Files

T

ghosty93 ffb816fe7f fix(coding-agent): classify destructive rm with long options as critical

`CRITICAL_BASH_PATTERNS` required the target to follow one short flag
cluster directly, so anything in between escaped the check:

    rm -rf /                      matched
    rm -rf -- /                   missed
    rm --recursive --force /      missed
    rm -rf --no-preserve-root /   missed
    rm --no-preserve-root -rf /   missed

The last two matter most. GNU coreutils already refuses `rm -rf /` with
"it is dangerous to operate recursively on '/'" and names
`--no-preserve-root` as the override, so the pattern matched the form
that fails safe and missed the form that does not.

Repeat the option separator instead of assuming the path follows one
cluster, and treat `--no-preserve-root` as critical wherever it appears.
Absolute targets are still required for the first pattern, so
`rm -rf -- ./build` and `rm --recursive --force ./dist` stay benign;
both are asserted in the test.

PR #5270 reported the `--` and long-option forms in July and was closed
unmerged by the contributor-vouch bot rather than on merit. This keeps
its cases, credits them in the tests, and adds the `--no-preserve-root`
forms that patch did not cover.

2026-08-16 22:41:44 +03:00

bench

feat: introduced omptype validation package and migrated workspace dependencies

2026-08-03 21:56:48 +02:00

examples

Merge PR #7735 : fix(coding-agent): return ToolInfo[] from getAllTools extension API (@roboomp)

2026-08-05 22:15:46 +02:00

scripts

feat: replaced custom mupdf wasm pipeline with native function

2026-08-14 14:08:28 +02:00

src

fix(coding-agent): classify destructive rm with long options as critical

2026-08-16 22:41:44 +03:00

test

fix(coding-agent): classify destructive rm with long options as critical

2026-08-16 22:41:44 +03:00

CHANGELOG.md

fix(coding-agent): classify destructive rm with long options as critical

2026-08-16 22:41:44 +03:00

DEVELOPMENT.md

…

package.json

chore: bump version to 17.3.5

2026-08-16 10:21:05 +03:00

README.md

fix(memory): synchronized live backend lifecycle

2026-07-23 19:52:09 +00:00

tsconfig.examples.json

…

tsconfig.json

…

tsconfig.publish.json

…

README.md

@oh-my-pi/pi-coding-agent

Core implementation package for the omp coding agent in the oh-my-pi monorepo.

For installation, setup, provider configuration, model roles, slash commands, and full CLI reference, see:

Package-specific references:

Memory backends

The agent supports three mutually-exclusive memory backends, selected via the memory.backend setting (Settings → Memory tab, or ~/.omp/config.yml):

off (default) — no memory subsystem runs.
local — existing rollout-summarisation pipeline; writes memory_summary.md and consolidated artifacts under the agent dir.
hindsight — talks to a Hindsight server (Cloud or self-hosted Docker), retains transcripts every Nth user turn, recalls memories on the first turn of a session, and exposes retain, recall, and reflect.

Hindsight quickstart

Run a Hindsight server (Cloud or docker run -p 8888:8888 ghcr.io/vectorize-io/hindsight:latest).
Set memory.backend = "hindsight" and hindsight.apiUrl = "http://localhost:8888" (or your Cloud URL).
Optional environment overrides (env wins over settings):
- HINDSIGHT_API_URL, HINDSIGHT_API_TOKEN — connection
- HINDSIGHT_BANK_ID, HINDSIGHT_DYNAMIC_BANK_ID, HINDSIGHT_AGENT_NAME — bank addressing
- HINDSIGHT_AUTO_RECALL, HINDSIGHT_AUTO_RETAIN, HINDSIGHT_RETAIN_MODE — lifecycle
- HINDSIGHT_RECALL_BUDGET, HINDSIGHT_RECALL_MAX_TOKENS — recall sizing
- HINDSIGHT_BANK_MISSION, HINDSIGHT_DEBUG

Switching backends mid-session immediately replaces the live backend, memory tools, listeners, and system-prompt context. Existing users with memories.enabled = true|false are migrated to memory.backend = "local"|"off" exactly once on first launch; afterward, memory.backend is the sole runtime selector.