In OMP, the repository you open can write the policy that governs it
At v18.2.8 OMP's extension types say project-local .omp/config.yml and .omp/extensions "are already discovered and loaded unconditionally" and that isProjectTrusted "always returns true"; the approval docs list yolo as the default mode and project config above global config in precedence. A Pi extension that consults Pi's per-directory trust gate is told the project is trusted. v18.2.1 (2026-09-15) closed a cluster of approval bypasses, including a tool run with no approval context being treated as approved, and a view-only collab link that could steer a session after the host reconnected. None got an advisory.
What this changes for operators
- Do not open an untrusted repository in OMP. Inspect .omp/config.yml, .omp/extensions and package.json omp.extensions or pi.extensions in any clone first.
- Upgrade to v18.2.1 or later for the approval and collab fixes. Do not reuse a Pi extension’s trust check as a guard under OMP. This is a fact about OMP; Pi has had a trust prompt since June.
Primary sources
- tagged_commit_file 2026-09-21-omp-a-repository-under-review-can-write-omp-s-policy-project-local-config-and-extensions-load can1357/oh-my-pi / packages/coding-agent/src/extensibility/extensions/types.ts#L508-L520
- github_release 2026-09-21-omp-v18-2-1-closes-a-cluster-of-approval-bypasses-including-one-where-a-missing-context-resolv can1357/oh-my-pi / v18.2.1
- merged_pr 2026-09-21-omp-v18-2-1-closes-a-cluster-of-approval-bypasses-including-one-where-a-missing-context-resolv github.com/can1357/oh-my-pi/pull/11400
- commit 2026-09-21-omp-collab-relay-sessions-a-view-only-link-could-steer-the-session-after-a-host-reconnect-fixe github.com/can1357/oh-my-pi/commit/156093b9a1de550a553625f16517d180a330be4b
- tagged_commit_file 2026-09-21-omp-collab-relay-sessions-a-view-only-link-could-steer-the-session-after-a-host-reconnect-fixe can1357/oh-my-pi / docs/collab.md
Signal metadata
Source findings
- 2026-09-21-omp-a-repository-under-review-can-write-omp-s-policy-project-local-config-and-extensions-load 2026-09-21-omp-a-repository-under-review-can-write-omp-s-policy-project-local-config-and-extensions-load
- 2026-09-21-omp-v18-2-1-closes-a-cluster-of-approval-bypasses-including-one-where-a-missing-context-resolv 2026-09-21-omp-v18-2-1-closes-a-cluster-of-approval-bypasses-including-one-where-a-missing-context-resolv
- 2026-09-21-omp-collab-relay-sessions-a-view-only-link-could-steer-the-session-after-a-host-reconnect-fixe 2026-09-21-omp-collab-relay-sessions-a-view-only-link-could-steer-the-session-after-a-host-reconnect-fixe
Featured in
- Before the First Turn / 2026-09-21
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-09-21-omp-the-repository-writes-the-policy
Research evidence and publication history are open in the repository.