feat(omp): integrate Oh My Pi provider on current main - #11973
nullStack65 wants to merge 25 commits into
Conversation
Adds omp (https://github.com/can1357/oh-my-pi) as a seventh built-in provider by driving its native stdio ACP server (`omp acp`) through the existing generic ACP client stack (effect-acp), mirroring the Cursor/Grok driver layout: - OmpDriver: provider bundle; manual-only maintenance (T3 never guesses an omp update command); model catalog sourced exclusively from the probe ACP session's configOptions during status checks. - OmpAdapter: session lifecycle on the shared ACP runtime: permission bridging via session/request_permission echoing advertised snake_case option ids, dual elicitation bridging (typed session/elicitation plus the official-SDK ext method elicitation/create with its flat response), task-tool subagent projection into the Agents panel, steering merge, pre-prompt and in-permit cancel checkpoints, and a per-session dispatch lock that serializes the configuration write, the turn.started stamp, and the session/prompt dispatch registration (omp applies model writes to the shared session). The permit is released on dispatch registration or prompt fiber exit (raced), never held across the prompt, so steers stay concurrent; the join carries onInterrupt interruption so post-dispatch cancels cannot orphan a prompt. Rollback is advertised unsupported: the ACP session cannot rewind its native conversation history. - OmpProvider: `omp --version` probe plus ACP model discovery; capabilities attach only to the model the probe session currently runs (trimmed currentValue), other catalog entries report null. Owns both model-option selectors (select-guarded and unguarded existence probe) so their category/id normalization cannot drift. - OmpAcpSupport: spawn args per RuntimeMode (Supervised --approval-mode=always-ask, Auto-accept edits --approval-mode=write, Auto --auto-approve, Full access --approval-mode=yolo); model writes only when the session advertises no model option at all (write through) or advertises the requested slug in its select model option; unadvertised slugs and non-select model options preserve the session's configured model, and the effective model is returned so callers stamp truthful turn/session state. - OmpTextGeneration: unattended commit/PR/branch/title generation with --auto-approve and elicitation disabled. - Contracts: OmpSettings/OmpSettingsPatch, off by default like cursor/grok/opencode; display name "Oh My Pi". - Web/mobile: provider icon, settings metadata, add-provider entry; model rows render the provider and upstream label per model. Tests: adapter/provider/support/text-generation suites on the shared mock ACP agent covering the four model-write cases (no model option, advertised slug, unadvertised slug, non-select model option), flat elicitation responses, prepare-cancel permit release, dispatch serialization order, thread-filtered event consumers, plus picker row label coverage. Validated end to end against a real omp 18.1.15 install (11.9k-model catalog, streamed turn in the built desktop UI). Discussion: pingdotgg#10883.
…, workspace snapshots
…, model-swap warning
…vel command catalog
…urface failed session load
…neration, cache freshness, docs
Merges the OMP provider work from pingdotgg#11791 (head 14ed34f) onto main 3efdcc5. Conflict resolution in ProviderRuntimeIngestion.ts keeps both sides: main's manual-title guard from pingdotgg#10720 (`titleState.source !== "manual"`) and the PR's explicit agent rename override (`nameIsExplicit`), so an OMP `/rename` replaces a generated title while a manual T3 rename still wins. Main's `thread.title.generate.complete` dispatch with optimistic title/version expectations is preserved over the PR's older `thread.meta.update` call. pnpm-lock.yaml takes main's version: the PR changed only a peer-suffix hash for alchemy with no package.json change, which is lockfile drift. OMP feature work is otherwise carried unmodified per file; see the integration report for the per-file audit.
`vp lint` on the integrated files surfaced one error and dead imports carried from the PR: - AgentSessionScanner.test.ts read `NodeOS.platform()`, which current main's `t3code/no-global-process-runtime` rule rejects. Use `HostProcessPlatform.defaultValue()`, the pattern main's own tests use for module-scope platform checks. - Drop unused `Dialog*`/`PiAgentIcon` imports in AddProviderInstanceDialog after the PR removed the Pi Agent coming-soon option, plus unused `EffectAcpSchema` and `acpPermissionOutcome` imports in OMP files. No behavior change.
Current `@effect/tsgo` reports `@effect-diagnostics-next-line
preferSchemaOverJson:off` as TS377000 ("directive has no effect") on
11 OMP lines. effect-tsgo promotes those warnings to a non-zero
`tsc --noEmit` exit, so the server typecheck failed on warnings alone.
The directives suppress nothing on this toolchain; remove exactly the
11 flagged lines and let fmt reflow one JSON.stringify block.
Server typecheck now has 0 errors and 0 warnings (suggestions only).
No behavior change.
github-actions
Bot
added
vouch:unvouched
Independent exact-head source review — Oh My Pi (omp) integrationVerdict: Reviewed state (re-fetched immediately before posting):
Constraints honored: read-only. No source changes, no commits, no merge, no OMP install, no sign-in, no provider credentials, no inference. Tests were executed in an isolated WSL Ubuntu 24.04 clone ( 1. Provenance / commit graphThe candidate is a genuine descendant of the #11791 implementation, not a re-implementation:
2. Per-file parity audit (independently reproduced)I recomputed blob-level parity between 72 source files = 54 byte-identical + 17 content deltas + 1 source-only ( All 17 deltas classified (A = current-main reconciliation, B = lint/typecheck conformance, C = main already implements differently, D = behavior-changing integration delta, E = suspicious): Lint/typecheck-only (B) — 6 OMP files, all removals of stale/no-op Current-main reconciliation (A/C) — shared files keep main's newer code and re-apply only the OMP hunks:
No feature hunk was dropped. Every OMP-specific production file from #11791 exists in the candidate, and the only deltas in OMP-named files are lint removals. 3. Title / session authorityThe candidate re-implements #11791's explicit-rename behavior on main's newer title machinery instead of the source's old
Walkthrough of the required cases:
4. Feature parity (traced end-to-end, not file existence)All 24 capability areas are wired: provider registration ( Nothing that #11791 exposed is missing in #11973. Gaps found are present in #11791 too (verified byte-identical files), i.e. scope/robustness observations, not regressions: no live 5. Shared-runtime regression reviewGeneric changes are limited and consistent with existing provider patterns:
6. Security / auth / process boundary
Non-blocking security notes (also present in #11791):
7. LockfileKeeping
8. Independent test evidenceRun on the exact candidate head in a clean WSL clone (source-only;
Reported Windows scanner flake: not independently reproduced here (Linux-only runner; 9. Hosted CI stateWorkflow runs for Verdict:
|
Operator-authorized live acceptance — Oh My Pi (omp) integrationVerdict: 1. Exact refs at test time
2. OMP install and state protection
3. Discovery / auth (no inference)Enabled Oh My Pi through the real Settings UI (off by default, as designed). Provider snapshot then reported:
4. Model selection and attemptsPolicy: subscription route, non-Anthropic, low cost. Primary:
No silent fallback occurred; each attempt is recorded above. The quota block is account-wide for the in-catalog codex models until the reset date. 5. Real ACP session lifecycle (verified on the failure-free paths)Exact frame sequence observed through the candidate adapter (
Token accounting is real: 6. Model / thinking switching
7. Commands / context / compaction
8. Titles and
|
Unattended commit/PR/branch/title generation spawned omp with --auto-approve and registered no permission handlers, so repository-derived prompt text could steer the model into write or destructive tool work that ran without any user in the loop. Spawn those sessions with --no-tools and always-ask instead, and answer any remaining permission request with a refusal and any elicitation with a decline, so nothing can pause on UI that does not exist. The interactive provider is unchanged.
The omp usage --json probe refreshes provider quota over the network. Warm runs measure 0.5-1.3s but the first refresh after an omp update measured 4.8s, so the 3s bound dropped a healthy account's limits and could transiently degrade the snapshot. 10s matches omp's own update --check bound and still fails rather than hanging a refresh.
Current-runtime refresh + bounded safety hardening — checkpointVerdict: This slice refreshed the runtime evidence to current OMP, classified current-main drift, repaired one narrow probe-timeout brittleness, and closed the unattended text-generation approval gap found in independent review. No Codex inference was attempted (quota remains exhausted until ~2026-09-19T17:18:32Z). 1. Exact refs
2. Current-main drift classification
No semantic overlap with OMP/shared integration surfaces, so per the dispatch rule the reviewed head was kept and no main merge was performed. 3. OMP user-state proof
4. 18.0.10 → 18.2.1 delta and current compatibility (no inference)Release deltas that matter to this integration: ACP Live run (candidate code driving the real
No runtime incompatibility was found. Raw observations: 5. Probe timings and timeout repair
Conclusion: the 4 s version probe has 15–40× headroom on current OMP and is not brittle — kept. The 3 s usage bound was exceeded by an ordinary cold quota refresh, so it was raised narrowly to 10 s (matching omp's own 6. Unattended text-generation security repairFinding (confirmed in source): Repair, in the smallest shape that keeps generation unattended:
Regression tests added: spawn args assert 7. Source validation (all on
|
2 participants
What this is
A draft, source-only integration of the Oh My Pi (
omp) provider from #11791(head
14ed34f4e21946819109d2cdf17186d89b4b6d1b, unchanged) onto currentmain.Refresh history: the first integration head
2d713044dwas built on3efdcc5296f1754e0f3bf7fee5fc2ada510e0438(dispatch main). Main then moved tof4600d77dd7c2fa9f10e8f4500882e427fcc7e26, producing refreshed headad9837ed5(a merge that preserves
2d713044das an ancestor). Main moved once more to87a12b53fdff7e2e0318af3edea54005557cea56(#11928), and the branch was synced toit, yielding the current head
d8707173644cfc49c62b1ad2f840a0ffc41a4b5c. Itexists to answer whether the OMP feature set can ride today's main cleanly.
It does not install, sign in to, or run OMP, and it is not a merge request.
Integration shape
feat/omp-main-integration-20260915(forknullStack65/t3code).d8707173644cfc49c62b1ad2f840a0ffc41a4b5c: merge ofad9837ed5e6ec8ce249b8264c3f0da174c87ff90(refreshed integration) with87a12b53fdff7e2e0318af3edea54005557cea56(current main).ad9837ed5mergedf4600d77dd7c2fa9f10e8f4500882e427fcc7e26with2d713044d609d82b8eda3802659ce2da5c09605e,which itself merged feat(omp): Oh My Pi provider with full terminal parity #11791 head
14ed34f4e21946819109d2cdf17186d89b4b6d1binto
3efdcc52...plus two conformance commits. All 18 PR commits andauthorship survive; nothing is squashed or rewritten.
87a12b53: 71 files, +13,397 / −186.packages/contracts/src/settings.ts/.test.ts: main'sfollowUpBehaviorand the OMP provider settings coexist.
AddProviderInstanceDialog.tsx: main's simplifiedDialogimport kept;feat(omp): Oh My Pi provider with full terminal parity #11791's removal of the Pi Agent coming-soon row kept.
pnpm-lock.yaml: main's version kept (the PR's alchemy peer-hash churn hasno accompanying
package.jsonchange).#11928(usage refresh): lands only inapps/web,apps/mobile,packages/client-runtime, and docs; no OMP file overlap.ProviderRuntimeIngestion.tskeeps main'sthread.title.generate.completedispatch and combines main's manual-title guard with the PR's explicit-agent
rename override: an OMP
/rename(nameIsExplicit) replaces a generatedtitle, while a manual T3 rename still wins.
from the PR head are that title-policy merge, lint/typecheck conformance, and
files main itself changed since the PR's branch point.
Feature parity
All #11791 capabilities are present:
ompdriver registration, ACP runtime,OMP model catalog with upstream grouping and thinking ladders, skills/command
discovery, slash-command argument suggestions,
usage_updatecontext meter,/compact, usage/auth projection, self-update advisory, transcript/projectdiscovery and import/resume,
/rename,/freshsession replacement,approvals, subagent progress, image input, interrupt, web/mobile metadata,
text generation, and docs.
Validation (source-only, on the refreshed heads)
0 warnings.
pass;
AgentSessionScannerpasses standalone (85 pass / 5 skipped).129 pass; client-runtime usage: 7 pass; mobile usage section: 2 pass; root
script suite: 17 pass.
vp fmt --checkclean on all changed files;vp lintexit 0 (ChatComposerwarning count identical to main, 43);
git diff --checkclean.this Windows host; clean
mainfails the same family (3-4 tests per run,including standalone), so it is environmental, not introduced here.
Work done by opencode (deepseek-v4.1-flash) in the OpenCode harness; refresh
passes by opencode (deepseek-v4.1-flash), OpenCode harness.