oh-my-agent crossed 9.0 this week, and it carries the project's first breaking change: the agent slot formerly called retrieval is now explore. The name finally matches the work class, and migration 014 rewrites your oma-config.yaml automatically on install or update. Around that rename, 175 commits landed in seven days, taking the CLI from 8.42.0 to 9.0.2.
What's new
-
Two new agents:
refactor-engineerowns budget-funded, behavior-preserving refactoring, andresearch-explorertraverses oma-search, oma-market, and oma-scholar with cited, trust-labeled synthesis. - oma-refactor skill: smell, SATD, and hotspot targeting with characterization-test safety nets. Utility eval measured a +57.1% lift over baseline across 7 tasks.
-
oma hookABI: vendor hooks no longer copy and patch per-vendor bun scripts. A singleoma hook --vendor <v> --event <e>entry point now dispatches for all 8 hook-model vendors, with embedded routes and fail-open semantics. -
New dispatch vendors: commandcode joins the registry as an opt-in vendor, and pi (Earendil's multi-provider proxy) is now a full per-agent dispatch target via
oma agent:spawn <agent> -m pi. -
oma ralph:verify: the ralph workflow's anti-circumvention gate moved from prose instructions to a deterministic CLI verdict with structured JSON output and non-zero exit on failure. - serena-primer: a per-session prompt hook that reminds the model to load Serena's symbolic tools in Serena-activated projects, instead of silently falling back to grep.
The through-line is mechanical enforcement. Prose instructions get rationalized away by agents; CLI verdicts and dispatch ABIs do not.
What's fixed
- Docs reference verification cut false positives from 6,611 to 394 broken refs repo-wide (491 to 29 on the docs subset) by tightening extraction rules and adding a git-backed suffix resolver.
-
oma updateno longer prunes skills that shipped agents depend on, which previously could deliver an agent without its required skill. - Antigravity installs stop clobbering user-registered hooks in
hooks.json; oma-managed entries now merge instead of overwrite. -
oma hookcaps its stdin read at 2 seconds with fail-open dispatch. Codex was holding the pipe open and stalling prompts for 18 to 21 seconds. - Discussing ultrawork or ralph by name no longer activates the persistent workflow; the keyword detector now distinguishes commands from mentions and compound tokens like
ralph.md. - A crashed install or update lock is reclaimed in 60 seconds instead of 10 minutes when the holding pid is confirmed dead.
What's better
-
oma hookinvocation dropped from roughly 0.54s to 0.32s user time via a lazy-loaded command tree and an argv fast path, which matters because it fires on every prompt. - All 28 non-test CLI files over 500 lines were split into focused modules with public APIs unchanged; the largest remaining file is 491 lines, verified by 3,043 passing tests.
- On-disk backups consolidated from 5+ scattered conventions into a single
.agents/backup/root, covered by one gitignore line and cleared after a successful update. - A security pass replaced shell-interpolated
execSynccalls with argv arrays, added SSRF guards and path-containment checks, and closed an XSS vector in slide font inlining. - The cross-slice import boundary gate went from permanently red (24 false violations) to green and now gates CI.
Installation
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/first-fluke/oh-my-agent/main/cli/install.sh | bash
# Windows (PowerShell)
irm https://raw.githubusercontent.com/first-fluke/oh-my-agent/main/cli/install.ps1 | iex
Links
oh-my-agent is built for teams who orchestrate more than they prompt. Next up: deepening the pi dispatch path and graduating commandcode from opt-in.