Omnigent

On 2026-10-13, Omnigent shipped stable 0.18.0 with reusable agent installs. That puts a trust decision in front of omnigent agent add: whose tools are you willing to run?

Where it stands, 2026-10-13

Install stable 0.18.0. Use uv tool install omnigent==0.18.0 on Python 3.12 or newer. Avoid the 2026-10-13 nightly, which predates the security fixes.

Patch execution hosts and servers. Restart affected agents and helpers. Before this fix, code inside affected Linux bubblewrap sandboxes could compromise the launcher and execute as Omnigent’s host OS account. On multi-user servers, an authenticated importer who knew another user’s host ID could run an agent as that host’s OS account if the host was connected and its required harness configured. Until patched, use the bubblewrap advisory’s disposable VM or container workaround without sensitive host credentials or mounts.

Verify the running CLI version and container image. Homebrew reached 0.18.0 on 2026-10-13, but the desktop app launches a separately installed CLI. Docker compose defaults to latest. Check the running image digest and its fixed source before declaring the upgrade complete.

Migrate uploaded source tools before rolling out on shared servers. On multi-user servers, v0.18.0 rejects bundles containing server-side Python or TypeScript tools, nested agents included, closing code execution during tool discovery with runner privileges. Replace those tools with services exposed through the Model Context Protocol (MCP), upload the replacement and start new sessions; re-uploading does not rewrite existing sessions.

Review a reusable agent as software before installing it. Install a GitHub package with omnigent agent add owner/repo, then start a new session. Trusted single-user/local bundles retain Python and TypeScript source tools. Read the tools, policies and MCP services before confirming. Avoid scripting --yes for repositories you do not control.

Reuse moves the work from writing an agent to deciding whose code you trust.

Give Edit only to people you trust to run code through the agent. Ordinary editors cannot use the raw environment shell, but still answer pending approvals. v0.18.0’s public Edit opt-in can extend that authority to signed-in users with the link on sessions shared publicly with Edit. Keep public_sharing_max_level at its read default, especially for workstation sessions.

Review launch settings before handing over an unfamiliar repository. Omnigent sets enableAllProjectMcpServers for Claude Code. Read .mcp.json: the maintainer reports pre-approval of previously undeclined servers, with local server processes starting at launch. It also persists workspace trust in Claude Code’s global configuration. For Codex, a launch without explicit settings selects auto_review; set permission, sandbox and reviewer choices explicitly before launch.

Fewer startup dialogs put more weight on setup review.

Set delegated-work budgets on the top-level (root) session and allow for overshoot before each turn’s spend is recorded. Since v0.15.0, stored root-session policies reach native children. For priced usage, omitted or empty expensive_models stops every model at the cap; a nonempty list blocks only named tiers. Checks use spend reconciled at turn boundaries, so a turn can overshoot the cap.

Decline missing-price approval when the cap must hold. Nonzero reported tokens with no total_cost_usd key trigger an approval request, unless already approved. One approval covers the spawn tree while that condition holds; checks resume when total_cost_usd is present. Choose models with catalog prices before delegating budget-sensitive work.

Measure shell approvals before leaving runs unattended. v0.18.0 closes bypasses using Git global options and other shell forms. With github_policy attached, heredocs and substitutions require approval even for ordinary commands; block_working_dir_changes uses its configured action, blocking by default.

Test representative commands and budget attention for the approval queue. Keep independent filesystem and credential restrictions.

Put rules that must stop execution before the tool call. On evaluation timeout, checks on responses and tool results in the harness scaffold stop blocking after at most 120 seconds. A check after execution cannot undo a completed side effect.

Integration checks for custom and brokered deployments

Test integration compatibility before upgrading. Test custom cost policies against user_daily_cost becoming a list, Python clients against list_items() and child_sessions() returning PaginatedList, and skills against directory-name invocation and compatibility fallbacks. The switch-agent endpoint returns 410 from v0.17.0. Fork where supported or start another session, since some managed deployments disable fork controls.

Configure brokered Databricks Codex before migrating that executor. This path requires an active supported sandbox, explicit provider/profile, route grant and credential helper, and stable Codex 0.146.0 or newer, excluding prerelease and postrelease builds.

Try fresh managed sandboxes for recurring work and verify each run’s cap. Scheduled runs can request a fresh managed sandbox when the server supports it; the default remains connected_host. This can move work off a workstation. Check each new session’s budget: cap attachment failures remain nonfatal.

What is unresolved

• Test outage fallback in your harness before relying on it. Omnigent’s Claude Code and Codex tool-call hooks request approval when the policy server is unreachable. Whether the installed harness honors that answer in bypass or auto mode remains unverified. Run paired outage tests; record versions, permission modes, hook output and whether a harmless tool actually executes.
• Trace mixed priced/unpriced usage before trusting its budget behavior. It remains unverified when mixed histories of priced and unpriced usage trigger the missing-price approval request. Track token and cost records, aggregate context and approval decisions through the transition to priced usage.
• Use one budget period until independent accounting is tested. Correct weekly/monthly totals under the shared-record evaluator were not established. Compare each stacked cap’s evaluated total with independently calculated spend over its own date range.
• Wait for a containing stable tag before deploying the new credential brokers. Repository-scoped Git SSH grants and the managed MCP registry/gateway prototype were main-only at this cutoff, with no runtime probe. Require configured tests of granted repository operations and MCP credential use. For shared MCP turns, trace the initiating editor, policy actor and credential owner through the queue; queued-editor attribution remains limited.