oh-my-opencode 5.1.51 → 5.1.55

package/dist/cli/index.js

@@ -2132,7 +2132,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "oh-my-opencode",
-    version: "5.1.51",
+    version: "5.1.55",
     description: "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
     main: "./dist/index.js",
     types: "dist/index.d.ts",
@@ -2156,6 +2156,7 @@ var init_package = __esm(() => {
       "packages/openclaw-core",
       "packages/boulder-state",
       "packages/memory-core",
+      "packages/device-service-core",
       "packages/isolation-core",
       "packages/telemetry-core",
       "packages/claude-code-compat-core",
@@ -2274,14 +2275,15 @@ var init_package = __esm(() => {
       prepublishOnly: "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",
       "test:model-capabilities": "bun test --timeout 20000 packages/model-core/src/model-capability-aliases.test.ts packages/model-core/src/model-capability-guardrails.test.ts packages/model-core/src/model-capabilities.test.ts packages/omo-opencode/src/cli/doctor/checks/model-resolution.test.ts --bail",
       "check:copy": "bun script/check-copy.ts",
-      typecheck: "bun run check:copy && tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",
-      "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json && tsgo --noEmit -p packages/git-bash-mcp/tsconfig.json && tsgo --noEmit -p packages/ast-grep-mcp/tsconfig.json && tsgo --noEmit -p packages/lsp-core/tsconfig.json && tsgo --noEmit -p packages/utils/tsconfig.json && tsgo --noEmit -p packages/model-core/tsconfig.json && tsgo --noEmit -p packages/omo-config-core/tsconfig.json && tsgo --noEmit -p packages/prompts-core/tsconfig.json && tsgo --noEmit -p packages/comment-checker-core/tsconfig.json && tsgo --noEmit -p packages/hashline-core/tsconfig.json && tsgo --noEmit -p packages/tmux-core/tsconfig.json && tsgo --noEmit -p packages/team-core/tsconfig.json && tsgo --noEmit -p packages/openclaw-core/tsconfig.json && tsgo --noEmit -p packages/boulder-state/tsconfig.json && tsgo --noEmit -p packages/isolation-core/tsconfig.json && tsgo --noEmit -p packages/memory-core/tsconfig.json && tsgo --noEmit -p packages/telemetry-core/tsconfig.json && tsgo --noEmit -p packages/claude-code-compat-core/tsconfig.json && tsgo --noEmit -p packages/skills-loader-core/tsconfig.json && tsgo --noEmit -p packages/agents-md-core/tsconfig.json && tsgo --noEmit -p packages/omo-codex/plugin/shared/tsconfig.json && tsgo --noEmit -p packages/omo-codex/tsconfig.json && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && tsgo --noEmit -p packages/senpi-task/tsconfig.json && tsgo --noEmit -p packages/omo-opencode/tsconfig.json && tsgo --noEmit -p packages/omo-native/tsconfig.json && tsgo --noEmit -p packages/senpi-desktop-protocol/tsconfig.json && tsgo --noEmit -p packages/senpi-desktop-engine/tsconfig.json && tsgo --noEmit -p packages/senpi-desktop-prelude/tsconfig.json && tsgo --noEmit -p packages/senpi-desktop-service/tsconfig.json && tsgo --noEmit -p packages/senpi-desktop-tool/tsconfig.json",
-      "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",
+      typecheck: "bun run check:copy && bun check --no-script --all -p tsconfig.json && bun run typecheck:script && bun run typecheck:packages && bun run typecheck:skill-scripts",
+      "typecheck:skill-scripts": "bun check --no-script --all -p packages/shared-skills/skills/frontend/scripts/detect/tsconfig.json",
+      "typecheck:packages": "bun check --no-script --all -p packages/rules-engine/tsconfig.json && bun check --no-script --all -p packages/delegate-core/tsconfig.json && bun check --no-script --all -p packages/mcp-stdio-core/tsconfig.json && bun check --no-script --all -p packages/mcp-client-core/tsconfig.json && bun check --no-script --all -p packages/git-bash-mcp/tsconfig.json && bun check --no-script --all -p packages/ast-grep-mcp/tsconfig.json && bun check --no-script --all -p packages/lsp-core/tsconfig.json && bun check --no-script --all -p packages/utils/tsconfig.json && bun check --no-script --all -p packages/device-service-core/tsconfig.json && bun check --no-script --all -p packages/model-core/tsconfig.json && bun check --no-script --all -p packages/omo-config-core/tsconfig.json && bun check --no-script --all -p packages/prompts-core/tsconfig.json && bun check --no-script --all -p packages/comment-checker-core/tsconfig.json && bun check --no-script --all -p packages/hashline-core/tsconfig.json && bun check --no-script --all -p packages/tmux-core/tsconfig.json && bun check --no-script --all -p packages/team-core/tsconfig.json && bun check --no-script --all -p packages/openclaw-core/tsconfig.json && bun check --no-script --all -p packages/boulder-state/tsconfig.json && bun check --no-script --all -p packages/isolation-core/tsconfig.json && bun check --no-script --all -p packages/memory-core/tsconfig.json && bun check --no-script --all -p packages/telemetry-core/tsconfig.json && bun check --no-script --all -p packages/claude-code-compat-core/tsconfig.json && bun check --no-script --all -p packages/skills-loader-core/tsconfig.json && bun check --no-script --all -p packages/agents-md-core/tsconfig.json && bun check --no-script --all -p packages/omo-codex/plugin/shared/tsconfig.json && bun check --no-script --all -p packages/omo-codex/tsconfig.json && bun check --no-script --all -p packages/omo-senpi/tsconfig.json && bun check --no-script --all -p packages/senpi-task/tsconfig.json && bun check --no-script --all -p packages/omo-opencode/tsconfig.json && bun check --no-script --all -p packages/omo-native/tsconfig.json && bun check --no-script --all -p packages/senpi-desktop-protocol/tsconfig.json && bun check --no-script --all -p packages/senpi-desktop-engine/tsconfig.json && bun check --no-script --all -p packages/senpi-desktop-prelude/tsconfig.json && bun check --no-script --all -p packages/senpi-desktop-service/tsconfig.json && bun check --no-script --all -p packages/senpi-desktop-tool/tsconfig.json",
+      "typecheck:script": "bun check --no-script --all -p script/tsconfig.json",
       test: "bun test --timeout 20000",
       "changelog:section": "bun script/changelog-section.ts",
       "test:codex": "bun run build:codex-install && bun run build:git-bash-mcp && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && npm --prefix packages/lsp-tools-mcp test && npm --prefix packages/omo-codex/plugin ci && npm --prefix packages/omo-codex/plugin/components/ulw-loop test && bun run --cwd packages/omo-codex/plugin build && node scripts/check-third-party-notices.mjs --ship && bun test --timeout 20000 packages/omo-opencode/src/cli/cli-installer.platform.test.ts packages/omo-codex/src/install/codex-cache.test.ts packages/omo-codex/src/install/codex-cleanup.test.ts packages/omo-codex/src/install/codex-config-agent-cleanup.test.ts packages/omo-codex/src/install/codex-config-autonomous-features.test.ts packages/omo-codex/src/install/codex-config-reasoning.test.ts packages/omo-codex/src/install/codex-config-toml.test.ts packages/omo-codex/src/install/codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex.test.ts packages/omo-codex/src/install/install-codex-packaged.test.ts packages/omo-codex/src/install/link-cached-plugin-agents.test.ts packages/omo-codex/src/**/*.test.ts packages/utils/src/jsonc-parser.test.ts packages/utils/src/frontmatter.test.ts packages/hashline-core/src/hash-computation.test.ts packages/hashline-core/src/smoke-untested-modules.test.ts packages/rules-engine/src/index.test.ts packages/rules-engine/src/security-boundary.test.ts packages/agents-md-core/src/injector.test.ts packages/omo-codex/plugin/components/lsp/test/package-smoke.test.ts && node --test packages/omo-codex/plugin/test/*.test.mjs packages/omo-codex/scripts/install-cache-copy.test.mjs packages/omo-codex/scripts/install-cli-args.test.mjs packages/omo-codex/scripts/install-delegated-command.test.mjs packages/omo-codex/scripts/install-config-autonomous-features.test.mjs packages/omo-codex/scripts/install-config-autonomous.test.mjs packages/omo-codex/scripts/install-config-reasoning.test.mjs packages/omo-codex/scripts/install-config.test.mjs packages/omo-codex/scripts/install-hook-targets.test.mjs packages/omo-codex/scripts/install-project-local-cleanup.test.mjs packages/omo-codex/scripts/install-lazycodex-version-stamp.test.mjs packages/omo-codex/scripts/install-local-entrypoint.test.mjs packages/omo-codex/scripts/install-local-git-bash-preflight.test.mjs packages/omo-codex/scripts/install-local.test.mjs packages/omo-codex/scripts/install-marketplace-cache.test.mjs packages/omo-codex/scripts/install-mcp-context7-runtime.test.mjs packages/omo-codex/scripts/install-mcp-runtime.test.mjs packages/omo-codex/scripts/install-packaged-local.test.mjs packages/omo-codex/scripts/install-generated-bundle.test.mjs packages/omo-codex/scripts/install-agent-links.test.mjs packages/omo-codex/scripts/install-bin-links.test.mjs",
       "test:fast": "bun run script/test-fast.ts",
-      "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/scripts/resolve-evidence-dir.test.mjs",
+      "test:senpi": "bun run build:senpi-plugin && bun check --no-script --all -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/scripts/resolve-evidence-dir.test.mjs",
       "test:windows-codex": "bun run test:codex",
       "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build",
       "build:ast-grep-mcp": "bun run --cwd packages/ast-grep-mcp build",
@@ -2317,11 +2319,12 @@ var init_package = __esm(() => {
     },
     devDependencies: {
       "@clack/prompts": "^1.8.1",
-      "@code-yeongyu/senpi": "2026.10.27-1",
+      "@code-yeongyu/senpi": "2026.10.30-1",
       "@modelcontextprotocol/sdk": "^1.30.0",
       "@oh-my-opencode/agents-md-core": "workspace:*",
       "@oh-my-opencode/ast-grep-mcp": "workspace:*",
       "@oh-my-opencode/boulder-state": "workspace:*",
+      "@oh-my-opencode/device-service-core": "workspace:*",
       "@oh-my-opencode/claude-code-compat-core": "workspace:*",
       "@oh-my-opencode/comment-checker-core": "workspace:*",
       "@oh-my-opencode/delegate-core": "workspace:*",
@@ -2371,7 +2374,7 @@ var init_package = __esm(() => {
       "jsonc-parser": "^3.3.1",
       knip: "6.43.0",
       "node-pty": "^1.1.0",
-      omowright: "github:code-yeongyu/omowright#f87ef4d63fe7b56fe117dbab246c8ad88dd8a780",
+      omowright: "github:code-yeongyu/omowright#c06d20337ad942b09dea8757a45f6c848008a68d",
       "oxc-parser": "0.148.0",
       oxlint: "1.89.0",
       picocolors: "^1.1.1",
@@ -2381,18 +2384,18 @@ var init_package = __esm(() => {
       typescript: "^7.0.2"
     },
     optionalDependencies: {
-      "oh-my-opencode-darwin-arm64": "5.1.51",
-      "oh-my-opencode-darwin-x64": "5.1.51",
-      "oh-my-opencode-darwin-x64-baseline": "5.1.51",
-      "oh-my-opencode-linux-arm64": "5.1.51",
-      "oh-my-opencode-linux-arm64-musl": "5.1.51",
-      "oh-my-opencode-linux-x64": "5.1.51",
-      "oh-my-opencode-linux-x64-baseline": "5.1.51",
-      "oh-my-opencode-linux-x64-musl": "5.1.51",
-      "oh-my-opencode-linux-x64-musl-baseline": "5.1.51",
-      "oh-my-opencode-windows-arm64": "5.1.51",
-      "oh-my-opencode-windows-x64": "5.1.51",
-      "oh-my-opencode-windows-x64-baseline": "5.1.51"
+      "oh-my-opencode-darwin-arm64": "5.1.55",
+      "oh-my-opencode-darwin-x64": "5.1.55",
+      "oh-my-opencode-darwin-x64-baseline": "5.1.55",
+      "oh-my-opencode-linux-arm64": "5.1.55",
+      "oh-my-opencode-linux-arm64-musl": "5.1.55",
+      "oh-my-opencode-linux-x64": "5.1.55",
+      "oh-my-opencode-linux-x64-baseline": "5.1.55",
+      "oh-my-opencode-linux-x64-musl": "5.1.55",
+      "oh-my-opencode-linux-x64-musl-baseline": "5.1.55",
+      "oh-my-opencode-windows-arm64": "5.1.55",
+      "oh-my-opencode-windows-x64": "5.1.55",
+      "oh-my-opencode-windows-x64-baseline": "5.1.55"
     },
     overrides: {
       hono: "^4.13.8",
@@ -8055,7 +8058,8 @@ var init_latest_models = __esm(() => {
     gptLunaFast: "gpt-6-luna-fast",
     glm: "glm-5.3",
     glmFlash: "glm-5.3-flash",
-    kimi: "kimi-k3",
+    kimi: "kimi-k3.1-pro",
+    kimiK3: "kimi-k3",
     geminiPro: "gemini-4-argon"
   };
 });
@@ -9378,9 +9382,13 @@ var init_agent_model_requirements = __esm(() => {
           variant: "max"
         },
         {
-          providers: ["opencode-go", "kimi-for-coding", "moonshotai", "opencode", "bailian-coding-plan", "moonshotai-cn", "firmware", "ollama-cloud", "aihubmix"],
+          providers: ["opencode-go", "kimi-for-coding", "moonshotai", "moonshotai-cn"],
           model: LATEST_MODEL_BY_FAMILY.kimi
         },
+        {
+          providers: ["opencode", "bailian-coding-plan", "firmware", "ollama-cloud", "aihubmix"],
+          model: LATEST_MODEL_BY_FAMILY.kimiK3
+        },
         {
           providers: ["openai", "chatgpt-subscription", "github-copilot", "opencode"],
           model: "gpt-5.6-sol",
@@ -9475,10 +9483,11 @@ var init_agent_model_requirements = __esm(() => {
           variant: "max"
         },
         {
-          providers: ["opencode-go", "kimi-for-coding", "moonshotai", "opencode"],
+          providers: ["opencode-go", "kimi-for-coding", "moonshotai"],
           model: LATEST_MODEL_BY_FAMILY.kimi,
           variant: "max"
-        }
+        },
+        { providers: ["opencode"], model: LATEST_MODEL_BY_FAMILY.kimiK3, variant: "max" }
       ])
     },
     metis: {
@@ -9499,10 +9508,11 @@ var init_agent_model_requirements = __esm(() => {
           variant: "max"
         },
         {
-          providers: ["opencode-go", "kimi-for-coding", "moonshotai", "opencode"],
+          providers: ["opencode-go", "kimi-for-coding", "moonshotai"],
           model: LATEST_MODEL_BY_FAMILY.kimi,
           variant: "max"
-        }
+        },
+        { providers: ["opencode"], model: LATEST_MODEL_BY_FAMILY.kimiK3, variant: "max" }
       ])
     },
     momus: {
@@ -9585,10 +9595,11 @@ var init_category_model_requirements = __esm(() => {
           variant: "max"
         },
         {
-          providers: ["kimi-for-coding", "moonshotai", "opencode-go", "opencode"],
+          providers: ["kimi-for-coding", "moonshotai", "opencode-go"],
           model: LATEST_MODEL_BY_FAMILY.kimi,
           variant: "max"
-        }
+        },
+        { providers: ["opencode"], model: LATEST_MODEL_BY_FAMILY.kimiK3, variant: "max" }
       ])
     },
     ultrabrain: {
@@ -9640,10 +9651,11 @@ var init_category_model_requirements = __esm(() => {
           variant: "max"
         },
         {
-          providers: ["kimi-for-coding", "moonshotai", "opencode-go", "opencode"],
+          providers: ["kimi-for-coding", "moonshotai", "opencode-go"],
           model: LATEST_MODEL_BY_FAMILY.kimi,
           variant: "max"
-        }
+        },
+        { providers: ["opencode"], model: LATEST_MODEL_BY_FAMILY.kimiK3, variant: "max" }
       ])
     },
     quick: {
@@ -9706,10 +9718,11 @@ var init_category_model_requirements = __esm(() => {
         },
         { providers: ["zai-coding-plan", "opencode-go"], model: LATEST_MODEL_BY_FAMILY.glm, variant: "max" },
         {
-          providers: ["kimi-for-coding", "moonshotai", "opencode-go", "opencode"],
+          providers: ["kimi-for-coding", "moonshotai", "opencode-go"],
           model: LATEST_MODEL_BY_FAMILY.kimi,
           variant: "max"
-        }
+        },
+        { providers: ["opencode"], model: LATEST_MODEL_BY_FAMILY.kimiK3, variant: "max" }
       ]
     },
     writing: {
@@ -10273,7 +10286,7 @@ function transformModelForProviderDisplay(provider, model) {
 var CLAUDE_VERSION_DOT, GEMINI_31_PRO_PREVIEW, GEMINI_3_FLASH_PREVIEW;
 var init_provider_model_id_transform = __esm(() => {
   CLAUDE_VERSION_DOT = /claude-(\w+)-(\d+)-(\d+)/g;
-  GEMINI_31_PRO_PREVIEW = /gemini-3\.1-pro(?!-)/g;
+  GEMINI_31_PRO_PREVIEW = /(?<!antigravity-)gemini-3\.1-pro(?!-)/g;
   GEMINI_3_FLASH_PREVIEW = /(?<!antigravity-)gemini-3-flash(?!-)/g;
 });
 
@@ -10347,6 +10360,36 @@ var init_supplemental_entries = __esm(() => {
         output: 262144
       }
     },
+    "kimi-k3.1-pro": {
+      id: "kimi-k3.1-pro",
+      family: "kimi",
+      reasoning: true,
+      temperature: true,
+      toolCall: true,
+      modalities: {
+        input: ["text", "image", "video"],
+        output: ["text"]
+      },
+      limit: {
+        context: 1048576,
+        output: 1048576
+      }
+    },
+    "kimi-k3.1-pro-highspeed": {
+      id: "kimi-k3.1-pro-highspeed",
+      family: "kimi",
+      reasoning: true,
+      temperature: true,
+      toolCall: true,
+      modalities: {
+        input: ["text", "image", "video"],
+        output: ["text"]
+      },
+      limit: {
+        context: 1048576,
+        output: 1048576
+      }
+    },
     "kimi-k2.6": {
       id: "kimi-k2.6",
       family: "kimi",
@@ -12431,6 +12474,33 @@ function createJsonFileCacheStore(options) {
       });
     }
   }
+  function writeIfChanged(value) {
+    ensureCacheDir();
+    const cacheFile = getCacheFilePath();
+    const serialized = options.serialize?.(value) ?? JSON.stringify(value, null, 2);
+    try {
+      const existing = existsSync10(cacheFile) ? readFileSync3(cacheFile, "utf-8") : undefined;
+      const unchanged = existing !== undefined && (existing === serialized || options.comparable !== undefined && JSON.stringify(options.comparable(JSON.parse(existing))) === JSON.stringify(options.comparable(value)));
+      if (unchanged) {
+        memoryValue = value;
+        writtenInCurrentProcess = true;
+        log2(`[${options.logPrefix}] ${options.cacheLabel} unchanged; skipped write`, options.describe(value));
+        return false;
+      }
+    } catch {}
+    try {
+      writeFileSync4(cacheFile, serialized);
+      memoryValue = value;
+      writtenInCurrentProcess = true;
+      log2(`[${options.logPrefix}] ${options.cacheLabel} written`, options.describe(value));
+      return true;
+    } catch (error) {
+      log2(`[${options.logPrefix}] Error writing ${toLogLabel(options.cacheLabel)}`, {
+        error: String(error)
+      });
+      return false;
+    }
+  }
   function resetMemory() {
     memoryValue = undefined;
     writtenInCurrentProcess = false;
@@ -12439,6 +12509,7 @@ function createJsonFileCacheStore(options) {
     read,
     has,
     write,
+    writeIfChanged,
     resetMemory
   };
 }
@@ -67503,7 +67574,8 @@ function createModelCapabilitiesCacheStore(getCacheDir = getOmoOpenCodeCacheDir)
       generatedAt: snapshot.generatedAt
     }),
     serialize: (snapshot) => `${JSON.stringify(snapshot, null, 2)}
-`
+`,
+    comparable: ({ generatedAt: _generatedAt, ...catalog }) => catalog
   });
   function readModelCapabilitiesCache() {
     return snapshotCacheStore.read();
@@ -67516,7 +67588,7 @@ function createModelCapabilitiesCacheStore(getCacheDir = getOmoOpenCodeCacheDir)
   }
   async function refreshModelCapabilitiesCache(args = {}) {
     const snapshot = await fetchModelCapabilitiesSnapshot(args);
-    writeModelCapabilitiesCache(snapshot);
+    snapshotCacheStore.writeIfChanged(snapshot);
     return snapshot;
   }
   return {
@@ -76883,6 +76955,7 @@ var init_agent = __esm(() => {
     prompt: string2().optional(),
     model: string2().optional(),
     models: array(OmoAgentModelEntrySchema).optional(),
+    models_distribution: _enum(["sequential", "round_robin"]).optional(),
     reasoning: OmoReasoningSchema.optional(),
     variant: string2().optional(),
     reasoningEffort: OmoReasoningEffortSchema.optional(),
@@ -76915,6 +76988,7 @@ var init_category = __esm(() => {
     description: string2().optional(),
     model: string2().optional(),
     models: array(union([string2(), OmoFallbackModelObjectSchema])).optional(),
+    models_distribution: _enum(["sequential", "round_robin"]).optional(),
     reasoning: OmoReasoningSchema.optional(),
     temperature: number2().min(0).max(2).optional(),
     top_p: number2().min(0).max(1).optional(),
@@ -77153,8 +77227,8 @@ var init_memory = __esm(() => {
     enabled: boolean2().optional()
   }).strict();
   OmoMemoryProjectionSchema = object({
-    max_entries_per_directory: number2().int().min(0).default(40),
-    max_bytes: number2().int().min(0).default(24576)
+    max_entries_per_directory: number2().int().min(0).default(0),
+    max_bytes: number2().int().min(0).default(40960)
   }).strict();
   OmoMemoryProjectionLayerSchema = object({
     max_entries_per_directory: number2().int().min(0).optional(),
@@ -77218,7 +77292,7 @@ var init_memory = __esm(() => {
       query_expansion: false
     }),
     project_scope: OmoMemoryProjectScopeSchema.default({ nudge: true, recall: true }),
-    projection: OmoMemoryProjectionSchema.default({ max_entries_per_directory: 40, max_bytes: 24576 }),
+    projection: OmoMemoryProjectionSchema.default({ max_entries_per_directory: 0, max_bytes: 40960 }),
     compile_warn_tokens: number2().int().positive().default(30000),
     agents: record(string2(), OmoMemoryAgentOverridesSchema).default({})
   }).strict();
@@ -77266,6 +77340,21 @@ var init_model_catalog = __esm(() => {
   OmoModelCatalogLayerSchema = record(string2(), OmoModelCatalogEntryLayerSchema);
 });
 
+// packages/omo-config-core/src/schema/model-pad.ts
+var OmoModelPadLabelsSchema, OmoModelPadSchema;
+var init_model_pad = __esm(() => {
+  init_zod();
+  OmoModelPadLabelsSchema = object({
+    daily: string2().optional(),
+    geeky: string2().optional(),
+    normal: string2().optional(),
+    heavy: string2().optional()
+  }).strict();
+  OmoModelPadSchema = object({
+    labels: OmoModelPadLabelsSchema.optional()
+  }).strict();
+});
+
 // packages/omo-config-core/src/schema/model-profile.ts
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -77586,6 +77675,7 @@ var init_config = __esm(() => {
   init_git_master();
   init_memory();
   init_model_catalog();
+  init_model_pad();
   init_model_profile();
   init_side_panel();
   init_task();
@@ -77607,6 +77697,7 @@ var init_config = __esm(() => {
     models: OmoModelCatalogLayerSchema.optional(),
     model_profiles: OmoModelProfilesLayerSchema.optional(),
     model_profile: string2().optional(),
+    model_pad: OmoModelPadSchema.optional(),
     memory: OmoMemorySettingsLayerSchema.optional(),
     telemetry: OmoTelemetrySettingsLayerSchema.optional(),
     side_panel: OmoSidePanelSettingsLayerSchema.optional(),
@@ -77625,6 +77716,7 @@ var init_config = __esm(() => {
     models: OmoModelCatalogLayerSchema.optional(),
     model_profiles: OmoModelProfilesLayerSchema.optional(),
     model_profile: string2().optional(),
+    model_pad: OmoModelPadSchema.optional(),
     memory: OmoMemorySettingsLayerSchema.optional(),
     telemetry: OmoTelemetrySettingsLayerSchema.optional(),
     side_panel: OmoSidePanelSettingsLayerSchema.optional(),
@@ -77648,6 +77740,7 @@ var init_config = __esm(() => {
     models: OmoModelCatalogSchema.optional(),
     model_profiles: OmoModelProfilesSchema.optional(),
     model_profile: string2().optional(),
+    model_pad: OmoModelPadSchema.optional(),
     memory: OmoMemorySettingsSchema.optional(),
     telemetry: OmoTelemetrySettingsSchema.optional(),
     side_panel: OmoSidePanelSettingsSchema.optional(),
@@ -77674,6 +77767,7 @@ var init_config = __esm(() => {
     models: OmoModelCatalogLayerSchema.optional(),
     model_profiles: OmoModelProfilesLayerSchema.optional(),
     model_profile: string2().optional(),
+    model_pad: OmoModelPadSchema.optional(),
     memory: OmoMemorySettingsLayerSchema.optional(),
     telemetry: OmoTelemetrySettingsLayerSchema.optional(),
     side_panel: OmoSidePanelSettingsLayerSchema.optional(),
@@ -77819,6 +77913,7 @@ var init_schema = __esm(() => {
   init_legacy_harness_names();
   init_memory();
   init_model_catalog();
+  init_model_pad();
   init_model_profile();
   init_model_ref();
   init_provenance();
@@ -78737,9 +78832,13 @@ function resolveModelReferences(view) {
 }
 var init_model_reference_resolution = () => {};
 
+// packages/omo-config-core/src/models/models-distribution.ts
+var init_models_distribution = () => {};
+
 // packages/omo-config-core/src/models/index.ts
 var init_models = __esm(() => {
   init_model_reference_resolution();
+  init_models_distribution();
 });
 
 // packages/omo-config-core/src/writer/types.ts
@@ -82839,6 +82938,37 @@ function getDefaultTelemetryOsProvider() {
 }
 var init_machine_id = () => {};
 
+// packages/telemetry-core/src/terminal-program.ts
+function isKnownTerminalProgram(value) {
+  return KNOWN_TERMINAL_PROGRAMS.some((known) => known === value);
+}
+function toTelemetryTerminalProgram(termProgram) {
+  if (termProgram === undefined || termProgram === "")
+    return;
+  return isKnownTerminalProgram(termProgram) ? termProgram : "other";
+}
+var KNOWN_TERMINAL_PROGRAMS;
+var init_terminal_program = __esm(() => {
+  KNOWN_TERMINAL_PROGRAMS = [
+    "Apple_Terminal",
+    "iTerm.app",
+    "vscode",
+    "cursor",
+    "windsurf",
+    "zed",
+    "WezTerm",
+    "ghostty",
+    "tmux",
+    "Hyper",
+    "WarpTerminal",
+    "kitty",
+    "alacritty",
+    "Tabby",
+    "rio",
+    "mintty"
+  ];
+});
+
 // packages/telemetry-core/src/injected-client.ts
 function isTelemetryClientEnabled(input) {
   const env = input.env ?? process.env;
@@ -82941,12 +83071,16 @@ function getSharedProperties(input) {
     total_memory_gb: Math.round(osProvider.totalmem() / 1024 / 1024 / 1024),
     locale: Intl.DateTimeFormat().resolvedOptions().locale,
     timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
-    shell: process.env.SHELL,
+    shell: getShellName(process.env.SHELL),
     ci: Boolean(process.env.CI),
-    terminal: process.env.TERM_PROGRAM,
+    terminal: toTelemetryTerminalProgram(process.env.TERM_PROGRAM),
     ...input.product.additionalProperties
   };
 }
+function getShellName(shellPath) {
+  const name = shellPath?.split(/[\\/]/).pop()?.replace(/\.exe$/i, "");
+  return name ? name : undefined;
+}
 function getSafeCpuInfo(osProvider, input) {
   try {
     const cpuInfo = osProvider.cpus();
@@ -82971,6 +83105,7 @@ var NO_OP_CLIENT;
 var init_injected_client = __esm(() => {
   init_env();
   init_machine_id();
+  init_terminal_program();
   NO_OP_CLIENT = {
     enabled: false,
     trackActive: () => {
@@ -92550,7 +92685,7 @@ var package_default2;
 var init_package2 = __esm(() => {
   package_default2 = {
     name: "@oh-my-opencode/omo-codex",
-    version: "5.1.51",
+    version: "5.1.55",
     type: "module",
     private: true,
     description: "Codex harness adapter for oh-my-openagent. Vendored Codex plugin namespace (omo) + TypeScript installer + telemetry.",
@@ -93758,11 +93893,22 @@ init_commander();
 // packages/omo-opencode/src/cli/install.ts
 init_package();
 
+// packages/omo-opencode/src/cli/cli-installer.ts
+import { createInterface as createInterface2 } from "readline/promises";
+
+// packages/telemetry-core/src/install-disclosure.ts
+var TELEMETRY_PRIVACY_POLICY_URL = "https://github.com/code-yeongyu/oh-my-openagent/blob/dev/docs/legal/privacy-policy.md";
+var TELEMETRY_INSTALL_DISCLOSURE_LINES = [
+  "OmO sends anonymous usage telemetry (no prompts, code, file paths, or account data) to improve the product.",
+  "The data goes to PostHog in the United States.",
+  "Turn it off with DO_NOT_TRACK=1 (or OMO_DISABLE_TELEMETRY=1).",
+  `Details: ${TELEMETRY_PRIVACY_POLICY_URL}`
+];
+
 // packages/omo-opencode/src/cli/cli-installer.ts
 init_shared();
 init_config_manager();
 var import_picocolors3 = __toESM(require_picocolors(), 1);
-import { createInterface as createInterface2 } from "readline/promises";
 
 // packages/omo-opencode/src/cli/install-validators.ts
 var import_picocolors = __toESM(require_picocolors(), 1);
@@ -99923,6 +100069,7 @@ var REQUIRED_PLUGIN_ARTIFACTS = [
   join66("extensions", "omo-thread-client.js"),
   join66("extensions", "omo-telemetry-recovery.js"),
   join66("extensions", "omo-feedback.js"),
+  join66("extensions", "omo-desktop-toolkit.js"),
   join66("extensions", "omo-claim-receipt.js"),
   join66("extensions", "assets.generated.json"),
   join66("extensions", "omo-member.js"),
@@ -101201,8 +101348,8 @@ async function runCliInstaller(args, version) {
     }
     console.log();
   }
-  printInfo("Anonymous telemetry is enabled by default. Disable it with OMO_SEND_ANONYMOUS_TELEMETRY=0 or OMO_DISABLE_POSTHOG=1.");
-  printInfo("Docs: docs/legal/privacy-policy.md and docs/legal/terms-of-service.md");
+  for (const line of TELEMETRY_INSTALL_DISCLOSURE_LINES)
+    printInfo(line);
   console.log();
   printBox(`${import_picocolors3.default.bold("Pro Tip:")} Include ${import_picocolors3.default.cyan("ultrawork")} (or ${import_picocolors3.default.cyan("ulw")}) in your prompt.
 ` + `All features work like magic-parallel agents, background tasks,
@@ -102498,7 +102645,7 @@ async function promptInstallConfig(detected, platform, codexAutonomousOverride)
     message: "Do you have a Kimi For Coding subscription?",
     options: [
       { value: "no", label: "No", hint: "Will use other configured providers" },
-      { value: "yes", label: "Yes", hint: "Kimi K3 for Sisyphus/Prometheus fallback" }
+      { value: "yes", label: "Yes", hint: "Kimi K3.1 Pro for Sisyphus/Prometheus fallback" }
     ],
     initialValue: initial.kimiForCoding
   });
@@ -102757,8 +102904,8 @@ async function runTuiInstaller(args, version) {
   if (config.hasOpenCode) {
     log4.message(`Run ${import_picocolors4.default.cyan("opencode")} to start!`);
   }
-  log4.info("Anonymous telemetry is enabled by default. Disable it with OMO_SEND_ANONYMOUS_TELEMETRY=0 or OMO_DISABLE_POSTHOG=1.");
-  log4.info("Docs: docs/legal/privacy-policy.md and docs/legal/terms-of-service.md");
+  log4.info(TELEMETRY_INSTALL_DISCLOSURE_LINES.join(`
+`));
   note(`Include ${import_picocolors4.default.cyan("ultrawork")} (or ${import_picocolors4.default.cyan("ulw")}) in your prompt.
 ` + `All features work like magic-parallel agents, background tasks,
 ` + `deep exploration, and relentless execution until completion.`, "The Magic Word");
@@ -103991,11 +104138,11 @@ function recordFields(value, fields) {
 }
 function modelInput(view) {
   const agents = isPlainRecord(view.agents) ? Object.fromEntries(Object.entries(view.agents).flatMap(([name, definition]) => {
-    const fields = recordFields(definition, ["description", "prompt", "model", "models", "variant", "reasoningEffort", "tools", "temperature", "disable"]);
+    const fields = recordFields(definition, ["description", "prompt", "model", "models", "models_distribution", "variant", "reasoningEffort", "tools", "temperature", "disable"]);
     return fields === undefined ? [] : [[name, fields]];
   })) : undefined;
   const categories = isPlainRecord(view.categories) ? Object.fromEntries(Object.entries(view.categories).flatMap(([name, definition]) => {
-    const fields = recordFields(definition, ["description", "model", "fallback_models", "variant", "temperature", "top_p", "maxTokens", "thinking", "reasoningEffort", "textVerbosity", "tools", "prompt_append", "max_prompt_tokens", "is_unstable_agent", "disable"]);
+    const fields = recordFields(definition, ["description", "model", "models", "models_distribution", "fallback_models", "variant", "temperature", "top_p", "maxTokens", "thinking", "reasoningEffort", "textVerbosity", "tools", "prompt_append", "max_prompt_tokens", "is_unstable_agent", "disable"]);
     return fields === undefined ? [] : [[name, fields]];
   })) : undefined;
   return {
@@ -104269,6 +104416,7 @@ var AgentPermissionSchema = object({
 var AgentOverrideConfigSchema = object({
   model: string2().optional(),
   models: array(union([string2(), FallbackModelObjectSchema])).optional(),
+  models_distribution: _enum(["sequential", "round_robin"]).optional(),
   fallback_models: FallbackModelsSchema.optional(),
   reasoning: OmoReasoningSchema.optional(),
   variant: string2().optional(),
@@ -104369,6 +104517,7 @@ var CategoryConfigSchema = object({
   description: string2().optional(),
   model: string2().optional(),
   models: array(union([string2(), FallbackModelObjectSchema])).optional(),
+  models_distribution: _enum(["sequential", "round_robin"]).optional(),
   fallback_models: FallbackModelsSchema.optional(),
   reasoning: OmoReasoningSchema.optional(),
   variant: string2().optional(),
@@ -104932,7 +105081,8 @@ function materializeAgentModelChains(config) {
     return [name, {
       ...rest,
       ...primarySettings,
-      fallback_models: fallbacks
+      fallback_models: fallbacks,
+      ...agent.models_distribution === "round_robin" ? { models: agent.models } : {}
     }];
   }));
   return changed ? { ...config, agents } : config;
@@ -109295,6 +109445,8 @@ var package_default3 = {
   },
   dependencies: {
     "@clack/prompts": "^1.8.1",
+    "@code-yeongyu/senpi": "2026.10.30-1",
+    "@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.30-1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@oh-my-opencode/agents-md-core": "workspace:*",
     "@oh-my-opencode/boulder-state": "workspace:*",
@@ -110603,6 +110755,8 @@ function isOAuthTokenData(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return false;
   const record = value;
+  if (record["issuer"] !== undefined && typeof record["issuer"] !== "string")
+    return false;
   if (typeof record["accessToken"] !== "string")
     return false;
   const refreshToken = record["refreshToken"];
@@ -110617,6 +110771,8 @@ function isOAuthTokenData(value) {
   if (typeof clientInfo !== "object" || clientInfo === null || Array.isArray(clientInfo))
     return false;
   const clientRecord = clientInfo;
+  if (clientRecord["issuer"] !== undefined && typeof clientRecord["issuer"] !== "string")
+    return false;
   if (typeof clientRecord["clientId"] !== "string")
     return false;
   const clientSecret = clientRecord["clientSecret"];
@@ -110685,7 +110841,9 @@ function deleteToken(serverHost, resource) {
     return deleteLegacyToken(serverHost, resource);
   try {
     unlinkSync9(filePath);
-    return deleteTokenIndexEntry(getMcpOauthStorageDir(), getMcpOauthServerHash(serverHost, resource));
+    const indexDeleted = deleteTokenIndexEntry(getMcpOauthStorageDir(), getMcpOauthServerHash(serverHost, resource));
+    const legacyDeleted = deleteLegacyToken(serverHost, resource);
+    return indexDeleted && legacyDeleted;
   } catch (deleteError) {
     if (!(deleteError instanceof Error))
       throw deleteError;
@@ -110795,19 +110953,26 @@ async function fetchMetadata(url) {
   }
   return { ok: true, json };
 }
-function parseMetadataFields(json, resource) {
+function parseMetadataFields(json, resource, expectedIssuer) {
+  const issuer = readStringField(json, "issuer");
+  parseHttpsUrl(issuer, "issuer");
+  if (issuer !== expectedIssuer) {
+    throw new Error("OAuth metadata issuer mismatch");
+  }
   const authorizationEndpoint = parseHttpsUrl(readStringField(json, "authorization_endpoint"), "authorization_endpoint").toString();
   const tokenEndpoint = parseHttpsUrl(readStringField(json, "token_endpoint"), "token_endpoint").toString();
   const registrationEndpointValue = json.registration_endpoint;
   const registrationEndpoint = typeof registrationEndpointValue === "string" && registrationEndpointValue.length > 0 ? parseHttpsUrl(registrationEndpointValue, "registration_endpoint").toString() : undefined;
   return {
+    issuer,
+    ...json.authorization_response_iss_parameter_supported === true ? { authorizationResponseIssParameterSupported: true } : {},
     authorizationEndpoint,
     tokenEndpoint,
     registrationEndpoint,
     resource
   };
 }
-async function fetchAuthorizationServerMetadata(issuer, resource) {
+async function fetchAuthorizationServerMetadata(issuer, resource, allowOriginFallback = false) {
   const issuerUrl = parseHttpsUrl(issuer, "Authorization server URL");
   const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
   const metadataUrl = new URL(`/.well-known/oauth-authorization-server${issuerPath}`, issuerUrl).toString();
@@ -110817,7 +110982,7 @@ async function fetchAuthorizationServerMetadata(issuer, resource) {
       const rootMetadataUrl = new URL("/.well-known/oauth-authorization-server", issuerUrl).toString();
       const rootMetadata = await fetchMetadata(rootMetadataUrl);
       if (rootMetadata.ok) {
-        return parseMetadataFields(rootMetadata.json, resource);
+        return parseMetadataFields(rootMetadata.json, resource, allowOriginFallback ? issuerUrl.origin : issuer);
       }
     }
     if (metadata.status === 404) {
@@ -110825,7 +110990,7 @@ async function fetchAuthorizationServerMetadata(issuer, resource) {
     }
     throw new Error(`OAuth authorization server metadata fetch failed (${metadata.status})`);
   }
-  return parseMetadataFields(metadata.json, resource);
+  return parseMetadataFields(metadata.json, resource, issuer);
 }
 function parseAuthorizationServers(metadata) {
   const servers = metadata.authorization_servers;
@@ -110833,11 +110998,11 @@ function parseAuthorizationServers(metadata) {
     return [];
   return servers.filter((server) => typeof server === "string" && server.length > 0);
 }
-async function discoverOAuthServerMetadata(resource) {
+async function discoverOAuthServerMetadata(resource, forceRefresh = false) {
   const resourceUrl = parseHttpsUrl(resource, "Resource server URL");
   const resourceKey = resourceUrl.toString();
   const cached = discoveryCache.get(resourceKey);
-  if (cached)
+  if (cached && !forceRefresh)
     return cached;
   const pending = pendingDiscovery.get(resourceKey);
   if (pending)
@@ -110855,7 +111020,7 @@ async function discoverOAuthServerMetadata(resource) {
     if (prmResponse.status !== 404) {
       throw new Error(`OAuth protected resource metadata fetch failed (${prmResponse.status})`);
     }
-    return fetchAuthorizationServerMetadata(resourceKey, resource);
+    return fetchAuthorizationServerMetadata(resource.replace(/\/+$/, ""), resource, true);
   })();
   pendingDiscovery.set(resourceKey, discoveryPromise);
   try {
@@ -110879,6 +111044,10 @@ async function getOrRegisterClient(options) {
   }
   const fetchImpl = options.fetch ?? globalThis.fetch;
   const request = {
+    application_type: options.redirectUris.some((uri) => {
+      const url = new URL(uri);
+      return (url.protocol === "http:" || url.protocol === "https:") && !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+    }) ? "web" : "native",
     redirect_uris: options.redirectUris,
     client_name: options.clientName,
     grant_types: ["authorization_code", "refresh_token"],
@@ -110955,12 +111124,20 @@ function buildAuthorizationUrl(authorizationEndpoint, options) {
   return url.toString();
 }
 var CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
-function startCallbackServer(port) {
+function startCallbackServer(port, validation) {
   return new Promise((resolve, reject) => {
     let timeoutId;
     const server = createServer2((request, response) => {
       clearTimeout(timeoutId);
       const requestUrl = new URL(request.url ?? "/", `http://localhost:${port}`);
+      const issuer = requestUrl.searchParams.get("iss");
+      if (validation && (issuer !== null && issuer !== validation.issuer || issuer === null && validation.authorizationResponseIssParameterSupported)) {
+        response.writeHead(400, { "content-type": "text/html" });
+        response.end("<html><body><h1>Authorization failed</h1></body></html>");
+        server.close();
+        reject(new Error("OAuth authorization response issuer mismatch or missing issuer"));
+        return;
+      }
       const code = requestUrl.searchParams.get("code");
       const state = requestUrl.searchParams.get("state");
       const error = requestUrl.searchParams.get("error");
@@ -111030,7 +111207,7 @@ async function runAuthorizationCodeRedirect(options) {
     scopes: options.scopes,
     resource: options.resource
   });
-  const callbackPromise = startCallbackServer(options.callbackPort);
+  const callbackPromise = startCallbackServer(options.callbackPort, options);
   openBrowser(authorizationUrl);
   const result = await callbackPromise;
   if (result.state !== state) {
@@ -111065,10 +111242,12 @@ function buildOAuthTokenData(tokenData, clientInfo, fallbackRefreshToken) {
     throw new Error("Token response missing access_token");
   }
   return {
+    ...clientInfo.issuer ? { issuer: clientInfo.issuer } : {},
     accessToken,
     refreshToken: typeof tokenData["refresh_token"] === "string" ? tokenData["refresh_token"] : fallbackRefreshToken,
     expiresAt: typeof tokenData["expires_in"] === "number" ? Math.floor(Date.now() / 1000) + tokenData["expires_in"] : undefined,
     clientInfo: {
+      ...clientInfo.issuer ? { issuer: clientInfo.issuer } : {},
       clientId: clientInfo.clientId,
       ...clientInfo.clientSecret ? { clientSecret: clientInfo.clientSecret } : {}
     }
@@ -111082,6 +111261,7 @@ class McpOAuthProvider {
   storedCodeVerifier = null;
   storedClientInfo = null;
   callbackPort = null;
+  issuer;
   constructor(options) {
     this.serverUrl = options.serverUrl;
     this.configClientId = options.clientId;
@@ -111091,7 +111271,32 @@ class McpOAuthProvider {
     return loadToken(this.serverUrl, this.serverUrl);
   }
   saveTokens(tokenData) {
-    return saveToken(this.serverUrl, this.serverUrl, tokenData);
+    const issuer = tokenData.issuer ?? this.issuer;
+    return saveToken(this.serverUrl, this.serverUrl, issuer ? {
+      ...tokenData,
+      issuer,
+      ...tokenData.clientInfo ? { clientInfo: { ...tokenData.clientInfo, issuer: tokenData.clientInfo.issuer ?? issuer } } : {}
+    } : tokenData);
+  }
+  bindIssuer(issuer) {
+    const token = this.tokens();
+    const stamps = [token?.issuer, token?.clientInfo?.issuer, this.storedClientInfo?.issuer, this.issuer];
+    const changed = stamps.some((stamp) => stamp !== undefined && stamp !== issuer);
+    if (changed) {
+      this.storedClientInfo = null;
+      this.storedCodeVerifier = null;
+      if (!deleteToken(this.serverUrl, this.serverUrl)) {
+        throw new Error("Unable to discard credentials for the previous OAuth issuer");
+      }
+    }
+    this.issuer = issuer;
+    if (!changed && token && !this.saveTokens(token)) {
+      throw new Error("Unable to stamp stored OAuth credentials with their issuer");
+    }
+    const clientInfo = this.clientInformation();
+    if (clientInfo)
+      this.storedClientInfo = { ...clientInfo, issuer };
+    return changed;
   }
   clientInformation() {
     if (this.storedClientInfo)
@@ -111121,6 +111326,8 @@ class McpOAuthProvider {
       this.callbackPort = await findAvailablePort2();
     }
     const result = await runAuthorizationCodeRedirect({
+      issuer: metadata.issuer,
+      authorizationResponseIssParameterSupported: metadata.authorizationResponseIssParameterSupported,
       authorizationEndpoint: metadata.authorizationEndpoint,
       callbackPort: this.callbackPort,
       clientId: clientInfo.clientId,
@@ -111132,16 +111339,19 @@ class McpOAuthProvider {
     return { code: result.code };
   }
   async login() {
-    const metadata = await discoverOAuthServerMetadata(this.serverUrl);
+    const metadata = await discoverOAuthServerMetadata(this.serverUrl, true);
+    this.bindIssuer(metadata.issuer);
+    if (this.callbackPort === null)
+      this.callbackPort = await findAvailablePort2();
     const clientRegistrationStorage = {
       getClientRegistration: () => this.storedClientInfo,
       setClientRegistration: (_serverIdentifier, credentials) => {
-        this.storedClientInfo = credentials;
+        this.storedClientInfo = { ...credentials, issuer: metadata.issuer };
       }
     };
     const clientInfo = await getOrRegisterClient({
       ...metadata.registrationEndpoint ? { registrationEndpoint: metadata.registrationEndpoint } : {},
-      serverIdentifier: this.serverUrl,
+      serverIdentifier: metadata.issuer,
       clientName: PLUGIN_NAME4,
       redirectUris: [this.redirectUrl()],
       tokenEndpointAuthMethod: "none",
@@ -111151,7 +111361,7 @@ class McpOAuthProvider {
     if (!clientInfo) {
       throw new Error("Failed to obtain client credentials. Provide a clientId or ensure the server supports DCR.");
     }
-    this.storedClientInfo = clientInfo;
+    this.storedClientInfo = { ...clientInfo, issuer: metadata.issuer };
     const { code } = await this.redirectToAuthorization(metadata);
     const verifier = this.codeVerifier();
     if (!verifier) {
@@ -111170,12 +111380,14 @@ class McpOAuthProvider {
       }).toString()
     });
     const tokenData = await parseTokenResponse(tokenResponse);
-    const oauthTokenData = buildOAuthTokenData(tokenData, clientInfo);
+    const oauthTokenData = buildOAuthTokenData(tokenData, { ...clientInfo, issuer: metadata.issuer });
     this.saveTokens(oauthTokenData);
     return oauthTokenData;
   }
   async refresh(refreshToken) {
-    const metadata = await discoverOAuthServerMetadata(this.serverUrl);
+    const metadata = await discoverOAuthServerMetadata(this.serverUrl, true);
+    if (this.bindIssuer(metadata.issuer))
+      return this.login();
     const clientInfo = this.clientInformation();
     const clientId = clientInfo?.clientId ?? this.configClientId;
     if (!clientId) {
@@ -111195,6 +111407,7 @@ class McpOAuthProvider {
     const tokenData = await parseTokenResponse(tokenResponse);
     const oauthTokenData = buildOAuthTokenData(tokenData, {
       clientId,
+      issuer: metadata.issuer,
       ...clientInfo?.clientSecret ? { clientSecret: clientInfo.clientSecret } : {}
     }, refreshToken);
     this.saveTokens(oauthTokenData);
@@ -112042,6 +112255,17 @@ import { hostname } from "os";
 // packages/omo-opencode/src/cli/service-auth/protocol.ts
 init_zod();
 
+// packages/omo-opencode/src/cli/service-auth/credential-owner.ts
+init_zod();
+var identity = string2().regex(/^[A-Za-z0-9_-]{1,128}$/);
+var credentialOwnerSchema = object({
+  accountId: identity,
+  deviceId: identity,
+  familyId: identity,
+  generation: number2().int().positive().safe(),
+  ownerHandle: string2().regex(/^[\x21-\x7e]{1,4096}$/)
+});
+
 // packages/omo-opencode/src/cli/service-auth/terminal-text.ts
 import { stripVTControlCharacters as stripVTControlCharacters4 } from "util";
 function terminalText(value) {
@@ -112060,9 +112284,19 @@ class SignInError extends Error {
 
 class RequestFailure extends SignInError {
   notSent;
-  constructor(notSent) {
+  responseStatus;
+  constructor(notSent, responseStatus) {
     super("Unable to complete the service request. Check the connection and retry.", true);
     this.notSent = notSent;
+    this.responseStatus = responseStatus;
+  }
+}
+
+class InvalidApiResponse extends SignInError {
+  status;
+  constructor(status) {
+    super("The service returned an invalid error response.");
+    this.status = status;
   }
 }
 var platformSchema = _enum(["macos", "linux", "windows"]);
@@ -112075,12 +112309,18 @@ var tokenSchema = object({
 });
 var grantSchema = tokenSchema.extend({
   device: object({ id: nonempty, name: nonempty }),
-  offlineGrant: nonempty.optional()
+  offlineGrant: nonempty.optional(),
+  owner: credentialOwnerSchema.optional(),
+  writerFloor: union([literal(1), literal(2)]).optional(),
+  freshAuthorizationProof: nonempty.optional()
 });
 var credentialSchema = grantSchema.extend({
   signingPrivateKey: nonempty,
   sealingPrivateKey: nonempty,
-  refreshState: literal("uncertain").optional()
+  refreshState: literal("uncertain").optional(),
+  credentialGeneration: nonempty.optional(),
+  accountId: nonempty.optional(),
+  refreshAttempt: unknown().optional()
 });
 var deviceCodeSchema = object({
   deviceCode: string2().regex(/^dc\.[A-Za-z0-9_-]{43}$/),
@@ -112108,6 +112348,9 @@ var limitSchema = object({
 var deviceListSchema = object({
   devices: array(object({ id: nonempty, name: nonempty, revokedAt: timestamp.nullable() }))
 });
+var currentDeviceListSchema = object({
+  devices: array(object({ id: nonempty, current: boolean2(), revokedAt: timestamp.nullable() }))
+});
 var REFUSAL_CODES = [
   "unauthorized",
   "account_deleted",
@@ -112124,7 +112367,11 @@ var REFUSAL_CODES = [
   "unavailable",
   "forbidden",
   "invalid_request",
-  "not_found"
+  "not_found",
+  "client_upgrade_required",
+  "writer_floor_mismatch",
+  "service_upgrade_required",
+  "refresh_recovery_expired"
 ];
 var isKnownRefusal = (code) => REFUSAL_CODES.includes(code);
 function refusalGuidance(code, status) {
@@ -112151,6 +112398,10 @@ function refusalGuidance(code, status) {
     case "access_denied":
     case "authorization_pending":
       return "account_refused";
+    case "client_upgrade_required":
+    case "writer_floor_mismatch":
+    case "service_upgrade_required":
+    case "refresh_recovery_expired":
     case "unknown":
       if (status === 401)
         return "sign_in_again";
@@ -112261,13 +112512,13 @@ async function requestApi(api, path, init, signal) {
   try {
     body = await response.json();
   } catch {
-    throw new RequestFailure(false);
+    throw new RequestFailure(false, response.status);
   }
   if (response.ok)
     return body;
   const envelope = envelopeSchema.safeParse(body);
   if (!envelope.success)
-    throw new SignInError("The service returned an invalid error response.");
+    throw new InvalidApiResponse(response.status);
   const error = envelope.data.error;
   const detail = limitSchema.safeParse(error.detail);
   throw new ApiRefusal(error.code, response.status, error.code === "entitlement_required" && detail.success ? detail.data : undefined, response.headers.get("retry-after"));
@@ -112371,7 +112622,7 @@ async function loginDevice(session, options) {
 }
 
 // packages/omo-opencode/src/cli/service-auth/keystore.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash12, randomUUID as randomUUID7 } from "crypto";
 import { basename as basename15 } from "path";
 
 // packages/omo-opencode/src/cli/service-auth/secret-service-lock.ts
@@ -112415,289 +112666,490 @@ var probeSecretServiceLock = () => new Promise((resolve) => {
   });
 });
 
-// packages/omo-opencode/src/cli/service-auth/keystore.ts
-class CredentialStoreError extends SignInError {
-}
+// packages/omo-opencode/src/cli/service-auth/credential-lock.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+import { createHash as createHash11 } from "crypto";
+import { mkdir as mkdir11 } from "fs/promises";
+import { homedir as homedir31 } from "os";
+import { join as join106 } from "path";
 
-class KeychainLockedError extends CredentialStoreError {
+// packages/team-core/src/team-state-store/lock-publish.ts
+import { access as access4, open as open3, unlink as unlink3 } from "fs/promises";
+import { dirname as dirname42 } from "path";
+
+// packages/team-core/src/team-state-store/lock-record.ts
+import { randomUUID as randomUUID6 } from "crypto";
+import { readFile as readFile34, stat as stat9 } from "fs/promises";
+
+// packages/memory-core/src/locks/process-identity.ts
+import { execFile as execFile7 } from "child_process";
+
+// packages/memory-core/src/fs/resilient.ts
+import * as fsSync from "fs";
+import * as fsp from "fs/promises";
+
+// packages/memory-core/src/fs/retry.ts
+var EINTR_RETRY_CAP = 128;
+function fsErrorCode(error) {
+  if (!(error instanceof Error) || !("code" in error))
+    return;
+  return typeof error.code === "string" ? error.code : undefined;
 }
-class InvalidCredentialState extends SignInError {
+async function retryOnEintr(operation) {
+  for (let attempt = 0;; attempt += 1) {
+    try {
+      return await operation();
+    } catch (error) {
+      if (fsErrorCode(error) !== "EINTR" || attempt >= EINTR_RETRY_CAP)
+        throw error;
+    }
+  }
+}
+function retryOnEintrSync(operation) {
+  for (let attempt = 0;; attempt += 1) {
+    try {
+      return operation();
+    } catch (error) {
+      if (fsErrorCode(error) !== "EINTR" || attempt >= EINTR_RETRY_CAP)
+        throw error;
+    }
+  }
 }
 
-class KeychainApprovalPendingError extends CredentialStoreError {
+// packages/memory-core/src/fs/rename-contention.ts
+var CONTENTION_CODES = new Set(["EPERM", "EBUSY", "EACCES"]);
+
+// packages/memory-core/src/fs/resilient.ts
+function isFunction2(value) {
+  return typeof value === "function";
 }
-var SESSION_READ_WAIT = { kind: "bounded", deadlineMs: 5000 };
-var INTERACTIVE_READ_WAIT = {
-  kind: "interactive",
-  noticeAfterMs: 2000,
-  notice: (message) => process.stderr.write(`${message}
-`)
-};
-var processReads = new WeakMap;
-var LOCKED = /-25308|errSecInteractionNotAllowed|interaction is not allowed|locked collection/i;
-var UNLOCKED_REUSE_MS = 30000;
-var fallbackNoticed = false;
-var stderrNoticeOncePerProcess = (message) => {
-  if (fallbackNoticed)
+function withAsyncRetry(operation) {
+  return (...args) => retryOnEintr(async () => operation(...args));
+}
+function withSyncRetry(operation) {
+  return (...args) => retryOnEintrSync(() => operation(...args));
+}
+function resilientNamespace(namespace, kind) {
+  const wrapFunction = kind === "async" ? withAsyncRetry : withSyncRetry;
+  const cache = new Map;
+  return new Proxy(namespace, {
+    get(target, property) {
+      if (cache.has(property))
+        return cache.get(property);
+      const value = Reflect.get(target, property);
+      if (!isFunction2(value))
+        return value;
+      const wrapped = wrapFunction(value);
+      const native = Reflect.get(value, "native");
+      if (isFunction2(native))
+        Object.assign(wrapped, { native: wrapFunction(native) });
+      cache.set(property, wrapped);
+      return wrapped;
+    }
+  });
+}
+var IDEMPOTENT_HANDLE_METHODS = new Set(["stat", "sync", "datasync", "chmod", "chown", "utimes", "truncate"]);
+var promises = resilientNamespace(fsp, "async");
+var sync = resilientNamespace(fsSync, "sync");
+var {
+  access: access3,
+  chmod: chmod2,
+  copyFile: copyFile4,
+  cp: cp5,
+  link,
+  lstat: lstat18,
+  mkdir: mkdir10,
+  mkdtemp: mkdtemp2,
+  readFile: readFile33,
+  readdir: readdir17,
+  readlink: readlink7,
+  realpath: realpath2,
+  rm: rm16,
+  rmdir: rmdir2,
+  stat: stat8,
+  statfs,
+  unlink: unlink2
+} = promises;
+var {
+  accessSync: accessSync5,
+  chmodSync: chmodSync7,
+  fsyncSync: fsyncSync3,
+  linkSync,
+  lstatSync: lstatSync5,
+  mkdirSync: mkdirSync19,
+  readFileSync: readFileSync44,
+  readdirSync: readdirSync14,
+  realpathSync: realpathSync13,
+  statSync: statSync8,
+  unlinkSync: unlinkSync10,
+  writeFileSync: writeFileSync17,
+  writeSync
+} = sync;
+
+// packages/memory-core/src/locks/process-start-time.ts
+var PROC_PIDTBSDINFO = 3;
+var PROC_BSDINFO_SIZE = 136;
+var START_TVSEC_OFFSET = 120;
+var procPidInfoLookup = null;
+async function openProcPidInfo() {
+  if (process.platform !== "darwin")
+    return null;
+  try {
+    const { dlopen, FFIType } = await import("bun:ffi");
+    const library = dlopen("/usr/lib/libSystem.B.dylib", {
+      proc_pidinfo: {
+        args: [FFIType.i32, FFIType.i32, FFIType.u64, FFIType.ptr, FFIType.i32],
+        returns: FFIType.i32
+      }
+    });
+    return (pid, flavor, arg, buffer, size) => Number(library.symbols.proc_pidinfo(pid, flavor, arg, buffer, size));
+  } catch {
+    return null;
+  }
+}
+function loadProcPidInfo() {
+  procPidInfoLookup ??= openProcPidInfo();
+  return procPidInfoLookup;
+}
+async function readDarwinProcessStartSeconds(pid) {
+  if (process.platform !== "darwin")
+    return null;
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    return null;
+  const procPidInfo = await loadProcPidInfo();
+  if (procPidInfo === null)
+    return null;
+  const buffer = new Uint8Array(PROC_BSDINFO_SIZE);
+  let written = 0;
+  try {
+    written = procPidInfo(pid, PROC_PIDTBSDINFO, 0n, buffer, PROC_BSDINFO_SIZE);
+  } catch {
+    return null;
+  }
+  if (written !== PROC_BSDINFO_SIZE)
+    return null;
+  const view = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+  const startSeconds = Number(view.getBigUint64(START_TVSEC_OFFSET, true));
+  return startSeconds > 0 ? startSeconds : null;
+}
+var PROCESS_QUERY_LIMITED_INFORMATION = 4096;
+var kernel32Lookup = null;
+async function openKernel32() {
+  if (process.platform !== "win32")
+    return null;
+  try {
+    const { dlopen, FFIType } = await import("bun:ffi");
+    const library = dlopen("kernel32.dll", {
+      OpenProcess: { args: [FFIType.u32, FFIType.i32, FFIType.u32], returns: FFIType.ptr },
+      GetProcessTimes: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+      CloseHandle: { args: [FFIType.ptr], returns: FFIType.i32 }
+    });
+    return library.symbols;
+  } catch {
+    return null;
+  }
+}
+async function readWin32ProcessCreationFiletime(pid) {
+  if (process.platform !== "win32")
+    return null;
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    return null;
+  kernel32Lookup ??= openKernel32();
+  const kernel32 = await kernel32Lookup;
+  if (kernel32 === null)
+    return null;
+  const handle = kernel32.OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid);
+  if (handle === null || handle === 0 || handle === 0n)
+    return null;
+  try {
+    const creation = new BigUint64Array(1);
+    const ok = kernel32.GetProcessTimes(handle, creation, new BigUint64Array(1), new BigUint64Array(1), new BigUint64Array(1));
+    const filetime = creation[0] ?? 0n;
+    return ok === 0 || filetime === 0n ? null : filetime;
+  } finally {
+    kernel32.CloseHandle(handle);
+  }
+}
+
+// packages/memory-core/src/locks/process-identity.ts
+function errorCode(error) {
+  if (!(error instanceof Error) || !("code" in error))
     return;
-  fallbackNoticed = true;
-  process.stderr.write(`${message}
-`);
-};
-var isLocked = (error) => error instanceof Error && (LOCKED.test(error.message) || LOCKED.test(String(error.code ?? "")));
-function credentialId(api) {
-  return createHash10("sha256").update(serviceOrigin(api)).digest("hex");
+  return typeof error.code === "string" ? error.code : undefined;
 }
-function createCredentialStore(api, options = {}) {
-  return createSealedStore(api, "omo-cli", credentialSchema, options.secrets, options.platform, options.lockProbe, options.notice, options.wait);
+async function execFileText(command, args) {
+  return await new Promise((resolve) => {
+    execFile7(command, args, { encoding: "utf8", timeout: 2000, windowsHide: true }, (error, stdout) => {
+      if (error !== null) {
+        resolve(null);
+        return;
+      }
+      const value = stdout.trim();
+      resolve(value.length > 0 ? value : null);
+    });
+  });
 }
-function createSealedStore(api, namespace, schema, secrets = typeof Bun === "undefined" ? null : Bun.secrets, platform = process.platform, lockProbe = probeSecretServiceLock, notice = stderrNoticeOncePerProcess, wait = SESSION_READ_WAIT) {
-  if (!secrets)
-    throw new SignInError("OmO sign-in needs Bun 1.4 or newer with OS credential storage. No file fallback is available.");
-  const platformName = platform === "darwin" ? "macOS Keychain" : platform === "linux" ? "Linux Secret Service (libsecret and an unlocked keyring)" : platform === "win32" ? "Windows Credential Manager" : null;
-  if (platformName === null)
-    throw new SignInError("This platform has no supported OS credential store.");
-  const key = { service: namespace, name: credentialId(api) };
-  const slot = `${key.service}
-${key.name}`;
-  const readsOf = (api) => {
-    const known = processReads.get(api);
-    if (known !== undefined)
-      return known;
-    const created = new Map;
-    processReads.set(api, created);
-    return created;
-  };
-  const forget = (api) => {
-    readsOf(api).delete(slot);
-  };
-  const sharedRead = (api) => {
-    const reads = readsOf(api);
-    const pending = reads.get(slot);
-    if (pending !== undefined)
-      return pending;
-    const read = Promise.resolve().then(() => api.get(key));
-    const done = () => {
-      if (reads.get(slot) === read)
-        reads.delete(slot);
-    };
-    read.then(done, done);
-    reads.set(slot, read);
-    return read;
+async function readLinuxStartIdentity(pid) {
+  try {
+    const stat = await readFile33(`/proc/${pid}/stat`, "utf8");
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd < 0)
+      return null;
+    const fieldsAfterCommand = stat.slice(commandEnd + 2).trim().split(/\s+/);
+    const startTicks = fieldsAfterCommand[19];
+    return startTicks === undefined ? null : `linux-proc-start-ticks:${startTicks}`;
+  } catch {
+    return null;
+  }
+}
+async function readWin32StartIdentity(pid) {
+  if (getPidLiveness(pid) === "dead")
+    return null;
+  const creationFiletime = await readWin32ProcessCreationFiletime(pid);
+  if (creationFiletime !== null)
+    return `win32-creation-filetime:${creationFiletime}`;
+  const value = await execFileText("powershell.exe", [
+    "-NoProfile",
+    "-Command",
+    `(Get-Process -Id ${pid} -ErrorAction SilentlyContinue).StartTime.ToUniversalTime().ToString('o')`
+  ]);
+  return value === null ? null : `win32-creation-date:${value}`;
+}
+function createProcessStartIdentityReader(read, ownPid) {
+  let ownIdentity;
+  return (pid) => {
+    if (pid !== ownPid)
+      return read(pid);
+    ownIdentity ??= read(pid).then((identity) => {
+      if (identity === null)
+        ownIdentity = undefined;
+      return identity;
+    }, (error) => {
+      ownIdentity = undefined;
+      throw error;
+    });
+    return ownIdentity;
   };
-  const waiting = platform === "darwin" ? `macOS Keychain is waiting for your approval: answer the "${basename15(process.execPath)} wants to access key ${namespace}" dialog ("Always Allow" stops it asking again)` : `${platformName} has not answered; it may be waiting for your approval or an unlock in a system dialog`;
-  const answered = async (api) => {
-    const read = sharedRead(api);
-    let timer;
-    try {
-      if (wait.kind === "interactive") {
-        timer = setTimeout(() => wait.notice(`omo: ${waiting}.`), wait.noticeAfterMs);
-        return await read;
-      }
-      const expired = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new KeychainApprovalPendingError(`${waiting}, then try again. Credentials are never saved to a file.`)), wait.deadlineMs);
-      });
-      return await Promise.race([read, expired]);
-    } finally {
-      clearTimeout(timer);
-    }
+}
+var getProcessStartIdentity = createProcessStartIdentityReader(readProcessStartIdentity, process.pid);
+async function readProcessStartIdentity(pid) {
+  if (process.platform === "linux")
+    return await readLinuxStartIdentity(pid);
+  if (process.platform === "darwin" || process.platform === "freebsd") {
+    if (getPidLiveness(pid) === "dead")
+      return null;
+    const startSeconds = await readDarwinProcessStartSeconds(pid);
+    if (startSeconds !== null)
+      return `proc-start-epoch:${startSeconds}`;
+    const value = await execFileText("/bin/ps", ["-o", "lstart=", "-p", String(pid)]);
+    return value === null ? null : `ps-lstart:${value.replace(/\s+/g, " ")}`;
+  }
+  if (process.platform === "win32")
+    return await readWin32StartIdentity(pid);
+  return null;
+}
+function identityScheme(identity) {
+  const separator = identity.indexOf(":");
+  return separator <= 0 ? null : identity.slice(0, separator);
+}
+function startIdentitiesConflict(recorded, actual) {
+  const recordedScheme = identityScheme(recorded);
+  if (recordedScheme === null || recordedScheme !== identityScheme(actual))
+    return false;
+  return recorded !== actual;
+}
+function getPidLiveness(pid) {
+  try {
+    process.kill(pid, 0);
+    return "alive";
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ESRCH")
+      return "dead";
+    if (code === "EPERM")
+      return "alive";
+    return "unknown";
+  }
+}
+
+// packages/team-core/src/team-state-store/lock-worker-lifetime.ts
+init_zod();
+import { randomUUID as randomUUID5 } from "crypto";
+import { BroadcastChannel, parentPort, threadId } from "worker_threads";
+var Registration = object({
+  kind: literal("omo-team-lock-register-v1"),
+  incarnation: string2(),
+  challenge: string2()
+});
+var Message = discriminatedUnion("kind", [
+  object({ kind: literal("query"), id: string2(), incarnation: string2(), record: string2() }),
+  object({ kind: literal("answer"), id: string2(), released: boolean2() }),
+  object({ kind: literal("hello"), threadId: number2() }),
+  object({ kind: literal("register"), threadId: number2(), challenge: string2() })
+]);
+function createState() {
+  const channel = new BroadcastChannel(`omo-team-lock-lifetime-v1-${process.pid}`);
+  channel.unref();
+  const state = {
+    incarnation: randomUUID5(),
+    records: new Map,
+    exited: new Set,
+    observed: new WeakSet,
+    observing: new Map,
+    pending: new Map,
+    channel,
+    installed: false,
+    registered: parentPort === null,
+    registration: undefined,
+    onRegistered: undefined
   };
-  const unavailable = (error) => isLocked(error) ? new KeychainLockedError(`${platformName} is locked. Unlock it, then try again. Credentials are never saved to a file.`) : new CredentialStoreError(`Cannot access ${platformName}. Unlock or enable the OS credential store and try again. Credentials are never saved to a file.`);
-  let unlockedUntil = 0;
-  let noticed = false;
-  const assertUsable = async () => {
-    if (platform !== "linux" || Date.now() < unlockedUntil)
-      return;
-    const lock = await lockProbe();
-    if (lock === "locked")
-      throw new KeychainLockedError(`${platformName} is locked. Unlock it, then try again. Credentials are never saved to a file.`);
-    if (lock === "unlocked") {
-      unlockedUntil = Date.now() + UNLOCKED_REUSE_MS;
+  channel.onmessage = (event) => {
+    const parsed = Message.safeParse(event.data);
+    if (!parsed.success)
       return;
-    }
-    if (!noticed) {
-      noticed = true;
-      notice("omo: could not check whether the keyring is locked (gdbus or the Secret Service did not answer); using libsecret directly.");
-    }
-  };
-  return {
-    async read() {
-      await assertUsable();
-      let value;
-      try {
-        value = await answered(secrets);
-      } catch (error) {
-        if (error instanceof KeychainApprovalPendingError)
-          throw error;
-        throw unavailable(error);
-      }
-      if (value === null)
-        return null;
-      try {
-        return schema.parse(JSON.parse(value));
-      } catch {
-        throw new InvalidCredentialState(signInRoute() === "cli" ? "Stored sign-in data is invalid. Run omo logout, then omo login." : "The OmO sign-in saved on this computer can't be read, and it can't be reset from the terminal yet.");
+    const message = parsed.data;
+    switch (message.kind) {
+      case "hello": {
+        const observed = state.observing.get(message.threadId);
+        if (observed !== undefined) {
+          channel.postMessage({ kind: "register", threadId: message.threadId, challenge: observed.challenge });
+        }
+        return;
       }
-    },
-    async write(value) {
-      await assertUsable();
-      try {
-        await secrets.set({ ...key, value: JSON.stringify(schema.parse(value)) });
-      } catch (error) {
-        throw unavailable(error);
+      case "register":
+        if (message.threadId === threadId) {
+          parentPort?.postMessage({
+            kind: "omo-team-lock-register-v1",
+            incarnation: state.incarnation,
+            challenge: message.challenge
+          });
+          state.registered = true;
+          state.onRegistered?.();
+        }
+        return;
+      case "answer":
+        state.pending.get(message.id)?.(message.released);
+        return;
+      case "query": {
+        const status = message.incarnation === state.incarnation ? state.records.get(message.record) : undefined;
+        if (status !== undefined || state.exited.has(message.incarnation)) {
+          channel.postMessage({
+            kind: "answer",
+            id: message.id,
+            released: status === "released" || state.exited.has(message.incarnation)
+          });
+        }
+        return;
       }
-      forget(secrets);
-    },
-    async clear() {
-      await assertUsable();
-      try {
-        await secrets.delete(key);
-      } catch (error) {
-        throw unavailable(error);
+      default: {
+        const unexpected = message;
+        throw new Error(`Unexpected lock lifetime message: ${unexpected}`);
       }
-      forget(secrets);
     }
   };
+  return state;
 }
-
-// packages/omo-opencode/src/cli/service-auth/loopback.ts
-import { createHash as createHash11, randomBytes as randomBytes5, timingSafeEqual } from "crypto";
-import { createServer as createServer3 } from "http";
-class BrowserUnavailable extends SignInError {
-}
-async function authorize(options) {
-  const verifier = randomBytes5(32).toString("base64url");
-  const state = randomBytes5(32).toString("base64url");
-  const answer = Promise.withResolvers();
-  const abort = () => answer.reject(new SignInError("Browser sign-in cancelled or timed out."));
-  let accepted = false;
-  let origin = "";
-  const server = createServer3((request, response) => {
-    response.setHeader("cache-control", "no-store");
-    response.setHeader("referrer-policy", "no-referrer");
-    response.setHeader("content-type", "text/plain; charset=utf-8");
-    const url = new URL(request.url ?? "/", origin);
-    if (request.method !== "GET" || request.headers.host !== new URL(origin).host || url.origin !== origin || url.pathname !== "/callback" || request.headers.forwarded || request.headers["x-forwarded-for"]) {
-      response.writeHead(404).end("Not found");
-      return;
-    }
-    const code = url.searchParams.get("code");
-    const suppliedState = Buffer.from(url.searchParams.get("state") ?? "");
-    const expectedState = Buffer.from(state);
-    if (accepted || url.searchParams.getAll("state").length !== 1 || suppliedState.length !== expectedState.length || !timingSafeEqual(suppliedState, expectedState) || url.searchParams.getAll("code").length !== 1 || !code) {
-      response.writeHead(400).end("Invalid sign-in response");
+var state2 = globalThis.__omoTeamLockLifetimeV1 ??= createState();
+var lockOwnerInstanceId = state2.incarnation;
+function attachWorker(worker) {
+  if (state2.observed.has(worker))
+    return;
+  state2.observed.add(worker);
+  const id = worker.threadId;
+  const challenge = randomUUID5();
+  state2.observing.set(id, { worker, challenge });
+  const incarnations = new Set;
+  let exited = false;
+  worker.on("message", (message) => {
+    const parsed = Registration.safeParse(message);
+    if (!parsed.success || parsed.data.challenge !== challenge)
       return;
-    }
-    accepted = true;
-    response.writeHead(200).end("Return to the terminal to finish signing in.");
-    answer.resolve(code);
+    incarnations.add(parsed.data.incarnation);
+    if (exited)
+      state2.exited.add(parsed.data.incarnation);
   });
-  try {
-    await new Promise((resolve, reject) => {
-      server.once("error", reject);
-      server.listen(0, "127.0.0.1", () => {
-        server.off("error", reject);
-        resolve();
-      });
-    });
-    const address = server.address();
-    if (!address || typeof address === "string")
-      throw new SignInError("Unable to start the sign-in callback.");
-    origin = `http://127.0.0.1:${address.port}`;
-    const url = new URL(serviceOrigin(options.accounts));
-    url.search = new URLSearchParams({
-      redirect_uri: `${origin}/callback`,
-      code_challenge: createHash11("sha256").update(verifier).digest("base64url"),
-      code_challenge_method: "S256",
-      state
-    }).toString();
-    const timer = setTimeout(abort, 5 * 60000);
-    options.signal?.addEventListener("abort", abort, { once: true });
-    try {
-      options.signal?.throwIfAborted();
-      const openerFailed = () => {
-        if (!accepted)
-          throw new BrowserUnavailable("No browser is available; use device sign-in.");
-      };
-      const [code] = await Promise.all([
-        answer.promise,
-        options.open(url.href).then((opened) => {
-          if (!opened)
-            openerFailed();
-        }, openerFailed)
-      ]);
-      return { code, codeVerifier: verifier };
-    } finally {
+  worker.once("exit", () => {
+    exited = true;
+    if (state2.observing.get(id)?.worker === worker)
+      state2.observing.delete(id);
+    for (const incarnation of incarnations)
+      state2.exited.add(incarnation);
+  });
+}
+function installLockWorkerObserver() {
+  if (state2.installed)
+    return;
+  state2.installed = true;
+  process.on("worker", attachWorker);
+  state2.channel.postMessage({ kind: "hello", threadId });
+}
+installLockWorkerObserver();
+async function registerLockWorker() {
+  if (state2.registered)
+    return;
+  state2.registration ??= new Promise((resolve) => {
+    const finish = () => {
       clearTimeout(timer);
-      options.signal?.removeEventListener("abort", abort);
-    }
-  } finally {
-    server.closeAllConnections();
-    await new Promise((resolve) => server.close(() => resolve()));
-  }
+      state2.onRegistered = undefined;
+      resolve();
+    };
+    const timer = setTimeout(finish, 250);
+    state2.onRegistered = finish;
+    state2.channel.postMessage({ kind: "hello", threadId });
+  });
+  await state2.registration;
 }
-async function loginLoopback(session, options) {
-  await session.ready();
-  const keys = generateDeviceKeys();
-  for (;; ) {
-    const authorization = await authorize({ accounts: options.accounts, open: options.open, signal: session.signal });
-    try {
-      const grant = parseReply(grantSchema, await session.request("/v1/session/exchange", jsonRequest({
-        ...authorization,
-        kind: "cli",
-        deviceName: options.name,
-        platform: options.platform,
-        ...keys.public
-      })));
-      await session.save({ ...grant, ...keys.private });
-      return;
-    } catch (error) {
-      if (await session.removeForLimit(error, options.chooseDevice))
-        continue;
-      throw new SignInError("Sign-in cancelled. No device was removed.");
-    }
-  }
+function markLockRecordHeld(record) {
+  state2.records.set(record, "held");
+}
+function markLockRecordReleased(record) {
+  if (state2.records.has(record))
+    state2.records.set(record, "released");
+}
+function forgetLockRecord(record) {
+  state2.records.delete(record);
+}
+async function isWorkerLockReleased(incarnation, record) {
+  if (state2.exited.has(incarnation))
+    return true;
+  if (incarnation === state2.incarnation)
+    return state2.records.get(record) === "released";
+  const id = randomUUID5();
+  return await new Promise((resolve) => {
+    const finish = (released) => {
+      clearTimeout(timer);
+      state2.pending.delete(id);
+      resolve(released);
+    };
+    const timer = setTimeout(() => finish(false), 250);
+    state2.pending.set(id, finish);
+    state2.channel.postMessage({ kind: "query", id, incarnation, record });
+  });
 }
-
-// packages/omo-opencode/src/cli/service-auth/session.ts
-import { mkdir as mkdir11 } from "fs/promises";
-import { homedir as homedir31 } from "os";
-import { join as join107 } from "path";
-
-// packages/team-core/src/team-state-store/lock-publish.ts
-import { access as access3, open as open2, unlink as unlink2 } from "fs/promises";
-import { dirname as dirname42 } from "path";
 
 // packages/team-core/src/team-state-store/lock-record.ts
-import { randomUUID as randomUUID5 } from "crypto";
-import { readFile as readFile33, stat as stat8 } from "fs/promises";
-var lockOwnerInstanceId = randomUUID5();
-var heldLockRecords = new Set;
-function buildLockRecord(ownerTag) {
-  return `${ownerTag} ${randomUUID5()}
+async function buildLockRecord(ownerTag) {
+  await registerLockWorker();
+  const processStart = await getProcessStartIdentity(process.pid);
+  return `${ownerTag} ${randomUUID6()}
 ${process.pid}
 ${Date.now()}
 ${lockOwnerInstanceId}
+${processStart ?? "unavailable"}
 `;
 }
-function markLockRecordHeld(content) {
-  heldLockRecords.add(content);
-}
-function markLockRecordReleased(content) {
-  heldLockRecords.delete(content);
-}
-function errorCode(error) {
+function errorCode2(error) {
   if (!(error instanceof Error) || !("code" in error))
     return null;
   return typeof error.code === "string" ? error.code : null;
 }
 function isPathAbsenceError(error) {
-  const code = errorCode(error);
+  const code = errorCode2(error);
   return code === "ENOENT" || code === "ENOTDIR";
 }
 function parseLockOwner(content) {
   const lines = content.split(/\r?\n/).filter((line) => line.length > 0);
-  if (lines.length !== 3 && lines.length !== 4)
+  if (lines.length !== 3 && lines.length !== 4 && lines.length !== 5)
     return null;
   const ownerPid = Number.parseInt(lines[1] ?? "", 10);
   const acquiredAtEpochMs = Number.parseInt(lines[2] ?? "", 10);
@@ -112708,24 +113160,14 @@ function parseLockOwner(content) {
   return {
     ownerPid,
     acquiredAtEpochMs,
-    instanceId: lines.length === 4 ? lines[3] ?? null : null
+    instanceId: lines[3] ?? null,
+    processStart: lines[4] ?? null
   };
 }
-function isPidAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    if (!(error instanceof Error)) {
-      throw error;
-    }
-    return false;
-  }
-}
 async function readLockRecord(lockPath) {
   try {
-    const content = await readFile33(lockPath, "utf8");
-    const { mtimeMs } = await stat8(lockPath);
+    const content = await readFile34(lockPath, "utf8");
+    const { mtimeMs } = await stat9(lockPath);
     return { content, modifiedAtEpochMs: mtimeMs };
   } catch (error) {
     if (!(error instanceof Error))
@@ -112733,23 +113175,30 @@ async function readLockRecord(lockPath) {
     return null;
   }
 }
-function isLockRecordStale(record, staleAfterMs) {
+async function isLockRecordStale(record, staleAfterMs) {
   const owner = parseLockOwner(record.content);
   if (owner === null)
     return Date.now() - record.modifiedAtEpochMs > staleAfterMs;
-  if (owner.instanceId !== null && owner.ownerPid === process.pid) {
-    return owner.instanceId !== lockOwnerInstanceId || !heldLockRecords.has(record.content);
+  const liveness = getPidLiveness(owner.ownerPid);
+  if (liveness === "dead") {
+    return owner.instanceId !== null || Date.now() - owner.acquiredAtEpochMs > staleAfterMs;
   }
-  if (isPidAlive(owner.ownerPid))
+  if (liveness === "unknown")
     return false;
-  if (owner.instanceId !== null)
-    return true;
-  return Date.now() - owner.acquiredAtEpochMs > staleAfterMs;
+  if (owner.processStart !== null) {
+    const actual = await getProcessStartIdentity(owner.ownerPid);
+    if (actual !== null && startIdentitiesConflict(owner.processStart, actual))
+      return true;
+  }
+  if (owner.instanceId !== null && owner.ownerPid === process.pid) {
+    return await isWorkerLockReleased(owner.instanceId, record.content);
+  }
+  return false;
 }
 
 // packages/team-core/src/team-state-store/lock-publish.ts
 async function pathMayExist(path, deps = {}) {
-  const accessPath = deps.access ?? access3;
+  const accessPath = deps.access ?? access4;
   try {
     await accessPath(path);
     return true;
@@ -112760,7 +113209,7 @@ async function pathMayExist(path, deps = {}) {
   }
 }
 async function assertRetryableLockOpenError(lockPath, error, deps) {
-  const code = errorCode(error);
+  const code = errorCode2(error);
   if (code === "EEXIST")
     return;
   if (code === "EPERM") {
@@ -112775,9 +113224,9 @@ async function publishLockRecord(lockPath, record) {
   markLockRecordHeld(record);
   let fileHandle;
   try {
-    fileHandle = await open2(lockPath, "wx");
+    fileHandle = await open3(lockPath, "wx");
   } catch (error) {
-    markLockRecordReleased(record);
+    forgetLockRecord(record);
     await assertRetryableLockOpenError(lockPath, error);
     return false;
   }
@@ -112786,7 +113235,7 @@ async function publishLockRecord(lockPath, record) {
   } catch (error) {
     markLockRecordReleased(record);
     await fileHandle.close();
-    await unlink2(lockPath).catch(() => {
+    await unlink3(lockPath).catch(() => {
       return;
     });
     throw error;
@@ -112796,8 +113245,8 @@ async function publishLockRecord(lockPath, record) {
 }
 
 // packages/team-core/src/team-state-store/lock-reclaim.ts
-import { createHash as createHash12 } from "crypto";
-import { unlink as unlink3 } from "fs/promises";
+import { createHash as createHash10 } from "crypto";
+import { unlink as unlink4 } from "fs/promises";
 var RECLAIM_UNLINK_ATTEMPTS = 3;
 var RECLAIM_UNLINK_RETRY_MS = 25;
 function delay2(ms) {
@@ -112806,11 +113255,11 @@ function delay2(ms) {
   });
 }
 function reclaimGuardPath(lockPath, record) {
-  return `${lockPath}.reclaim-${createHash12("sha256").update(record).digest("hex").slice(0, 16)}`;
+  return `${lockPath}.reclaim-${createHash10("sha256").update(record).digest("hex").slice(0, 16)}`;
 }
 async function unlinkWithRetry(path, deps) {
   const wait = deps.delay ?? delay2;
-  const unlinkFile = deps.unlink ?? unlink3;
+  const unlinkFile = deps.unlink ?? unlink4;
   for (let attempt = 1;; attempt += 1) {
     try {
       await unlinkFile(path);
@@ -112820,7 +113269,7 @@ async function unlinkWithRetry(path, deps) {
         throw error;
       if (isPathAbsenceError(error))
         return "absent";
-      const code = errorCode(error);
+      const code = errorCode2(error);
       if (code !== "EPERM" && code !== "EBUSY" || attempt === RECLAIM_UNLINK_ATTEMPTS)
         return "stuck";
       await wait(RECLAIM_UNLINK_RETRY_MS);
@@ -112829,10 +113278,10 @@ async function unlinkWithRetry(path, deps) {
 }
 async function removeLockRecordIfUnchanged(lockPath, expectedRecord, staleAfterMs, deps = {}) {
   const guardPath = reclaimGuardPath(lockPath, expectedRecord);
-  const guardRecord = buildLockRecord("lock-reclaim");
+  const guardRecord = await buildLockRecord("lock-reclaim");
   if (!await publishLockRecord(guardPath, guardRecord)) {
     const guard = await readLockRecord(guardPath);
-    if (guard !== null && isLockRecordStale(guard, staleAfterMs)) {
+    if (guard !== null && await isLockRecordStale(guard, staleAfterMs)) {
       await removeLockRecordIfUnchanged(guardPath, guard.content, staleAfterMs, deps);
     }
     return "busy";
@@ -112841,13 +113290,16 @@ async function removeLockRecordIfUnchanged(lockPath, expectedRecord, staleAfterM
     const current = await readLockRecord(lockPath);
     if (current === null)
       return "absent";
-    if (current.content !== expectedRecord || !isLockRecordStale(current, staleAfterMs))
+    if (current.content !== expectedRecord || !await isLockRecordStale(current, staleAfterMs))
       return "changed";
     const unlinked = await unlinkWithRetry(lockPath, deps);
+    if (unlinked !== "stuck")
+      forgetLockRecord(expectedRecord);
     return unlinked === "absent" ? "absent" : unlinked;
   } finally {
     markLockRecordReleased(guardRecord);
-    await unlinkWithRetry(guardPath, deps);
+    if (await unlinkWithRetry(guardPath, deps) !== "stuck")
+      forgetLockRecord(guardRecord);
   }
 }
 
@@ -112866,7 +113318,7 @@ async function acquireLock(lockPath, ownerTag, staleAfterMs) {
     if (Date.now() - startedAt > LOCK_WAIT_TIMEOUT_MS) {
       throw new Error(`Timed out acquiring lock: ${lockPath}`);
     }
-    const record = buildLockRecord(ownerTag);
+    const record = await buildLockRecord(ownerTag);
     if (await publishLockRecord(lockPath, record))
       return record;
     const outcome = await reapStaleLock(lockPath, staleAfterMs);
@@ -112883,26 +113335,327 @@ async function withLock(lockPath, fn, opts) {
     return await fn();
   } finally {
     markLockRecordReleased(record);
-    await removeLockRecordIfUnchanged(lockPath, record, staleAfterMs);
+    const outcome = await removeLockRecordIfUnchanged(lockPath, record, staleAfterMs);
+    if (outcome === "removed" || outcome === "absent" || outcome === "changed")
+      forgetLockRecord(record);
   }
 }
 async function reapStaleLock(lockPath, staleAfterMs = DEFAULT_STALE_AFTER_MS, deps = {}) {
   const observed = await readLockRecord(lockPath);
   if (observed === null)
     return "absent";
-  if (!isLockRecordStale(observed, staleAfterMs))
+  if (!await isLockRecordStale(observed, staleAfterMs))
     return "changed";
   return await removeLockRecordIfUnchanged(lockPath, observed.content, staleAfterMs, deps);
 }
 
+// packages/omo-opencode/src/cli/service-auth/credential-lock.ts
+var held = new AsyncLocalStorage3;
+function credentialLockPaths(api, home = homedir31()) {
+  const id = createHash11("sha256").update(serviceOrigin(api)).digest("hex");
+  const directory = join106(home, ".omo", "session-locks");
+  return { directory, lock: join106(directory, `${id}.lock`), desktopRecord: join106(directory, `${id}.desktop-generation.json`) };
+}
+async function withCredentialLock(api, action, home = homedir31(), ownerTag = "cli-session") {
+  const { directory, lock } = credentialLockPaths(api, home);
+  const owned = held.getStore();
+  if (owned?.has(lock))
+    return action();
+  await mkdir11(directory, { recursive: true, mode: 448 });
+  return withLock(lock, () => held.run(new Set([...owned ?? [], lock]), action), {
+    ownerTag,
+    staleAfterMs: Number.POSITIVE_INFINITY
+  });
+}
+
+// packages/omo-opencode/src/cli/service-auth/keystore.ts
+class CredentialStoreError extends SignInError {
+}
+
+class KeychainLockedError extends CredentialStoreError {
+}
+class InvalidCredentialState extends SignInError {
+}
+
+class CredentialIdentityChanged extends Error {
+  constructor() {
+    super("The stored sign-in changed; the captured account is no longer current.");
+  }
+}
+
+class KeychainApprovalPendingError extends CredentialStoreError {
+}
+var SESSION_READ_WAIT = { kind: "bounded", deadlineMs: 5000 };
+var INTERACTIVE_READ_WAIT = {
+  kind: "interactive",
+  noticeAfterMs: 2000,
+  notice: (message) => process.stderr.write(`${message}
+`)
+};
+var processReads = new WeakMap;
+var LOCKED = /-25308|errSecInteractionNotAllowed|interaction is not allowed|locked collection/i;
+var UNLOCKED_REUSE_MS = 30000;
+var fallbackNoticed = false;
+var stderrNoticeOncePerProcess = (message) => {
+  if (fallbackNoticed)
+    return;
+  fallbackNoticed = true;
+  process.stderr.write(`${message}
+`);
+};
+var isLocked = (error) => error instanceof Error && (LOCKED.test(error.message) || LOCKED.test(String(error.code ?? "")));
+function credentialId(api) {
+  return createHash12("sha256").update(serviceOrigin(api)).digest("hex");
+}
+function createCredentialStore(api, options = {}) {
+  const store = createSealedStore(api, "omo-cli", credentialSchema, options.secrets, options.platform, options.lockProbe, options.notice, options.wait, (current, value) => {
+    const sameIdentity = current !== null && current.device.id === value.device.id && current.signingPrivateKey === value.signingPrivateKey && current.sealingPrivateKey === value.sealingPrivateKey && (value.accountId === undefined || current.accountId === undefined || current.accountId === value.accountId);
+    const accountId = value.accountId ?? (sameIdentity ? current?.accountId : undefined);
+    return {
+      ...value,
+      ...accountId === undefined ? {} : { accountId },
+      credentialGeneration: sameIdentity ? current?.credentialGeneration ?? randomUUID7() : randomUUID7()
+    };
+  });
+  return {
+    read: store.read,
+    readAuthoritative: store.readAuthoritative,
+    write: (value) => withCredentialLock(api, () => store.write(value), options.home),
+    clear: () => withCredentialLock(api, store.clear, options.home)
+  };
+}
+function createSealedStore(api, namespace, schema, secrets = typeof Bun === "undefined" ? null : Bun.secrets, platform = process.platform, lockProbe = probeSecretServiceLock, notice = stderrNoticeOncePerProcess, wait = SESSION_READ_WAIT, amendWrite) {
+  if (!secrets)
+    throw new SignInError("OmO sign-in needs Bun 1.4 or newer with OS credential storage. No file fallback is available.");
+  const platformName = platform === "darwin" ? "macOS Keychain" : platform === "linux" ? "Linux Secret Service (libsecret and an unlocked keyring)" : platform === "win32" ? "Windows Credential Manager" : null;
+  if (platformName === null)
+    throw new SignInError("This platform has no supported OS credential store.");
+  const key = { service: namespace, name: credentialId(api) };
+  const slot = `${key.service}
+${key.name}`;
+  const readsOf = (api) => {
+    const known = processReads.get(api);
+    if (known !== undefined)
+      return known;
+    const created = new Map;
+    processReads.set(api, created);
+    return created;
+  };
+  const forget = (api) => {
+    readsOf(api).delete(slot);
+  };
+  const sharedRead = (api) => {
+    const reads = readsOf(api);
+    const pending = reads.get(slot);
+    if (pending !== undefined)
+      return pending;
+    const read = Promise.resolve().then(() => api.get(key));
+    const done = () => {
+      if (reads.get(slot) === read)
+        reads.delete(slot);
+    };
+    read.then(done, done);
+    reads.set(slot, read);
+    return read;
+  };
+  const waiting = platform === "darwin" ? `macOS Keychain is waiting for your approval: answer the "${basename15(process.execPath)} wants to access key ${namespace}" dialog ("Always Allow" stops it asking again)` : `${platformName} has not answered; it may be waiting for your approval or an unlock in a system dialog`;
+  const answered = async (api, fresh = false) => {
+    const read = fresh ? Promise.resolve().then(() => api.get(key)) : sharedRead(api);
+    let timer;
+    try {
+      if (wait.kind === "interactive") {
+        timer = setTimeout(() => wait.notice(`omo: ${waiting}.`), wait.noticeAfterMs);
+        return await read;
+      }
+      const expired = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new KeychainApprovalPendingError(`${waiting}, then try again. Credentials are never saved to a file.`)), wait.deadlineMs);
+      });
+      return await Promise.race([read, expired]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const unavailable = (error) => isLocked(error) ? new KeychainLockedError(`${platformName} is locked. Unlock it, then try again. Credentials are never saved to a file.`) : new CredentialStoreError(`Cannot access ${platformName}. Unlock or enable the OS credential store and try again. Credentials are never saved to a file.`);
+  let unlockedUntil = 0;
+  let noticed = false;
+  const assertUsable = async () => {
+    if (platform !== "linux" || Date.now() < unlockedUntil)
+      return;
+    const lock = await lockProbe();
+    if (lock === "locked")
+      throw new KeychainLockedError(`${platformName} is locked. Unlock it, then try again. Credentials are never saved to a file.`);
+    if (lock === "unlocked") {
+      unlockedUntil = Date.now() + UNLOCKED_REUSE_MS;
+      return;
+    }
+    if (!noticed) {
+      noticed = true;
+      notice("omo: could not check whether the keyring is locked (gdbus or the Secret Service did not answer); using libsecret directly.");
+    }
+  };
+  const parsedRead = async (fresh) => {
+    await assertUsable();
+    let value;
+    try {
+      value = await answered(secrets, fresh);
+    } catch (error) {
+      if (error instanceof KeychainApprovalPendingError)
+        throw error;
+      throw unavailable(error);
+    }
+    if (value === null)
+      return null;
+    try {
+      return schema.parse(JSON.parse(value));
+    } catch {
+      throw new InvalidCredentialState(signInRoute() === "cli" ? "Stored sign-in data is invalid. Run omo account forget, then omo login." : "The OmO sign-in saved on this computer can't be read. Run omo account forget to remove it, then sign in again in the desktop app.");
+    }
+  };
+  return {
+    read: () => parsedRead(false),
+    readAuthoritative: () => parsedRead(true),
+    async write(value) {
+      await assertUsable();
+      try {
+        let next = value;
+        if (amendWrite !== undefined) {
+          const raw = await answered(secrets, true);
+          let previous = null;
+          if (raw !== null) {
+            try {
+              previous = schema.parse(JSON.parse(raw));
+            } catch {}
+          }
+          next = amendWrite(previous, value);
+        }
+        await secrets.set({ ...key, value: JSON.stringify(schema.parse(next)) });
+      } catch (error) {
+        throw unavailable(error);
+      }
+      forget(secrets);
+    },
+    async clear() {
+      await assertUsable();
+      try {
+        await secrets.delete(key);
+      } catch (error) {
+        throw unavailable(error);
+      }
+      forget(secrets);
+    }
+  };
+}
+
+// packages/omo-opencode/src/cli/service-auth/loopback.ts
+import { createHash as createHash13, randomBytes as randomBytes5, timingSafeEqual } from "crypto";
+import { createServer as createServer3 } from "http";
+class BrowserUnavailable extends SignInError {
+}
+async function authorize(options) {
+  const verifier = randomBytes5(32).toString("base64url");
+  const state = randomBytes5(32).toString("base64url");
+  const answer = Promise.withResolvers();
+  const abort = () => answer.reject(new SignInError("Browser sign-in cancelled or timed out."));
+  let accepted = false;
+  let origin = "";
+  const server = createServer3((request, response) => {
+    response.setHeader("cache-control", "no-store");
+    response.setHeader("referrer-policy", "no-referrer");
+    response.setHeader("content-type", "text/plain; charset=utf-8");
+    const url = new URL(request.url ?? "/", origin);
+    if (request.method !== "GET" || request.headers.host !== new URL(origin).host || url.origin !== origin || url.pathname !== "/callback" || request.headers.forwarded || request.headers["x-forwarded-for"]) {
+      response.writeHead(404).end("Not found");
+      return;
+    }
+    const code = url.searchParams.get("code");
+    const suppliedState = Buffer.from(url.searchParams.get("state") ?? "");
+    const expectedState = Buffer.from(state);
+    if (accepted || url.searchParams.getAll("state").length !== 1 || suppliedState.length !== expectedState.length || !timingSafeEqual(suppliedState, expectedState) || url.searchParams.getAll("code").length !== 1 || !code) {
+      response.writeHead(400).end("Invalid sign-in response");
+      return;
+    }
+    accepted = true;
+    response.writeHead(200).end("Return to the terminal to finish signing in.");
+    answer.resolve(code);
+  });
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => {
+        server.off("error", reject);
+        resolve();
+      });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+      throw new SignInError("Unable to start the sign-in callback.");
+    origin = `http://127.0.0.1:${address.port}`;
+    const url = new URL(serviceOrigin(options.accounts));
+    url.search = new URLSearchParams({
+      redirect_uri: `${origin}/callback`,
+      code_challenge: createHash13("sha256").update(verifier).digest("base64url"),
+      code_challenge_method: "S256",
+      state
+    }).toString();
+    const timer = setTimeout(abort, 5 * 60000);
+    options.signal?.addEventListener("abort", abort, { once: true });
+    try {
+      options.signal?.throwIfAborted();
+      const openerFailed = () => {
+        if (!accepted)
+          throw new BrowserUnavailable("No browser is available; use device sign-in.");
+      };
+      const [code] = await Promise.all([
+        answer.promise,
+        options.open(url.href).then((opened) => {
+          if (!opened)
+            openerFailed();
+        }, openerFailed)
+      ]);
+      return { code, codeVerifier: verifier };
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
+    }
+  } finally {
+    server.closeAllConnections();
+    await new Promise((resolve) => server.close(() => resolve()));
+  }
+}
+async function loginLoopback(session, options) {
+  await session.ready();
+  const keys = generateDeviceKeys();
+  for (;; ) {
+    const authorization = await authorize({ accounts: options.accounts, open: options.open, signal: session.signal });
+    try {
+      const grant = parseReply(grantSchema, await session.request("/v1/session/exchange", jsonRequest({
+        ...authorization,
+        kind: "cli",
+        deviceName: options.name,
+        platform: options.platform,
+        ...keys.public
+      })));
+      await session.save({ ...grant, ...keys.private });
+      return;
+    } catch (error) {
+      if (await session.removeForLimit(error, options.chooseDevice))
+        continue;
+      throw new SignInError("Sign-in cancelled. No device was removed.");
+    }
+  }
+}
+
+// packages/omo-opencode/src/cli/service-auth/session.ts
+import { homedir as homedir32 } from "os";
+
 // packages/omo-opencode/src/cli/service-auth/signed-out-marker.ts
 init_zod();
-import { mkdir as mkdir10, readFile as readFile34, rename as rename7, rm as rm16, writeFile as writeFile16 } from "fs/promises";
-import { dirname as dirname43, join as join106 } from "path";
+import { mkdir as mkdir12, readFile as readFile35, rename as rename8, rm as rm17, writeFile as writeFile17 } from "fs/promises";
+import { dirname as dirname43, join as join107 } from "path";
 var markerSchema = object({ device: string2().nullable(), at: string2() });
-var signedOutMarkerPath = (home, credential) => join106(home, ".omo", "account-state", `${credential}.signed-out.json`);
+var signedOutMarkerPath = (home, credential) => join107(home, ".omo", "account-state", `${credential}.signed-out.json`);
 async function readSignedOutMarker(path) {
-  const text = await readFile34(path, "utf8").catch(() => null);
+  const text = await readFile35(path, "utf8").catch(() => null);
   if (text === null)
     return null;
   let value;
@@ -112915,12 +113668,12 @@ async function readSignedOutMarker(path) {
   return parsed.success ? parsed.data : null;
 }
 async function writeSignedOutMarker(path, device) {
-  await mkdir10(dirname43(path), { recursive: true, mode: 448 });
+  await mkdir12(dirname43(path), { recursive: true, mode: 448 });
   const staging = `${path}.${process.pid}.tmp`;
-  await writeFile16(staging, JSON.stringify({ device, at: new Date().toISOString() }), { mode: 384 });
-  await rename7(staging, path);
+  await writeFile17(staging, JSON.stringify({ device, at: new Date().toISOString() }), { mode: 384 });
+  await rename8(staging, path);
 }
-var clearSignedOutMarker = (path) => rm16(path, { force: true });
+var clearSignedOutMarker = (path) => rm17(path, { force: true });
 
 // packages/omo-opencode/src/cli/service-auth/session.ts
 class SessionEnded extends SignInError {
@@ -112935,30 +113688,29 @@ class SessionEnded extends SignInError {
 var DEVICE_REVOKING_REFUSALS = new Set(["account_deleted", "reauth_required", "device_revoked"]);
 function createSession(options) {
   const api = serviceOrigin(options.api);
+  const now = options.now ?? Date.now;
   const { store, signal } = options;
-  const directory = join107(options.home ?? homedir31(), ".omo", "session-locks");
-  const lockPath = join107(directory, `${credentialId(api)}.lock`);
-  const markerPath = signedOutMarkerPath(options.home ?? homedir31(), credentialId(api));
+  const markerPath = signedOutMarkerPath(options.home ?? homedir32(), credentialId(api));
   async function locked(action) {
-    await mkdir11(directory, { recursive: true, mode: 448 });
     signal?.throwIfAborted();
-    return withLock(lockPath, async () => {
+    return withCredentialLock(api, async () => {
       signal?.throwIfAborted();
       return action();
-    }, { ownerTag: "cli-session", staleAfterMs: Number.POSITIVE_INFINITY });
+    }, options.home);
   }
   const request = (path, init) => requestApi(api, path, init, signal);
-  const uncertain = () => new SignInError(`The refresh outcome is unknown. Saved credentials and keys were retained, but this refresh token will not be sent again. ${signInHint("again")}`, true);
-  async function refreshedAccess(current) {
-    if (current.refreshState === "uncertain")
-      throw uncertain();
-    if (Date.parse(current.accessTokenExpiresAt) > Date.now() + 30000)
-      return current.accessToken;
+  async function refreshed(current) {
+    if (current.refreshState === "uncertain" || current.refreshAttempt !== undefined) {
+      throw new SessionEnded(`Refresh recovery can no longer be proved safe. ${signInHint("again")}`, false, "refresh_recovery_expired");
+    }
+    if (Date.parse(current.accessTokenExpiresAt) > now() + 30000)
+      return current;
     await store.write({ ...current, refreshState: "uncertain" });
     try {
       const tokens = parseReply(tokenSchema, await request("/v1/session/refresh", jsonRequest({ refreshToken: current.refreshToken })));
-      await store.write({ ...current, ...tokens });
-      return tokens.accessToken;
+      const successor = { ...current, ...tokens };
+      await store.write(successor);
+      return successor;
     } catch (error) {
       if (error instanceof CredentialStoreError)
         throw error;
@@ -112970,12 +113722,19 @@ function createSession(options) {
         await store.write(current);
         throw error;
       }
-      throw uncertain();
+      throw new SessionEnded(`The refresh outcome is unknown. Saved credentials and keys were retained. ${signInHint("again")}`, false, "refresh_recovery_expired");
     }
   }
+  async function snapshot() {
+    return locked(async () => {
+      const current = await store.read();
+      return current === null ? null : refreshed(current);
+    });
+  }
   return {
     request,
     signal,
+    transaction: locked,
     async ready() {
       await store.read();
     },
@@ -112987,18 +113746,32 @@ function createSession(options) {
     },
     signedOutMarker: () => readSignedOutMarker(markerPath),
     clearSignedOutMarker: () => clearSignedOutMarker(markerPath),
-    async update(action) {
-      return locked(async () => action(await store.read()));
+    async update(action, options = {}) {
+      return locked(async () => {
+        let current;
+        try {
+          current = await store.readAuthoritative();
+        } catch (error) {
+          if (!options.replaceInvalid || !(error instanceof InvalidCredentialState))
+            throw error;
+          current = null;
+        }
+        return action(current);
+      });
     },
+    async forget() {
+      await locked(() => store.clear());
+    },
+    accessSnapshot: snapshot,
     async logout() {
       return locked(async () => {
         let current = null;
         try {
-          current = await store.read();
+          current = await store.readAuthoritative();
           if (current !== null) {
             if (current.refreshState === "uncertain")
               return false;
-            const access = Date.parse(current.accessTokenExpiresAt) <= Date.now() ? await refreshedAccess(current) : current.accessToken;
+            const access = Date.parse(current.accessTokenExpiresAt) <= now() ? (await refreshed(current)).accessToken : current.accessToken;
             await request(`/v1/devices/${encodeURIComponent(current.device.id)}`, {
               method: "DELETE",
               headers: { authorization: `Bearer ${access}` }
@@ -113017,12 +113790,19 @@ function createSession(options) {
         }
       });
     },
-    async accessToken() {
+    async accessToken(expect) {
+      signal?.throwIfAborted();
+      const snapshot = await store.read();
+      signal?.throwIfAborted();
+      if (snapshot !== null && snapshot.refreshState !== "uncertain" && snapshot.refreshAttempt === undefined && Date.parse(snapshot.accessTokenExpiresAt) > now() + 30000 && (expect === undefined || expect(snapshot)))
+        return snapshot.accessToken;
       return locked(async () => {
-        const current = await store.read();
+        const current = await store.readAuthoritative();
         if (current === null)
           throw new SignInError(`Not signed in. ${signInHint("first")}`);
-        return refreshedAccess(current);
+        if (expect !== undefined && !expect(current))
+          throw new CredentialIdentityChanged;
+        return (await refreshed(current)).accessToken;
       });
     },
     async removeForLimit(error, choose) {
@@ -113351,12 +114131,12 @@ async function boulder(options) {
 }
 // packages/omo-opencode/src/cli/codex-ulw-loop.ts
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync67, readFileSync as readFileSync44, realpathSync as realpathSync13 } from "fs";
-import { homedir as homedir32 } from "os";
+import { existsSync as existsSync67, readFileSync as readFileSync45, realpathSync as realpathSync14 } from "fs";
+import { homedir as homedir33 } from "os";
 var ULW_LOOP_DELEGATION_SENTINEL = "OMO_ULW_LOOP_DELEGATED";
 function resolveCodexUlwLoopCommand(input = {}) {
   const env = input.env ?? process.env;
-  const homeDir = input.homeDir ?? homedir32();
+  const homeDir = input.homeDir ?? homedir33();
   const localComponentBin = resolveLocalUlwLoopBin(env, homeDir);
   if (localComponentBin !== null)
     return { executable: localComponentBin, argsPrefix: [] };
@@ -113401,7 +114181,7 @@ function resolveLegacyLocalOmoBin(env, homeDir, currentExecutablePaths) {
 }
 function isGeneratedRuntimeWrapper(candidate) {
   try {
-    return readFileSync44(candidate, "utf8").includes(RUNTIME_WRAPPER_MARKER);
+    return readFileSync45(candidate, "utf8").includes(RUNTIME_WRAPPER_MARKER);
   } catch (error) {
     if (error instanceof Error)
       return false;
@@ -113414,7 +114194,7 @@ function isCurrentExecutable(candidate, currentExecutablePaths) {
 }
 function realpathOrSelf2(path) {
   try {
-    return realpathSync13(path);
+    return realpathSync14(path);
   } catch (error) {
     if (error instanceof Error)
       return path;
@@ -113599,7 +114379,7 @@ function linkedWorktrees(records) {
 }
 // packages/omo-opencode/src/cli/worktree-sweep/sweep.ts
 import { existsSync as existsSync68 } from "fs";
-import { stat as stat9 } from "fs/promises";
+import { stat as stat10 } from "fs/promises";
 import os7 from "os";
 import { normalize as normalize2 } from "path";
 
@@ -113682,7 +114462,7 @@ async function isOlderThan(worktreePath, days, now) {
   if (days <= 0)
     return false;
   try {
-    const stats = await stat9(worktreePath);
+    const stats = await stat10(worktreePath);
     return now - stats.mtimeMs > days * DAY_MS;
   } catch {
     return false;
@@ -113929,7 +114709,7 @@ Model Providers (Priority: Native > Copilot > OpenCode Zen > Z.ai > Kimi > Baili
   Copilot       github-copilot/ models (fallback)
   OpenCode Zen  opencode/ models (opencode/claude-opus-5, etc.)
   Z.ai          zai-coding-plan/glm-5.2 (visual-engineering fallback)
-  Kimi          kimi-for-coding/kimi-k3 (Sisyphus/Prometheus fallback)
+  Kimi          kimi-for-coding/kimi-k3.1-pro (Sisyphus/Prometheus fallback)
   Bailian       bailian-coding-plan/ models (Qwen, GLM, Kimi fallback)
   MiniMax       minimax-coding-plan/MiniMax-M3 (utility fallback)
   MiniMax CN    minimax-cn-coding-plan/MiniMax-M3 (utility fallback)