code-yeongyu/oh-my-openagent v5.1.43 on GitHub

A session's first prompt no longer freezes a shared host while it reads what changed in memory (#10728). A session resumed a few hours after its last turn read the memory commits since then with one git diff-tree process per commit, all started at once. On a busy memory repository that was thousands of processes, and starting them blocked every session on the same host for 28 s with one session and 142 s with seven, while the finished ones piled up unreaped. The range is now read with one git log; the same notices come out, the longest block with seven sessions fell to 16 s, and the host's memory footprint during prompts fell from a median of 1,258 MB to 813 MB. (#10726)

Prompts stop freezing a shared host after every memory commit (#10731). Recall skips memory notes the conversation already mentions, and it rechecked the last 200 messages against every note again after each memory commit, one note at a time. On a 7,500-note memory that took 1 to 1.7 s per session per prompt, with every session on the host waiting. Earlier answers now carry over and only notes the commit added are checked, so a recheck takes about 6 ms and the first check about 0.2 s; with seven sessions and a commit every 20 s, the host's blocked time fell from 185 s to 28 s over four and a half minutes. The notes skipped are unchanged. (#10729)

A relaunch's first prompt no longer recompiles your memory. The compiled memory block and its size estimate are now saved by commit inside the memory repository's .git folder, never committed or synced, and read back on the next launch. On a 6,862-note memory this cut the memory step of a prompt from a median of about 178 ms to about 52 ms in the desktop app. A block built after a git read failed is used once and never saved. (#10674)

Anonymous usage stats now count how many accounts you have linked per provider. session_started reports, per provider kind, how many accounts the engine lists for it (the same list the app's account list shows: signed-in accounts and environment-variable slots), used or not, as capped counts only, never an account name, email, token or value (#10919).

The desktop app and omo login can share one device on a machine. A new hidden omo account command (show, adopt, token, export, forget) lets the desktop use the same OS-keychain sign-in the CLI writes, so a machine counts as one device for memory sync and only one process ever refreshes its tokens. Secrets pass only on stdin and stdout, a refused renewal (exit 5) names the service's refusal code so the desktop can say why the sign-in ended, and a locked OS keychain is reported as its own outcome (exit 7) instead of a generic failure. On Linux, where a locked Secret Service collection reads as empty, the default collection's lock state is read over D-Bus before any secret call (libsecret would otherwise ask the keyring to show an unlock prompt), a locked collection is reported (exit 7) instead of read, and when that check cannot answer (no gdbus on a minimal install, no Secret Service on the bus, a slow bus) the CLI prints one notice and uses libsecret directly as before, so login never depends on gdbus (#10658).

Memory sync can join a new device. omo sync enable turns memory sync on for the device and, if the account already syncs, asks a device that already syncs to approve it. omo sync approve on that device answers the request. Both screens show the same 6-digit code, and the new device is admitted only after the person confirms the codes match. A relay that swaps keys produces a different code and is refused. omo sync recover points to passkey recovery in the desktop app. (#10625, #10634)

A task started on a task host now records its own session id from the start (#10885). Before, the id stayed empty for every hosted task, so anything that looks up a parent task from a child's session, such as the desktop app's task tree or the cleanup when a task is cancelled, missed hosted tasks. The id was already in the host's answer when the session opened; it is now kept.

Anonymous usage stats now count the providers you signed into, not only the ones you configured. session_started counted only the providers in models.json, so a user who just signed into a subscription or added an API key showed zero providers. It now counts both, reports signed_in_provider_count and configured_provider_count separately, and still sends only the names of providers OmO ships (anything else is custom), never an account, key or credential (#10889).

A memory write recovers on its own after a crashed writer on Linux too. When a memory writer was killed mid-commit, the next write is meant to clear the git lock it left behind once the writer is proven dead. On Linux that check read other processes through /proc, and on a normal systemd login (or an SSH session, or a CI runner) some of the user's own processes cannot be read, so the lock was always kept and every write failed until /memory unlock. Memory's git commands now hold a kernel file lock that their git processes inherit, and the cleanup asks the kernel whether any of them is still running. A live writer's lock is still never removed. (#10604)

Resuming a session no longer asks git whether the commit it is pinned to still exists when that commit is the current HEAD. That saves up to two git processes on the first prompt after a resume. (#10707, #10854)

Each prompt reads your memory's git HEAD once instead of up to three times. The memory nudge, the soul notice and the session pin now share one read, which saves up to two git processes on every prompt. (#10707, #10855)

In a Bun project, lsp_diagnostics on a TypeScript directory typechecks it with bun check. A project with bun.lock, bun.lockb, bunfig.toml or a bun@ packageManager gets the errors bun check reports, which are the same errors as tsc 7. When the installed bun has a linter, bun lint diagnostics are added. For a project that formats with prettier, the Senpi formatter runs bun format --write instead of the prettier binary, but only once bun has proven it rewrites a file in place. Each command is used only after bun <command> --help succeeds in an empty directory, never when the project's own script of that name would run instead, and a probe that times out is retried rather than remembered as absent. Every other project keeps the language-server path unchanged (#10840, #10843).

A task-store admission no longer freezes the session while the disk is slow to flush (#10867, #10868). Registering a session's task store before a task host starts now does its durable write (fsync, rename, directory fsync) off the event loop, so a loaded Linux disk delays only that registration instead of every timer, socket and prompt of the process.

Memory no longer turns the assistant's own suggestion into "the user decided". Memory is now reference only: a remembered decision or approval counts only when its receipt quotes the user, and every memory write and extracted fact records who it came from (source: user, agent or inferred). A user receipt is kept only when the user's whole reply, sent right after the assistant's proposal, is a short explicit approval such as "yes", "ok", "delete it", "네" or "지워줘"; the receipt names the proposal it approved. Anything else, including a hedge, a question, an image-only message in between, or an older "ok", is stored as an agent suggestion, so the agent asks again instead of acting on memory. Thanks to @wuhaoyujerry for the report. (#10488, #10498)

Cancelling a task now also stops the tasks it started (#10824). Before, the cancelled task's session suspended its running children as if it could be resumed later, so they kept running tools on the task host with nobody able to collect them. A cancelled, lost or killed task now cancels its children when its session shuts down, and the same rule applies one level down. A live task's quit or reload still keeps its children so they can be collected on resume.

A task start is no longer refused when the model check can't finish on a busy machine. Before a task child starts, OmO checks that its model is available by listing models in a fresh CLI with a 20-second budget; on a heavily loaded machine that listing ran out of time twice and the start failed with catalog_probe_timed_out, even for a valid model. A check that times out now lets the start go ahead and is logged, a model list from the last 30 minutes is noted in that log, and a child that truly can't use its model fails as model_unavailable with its own error (#10863, #10865).

Internal: telemetry-core can host OpenTelemetry and send product events as OTLP with a write-ahead spool. A new @oh-my-opencode/telemetry-core/otlp entry point provides minimal OpenTelemetry logger and tracer providers, a spool that writes every event to disk before it is queued (so a crash loses nothing already emitted), and an OTLP/HTTP sender with retries, a 5 MB spool cap, a dropped-events counter and a 2 s shutdown cap. Every telemetry opt-out, plus OTEL_SDK_DISABLED=true, still applies: nothing is written while telemetry is off, and an opt-out deletes every file the spool itself created in earlier runs, never anything else in its directory, skips (and reports) any spool-named entry that is not a regular file of the current user, reports each of its own files it could not delete by error code as an incomplete opt-out, and refuses to touch a spool directory that is a symlink, belongs to another user, or resolves outside the root its caller names. A collector that accepts a request and never answers cannot stall sending, because each request times out after 10 s. Nothing uses it yet; the switch arrives with a later telemetry.sink setting. The entry point reads the opt-outs and consent before importing anything, so a run with telemetry off loads no OpenTelemetry or protobuf code. Every event goes through the projection the caller passes (the schema artifact's per-event allowlist; there is no default), spans keep only the attributes the span allowlist names, and no free-text slot (a LogRecord body or severity text, an unlisted span name) reaches the wire. (#10272, #10273)

OmO Native records whether people use the handoff hint. When senpi shows its handoff hint (the line that offers a fresh session once a large session's cache has expired, code-yeongyu/senpi#3230), OmO Native sends one handoff_hint event per shown, accepted and dismissed hint. It carries the context size, the two prices the hint displayed and whether the session was on a subscription, under the usual telemetry consent and opt-outs. The handoff brief, session text and file paths never leave the machine (#10607).

Sends waiting for a child now say queued, not delivered. A workflow node send and an eval-handle send that was only accepted locally report queued, even when the child's run ends before the host receives the message, instead of claiming delivery. The input-identity regression waits for the host's input events before checking the sequence (#10318, #10668).

OmO sessions prewarm the prompt cache again, and anything that blocks it is named. Since v5.1.17 every OmO session skipped senpi's prompt-cache prewarm, because the gateway, onboarding and task-host before_agent_start handlers were not registered as preview-safe; they now are, and a preview changes no state (no onboarding claim, no gateway store, no host launch). An unsafe before_agent_start registration warns immediately, including one added after startup; a recorded skipped prewarm is reported once per session at the next lifecycle event, with its reason and the blocking components and source locations. Gateway preview lookup errors now pass the prompt through and warn once instead of throwing. (#10356, #10372)

Fixed

While a delegated task hands off to its next fallback model, its row, task_output and completion notice no longer claim it ran on a model nothing has run on yet: the record keeps the last model a child was seen running until the new one reports, and the parent-model note reads "switching to" during the handoff and "was never confirmed running on" if the task ends before a child is seen on it (#10797). (#10807)
8318651 Merge pull request #10964 from code-yeongyu/release/v5.1.43-source-state
cb2885f docs(changelog): compile the unreleased change fragments into 5.1.43 and lead with the measured optimizations
3314359 Merge pull request #10899 from code-yeongyu/batch/memsync-coord-2
dfd839f batch2: merge #10946 @8628ffe200 (hooks test teardown waits for children)
843be3b batch2: merge #10947 @f175f53687 (win32 skip for host-prewarm preview test)
8628ffe test(memory-core): hooks test teardown stops and waits for live children before removing temp roots
2ffa198 batch2: merge #10939 @9727ba7bb9 (#10372 follow-up: bounded teardown, settled attach)
5cdde7a chore(bundles): regenerate generated bundles for batch #2 after the v5.1.42 dev merge (bun 1.4.3)
ad1655a batch2: merge dev 4d18b5e (v5.1.42 release)
f763e9d batch2: merge #10372 @0ae78c639e (restore-first teardown, bounded attach waits)
d6b49d2 batch2: merge #10372 @44aacbcd05 (prompt-cache-preview sibling leak fix)
303a574 chore(bundles): regenerate generated bundles for bundle-train batch #2 with the #10922 runtime-import fix (bun 1.4.3)
a5c136b batch2: merge #10372 @df0e2f9f24 (prewarm test temp-dir leak fix)
b4c70f6 batch2: merge #10658 @79672fd997 (Windows teardown leftover fix)
33f2db6 batch2: merge #10922 @5a6ec6242b (runtime-import fix)
79672fd test(omo-native): the no-gdbus fixture keeps its empty bin inside the test HOME (#10658)
5a6ec62 fix(telemetry): load pi-ai with a guarded dynamic import, never statically, so an installed plugin always loads (batch #2 receipt)
11df909 chore(bundles): regenerate generated bundles for bundle-train batch #2 after the dev merge (bun 1.4.3)
8aae041 batch2: merge dev 5888e9f
335faa2 chore(bundles): regenerate generated bundles for bundle-train batch #2 incl. #10922 engine parity (bun 1.4.3)
f757e6c batch2: merge #10922 @dddeca7de9 (engine parity)
dddeca7 fix(telemetry): Claude empty account list = the engine flat slot; generative parity against getCredentialAccounts; lazy-safe pi-ai namespace import (#10922 review)
cf6937c chore(bundles): regenerate generated bundles for bundle-train batch #2 incl. #10922 (bun 1.4.3)
6e2c690 batch2: merge #10922 @cdd2b3fa0a (engine-count fold)
8758524 batch2: merge #10922 @14a8500909
14a8500 fix(telemetry): an empty account list is not linked; a provider entry without a list is one linked account; one diagnostic for a malformed auth.json (#10922 review)
c1894a7 feat(telemetry): linked accounts per provider only; drop the concurrently-active count (Q, #10919)
47a3735 feat(telemetry): session_started counts accounts per provider, connected and concurrently active (#10919)
fa056ea chore(bundles): regenerate generated bundles for the rebuilt bundle-train batch #2 (bun 1.4.3)
6380c8c batch2: merge #10658 @526f3e3364 (audit fix delta)
f02c1c1 docs(changelog): keep the batch #2 entries under [Unreleased] after the 5.1.41 cut
c0dc145 batch2: merge #10865 @bfd0cacf28
248456e batch2: merge #10668 @ca59274e46
4871758 batch2: merge #10607 @1d9b7eb475
50bb024 batch2: merge #10604 @c116516181
cce4d88 batch2: merge #10889 @6142224b5b
8a4dce9 batch2: merge #10731 @ea6b1e521e
d9f35b1 batch2: merge #10728 @10ac5b7bba
96dc61b batch2: merge #10885 @ed8def4f8a
9ce25e9 batch2: merge #10658 @185872cd6c
93d0246 batch2: merge #10634 @bb1ab9b7ec
526f3e3 test(omo-native): resolve the omo entry from package.json bin, not a literal path (#10658)
b945b39 batch2: merge #10824 @01f537e85c
7676f5e batch2: merge #10807 @b69c102842
0c9899b batch2: merge #10498 @cb2c46f5a9
50ce417 batch2: merge #10868 @9403ee93f7
ec55f4f batch2: merge #10843 @798e5fbff9
8ed1a04 batch2: merge #10273 @3dd3e430fd
033ea6e batch2: merge #10855 @a8d5b313a6
58be2ff batch2: merge #10854 @93b9ecfa35
44a09b0 batch2: merge #10674 @7931ca2684
ea36bdd batch2: merge #10372 @026d195f40
6142224 fix(telemetry): a models.json parse error reports a fixed message, never the parser text (#10889 review)
9403ee9 Merge remote-tracking branch 'origin/dev' into fix/store-admission-async-fsync
ee8ab06 docs(changelog): provider_count counts signed-in providers (#10889)
c116516 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
af73088 fix(telemetry): signed-in providers count without models.json; auth.json diagnostic never quotes the file; restore changes.md (#10887)
9ac95d7 docs(changes): provider_count counts signed-in providers (#10887)
1584fda fix(telemetry): provider_count counts signed-in providers (auth.json) as well as configured ones (#10887)
185872c test(qa): the compiled binary's first --version leaves no legacy plaintext credentials (#10658 round 2)
d55bbe0 fix(omo-native): one early hook deletes the legacy plaintext credentials before the release entry answers any command (#10658 round 2 MEDIUM)
5e18a87 test(omo-native): the release entry's refused-trust answer leaves no legacy plaintext credentials (#10658 round 2 MEDIUM)
f3d14e4 test(omo-native): the compiled entry's main() leaves no legacy plaintext credentials after --version or -v (#10658 delta review MEDIUM)
798e5fb docs(changelog): move the #10843 note into Unreleased for the current changelog gate
6c13f40 docs(changelog): #10885 hosted child_session_id
460883b test(service-auth): the fallback notice shows once when a normal store noticed before a quiet one (#10658 delta review LOW)
a8452be fix(omo-native): omo account also deletes the legacy plaintext credentials before its early exit (#10658 delta review MEDIUM)
f8857d0 test(omo-native): a first omo account after upgrading deletes the legacy plaintext credentials (#10658 delta review MEDIUM)
bfd0cac chore(bundles): regenerate omo-task/omo-member/rollback-migrate bundles (bun 1.4.3, bundle-train solo window)
a48f4f2 docs(changelog): add the #10865 entry under [Unreleased]
8c65eb5 docs(changelog): note the async store-admission write (#10868)
513d594 docs(changes): add #10865 changelog fragment
1c2ec39 fix(memory): the agreement ledger writers lower or drop a provenance header instead of being refused
c53b84e Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
a8d5b31 fix(memory-core): the soul notice scans only up to the HEAD it records; a failed shared HEAD read can be retried (#10855)
1ef1822 test(memory-core): a soul notice read with an earlier HEAD is not repeated (RED, #10855)
7931ca2 Merge remote-tracking branch 'origin/dev' into lpr4-pr5-local
29dab47 fix(lsp-core): spawn bun in its own process group so a timeout kills the tree
d116ba7 docs(changelog): one memory prompt reads HEAD once (#10855)
2aeee2b fix(lsp-core): kill the whole process tree when a bun probe times out
93b9ecf docs(changelog): a resumed pin at HEAD skips the git revision lookup (#10854)
9d7ad15 fix(memory): a patch move onto a freed or non-UTF-8 path applies again
3dd3e43 fix(telemetry-core): a stale lock from an earlier boot of our own pid is abandoned; rollback and lock-fill cleanup never mask the error
3291da5 fix(lsp-core): never cache a timed-out or unspawnable bun probe as absent
3d5ed66 fix(lsp-core): bun format must prove it writes in place; async probe, tighter shadowing
ab3ff01 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
ea6b1e5 Merge remote-tracking branch 'origin/dev' into fix/3833-recall-mentions-head-move
10ac5b7 Merge remote-tracking branch 'origin/dev' into fix/3833-memory-range-log-one-process
653b914 Merge remote-tracking branch 'origin/dev' into fix/parent-cancel-stops-child
b35f250 Revert "docs(changelog): note bun check / lint / format in Bun projects (#10843)"
42216ec docs(changelog): note bun check / lint / format in Bun projects (#10843)
d83d5b8 docs(changes): note bun check / lint / format in Bun projects (#10843)
75d2e00 feat(lsp-core): use bun check, and bun lint/format when present, in Bun projects
65f2718 Merge remote-tracking branch 'origin/dev' into lpr4-pr5-local
b6cc9f2 docs(changelog): link #10824 in Unreleased
4607c2b fix(memory): writers report each legacy header they drop, per file, at the restamp point
a7f106c Merge remote-tracking branch 'origin/dev' into fix/10318-input-identity-race
f5607da Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
3ab2408 fix(memory): the memory tool records each legacy header it drops; rename drops it too
8328412 Merge remote-tracking branch 'origin/dev' into fix/3833-recall-mentions-head-move
b9e95c1 Merge remote-tracking branch 'origin/dev' into fix/3833-memory-range-log-one-process
42159f6 fix(memory): no writer writes a user header; one rule drops legacy ones and records it
5cb8d14 docs(changes): add fragment for #10807
494100d fix(telemetry-core): a throw in a spool move leaves the spool consistent; a lock is only its owner's
e16f018 Merge remote-tracking branch 'origin/dev' into lpr4-pr5-local
204cdf3 fix(memory): memory carries no user authority; flag receipt-like text, refuse Unicode look-alike keys
1d9b7eb Merge remote-tracking branch 'origin/dev' into feat/3230-handoff-hint-telemetry
e20d753 Merge remote-tracking branch 'origin/dev' into feat/telemetry-otel-host
8e27f69 Merge commit 'bb1ab9b7ec' into memsync/10625-account-cli
bb1ab9b fix(omo-native): delete the legacy plaintext credentials file when an account verb is the first command (#10634 review LOW1)
421f9d4 fix(memory): a quiet host store can no longer use up the keyring fallback notice (#10658 review LOW1/LOW3)
ad90512 Merge 8293658 into memsync/10625-account-cli (restack; generated plugin bundles taken from the base, canonical regen follows in this PR's bundle-train window) (#10625)
8293658 Merge 0f74428 into memsync/10625-sync-verbs (restack; generated plugin bundles taken from the base, canonical regen follows in this PR's bundle-train window) (#10625)
1155842 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
a7ee0a6 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
12ee67b fix(telemetry-core): one winner per spool move on Windows via an O_EXCL per-file lock
d255dcf Merge remote-tracking branch 'origin/dev' into fix/10356-preview-safe-handlers
a27aeb6 fix(memory): the recall hint defers user approval to the read tool's attestation
be615d5 Merge remote-tracking branch 'origin/dev' into tchain-mv-10273
51cbd73 fix(memory): memory hooks read through the resilient fs module and hide git's console on Windows
0656bf6 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
4a17b4c fix(memory): trust only the read tool's attestation; refuse look-alike provenance keys
f908fe9 fix(memory): inspect every staged entry, refuse non-regular files, guard every read path
c8072cc fix(memory): bind a user receipt to the body it approved; refuse laundered or unreadable notes
50631de fix(memory): the memory hooks check staged notes with the reader's own frontmatter parser
5461355 test(memory): type the text-payload helper by the fixture fields it uses
df6eba1 fix(memory): refuse a hand-written claim receipt header in memory notes
31617a8 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
42429bb test(memory-core): compare guard paths with forward slashes on Windows (#10726)
d56c099 fix(memory-core): pin the reflection secret scan's diff-tree read (#10726 review)
4c8a62a Merge remote-tracking branch 'origin/dev' into fix/3833-memory-range-log-one-process
41958de fix(memory-core): pin path commit times and guard every parsed log read (#10726 review)
96fdb44 fix(memory-core): pin the git log settings memory reads parse (#10726 review)
b49f8d1 fix(omo-native): the keyring-check fallback notice shows once per process; one store per omo account command (#10658 review)
72131a9 fix(omo-native): only a locked keyring stops omo account; a probe that cannot answer falls back to libsecret (#10658 review)
2fb0a29 docs(changelog): recall mention recheck after memory commits (#10731)
f791193 docs(changelog): one git process reads a memory commit range (#10728)
3235879 fix(memory-core): read a commit range's paths in one git process (#10726)
da351dc feat(omo-native): omo account token names the refusal code when a renewal ends the session (sisyphuslabs/omo-desktop-app#3522)
63a8ed4 Merge remote-tracking branch 'origin/dev' into tchain-10273
7985b0c Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
f87ed1e test(service-auth): answer the Linux lock probe in the CLI keystore fixture so child-process tests stay hermetic (#10625)
c6f3351 test(service-auth): give the in-memory secret store an unlocked lock probe so Linux runners without a Secret Service stay hermetic (#10625)
523fa56 Merge remote-tracking branch 'origin/dev' into tchain-10273
df67f00 fix(memory): read the bundle stat through the resilient fs boundary; changelog entry
391416b fix(memory): a text facts payload carries no consent exchanges
b7d15d6 Merge commit '657a02ef48cc6653ba845f0bb8c71b1097a64aa2' into fix/10488-memory-authority-receipts
1051bd8 fix(omo-native): check the Linux Secret Service lock before any secret call so a locked keyring never prompts (sisyphuslabs/omo-desktop-app#3509)
9cfad3d Merge remote-tracking branch 'origin/dev' into tchain-10273
3470574 fix(telemetry-core): roll back a torn spool frame by path so Windows can truncate it
e64156e fix(omo-native): a locked Linux Secret Service never reads as signed out; check the collection over D-Bus (sisyphuslabs/omo-desktop-app#3509)
6d7b885 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
72740b6 Merge remote-tracking branch 'origin/dev' into tchain-10273
de18342 Merge remote-tracking branch 'origin/dev' into tchain-10273
abe6e18 Merge remote-tracking branch 'origin/dev' into fix/10318-input-identity-race
c685815 fix(memory): never persist a block compiled from failed git reads; review delta
f8d7a46 Merge remote-tracking branch 'origin/dev' into feat/3230-handoff-hint-telemetry
fe2311f Merge remote-tracking branch 'origin/dev' into perf/memory-corpus-cache
7efee39 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
03a6629 fix(omo-native): report a locked OS keychain as its own omo account outcome (exit 7) (sisyphuslabs/omo-desktop-app#3509)
3cdd3cd Merge commit 'd36519ed9f6f6e404026d6efd5cf67ae3f8dd195' into memsync/10625-account-cli
6bda8e8 Merge commit 'da1d4a7574752cb2faa9c040b97dcd7087bc5cfc' into memsync/10625-account-cli
da1d4a7 Merge commit 'c19cac0a344ad9b809f8db990590171e86fa0596' into memsync/10625-sync-verbs
d8cd3ee docs(changes): persisted compiled memory block (#10642)
04a30b1 test(memory-core): settle every persisted-block cache before removing its repository
ef89236 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
d8de094 perf(memory): persist the compiled memory block and its pressure estimate by commit, prebuilt at session bind
041e5a6 Merge commit '3b9295b9a3' into memsync/10625-account-cli
3b9295b Merge commit 'e272d10b3e4d65636c125833633425ca10c64d7c' into memsync/10625-sync-verbs
877d4ad fix(telemetry-core): a failed startup pass or a throwing consent() no longer breaks flush and shutdown
4c09ec4 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
5cfb125 fix(telemetry-core): the OTLP runtime refuses to start while telemetry is off
a11c78b chore(omo-codex): regenerate the Codex installer bundle after merging dev (Linux, bun 1.4.3)
382fcf2 Merge remote-tracking branch 'origin/dev' into tchain-10273
84399ec feat(memory): omo account show --account reports whether this device joined sync
5cec341 docs(changelog): one device per machine through omo account (#10658)
dac8b77 feat(memory): share the machine's one device credential through omo account
d770949 build(omo-native): regenerate the service auth bundle (#10634)
448bb4b docs(changelog): memory sync device pairing (#10634)
fca095a feat(memory): pair devices and turn memory sync on with omo sync enable, approve and recover
24e83f6 Merge remote-tracking branch 'origin/dev' into feat/3230-handoff-hint-telemetry
cbe9cce chore(omo-codex): regenerate the Codex installer bundle after merging dev (Linux, bun 1.4.3)
142c2bb Merge remote-tracking branch 'origin/dev' into tchain-10273
1132cbd Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
58e0d31 chore(omo-codex): regenerate the Codex installer bundle after merging dev (Linux, bun 1.4.3)
a6b6fc7 Merge remote-tracking branch 'origin/dev' into tchain-10273
9d36b52 fix(telemetry-core): the disabled path loads no OTLP code, and every wire slot is allowlisted
f7be11c chore(omo-codex): regenerate the Codex installer bundle after merging dev (Linux, bun 1.4.3)
fdeee83 build(bundles): commit the regenerated thread-sdk bundle (#10604)
fb3f7d8 chore(telemetry-core): exempt the vendored OTLP proto code from whitespace checks
566cd4d Merge remote-tracking branch 'origin/dev' into tchain-10273
e05cfdd fix(telemetry-core): the artifact projection is required and LogRecord bodies never travel
ccef050 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
897c8b8 fix(memory-core): classify flock failures by errno and vouch only on local filesystems
8696dea Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
e9d0224 fix(memory): let the pre-commit hook accept the claim receipt header; prove it on the real binary
1226c99 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
1784141 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
25680d2 Merge remote-tracking branch 'origin/dev' into feat/telemetry-otel-host
92cf5b7 docs: changelog for handoff-hint telemetry (#10607)
32e8328 Merge remote-tracking branch 'origin/dev' into feat/3230-handoff-hint-telemetry
3037c7f fix(memory-core): keep the git-activity lock out of lock-record scans and never recreate a removed memory home
2b6d1b6 docs(changelog): memory claim receipts and consent binding (#10498)
50eda70 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
95fc163 docs(changelog): drop a stray conflict marker from the dev merge
4802b83 Merge remote-tracking branch 'origin/dev' into fix/10322-git-lock-flock-liveness
8936221 docs(changelog): kernel-lock liveness for stranded git lock reclaim (#10604)
9c0a4bb fix(memory-core): decide git liveness with a kernel lock so dead-writer reclaim works on Linux
eab4146 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
e7d9060 fix(memory): keep image-only user turns in the journal so they break consent adjacency
6ea999d fix(memory): let the facts extractor bind a consent reply to the previous turn's proposal
b59a8e4 fix(memory): bind a consent reply to the proposal it directly answered
8ab0fae fix(memory): auto-verify consent only for a closed table of explicit approval phrases
7d03e59 fix(memory): verify a user quote only against a closed character allowlist
90082b2 fix(memory): no combining marks or default-ignorables in a consent message
1d1d978 fix(memory): refuse question and hedge punctuation by class, not by list
e89ddd7 fix(memory): trim only whitespace . ! ~ at the quote edges; one shared user_quote rule
546d39d fix(memory): a user receipt needs the user's whole message, not a part of it
c15c30d fix(memory): close the spanning-quote and later-clause gaps in claim receipts
7a56b99 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
f833698 Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
58b5a8d fix(memory): a user receipt needs the quote to be the user's last word (lead decision B)
a57de70 test(memory): one consent corpus for every retraction from all review rounds
e3311c8 fix(memory): scan the next sentence for any retraction, Hangul stems as substrings
584ec3c fix(memory): Korean next-sentence refusals and prohibitions downgrade consent
eb6bdee Merge remote-tracking branch 'origin/dev' into fix/10488-memory-authority-receipts
cfb7e3f fix(memory): whole-sentence consent check; doubt stays a suggestion
070949a fix(memory): a quote inside a question or after a negation stays a suggestion
a863d41 fix(memory): receipts store the whole user sentence; update_description re-stamps
6abdc94 Merge remote-tracking branch 'origin/dev' into t10273m-refresh
d9acd29 Merge branch 'dev' into fix/10356-preview-safe-handlers
d3ff21b fix(memory): unverified edits demote a user note to mixed; Hangul keeps the word floor
1c9fa35 fix(memory): harness-owned note receipts, scoped authority rule, review fixes
9aa5eed fix(memory): memory is reference only; writes carry verified claim receipts
6f74626 chore(omo-codex): regenerate install bundle after dev merge
24572df Merge branch 'dev' into fix/10356-preview-safe-handlers
29beb77 Merge remote-tracking branch 'origin/dev' into t10273m-refresh
fd8e63c Merge branch 'dev' into fix/10356-preview-safe-handlers
430e8e2 Merge branch 'dev' into fix/10356-preview-safe-handlers
88da579 fix(telemetry-core): declare the spool purge diagnostics in the root types entry
145b0bd build(omo-codex): regenerate bundles on Linux (node 24, bun 1.4.2)
6f4c3df Merge remote-tracking branch 'origin/dev' into feat/telemetry-otel-host
f88e773 fix(telemetry-core): keep the errno code of a failed opt-out purge in the diagnostics record
7bc785f fix(telemetry-core): report an opt-out purge that cannot delete its own spool file as incomplete, not as a swapped entry
eab0c7d fix(telemetry-core): keep the opt-out purge sweeping past an entry swapped mid-purge; test FIFO, file symlink and foreign owner
1bba6e7 Merge remote-tracking branch 'origin/dev' into feat/telemetry-otel-host
78635fd docs(changelog): note the purge's per-entry skip, owner check and required spool root
b426258 fix(telemetry-core): purge only regular spool files of the current user, inside an owned spool dir below a required root
1bd8e2c Merge remote-tracking branch 'origin/dev' into feat/telemetry-otel-host
81b5ea1 Merge remote-tracking branch 'origin/dev' into feat/telemetry-otel-host
067859b test(telemetry-core): pin the documented batch id counter overflow limit
c0a75fe fix(telemetry-core): count every record of an abandoned active file as dropped
b4e8bda fix(telemetry-core): purge only the spool's own files, and only inside a verified spool directory
e6bd23b refactor(telemetry-core): move the retry sleep primitives out of the OTLP sender
e13d4f7 Merge remote-tracking branch 'origin/dev' into feat/telemetry-otel-host
f5a1db9 docs(changelog): note the opt-out spool purge and the request timeout for the OTLP host
bbb598c test(telemetry-core): widen the shutdown-cap slack and give filesystem-heavy tests explicit timeouts
5c788dc fix(telemetry-core): apply the wire key rule to every log record and span, not only capture()
9d24e9e fix(telemetry-core): finish short spool writes, roll back a torn frame, and count write failures as dropped
50c7514 fix(telemetry-core): retry sleeps remove their abort listener when they end normally
e5c2dca fix(telemetry-core): per-request timeout, unref'd retry timers and a lease deadline so a hung collector cannot stall sending
ce03434 fix(telemetry-core): bound the quarantine by the spool cap and the age sweep
187b607 fix(telemetry-core): an opt-out purges the whole spool, at startup and on mid-run withdrawal
79b6f8d fix(telemetry-core): capture never throws; integers outside int64 travel as doubles
44eabac fix(telemetry-core): monotonic batch ids so send and eviction order follow seal order
ecc6143 docs(changelog): link the OTLP host entry to its own PR (#10273)
c299446 fix(telemetry-core): release a claim whose rename is still running when shutdown stops the sender
6562e1e test(telemetry-core): stall the shutdown flush before any I/O in the cap regression
e8c8dbf fix(telemetry-core): leave a cleanup reserve inside the 2 s shutdown cap
ca30f18 fix(telemetry-core): claim and read spool batches off the event loop so a stalled rename cannot hold the shutdown deadline
f7ac399 fix(telemetry-core): hard 2 s shutdown deadline and a rename-free, linear-cost spool hot path
f593e9f test(telemetry-core): RED tests for the shutdown deadline and crash-safe link moves in the spool
85919ff feat(telemetry-core): OpenTelemetry providers with write-ahead OTLP spool and sender
8268412 test(telemetry-core): RED tests for the OpenTelemetry host, write-ahead OTLP spool and sender (#10272)

bun add -g omo-ai