- Replaced usage of `ReturnType<typeof setTimeout>` and `ReturnType<typeof setInterval>` with the explicit `Timer` type across the codebase.
- Updated several type definitions and function signatures to use concrete types instead of inferred return types for improved clarity and maintainability.
- Migrated all wire protocol, schema definitions, and tools validation from Zod to ArkType across multiple packages.
- Updated extension runtimes, custom tools loader, and TypeBox compatibility shim to expose and use ArkType instances.
- Added a comprehensive ArkType migration guide, validation parity tests, and helper utilities.
- Removed redundant PDF asset routing and parsing implementations from the read tool.
- Added a new builtin rule definition file, `ts-no-inline-cast-access.md`, with AST patterns that flag inline cast member access and usage guidance.
- Registered the new rule in `src/discovery/builtin-rules/index.ts` so it is included in the built-in TypeScript rule set.
- Updated `ts-no-any.md` to recommend schema parsing at trust boundaries and clarified when to choose schema parsing, guards, or unchecked casts.
GitHub documents applyTo as a single comma-separated string (e.g.
"**/*.ts,**/*.tsx") and treats both ** and **/* as all-files. The rule
loader kept the whole CSV value as one glob and missed **/* for
always-apply. Split applyTo via parseCSV and include **/* as all-files.
Addresses review feedback on #2734.
Added GitHub Copilot instruction-file discovery to the github rule provider path, mapping applyTo frontmatter into always-apply or glob-scoped rules and avoiding duplicate always-apply prompt content when context imports the same file.\n\nFixes #2731
When a Claude plugin skill's SKILL.md frontmatter uses a display-style
name (e.g. `name: Understand Anything`), the synthesized slash command
inherited that text. `expandSlashCommand` splits the command at the
first whitespace, so `/understand` never resolved and the multi-word
form could not expand either.
Use `path.basename(path.dirname(skill.path))` so the slash command
always matches the documented `skills/<name>/SKILL.md` → `/<name>`
contract while the frontmatter still drives the description/body.
Fixes#2415
Add a default-off "auto-learn" loop. When `autolearn.enabled` is set, after the
agent stops a session controller nudges it to capture reusable lessons: durable
facts go to long-term memory and repeatable procedures become "managed skills" —
SKILL.md files written to an isolated ~/.omp/agent/managed-skills directory that is
discovered and surfaced like authored skills but never overwrites them.
Two tools back this:
- `manage_skill` — create/update/delete managed skills.
- `learn` — record a lesson, optionally minting/enhancing a managed skill in the
same call (requires a hindsight/mnemopi memory backend).
The nudge is passive by default (a hidden reminder rides the next turn);
`autolearn.autoContinue` instead auto-runs one capture turn at stop, and
`autolearn.minToolCalls` (default 5) gates trivial turns. Plan/goal-mode turns and
subagents are never nudged, and the controller re-checks the live setting at fire
time so a mid-session opt-out takes effect.
Isolation & precedence: managed skills are a separate lowest-priority discovery
provider, so an authored skill of the same name wins across every provider and
custom directory regardless of third-party toggles; a disabled higher-priority
authored skill can never hide a managed one, and managed never masks an enabled
authored skill. Managed names and descriptions are sanitized on both write and
read (control/format chars, angle brackets, and Markdown fences) before they render
into the system prompt, and the SKILL.md byte cap is enforced on the final
serialized file.
Default off → zero footprint when disabled.
Loaded Claude Code marketplace plugin SKILL.md files into the slash-command capability so Claude-native plugin docs like /understand work in autocomplete and invocation.\n\nAdded a regression covering OMP installed plugin registries and bare slash-command expansion.\n\nFixes #2415
Address review against GitHub Copilot CLI docs (add-custom-instructions):
- COPILOT_CUSTOM_INSTRUCTIONS_DIRS: each dir contributes AGENTS.md (context) and .github/instructions/**/*.instructions.md (recursive), per spec. Dropped the non-spec <dir>/copilot-instructions.md and the wrong top-level <dir>/*.instructions.md scan.
- Scan the project .github/instructions/ tree recursively ('within or below').
- Prompts: .github/prompts/*.prompt.md is a VS Code construct, not a Copilot CLI feature; dropped the fictional ~/.copilot/prompts/ user dir and reframed comments/descriptions accordingly.
The github provider only scanned the project .github/ tree, so Copilot CLI's user-global config was ignored. Add user-global instructions (~/.copilot/copilot-instructions.md), COPILOT_HOME relocation, COPILOT_CUSTOM_INSTRUCTIONS_DIRS (copilot-instructions.md + *.instructions.md), and prompt discovery (*.prompt.md in .github/prompts/ and ~/.copilot/prompts/).
Closes#1913, #1915, #1916.
Store MCP OAuth credentials under deterministic mcp_oauth:<url> ids in each
profile's agent.db with refresh material embedded, so a definition-only entry
in a shared project mcp.json resolves each profile's own credential instead
of profiles clobbering each other's auth.credentialId pointer.
- Refresh material is single-source: embedded credential fields win over the
config auth block (which may belong to another profile); legacy rows fall
back to the auth block wholesale
- Wire the 401 refresh hook off the resolvable credential, not the auth
block, so definition-only bindings refresh mid-session too
- The url-keyed fallback never overrides a pinned Authorization header
- Send prompt=consent by default (oauth.prompt to override, "" to omit) so
reauth can switch accounts past an active browser session
- /mcp reauth fails fast on stdio transports (with an mcp-remote ~/.mcp-auth
hint), probes http/sse without OAuth injection, GCs the superseded legacy
row only after the flow succeeds, and leaves definition-only entries
untouched on disk
- DCR-issued client secrets stay embedded in the stored credential and are
never written into config files; user-supplied secrets survive reauth
CLAUDE.md, AGENTS.md, GEMINI.md (and the other discovered context-file
flavors) all carry the @-import convention every other agent ships:
`@path/to/file` inside a memory file inlines that file's contents at
launch. The discovery loaders previously read the file content verbatim
and handed it straight to the system prompt builder, so a CLAUDE.md
whose entire body is `@AGENTS.md` shipped a single literal `@AGENTS.md`
line and Claude never saw the project rules.
Added discovery/at-imports.ts implementing the Claude-Code semantics:
relative paths resolve against the importing file's directory, `~/`
expands to home, recursion stops at MAX_AT_IMPORT_DEPTH (5) with cycle
detection, fenced code blocks and inline code spans are opaque so
`npm install @types/node` and `git@github.com` round-trip verbatim, and
missing files keep the literal @-token intact. Wired the expander
into loadProjectContextFiles so every provider that registers under
the context-file capability benefits without per-provider plumbing.
Fixes#2111
- Added a new built-in TTSR rule `ts-no-test-timers.md` that flags `Bun.sleep`, `setTimeout`, and `setInterval` usage in `*.test.ts` files.
- Registered `ts-no-test-timers` in the built-in rules index so it ships with default discovery providers.
- Updated builtin-defaults tests to enforce rule-name uniqueness and verify the new rule only matches in `*.test.ts` scopes.
- Added astCondition to rule frontmatter parsing and rule metadata, with AST-grep normalization.
- Updated TTSR bucketing so astCondition-only rules are treated as interruptible matches.
- Added ts-redundant-clear-guard as a built-in JS/TS tool rule for guarded clear* calls.
- Added AST snapshot matching in agent sessions with per-stream cache throttling and cleanup.
The github provider registered context-files (.github/copilot-instructions.md)
and instructions (.github/instructions/*.instructions.md), but no skills
capability — so .github/skills/<name>/SKILL.md, the layout GitHub documents
for Copilot Agent Skills, was silently never discovered. The skill://
URL resolved to 'Available: none' and nothing surfaced in the system prompt.
Register a skill capability on the github provider (priority 30, project-only)
pointing at .github/skills/ and reuse scanSkillsFromDir with
requireDescription: true to match the Agent Skills spec and the sibling
native/omp-plugins providers. Pin the wiring with a discovery test that
loads the skills capability scoped to the github provider against a temp
cwd containing a SKILL.md, and a negative case that drops a skill missing
a description.
Fixes#1906
Native user-level config discovery (MCP, skills, rules, slash commands, prompts, instructions, hooks, tools, settings, extensions, and the top-level SYSTEM.md/RULES.md/AGENTS.md) now resolves the user scope through getAgentDir() in builtin.ts, omp-extension-roots.ts, and the discovery-layer getUserPath() helper. A named profile sees only its own ~/.omp/profiles/<name>/agent config instead of the default profile's ~/.omp/agent leaking into every profile, matching the /mcp config writer and getMCPConfigPath("user").
discoverExtensionModulePaths now detects top-level symlinked directories that the native glob skips (follow_links=false) and synthesizes their index/package.json entry-point matches, so an extension shared across profiles via a symlink loads like a real directory. Symlinked extension files were already handled.
cli: check --tiny-worker on the profile-flag-stripped resolvedArgv, matching the adjacent --smoke-test check and launch routing.
- Converted compaction, branch, and handoff prompts to fragment voice.
- Replaced "You MUST" phrasing with bare "MUST" directives.
- Applied same rewrite to autoresearch and turn-aborted prompts.
- Warns against leaving `@deprecated` compatibility shims instead of finishing a refactor.
- Registered in the builtin rule index and covered by the defaults test.
The plugin:name prefix (e.g. hyperpiemia:whistle-rules) broke skill://
URL parsing because colons are ambiguous with port separators. Skills
from marketplace plugins are now registered under their plain names.
Name collisions are handled by the existing capability-layer dedup
based on provider priority ordering.
- Added 14 bundled TTSR rules (TypeScript and Rust conventions) embedded into the binary via the lowest-priority `builtin-defaults` provider.
- Extracted rule bucketing into `bucketRules` with support for `disabledRules` and `builtinRules` settings.
- Added `ttsr.builtinRules` and `ttsr.disabledRules` settings to control which rules are active per session.
Ordered recursively discovered Claude command files so root basename commands stay ahead of nested basename duplicates while nested files still get namespace aliases.\n\nFixes #1523
Kept recursive Claude command files invocable by their basename while adding colon namespace aliases for tools that install namespaced workflows.\n\nFixes #1523
Loaded Claude slash commands recursively and derived names from paths relative to .claude/commands so subdirectory commands match Claude Code's namespace format.\n\nAdded regression coverage for project and user command namespaces.\n\nFixes #1523
Marketplace and `omp plugin link` installs write to
`<plugins>/node_modules/` rather than to `extensions:` in settings,
so the original PR still missed their sibling skills/, hooks/,
tools/, commands/, rules/, prompts/, .mcp.json sub-trees. Wire
listOmpExtensionRoots to enumerate getEnabledPlugins(cwd, { home })
in addition to CLI-injected and settings-driven roots.
Adds an optional { home } parameter to getEnabledPlugins so the
discovery loader can pass through LoadContext.home for tempdir-rooted
tests. The getPluginsNodeModules/getPluginsPackageJson/
getPluginsLockfile helpers gain the same optional home overload so
they mirror getPluginsDir.
Per-PR review feedback: https://github.com/can1357/oh-my-pi/pull/1498
Bug 1: capability loaders in src/discovery/builtin.ts only walked
.omp/ and ~/.omp/agent/, so extension packages registered via
extensions: in settings or --extension on the CLI shipped their
skills/, hooks/pre|post/, tools/, commands/, rules/, prompts/, and
.mcp.json silently — the docs at omp.sh/docs/extension-authoring
advertise the opposite. Add a new omp-plugins discovery provider that
scans every configured extension package directory for those
sub-trees, plus a small omp-extension-roots helper that resolves the
union of settings-driven and CLI-injected roots. main.ts injects CLI
extension paths via injectOmpExtensionCliRoots before any capability
load.
Bug 2: install was never registered as a top-level subcommand, so
`omp install ./my-extension` was rewritten to `launch install
./my-extension` and forwarded to the LLM as an initial prompt. Add a
top-level install command that routes local paths to plugin link and
remote specs to plugin install. Extract the command table into
src/cli-commands.ts so tests can introspect registered subcommands
without triggering cli.ts's top-level await.
Fixes#1496
Adds optional autoloadSkills field to agent frontmatter that automatically loads listed skills when a sub-agent is spawned. Uses the same buildSkillPromptMessage + sendCustomMessage mechanism as interactive skill loading, queued via sendCustomMessage({ triggerTurn: false }) before the first session.prompt(task). No extra agent turns, no new injection path. Skills stay in listing for sub-resource access. Compaction behavior matches manual loading. Unknown skill names silently skipped.
Lore-id: f85fdbdc
Constraint: autoload must use buildSkillPromptMessage + sendCustomMessage, never modify systemPrompt or use contextFiles
Constraint: triggerTurn must be false to avoid extra agent turns
Rejected: append to systemPrompt | agent cannot distinguish skill content from own instructions
Rejected: contextFiles injection | agent sees opaque file blob, cannot discover sub-resources
Rejected: promptCustomMessage per skill | N extra agent turns with model inference
Directive: autoload skill names are resolved against parent session skill list at spawn time in task/index.ts
Tested: TypeScript compiles clean with tsc --noEmit
Tested: parseAgentFields parses array and CSV string frontmatter
Tested: parseAgentFields returns undefined for absent and empty fields
Not-tested: bun test cannot run locally due to missing pi_natives native addon (requires Rust toolchain)
Confidence: high
Scope-risk: moderate
Reversibility: clean
The native rule discovery provider only scanned the rules/ subdirectory under .omp/ and ~/.omp/agent/. The documented top-level RULES.md file (per https://omp.sh/docs/context-files) was silently ignored — neither ~/.omp/agent/RULES.md nor <repo>/.omp/RULES.md was ever read.
Load both as synthetic rules with alwaysApply forced to true (the whole point of RULES.md is to be reattached every turn). Project scope walks up from cwd to repoRoot using the same nearest-.omp/ search AGENTS.md uses.
Fixes#1266
`getProjectPathCandidates` walks up from cwd to repoRoot (or home as a
fallback). When cwd is anywhere under $HOME and no closer .git boundary
exists, that walk-up reaches the home directory and enumerates
`~/.agent/<segments>` and `~/.agents/<segments>` as project paths.
`getUserPathCandidates` then enumerates the very same directories as
user paths, so every skill/rule/prompt/command/AGENTS.md found there
loaded twice. The capability deduper marks the second copy as shadowed,
but the Extension Dashboard renders shadowed entries — so users see one
active + one greyed-out duplicate of every home-level skill.
Skip the home directory inside the walk-up while still terminating the
loop on it; ancestors above home are still visited if the cwd happens
to live above (e.g. monorepo `home: tempDir` test fixtures).
Tests:
- Drop the duplicated copy of `getProjectPathCandidates` from the
monorepo-skills test; import the real one so behavior stays in sync.
- Replace the old "walk-up stops at home when no repo root" assertion
(which encoded the buggy behavior) with one that pins the new
contract: home-level `.agent[s]/skills` are NOT enumerated as
project paths.
- Add an explicit regression assertion that project ∩ user candidate
sets are empty when cwd is under home.
Fixes#1116
The ClaudePluginManifest interface was missing the `commands` field
(the standard Claude plugin format), and resolvePluginDir only checked
the legacy `slash-commands` key. Plugins declaring their command path
via `"commands": "..."` silently fell back to the hardcoded
`<plugin-root>/commands/` directory, which doesn't exist for
Claude-format plugins, so no slash commands were ever loaded.
Changes:
- Added `commands?: string` to ClaudePluginManifest.
- Changed resolvePluginDir to accept ReadonlyArray<keyof
ClaudePluginManifest> and iterate in priority order; the first
non-empty match wins.
- loadSlashCommands now passes ["commands", "slash-commands"] so
the canonical Claude plugin key takes precedence over the legacy one.
- Added two regression tests: one covering the `commands` key in
isolation, one verifying its precedence over `slash-commands` when
both fields are present.
Fixes#1076
listClaudePluginRoots accepts a home parameter so callers (and tests)
can override the base directory, but the OMP registry path was constructed
via getPluginsDir() which always reads the global dirs resolver anchored
to os.homedir(). This caused every test that passed a temp dir as home to
receive the real user registry alongside the test fixture, producing
length mismatches (+1 root in every assertion).
Fix: add an optional home override to getPluginsDir(). The override only
short-circuits the resolver when home differs from RESOLVER_HOME (the
os.homedir() value captured at module load, i.e. what dirs is anchored
to). Production callers that pass os.homedir() match RESOLVER_HOME and
still go through the XDG-aware resolver, preserving read/write coherence
with the marketplace writer and the cache invalidator. Tests passing a
temp HOME mismatch and short-circuit to <home>/<configDir>/plugins for
deterministic isolation.
- Replaced duplicated plugin-registry cache invalidation blocks with clearPluginRootsAndCaches in command and selector setup paths.
- Updated OMP plugin registry path resolution to use getPluginsDir for reads and cache invalidation, matching marketplace write locations.
- Removed a redundant project-scope marketplace test after centralizing cache-root invalidation logic.
can1357