v2026.9.8

Highlights

Anthropic OAuth login no longer dead-ends on "State mismatch." (#1502, fixes #1503)

If another senpi/omo process on the same machine still held the OAuth callback port 53692 - a second TUI session, an RPC host whose login prompt was never answered, an abandoned /login - every /login anthropic and /claude-account add ended on a browser page reading "Authentication failed - State mismatch.", because the new login silently fell back to manual mode while still sending the browser to localhost:53692, i.e. to the other process's listener. Now:

• the login binds port 53692 when it is free and an ephemeral loopback port otherwise; the auth URL, the paste prompt, and the token exchange all carry the port that is actually listening (the OAuth client accepts any localhost port on /callback, as the Claude Code CLI itself relies on);
• a browser callback that belongs to a different session (or an earlier attempt) gets a page that says so and tells you to paste the address-bar URL into the session that is still waiting - or to start the login again from there;
• a login that receives neither a browser callback nor a pasted redirect URL for 10 minutes times out and releases its port instead of holding it for the life of the process.

Fixed

• Anthropic OAuth: ephemeral callback port when 53692 is taken, guidance page for foreign-session callbacks, 10-minute idle timeout (see Highlights) (#1502).
• Anthropic mid-output server fallback now follows the configured abort/continue policy instead of raising an unsupported-fallback error; continuing responses keep their serving-model identity and do not execute abandoned pre-fallback tools, and fallback markers stay out of later requests (#1493).
• Compaction recovery: required compaction no longer charges serialized prose bytes as tokens (which could reject a fitting retained turn after a summarizer failure); automatic blocking compaction and failed warm summaries share manual compaction's deterministic recovery, complete tool pairs survive steering messages, and genuinely rejected suffixes report their boundary, budget, and unsafe message location (#1497, oh-my-openagent#7952).
• Native tool search: a rejected Anthropic request now reports its HTTP status through the provider response hook, so the permanent-400 fallback is live (#1481); a native tool-search 400 retries once in place on the same model with native injection disabled instead of demoting to a weaker model (#1482); references handed back both namespaced and recased by a gateway (mcp__a4e6__LspSymbols for lsp_symbols) are folded onto the request's own tools (#1489); dangling references are dropped and a search result left without references is demoted to text (#1480).
• Goals: a provider turn that ends with the tool_use stop reason but no tool-call block no longer stalls an active goal forever - it is treated as provider breakage and resumed through the provider-recovery lane (#1490).
• /gpt-account add shows the OpenAI Codex login-method chooser as a real selector instead of an empty text input; the device-code flow prints the user code, and the paste dialog closes by itself once the local callback completes (#1486, #1485).
• Foreground bash runs git with GIT_EDITOR=true and GIT_TERMINAL_PROMPT=0, so an editor or credential prompt fails fast instead of blocking the agent until the timeout (#1475).
• Service tier: sessions created without builtin extensions (SDK embedders, delegated children) now send the priority tier of -fast models, :priority pins, and fast mode on the wire (#1474, oh-my-openagent#6795).

Changed

• Goal backstop: a goal parked on live wake sources re-checks at least every 4m30s (promptCache.goalBackstopMaxSeconds default 270 instead of 3570), so a monitor whose filter never matches cannot park the goal for an hour; set goalBackstopMaxSeconds: 3570 to keep the old long backstop (#1476).
• Terminal monitor telemetry: monitor state events carry command, filter, persistence, deadline, fire counts, and last-fired timestamps; monitor endings emit a typed lifecycle event (#1491).
• Prompt presets route eval work by dependency instead of call count: independent reads, searches, and probes batch into one cell, while edits, side-effecting commands, approvals, and result-dependent calls run one at a time and are observed (#1500). The GPT-6 Astra preset does small follow-ups itself instead of forwarding them to a child (#1479) and shows the same high-reasoning warning as GPT-5.6 Sol at xhigh/max (#1478).
• Toolchain: Bun pinned to 1.4.2 (#1494).

Pull requests

#1502 #1500 #1497 #1494 #1493 #1491 #1490 #1489 #1487 #1486 #1480 #1479 #1478 #1476 #1475 #1474