oh-my-opencode 5.1.38 → 5.1.41

package/dist/skills/ulw-plan/references/full-workflow.md

@@ -214,14 +214,15 @@ Every reviewer prompt must carry this intake contract with all angle-bracket val
 The first action must open the literal workspace root as a directory descriptor, then traverse `.omo`, `plans`, and the final target with descriptor-relative no-follow opens, `fstat` each ancestor as a directory and the final descriptor as a regular file, and hash all bytes read from that same final descriptor. If the platform cannot guarantee this chain, or any path/runtime/launch/receipt/digest check drifts, return `INCONCLUSIVE` before reviewing. Echo the literal workspace, runtime home, target, digest, round, and launch ID; the parent separately matches the completion envelope to the persisted session/process receipt. Never search or use another artifact.
 
 ### Bounded convergence (the review must terminate)
-Review rounds are capped at 5 (unlimited only on explicit user request), and an approval whose only remaining items are notes counts as approval. A finding may BLOCK only when it names at least one `blocker_eligibility` category below with its concrete evidence - an IS row no todo closes, no QA scenario proves, or the approach cannot reach for the named user is such a category; every other finding - speculative durability, replay/crash-recovery, schema, CLI-parsing, state-machine, or hardening concerns the accepted scope never required - is recorded as a non-blocking note and becomes implementation/test work, never plan expansion. After round 1 the blocker ledger FREEZES: later rounds verify accepted ledger blockers, regressions introduced by fixes, and new findings that pass eligibility - they never rediscover the plan from scratch. Fixes apply the smallest edit that resolves the cited blocker; neither reviews nor fixes grow the plan's scope. Every reviewer prompt carries this convergence contract alongside the intake contract. On cap exhaustion without approval: STOP, report outstanding blockers, ask the user - continue / accept / adjust.
+Review continues until unconditional approval, but a further round runs only while the previous round made progress: it raised at least one NEW blocker-eligible finding (one not already in the ledger and not a restatement of a closed blocker), or it confirmed at least one ledger blocker closed. A round that does neither and still does not approve ends the review: stop, report the outstanding blockers, and ask the user. This is the non-convergence guard, so there is no fixed round count; it terminates because the ledger is frozen after round 1, so every closure shrinks it. An approval whose only remaining items are notes counts as approval. A finding may BLOCK only when it names at least one `blocker_eligibility` category below with its concrete evidence - an IS row no todo closes, no QA scenario proves, or the approach cannot reach for the named user is such a category; every other finding - speculative durability, replay/crash-recovery, schema, CLI-parsing, state-machine, or hardening concerns the accepted scope never required - is recorded as a non-blocking note and becomes implementation/test work, never plan expansion. After round 1 the blocker ledger FREEZES: later rounds verify accepted ledger blockers, regressions introduced by fixes, and new findings that pass eligibility - they never rediscover the plan from scratch. Fixes apply the smallest edit that resolves the cited blocker; neither reviews nor fixes grow the plan's scope. Every reviewer prompt carries this convergence contract alongside the intake contract. On cap exhaustion without approval: STOP, report outstanding blockers, ask the user - continue / accept / adjust.
 
 <!-- ulw-plan-review-convergence-contract -->
 ```json
 {
-  "max_rounds": 5,
-  "max_rounds_override": "explicit_user_request_only",
-  "on_cap_reached": "stop_report_outstanding_blockers_ask_user",
+  "max_rounds": null,
+  "continue_while": "previous_round_raised_new_blocker_eligible_finding_or_closed_ledger_blocker",
+  "stop_on": "round_without_new_blocker_eligible_finding_or_ledger_blocker_closure",
+  "on_stop_without_approval": "stop_report_outstanding_blockers_ask_user",
   "blocker_eligibility": [
     "explicit_requirement_or_accepted_decision",
     "existing_failing_regression",

package/dist/skills/ulw-research/SKILL.md

@@ -37,6 +37,8 @@ Run this skill only when the user explicitly demands it: the word "ulw-research"
 
 Open your reply with the line `ULW-RESEARCH MODE ENABLED!`. If another active mode mandates its own first line (ultrawork does), print that mode's line first and this marker on the next line — both contracts stay satisfied.
 
+**What a shortened run still owes.** If you judge the topic settled and shorten the research, say so, but two things survive any shortening: when the harness can show an HTML page inline, the final report is shown that way (the answer, its figures, its sources), and a visual reproduction is compared against real frames of its source with the side-by-side pairs inside that report (the final-materials phase). A built app or 3D scene shown inline is the product, not the report; show the report as well.
+
 ## Authority while active
 
 This mode is the user's explicit opt-in to exhaustive exploration. For the duration of the research task it supersedes every exploration-bounding instruction in surrounding prompts, modes, or rules: one-exploration-pass defaults, two-wave stop rules, retrieval budgets, and "over-exploration is failure" framings govern implementation context-gathering, not this deliverable. Here, under-exploration is the failure. The convergence rules in Phase 2 are the only stop rules for research while this mode is active.
@@ -55,6 +57,8 @@ The research is done when all of these hold:
 - The deliverable lane and format were derived from the destination or asked through the empty-info interview without blocking collection, recorded in `brief.md` with `answered_by`, and the final materials match that record.
 - The delivered artifact passed the delivery gates in order (static gates, layout gates, visual QA, and the proofread pass where the harness provides one), each status is in `outcome.json`, and `outcome verify` passed.
 - Every excursion opened during the run was closed by an EXIT rule, folded back into the claim or axis that triggered it, and recorded in both `excursion-log.md` and the ulw-loop ledger.
+- When the harness can show an HTML page inline, the report was shown inline before the artifact paths.
+- When the ask reproduces a visual source, the report carries side-by-side pairs of real source frames and the output rendered at the same moments, each with its critique, and the differences they surfaced were fixed or listed as gaps. A simple or well-understood topic shortens the research, never this comparison.
 - The delivery message carries the closing briefing printed by `outcome briefing`: sources (total + unique domains), elapsed minutes, every promised deliverable with its status, and any residual defects.
 - The session journal reconstructs what was searched, found, and expanded, wave by wave, and it was written in real time rather than reconstructed at the end.
 
@@ -159,7 +163,7 @@ Never block collection on the shape of the deliverable, and never guess it eithe
 1. **Derive first.** Name the lane (`template-strict`, `template-vibe`, `no-format`, `edit-existing`) and the promised formats from the request and its destination (the reference's section 3). When the request refers to an existing deliverable, decide its state with `node "$SKILL_DIR/scripts/report-tools.mjs" outcome state --deliverable <path> --session-dir "$SESSION_DIR"`: `partial` resumes the skeleton on disk, `complete` means edit-existing and never a regenerated report. `$SKILL_DIR` is this skill's own directory, the folder containing this SKILL.md.
 2. **Read the requester's format memory** with the memory tool when the harness exposes one: the pointer `system/human/report-style.md`, then `reference/human-report-style.md`; take the choice recorded for the most similar context (same destination kind and audience) as the first option.
 3. **Ask only what is still missing**: at most the reference's three questions (destination and format, audience and length, template lineage) in one call to the harness question tool (`ask_user_question` or `request_user_input`), non-blocking where the harness supports it, each with its default first, a free-text "describe the format" path, and "don't care, you decide". Collection starts without waiting; a late answer is folded in until the assembly worker starts, and after that it becomes a re-render request.
-4. **Record it.** Write `## Deliverable` into `brief.md` (lane, state, formats, destination, audience, template, format description, each with `answered_by: user|default|request`) and open the manifest in the same step: `node "$SKILL_DIR/scripts/report-tools.mjs" outcome init --promised <formats> --lane <lane> --session-dir "$SESSION_DIR"`.
+4. **Record it.** Write `## Deliverable` into `brief.md` (lane, state, formats, destination, audience, template, format description, each with `answered_by: user|default|request`) and open the manifest in the same step: `node "$SKILL_DIR/scripts/report-tools.mjs" outcome init --promised <formats> --lane <lane> --session-dir "$SESSION_DIR"`. When the ask is to recreate, reproduce, or rebuild something visual, add `Reference compare: required` with the source (URL or file) and the moments to compare; the comparison runs on every round of the build, not only at the end.
 
 Phase 5 opens by turning the recorded fields into `design-spec.md`.
 
@@ -334,6 +338,8 @@ Asset workers (background, parallel, each fed `design-spec.md`) — visuals are
 
 **Every final report is visual — binding.** It carries at least one data visualization of the run's own findings (a chart drawn from the data table, next to the claim it supports), a diagram wherever structure matters, and the topic's own screenshots and video, embedded or linked with attribution; every figure is captioned, sourced, and given alt text. Mermaid for flows, timelines, and relations; generated charts for numbers; image generation only where an illustration genuinely helps; PlotNeuralNet for paper-format reports that describe model architectures. Every asset lane reads [references/report-visualization.md](references/report-visualization.md) first: which tool fits which finding, the render commands, the quality bar, and the checklist the gates apply. A light-tier post still carries one visual when it reports numbers or structure.
 
+**Visual reproductions are compared against the source — binding.** When the ask is to recreate, reproduce, or rebuild something visual (a clip in 3D, an interface from a screenshot, a figure), real frames or captures from the source are the reference: extract them at the moments that define the source, render the output at the same moments and viewpoints, compose side-by-side pairs, critique every pair by looking at it, fix the largest differences, and compare again within the repair bound. The final pairs, and the first-round pairs in the correction log, go into the report. Procedure: [references/report-visualization.md](references/report-visualization.md), section 3, Reference compare. A reproduction checked only against itself is unverified.
+
 **Verify the asset manifest before rendering.** List every asset the document references, assert each file exists and is non-empty on disk, and re-render whatever is missing. A document that renders with three broken diagrams is a document you will publish twice.
 
 Assembly worker — `task(category="deep-low", load_skills=["frontend", "visual-qa", "open-design", "data-scientist", "imagegen", "ulw-loop"], run_in_background=true, ...)`: before writing, read every available design and visualization skill and apply it — the report is a designed artifact, not a text dump; the worker's prompt carries `design-spec.md`. Use the template the user approved; absent a stronger house style the default skeleton is executive summary → key findings by theme → detailed analysis (quotes under 20 words with attribution, charts, Mermaid graphs, generated visuals, SHA-pinned permalinks, verification results) → comparative analysis when options compete → numbered sources with access dates → methodology appendix (workers, waves, searches, verifications, debate rounds) → correction log naming what verification overturned. Write it long and specific: every claim cites `[Source N]`, and the sources section lists every source the run actually used rather than a curated few.
@@ -349,7 +355,7 @@ Nothing reaches the user until the gates pass. Record each result with `node "$S
 
 **Repair is bounded.** After every gate run that found defects, ask `node "$SKILL_DIR/scripts/report-tools.mjs" repair decide --state "$SESSION_DIR/repair-state.json" --defects "$SESSION_DIR/defects.json" --artifact-bytes <bytes> --renders <pages> --session-dir "$SESSION_DIR"` and obey it: `repair` means fix and re-run; `deliver` means stop and ship with the residual defects the manifest now lists; `block` means a content-integrity defect remains (or there is no usable artifact), so do not deliver: tell the user what blocks it and record the row as `failed` with the reason. Never repair past a stop decision (3 attempts, a 2-attempt plateau, an oscillation, or 15 minutes; the reference's section 8).
 
-Then resolve every manifest row (`outcome set <format> delivered --path <file>` or `blocked_capability` / `skipped` / `failed` with `--reason`) and deliver: the artifact plus a compact chat-readable summary of what it says — the answer in a few sentences, the numbers that matter, and what to look at first. The document is the deliverable; the summary is what gets it read.
+Then resolve every manifest row (`outcome set <format> delivered --path <file>` or `blocked_capability` / `skipped` / `failed` with `--reason`) and deliver. **Show the report inline first when the harness can.** When this session has a tool that shows an HTML page inline in the conversation (`show_html_page`, `html_render`), the requester's first view of the result is the report itself: the gated `report.html` when it fits the tool, otherwise an inline edition built from the same synthesis and assets, with the reference-compare pairs when the run has them ([references/deliverable-phase.md](references/deliverable-phase.md), section 9, Showing the report inline). Then give the artifact paths and a compact chat-readable summary of what the report says — the answer in a few sentences, the numbers that matter, and what to look at first. This holds on every tier, a chat answer included, and when the thing built is itself a page (an app, a 3D scene), showing it does not replace the report page. Without an inline page tool, deliver the artifact paths plus that summary. The document is the deliverable; the summary is what gets it read.
 
 ### The closing briefing — every run ends with it
 
@@ -414,4 +420,6 @@ High-yield combinations: official docs (`site:<docs domain>`), GitHub implementa
 | Chasing an interesting find with no ENTER trigger | Excursions need a named trigger; everything else stays a queued lead |
 | An excursion that never came back, or drifted into a new mission | EXIT rules are unconditional; depth 3 means promote it to an axis or record it as a gap |
 | An excursion whose result was never folded back | Every EXIT writes what it changed in the top-level answer, `none` included, and mirrors into the loop ledger |
+| Ending with file paths while an inline HTML page tool is available | Show the report inline first (the gated `report.html` or its inline edition), then the paths and the summary |
+| A visual reproduction checked only against itself | Reference compare: real source frames next to renders at the same moments, a critique per pair, fixes, and the pairs in the report |
 | Delivering without the closing briefing | Paste the block `outcome briefing` prints; never compute or recall its numbers by hand |

package/dist/skills/ulw-research/references/deliverable-phase.md

@@ -166,6 +166,16 @@ node "$SKILL_DIR/scripts/report-tools.mjs" outcome briefing --session-dir "$SESS
 - `finish` stamps the finish time, the elapsed minutes from the session directory's start stamp, and the source and domain counts from `sources-ledger.md`.
 - `briefing` prints the closing block from the manifest and the ledger: sources and distinct domains, elapsed minutes, every deliverable with its status, the gate results, the residual defects, and the repair summary. That text is the closing briefing, pasted as printed, never filled in from memory.
 
+### Showing the report inline
+
+When the session has a tool that shows a self-contained HTML page inline in the conversation (`show_html_page` in OmO, `html_render` on hosts that offer it), the requester sees the report there first, after `verify` passes and before the closing briefing. A path to a file the requester has to go and open is not the first thing they read.
+
+- **Which page.** The gated `report.html` itself when the promised deliverable is a self-contained HTML report within the tool's size limit. Otherwise (a PDF, DOCX, LaTeX, or slide deliverable, or an HTML report over the limit) build an inline edition from the same `SYNTHESIS.md` and the same assets: the answer, the headline figures, the reference-compare pairs when the run has them, the key findings with their citations, the numbered sources, and the paths of the promised artifacts. Run `check` on the inline edition like any HTML deliverable.
+- **Self-contained.** No network: styles and scripts inline, no remote fonts, no CDN. Pass local images as absolute file paths (the tool inlines them) or as data URIs. Render it once at the reply width and at 390 px before showing it, and pass the measured height. When the session has the `visualize` skill, follow its inline-page constraints.
+- **Every tier, and always the report.** A light-tier chat answer with no promised document still ends with an inline page: the answer, its figures, the reference-compare pairs, and the sources. When the thing built is itself a page (an app, a 3D scene, a demo), show it too, but it never stands in for the report page, and a page that only links or redirects to a file is not a report.
+- **Not a manifest format.** The inline page never replaces or resolves a promised format; every manifest row still ends `delivered`, `blocked_capability`, `skipped`, or `failed` with its own artifact.
+- **No inline tool.** Deliver the artifact paths and the chat summary as before.
+
 ## 10. Command reference
 
 Invoke every command as `node "$SKILL_DIR/scripts/report-tools.mjs" <command>`. Exit codes for all of them: `0` pass, `1` semantic failure, `2` usage or IO error.

package/dist/skills/ulw-research/references/report-visualization.md

@@ -25,6 +25,7 @@ A report that ships with none of these is incomplete. The static gate raises `re
 | A product, interface, or page the report discusses | A screenshot captured while reading the source, through the browser skill | PNG |
 | A concept that has no data and no structure, a cover | The image-generation skill, only when it helps the reader understand | PNG |
 | A source video or talk | An embed (web) or a still frame plus link and timestamp (paginated) | iframe or PNG |
+| A reproduction of a visual source (a clip rebuilt in 3D, an interface rebuilt from a screenshot, a figure redrawn) | Reference-compare pairs: a real source frame next to the output rendered at the same moment and viewpoint | PNG per pair |
 
 Image generation never draws data, numbers, diagrams with labels, or anything the reader could mistake for evidence. Its caption says it is an illustration.
 
@@ -86,6 +87,27 @@ pdftocairo -svg arch.pdf "$SESSION_DIR/assets/arch.svg"   # for an HTML report;
 - Capture product and page screenshots through the browser skill while the source is open, at a readable width, and crop to the part the claim is about. Caption with the source and the access date.
 - Embed a video in a web report with the platform's embed and a timestamp; in a paginated report, use a still frame from the moment the claim refers to, with the link and timestamp in the caption.
 
+### Reference compare (visual reproductions)
+
+When the deliverable reproduces a visual source (recreate a clip in 3D, rebuild an interface from a screenshot, redraw a figure), the source is the test oracle. An output checked only against itself looks finished to its author and wrong to anyone who has seen the original, so the run compares the two directly and shows the comparison.
+
+1. **Pick the moments.** Choose 4 to 8 moments that carry the identity of the source: the start and end state, the peak of each motion, distinctive poses, camera framings, and the shot the requester pointed at. Record each in `$SESSION_DIR/compare/moments.json` with its timestamp (or region, for a still), what it shows, and the camera or viewport.
+2. **Extract real frames from the source.** For a video, download only the sections you need, then cut one frame per moment. Run the download as a background job; a long download outlives a single tool call.
+   ```bash
+   mkdir -p "$SESSION_DIR/compare"
+   uvx yt-dlp -f 'bv*[height<=720]/b[height<=720]' --download-sections '*<start>-<end>' --force-keyframes-at-cuts --remux-video mp4 -o "$SESSION_DIR/compare/source-<start>.%(ext)s" '<url>'
+   ffmpeg -y -v error -ss <seconds into the section> -i "$SESSION_DIR/compare/source-<start>.mp4" -frames:v 1 "$SESSION_DIR/compare/ref-<n>.png"
+   ```
+   For an image, use the original file. For a page or interface, capture it through the browser skill at the viewport the output targets. Never substitute a thumbnail, a generated image, or a description for the real frame.
+3. **Render the output at the same moment and viewpoint.** Match the time into the motion, the camera position and field of view, the framing, and the aspect ratio. For a 3D scene, move the camera to the source shot instead of capturing the scene's default camera. Save `out-<n>.png`.
+4. **Compose each pair.** Reference on the left, output on the right, scaled to the same height:
+   ```bash
+   ffmpeg -y -v error -i "$SESSION_DIR/compare/ref-<n>.png" -i "$SESSION_DIR/compare/out-<n>.png" -filter_complex "[0:v]scale=-2:540[a];[1:v]scale=-2:540[b];[a][b]hstack=inputs=2" "$SESSION_DIR/compare/pair-<n>-r<round>.png"
+   ```
+5. **Critique every pair by looking at it.** Open each pair image and write `$SESSION_DIR/compare/critique-r<round>.md`: per pair, every visible difference ranked by how much a viewer would notice it (silhouette and proportions, pose and orientation, motion path and timing, camera and framing, scale against the surroundings, color and lighting, missing or extra elements), each with its likely cause and the fix.
+6. **Fix and compare again.** Fix the largest differences first, re-render the same moments, compose the next round, and critique again. Stop after 3 rounds or after 2 rounds that close no listed difference, the same bound the repair loop uses; every difference still open becomes a residual gap in the report.
+7. **Put the comparison in the report.** A "Reference comparison" section holds the final pair for each moment as a captioned figure: the moment and timestamp, the source with attribution and link, what now matches, and what still differs. The first-round pairs go in the correction log next to their final pairs, so the reader sees what the comparison changed. Alt text describes both halves.
+
 ### Generated illustrations
 
 Use the image-generation skill only for a cover or a concept illustration that helps the reader, prompted from the design spec's palette and register. Never let generated images carry text, numbers, or logos the reader could read as fact.
@@ -123,4 +145,5 @@ The static gate (`report-tools check`) enforces the machine-checkable rows; visu
 | Each major quantitative finding has a chart and each structural finding has a diagram | visual QA |
 | Diagram and chart text renders in the spec font and is legible at phone width | visual QA |
 | Source videos and screenshots are embedded or linked with attribution where the topic has them | visual QA |
+| A visual reproduction carries reference-compare pairs (final and first round) and a critique for every pair | visual QA |
 | Generated illustrations carry no fake data or text and are captioned as illustrations | visual QA |

package/dist/tui.js

@@ -70075,17 +70075,23 @@ var init_computer = __esm(() => {
 });
 
 // packages/omo-config-core/src/schema/git-master.ts
-var OmoGitMasterSettingsShape, OmoGitMasterSettingsLayerSchema, OmoGitMasterSettingsSchema;
+var GIT_ENV_ASSIGNMENT_PATTERN, GitEnvPrefixSchema, OmoGitMasterSettingsShape, OmoGitMasterSettingsLayerSchema, OmoGitMasterSettingsSchema;
 var init_git_master = __esm(() => {
   init_zod();
+  GIT_ENV_ASSIGNMENT_PATTERN = /^(?:[A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9_-]*)(?: [A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9_-]*)*$/;
+  GitEnvPrefixSchema = string2().refine((value) => value === "" || GIT_ENV_ASSIGNMENT_PATTERN.test(value), {
+    message: 'git_env_prefix must be empty or use shell-safe env assignments like "GIT_MASTER=1"'
+  });
   OmoGitMasterSettingsShape = {
     commit_footer: union([boolean2(), string2()]),
-    include_co_authored_by: boolean2()
+    include_co_authored_by: boolean2(),
+    git_env_prefix: GitEnvPrefixSchema
   };
   OmoGitMasterSettingsLayerSchema = object(OmoGitMasterSettingsShape).partial().strict();
   OmoGitMasterSettingsSchema = OmoGitMasterSettingsLayerSchema.extend({
     commit_footer: union([boolean2(), string2()]).default(false),
-    include_co_authored_by: boolean2().default(false)
+    include_co_authored_by: boolean2().default(false),
+    git_env_prefix: GitEnvPrefixSchema.default("GIT_MASTER=1")
   }).strict();
 });
 
@@ -70100,10 +70106,29 @@ var init_harness = __esm(() => {
   OMO_CONFIG_LEGACY_HARNESS_IDS = Object.keys(OMO_CONFIG_LEGACY_HARNESS_ALIASES);
 });
 
+// packages/omo-config-core/src/schema/memory-agreements.ts
+var OMO_MEMORY_AGREEMENTS_DEFAULTS, OmoMemoryAgreementsSchema, OmoMemoryAgreementsLayerSchema;
+var init_memory_agreements = __esm(() => {
+  init_zod();
+  OMO_MEMORY_AGREEMENTS_DEFAULTS = { enabled: true, needs_human_threshold: 3, max_items: 64 };
+  OmoMemoryAgreementsSchema = object({
+    enabled: boolean2().default(OMO_MEMORY_AGREEMENTS_DEFAULTS.enabled),
+    needs_human_threshold: number2().int().min(1).default(OMO_MEMORY_AGREEMENTS_DEFAULTS.needs_human_threshold),
+    max_items: number2().int().min(8).max(256).default(OMO_MEMORY_AGREEMENTS_DEFAULTS.max_items)
+  }).strict();
+  OmoMemoryAgreementsLayerSchema = object({
+    enabled: boolean2().optional(),
+    needs_human_threshold: number2().int().min(1).optional(),
+    max_items: number2().int().min(8).max(256).optional()
+  }).strict();
+});
+
 // packages/omo-config-core/src/schema/memory.ts
 var OmoMemoryReflectionTriggerSchema, OmoMemoryReflectionSchema, OmoMemorySyncSchema, OmoMemorySearchSchema, OmoMemoryRecallEventCapsSchema, OmoMemoryRecallSchema, OmoMemoryNudgeSchema, OmoMemoryFactsSchema, OmoMemoryDreamSchema, OmoMemoryPeopleSchema, OmoMemorySoulSchema, OmoMemoryWriteNoticeSchema, OmoMemoryReflectionTriggerLayerSchema, OmoMemoryReflectionLayerSchema, OmoMemorySyncLayerSchema, OmoMemorySearchLayerSchema, OmoMemoryRecallEventCapsLayerSchema, OmoMemoryRecallLayerSchema, OmoMemoryNudgeLayerSchema, OmoMemoryFactsLayerSchema, OmoMemoryDreamLayerSchema, OmoMemoryPeopleLayerSchema, OmoMemorySoulLayerSchema, OmoMemoryWriteNoticeLayerSchema, OmoMemoryProjectionSchema, OmoMemoryProjectionLayerSchema, OmoMemoryAgentOverridesSchema, OmoMemorySettingsSchema, OmoMemorySettingsLayerSchema;
 var init_memory = __esm(() => {
   init_zod();
+  init_memory_agreements();
+  init_memory_agreements();
   OmoMemoryReflectionTriggerSchema = object({
     step_count: number2().int().nonnegative().default(25),
     on_compaction: boolean2().default(true)
@@ -70246,6 +70271,7 @@ var init_memory = __esm(() => {
     facts: OmoMemoryFactsLayerSchema.optional(),
     dream: OmoMemoryDreamLayerSchema.optional(),
     people: OmoMemoryPeopleLayerSchema.optional(),
+    agreements: OmoMemoryAgreementsLayerSchema.optional(),
     soul: OmoMemorySoulLayerSchema.optional(),
     write_notice: OmoMemoryWriteNoticeLayerSchema.optional(),
     sync: OmoMemorySyncLayerSchema.optional(),
@@ -70276,6 +70302,7 @@ var init_memory = __esm(() => {
       auto_select_max_chars: 150000
     }),
     people: OmoMemoryPeopleSchema.default({ enabled: true, max_entries: 40, max_entry_chars: 200 }),
+    agreements: OmoMemoryAgreementsSchema.default(OMO_MEMORY_AGREEMENTS_DEFAULTS),
     soul: OmoMemorySoulSchema.default({ edit_notice: true }),
     write_notice: OmoMemoryWriteNoticeSchema.default({ enabled: true }),
     sync: OmoMemorySyncSchema.default({ enabled: true }),
@@ -70302,6 +70329,7 @@ var init_memory = __esm(() => {
     facts: OmoMemoryFactsLayerSchema.optional(),
     dream: OmoMemoryDreamLayerSchema.optional(),
     people: OmoMemoryPeopleLayerSchema.optional(),
+    agreements: OmoMemoryAgreementsLayerSchema.optional(),
     soul: OmoMemorySoulLayerSchema.optional(),
     write_notice: OmoMemoryWriteNoticeLayerSchema.optional(),
     sync: OmoMemorySyncLayerSchema.optional(),
@@ -72632,13 +72660,13 @@ function isValidGitEnvPrefix(value) {
   if (value === "") {
     return true;
   }
-  return GIT_ENV_ASSIGNMENT_PATTERN.test(value);
+  return GIT_ENV_ASSIGNMENT_PATTERN2.test(value);
 }
-var GIT_ENV_ASSIGNMENT_PATTERN, GIT_ENV_PREFIX_VALIDATION_MESSAGE = 'git_env_prefix must be empty or use shell-safe env assignments like "GIT_MASTER=1"', GitEnvPrefixSchema;
+var GIT_ENV_ASSIGNMENT_PATTERN2, GIT_ENV_PREFIX_VALIDATION_MESSAGE = 'git_env_prefix must be empty or use shell-safe env assignments like "GIT_MASTER=1"', GitEnvPrefixSchema2;
 var init_git_env_prefix = __esm(() => {
   init_zod();
-  GIT_ENV_ASSIGNMENT_PATTERN = /^(?:[A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9_-]*)(?: [A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9_-]*)*$/;
-  GitEnvPrefixSchema = string2().refine(isValidGitEnvPrefix, { message: GIT_ENV_PREFIX_VALIDATION_MESSAGE }).default("GIT_MASTER=1");
+  GIT_ENV_ASSIGNMENT_PATTERN2 = /^(?:[A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9_-]*)(?: [A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9_-]*)*$/;
+  GitEnvPrefixSchema2 = string2().refine(isValidGitEnvPrefix, { message: GIT_ENV_PREFIX_VALIDATION_MESSAGE }).default("GIT_MASTER=1");
 });
 
 // packages/omo-opencode/src/config/schema/git-env-prefix.ts
@@ -72654,7 +72682,7 @@ var init_git_master2 = __esm(() => {
   GitMasterConfigSchema = object({
     commit_footer: union([boolean2(), string2()]).default(false),
     include_co_authored_by: boolean2().default(false),
-    git_env_prefix: GitEnvPrefixSchema
+    git_env_prefix: GitEnvPrefixSchema2
   });
 });
 
@@ -75008,7 +75036,7 @@ init_shared();
 // package.json
 var package_default = {
   name: "oh-my-opencode",
-  version: "5.1.38",
+  version: "5.1.41",
   description: "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
   main: "./dist/index.js",
   types: "dist/index.d.ts",
@@ -75185,7 +75213,7 @@ var package_default = {
   },
   devDependencies: {
     "@clack/prompts": "^1.8.1",
-    "@code-yeongyu/senpi": "2026.10.19",
+    "@code-yeongyu/senpi": "2026.10.21-1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@oh-my-opencode/agents-md-core": "workspace:*",
     "@oh-my-opencode/ast-grep-mcp": "workspace:*",
@@ -75226,6 +75254,7 @@ var package_default = {
     "@opentui/core": "^0.5.11",
     "@opentui/keymap": "^0.5.11",
     "@types/js-yaml": "^4.0.9",
+    "@types/node": "26.6.2",
     "@types/picomatch": "^4.0.3",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "@typescript/typescript6": "6.0.2",
@@ -75245,18 +75274,18 @@ var package_default = {
     typescript: "^7.0.2"
   },
   optionalDependencies: {
-    "oh-my-opencode-darwin-arm64": "5.1.38",
-    "oh-my-opencode-darwin-x64": "5.1.38",
-    "oh-my-opencode-darwin-x64-baseline": "5.1.38",
-    "oh-my-opencode-linux-arm64": "5.1.38",
-    "oh-my-opencode-linux-arm64-musl": "5.1.38",
-    "oh-my-opencode-linux-x64": "5.1.38",
-    "oh-my-opencode-linux-x64-baseline": "5.1.38",
-    "oh-my-opencode-linux-x64-musl": "5.1.38",
-    "oh-my-opencode-linux-x64-musl-baseline": "5.1.38",
-    "oh-my-opencode-windows-arm64": "5.1.38",
-    "oh-my-opencode-windows-x64": "5.1.38",
-    "oh-my-opencode-windows-x64-baseline": "5.1.38"
+    "oh-my-opencode-darwin-arm64": "5.1.41",
+    "oh-my-opencode-darwin-x64": "5.1.41",
+    "oh-my-opencode-darwin-x64-baseline": "5.1.41",
+    "oh-my-opencode-linux-arm64": "5.1.41",
+    "oh-my-opencode-linux-arm64-musl": "5.1.41",
+    "oh-my-opencode-linux-x64": "5.1.41",
+    "oh-my-opencode-linux-x64-baseline": "5.1.41",
+    "oh-my-opencode-linux-x64-musl": "5.1.41",
+    "oh-my-opencode-linux-x64-musl-baseline": "5.1.41",
+    "oh-my-opencode-windows-arm64": "5.1.41",
+    "oh-my-opencode-windows-x64": "5.1.41",
+    "oh-my-opencode-windows-x64-baseline": "5.1.41"
   },
   overrides: {
     hono: "^4.13.8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-opencode",
-  "version": "5.1.38",
+  "version": "5.1.41",
   "description": "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
   "main": "./dist/index.js",
   "types": "dist/index.d.ts",
@@ -177,7 +177,7 @@
   },
   "devDependencies": {
     "@clack/prompts": "^1.8.1",
-    "@code-yeongyu/senpi": "2026.10.19",
+    "@code-yeongyu/senpi": "2026.10.21-1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@oh-my-opencode/agents-md-core": "workspace:*",
     "@oh-my-opencode/ast-grep-mcp": "workspace:*",
@@ -218,6 +218,7 @@
     "@opentui/core": "^0.5.11",
     "@opentui/keymap": "^0.5.11",
     "@types/js-yaml": "^4.0.9",
+    "@types/node": "26.6.2",
     "@types/picomatch": "^4.0.3",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "@typescript/typescript6": "6.0.2",
@@ -237,18 +238,18 @@
     "typescript": "^7.0.2"
   },
   "optionalDependencies": {
-    "oh-my-opencode-darwin-arm64": "5.1.38",
-    "oh-my-opencode-darwin-x64": "5.1.38",
-    "oh-my-opencode-darwin-x64-baseline": "5.1.38",
-    "oh-my-opencode-linux-arm64": "5.1.38",
-    "oh-my-opencode-linux-arm64-musl": "5.1.38",
-    "oh-my-opencode-linux-x64": "5.1.38",
-    "oh-my-opencode-linux-x64-baseline": "5.1.38",
-    "oh-my-opencode-linux-x64-musl": "5.1.38",
-    "oh-my-opencode-linux-x64-musl-baseline": "5.1.38",
-    "oh-my-opencode-windows-arm64": "5.1.38",
-    "oh-my-opencode-windows-x64": "5.1.38",
-    "oh-my-opencode-windows-x64-baseline": "5.1.38"
+    "oh-my-opencode-darwin-arm64": "5.1.41",
+    "oh-my-opencode-darwin-x64": "5.1.41",
+    "oh-my-opencode-darwin-x64-baseline": "5.1.41",
+    "oh-my-opencode-linux-arm64": "5.1.41",
+    "oh-my-opencode-linux-arm64-musl": "5.1.41",
+    "oh-my-opencode-linux-x64": "5.1.41",
+    "oh-my-opencode-linux-x64-baseline": "5.1.41",
+    "oh-my-opencode-linux-x64-musl": "5.1.41",
+    "oh-my-opencode-linux-x64-musl-baseline": "5.1.41",
+    "oh-my-opencode-windows-arm64": "5.1.41",
+    "oh-my-opencode-windows-x64": "5.1.41",
+    "oh-my-opencode-windows-x64-baseline": "5.1.41"
   },
   "overrides": {
     "hono": "^4.13.8",

package/packages/lsp-core/src/lsp/fixtures/disposed-stdin-epipe-probe.ts

@@ -0,0 +1,28 @@
+// Reproduces the Windows teardown race from #9601 on any OS: the transport
+// disposes its JSON-RPC connection, then the server's stdin pipe fails with
+// EPIPE. Windows reports that failure asynchronously, after dispose removed the
+// connection's listener, so the stream is destroyed with the error here to get
+// the same event order deterministically. The probe exits 0 only when the error
+// was handled; an unhandled 'error' event crashes it with a non-zero exit.
+import { JsonRpcConnection } from "../json-rpc-connection.js";
+import { spawnProcess } from "../process.js";
+
+const server = spawnProcess([process.execPath, "-e", "process.stdin.on('close', () => process.exit(0)).resume()"], {
+	cwd: process.cwd(),
+	env: process.env,
+});
+const connection = new JsonRpcConnection(server.stdout, server.stdin);
+connection.listen();
+connection.dispose();
+
+const stdinClosed = new Promise<void>((resolve) => server.stdin.once("close", () => resolve()));
+const epipe = Object.assign(new Error("EPIPE: broken pipe, write"), { code: "EPIPE", syscall: "write", errno: -4047 });
+if (!("destroy" in server.stdin) || typeof server.stdin.destroy !== "function") {
+	throw new Error("server stdin is not destroyable");
+}
+server.stdin.destroy(epipe);
+await stdinClosed;
+
+server.kill("SIGKILL");
+await server.exited;
+process.stdout.write("PROBE_SURVIVED\n");

package/packages/lsp-core/src/lsp/process-pipe-errors.test.ts

@@ -0,0 +1,21 @@
+import { spawnSync } from "node:child_process";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "bun:test";
+
+const probePath = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "disposed-stdin-epipe-probe.ts");
+
+describe("spawned LSP server pipes", () => {
+	it("handles an EPIPE on server stdin after the connection is disposed", () => {
+		// given a server whose JSON-RPC connection was disposed during cleanup
+		// when its stdin pipe then fails with EPIPE (the Windows teardown order)
+		const result = spawnSync(process.execPath, [probePath], { encoding: "utf8", timeout: 15_000 });
+
+		// then the failure is reported as ignored cleanup noise, never raised as unhandled
+		expect(result.stderr).not.toContain("Unhandled");
+		expect(result.stderr).toContain("[lsp] ignored server stdin failure during cleanup: EPIPE");
+		expect(result.stdout).toContain("PROBE_SURVIVED");
+		expect(result.status).toBe(0);
+	});
+});

package/packages/lsp-core/src/lsp/process.ts

@@ -56,6 +56,19 @@ export function validateCwd(cwd: string): { valid: boolean; error?: string } {
 	}
 }
 
+// The child's pipes outlive every JsonRpcConnection that borrows them: a
+// connection detaches its listeners on dispose, yet a write issued before
+// dispose can still fail later (on Windows a closed pipe reports EPIPE
+// asynchronously). An 'error' event with no listener is raised as an unhandled
+// error, so each pipe keeps this guard for its whole life. It reports only when
+// no other owner is listening, so an attached connection keeps sole reporting.
+function guardPipeErrors(stream: NodeJS.EventEmitter, pipe: string): void {
+	stream.on("error", (error: Error) => {
+		if (stream.listenerCount("error") > 1) return;
+		reportBestEffortCleanupError(`server ${pipe}`, error);
+	});
+}
+
 function wrap(proc: ChildProcess): SpawnedProcess {
 	const exitedPromise = new Promise<number>((resolve) => {
 		proc.once("close", (code) => resolve(code ?? 0));
@@ -65,6 +78,9 @@ function wrap(proc: ChildProcess): SpawnedProcess {
 	if (!proc.stdin || !proc.stdout || !proc.stderr) {
 		throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
 	}
+	guardPipeErrors(proc.stdin, "stdin");
+	guardPipeErrors(proc.stdout, "stdout");
+	guardPipeErrors(proc.stderr, "stderr");
 
 	return {
 		stdin: proc.stdin,

package/packages/lsp-daemon/dist/cli.js

@@ -1404,6 +1404,13 @@ function validateCwd(cwd) {
     };
   }
 }
+function guardPipeErrors(stream, pipe) {
+  stream.on("error", (error) => {
+    if (stream.listenerCount("error") > 1)
+      return;
+    reportBestEffortCleanupError(`server ${pipe}`, error);
+  });
+}
 function wrap(proc) {
   const exitedPromise = new Promise((resolve) => {
     proc.once("close", (code) => resolve(code ?? 0));
@@ -1412,6 +1419,9 @@ function wrap(proc) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
   }
+  guardPipeErrors(proc.stdin, "stdin");
+  guardPipeErrors(proc.stdout, "stdout");
+  guardPipeErrors(proc.stderr, "stderr");
   return {
     stdin: proc.stdin,
     stdout: proc.stdout,

package/packages/lsp-daemon/dist/client.js

@@ -1640,6 +1640,13 @@ function validateCwd(cwd) {
     };
   }
 }
+function guardPipeErrors(stream, pipe) {
+  stream.on("error", (error) => {
+    if (stream.listenerCount("error") > 1)
+      return;
+    reportBestEffortCleanupError(`server ${pipe}`, error);
+  });
+}
 function wrap(proc) {
   const exitedPromise = new Promise((resolve) => {
     proc.once("close", (code) => resolve(code ?? 0));
@@ -1648,6 +1655,9 @@ function wrap(proc) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
   }
+  guardPipeErrors(proc.stdin, "stdin");
+  guardPipeErrors(proc.stdout, "stdout");
+  guardPipeErrors(proc.stderr, "stderr");
   return {
     stdin: proc.stdin,
     stdout: proc.stdout,

package/packages/lsp-daemon/dist/index.js

@@ -465,6 +465,13 @@ function validateCwd(cwd) {
     };
   }
 }
+function guardPipeErrors(stream, pipe) {
+  stream.on("error", (error) => {
+    if (stream.listenerCount("error") > 1)
+      return;
+    reportBestEffortCleanupError(`server ${pipe}`, error);
+  });
+}
 function wrap(proc) {
   const exitedPromise = new Promise((resolve) => {
     proc.once("close", (code) => resolve(code ?? 0));
@@ -473,6 +480,9 @@ function wrap(proc) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
   }
+  guardPipeErrors(proc.stdin, "stdin");
+  guardPipeErrors(proc.stdout, "stdout");
+  guardPipeErrors(proc.stderr, "stderr");
   return {
     stdin: proc.stdin,
     stdout: proc.stdout,

package/packages/lsp-tools-mcp/dist/cli.js

@@ -470,6 +470,13 @@ function validateCwd(cwd) {
     };
   }
 }
+function guardPipeErrors(stream, pipe) {
+  stream.on("error", (error) => {
+    if (stream.listenerCount("error") > 1)
+      return;
+    reportBestEffortCleanupError(`server ${pipe}`, error);
+  });
+}
 function wrap(proc) {
   const exitedPromise = new Promise((resolve) => {
     proc.once("close", (code) => resolve(code ?? 0));
@@ -478,6 +485,9 @@ function wrap(proc) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
   }
+  guardPipeErrors(proc.stdin, "stdin");
+  guardPipeErrors(proc.stdout, "stdout");
+  guardPipeErrors(proc.stderr, "stderr");
   return {
     stdin: proc.stdin,
     stdout: proc.stdout,

package/packages/lsp-tools-mcp/dist/lsp/manager.js

@@ -465,6 +465,13 @@ function validateCwd(cwd) {
     };
   }
 }
+function guardPipeErrors(stream, pipe) {
+  stream.on("error", (error) => {
+    if (stream.listenerCount("error") > 1)
+      return;
+    reportBestEffortCleanupError(`server ${pipe}`, error);
+  });
+}
 function wrap(proc) {
   const exitedPromise = new Promise((resolve) => {
     proc.once("close", (code) => resolve(code ?? 0));
@@ -473,6 +480,9 @@ function wrap(proc) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
   }
+  guardPipeErrors(proc.stdin, "stdin");
+  guardPipeErrors(proc.stdout, "stdout");
+  guardPipeErrors(proc.stderr, "stderr");
   return {
     stdin: proc.stdin,
     stdout: proc.stdout,

package/packages/lsp-tools-mcp/dist/mcp.js

@@ -969,6 +969,13 @@ function validateCwd(cwd) {
     };
   }
 }
+function guardPipeErrors(stream, pipe) {
+  stream.on("error", (error) => {
+    if (stream.listenerCount("error") > 1)
+      return;
+    reportBestEffortCleanupError(`server ${pipe}`, error);
+  });
+}
 function wrap(proc) {
   const exitedPromise = new Promise((resolve) => {
     proc.once("close", (code) => resolve(code ?? 0));
@@ -977,6 +984,9 @@ function wrap(proc) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
   }
+  guardPipeErrors(proc.stdin, "stdin");
+  guardPipeErrors(proc.stdout, "stdout");
+  guardPipeErrors(proc.stderr, "stderr");
   return {
     stdin: proc.stdin,
     stdout: proc.stdout,

package/packages/lsp-tools-mcp/dist/tools.js

@@ -657,6 +657,13 @@ function validateCwd(cwd) {
     };
   }
 }
+function guardPipeErrors(stream, pipe) {
+  stream.on("error", (error) => {
+    if (stream.listenerCount("error") > 1)
+      return;
+    reportBestEffortCleanupError(`server ${pipe}`, error);
+  });
+}
 function wrap(proc) {
   const exitedPromise = new Promise((resolve) => {
     proc.once("close", (code) => resolve(code ?? 0));
@@ -665,6 +672,9 @@ function wrap(proc) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new LspProcessSpawnError("Spawned process is missing one of stdin/stdout/stderr pipes");
   }
+  guardPipeErrors(proc.stdin, "stdin");
+  guardPipeErrors(proc.stdout, "stdout");
+  guardPipeErrors(proc.stderr, "stderr");
   return {
     stdin: proc.stdin,
     stdout: proc.stdout,