Refresh Gemini, Paseo and OpenCode production dependency graphs; repair code-server dependency bundles and proxy-core binaries. Preserve consumer APIs, transactional rollback and the existing Trivy security policy.
Validated native amd64/arm64 workstation build and runtime smoke, both browser variants and eight policy replays at 6959d03001.
Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers.
Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations.
Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification.
Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.
oh-my-opencode >= v4.7 removed the 'mcp start' subcommand but the installer still writes a local MCP config entry pointing to it. Built-in MCP servers (websearch, context7, grep_app, lsp) are remote HTTP and registered by the plugin itself. After running the installer, clean up the MCP section so OpenCode doesn't try to start the nonexistent command.
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
When OMO_PACKAGE is explicitly set (e.g. via compose .env), the resolver was short-circuiting and outputting baseline=0, bypassing AVX2 detection. This meant Bun was never reinstalled as baseline and kept SIGILLing. Now the resolver always computes the baseline flag and only uses OMO_PACKAGE as the package name override.
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
When the resolver detects a non-AVX2 CPU, reinstall Bun via its own install script before running oh-my-opencode. Bun's installer reads /proc/cpuinfo and auto-selects the baseline variant, which runs on older x64 CPUs. Export BUN_VERSION as an ENV in the Dockerfile so the install script can target the same version at runtime.
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Replace platform-specific npm package resolution with the meta-package oh-my-opencode and OH_MY_OPENCODE_FORCE_BASELINE=1 env export. The meta-package's JS wrapper handles baseline binary selection, avoiding npm exec binary-not-found errors with platform-specific packages while still supporting non-AVX2 hosts. Also works around the OMO_PACKAGE env var leakage issue by making resolver always output the meta-package name.
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Run oh-my-opencode through npm exec instead of bunx so non-AVX2 hosts can install the baseline package without Bun crashing before the package entrypoint runs. Keep the existing package resolver in place so doctor, smoke, and auto-install all follow the same compatibility path.
Make the workstation image select architecture-appropriate oh-my-opencode packages and stop assuming AVX2-capable amd64 hosts. Also upgrade Bun and make the bundled Go download respect the target container architecture so the image builds and installs more reliably across supported platforms.
- add ensure_hashline_default() to set hashline_edit: true in oh-my-openagent.json
- called before user override merge so users can opt out via .user.json
okxlin
