feat(providers): add Oh My Pi Early Access support

[rynfar]

Problem

Pylon had no first-party way to run Oh My Pi. Users could not bind an OMP profile to a provider instance, discover its exact model selectors safely, or use it across local and remote Pylon clients.

What changed

• Add an instance-only omp provider driver with independent profiles, environment variables, maintenance metadata, and no legacy providers.omp slot.
• Run durable OMP sessions over ACP with exact model and thinking selection, mapped permission modes, attachments, cancellation, resume, form elicitation, Pylon MCP handoff, and explicit unsupported rollback.
• Probe OMP with bounded, shell-free --version and profile-scoped models --json --no-extensions commands. Require OMP 15.13.1 or newer and keep discovery diagnostics sanitized.
• Add isolated ACP text generation for titles, branches, commits, and pull requests. It disables persisted sessions, tools, extensions, skills, rules, and prewalk.
• Present Oh My Pi as Early Access in web/desktop and mobile, using its official icon, separate profile groups, searchable sub-provider labels, and complete MIT notices in shipped assets.
• Document host-side installation, authentication, profiles, remote ownership, discovery, permissions, supported behavior, and Early Access limits.

Compatibility evidence

Validated with isolated temporary HOME, XDG directories, PI_CODING_AGENT_DIR, and Bun/npm caches. The checks did not read or modify an installed OMP profile.

• OMP 15.13.1 and 18.0.4: version reporting, profile-aware model discovery, ACP initialize/authenticate/new session, exact model configuration, isolated local structured prompts, and durable session/load
• OMP 18.0.4: live cancellation with stopReason: "cancelled"

Verification

• vp test run <24 focused OMP and nearby ACP files> — 24 files, 314 tests passed
  • Includes 18 OMP adapter tests and 8 safe-probe tests
  • Includes the nearby Cursor/Grok ACP regression suites
• vp run -F @t3tools/contracts typecheck — passed
• vp run -F t3 typecheck — passed; only pre-existing Effect suggestions were reported
• vp run -F @t3tools/web typecheck — passed
• vp run -F @t3tools/mobile typecheck — passed
• vp lint <47 changed TypeScript files> — 0 warnings, 0 errors
• git diff --check origin/pylon...HEAD — passed
• Independent read-only adversarial review — no remaining blockers

UI evidence

• Focused web and mobile tests cover the official icon, Early Access labels, settings metadata, per-profile model grouping, and sub-provider labels.
• A headless Chromium pass used an isolated Pylon home and safe fake OMP executable. It verified instance creation, profile-scoped discovery, the official provider presentation, editable settings, exact model groups and sub-provider labels, and all advertised thinking tiers.
• A fresh browser pass on the rebased head completed an end-to-end thread turn through Pylon's OMP ACP adapter, including exact instance/profile/model routing, ACP initialization and authentication, thread-scoped MCP handoff, prompt streaming, and the final assistant reply.
• The earlier browser pass exposed an unlabeled unset-thinking trigger. The trigger now displays the descriptor label without inventing a selected thinking value, with focused regression coverage.
• An iPhone 17 Pro Simulator pass used a freshly rebuilt Pylon Dev client and the same disposable environment. It verified the OMP icon, profile group and Early Access badge, profile-default and discovered models, Off/Auto/Low/Medium/High thinking choices, and full-access runtime presentation.
• The simulator resumed the existing OMP thread, sent a follow-up prompt through the same ACP session, and received the expected assistant reply. The disposable mobile environment was removed after verification.

Early Access scope

OMP-native subagent controls, manual compaction, input queues, state inspection, goals/refinement controls, side questions, terminal authentication, and faithful rollback remain out of scope. The provider returns an explicit rollback error rather than letting Pylon and OMP histories diverge.

Implemented by OpenAI GPT-5.6 (xhigh) with the Prime Agent harness.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.5 KiB	+176 B (+1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+170 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.0 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	11	+1 (+10.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−43 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−14 B (−0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−29 B (−0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 0c88313 · PR result: ff811b0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.0 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pylon-marketing	Ignored	Preview	Sep 24, 2026 7:34am UTC

[rynfar]

Reconciled this PR with current pylon at head 2ae32b0944 via a fast-forward update to the original branch. The merge preserves current ACP stderr capture and termination handling, mobile provider labels, provider settings, and install guidance while adding Oh My Pi.

Independent adversarial review found that the shared ACP adapter passed an MCP bearer across provider instances and omitted the instance's agent-device subprocess environment. Commit 2ae32b0944 rejects a foreign-instance route before spawning ACP and merges the matching route's device environment into that child only; the reviewer rechecked and cleared this finding.

Verification: server, web, and mobile typechecks; 43 focused Oh My Pi server tests; 157 mobile/web/contract tests; 19 adapter tests after the scoping fix; scoped lint on changed TypeScript files. New CI is running. UI/runtime browser evidence remains pending explicit browser approval, so no interactive UI claim is made here.

[rynfar]

The maintainer explicitly decided not to bring Oh My Pi support into Pylon. We are not merging this PR, and it is closed at their request.

The catch-up review and reconciliation do not change that product decision. The branch and review history are preserved; no Oh My Pi changes from this PR have been merged into pylon. Tracking context: #736.