oh-my-opencode 5.1.46 → 5.1.48

package/.agents/command/publish.md

@@ -205,8 +205,7 @@ gh release view "v${NEW_VERSION}" --json tagName,url --jq '{tag: .tagName, url:
 
 **Release notes are written BEFORE the release, not after.**
 
-The release body is extracted from the `CHANGELOG.md` section for this version. Author the user-facing
-notes under `## [Unreleased]` and land them before dispatching `/publish`; release-state preparation
+The release body is extracted from the `CHANGELOG.md` section for this version. Add the user-facing notes as `changes/unreleased/<pr-number>.md` fragments (one per PR, named for the PR) and land them before dispatching `/publish`; release-state preparation
 stamps that heading into `## [<version>] - <UTC date>` and commits it with the release state, so the
 published commit already carries its own notes.
 
@@ -220,13 +219,13 @@ bun run script/print-release-notes.ts "${NEW_VERSION}" /tmp/contributors.md
 <agent-instruction>
 After running the preview, present the output to the user and say:
 
-> **This is the exact body the release will publish:** the notes you authored under `[Unreleased]`,
+> **This is the exact body the release will publish:** the assembled fragments,
 > then contributor thank-yous for non-team contributors, then the install footer.
 >
 > Both steps are fail-closed: an absent, empty, or duplicated section aborts the release instead of
 > publishing blank notes, and re-stamping a version that already has a section is refused.
 >
-> If the `[Unreleased]` section is empty, STOP and write the notes first — the release cannot proceed.
+> If `changes/unreleased/` holds no fragments, STOP and write them first — the release cannot proceed.
 
 **APPROVAL GATE (single, binary):** The user's initial publish request with a named bump type IS the only approval this workflow requires. Do NOT wait for a separate acknowledgement here. Present the preview, then IMMEDIATELY proceed to Step 6. The only exception: if the user explicitly said "let me review the changelog before you continue" (or equivalent), stop and wait. Otherwise continue without ending the turn.
 </agent-instruction>

package/.agents/skills/publish/SKILL.md

@@ -204,8 +204,7 @@ gh release view "v${NEW_VERSION}" --json tagName,url --jq '{tag: .tagName, url:
 
 **Release notes are written BEFORE the release, not after.**
 
-The release body is extracted from the `CHANGELOG.md` section for this version. Author the user-facing
-notes under `## [Unreleased]` and land them before dispatching `/publish`; release-state preparation
+The release body is extracted from the `CHANGELOG.md` section for this version. Add the user-facing notes as `changes/unreleased/<pr-number>.md` fragments (one per PR, named for the PR) and land them before dispatching `/publish`; release-state preparation
 stamps that heading into `## [<version>] - <UTC date>` and commits it with the release state, so the
 published commit already carries its own notes.
 
@@ -219,13 +218,13 @@ bun run script/print-release-notes.ts "${NEW_VERSION}" /tmp/contributors.md
 <agent-instruction>
 After running the preview, present the output to the user and say:
 
-> **This is the exact body the release will publish:** the notes you authored under `[Unreleased]`,
+> **This is the exact body the release will publish:** the assembled fragments,
 > then contributor thank-yous for non-team contributors, then the install footer.
 >
 > Both steps are fail-closed: an absent, empty, or duplicated section aborts the release instead of
 > publishing blank notes, and re-stamping a version that already has a section is refused.
 >
-> If the `[Unreleased]` section is empty, STOP and write the notes first — the release cannot proceed.
+> If `changes/unreleased/` holds no fragments, STOP and write them first — the release cannot proceed.
 
 **APPROVAL GATE (single, binary):** The user's initial publish request with a named bump type IS the only approval this workflow requires. Do NOT wait for a separate acknowledgement here. Present the preview, then IMMEDIATELY proceed to Step 6. The only exception: if the user explicitly said "let me review the changelog before you continue" (or equivalent), stop and wait. Otherwise continue without ending the turn.
 </agent-instruction>

package/.opencode/command/publish.md

@@ -205,8 +205,7 @@ gh release view "v${NEW_VERSION}" --json tagName,url --jq '{tag: .tagName, url:
 
 **Release notes are written BEFORE the release, not after.**
 
-The release body is extracted from the `CHANGELOG.md` section for this version. Author the user-facing
-notes under `## [Unreleased]` and land them before dispatching `/publish`; release-state preparation
+The release body is extracted from the `CHANGELOG.md` section for this version. Add the user-facing notes as `changes/unreleased/<pr-number>.md` fragments (one per PR, named for the PR) and land them before dispatching `/publish`; release-state preparation
 stamps that heading into `## [<version>] - <UTC date>` and commits it with the release state, so the
 published commit already carries its own notes.
 
@@ -220,13 +219,13 @@ bun run script/print-release-notes.ts "${NEW_VERSION}" /tmp/contributors.md
 <agent-instruction>
 After running the preview, present the output to the user and say:
 
-> **This is the exact body the release will publish:** the notes you authored under `[Unreleased]`,
+> **This is the exact body the release will publish:** the assembled fragments,
 > then contributor thank-yous for non-team contributors, then the install footer.
 >
 > Both steps are fail-closed: an absent, empty, or duplicated section aborts the release instead of
 > publishing blank notes, and re-stamping a version that already has a section is refused.
 >
-> If the `[Unreleased]` section is empty, STOP and write the notes first — the release cannot proceed.
+> If `changes/unreleased/` holds no fragments, STOP and write them first — the release cannot proceed.
 
 **APPROVAL GATE (single, binary):** The user's initial publish request with a named bump type IS the only approval this workflow requires. Do NOT wait for a separate acknowledgement here. Present the preview, then IMMEDIATELY proceed to Step 6. The only exception: if the user explicitly said "let me review the changelog before you continue" (or equivalent), stop and wait. Otherwise continue without ending the turn.
 </agent-instruction>

package/dist/agents/atlas/agent.d.ts

@@ -7,7 +7,8 @@
  * 1. Claude Opus 4.7       → opus-4-7.md   (literal-following + explicit fan-out push)
  * 2. GPT family            → gpt.md        (shared GPT-family calibration)
  * 3. Gemini family         → gemini.md
- * 4. Kimi K3              → kimi-k3.md    (K3-native; checked first among Kimi)
+ * 4. Kimi K3.1            → kimi-k3-1.md  (own copy of kimi-k3.md; checked before K3)
+ * 4b. Kimi K3             → kimi-k3.md    (K3-native; checked first among the rest of Kimi)
  * 5. Kimi K2.7             → kimi-k2-7.md  (restrained, outcome-first; checked before generic kimi)
  * 6. Kimi K2.x family      → kimi.md       (Claude-family base + K2.6 thinking-mode calibration)
  * 7. GLM family            → glm.md        (GLM 5.2 calibration)
@@ -18,7 +19,7 @@ import type { AgentMode, AgentPromptMetadata } from "../types";
 import type { AvailableAgent, AvailableSkill } from "../dynamic-agent-prompt-builder";
 import type { CategoryConfig } from "../../config/schema";
 declare const MODE: AgentMode;
-export type AtlasPromptSource = "default" | "gpt" | "gemini" | "kimi" | "kimi-k3" | "kimi-k2-7" | "opus-4-7" | "glm";
+export type AtlasPromptSource = "default" | "gpt" | "gemini" | "kimi" | "kimi-k3" | "kimi-k3-1" | "kimi-k2-7" | "opus-4-7" | "glm";
 export declare function getAtlasPromptSource(model?: string): AtlasPromptSource;
 export interface OrchestratorContext {
     model?: string;

package/dist/agents/sisyphus/index.d.ts

@@ -28,3 +28,4 @@ export { buildGlm52SisyphusPrompt } from "./glm-5-2";
 export { buildKimiK26SisyphusPrompt } from "./kimi-k2-6";
 export { buildKimiK27SisyphusPrompt } from "./kimi-k2-7";
 export { buildKimiK3SisyphusPrompt } from "./kimi-k3";
+export { buildKimiK31SisyphusPrompt } from "./kimi-k3-1";

package/dist/agents/sisyphus/kimi-k3-1.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Kimi K3.1 Sisyphus prompt: its own copy of kimi-k3.ts (Q, 2026-10-24), so later K3 tuning never
+ * changes what K3.1 sees. Copied at omo dev de27f2ebfa; only the identity line and the function names
+ * differ. Tune it on K3.1 evidence from here on. The K3 design notes in kimi-k3.ts applied at the copy.
+ */
+import type { AvailableAgent, AvailableTool, AvailableSkill, AvailableCategory } from "../dynamic-agent-prompt-builder";
+import { categorizeTools } from "../dynamic-agent-prompt-builder";
+export declare function buildKimiK31SisyphusPrompt(model: string, availableAgents: AvailableAgent[], availableTools?: AvailableTool[], availableSkills?: AvailableSkill[], availableCategories?: AvailableCategory[], useTaskSystem?: boolean): string;
+export { categorizeTools };

package/dist/agents/sisyphus-agent-factory.d.ts

@@ -9,7 +9,7 @@ declare const MODE: AgentMode;
  * runtime model resolves to a different family than the configured one, the baked
  * body is the wrong family and must be rebuilt (issue #5297/#5316).
  */
-export type SisyphusPromptFamily = "kimi-k3" | "kimi-k2-7" | "kimi-k2-6" | "gpt-5-5" | "gpt-5-4" | "claude-fable-5" | "claude-opus-5" | "claude-opus-4-8" | "claude-opus-4-7" | "glm-5-2" | "grok-4" | "fallback";
+export type SisyphusPromptFamily = "kimi-k3-1" | "kimi-k3" | "kimi-k2-7" | "kimi-k2-6" | "gpt-5-5" | "gpt-5-4" | "claude-fable-5" | "claude-opus-5" | "claude-opus-4-8" | "claude-opus-4-7" | "glm-5-2" | "grok-4" | "fallback";
 export declare function resolveSisyphusPromptFamily(model: string): SisyphusPromptFamily;
 export declare function createSisyphusAgent(model: string, availableAgents?: AvailableAgent[], availableToolNames?: string[], availableSkills?: AvailableSkill[], availableCategories?: AvailableCategory[], useTaskSystem?: boolean): AgentConfig;
 export declare namespace createSisyphusAgent {

package/dist/agents/sisyphus-junior/agent.d.ts

@@ -21,7 +21,7 @@ export declare const SISYPHUS_JUNIOR_DEFAULTS: {
     readonly model: "anthropic/claude-sonnet-5";
     readonly temperature: 0.1;
 };
-export type SisyphusJuniorPromptSource = "default" | "kimi-k2" | "kimi-k2-7" | "kimi-k3" | "gpt" | "gpt-5-5" | "gpt-5-4" | "gemini" | "glm-5-2";
+export type SisyphusJuniorPromptSource = "default" | "kimi-k2" | "kimi-k2-7" | "kimi-k3" | "kimi-k3-1" | "gpt" | "gpt-5-5" | "gpt-5-4" | "gemini" | "glm-5-2";
 export declare function getSisyphusJuniorPromptSource(model?: string): SisyphusJuniorPromptSource;
 /**
  * Builds the appropriate Sisyphus-Junior prompt based on model.

package/dist/agents/sisyphus-junior/index.d.ts

@@ -2,6 +2,7 @@ export { buildDefaultSisyphusJuniorPrompt } from "./default";
 export { buildKimiK26SisyphusJuniorPrompt } from "./kimi-k2-6";
 export { buildKimiK27SisyphusJuniorPrompt } from "./kimi-k2-7";
 export { buildKimiK3SisyphusJuniorPrompt } from "./kimi-k3";
+export { buildKimiK31SisyphusJuniorPrompt } from "./kimi-k3-1";
 export { buildGptSisyphusJuniorPrompt } from "./gpt";
 export { buildGpt54SisyphusJuniorPrompt } from "./gpt-5-4";
 export { buildGpt55SisyphusJuniorPrompt } from "./gpt-5-5";

package/dist/agents/sisyphus-junior/kimi-k3-1.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Kimi K3.1 Sisyphus-Junior prompt: its own copy of kimi-k3.ts (Q, 2026-10-24), so later K3 tuning never
+ * changes what K3.1 sees. Copied at omo dev de27f2ebfa; only the identity line and the function names
+ * differ. Tune it on K3.1 evidence from here on. The K3 design notes in kimi-k3.ts applied at the copy.
+ */
+export declare function buildKimiK31SisyphusJuniorPrompt(useTaskSystem: boolean, promptAppend?: string): string;

package/dist/agents/types.d.ts

@@ -1,6 +1,6 @@
 import type { AgentConfig } from "@opencode-ai/sdk";
-import { isClaudeFable5Model, isClaudeFableOrMythosModel, isClaudeOpus46Model, isClaudeOpus47Model, isClaudeOpus47OrLaterModel, isClaudeOpus48Model, isClaudeOpus5Model, isGeminiModel, isGlmModel, isGptModel, isGrok45Model, isGrok46Model, isKimiK2CodeModel, isKimiK2Model, isKimiK27Model, isKimiK28Model, isKimiK3Model, isMiniMaxModel } from "@oh-my-opencode/model-core";
-export { isClaudeFable5Model, isClaudeFableOrMythosModel, isClaudeOpus46Model, isClaudeOpus47Model, isClaudeOpus47OrLaterModel, isClaudeOpus48Model, isClaudeOpus5Model, isGeminiModel, isGlmModel, isGptModel, isGrok45Model, isGrok46Model, isKimiK2CodeModel, isKimiK2Model, isKimiK27Model, isKimiK28Model, isKimiK3Model, isMiniMaxModel, };
+import { isClaudeFable5Model, isClaudeFableOrMythosModel, isClaudeOpus46Model, isClaudeOpus47Model, isClaudeOpus47OrLaterModel, isClaudeOpus48Model, isClaudeOpus5Model, isGeminiModel, isGlmModel, isGptModel, isGrok45Model, isGrok46Model, isKimiK2CodeModel, isKimiK2Model, isKimiK27Model, isKimiK28Model, isKimiK3Model, isKimiK31Model, isMiniMaxModel } from "@oh-my-opencode/model-core";
+export { isClaudeFable5Model, isClaudeFableOrMythosModel, isClaudeOpus46Model, isClaudeOpus47Model, isClaudeOpus47OrLaterModel, isClaudeOpus48Model, isClaudeOpus5Model, isGeminiModel, isGlmModel, isGptModel, isGrok45Model, isGrok46Model, isKimiK2CodeModel, isKimiK2Model, isKimiK27Model, isKimiK28Model, isKimiK3Model, isKimiK31Model, isMiniMaxModel, };
 /**
  * Anthropic Opus 4.7+, Fable, and Mythos models reject thinking.type "enabled";
  * they require adaptive thinking plus an effort, which OpenCode core derives from

package/dist/cli/index.js

@@ -2132,7 +2132,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "oh-my-opencode",
-    version: "5.1.46",
+    version: "5.1.48",
     description: "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
     main: "./dist/index.js",
     types: "dist/index.d.ts",
@@ -2315,7 +2315,7 @@ var init_package = __esm(() => {
     },
     devDependencies: {
       "@clack/prompts": "^1.8.1",
-      "@code-yeongyu/senpi": "2026.10.23-1",
+      "@code-yeongyu/senpi": "2026.10.25-2",
       "@modelcontextprotocol/sdk": "^1.30.0",
       "@oh-my-opencode/agents-md-core": "workspace:*",
       "@oh-my-opencode/ast-grep-mcp": "workspace:*",
@@ -2378,18 +2378,18 @@ var init_package = __esm(() => {
       typescript: "^7.0.2"
     },
     optionalDependencies: {
-      "oh-my-opencode-darwin-arm64": "5.1.46",
-      "oh-my-opencode-darwin-x64": "5.1.46",
-      "oh-my-opencode-darwin-x64-baseline": "5.1.46",
-      "oh-my-opencode-linux-arm64": "5.1.46",
-      "oh-my-opencode-linux-arm64-musl": "5.1.46",
-      "oh-my-opencode-linux-x64": "5.1.46",
-      "oh-my-opencode-linux-x64-baseline": "5.1.46",
-      "oh-my-opencode-linux-x64-musl": "5.1.46",
-      "oh-my-opencode-linux-x64-musl-baseline": "5.1.46",
-      "oh-my-opencode-windows-arm64": "5.1.46",
-      "oh-my-opencode-windows-x64": "5.1.46",
-      "oh-my-opencode-windows-x64-baseline": "5.1.46"
+      "oh-my-opencode-darwin-arm64": "5.1.48",
+      "oh-my-opencode-darwin-x64": "5.1.48",
+      "oh-my-opencode-darwin-x64-baseline": "5.1.48",
+      "oh-my-opencode-linux-arm64": "5.1.48",
+      "oh-my-opencode-linux-arm64-musl": "5.1.48",
+      "oh-my-opencode-linux-x64": "5.1.48",
+      "oh-my-opencode-linux-x64-baseline": "5.1.48",
+      "oh-my-opencode-linux-x64-musl": "5.1.48",
+      "oh-my-opencode-linux-x64-musl-baseline": "5.1.48",
+      "oh-my-opencode-windows-arm64": "5.1.48",
+      "oh-my-opencode-windows-x64": "5.1.48",
+      "oh-my-opencode-windows-x64-baseline": "5.1.48"
     },
     overrides: {
       hono: "^4.13.8",
@@ -7163,7 +7163,7 @@ function resolveStdio(options) {
   return [options.stdin ?? "ignore", options.stdout ?? "pipe", options.stderr ?? "inherit"];
 }
 function createBunSpawnOptions(options) {
-  return { ...options, windowsHide: true };
+  return { ...options, env: options.env ?? process.env, windowsHide: true };
 }
 function createNodeSpawnOptions(options, platform = process.platform) {
   const nodeOptions = {
@@ -10184,6 +10184,10 @@ function transformModelForProviderUsingAnthropicBehavior(provider, model) {
       return "k3";
     if (model === "kimi-k3-256k")
       return "k3-256k";
+    if (model === "kimi-k3.1-pro")
+      return "k3.1-pro";
+    if (model === "kimi-k3.1-pro-highspeed")
+      return "k3.1-pro-highspeed";
   }
   return model;
 }
@@ -92381,7 +92385,7 @@ var package_default2;
 var init_package2 = __esm(() => {
   package_default2 = {
     name: "@oh-my-opencode/omo-codex",
-    version: "5.1.46",
+    version: "5.1.48",
     type: "module",
     private: true,
     description: "Codex harness adapter for oh-my-openagent. Vendored Codex plugin namespace (omo) + TypeScript installer + telemetry.",
@@ -93954,8 +93958,7 @@ function windowsNodeDiscoveryLines() {
     '  for /f "tokens=* delims= " %%N in ("!OMO_NODE_BINARY!") do set "OMO_NODE_BINARY=%%N"',
     `  if "!OMO_NODE_BINARY:~0,1!"=="'" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~1!"`,
     `  if "!OMO_NODE_BINARY:~-1!"=="'" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~0,-1!"`,
-    '  if "!OMO_NODE_BINARY:~0,1!"=="^"" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~1!"',
-    '  if "!OMO_NODE_BINARY:~-1!"=="^"" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~0,-1!"',
+    '  set "OMO_NODE_BINARY=!OMO_NODE_BINARY:"=!"',
     '  if defined OMO_NODE_BINARY if not exist "!OMO_NODE_BINARY!" set "OMO_NODE_BINARY="',
     ")",
     'if not defined OMO_NODE_BINARY where node >nul 2>nul && set "OMO_NODE_BINARY=node"'
@@ -112065,6 +112068,8 @@ class CredentialStoreError extends SignInError {
 
 class KeychainLockedError extends CredentialStoreError {
 }
+class InvalidCredentialState extends SignInError {
+}
 var LOCKED = /-25308|errSecInteractionNotAllowed|interaction is not allowed|locked collection/i;
 var UNLOCKED_REUSE_MS = 30000;
 var fallbackNoticed = false;
@@ -112080,12 +112085,15 @@ function credentialId(api) {
   return createHash10("sha256").update(serviceOrigin(api)).digest("hex");
 }
 function createCredentialStore(api, secrets = typeof Bun === "undefined" ? null : Bun.secrets, platform = process.platform, lockProbe = probeSecretServiceLock, notice = stderrNoticeOncePerProcess) {
+  return createSealedStore(api, "omo-cli", credentialSchema, secrets, platform, lockProbe, notice);
+}
+function createSealedStore(api, namespace, schema, secrets = typeof Bun === "undefined" ? null : Bun.secrets, platform = process.platform, lockProbe = probeSecretServiceLock, notice = stderrNoticeOncePerProcess) {
   if (!secrets)
     throw new SignInError("OmO sign-in needs Bun 1.4 or newer with OS credential storage. No file fallback is available.");
   const platformName = platform === "darwin" ? "macOS Keychain" : platform === "linux" ? "Linux Secret Service (libsecret and an unlocked keyring)" : platform === "win32" ? "Windows Credential Manager" : null;
   if (platformName === null)
     throw new SignInError("This platform has no supported OS credential store.");
-  const key = { service: "omo-cli", name: credentialId(api) };
+  const key = { service: namespace, name: credentialId(api) };
   const unavailable = (error) => isLocked(error) ? new KeychainLockedError(`${platformName} is locked. Unlock it, then try again. Credentials are never saved to a file.`) : new CredentialStoreError(`Cannot access ${platformName}. Unlock or enable the OS credential store and try again. Credentials are never saved to a file.`);
   let unlockedUntil = 0;
   let noticed = false;
@@ -112116,15 +112124,15 @@ function createCredentialStore(api, secrets = typeof Bun === "undefined" ? null
       if (value === null)
         return null;
       try {
-        return credentialSchema.parse(JSON.parse(value));
+        return schema.parse(JSON.parse(value));
       } catch {
-        throw new SignInError("Stored sign-in data is invalid. Run omo logout, then omo login.");
+        throw new InvalidCredentialState("Stored sign-in data is invalid. Run omo logout, then omo login.");
       }
     },
     async write(value) {
       await assertUsable();
       try {
-        await secrets.set({ ...key, value: JSON.stringify(credentialSchema.parse(value)) });
+        await secrets.set({ ...key, value: JSON.stringify(schema.parse(value)) });
       } catch (error) {
         throw unavailable(error);
       }

package/dist/cli/service-auth/keystore.d.ts

@@ -1,3 +1,4 @@
+import type { z } from "zod";
 import { type Credentials, SignInError } from "./protocol";
 import { type SecretServiceLockProbe } from "./secret-service-lock";
 type SecretKey = {
@@ -11,18 +12,22 @@ export type SecretApi = {
     }) => Promise<void>;
     readonly delete: (key: SecretKey) => Promise<boolean>;
 };
-export type CredentialStore = {
-    readonly read: () => Promise<Credentials | null>;
-    readonly write: (value: Credentials) => Promise<void>;
+export type SealedStore<T> = {
+    readonly read: () => Promise<T | null>;
+    readonly write: (value: T) => Promise<void>;
     readonly clear: () => Promise<void>;
 };
+export type CredentialStore = SealedStore<Credentials>;
 export declare class CredentialStoreError extends SignInError {
 }
 export declare class KeychainLockedError extends CredentialStoreError {
 }
 export declare class SecretServiceUnavailableError extends CredentialStoreError {
 }
+export declare class InvalidCredentialState extends SignInError {
+}
 export declare const quietNotice: (_message: string) => void;
 export declare function credentialId(api: string): string;
 export declare function createCredentialStore(api: string, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void): CredentialStore;
+export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void): SealedStore<T>;
 export {};

package/dist/cli-node/index.js

@@ -2133,7 +2133,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "oh-my-opencode",
-    version: "5.1.46",
+    version: "5.1.48",
     description: "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
     main: "./dist/index.js",
     types: "dist/index.d.ts",
@@ -2316,7 +2316,7 @@ var init_package = __esm(() => {
     },
     devDependencies: {
       "@clack/prompts": "^1.8.1",
-      "@code-yeongyu/senpi": "2026.10.23-1",
+      "@code-yeongyu/senpi": "2026.10.25-2",
       "@modelcontextprotocol/sdk": "^1.30.0",
       "@oh-my-opencode/agents-md-core": "workspace:*",
       "@oh-my-opencode/ast-grep-mcp": "workspace:*",
@@ -2379,18 +2379,18 @@ var init_package = __esm(() => {
       typescript: "^7.0.2"
     },
     optionalDependencies: {
-      "oh-my-opencode-darwin-arm64": "5.1.46",
-      "oh-my-opencode-darwin-x64": "5.1.46",
-      "oh-my-opencode-darwin-x64-baseline": "5.1.46",
-      "oh-my-opencode-linux-arm64": "5.1.46",
-      "oh-my-opencode-linux-arm64-musl": "5.1.46",
-      "oh-my-opencode-linux-x64": "5.1.46",
-      "oh-my-opencode-linux-x64-baseline": "5.1.46",
-      "oh-my-opencode-linux-x64-musl": "5.1.46",
-      "oh-my-opencode-linux-x64-musl-baseline": "5.1.46",
-      "oh-my-opencode-windows-arm64": "5.1.46",
-      "oh-my-opencode-windows-x64": "5.1.46",
-      "oh-my-opencode-windows-x64-baseline": "5.1.46"
+      "oh-my-opencode-darwin-arm64": "5.1.48",
+      "oh-my-opencode-darwin-x64": "5.1.48",
+      "oh-my-opencode-darwin-x64-baseline": "5.1.48",
+      "oh-my-opencode-linux-arm64": "5.1.48",
+      "oh-my-opencode-linux-arm64-musl": "5.1.48",
+      "oh-my-opencode-linux-x64": "5.1.48",
+      "oh-my-opencode-linux-x64-baseline": "5.1.48",
+      "oh-my-opencode-linux-x64-musl": "5.1.48",
+      "oh-my-opencode-linux-x64-musl-baseline": "5.1.48",
+      "oh-my-opencode-windows-arm64": "5.1.48",
+      "oh-my-opencode-windows-x64": "5.1.48",
+      "oh-my-opencode-windows-x64-baseline": "5.1.48"
     },
     overrides: {
       hono: "^4.13.8",
@@ -7164,7 +7164,7 @@ function resolveStdio(options) {
   return [options.stdin ?? "ignore", options.stdout ?? "pipe", options.stderr ?? "inherit"];
 }
 function createBunSpawnOptions(options) {
-  return { ...options, windowsHide: true };
+  return { ...options, env: options.env ?? process.env, windowsHide: true };
 }
 function createNodeSpawnOptions(options, platform = process.platform) {
   const nodeOptions = {
@@ -10185,6 +10185,10 @@ function transformModelForProviderUsingAnthropicBehavior(provider, model) {
       return "k3";
     if (model === "kimi-k3-256k")
       return "k3-256k";
+    if (model === "kimi-k3.1-pro")
+      return "k3.1-pro";
+    if (model === "kimi-k3.1-pro-highspeed")
+      return "k3.1-pro-highspeed";
   }
   return model;
 }
@@ -92460,7 +92464,7 @@ var package_default2;
 var init_package2 = __esm(() => {
   package_default2 = {
     name: "@oh-my-opencode/omo-codex",
-    version: "5.1.46",
+    version: "5.1.48",
     type: "module",
     private: true,
     description: "Codex harness adapter for oh-my-openagent. Vendored Codex plugin namespace (omo) + TypeScript installer + telemetry.",
@@ -94033,8 +94037,7 @@ function windowsNodeDiscoveryLines() {
     '  for /f "tokens=* delims= " %%N in ("!OMO_NODE_BINARY!") do set "OMO_NODE_BINARY=%%N"',
     `  if "!OMO_NODE_BINARY:~0,1!"=="'" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~1!"`,
     `  if "!OMO_NODE_BINARY:~-1!"=="'" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~0,-1!"`,
-    '  if "!OMO_NODE_BINARY:~0,1!"=="^"" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~1!"',
-    '  if "!OMO_NODE_BINARY:~-1!"=="^"" set "OMO_NODE_BINARY=!OMO_NODE_BINARY:~0,-1!"',
+    '  set "OMO_NODE_BINARY=!OMO_NODE_BINARY:"=!"',
     '  if defined OMO_NODE_BINARY if not exist "!OMO_NODE_BINARY!" set "OMO_NODE_BINARY="',
     ")",
     'if not defined OMO_NODE_BINARY where node >nul 2>nul && set "OMO_NODE_BINARY=node"'
@@ -112144,6 +112147,8 @@ class CredentialStoreError extends SignInError {
 
 class KeychainLockedError extends CredentialStoreError {
 }
+class InvalidCredentialState extends SignInError {
+}
 var LOCKED = /-25308|errSecInteractionNotAllowed|interaction is not allowed|locked collection/i;
 var UNLOCKED_REUSE_MS = 30000;
 var fallbackNoticed = false;
@@ -112159,12 +112164,15 @@ function credentialId(api) {
   return createHash10("sha256").update(serviceOrigin(api)).digest("hex");
 }
 function createCredentialStore(api, secrets = typeof Bun === "undefined" ? null : Bun.secrets, platform = process.platform, lockProbe = probeSecretServiceLock, notice = stderrNoticeOncePerProcess) {
+  return createSealedStore(api, "omo-cli", credentialSchema, secrets, platform, lockProbe, notice);
+}
+function createSealedStore(api, namespace, schema, secrets = typeof Bun === "undefined" ? null : Bun.secrets, platform = process.platform, lockProbe = probeSecretServiceLock, notice = stderrNoticeOncePerProcess) {
   if (!secrets)
     throw new SignInError("OmO sign-in needs Bun 1.4 or newer with OS credential storage. No file fallback is available.");
   const platformName = platform === "darwin" ? "macOS Keychain" : platform === "linux" ? "Linux Secret Service (libsecret and an unlocked keyring)" : platform === "win32" ? "Windows Credential Manager" : null;
   if (platformName === null)
     throw new SignInError("This platform has no supported OS credential store.");
-  const key = { service: "omo-cli", name: credentialId(api) };
+  const key = { service: namespace, name: credentialId(api) };
   const unavailable = (error) => isLocked(error) ? new KeychainLockedError(`${platformName} is locked. Unlock it, then try again. Credentials are never saved to a file.`) : new CredentialStoreError(`Cannot access ${platformName}. Unlock or enable the OS credential store and try again. Credentials are never saved to a file.`);
   let unlockedUntil = 0;
   let noticed = false;
@@ -112195,15 +112203,15 @@ function createCredentialStore(api, secrets = typeof Bun === "undefined" ? null
       if (value === null)
         return null;
       try {
-        return credentialSchema.parse(JSON.parse(value));
+        return schema.parse(JSON.parse(value));
       } catch {
-        throw new SignInError("Stored sign-in data is invalid. Run omo logout, then omo login.");
+        throw new InvalidCredentialState("Stored sign-in data is invalid. Run omo logout, then omo login.");
       }
     },
     async write(value) {
       await assertUsable();
       try {
-        await secrets.set({ ...key, value: JSON.stringify(credentialSchema.parse(value)) });
+        await secrets.set({ ...key, value: JSON.stringify(schema.parse(value)) });
       } catch (error) {
         throw unavailable(error);
       }