Evidence record / omp
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-omp-session-handoff-became-explicit-but-credential-export-writes-live-secrets-as-plain-json
Session handoff became explicit, but credential export writes live secrets as plain JSON. omp session pack/unpack transfers a session with artifacts and image blobs; moved marks the source copy so resuming it forks. Missing blobs are warned about rather than invented. omp auth export/import transfers stored sign-ins separately. Export writes plain JSON to stdout, including OAuth refresh tokens, refuses remote-broker configuration, and warns that refresh-token rotation on the destination may sign out the source machine.
Channel: tagged-release. Half: both. Date: 2026-10-12 (v18.10.0).
Operator consequence: Treat auth output as live credentials. Use a protected transfer path, not an ordinary transcript or an assumed encrypted backup. Mark the session source moved after a deliberate handoff, and account for possible source sign-out.
Receipt
- https://github.com/can1357/oh-my-pi/commit/3df76b1c6f1a92c9f64196701321be26045f329d
- https://github.com/can1357/oh-my-pi/blob/v18.10.4/packages/coding-agent/src/commands/session.ts#L1-L8
- https://github.com/can1357/oh-my-pi/blob/v18.10.4/packages/coding-agent/src/commands/session.ts#L66-L69
- https://github.com/can1357/oh-my-pi/blob/v18.10.4/packages/coding-agent/src/commands/auth.ts#L202-L225
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-omp-session-handoff-became-explicit-but-credential-export-writes-live-secrets-as-plain-json
Profile citations
- omp / claim / session-and-auth-transfer
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-omp-session-handoff-became-explicit-but-credential-export-writes-live-secrets-as-plain-jsongithub.com/can1357/oh-my-pi/commit/3df76b1c6f1a92c9f64196701321be26045f329dtagged commit file2026-10-13-omp-session-handoff-became-explicit-but-credential-export-writes-live-secrets-as-plain-jsoncan1357/oh-my-pi / packages/coding-agent/src/commands/session.ts#L1-L8tagged commit file2026-10-13-omp-session-handoff-became-explicit-but-credential-export-writes-live-secrets-as-plain-jsoncan1357/oh-my-pi / packages/coding-agent/src/commands/session.ts#L66-L69tagged commit file2026-10-13-omp-session-handoff-became-explicit-but-credential-export-writes-live-secrets-as-plain-jsoncan1357/oh-my-pi / packages/coding-agent/src/commands/auth.ts#L202-L225
Versioned source: run artifact