Reliable installs, faster CI, safer releases
Ast-grep setup now fails clearly instead of hanging
OpenCode and LazyCodex installation now enforce a live timeout for ast-grep
provisioning, terminate stuck child installers, and report a clear bounded
failure if the child refuses to exit. Install commands no longer sit
indefinitely behind a silent provisioning process.
Faster validation without source-coverage shortcuts
Web/docs-only changes and verified generated release-state merges can skip
unnecessary root jobs, while missing diffs, normal source changes, and
release-looking non-merge commits still run full validation.
Releases are tied to one validated source SHA
Publication now reuses the successful full CI workflow for the exact prepared
commit instead of running a second release-local matrix that could diverge
from the code being shipped.
Release credentials stay out of build scripts
Repository-controlled generation runs without the release PAT. The token is
available only for the push/PR step, and the credential-bearing remote is
removed even when publication fails.
More predictable Windows release checks
Native-shell execution, Bun 1.3.14, Windows-safe script resolution, and
targeted serial execution remove known environment mismatches and timeout
instability from the release path.
A reliability-focused beta
v5.0.0-beta.10 is a focused hardening release for installation, continuous integration, and the synchronized publish pipeline. There are no breaking user-facing changes in this beta. The main result is that failed setup work now stops predictably, release builds are validated against the exact source being published, credentials have a narrower exposure window, and Windows checks run closer to real Windows behavior.
What changed
Installer timeouts now finish predictably
The shared ast-grep provisioning path no longer relies on an unreferenced timer that could be starved while a child process remained stuck. The installer now:
- keeps the primary 30-second deadline active;
- terminates a child that exceeds that deadline;
- gives termination one second to settle; and
- reports an explicit failure if the child ignores termination instead of hanging indefinitely.
This matters most on failure paths: a broken shell, stalled download, or unresponsive installer should now produce a bounded result rather than holding the CLI or CI job open until a much larger outer timeout expires.
Releases reuse validation from the exact source SHA
The publish workflow no longer starts a second, redundant test/typecheck/compatibility matrix. Instead, it requires a successful full CI workflow for the exact prepared release SHA and fails closed when that proof is unavailable.
The gate handles both valid release paths: the release-state pull request's exact-SHA run and the post-merge push run. It retries temporary GitHub API failures, waits for active validation to finish, stops when completed runs have no success, and enforces a bounded overall timeout. This makes the release faster while preserving the important guarantee: the source that passed CI is the source that gets published.
Release credentials are more tightly isolated
Release-state generation and privileged publication are now separate steps. Dependency installation, version synchronization, lockfile updates, and generated-artifact rebuilds run without the release PAT. The token is present only in the step that pushes the prepared branch and manages its pull request.
The authenticated git remote is also protected by an EXIT trap, so it is restored to a clean token-free URL even when a push fails. This reduces the chance of a credential remaining in repository configuration for later commands or diagnostic output.
CI skips expensive work only when it can prove that it is safe
A new changed-path classifier identifies two narrow cases that do not need the full repository matrix:
- generated release-state merge commits with verified merge provenance; and
- changes confined to the web/docs surface.
Everything else continues to run heavy validation. If the base SHA is unavailable, the diff cannot be read, classifier inputs are malformed, or a commit merely imitates a release message without being the expected merge shape, CI defaults to the full matrix. The fast path therefore reduces repeated work without turning uncertainty into a skip.
Windows validation now matches the supported runtime more closely
Repository workflows are pinned consistently to Bun 1.3.14, with cache keys aligned to that version. Windows root tests execute under native PowerShell rather than Git Bash where shell-sensitive behavior could observe Unix-like environment variables and launch paths. File-URL handling in the CI classifier tests also uses native path conversion, including Windows drive-letter paths.
These changes are aimed at reducing Windows-only hangs and false failures while preserving the existing platform coverage for OpenCode/OpenAgent and Codex installations.
Per-layer highlights
omo pure components
- ast-grep provisioning has a real, bounded timeout and kill-grace path;
- a child that ignores termination becomes an actionable failed result rather than an endless wait; and
- reusable CI classification fails safe when provenance or changed-path information is incomplete.
omo opencode
- publish gates reuse complete CI from the exact prepared SHA instead of rerunning the same validation;
- release-state generation cannot access the release PAT;
- push/PR automation has bounded retries and recovery checks; and
- generated-release and web/docs-only changes receive a safe CI fast path.
omo codex
- Codex compatibility and platform publication use the same exact-SHA release guarantee;
lazycodex-aipublication remains behind successful synchronized validation;- Windows installer and compatibility checks run with native shell semantics; and
- Codex consumers inherit the bounded ast-grep installer failure path.
Breaking changes
None. Existing commands, package entry points, configuration, and installation flows remain compatible with beta.9.
Install or upgrade
Install or upgrade the beta with:
npm i -g omo-ai@betaAfter installation, omo --version should report the beta.10-mapped package version once the release is available on npm.
Discord announcement
omo v5.0.0-beta.10 is out — a reliability-focused beta.
This release hardens the paths around installation and publication: ast-grep setup can no longer hang indefinitely after a stalled child process, release jobs reuse successful CI from the exact source SHA instead of running duplicate gates, and the release PAT is isolated from repository-controlled generation steps. CI also gains safe fast paths for generated release merges and web/docs-only changes, while unknown cases still run the full matrix. Windows checks now use Bun 1.3.14 consistently and run shell-sensitive root tests under native PowerShell.
No user-facing breaking changes.
npm i -g omo-ai@beta