can1357/oh-my-pi v18.1.22 on GitHub

@oh-my-pi/pi-ai

400-request debug dumps now redact provider-specific auth headers (x-goog-api-key, x-amz-security-token, and any header whose name carries a key/token/secret), not just a fixed allow-list, so a shared dump can no longer leak a live API key (#12007).

OpenCode Zen GPT-6 Astra requests now use the Responses endpoint instead of failing through chat completions with HTTP 500 (#12030).

Hub message/job waits now always use the adaptive window (5s, lengthening to 5m across back-to-back waits); removed the timeoutMs argument and async.pollWaitDuration setting.

Added a privacy warning to memory reports reminding users to review data for secrets before sharing
omp git / /git: delete discards the selected file's changes (press twice to confirm) — in the sidebar on a file or whole directory, in the diff pane on the shown file; untracked files are removed, staged files reset to HEAD

Pressing c on a /btw answer now shows a green "✓ Copied to clipboard" confirmation in the panel and history detail, and BTW history accepts Ctrl+/ to switch panes (#12052 by @H4vC).

Automatic session titles no longer draw from canned prompt examples.
Sessions titled by a local Ollama model (e.g. LFM2.5) no longer stay unnamed when the model's chat template spends the whole output budget on reasoning.
/debug memory reports now include numeric memory statistics instead of raw heap snapshots that could expose provider and MCP credentials.
Multi-step logins (e.g. Perplexity email → code) now move the input field under the latest prompt instead of leaving it stuck beneath the first one.
Todo updates made through Eval's tool.todo(...) now persist to the session, so they survive resume/rewind/fork and no longer trigger false incomplete-todo reminders.
Native background security scans now accept provider-owned AWS authentication for Amazon Bedrock and Bedrock Mantle without requiring a stored OAuth account (#12013).

Fixed extractRetryHint sleeping hours past the provider's stated wait when a timezone-naive reset at timestamp overshoots the relative retry hint: the skewed stamp is now ignored instead of winning longest-wins (#12070 by @H4vC).

fix(catalog): route Zen Astra through Responses by @roboomp in #12032
fix(ai): redact provider-specific auth headers in 400 dumps by @roboomp in #12010
fix(security): support provider-native Bedrock auth by @roboomp in #12017
feat(coding-agent): confirm /btw copies with visual feedback by @H4vC in #12052
fix(utils): ignore zone-skewed naive reset-at past relative retry hint by @H4vC in #12070

Full Changelog: v18.1.21...v18.1.22