Evidence record / omp
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-08-10-omp-omp-added-an-exact-path-extension-allowlist-that-bypasses-ambient
OMP added an exact-path extension allowlist that bypasses ambient discovery.
A --trusted-extension <absolute-path> CLI flag loads an exact extension-module allowlist and bypasses ambient extension discovery entirely. The same release carries a breaking change: the re-exported zod API is replaced by an omptype-backed compatibility facade (@oh-my-pi/omptype/zod), so plugins keep the Zod-style builder interface but real Zod-specific APIs are gone.
Channel: tagged-release. Ancestry: Published GitHub release https://github.com/can1357/oh-my-pi/releases/tag/v17.2.10, published_at 2026-08-06T12:28:54Z, prerelease=false; tag v17.2.10 -> 43c1b245e79f845c7ed7c692b79b4acd0f5c56af; npm published 17.2.10 at 2026-08-06T12:33:09Z. Changelog entry pinned at https://github.com/can1357/oh-my-pi/blob/v17.2.10/packages/coding-agent/CHANGELOG.md.
Operator consequence: Try --trusted-extension if you run OMP against repositories you do not control. Ambient extension discovery walks configured roots, and OMP's rule discovery already reads in-workspace config (.omp rules, plus Cursor, Windsurf, Cline and GitHub rule providers, per docs/rulebook-matching-pipeline.md at v17.3.5), so a repository under review has surface to influence agent behaviour by default. An explicit absolute-path allowlist is the flag that closes the extension half of that. Adapt any plugin importing Zod-specific APIs before upgrading.
Receipt
Finding metadata
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
Finding ID: 2026-08-10-omp-omp-added-an-exact-path-extension-allowlist-that-bypasses-ambient
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact