Files

T

iacore 54008bce99 fix(secrets): round-tripped unconfigured credential-shaped tokens through reversible obfuscation

With secrets.enabled (Hide Secrets), a credential-shaped token not present
in secrets.yml or the environment fell through to pi-ai's irreversible
[*_token_redacted] rewrite in transform-messages. The model echoed that
placeholder into edit-tool old_text, which could never match the real
bytes on disk, breaking exact-match edits of any file containing such a
token.

Route the same token shapes (SENSITIVE_TOKEN_RE, now exported from
pi-ai) through the SecretObfuscator as a built-in obfuscate-mode regex
entry: the provider sees reversible keyed placeholders, and
deobfuscateToolArguments restores the real bytes before tool execution.
Hide Secrets' contract is unchanged — credential bytes still never
reach the provider; pi-ai's redaction stays as the backstop for hosts
without an obfuscator.

Fixes #6968

2026-07-30 15:14:00 +08:00

bench

Merge PR #5947 : perf(session): memoize convertToLlm and estimateTokens over settled history (@roboomp)

2026-07-18 19:42:52 +02:00

examples

refactor(coding-agent): consolidated tool surface onto xd:// devices and hub

2026-07-15 15:16:29 +02:00

scripts

fix(coding-agent): package lazy HTML export assets

2026-07-28 02:45:16 +00:00

src

fix(secrets): round-tripped unconfigured credential-shaped tokens through reversible obfuscation

2026-07-30 15:14:00 +08:00

test

fix(secrets): round-tripped unconfigured credential-shaped tokens through reversible obfuscation

2026-07-30 15:14:00 +08:00

CHANGELOG.md

fix(secrets): round-tripped unconfigured credential-shaped tokens through reversible obfuscation

2026-07-30 15:14:00 +08:00

DEVELOPMENT.md

feat(coding-agent): added opt-in task prewalk and tightened --tools and xdev behavior

2026-07-15 18:39:36 +02:00

package.json

chore: bump version to 17.2.0

2026-07-30 07:58:50 +02:00

README.md

fix(memory): synchronized live backend lifecycle

2026-07-23 19:52:09 +00:00

tsconfig.examples.json

…

tsconfig.json

…

tsconfig.publish.json

…

README.md

@oh-my-pi/pi-coding-agent

Core implementation package for the omp coding agent in the oh-my-pi monorepo.

For installation, setup, provider configuration, model roles, slash commands, and full CLI reference, see:

Package-specific references:

Memory backends

The agent supports three mutually-exclusive memory backends, selected via the memory.backend setting (Settings → Memory tab, or ~/.omp/config.yml):

off (default) — no memory subsystem runs.
local — existing rollout-summarisation pipeline; writes memory_summary.md and consolidated artifacts under the agent dir.
hindsight — talks to a Hindsight server (Cloud or self-hosted Docker), retains transcripts every Nth user turn, recalls memories on the first turn of a session, and exposes retain, recall, and reflect.

Hindsight quickstart

Run a Hindsight server (Cloud or docker run -p 8888:8888 ghcr.io/vectorize-io/hindsight:latest).
Set memory.backend = "hindsight" and hindsight.apiUrl = "http://localhost:8888" (or your Cloud URL).
Optional environment overrides (env wins over settings):
- HINDSIGHT_API_URL, HINDSIGHT_API_TOKEN — connection
- HINDSIGHT_BANK_ID, HINDSIGHT_DYNAMIC_BANK_ID, HINDSIGHT_AGENT_NAME — bank addressing
- HINDSIGHT_AUTO_RECALL, HINDSIGHT_AUTO_RETAIN, HINDSIGHT_RETAIN_MODE — lifecycle
- HINDSIGHT_RECALL_BUDGET, HINDSIGHT_RECALL_MAX_TOKENS — recall sizing
- HINDSIGHT_BANK_MISSION, HINDSIGHT_DEBUG

Switching backends mid-session immediately replaces the live backend, memory tools, listeners, and system-prompt context. Existing users with memories.enabled = true|false are migrated to memory.backend = "local"|"off" exactly once on first launch; afterward, memory.backend is the sole runtime selector.