Minor bump. This release adds first-class support for a new agent host (Oh My Pi) across detection, install, uninstall and doctor, and closes a config-override bypass that could allow an unexamined command.
Security
-
An
[overrides] allowentry no longer speaks for the rest of a compound command. Allow patterns are substring-matched, and the allow check runs before pack evaluation, so a single entry matching one segment returnedallowedfor text that was never examined — an entry naming a scratch path also allowed whatever followed the&&. A safe segment silencing a destructive one is the same bypass classsplit_command_segmentsalready closes for pack patterns, so allow overrides now clear each segment on its own terms: a single-segment command keeps the previous whole-string semantics, and a compound command is allowed only when every segment is itself allowed. Anything uncovered falls through to normal evaluation, and command substitutions are segments too, so a safe outer command cannot carry a destructive inner one past the check.As a side effect, anchored entries now compose across a chain for the first time:
^a$and^b$previously allowed neither half ofa && b, because neither matched the whole string. (#340)
Added
- First-class Oh My Pi (
omp) agent support in detection, CLI, anddcg doctor, with easy-mode installers and uninstallers taught about it and a symmetric uninstall path. The generated OMP extension bridge carries schema validation and health checks, monotonic child-transition handling, refined timeout and process-signal handling, and dynamic shell-dialect selection for eligible local PTYs.
Fixed
dcg doctorno longer undercounts enabled packs. It counted the raw enabled-pack set, which carries the barecorecategory marker, whiledcg packs --enabledlists the two registry leaves that marker expands into (core.filesystem,core.git). The two disagreed by exactly one in every configuration. No protection was missing; only the reported count was wrong. (#335)- A block message no longer grows with the command it is reporting on. The message becomes the hook's
permissionDecisionReason, which lands in an agent's context and is replayed on every later turn, and it embedded the command verbatim: a 10 KB heredoc write produced a ~10.8 KB reason and a 50 KB one produced ~50.8 KB, while the stderr box stayed a constant ~2 KB. The echoed command is now capped and the reason reports how many bytes were elided. Ordinary commands are untouched and stay copy-pasteable. (#339) - OMP hardening: invalid profile environments are rejected, commands are evaluated in the effective cwd, agent policy is applied in robot mode, the installer conflict summary is preserved, project extensions are anchored to cwd, and
PI_CONFIG_DIRis honored when detecting OMP. The PowerShell installer and uninstaller handle Windows OMP config paths correctly. - Install path: the OpenCode plugin and OMP extension are written atomically, a non-UTF-8
dcgpath is refused rather than embedded in generated JavaScript, and the native-integration install flags are mutually exclusive. - Docs and pack metadata:
docs/packs/andREADME.mdnow listdatabase.databricks, and a stalegatedmarker was removed from a suggestion the pack deliberately allows.
Platform notes
All six artifacts were verified before upload: architecture asserted with file, and the glibc floor measured with objdump -T.
linux/amd64is a fully static musl binary (static-pie linked, zero GLIBC symbols), so it runs on any distro regardless of host glibc.linux/arm64is cross-built withcargo zigbuildagainst a GLIBC 2.28 floor. A host-native cross build inherited the build host's glibc and produced a 2.39 floor, which would have excluded Debian 12, Ubuntu 22.04 LTS, RHEL 9 / Rocky 9 and Amazon Linux 2023. That artifact was rebuilt rather than published.
Verification
Gate: 5099 tests passed across 100 test binaries, 0 failures; cargo clippy --all-targets -- -D warnings exit 0.
SHA256SUMS is attached and covers every archive.