OMP (Oh My Pi)

Where it stands, 2026-10-13

In stable 18.10.4, OMP lets extensions reopen plan review, revise the plan and approve execution. An extension can answer while the terminal picker remains open; the first answer wins. An extension can approve execution while a person is still reading the plan.

Install stable 18.10.4 in a repository you inspected. Use bun install -g @oh-my-pi/pi-coding-agent@18.10.4 or the Homebrew formula at 18.10.4 with brew install can1357/tap/omp. Pin Nix with nix run github:can1357/oh-my-pi/v18.10.4; the package takes its version label from the selected source.

Check a binary against GitHub’s matching checksum. Since 18.9.0, binary installation uses Stencil’s build service and checks SHA-256. Compare with GitHub’s 18.10.4 checksums. A hash supplied by the same download service detects corruption. It cannot independently authenticate that service’s bytes.

Close older Windows sessions after upgrading to 18.10.4. 18.10.0 made daemon transport owner-only and requires closing older sessions.

Before rollout, review who can approve and configure the work, set upgrade contracts, and choose how much work to delegate.

Decide who can approve and configure the work

Inspect project inputs before first launch. OMP loads them without trust approval, project config outranks global policy, and approval defaults to yolo. Read .omp, package extension declarations, hooks, commands and project tools. Put approval and provider exclusions in runtime controls or a --config overlay above project config. For project MCP exclusion, use nested YAML: mcp: { enableProjectConfig: false }.

Restrict which extensions can answer. Inspect resolvePlanReview and openPlanReview, then disable extension discovery or use an exact trusted-extension allowlist. An extension can revise the plan file and approve execution. Edits in the review overlay take precedence over the extension’s revisions. Downstream tool policy still applies.

Audit extensions beyond their tool lists or import names. Handlers can add developer/system-priority context without changing displayed tool results, where the transport supports it, and rewrite finalized reply text in history without retracting streamed text. Inspect additionalContext, addAdditionalContext and assistant_message.

Test Pi extensions individually: Pi imports resolve to OMP’s bundled copies, whose isProjectTrusted() returns true; that check cannot be your OMP trust guard.

Choose Allow once for settings changes. The interactive agent can change approval policy through cfg://; yolo alone does not authorize it. Inspect the key and before/after values. Session grants span keys; a session-only grant asks on the first save, while a save grant covers later saves. Since 18.6.1, writable collab guests can answer these prompts, including persistence to global config. Share a control link only with someone allowed to save those settings.

Gate eval separately from shell commands. Bash patterns do not govern commands spawned through eval; AST rules add guidance after an eval-bridged call. Set tools.approval.eval: prompt or deny when those boundaries matter. The computer API is off by default, and its read-only guard is not a general JavaScript sandbox.

Read full tool content in the transcript before approving a compact prompt. The 18.10.4 dialog makes Enter inert and guards Ctrl+Enter or Ctrl+Q for half a second.

Keep credentials out of plugin URLs. Non-GitHub Git specs are sanitized, while GitHub specs still reach Bun unchanged. Inspect existing ~/.omp/plugins/package.json and lockfiles on any version. Rotate any embedded credentials you find.

Set contracts before rolling out the upgrade

Restore task validation for machine consumers. Set task.structured: true before upgrading: 18.10.2 changed task results to plain text by default. Eval agent() and workpool() spawns remain structured independently.

Update custom callers and stored prompts before rollout. These inputs were removed:

• hub was removed in 18.3.0; use wait and write proc://<id>/kill.
• Remove per-call model fields from task, eval agent() and workpool() in 18.8.2 and later; replace task complexity with solutionSpace.
• Replace SM edit headers with *** Edit File:, *** Find and *** Replace, and remove irc.timeoutMs.
• Remove providers.openai-codex.codeMode and providers.openai-codex.codeModeDirectTools; 18.10.4 uses the full direct tool surface. Recheck direct-tool policy.

Check provider routing separately from account pools. 18.4.1 fixed excluded-provider fallback routes; 18.6.3 stopped headless restore silently switching models, while interactive fallback remains possible.

Named-agent OAuth pools restrict identities for listed providers, and 18.9.0 stopped quota recovery spending excluded accounts’ saved reset credits. Pools do not choose providers; custom SDK getApiKey resolvers bypass them. Inspect model/fallback settings, SDK resolvers and pool membership.

Check context pricing before reusing numeric compaction limits. Per-model numbers are scaled bases; a base above the standard window can enable extended-context pricing even when the scaled trigger falls below it. Inspect /models previews. Use f400k for an exact 400K trigger, subject to the model-window cap.

Turn off cache warming if idle provider requests are unwanted. OMP added cache warming, with providers.cacheWarming: idle on by default. Set it to off to stop those replay requests.

Choose whether saved output must be complete. Bash, Python and JavaScript eval artifacts default to a 16 MiB cap, keeping the beginning and rolling tail. If they feed an audit or parser, inspect truncation notices. tools.artifactMaxBytes: 0 disables the cap, at the cost of unbounded storage.

Choose how much work the agent can operate

Give parallel sessions separate working trees. For fresh interactive sessions, set worktree.onStart: create or ask; startup defaults off and exit defaults to keep. bash.gitGuard defaults off and covers only embedded-shell git, with a conflict-resolution exception; path-invoked git, pty, services and other programs bypass it. Use default-on status in compatible terminals to find sessions waiting for a decision, reducing the need to poll panes.

Decide whether agents should operate your IDA installation. Discovery is on when a compatible local installation is found, exposing persistent Python execution and project-shared databases. Disable ida.enabled or set tools.approval.ida: prompt if that access is unwanted.

Transfer credentials separately from session state. omp session pack and omp session unpack transfer artifacts; omp session moved makes the source copy fork on resume. omp auth export writes plain JSON with live refresh tokens, and destination refresh can sign out the source. Use a protected transfer path. An ordinary transcript is a poor place for a sign-in.

What is unresolved

• Project trust: whether a pre-load trust gate will ship. A tagged loading path and tests showing project inputs blocked until trust is decided would change the first-run advice.
• Narrower delegation: whether restricted plan responders and key-scoped cfg:// grants will ship. Tagged controls and tests showing unapproved responders and unrelated keys refused would justify delegating less authority.
• Stable approval steering: Keeping the input box open during approval and denying pending calls when you redirect the agent is available only on main, not in stable 18.10.4. A published release containing that commit would confirm availability for stable users.
• GitHub plugin credentials: which release, if any, strips credentials before forwarding GitHub specs. A tagged fix and regression test covering that branch would settle that install behavior.
• Production-relay retention: OMP’s documentation says the relay retains only live-connection state and that its Go source and binaries are unpublished. The hosted service’s retention behavior remains unverified here. An independent audit of the deployed service would test that statement; published source would make the intended implementation inspectable.
• Review payoff: whether programmable review improves verified outcomes per unit of human attention on your workload. A bounded trial recording outcomes, review time and exceptions would answer that question for the workload tested.

With plan review and settings changes available to software, OMP can automate more of the work around a coding turn. The time-saving bet is to spend fewer minutes on routine approvals and more on choosing the reviewer and its limits. Test that bet with verified outcomes, review time and exceptions.