Skip to content

v0.1.216

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Sep 20:17
v0.1.216
f8e6d89
This commit was signed with the committer’s verified signature.
PyRo1121 Olen Latham
SSH Key Fingerprint: ucuPdoh9RiuvgSY+Wh0UbvFI4QMXpzPgYflENQIa5Ik
Verified
Learn about vigilant mode.

Alpha

OMG is alpha software: the CLI, flags, and on-disk formats can change without a compatibility guarantee.

Breaking changes

These CLI and release changes shipped in 0.1.215 and remain in later alphas.

omg license removed

Local features are no longer license-gated. Dashboard identity is optional.

# Removed
omg license
omg license check
omg license pricing

# Use instead
omg account status
omg account link <token>
omg account unlink

Team, Enterprise, and Fleet commands no longer require a paid JWT. Scripts that expected those commands to fail without a license will now succeed locally. Remote dashboard sync still needs a valid token from omg account link.

Installation

Quick Install (Linux/macOS):

curl -fsSL https://raw.githubusercontent.com/PyRo1121/omg/main/install.sh | bash

Windows Subsystem for Linux: Use the Linux installer inside your WSL distribution.

What's New in v0.1.216

Style

  • Search: Drop per-row separators, tighten list rhythm
  • Update: Inline source badge in update list rows
  • Policy: Warn about missing policy file once per process
  • Info: Render sync-DB info through the shared kv renderer
  • Test: Rustfmt the R2 --remote rollback assertion (#185)

#181 squash-merged with a cargo fmt --check failure on the new

rollback CLI guard. Reapply rustfmt on current main.

⚠️ Breaking Changes

  • Sanitize remote strings at render boundaries; revert breaking sha2/p256/p384 bump

⚡ Performance

  • Runtimes: Skip vendor fetch for exact version requests

resolve_requested_version returns early when the request is not partial, so exact versions and aliases avoid list_available network work.

✨ New Features

  • Runtimes: Uninstall versions via omg use RUNTIME VERSION --uninstall
  • Hook: Add --uninstall removing shell integration with backup
  • Install: Add --uninstall removing binaries and shell integration
  • Runtimes: Add native Deno management

Install verified Deno release archives, resolve stable aliases and project pins, expose the vendor bin directory without shims, and register Deno across CLI discovery and health checks.

  • Hooks: Resolve project runtime ranges

Read Python and Deno project pins, map compatible requests to installed versions, normalize Java feature pins, and keep each vendor bin directory intact on PATH.

🐛 Bug Fixes

  • Ci: Align tests with current CLI contracts
  • Tui: Sanitize remaining team fields
  • Doctor: Report healthy runs with warnings
  • Sanitize TUI team names
  • Sanitize TUI package versions
  • Ci: Merge main and resolve progress.rs clippy conflict

Take main's later mechanical clippy form (allow reason, take()

clear/drop) and keep this branch's portable dead_code/guard bindings.

  • Ci: Gate fast-path block instead of stubbing for backend-less builds
  • Ci: Repair debian-pure transaction lane call and drop dead import
  • Ci: Satisfy portable clippy gate without touching behavior
  • Ci: Gate elevated fast-path helpers for backend-less feature combos
  • Ci: Un-gate ensure_local_archive_consent for backend-less feature combos
  • Ci: Format tree with pinned rustfmt to unblock Quick Gate
  • Sanitize plain update summary rows
  • Strip bidi controls from PKGBUILD review
  • Tea: Sanitize package versions (#193)

fix(tea): sanitize package versions

  • Sanitize repo field and invisible chars in terminal text

    • Render the tea info Source field through sanitize_terminal_text; repo

from daemon IPC is untrusted like name/version/description/url.

  • Extend sanitize_terminal_text to strip zero-width and invisible

formatting characters (U+200B-200F, U+2060-2064, U+2028/2029, U+FEFF)

in addition to control bytes and bidi overrides/isolates.

  • Add unit tests for the sanitizer (control/OSC, bidi, invisible,

separators, visible multibyte preservation) and harden the tea info

view test with zero-width and repo payloads.

COM-183

  • Sanitize tea package versions
  • Sanitize AUR build package names
  • Sanitize update summary fields
  • Clippy: Clear gate after progress-lane migration (mechanical only)
  • Test: Create GnuPG home with 0700 in round-trip test
  • Secrets: Detect Google OAuth and OpenAI key formats
  • Rollback: Remove historical worktree after successful rebuild
  • Keyserver: Safe getuid and extracted home validation
  • Sbom: Populate component licenses from package databases
  • Team: Back up local omg.lock before a pull overwrites it
  • History: Archive retired transactions instead of dropping them
  • Rust: Stream component archives through disk

Share tar entry safety across runtime and component extraction, and replace Rust's in-memory XZ buffer with a bounded same-filesystem temporary file.

  • Python: Select exact standalone assets

Page through bounded GitHub release results, reject incompatible build variants, preserve Python prerelease identity, and stop an install search after the matching page.

  • Java: Normalize Adoptium feature requests

Accept Java feature pins such as 21 and 21.0, reject unsupported update requests before network access, and keep the extracted JDK bin directory intact.

  • Osv: Scope cache key by ecosystem and validate severity scores
  • Update: Refresh Arch daemon snapshot after sync before probing
  • Clippy: Clear main gate blocked by recent landings
  • Config: Preserve comments and unknown keys on save
  • Doctor: Bound DNS resolution and detect stale db.lck
  • Release: Publish R2 objects to the remote bucket (#184)
  • fix(release): publish R2 objects to the remote bucket

Wrangler 4 defaults r2 object commands to local Miniflare storage, so

sync-r2 could succeed without writing omg-releases. Pass --remote and

stop using stdin as --file=-.

  • Update: Do not leave an AUR spinner live on skipped hosts (#189)

The joined check started a "Checking AUR packages" bar before the lane

could skip. Debian and test_mode never finished it, so the ticker stayed

on screen. Only start that bar when the lane actually runs, and clear it

on official or policy errors. The search picker test now asserts the

real JSON/TTY gate instead of an inverted attended check.

  • Bench: Archive documented update-only hyperfine runs (#188)

#179 rejected every export without search.json, including

./benchmark-hyperfine.sh --update which only writes update.json.

Keep fail-closed for any other scenario set.

  • Search: Never group an explicitly queried language pack
  • Security: Sanitize AUR-controlled strings at info render sites
  • Deps: Restore audited crypto pins broken by renovate #183
  • Release: Publish R2 objects to the remote bucket (#181)

Wrangler 4 defaults r2 object commands to local Miniflare storage, so

sync-r2 could succeed without writing omg-releases. Pass --remote and

stop using stdin as --file=-.

  • Ci: Dispatch Release after tagging so GITHUB_TOKEN actually publishes (#180)

Tag pushes made with GITHUB_TOKEN do not start other workflows, which is why

v0.1.215 never became GitHub Latest after CI tagged it.

📚 Documentation

  • Separate enterprise dashboard policy from local policy.toml

omg enterprise policy show reads dashboard TEAM_POLICIES.

The local host file is omg audit policy, not that command.

  • Correct stale CLI and runtime guidance

🔧 Maintenance

  • Sync Cargo.lock with toml_edit
  • Deps: Update rust dependencies (#183)

🧪 Testing

  • Expose remaining raw team fields
  • Expose raw team names in TUI
  • Expose raw package versions in TUI
  • Ci: Refresh the isolated fuzz lockfile
  • Expose bidi controls in PKGBUILD review
  • Expose raw version text in tea info

Platform Support

Platform Architecture Binary
Arch Linux x86_64 omg-v0.1.216-x86_64-linux-arch.tar.gz
Debian x86_64 omg-v0.1.216-x86_64-linux-debian.tar.gz
Ubuntu x86_64 omg-v0.1.216-x86_64-linux-ubuntu.tar.gz
Fedora/RHEL x86_64 omg-v0.1.216-x86_64-linux-fedora.tar.gz
macOS ARM64 omg-v0.1.216-aarch64-darwin.tar.gz
WSL x86_64 Use the binary matching the installed Linux distribution

Verification

Verify the downloaded archive before extracting or installing it.

Integrity (checksum):

Linux:

sha256sum -c omg-v0.1.216-*.sha256

macOS:

shasum -a 256 -c omg-v0.1.216-*.sha256

Provenance (recommended): every release archive carries a Sigstore build
provenance attestation generated by GitHub Actions. Verify it with the GitHub
CLI:

gh attestation verify omg-v0.1.216-x86_64-linux-arch.tar.gz -R PyRo1121/omg

omg self-update and install.sh perform this check automatically whenever
the GitHub CLI is installed locally.

Manual Installation

Linux/macOS:

tar -xzf omg-v0.1.216-*.tar.gz
cd omg-v0.1.216-*
sudo cp omg /usr/local/bin/

Full Changelog: https://github.com/PyRo1121/omg/blob/main/docs/changelog.md

Assets 13
Loading