision-1, GEMINI_API_KEY); assign it to the judge role to use it (#19060 by @kevcube)


• Added Nace (nace) with the drex-max-v1.1, drex-max-finance and drex-v2.0 judge models and /login nace (NACE_API_KEY) (#18950 by @alphastorm)


• Added Gemini 4 Hydrogen (gemini-4-hydrogen) on Google, Vertex, OpenCode Zen, OpenRouter, Vercel AI Gateway, and Kilo, with low, medium, high, and xhigh thinking levels on the native Google transports.

Changed

• Factory Droid requests identify as droid 1.7.1 and report the interactive CLI as their surface, and prefix-bound Claude models (Opus, Sonnet and Haiku 5.5, Fable 5.1) on Factory's direct Anthropic route now ask Anthropic to drop stale signed thinking instead of rejecting a turn whose earlier context changed (#18771 by @will-bogusz)

Fixed

• Fixed alibaba-token-plan/qwen4-max-preview (including its qwen4.0-max-preview alias) showing no context or output limits, image input, or thinking levels (#18986).


• Fixed Vertex AI Mistral partner models (mistral-medium-3, mistral-small-2503, codestral-2) misrouting to the first-party Gemini endpoint; they now ride the publishers/mistralai raw-predict endpoint with ADC auth and an OpenAI-shaped body (#19010, #19022 by @yuzu-octopus).


• Added Liquid AI (liquid) with the d1.1 and d1-ultra judge models and /login liquid (LIQUID_API_KEY) (#18076, #18100 by @SuperUserA)

@oh-my-pi/pi-coding-agent

Breaking Changes

• secrets.yml regex rules are now Rust regex patterns run natively, in linear time: lookarounds and backreferences are no longer supported, and a (?P<secret>…) group marks the part to redact (text around it is context that stays); \d, \w and \s are Unicode-aware. A regex rule that does not compile stops startup with an error naming the file and entry instead of being skipped. Migrate (?<=password=)\S+ to password=(?P<secret>\S+); see docs/secrets.md (#18965 by @H4vC)


• Secret placeholders are now four camelCased words after the friendly name, e.g. GitHubToken_correctHorseStapleBattery, with no $$ delimiters, and the transcript shows the real value wherever the model wrote one. Placeholders in the old $$NAME_HASH:CASE$$ form, in sessions saved before this change, stay literal text, including in tool calls the model copies them into; start a new session to get working placeholders (#19014 by @H4vC)


• What the model writes from placeholders (replies, thinking, tool calls, summaries) is stored as written and replayed byte-identical, keeping thinking signatures and prompt caches valid; model output that still holds a value (written while redaction was off, or before the secret was configured) is redacted on replay. Values a regex rule finds later no longer rewrite earlier history. A friendlyName is shown to the model as written and is dropped only when it spells out its own secret (#19014 by @H4vC)


• Nix builds with withAppleFm = false no longer compile the Apple Foundation Models bridge with the host's Xcode (#18911)


• Apple Silicon Nix builds include Apple Foundation Models support instead of silently building without it (#16584 by @honsunrise)


• ask over RPC hosts without a form dialog now shows each prompt with the form's surrounding paragraphs, lists, preformatted blocks and tables instead of only the question (#18927)

Added

• Added the Gemini Decision 1 judge (google/gemini-decision-1) for the judge role, and models.yml accepts the google-decisions API (#19060 by @kevcube)


• ssh:// host listing, ssh:// autocomplete and /ssh list now include the Host aliases from ~/.ssh/config and /etc/ssh/ssh_config (following Include); ssh.json entries win on a name clash


• Added find.verifyModel, a model selector whose judge answers only find's passage verification while filename and sketch ranking stay on the judge role (#19006 by @alphastorm)


• Added omp bench --account to benchmark a specific stored OAuth account, and report rejected priority requests instead of silently benchmarking standard speed.


• Text a browser or computer call types into a page or app, such as a password, no longer appears in plain text in an eval cell's status lines or the session file (#18981 by @will-bogusz)


• Browser page-script observations in Tern and WebKit now mask password values, including values used as accessible names or descriptions (#18983 by @will-bogusz)


• Chromium main-world waitForFunction calls no longer expose Puppeteer's internal ARIA query bindings to page scripts (#18883 by @will-bogusz)


• On macOS a computer run that ends while secure input is on now starts with a note naming the app holding it and saying the user's Escape and typing go unseen until it ends, instead of nothing while capabilities() still reported globalEscape: true (#18982 by @will-bogusz)


• Windows computer runs now explain when a locked or disconnected session, or a secure desktop, prevents capture and input from confirming your app's state (#18947 by @will-bogusz)


• Computer helpers now reject unknown option and filter keys instead of silently ignoring them, including keys unused by the selected wait or element press overload, and name valid keys and likely spelling corrections (#18753 by @will-bogusz)


• Selector waits on Chromium-backed browser tabs and their frames now accept state: "attached" | "detached" | "visible" | "hidden" alongside Puppeteer's visible/hidden forms, including live snapshot refs and waits that span a navigation, and reject unknown options, invalid values or conflicting visibility flags instead of silently ignoring them. Frame wait timeouts remain catchable later in the same run; Tern and cmux tabs are unchanged (#18924 by @will-bogusz)


• Chromium main-world waitForFunction calls rearm across navigation after an earlier wait instead of rejecting with "Waiting failed" (#18884 by @will-bogusz)


• In Chromium browser tabs, tab.hover and element-handle hover() on a hidden match now wait for it to appear and, if it never does, fail with the reason (and a selector's match count), as clicks do, instead of failing at once with Puppeteer's "Node is either not clickable or not an Element" (#18750 by @will-bogusz)


• Treating the result of browser tab.console() or tab.errors() as an array now fails with a message saying to read its .entries, instead of slice is not a function, and the browser docs state the { entries, nextSeq, dropped } shape (#18738 by @will-bogusz)


• A printed browser tab.observe() result, including a full observation returned through tab.run() (not arbitrary objects with an elements array), or one left as a JavaScript Eval cell's last value, shows every element, one line each, instead of the first 100 followed by ... N more items; an observation changed after it returned, including in-place prototype edits, prints as plain inspect output, every element included (#18772 by @will-bogusz)

Changed

• Secret redaction no longer rescans the whole conversation on every request: text already redacted in an earlier request is reused until a new secret changes the outcome, and secrets.yml regex rules skip text missing their leading literal, cutting redaction on a large session from 17–55 ms to about 1 ms per request and the first request after loading by 2–4×


• Trimmed the default system prompt: the tool-choice rules now only point to read, edit and find; the reasoning-format, AST and subagent-limit guidance is gone (ast_edit/ast_grep state their preference in their own summaries); the workflow, delivery and critical rules are shorter and no longer repeat each other; Spotlight's note on how tool results are shaped is a short list under Tool I/O instead of a paragraph at the end; and xd:// devices are listed by bare name


• edit.modelVariants now picks the longest matching model pattern instead of the first, so a specific key like openai/gpt-5 wins over gpt whatever the config order (#17835 by @DeprecatedLuke)


• Browser tabs open in omp's own headless WebKit engine instead of managed Chromium when the engine, ABKit, is installed (~/.o2/lib/abkit/ABHost, ABHost.exe on Windows, the location Tern uses too; or the browser.webkitPath setting / PI_BROWSER_WEBKIT_PATH): pages see a visible, focused window with no automation flag, and a default tab runs no omp script in the page (console, errors and the request log come from the engine; route, geolocation/locale/offline emulation, vitals and reactEnable add page code only when called; response bodies are unavailable there). Chromium still opens headed tabs where the engine ships no viewer and takes over, saying why, when the engine cannot start; app: "chromium" picks Chromium for one open and app: "webkit" requires WebKit (with headed: true its tab opens in a window), and the browser.webkit setting or PI_BROWSER_WEBKIT=0 turns it off. On macOS the engine has WebGL, WebGPU, silent video and audio playback, Web Audio, WebRTC, WebAuthn, gamepads and Web Share, and its TLS handshake, HTTP/2 settings and request headers are the ones Safari sends


• omp downloads its WebKit engine, ABKit, from build.stencil.so into ~/.o2/lib/abkit (checked against the build's SHA-256) for app: "webkit" when it is missing, and before Chrome for Testing when an open finds no browser installed; a failed download leaves that open on Chromium and says why


• The task tool description now lists only the delivery rules (results auto-deliver, wait, unverified completed); the read proc://, write proc://<id>/kill, job-expiry and write agent:// reference arrives with the session's first spawn result


• The ask.timeout setting, README and RPC schema docs now describe the ask tool as an HTML form that submits its current values on timeout, not a question picker that auto-selects an option


• The bash tool description lists the embedded shell's in-process builtins again, straight from the shell, so it follows every PI_DISABLE_* switch and the platform


• read's selectors for SQLite, archives, JSON queries, executables, video and SVG, and the sub-path grammar of proc://, ssh:// and issue:///pr://, no longer ship with every request: the model reads them on demand at xd://read/sources and xd://read/urls, and they stay inline when read is off


• /browser visible and /browser headless now show and hide the windows of omp's WebKit tabs at once instead of waiting for the next open: where the engine ships its viewer (macOS), each tab gets a window of its own that the user can also click, scroll and type in, and headed: true or browser.headless off keeps a tab on WebKit with a window instead of sending it to Chromium. Chromium tabs still change mode with the next open


• In a Tern whose engine reads the DOM natively, browser observe, selectors, clicks, typing, element reads and waits no longer run script in the page: the engine finds elements (across frames and closed shadow roots) and every action is trusted input at the point it resolved; type then types at the caret its click places, and text/ selectors ignore case


• A browser screenshot's text is one line (the size the model sees, the full-size file when one was kept, and the coordinate factor for tab.clickAt) instead of four lines with byte sizes and formats, and browser.open reports the tab, the page it landed on when that is not the requested URL (using navigation's normalized URL comparison), and the title on one line (#18776 by @will-bogusz)


• RPC select requests carry initialIndex, selectionMarker, checkedIndices and markableCount, so hosts can show which ask checkbox options are already checked instead of letting users toggle them blind (#18929 by @andrebrait)


• Every language server now hands file watching to omp (it was only TypeScript 7); set watchFiles: false on a server to keep its own watcher


• A failed JavaScript Eval cell prints the error's message and the cell's own frames, with one line counting the hidden frames from omp's runtime, its dependencies and the engine, instead of the full host stack; project-local dependency frames stay visible, cached stacks whose headers no longer match the error stay intact, floating rejections retain their current message and missing-await hint even with a cached stack, and print(e.stack) in a catch still shows every frame (#18775 by @will-bogusz)


• Snapcompact compaction resolves the frame shape once in its preflight and passes it to compact(), which re-derived it with the auto shape setting; the preflight scans the transcript once instead of twice, runs as the compaction.snapcompact loop phase, and yields to the event loop before rendering (#15689, #18867 by @wolfiesch)


• Full session file rewrites (pruning, image drops, rescue stamping) run as the session.rewrite loop phase, so their stalls are attributed in ui.loop-blocked logs (#15027, #18867 by @wolfiesch)

Fixed

• With the Spotlight experiment on, a read with :raw returns the selected bytes instead of an outlined, compacted, collapsed or cut rendering (#18713 by @eggpeat)


• With the Spotlight experiment on, a ;/, path read is shaped as one call: each part as that read alone would be (an outlined source file beside a :raw part kept verbatim), no part collapsed as already shown against another, and one trace whose notice opens the original (#18713 by @eggpeat)


• Fixed false unknown-model fallback warnings on cold or stale caches for authenticated openai-codex, google-antigravity, and google-gemini-cli providers, stopped disabled cold-cache providers from deferring fallback warnings, and stopped lazy catalog loads from overwriting completed or failed discovery states (#19017 by @PGupta-Git)


• ACP clients such as Orca now show an ask HTML form's "Other" text box inside its radio/checkbox question instead of as a second, duplicate question (#19028)


• Fixed background jobs (&), subshells and command substitutions in the bash tool seeing changes the parent shell made after they started; they now keep the variables, positional parameters ($1, $@), functions, aliases and shell options they started with, as in bash (#19072 by @H4vC; reported in #18990 by @alphastorm)


• MCP tools returning lists or strings no longer repeat their payload in the model's context when the server also sends SDK-wrapped structured content (#18894, #18920 by @yuzu-octopus)


• In Chromium browser tabs, page.evaluate, evaluateHandle, $eval, $$eval and waitForFunction inside tab.run now see the page's own globals and custom elements, as tab.evaluate does, instead of null or undefined; waits support concise methods, poll at page-side intervals, reject invalid polling options, preserve abort reasons and stop polling on cancellation, disposing late results (#18751 by @will-bogusz)


• Fixed omp bench --account, omp dry-balance --bench, and security scans pinned to one OAuth account sending the raw access token to providers whose API key is a structured credential (GitHub Copilot, Gemini CLI, Antigravity, Snowflake); they now send the same key normal requests do (#19030 by @Xytronix)


• A hashline PUT whose body repeats the line just outside its range and otherwise leaves the range unchanged now adds that copy, instead of silently doing nothing while reporting an auto-repaired boundary echo (#18234 by @eggpeat)


• omp --help lists the tool names --tools accepts, grouped into enabled-by-default and optional; browser and computer use are documented as eval features (#19064 by @nibblebot)


• Added Liquid AI judges (liquid/d1.1, liquid/d1-ultra) for the judge role; images are resized to fit Liquid's per-request patch budget (#18076, #18100 by @SuperUserA)


• Added Nace Drex judges (nace/drex-max-v1.1, nace/drex-max-finance, nace/drex-v2.0) for the judge role, including Drex Max image judgments (#18950 by @alphastorm)


• Added the find.hitThreshold setting (above 0, up to 1; unset keeps 0.2): the probability a verified passage needs before find and omp find report its file or list its range, so a judge other than TypeSafe Jev can run at the cutoff that fits its calibration (#18963 by @alphastorm)


• GitHub Actions watches now show per-step progress, states, and durations, with Ctrl+O expansion and native Tern Surface Protocol views (#18945 by @anatoli-tsinovoy).


• Computer instructions now describe macOS StaleRef refusals for relabelled controls, including the new ref and the weaker role-and-label recovery candidate from a partial window read (#18892 by @will-bogusz)


• Computer-use guidance tells the agent to reread the window after UserIntervened on X11 as well as macOS, without undoing or replaying over the user's input (#18784 by @will-bogusz)


• Computer raise refusals say that on X11 a covered window's screenshot needs a compositing manager, instead of promising one plain X11 cannot supply (#18783 by @will-bogusz)


• The computer tool's takeover type on Windows no longer loses the end of the text in apps that read keys slowly, such as Chrome, while reporting success, and says in its output when the text was sent but the app was not seen reading it (#19037 by @will-bogusz)


• Fixed wait returning "Nothing to wait for" after a directly messaged agent sent an agent://all broadcast before replying, instead of blocking for its direct reply (#18976 by @alphastorm)


• Fixed the TUI marking pending or in-progress todos completed when a subagent with a matching or similar description finishes; matching todos still highlight while the subagent runs and are marked completed only through todo or /todo (#18975 by @alphastorm)


• Fixed worker-thread subagents logging Failed to bind extension … <inline-0> on every spawn and subagents reporting themselves to Warp as separate sessions; an SDK inline extension that worker threads cannot load now logs one warning naming it (#18980 by @alphastorm)


• Fixed the shell's ls builtin so non-numeric -T/--tabsize values (such as ls -laT dir, which previously listed the working directory) and overflowing -w/--width values with trailing non-digits now fail with exit 2 (#18985 by @alphastorm)


• Fixed read JSON queries (archive.tar:member.json?q=.x) on text archive members failing with not found inside archive while preserving literal ? member names and member or query-output line selectors (#18970 by @alphastorm)


• Fixed write LSP diagnostics warning that a #! script is not executable (such as Ruff EXE001) on calls that mark the file executable (chmod +x) (#18978 by @alphastorm)


• Fixed read xd://<tool> and write xd://<tool> for unambiguous wire aliases of enabled tools (such as xd://apply_patch when edit uses apply_patch mode) so they return tool docs, run with the tool's approval tier, and no longer fail with No such tool (#18977 by @alphastorm)


• Fixed yield rejecting a JSON-string data payload with expected object, received string when the decoded value fails the output schema; it now reports the decoded field violations (#18971 by @alphastorm)


• Fixed github run_watch marking failed-job logs unavailable when they contain ANSI or other terminal escape sequences, returning plain-text logs on both current and older GitHub CLI (gh) releases (#18968 by @alphastorm)


• Fixed edit results after lsp.formatOnWrite (or an editor's format-on-save) reformatted the file showing the lines as sent under the formatted file's [path#TAG]; the result now shows the written lines and no longer blames the editor (#18998)


• Fixed prewalk handing off to the cheaper model on exec-tier xd:// device calls (test runners, remote commands, extension devices) and on proc:// service stdin or mode writes, before any file was changed (#19002)


• TypeScript 7 (typescript-native) no longer runs its own file watcher: omp watches the files it registers and reports changes, including ones made outside omp, so on Linux it sees edits from other tools instead of keeping stale diagnostics, and on network drives such as ovnfs checkouts its watcher no longer loops, keeping the drive's file server busy and stalling every checkout on it. Other servers opt in with the watchFiles server setting (#18964 by @H4vC)


• Folders moved into a watched project now report their files to language servers, and folders moved out or renamed report their deletion, so servers no longer keep stale or missing files after mv or a package install


• Language servers that watch files through omp no longer get changes under node_modules packages or .git object stores unless they asked for those directories, matching VS Code's default watcher excludes


• On Linux, a project too large for inotify's watch limit is watched one directory at a time instead of losing all file watching, and on network drives a lagging server clock no longer hides changes found after a watcher overflow


• Fixed the grep tool so directly named files containing NUL bytes are searched as text, directory and glob searches name skipped binary files that match instead of reporting No matches found, and returned match and context lines strip NUL, ANSI escape, and control characters (#18988 by @alphastorm)


• Added the encourageEdits setting (default on), which makes the system prompt require the edit tool and forbid sed/perl/python file edits; turn it off to drop that guidance.


• A browser call from Eval that sets no timeout of its own, such as tab.evaluate(…) or tab.run(fn), now runs as long as the Eval cell's timeout instead of failing at 30 seconds, and a call that runs out of time says what happened to the tab and how to give it longer (#18737 by @will-bogusz)


• Cancelling a browser call now releases an unresponsive worker after its cancellation grace instead of waiting for the full call budget, and recovery after a timeout has its own bounded startup budget (#18737 by @will-bogusz)


• Cmux browser helpers now use the active browser call's remaining time instead of cutting long evaluations off at the socket's 30-second default or giving late helpers a fresh full timeout; cancelling discards queued helpers and interrupts active socket requests so later calls can proceed (#18737 by @will-bogusz)


• MCP tools called through write to xd:// devices now honor their device names in model.toolCallLoopGuard.exemptTools, in both the main agent and advisor (#18860)


• computer.close() no longer disables desktop control for the rest of the session: the next computer call opens a fresh desktop session instead of failing with Computer session is closed


• An extension provider with an oauth.modifyModels hook no longer loads the whole model catalog at registration while that provider has no login (#18821 by @iliaal)


• Saving each session entry no longer blocks the UI for several milliseconds on Windows, where on-access scanning delayed the two re-opens of the session file that every write performed (#18819)


• A retry.fallbackChains model key written with a dotted revision (anthropic/claude-sonnet-5.5) now applies to the model it names (#18951 by @wolfiesch)


• Sharpshooter consolidation no longer gets stuck retrying every minute once the memory files grow large: the output budget now fits three full files, a cut-off reply is reported as truncated instead of must call replace_memory_files exactly once, and failed runs back off (one interval, doubling up to 6 hours) (#18938)


• The advisor now backs off between failed turns (doubling per failure, with jitter) and waits for a provider Retry-After hint, instead of retrying every second in step with other sessions (#18957 by @joshuaswarren)


• In ACP mode, an ask form the client fails to show (e.g. a JSON-RPC -32602 for an unsupported field) now returns the client's error to the agent instead of reporting Ask tool was cancelled by the user and aborting the turn (#18887)


• omp update runs mise, Homebrew, bun, and npm on the terminal's own output, so their progress bars redraw in place instead of printing every frame as a new line (#18874 by @a-glapinski)


• Fixed Anthropic prompt caching freezing for the rest of a turn when a context extension rewrites messages the same way on every request (for example a stable tag prefix on each message): every rewritten message was marked per-call, so the rolling breakpoint could not land on anything the tool loop appended and each step re-billed the whole tail as uncached input. A rewritten message is now per-call only once its bytes differ from the previous request; streamed assistant messages are no longer marked per-call just because structuredClone dropped their streaming symbols (#12392, #18869 by @tsankotsanev)

Removed

• Removed task.file and the task tool's taskFile field; subagent instructions are always inline


• Todo tasks can no longer be blocked: the blocked status and blocker note are gone from the todo tool, /todo edit ([!] is now an unknown marker), the HUD, ACP plans, goal continuation (which no longer pauses on a blocked-only list) and the RPC TodoStatus/TodoItem wire types and SDKs (Go, Python, Rust). A saved todo list that still holds a blocked task reads back with it pending on resume

@oh-my-pi/pi-mnemopi

Fixed

• Fixed fact extraction storing decimals, prices, and IP-address fragments as version facts and leaving symbols such as → in metric fact keys (#18886)

@oh-my-pi/pi-natives

Breaking Changes

• typeText and axType resolve to { unconfirmed, focusReturn } on every platform instead of the takeover focus report; only Windows takeover typing sets unconfirmed, saying why the target was not seen reading the typed text (#19037 by @will-bogusz)

Added

• DirectoryWatcher watches a directory on Windows through ReadDirectoryChangesW on its own thread and reports changes in batches with their action (added, removed, modified, renamed) and lost-change signals, without dropping changes during bursts as fs.watch does there (#18964 by @H4vC)


• DirectoryWatcher changes say whether their entry is a directory, and close() returns without waiting for the watcher thread to cancel its reads (a network round trip on shares)

Fixed

• Fixed grep() so directly named files containing NUL bytes are searched as text, and directory or glob searches list skipped binary files whose content matches in GrepResult.binaryMatches (#18988 by @alphastorm)


• Fixed computer.apps.open on macOS returning window: null for an HTML file with its own <title>, or a page's window still titled with the previous tab: it now returns the browser window once it shows the page, with the page's title, including without Accessibility permission or when AX window/subrole reads fail; a hidden file-extension display name no longer selects an unchanged unrelated window, and root folders retain immediate display-name matching (#18743 by @will-bogusz)


• Fixed the macOS computer tool typing into or pressing a different control than the ref named, and reporting success, once the app reused the control's element (Contacts put the city in the street field): the call now sends nothing and fails with StaleRef, naming the control that now reads as the ref did when there is one (#18892 by @will-bogusz)


• macOS relabelled-ref recovery also works for refs read from the desktop and searches the owning window once. Ref checks ignore unrelated identity-read failures, skip unused action-name queries, and refuse background input if the user brings its app forward during the check or a later window lookup (#18892 by @will-bogusz)


• Windows setValue() now detects readable value mismatches and notifies the app for native combo changes without repeating unchanged selections. Hidden or unavailable read-back retains success after a successful write; unsupported combos and unsafe message dispatch are refused, and native messages are timeout-bounded (#18915 by @will-bogusz)


• Fixed the Linux computer tool hanging for the rest of the session, and freezing the app, once a press() or menu.select() opened a modal dialog in a GTK 3 app such as Audacity: reads of an app that does not answer now fail with Timeout after 5 s while screenshots and input keep working (#18914 by @will-bogusz)


• Fixed responsive Linux AT-SPI windows disappearing when enumeration takes longer than 5 s in total: the timeout now applies to each application reply, not the whole window scan (#18914 by @will-bogusz)


• Fixed responsive Linux AT-SPI focus, window-ownership and hit-test scans timing out in aggregate; traversal replies are now bounded individually while single-element reads and mutations retain their operation budgets (#18914 by @will-bogusz)


• Fixed Wayland desktop accessibility reads selecting a shell surface when the focused application did not answer: shell-only candidates now require confirmed keyboard focus before bypassing the skipped application's timeout (#18914 by @will-bogusz)


• X11 takeover now observes the first quiet interval, waits for held keys and pointer buttons to be released, drains intervention events before admission, focus changes and further input as well as through focus hand-back, and advertises itself unavailable if observation fails; physical Escape remains observable during keyboard grabs (#18784 by @will-bogusz)


• Fixed X11 takeover taking a typing user's keys: a window or element takeover now waits, without holding the input lock, until you have pressed no key or button for 5 s (failing UserIntervened if you are still at it near the run's timeout), and stops with UserIntervened at your first key or click once it has activated its target (#18784 by @will-bogusz)


• X11 takeover activation failures now ask the window manager to put your window back even when its active-window property has not caught up with core focus, and a press or Escape just after the activation request is sent no longer leaves the window manager switching to the target after the call returns; pointer hand-back no longer warps after your press or while a button is held (#18784 by @will-bogusz)


• Fixed X11 window screenshots showing whatever was on screen over the window: under a compositing manager they come from the window's own pixels with its own menus and tooltips, cut to their shapes, and otherwise a covered window is reported covered instead of returning the window on top (#18783 by @will-bogusz)


• macOS relabelled-ref recovery also works for refs read from the desktop or a display and searches the owning window once. Ref checks ignore unrelated identity-read failures, skip queries for unused action names or child labels, and refuse background input if the user brings its app forward during the check or a later window lookup (#19054 by @will-bogusz)


• Fixed Linux setValue losing its empty-field warning when a masked field was cleared and the replacement write timed out or was cancelled (#19050 by @will-bogusz)


• Fixed Linux setValue() with a number reporting success when the control clamped, rounded or ignored it, such as 150 on a 0-100 slider; it now reads the value back and fails naming what the control holds and any bound crossed, without printing an unbounded limit (#19047 by @will-bogusz)


• Fixed Linux menu.select() refusing every path below a Qt 5 or Qt 6 menu bar ("path traverses a command rather than a submenu") and menu.items() refusing a Qt menu: Qt holds a menu bar item's items in a popup menu, which is now read as that item's submenu, so menu.select(["File", "Save"]) presses the item with no menu opened (#19046 by @will-bogusz)


• Fixed a macOS takeover click on a suggestion list, such as Safari's password autofill dropdown, refusing without saying what works: pointer refusals now name the window the list is attached to and say a click without takeover reaches it, without suggesting a click for refused key input (#19027 by @will-bogusz)


• Fixed setValue on macOS failing with AxFailed when a password field read back as a mask exactly as long as the text written, although the text had landed (KeePassXC's Qt field); it now succeeds. Typing into such a field by accessibility insertion (el.type, win.type) no longer fails either. A mask of another length still fails (#19026 by @will-bogusz)


• Fixed X11 clicks, holds, drags and scrolls on a window, in the background and in takeover, reporting success while that app had a popup menu open, such as one an earlier session opened and left: the menu took the press and closed, and nothing reached the window. Such a call now fails with nothing sent, naming the popup (BackgroundUnavailable in the background, InputFailed in takeover); a press inside the popup or its submenus still goes through (#19044 by @will-bogusz)


• Fixed Linux X11 background keys and clicks going into the window you were using, while reported delivered, after a screen lock or a switch to another virtual terminal and back (#19023 by @will-bogusz)


• Fixed Windows takeover typing handing the foreground back before the target had read the typed keys, which sent the end of the text to the user's window while reporting success (a Chrome field kept 218 to 237 of 2,000 characters); typing now waits up to 5 s for the focused control's thread to read them, and unconfirmed says why when it could not see that (#19037 by @will-bogusz)


• Fixed setValue errors on macOS and Linux repeating the written text, which could expose a password typed into a field that did not report itself as a password field (#18989 by @will-bogusz)


• Fixed clicking an element of a macOS suggestion list, such as a row of Safari's password autofill dropdown, failing with AxFailed: AX element has no identifiable owning window (#19004 by @will-bogusz)


• Fixed macOS desktop capabilities claiming globalEscape while Secure Event Input is on (a focused password field, an authentication dialog, a terminal's secure keyboard entry), when macOS hides every key from the Escape and user-input monitors; capabilities now report secureInput and the holding app in secureInputApp (#18982 by @will-bogusz)


• Windows computer use now reports a locked, disconnected or secure desktop instead of leaving failed captures and undelivered input unexplained (#18947 by @will-bogusz)


• Fixed macOS key presses on non-US keyboard layouts pressing the wrong key: on French AZERTY cmd+a quit the app and cmd+z closed the window; shortcuts now use the keys your layout puts those letters on, and a failed layout read stops before sending keys (#18897 by @will-bogusz)


• Fixed Windows background shortcuts such as ctrl+s and ctrl+a, and Ctrl- or Shift-clicks, reporting success while classic Win32, WinForms and Qt apps got the plain key or click; background input holding Ctrl, Alt, Shift or the Windows key now throws BackgroundUnavailable with nothing sent, and the default backgroundFallback reruns it in takeover (#18895 by @will-bogusz)


• Fixed your running Qt 6.5+ apps crashing on Linux X11 when a computer session that used background window input ended or was cancelled, or after an omp process using it was killed (#18825 by @will-bogusz)


• Limited retained X11 background-input master pairs to two per display, clearing dead holders' focus even while their slaves unplug, reusing free pairs with keyboard locks and latches cleared, and falling back or refusing when both are busy without disabling later attempts; legacy pairs are neither adopted nor counted toward this limit because older omp versions can still remove them (#18825 by @will-bogusz)


• Fixed X11 background typing reporting success after losing keys during an X server stall; incomplete typing now fails and disables further background input for the session (#18828 by @will-bogusz)


• Fixed Windows element typing and key presses that ran in takeover, such as el.type() into a Chrome, Electron or WPF field, leaving the target window in front instead of handing focus back to the user's window; a user window switch before element focus now stops delivery instead of taking focus back (#18919 by @will-bogusz)


• Fixed macOS press() on a disabled control reporting success while the control ignored it; it now fails and says the control is disabled (#18898 by @will-bogusz)


• Windows menu selections that open a modal dialog no longer report a delivery timeout when the new dialog is responsive (#18922 by @will-bogusz)


• menu.select() and menu.items() on macOS, Linux and Windows now name the items a menu offers, escaping labels and marking disabled items and submenus, when a label in the path is not found; macOS waits for menu revalidation after activation before listing states (#18923 by @will-bogusz)


• Fixed Linux press() refusing with "AT-SPI action 'press' is unavailable" on Chromium and Electron menu items, list options and tabs, and on page elements whose only action is doDefault: a press now takes their select or doDefault action, as it already took click and activate (#18921 by @will-bogusz)


• macOS input from a second omp process no longer refuses with UserIntervened after the first process takes over a click in the same app; hardware clicks still pause input in that app (#18896 by @will-bogusz)


• Fixed omp worktree add — and the bash tool's git worktree add rewrite — exiting 1 with git: 'hook' is not a git command on Git older than 2.36 (such as Git 2.34 on Ubuntu 22.04) after the worktree had already been created (#18935 by @Bensonluo)

@oh-my-pi/snapcompact

Added

• resolveShapeAndScan() returns the auto-picked shape together with its scanRenderability() verdict, reusing the scan auto resolution already runs; exported ShapeScan and RenderabilityScan types (#15689, #18867 by @wolfiesch)

Changed

• compact() splits its synchronous work into two compaction.snapcompact loop phases (building the archive source, then planning the layout) with an event-loop turn between them, shortening the longest main-thread block on long histories (#15689, #18867 by @wolfiesch)

@oh-my-pi/omp-stats

Fixed

• Spotlight stats count a ;/, path read once with all its parts, and count a later read of any of its files as a re-read or a needed line (#18713 by @eggpeat)

@oh-my-pi/pi-tui

Added

• The Spotlight sheet of a ;/, path read shows each part as its own section, numbered from its file's lines with its own ranking (#18713 by @eggpeat)

Fixed

• Fixed grep tool results in ANSI and native Tern views to show a binary matches warning on both zero-match and matching searches (#18988 by @alphastorm)


• The /resume picker deletes sessions through the app.session.delete action (default Backspace or Delete) and shows its keys in the hints, so keybindings.yml can replace the shortcut, for example with Ctrl+D, or disable it with []; a bound key that also deletes backward, such as Backspace or Ctrl+W, still edits a typed search query (#17938, #18961 by @wolfiesch)


• Typing /job lists the jobs command first again instead of jumping whole-hyphen-segment skill matches like skill:…-job-… above it: inner-segment skill hits now tie (rather than outrank) command-prefix matches, so the tie keeps the popup command-first (#18891, #18916 by @yuzu-octopus)

What's Changed

• fix(github): capture run_watch failed-job logs with escape sequences by @alphastorm in #18968


• fix(yield): report decoded validation failures by @alphastorm in #18971


• fix(xdev): resolve enabled custom wire aliases by @alphastorm in #18977


• fix(write): set shebang execute bits before collecting diagnostics by @alphastorm in #18978


• fix(read): parse json selectors on archive members by @alphastorm in #18970


• fix(ls): reject invalid numeric option values by @alphastorm in #18985


• fix(coding-agent): stop worker subagents importing inline extension ids by @alphastorm in #18980


• fix(coding-agent): stop auto-completing todos when subagents finish by @alphastorm in #18975


• fix(wait): keep direct questions owed after broadcasts by @alphastorm in #18976


• feat(coding-agent,natives): watch LSP-registered files client-side, natively on Windows by @H4vC in #18964


• fix(computer): reject unknown helper option keys by @will-bogusz in #18753


• fix(natives): confirm every X11 virtual-keyboard key release, in order by @will-bogusz in #18828


• fix(coding-agent): run omp update installers on the terminal so progress redraws in place by @a-glapinski in #18874


• fix(browser): rearm main-world waits after navigation by @will-bogusz in #18884


• fix(mnemopi): stopped storing decimals as version facts by @roboomp in #18888


• fix(acp): surfaced elicitation rpc errors instead of user cancel by @roboomp in #18890


• fix(natives): refuse Windows background input that holds a modifier by @will-bogusz in #18895


• fix(natives): stop macOS input refusals between omp processes by @will-bogusz in #18896


• fix(natives): press macOS key chords on the keys of the current keyboard layout by @will-bogusz in #18897


• fix(tui): rank command prefix above inner-segment skill matches by @yuzu-octopus in #18916


• fix(natives): hand the foreground back after Windows element takeover input by @will-bogusz in #18919


• fix(mcp): stop delivering SDK-wrapped structured content twice by @yuzu-octopus in #18920


• fix(natives): press Chromium menu items, options and tabs on Linux by @will-bogusz in #18921


• fix(natives): confirm Windows menu commands that open modal dialogs by @will-bogusz in #18922


• fix(natives): name the menu items on offer when a menu bar path misses by @will-bogusz in #18923


• fix(browser): honor selector wait states and reject unknown options by @will-bogusz in #18924


• fix(coding-agent): send ask checkbox state on RPC select requests by @andrebrait in #18929


• fix(ask): carried form context into field-by-field prompts by @roboomp in #18930


• fix(natives): run the post-checkout hook on Git older than 2.36 by @Bensonluo in #18935


• fix(sharpshooter): stopped consolidation retry loop on truncated replies by @roboomp in #18941


• fix(coding-agent): match retry fallback chain keys by catalog model id by @wolfiesch in #18951


• fix(coding-agent): honor loop guard exemptions for MCP device writes by @SheetHappiness in #18954


• fix(advisor): back off between failed turns and honor the provider retry hint by @joshuaswarren in #18957


• fix(tui): honor app.session.delete in the /resume picker by @wolfiesch in #18961


• fix(coding-agent): keep text a cell enters out of browser and computer status lines by @will-bogusz in #18981


• fix(natives,coding-agent): report macOS secure input and stop claiming globalEscape under it by @will-bogusz in #18982


• fix(browser): mask password values in Tern kit observations by @will-bogusz in #18983


• fix(natives): never quote the written text when a setValue read-back disagrees by @will-bogusz in #18989


• fix(edit): rendered reformatted write results from the written text by @roboomp in #19000


• fix(prewalk): skipped hand-off on exec-tier devices and proc:// stdin by @roboomp in #19003


• fix(natives): own macOS suggestion-list elements by the window that lists them by @will-bogusz in #19004


• fix(browser): tell agents that treat console() or errors() as an array to read .entries by @will-bogusz in #18738


• fix(browser): hover on a hidden match waits and names the reason, like click by @will-bogusz in #18750


• fix(browser): print every observed element, one line each, instead of cutting at 100 by @will-bogusz in #18772


• fix(coding-agent): print a failed JavaScript cell's own frames, not omp's host stack by @will-bogusz in #18775


• feat(coding-agent): report browser screenshots and opens on one line by @will-bogusz in #18776


• fix(natives): stop X11 background input from crashing your running Qt 6.5+ apps by @will-bogusz in #18825


• fix(browser): keep main-world waits from exposing query bindings by @will-bogusz in #18883


• fix(natives,coding-agent): report unavailable Windows desktop sessions by @will-bogusz in #18947


• fix(natives): refuse a macOS press on a disabled element by @will-bogusz in #18898


• fix(grep): search targeted NUL-containing files as text and report binary skips by @alphastorm in #18988


• docs: correct jev-latest alias target to jev-1.14.0 by @alphastorm in #18948


• feat(ai,catalog,coding-agent): add Nace Drex judge provider by @alphastorm in #18950


• feat(find): add a find.hitThreshold setting for the hit cutoff by @alphastorm in #18963


• feat(find): add a find.verifyModel setting for the verification judge by @alphastorm in #19006


• feat(secrets)!: idempotent secret codec with word placeholders by @H4vC in #19014


• feat(secrets)!: native secret scanning and an idempotent word-placeholder codec by @H4vC in #18965


• fix(browser): give browser calls without a timeout the Eval cell's timeout by @will-bogusz in #18737


• fix(natives): return the window showing a page from macOS apps.open in a browser by @will-bogusz in #18743


• fix(browser): run tab.run page evaluations in the page's main world by @will-bogusz in #18751


• feat(ai,catalog): identify Factory Droid requests as droid 1.7.1 by @will-bogusz in #18771


• fix(natives): capture a covered X11 window from its own pixels, or say it is covered by @will-bogusz in #18783


• fix(natives): keep X11 takeover from taking a typing user's keys by @will-bogusz in #18784


• perf(compaction): split snapcompact main-thread block and label long sync phases by @wolfiesch in #18867


• fix(coding-agent): only mark context-hook rewrites per-call when their bytes change by @tsankotsanev in #18869


• fix(natives): refuse macOS element actions once the ref's element reads as another control by @will-bogusz in #18892


• fix(natives): keep an app that stops answering AT-SPI from hanging the Linux computer tool by @will-bogusz in #18914


• fix(natives): verify Windows value writes and notify combo selections by @will-bogusz in #18915


• fix(edit): keep hashline rows that repeat a boundary by @eggpeat in #18234


• fix(read): keep raw reads verbatim when output shaping is enabled by @eggpeat in #18713


• Fix: omp --help tool list by @nibblebot in #19064


• feat(ai,catalog): add Gemini Decision 1 as a native judge by @kevcube in #19060


• fix(coding-agent): defer fallback validation warnings when special provider discovery is pending by @PGupta-Git in #19017


• fix(ai): stop model-denied siblings from pacing a usage-limit wait by @wolfiesch in #19019


• fix(catalog): route Vertex Mistral partner models to publishers/mistralai by @yuzu-octopus in #19022


• fix(natives): keep X11 background input out of your window after a screen lock or VT switch by @will-bogusz in #19023


• fix(natives): report a setValue that reads back as a same-length mask as done, not failed by @will-bogusz in #19026


• fix(natives): name the background route when takeover refuses a macOS suggestion list by @will-bogusz in #19027


• fix(acp): named html form other companions __other by @roboomp in #19029


• fix(ai): account-pinned requests send the provider's API key, not the raw access token by @Xytronix in #19030


• fix(natives,coding-agent): stop Windows takeover typing from losing text the app had not read yet by @will-bogusz in #19037


• test(coding-agent): fix stream mock types in bench-auth-fallback tests by @eggpeat in #19038


• fix(natives): refuse X11 presses outside an open popup of the app by @will-bogusz in #19044


• fix(natives): let Linux menu.select walk into Qt apps' menus by @will-bogusz in #19046


• fix(natives): read back AT-SPI numeric setValue before reporting success by @will-bogusz in #19047


• fix(natives): preserve the empty-field warning on Linux write timeouts by @will-bogusz in #19050


• fix(natives): skip unused ref-check reads and recover display refs by @will-bogusz in #19054


• fix(ai): treat an unreachable AWS shared file as absent by @iamshatter in #19083


• feat(pi-shell): forked vprocs own copy-on-write process images by @H4vC in #19072


• fix(ai): drop upstream headers from scoped gateway clients by @alphastorm in #19067

New Contributors

• @tsankotsanev made their first contribution in #18869


• @nibblebot made their first contribution in #19064


• @PGupta-Git made their first contribution in #19017


• @iamshatter made their first contribution in #19083

Full Changelog: v18.19.0...v18.20.0