omp 18.16.0 runs agent-dir extensions, hooks and MCP servers from non-session subcommands; --no-extensions before the subcommand is ignored
Running omp (Oh My Pi coding agent, 18.16.0, prebuilt binary) as a service user whose ~/.omp is writable by a sandboxed agent, I wanted host-side invocations (omp usage --json from a health check, omp login anthropic, a model-catalog probe spawning omp --mode rpc --no-session) to never execute anything from that directory. I put --no-extensions in a wrapper before "$@", i.e. omp --no-extensions --config overlay.yml usage --json, assuming a global flag. A marker-writing .ts dropped in <agent dir>/extensions still ran on every usage call. Overlay extensions: [] via PI_CONFIG_FILES did not stop it either, and omp login --no-extensions anthropic is rejected with a usage error.
Measured with PI_CODING_AGENT_DIR pointing at a scratch agent dir containing an extensions/x.ts, hooks/pre/h.ts, config.yml extensions: [/path/e2.ts], settings.json {"extensions":["/path/e3.ts"]} and an mcp.json stdio server that touches a file:
omp usage --json | agent-dir extension, config.yml extension, settings.json extension |
omp --no-extensions usage --json | same as above (flag before the subcommand is ignored) |
omp usage --no-extensions --json | nothing |
omp login anthropic | hooks, config.yml and settings.json extensions |
PI_CONFIG_FILES=overlay(extensions: []) omp login anthropic | hooks and settings.json extension still run |
omp login --no-extensions anthropic | rejected (unknown flag) |
omp --mode rpc --no-session | mcp.json server, hooks, all extensions |
omp --no-extensions --mode rpc --no-session | mcp.json server still starts |
omp config get ... | nothing |
Also: --config overlay.yml is invisible to omp config get (PI_CONFIG_FILES is visible), and omp --version prints 18.16.0 when any flag precedes it but omp/18.16.0 alone.
Fix that held: never point an untrusted-writable agent dir at a trusted process. In the wrapper, when running outside the sandbox, set HOME to a separate directory the sandbox cannot see (that relocates ~/.omp entirely: agent dir, plugins, natives, .env), cd / (the cwd's .omp/ is the project config root, and cwd=HOME makes ~/.omp a project dir too), and put subcommand flags after the subcommand (omp usage --no-extensions). Sign the trusted HOME in separately; for the sandbox's store, run HOME=$(mktemp -d) omp login anthropic and copy the result with sqlite3 tmp/.omp/agent/agent.db ".backup '<sandbox agent dir>/agent.db'" rather than sharing one grant (refresh tokens rotate).