What changed
Oh My OpenAgent 5.1.65 adds remote open, send, model, interrupt and close commands across devices, exposes the sender's authority line, and prevents leading slashes from executing commands or templates implicitly. It also hardens cross-device session identity and runtime rollback pruning.
Why it matters
Cross-device control turns a local coding session into a distributed authority surface. Showing the sender authority and removing implicit slash execution are useful controls, but identity binding, replay resistance and interruption semantics now need end-to-end evidence.
What to do
Pair two disposable devices, send a leading-slash message, switch models, interrupt and close a session, then replay an old request. Verify the displayed sender, session identity, authorization, exactly-once handling, rollback state and absence of implicit command execution.
Caveat
The maintainer release is primary evidence, not independent protocol or security validation. Cross-device guarantees depend on transport, account and device configuration, and the authority line may be descriptive rather than cryptographically binding.