[georgepullen]

Fixes #416
Refs #366

Problem

The nightly OMP latest lane fails on 18.14.0 at tests/omp-sdk-contract.types.ts(32,3). OMP 18.13.3 added two session events, manual_compaction_start {mode?} and manual_compaction_end {result?, aborted, skipped?, errorMessage?}, and OMP_SESSION_EVENT_POLICIES does not classify them. Against 18.14.0 the contract file reports five errors: the session event policy and schema checks (lines 32, 35, 38) for the two events, and the command and response policy checks (lines 43, 46) for six new commands.

At runtime the plugin rejects every one of those frames as a protocol violation. Each /compact on 18.13.3+ logs two invalid-event violations, and a skipped compaction ("Already compacted") fails the turn with "OMP compaction failed". The three frames from #366 are also rejected as unknown-event-type. That means an extension_error is dropped without any notice, and config_update does not refresh the model or thinking level.

Change

• Manual compaction events. Added schemas and policies for both events. The session passes them to the existing OmpSessionCompaction operation:
  • During a /compact turn, manual_compaction_start is a no-op because the operation is already open. manual_compaction_end sets the final state. A skipped compaction now completes the turn and shows OMP's reason as an info notice. A cancelled one cancels the turn. The compact response still ends the turn on OMP versions that do not send these events.
  • A manual compaction OMP starts during a prompt turn (for example an extension calling ctx.compact()) gets its own compaction row, the same way an automatic one does. One that starts while idle is projected passively, like the legacy compaction_start and compaction_end events.
  • A skipped compaction now shows its reason as a warning, not as an error.
• paseo-omp: extension_error, session_info_update and config_update logged as protocol violations #366 frames.
  • extension_error is shown as an error notification: OMP extension <path> failed in <event>: <error>.
  • session_info_update is classified and ignored. The provider API has no way to update the title after session.opened.
  • config_update triggers the existing committed-config refresh, as model_changed and thinking_level_changed already do.
• New commands. navigate_tree, abort_branch_summary, set_label, dictation_start, dictation_stop and live_connect are classified as unsupported.
• SDK pin. The OMP SDK dev dependencies move from 18.12.6 to 18.14.0. The session event check is exact, so classifying the new events only passes when the pinned SDK also has them. This replaces chore(deps): update omp sdk to v18.13.1 #432, whose CI fails on bun install --frozen-lockfile because only package.json changed. Here bun.lock is regenerated with bun 1.4.4 and contains only the OMP package changes. npm-shrinkwrap.json is unaffected because these are dev dependencies.
• Fixture. tests/fixtures/fake-omp.ts now sends the new frames for two contract prompts.

Out of scope

• prompt_result.error.code: "cost_cap" (18.13.0). This is not a schema-only change:

  • prompt_result arrives after the agent_end it settles, and by then the session ignores events for a turn that is terminalizing.
  • A prompt the cost gate refuses before dispatch gets prompt_result with agentInvoked: true and no agent_end.

  Failing the turn with the cost-cap reason needs changes to terminal handling, so it belongs in its own PR.

• secret?: boolean on input dialogs (18.13.2, OMP #17080). The strict input schema still rejects it, so a secret input request from an extension is dropped as a violation. OMP itself only sends it for extension and tool dialogs. The Paseo question card cannot mask input, so accepting the flag means choosing between two options: cancel secret inputs with a visible notice, or show them unmasked. I would rather you decide which in a follow-up.

• A second tool_execution_end for one id (your comment on paseo-omp: extension_error, session_info_update and config_update logged as protocol violations #366). In 18.14.0 both synthesized ends emit a tool_execution_start first: the agent.ts catch path around line 2205, and createAbortedToolResult in agent-loop.ts. The transport accepts that pair, so this does not cause event-state-transition. The remaining effect is in the projector. If a tool already finished while its message was still streaming and the stream then fails, the synthesized pair reopens that tool's row and ends it as failed. That is a projector question, separate from this PR.

Verification

Test	Before	After
tsc -p tsconfig.tests.json against @oh-my-pi/*@18.14.0	5 errors (lines 32, 35, 38, 43, 46)	0 errors
omp-rpc-session.test.ts: 10 new frame shapes through the real transport	no event, so the test times out	each event emitted, no protocol diagnostics
provider-usage-compaction.test.ts: /compact with manual_compaction_*	events ignored; preTokens from the compact response	one row, loading then completed, preTokens from the end event
same file: skipped /compact ("Already compacted")	turn failed: "OMP compaction failed"	turn completed, info notice "Already compacted"
same file: aborted /compact	turn failed	turn canceled
same file: manual compaction inside a prompt turn, and while idle	no rows	manual compaction rows; skipped reason shown as a warning
provider-rendering.test.ts: extension_error, session_info_update	nothing shown	one error notification; title update ignored
provider-prompts-config.test.ts: config_update	no refresh	one get_state, config republished
provider-conformance.test.ts: real transport and session, fake OMP child sends the new frames	frames dropped as violations; no extension notice	one manual compaction row; extension notice rendered; both turns complete

All 18 new tests fail with the server/ change reverted and pass with it.

Live check on an isolated dev daemon (.paseo-dev home, explicit --host, OMP_COMMAND pointing at the fake OMP fixture). I ran /compact on an omp-plugin agent with the fixture sending manual_compaction_start and manual_compaction_end before the response. Then I ran a prompt that sends extension_error, session_info_update and config_update. The timeline fetched through the Paseo client showed:

• the compaction as loading then completed, with trigger: manual and preTokens: 1234, the same rows as a /compact without the events;
• the extension error notification;
• FAKE_OK.

Both turns completed.

Checks run in paseo-omp:

• npm run check (Biome and the shrinkwrap check)
• bun install --frozen-lockfile with bun 1.4.4
• npm run typecheck
• npm test: 935 passed, 7 skipped
• npm run test:coverage: 933 passed, 9 skipped

Under heavy machine load, session-descriptors.test.ts > finds sessions beyond the first thousand workspace directories failed in some runs. Its discovery scan has a 1 s wall-clock budget. It passes when run alone and on reruns, both here and on main, and this change does not touch session discovery.

Not done:

• the Docker canary;
• the real-binary e2e against OMP 18.14.0;
• a live "before" run. After a plugin reload, the fake session could not be resumed, so the before behavior comes from the tests above.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Manual compaction events are now reflected in the timeline, including loading and completion states. Skipped compactions complete the turn, while aborted compactions cancel it.
  • Extension failures now appear as error notifications with relevant details.
• Bug Fixes
  • Runtime configuration changes now refresh the committed session configuration.
  • Compaction outcomes are handled more consistently, including when compaction is skipped or canceled.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 82da0cca-0d76-44de-a5b2-870f9ae59e2b

Commits

Reviewing files that changed from the base of the PR and between 404656f and 7e28141.

Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

Files selected for processing: 13

• paseo-omp/package.json
• paseo-omp/server/provider/omp-rpc-protocol.ts
• paseo-omp/server/provider/session-compaction.ts
• paseo-omp/server/provider/session-events.ts
• paseo-omp/server/provider/session-terminal.ts
• paseo-omp/server/provider/session.ts
• paseo-omp/server/provider/timeline-projector.ts
• paseo-omp/tests/fixtures/fake-omp.ts
• paseo-omp/tests/omp-rpc-session.test.ts
• paseo-omp/tests/provider-conformance.test.ts
• paseo-omp/tests/provider-prompts-config.test.ts
• paseo-omp/tests/provider-rendering.test.ts
• paseo-omp/tests/provider-usage-compaction.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The OMP provider now accepts additional OMP 18.14 events. It handles manual compaction outcomes, projects extension errors as notifications, and refreshes committed configuration on config updates.

Changes: OMP event compatibility

Layer / File(s)	Summary
Protocol contracts and compatibility paseo-omp/package.json, paseo-omp/server/provider/omp-rpc-protocol.ts, paseo-omp/tests/omp-rpc-session.test.ts	The OMP development dependencies move to 18.14.0. The protocol adds event types and schemas, classifies event policies, lists unsupported commands, and tests the new frames.
Manual compaction lifecycle paseo-omp/server/provider/session-compaction.ts, paseo-omp/server/provider/session-terminal.ts, paseo-omp/server/provider/session.ts, paseo-omp/server/provider/timeline-projector.ts, paseo-omp/tests/fixtures/fake-omp.ts, paseo-omp/tests/provider-usage-compaction.test.ts, paseo-omp/tests/provider-conformance.test.ts	The provider tracks manual compaction outcomes and projects manual compaction events. Tests cover compaction during turns and while idle, including skipped and aborted outcomes.
Runtime side-channel handling paseo-omp/server/provider/session-events.ts, paseo-omp/server/provider/session.ts, paseo-omp/server/provider/timeline-projector.ts, paseo-omp/tests/fixtures/fake-omp.ts, paseo-omp/tests/provider-prompts-config.test.ts, paseo-omp/tests/provider-rendering.test.ts	Config updates trigger committed configuration refresh. Session-info updates are ignored, and extension errors produce error-level notifications. Tests cover these event paths.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant OMP as OMP runtime
  participant Session as OMP session
  participant Compaction as OmpSessionCompaction
  participant Projector as OmpTimelineProjector
  OMP->>Session: Send manual compaction start and end events
  Session->>Compaction: Handle manual compaction end
  Compaction-->>Session: Return compaction outcome
  Session->>Projector: Project compaction events

Loading

Possibly related issues

• omercnet/paseo-plugins#366 — This change handles the extension_error, session_info_update, and config_update frames identified by the issue.
• omercnet/paseo-plugins#416 — This change updates the OMP SDK dependencies to 18.14.0 and adds compatibility handling for its event frames.

Possibly related PRs

• omercnet/paseo-plugins#432 — It updates the same two OMP development dependencies to an 18.13.x version; this PR updates them to 18.14.0.
• omercnet/paseo-plugins#339 — It sets the same two OMP dependency pins that this PR updates.

Merge Risk: Minimal · up to 7e281

No actionable issue remains from this review. The Docker canary and real-binary test against OMP 18.14.0 remain unrun, so those checks would provide additional compatibility confidence.

Security architecture risk: Low · up to 7e281

The compatibility update retains validation and session-ownership controls, and the newly listed commands do not gain execution support. Remaining uncertainty concerns upstream event ordering and the sensitivity of newly visible extension diagnostics.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated new effects concern the provider-owned session: compaction outcome, usage refresh, committed configuration, and timeline diagnostics. The newly listed commands do not themselves add an execution capability. Broader deployment exposure is not established by the available evidence.

Trust Boundaries and Controls

• observed — Runtime frames remain subject to semantic-size limits, schema parsing, and event-state checks before delivery to session consumers. Acceptance of the new event types does not bypass this validation boundary.

Resilience and Maintainability Implications

• observed — Active compaction ends check the stored trigger, turn, and generation. Finishing clears the operation before publishing terminal state. Timeout, interruption, and runtime failure use existing cleanup and generation invalidation, while turn terminalization clears timers and resolves turn permissions.

Hardening Proposals

• proposed — If deployment policy treats extension paths or arbitrary error details as confidential, restrict those notification fields before publication rather than relying solely on length bounds and configured exact-value redaction. This is conditional hardening, not a verified disclosure finding.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: updating paseo-omp to accept OMP 18.13 and 18.14 RPC frames.
Linked Issues check		The PR addresses #416 by pinning the OMP SDK dependencies to 18.14.0 and updating the protocol contract for the new 18.14 session events and commands. It adds runtime handling for manual compaction, e…
Out of Scope Changes check		The changes remain within OMP 18.14 compatibility scope. Protocol policies, runtime event handling, compaction projection, configuration refresh, unsupported-command classification, fixtures, and test…

Full details: Linked Issues check

Explanation

The PR addresses #416 by pinning the OMP SDK dependencies to 18.14.0 and updating the protocol contract for the new 18.14 session events and commands. It adds runtime handling for manual compaction, extension errors, session information, and configuration updates. The added transport, conformance, rendering, configuration, and compaction tests cover these changes. The reported typecheck result has zero contract errors. The Docker canary was not run, but that is verification work and not a coding requirement in #416.

Full details: Out of Scope Changes check

Explanation

The changes remain within OMP 18.14 compatibility scope. Protocol policies, runtime event handling, compaction projection, configuration refresh, unsupported-command classification, fixtures, and tests all support acceptance of OMP 18.13 and 18.14 frames. The excluded cost-cap, secret-input, and synthesized-tool-event work is not implemented. No unrelated change is demonstrated.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 3 functions across 12 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

Biome (2.5.15)

paseo-omp/package.json

Biome could not lint this file: nested root configuration. Check the repository's Biome configuration and plugins.

paseo-omp/server/provider/omp-rpc-protocol.ts

Biome could not lint this file: nested root configuration. Check the repository's Biome configuration and plugins.

paseo-omp/server/provider/session-compaction.ts

Biome could not lint this file: nested root configuration. Check the repository's Biome configuration and plugins.

• 10 others

_{Comment @coderabbitai help to get the list of available commands.}

[georgepullen]

The two failing checks are unrelated to this change:

• top (windows-latest) failed one timing-sensitive test, tests/platform.test.ts > a live process tree > attributes the busy process and its scrubbed child to the agent (expected 0.2708 to be greater than 0.3, a CPU-sampling threshold). The top job ran only because this PR updates the root bun.lock for the OMP SDK pin.
• CI sentinel fails because of that job.

All paseo-omp jobs pass. I can't rerun jobs here; could you rerun the failed ones when you get a chance?