chore: update changelogs

packages/coding-agent/CHANGELOG.md

@@ -5,16 +5,8 @@
 ### Fixed
 
 - Fixed all extension loading silently failing on the cross-compiled `omp-darwin-arm64` release binary (downloaded directly or via a Homebrew tap wrapper) because `__computeBunfsPackageRoot` mis-handled `import.meta.dir = "//root/omp-darwin-arm64"`. Bun 1.3.14 reports `<bunfs-root>/<binary-name>` for the compiled entry's `import.meta.dir`, but the pre-fix function joined `metaDir + "packages"` and produced `/root/omp-darwin-arm64/packages` — the binary basename was baked into every bunfs path, so the TypeBox/legacy-pi shims and every `@oh-my-pi/pi-*` package-root override failed `existsSync` validation and `resolveCanonicalPiSpecifier` fell through to a bunfs `Bun.resolveSync` that also could not find the module. The function now detects the bunfs-root + binary-basename shape (`path.basename(path.dirname(metaDir)) === "root"`) and strips the trailing binary segment by slicing the original `metaDir`; the production bunfs shim join path also preserves Bun's bunfs-native `//root` / `B:\~BUN\root` prefix that `path.join` would otherwise collapse. ([#3329](https://github.com/can1357/oh-my-pi/issues/3329))
-### Fixed
-
 - Fixed llama.cpp discovery to prefer per-model `/v1/models` `meta.n_ctx`/`meta.n_ctx_train` values, refresh selected models after lazy load, and bypass fresh-cache reuse so server restarts update context windows. ([#3310](https://github.com/can1357/oh-my-pi/issues/3310))
-
-### Fixed
-
 - Fixed `task.maxConcurrency: 0` serializing subagent spawns instead of running them unbounded. The settings UI labels `0` as "Unlimited", but the session-scoped spawn `Semaphore` clamped `max` via `Math.max(1, max)`, so the second subagent body in a batch always waited for the first to release the seat. The constructor now treats `max <= 0` (and any non-finite input) as unbounded via `Number.POSITIVE_INFINITY`, matching the eval `parallel()`/`pipeline()` worker-pool semantics ([#3305](https://github.com/can1357/oh-my-pi/issues/3305)).
-
-### Fixed
-
 - Fixed MCP tool calls forwarding empty optional placeholder arguments (`""` and `{}`) to `tools/call`; optional placeholders are now omitted while required fields and meaningful falsy values are preserved. ([#3302](https://github.com/can1357/oh-my-pi/issues/3302))
 
 ## [16.1.16] - 2026-06-23

python/robomp/src/git_ops.py

@@ -1,9 +1,10 @@
 """Low-level git primitives with ephemeral PAT injection.
 
-The PAT is supplied through `git --config-env=http.extraHeader=ENVVAR`. Git
-expands the env var inside the spawned process; the secret only appears in
-the spawned process's environment, never in argv visible to other UIDs via
-`/proc/<pid>/cmdline`. The env var is wiped from the parent after each call.
+The PAT is supplied through `git --config-env=http.<url>.extraHeader=ENVVAR`
+when a verified HTTPS remote is known, or the legacy global `http.extraHeader`
+path for older direct callers. Git expands the env var inside the spawned
+process; the secret never appears in argv visible to other UIDs via
+`/proc/<pid>/cmdline`.
 
 Used by:
 - `robomp.sandbox.LocalGitTransport` for in-process git operations when no