[review companion] feat(omp): add native Oh My Pi (OMP) extension - #1

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

Adds an Oh My Pi extension that loads the bundled using-superpowers skill before agent runs and injects it into agent context. Adds package configuration, installation and porting documentation, and tests for injection, refresh, failures, and session changes.

Changes

Oh My Pi integration

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant OMP
  participant superpowersOmpExtension
  participant SkillFile as using-superpowers/SKILL.md
  participant AgentContext
  OMP->>superpowersOmpExtension: before_agent_start
  superpowersOmpExtension->>SkillFile: read skill
  SkillFile-->>superpowersOmpExtension: skill text
  OMP->>superpowersOmpExtension: provide agent context
  superpowersOmpExtension->>AgentContext: insert marked bootstrap after leading summaries

Suggested reviewers: obra

Security Blast Radius

• inferred — Exposure is bounded to OMP sessions that load the installed or linked package, but within those sessions the bootstrap reaches every provider request handled by this extension. No cross-service access is established.

Security Findings and Attack Paths

• inferred — A producer able to place superpowersBootstrap: true on an otherwise legitimate context message could cause its removal. Quoting the bootstrap text alone does not do so; whether less-trusted producers can set message properties in OMP is not established.

Trust Boundaries and Controls

• observed — The extension transfers installed-package skill content into model context and names OMP tools in its instructions. It reads a fixed path, rejects an empty body, and prevents stale asynchronous reads from committing; host-side authorization for subsequent tool calls is not shown.

Resilience and Maintainability Implications

• observed — Session lifecycle resets and generation checks limit stale bootstrap reuse, while failures clear the cached value and can recover on a later run. The cached state is extension-instance-wide; the runtime's concurrent-session contract is unavailable.

Hardening Proposals

• proposed — Establish OMP's message-metadata ownership contract before relying on the boolean marker to remove messages; if other producers can set it, use an ownership mechanism that cannot discard their messages.

❌ Failed checks (1 warning)

• X
• Mastodon
• Reddit
• LinkedIn

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.