DEV Community

gracefullight
gracefullight

Posted on

oh-my-agent: oma-security replaces deepsec, one global home

#productivity #opensource #ai #programming

oh-my-agent shipped five major CLI versions in seven days, from 15.10.0 to 20.0.0. Most of the bumps are deliberate breaking changes that remove old paths instead of keeping compatibility shims. Here is what changed and what you need to do about it.

What's new

  • oma-security replaces oma-deepsec, and /security replaces /deepsec, with no compatibility aliases. It routes source, skill, MCP, and scoped web runtime work to target-specific engines, keeps the engine evidence, and requires independent validation before a finding is confirmed or a CI gate is applied. Deepsec stays the default source scanning engine. The skill ships with 11 resource files, including a 408-line findings contract.
  • One global data home. OMA_HOME now selects the global data home (~/.oma by default) and holds definitions, state, schedules, and backups. Migration is copy-first with conflict checks and active-runtime checks. Old paths are not read as runtime fallbacks.
  • AgentMemory isolation. Writes, recalls, retries, and imports are scoped to the original project and profile. Shared-server responses are filtered by ownership. Install and update now prepare the default AgentMemory provider, unless the project opts out or uses another provider.
  • Agent decisions are captured and verified as state events (b4d76a71), so a run's choices can be checked after the fact.
  • User hooks for commit messages. The managed commit-msg hook now runs every executable file in .githooks/commit-msg.d/ first, in name order. A non-zero exit rejects the commit. oma never writes into that directory, so a commitlint call survives oma update.
  • Tooling profiles for oma-dev-workflow: Python, JS/TS, Dart/Flutter, Dockerfile, and local commitlint, plus guidance on reusing project verification tasks.

What's fixed

  • oma retro --json printed the banner and spinner before the JSON. It now emits one valid document, including for empty windows.
  • Help showed --older-than defaults as 90ds. Units are now appended only to bare numeric defaults.
  • schedule sync crashed on manifest rows missing required fields, which left every healthy job stale. Malformed rows are now dropped and reported, and schedule list names them.
  • Orphan pruning no longer touches internal services such as AgentMemory and Serena maintenance. It is limited to the agent schedule namespace.
  • Concurrent hook deduplication could expire a competing publisher's fresh claim. It now rechecks the clock after reading and tolerates clock rollback only within the TTL.
  • Standalone skill installs now bundle the shared guides they reference (closes #866).
  • Pinned local Serena bridge entries are repaired, with user environment and server options preserved.
  • design workflow routing now requires a visual target, so "API design" no longer triggers it.

What's better

  • Plugin packages lost 471 duplicated files. Full plugin packages now share one package-level resource tree. Root plugin skills require that shared tree, so use OMA preset installation instead of npx skills or APM.
  • Cleaner command surface. Internal entry points are hidden from oma describe and help but stay runnable. 25 command groups that had no description now have one. skills matrix is now oma skill matrix, and the plural spelling is rejected.
  • Docs generated from source. The CLI registry is rendered from oma describe, and the skill catalog from SKILL.md frontmatter. Both carry a --check mode that reports stale blocks.
  • Docs site content. It gained mermaid diagrams for routing, ultrawork, ralph, and config resolution, plus decision tables and a glossary. The 11 locales and 12 README translations were synced to match.
  • Corrected claims. The ralph judge is now described as prompted, not independent, because nothing checks the spawn. Event log lookup points to oma state list instead of a hard-coded path.

The week landed 81 commits across 840 files (+70,280 / -32,120), and the memory rework alone was validated with 1,095 tests.

Upgrade notes

  • Run oma state migrate --runtime to move project-local state. Runtime readers no longer load it.
  • Replace /deepsec with /security in any scripts or habits.
  • Replace oma skills matrix with oma skill matrix.

Installation 

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/first-fluke/oh-my-agent/main/cli/install.sh | bash
Enter fullscreen mode Exit fullscreen mode 
# Windows (PowerShell)
irm https://raw.githubusercontent.com/first-fluke/oh-my-agent/main/cli/install.ps1 | iex
Enter fullscreen mode Exit fullscreen mode

Links

oh-my-agent is built for teams who orchestrate more than they prompt. Next up: tightening the ralph judge so the spawn is verified instead of only prompted.

https://github.com/first-fluke/oh-my-agent

Top comments (0)