omo-ai 5.1.1 → 5.1.3

package/bin/lib/claude-code-floor.js

@@ -1,7 +1,10 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
+import { engineDependencyDir } from "./engine-dependency.js"
 
-const claudeCodeVersionRelative = "node_modules/@earendil-works/pi-ai/dist/api/anthropic-messages.js"
+const piAiPackage = "@earendil-works/pi-ai"
+const claudeCodeVersionRelative = "dist/api/anthropic-messages.js"
+const claudeCodeVersionTarget = `${piAiPackage}/${claudeCodeVersionRelative}`
 const claudeCodeVersionPattern = /const claudeCodeVersion = "(\d+)\.(\d+)\.(\d+)";/
 // Claude Opus 5.5 rejects OAuth requests advertising Claude Code below 2.1.280 (claude_code_version_too_old).
 export const claudeCodeVersionFloor = "2.1.280"
@@ -13,11 +16,12 @@ function isBelowFloor([major, minor, patch]) {
 }
 
 function floorPiAi(senpiRoot) {
-  const path = join(senpiRoot, claudeCodeVersionRelative)
-  if (!existsSync(path)) throw new Error(`omo-ai: installed Senpi target is missing: ${claudeCodeVersionRelative}`)
+  const piAiRoot = engineDependencyDir(senpiRoot, piAiPackage)
+  const path = piAiRoot === undefined ? undefined : join(piAiRoot, claudeCodeVersionRelative)
+  if (path === undefined || !existsSync(path)) throw new Error(`omo-ai: installed Senpi target is missing: ${claudeCodeVersionTarget}`)
   const source = readFileSync(path, "utf8")
   const match = claudeCodeVersionPattern.exec(source)
-  if (match === null) throw new Error(`omo-ai: unsupported Senpi ${claudeCodeVersionRelative}`)
+  if (match === null) throw new Error(`omo-ai: unsupported Senpi ${claudeCodeVersionTarget}`)
   if (!isBelowFloor(match.slice(1).map(Number))) return
   writeFileSync(path, source.replace(claudeCodeVersionPattern, `const claudeCodeVersion = "${claudeCodeVersionFloor}";`))
 }

package/bin/lib/doctor-migration.js

@@ -4,6 +4,7 @@ import { delimiter, dirname, isAbsolute, join, win32 } from "node:path"
 import { parseJsonc } from "./jsonc.js"
 import { releaseChannel } from "./package-paths.js"
 import { opencodeConfigSources } from "./setup-opencode-assets.js"
+import { openCodeRoutingGap, openCodeRoutingNotice, readEditionRouting } from "./setup-opencode-models.js"
 import { standaloneBinaryVersion } from "./standalone-binary.js"
 
 // Migration leftovers from the OpenCode edition, reported and never touched: another `omo` ahead of
@@ -321,16 +322,30 @@ export function formatMigrationLines({ shadowing, nativeDirectory, legacyPackage
   return lines
 }
 
+// The OpenCode edition's model settings Native does not use: the same line Native's first start
+// prints (omo-senpi config-startup), for as long as the gap exists.
+export function openCodeRoutingReport({ env, homeDir }) {
+  const path = ["omo.jsonc", "omo.json"].map((name) => join(homeDir, ".omo", name)).find((candidate) => readWholeFile(candidate) !== undefined)
+  let document = {}
+  if (path !== undefined) {
+    try {
+      document = parseJsonc(readWholeFile(path))
+    } catch {
+      return [] // The config loader reports an unreadable omo.jsonc itself.
+    }
+  }
+  const gap = openCodeRoutingGap(document, readEditionRouting({ home: homeDir, env }))
+  return gap.length === 0 ? [] : [`INFO ${openCodeRoutingNotice(gap)}`]
+}
+
 /** The doctor's migration section. `options.env` / `homeDir` / `platform` keep tests off the real machine. */
 export function migrationReport(options, restoreCommand) {
-  const environment = resolveMigrationEnvironment({
-    env: options.env ?? process.env,
-    platform: options.platform ?? process.platform,
-    homeDir: options.homeDir ?? homedir(),
-  })
+  const env = options.env ?? process.env
+  const homeDir = options.homeDir ?? homedir()
+  const environment = resolveMigrationEnvironment({ env, platform: options.platform ?? process.platform, homeDir })
   const bins = scanOmoBins(environment)
   const omoInstalls = omoInstallsOnPath(bins)
-  return formatMigrationLines({
+  return [...formatMigrationLines({
     shadowing: shadowingOmoBins(bins),
     nativeDirectory: omoInstalls[0]?.directory ?? null,
     legacyPackages: findLegacyPackages(environment),
@@ -339,5 +354,5 @@ export function migrationReport(options, restoreCommand) {
     omoInstalls,
     bunRoot: environment.bunRoot,
     standalone: options.standalone === true,
-  })
+  }), ...openCodeRoutingReport({ env, homeDir })]
 }

package/bin/lib/doctor-pi-config.js

@@ -0,0 +1,70 @@
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs"
+import { join } from "node:path"
+import { canonicalAgentDir, runtimeHome } from "./agent-dir.js"
+
+// Mirrors the engine's legacy-pi-edits check (senpi `src/legacy-pi-edits.ts`), which this package
+// cannot import synchronously: the same four files, the same `legacyPiAgentDir.copiedAt` record in
+// migrations-state.json, and the same rule: newer than the recorded copy (or, before the time was
+// recorded, than the agent copy's preserved mtime) and different in content. `~/.pi/agent` is only
+// read (#9173).
+export const PI_CONFIG_FILES = ["auth.json", "keybindings.json", "models.json", "settings.json"]
+
+function fileStat(path) {
+  try {
+    const stat = statSync(path)
+    return stat.isFile() ? stat : undefined
+  } catch (error) {
+    if (error?.code === "ENOENT" || error?.code === "ENOTDIR") return undefined
+    throw error
+  }
+}
+
+function recordedCopyTime(agentDir) {
+  let state
+  try {
+    state = JSON.parse(readFileSync(join(agentDir, "migrations-state.json"), "utf8"))
+  } catch {
+    // A missing or hand-broken state file means no recorded copy time; the rule falls back.
+    return undefined
+  }
+  const copiedAt = state?.schemaVersion === 1 ? state.legacyPiAgentDir?.copiedAt : undefined
+  return typeof copiedAt === "number" && Number.isFinite(copiedAt) ? copiedAt : undefined
+}
+
+export function findPiConfigEdits({ agentDir, homeDir }) {
+  const piAgentDir = join(homeDir, ".pi", "agent")
+  if (!existsSync(piAgentDir)) return []
+  if (existsSync(agentDir) && realpathSync(agentDir) === realpathSync(piAgentDir)) return []
+  const copiedAt = recordedCopyTime(agentDir)
+  const edits = []
+  for (const file of PI_CONFIG_FILES) {
+    const piPath = join(piAgentDir, file)
+    const agentPath = join(agentDir, file)
+    const pi = fileStat(piPath)
+    if (pi === undefined) continue
+    const agent = fileStat(agentPath)
+    if (pi.mtimeMs <= (copiedAt ?? agent?.mtimeMs ?? 0)) continue
+    if (agent !== undefined && readFileSync(piPath).equals(readFileSync(agentPath))) continue
+    edits.push({ file, piPath, agentPath })
+  }
+  return edits
+}
+
+export function formatPiConfigLines(agentDir, edits) {
+  return [
+    `INFO config dir: ${agentDir}`,
+    ...edits.map((edit) =>
+      `WARN You edited ${edit.piPath} after omo moved to ${agentDir}; omo reads ${edit.agentPath}. Copy your change there (or run: omo config import-pi ${edit.file}).`),
+  ]
+}
+
+export function piConfigReport(options = {}) {
+  const env = options.env ?? process.env
+  const agentDir = options.agentDir ?? canonicalAgentDir(env)
+  const homeDir = options.homeDir ?? runtimeHome(env)
+  try {
+    return formatPiConfigLines(agentDir, findPiConfigEdits({ agentDir, homeDir }))
+  } catch (error) {
+    return [`INFO config dir: ${agentDir}`, `WARN could not check ${join(homeDir, ".pi", "agent")} for config edits: ${error.message}`]
+  }
+}

package/bin/lib/doctor.js

@@ -3,59 +3,20 @@ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs"
 import { homedir } from "node:os"
 import { join, resolve } from "node:path"
 import { canonicalAgentDir } from "./agent-dir.js"
-import { packageManifest, packageRoot, readJson, releaseChannel, resolveSenpi, updateTarget } from "./package-paths.js"
+import { fetchNpmDistTagsSync } from "./npm-dist-tags.js"
+import { channelDistTagVersion, packageManifest, packageRoot, readJson, releaseChannel, resolveSenpi, updateTarget } from "./package-paths.js"
 import { daemonReportLines } from "./daemon.js"
 import { migrationReport } from "./doctor-migration.js"
+import { launchSpecDoctorLines } from "./launch-spec-mode.js"
+import { piConfigReport } from "./doctor-pi-config.js"
 import { needsSetupSuggestion } from "./setup-detect.js"
 
-const NPM_DIST_TAGS_URL = "https://registry.npmjs.org/-/package/omo-ai/dist-tags"
-const NPM_FETCH_TIMEOUT_MS = 5000
-
-// Doctor is called without await from the launcher and the compiled entry, so the
-// registry lookup has to finish before we print. A bounded child fetch keeps that
-// synchronous and turns any network failure into "could not check".
-
 export function installedDistTag(version) {
   return releaseChannel(version)
 }
 
 export function latestFromDistTags(distTags, version) {
-  if (distTags === null || distTags === undefined || typeof distTags !== "object") return "could not check"
-  const value = distTags[installedDistTag(version)]
-  return typeof value === "string" && value.length > 0 ? value : "could not check"
-}
-
-function distTagsFetchScript(url, timeoutMs) {
-  return `
-const url = ${JSON.stringify(url)};
-const timeout = ${Number(timeoutMs)};
-const ac = new AbortController();
-const timer = setTimeout(() => ac.abort(), timeout);
-fetch(url, { signal: ac.signal, headers: { accept: "application/json" } })
-  .then((res) => { if (!res.ok) throw new Error(String(res.status)); return res.text(); })
-  .then((text) => { JSON.parse(text); process.stdout.write(text); })
-  .catch(() => { process.exitCode = 1; })
-  .finally(() => { clearTimeout(timer); });
-`
-}
-
-export function fetchNpmDistTagsSync(options = {}) {
-  const spawn = options.spawn ?? spawnSync
-  const url = options.url ?? NPM_DIST_TAGS_URL
-  const timeoutMs = options.timeoutMs ?? NPM_FETCH_TIMEOUT_MS
-  try {
-    const result = spawn(process.execPath, ["-e", distTagsFetchScript(url, timeoutMs)], {
-      encoding: "utf8",
-      timeout: timeoutMs + 500,
-      windowsHide: true,
-      env: process.env,
-    })
-    if (result.error || result.status !== 0 || typeof result.stdout !== "string" || result.stdout.trim() === "") return null
-    const parsed = JSON.parse(result.stdout)
-    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null
-  } catch {
-    return null
-  }
+  return channelDistTagVersion(distTags, version) ?? "could not check"
 }
 
 function readDistTags(options) {
@@ -430,9 +391,13 @@ export function runDoctor(inventory, args = [], options = {}) {
   lines.push(`INFO Update: ${updateTarget().command}`)
   lines.push(...migrationReport(options, updateTarget().command))
   lines.push(...warningsForSettings())
+  lines.push(...piConfigReport({ env: options.env, homeDir: options.homeDir }))
   lines.push(...staleEngineReport(options))
   lines.push(...retiredPayloadReport(options))
   lines.push(...transientMemoryReport(options))
+  const launchSpec = launchSpecDoctorLines(options.pluginRoot ?? join(packageRoot, "plugin"), options.launchSpecIo)
+  if (launchSpec.some((line) => line.startsWith("FAIL "))) failed = true
+  lines.push(...launchSpec)
   lines.push(...daemonReport(options), ...(options.computerUse ?? []), ...(options.categoryCoverage ?? []))
   if ((options.computerUse ?? []).some((line) => line.startsWith("FAIL "))) failed = true
   if (needsSetupSuggestion(inventory)) {

package/bin/lib/engine-dependency.js

@@ -0,0 +1,23 @@
+import { realpathSync, statSync } from "node:fs"
+import { basename, dirname, join } from "node:path"
+
+/**
+ * The directory of `name` as the engine installed at `senpiRoot` resolves it: Node's
+ * node_modules walk from senpi's real path. That one walk covers every install shape - a
+ * bundled senpi keeps the dependency in its own `node_modules`, npm hoists it beside senpi,
+ * and bun's isolated store links it beside senpi's real path in `.bun/<key>/node_modules` -
+ * so no caller may assume where the dependency lives. Returns undefined when nothing on the
+ * walk provides `name`.
+ */
+export function engineDependencyDir(senpiRoot, name) {
+  let current = realpathSync(senpiRoot)
+  while (true) {
+    if (basename(current) !== "node_modules") {
+      const candidate = join(current, "node_modules", name)
+      if (statSync(candidate, { throwIfNoEntry: false })?.isDirectory()) return candidate
+    }
+    const parent = dirname(current)
+    if (parent === current) return undefined
+    current = parent
+  }
+}

package/bin/lib/engine-models.js

@@ -11,13 +11,16 @@ import { existsSync, readFileSync } from "node:fs"
 import { join } from "node:path"
 import { pathToFileURL } from "node:url"
 import { parseJsonc } from "./jsonc.js"
+import { engineDependencyDir } from "./engine-dependency.js"
 import { resolveSenpi } from "./package-paths.js"
 
 // The same module the engine's model-runtime.js composes its builtins from
-// (`builtinProviderCatalog.builtinProviders()`), at the path claude-code-floor.js already relies on.
+// (`builtinProviderCatalog.builtinProviders()`), in the pi-ai the engine itself resolves.
 async function builtinCatalog() {
   const { packageRoot } = resolveSenpi()
-  const path = join(packageRoot, "node_modules", "@earendil-works", "pi-ai", "dist", "providers", "all.js")
+  const piAiRoot = engineDependencyDir(packageRoot, "@earendil-works/pi-ai")
+  if (piAiRoot === undefined) throw new Error(`the engine model catalog is missing: @earendil-works/pi-ai is not resolvable from ${packageRoot}`)
+  const path = join(piAiRoot, "dist", "providers", "all.js")
   if (!existsSync(path)) throw new Error(`the engine model catalog is missing at ${path}`)
   return (await import(pathToFileURL(path).href)).builtinProviders()
 }

package/bin/lib/engine-prepare.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
 import { floorClaudeCodeVersion } from "./claude-code-floor.js"
 import { prepareCompileSafeEngine } from "./compile-safe-engine.js"
+import { LAUNCH_SPEC_FILENAME, normalizeLaunchSpecMode } from "./launch-spec-mode.js"
 import { prepareRpcStreamErrors } from "./rpc-stream-errors.js"
 
 // Written inside the engine tree, so reinstalling or upgrading the engine drops it with the tree.
@@ -28,6 +29,20 @@ function isPreparedFor(senpiRoot, omoVersion) {
  * A failure is reported with the reinstall command and never blocks the launch: an unprepared
  * engine still runs, only without the guards.
  */
+/**
+ * The plugin's launch spec is re-checked on every launch, not behind the engine stamp: a reinstall
+ * of omo-ai under a loose umask rewrites the plugin while the engine tree keeps its stamp (#9208).
+ * Fail-open like the engine preparation: a failure warns with the manual fix and never blocks.
+ */
+export function preparePluginLaunchSpec({ pluginRoot, report = (line) => { process.stderr.write(line) }, io = {} }) {
+  try {
+    normalizeLaunchSpecMode(pluginRoot, io)
+  } catch (error) {
+    const path = join(pluginRoot, LAUNCH_SPEC_FILENAME)
+    report(`omo: could not make ${path} private (${error.message}); task children and teams need it, run: chmod 644 ${path}\n`)
+  }
+}
+
 export function ensureEnginePrepared({ senpiRoot, omoVersion, reinstallCommand, report = (line) => { process.stderr.write(line) } }) {
   if (isPreparedFor(senpiRoot, omoVersion)) return
   try {

package/bin/lib/launch-spec-mode.js

@@ -0,0 +1,78 @@
+import { chmodSync, lstatSync, statSync } from "node:fs"
+import { userInfo } from "node:os"
+import { join } from "node:path"
+
+export const LAUNCH_SPEC_FILENAME = "daemon-launch-spec.json"
+
+// The task host refuses a spec another user could rewrite (senpi-task `rejectInsecureMode`):
+// any group/world write bit, or an owner other than the current user.
+const WRITABLE_BY_OTHERS = 0o022
+
+function currentUid() {
+  return process.getuid?.()
+}
+
+function isMissing(error) {
+  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")
+}
+
+/**
+ * npm and bun extract package files with the installing user's umask, so a `umask 002` install
+ * leaves the spec 0664 and every task host start refuses it (#9208). Only the group/world write
+ * bits are removed, only on a regular file this user owns; a symlink is never followed, so a link
+ * (or a file owned by someone else) is left exactly as it is and the host still rejects it.
+ */
+export function normalizeLaunchSpecMode(pluginRoot, io = {}) {
+  const path = join(pluginRoot, LAUNCH_SPEC_FILENAME)
+  if ((io.platform ?? process.platform) === "win32") return { action: "skipped", path, reason: "win32" }
+  let stat
+  try {
+    stat = (io.lstat ?? lstatSync)(path)
+  } catch (error) {
+    if (isMissing(error)) return { action: "skipped", path, reason: "missing" }
+    throw error
+  }
+  if (!stat.isFile()) return { action: "left", path, reason: "not_regular_file" }
+  const uid = io.getuid === undefined ? currentUid() : io.getuid()
+  if (uid !== undefined && stat.uid !== uid) return { action: "left", path, reason: "foreign_owner" }
+  const from = stat.mode & 0o7777
+  if ((from & WRITABLE_BY_OTHERS) === 0) return { action: "unchanged", path }
+  const to = from & ~WRITABLE_BY_OTHERS
+  ;(io.chmod ?? chmodSync)(path, to)
+  return { action: "normalized", path, from, to }
+}
+
+function ownerName() {
+  try {
+    return userInfo().username
+  } catch {
+    return "$USER"
+  }
+}
+
+/**
+ * The doctor view applies the task host's own rule (the reader follows symlinks), so it reports
+ * exactly the specs the host would refuse: the ones a launch could not normalize.
+ */
+export function launchSpecDoctorLines(pluginRoot, io = {}) {
+  if ((io.platform ?? process.platform) === "win32") return []
+  const path = join(pluginRoot, LAUNCH_SPEC_FILENAME)
+  let stat
+  try {
+    stat = (io.stat ?? statSync)(path)
+  } catch (error) {
+    if (isMissing(error)) return []
+    throw error
+  }
+  if (!stat.isFile()) return []
+  const uid = io.getuid === undefined ? currentUid() : io.getuid()
+  const impact = "the task host refuses it, so process-mode task children and every team_create fail"
+  if (uid !== undefined && stat.uid !== uid) {
+    return [`FAIL launch spec: launch_spec_insecure: ${path} is not owned by you (uid ${stat.uid}); ${impact}. Fix: reinstall omo as this user, or run: sudo chown ${ownerName()} ${path}`]
+  }
+  if ((stat.mode & WRITABLE_BY_OTHERS) !== 0) {
+    const mode = (stat.mode & 0o777).toString(8)
+    return [`FAIL launch spec: launch_spec_insecure: ${path} is group/world-writable (${mode}); ${impact}. Fix: chmod 644 ${path}`]
+  }
+  return []
+}

package/bin/lib/launcher.js

@@ -6,29 +6,17 @@ import { doctorCoverageLines } from "./category-coverage.js"
 import { doctorComputerUseLines } from "./computer-use-doctor.js"
 import { runDaemonCommand } from "./daemon.js"
 import { runDoctor } from "./doctor.js"
-import { ensureEnginePrepared } from "./engine-prepare.js"
+import { ensureEnginePrepared, preparePluginLaunchSpec } from "./engine-prepare.js"
 import { migrateLegacyBunGlobalManifest } from "./legacy-bun-global-migration.js"
 import { adoptLegacyFlatState, canonicalAgentDir } from "./agent-dir.js"
 import { nearestNodeBin, packageManifest, packageRoot, readJson, releaseBanner, releaseChannel, resolveSenpi, updateTarget } from "./package-paths.js"
 import { runSelfUpdate } from "./self-update.js"
+import { isSelfUpdate } from "./update-args.js"
 import { detectHarnesses } from "./setup-detect.js"
 import { readSetupSuggestionCache, spawnSetupSuggestionRefresh } from "./setup-detect-cache.js"
 import { printSetupReport } from "./setup-report.js"
 
 const earlyCommands = new Set(["install", "remove", "list", "config", "auth", "app-server", "host"])
-const selfUpdateTargets = new Set(["self", "senpi", "omo"])
-// Updating extensions or model catalogs is the engine's job; everything else under `update`
-// would try to replace the pinned engine, so the launcher answers it instead.
-const engineUpdateTargets = new Set(["--extensions", "--models"])
-
-function isSelfUpdate(args) {
-  if (args[0] !== "update") return false
-  const rest = args.slice(1)
-  if (rest.length === 0) return true
-  if (rest.some((arg) => engineUpdateTargets.has(arg))) return false
-  return rest.every((arg) => arg.startsWith("-") || selfUpdateTargets.has(arg))
-}
-
 // Identity the engine adopts for this install: what the user sees, where state lives, which
 // environment prefix is read first, what goes on the wire, and which channel to check for
 // updates. The engine consumes this once and scrubs it, so nested engine processes are
@@ -136,6 +124,7 @@ function senpiEnvironment(senpiRoot) {
 }
 
 function preparedSenpi() {
+  preparePluginLaunchSpec({ pluginRoot: join(packageRoot, "plugin") })
   const senpi = resolveSenpi()
   ensureEnginePrepared({
     senpiRoot: senpi.packageRoot,
@@ -162,6 +151,12 @@ async function spawnSenpi(args, withExtension) {
   await spawnNode(senpi.cliPath, finalArgs, { env })
 }
 
+// Routine launch notices go straight to stderr: Bun renders every console.error line red on a
+// color terminal, which made a healthy startup look like a failure (#8442).
+function notice(line) {
+  process.stderr.write(`${line}\n`)
+}
+
 function isInteractiveDefault(args) {
   return process.stderr.isTTY === true && !args.includes("-p") && !args.includes("--print")
 }
@@ -180,7 +175,7 @@ function reportLegacyFlatAdoption() {
   }
   if (!result.adopted) return
   const moved = [...result.copied, ...result.backfilled].join(", ")
-  console.error(`omo: carried forward settings from the legacy ~/.omo layout (${moved})`)
+  notice(`omo: carried forward settings from the legacy ~/.omo layout (${moved})`)
 }
 
 /**
@@ -261,6 +256,8 @@ export async function runLauncher(args = process.argv.slice(2)) {
     return
   }
   if (command === "doctor") {
+    // Doctor is a launch too: it reports only what the launch-time preparation could not fix.
+    preparePluginLaunchSpec({ pluginRoot: join(packageRoot, "plugin") })
     const [categoryCoverage, computerUse] = args[1] === "--reap"
       ? [[], []]
       : await Promise.all([
@@ -301,9 +298,9 @@ export async function runLauncher(args = process.argv.slice(2)) {
     return
   }
   if (isInteractiveDefault(args)) {
-    console.error(releaseBanner())
+    notice(releaseBanner())
     if (process.stdout.isTTY === true && setupSuggestionForLaunch()) {
-      console.error("omo: sibling credentials detected; run `omo setup` to review them")
+      notice("omo: sibling credentials detected; run `omo setup` to review them")
     }
   }
   await spawnSenpi(args, true)

package/bin/lib/npm-dist-tags.js

@@ -0,0 +1,42 @@
+import { spawnSync } from "node:child_process"
+
+const NPM_DIST_TAGS_URL = "https://registry.npmjs.org/-/package/omo-ai/dist-tags"
+const NPM_FETCH_TIMEOUT_MS = 5000
+
+// The dist-tags of omo-ai, read by `omo doctor` for "Latest" and by `omo update` for the version it
+// installs. Doctor is called without await from the launcher and the compiled entry, so the
+// registry lookup has to finish before we print. A bounded child fetch keeps that synchronous
+// and turns any network failure into null.
+
+function distTagsFetchScript(url, timeoutMs) {
+  return `
+const url = ${JSON.stringify(url)};
+const timeout = ${Number(timeoutMs)};
+const ac = new AbortController();
+const timer = setTimeout(() => ac.abort(), timeout);
+fetch(url, { signal: ac.signal, headers: { accept: "application/json" } })
+  .then((res) => { if (!res.ok) throw new Error(String(res.status)); return res.text(); })
+  .then((text) => { JSON.parse(text); process.stdout.write(text); })
+  .catch(() => { process.exitCode = 1; })
+  .finally(() => { clearTimeout(timer); });
+`
+}
+
+export function fetchNpmDistTagsSync(options = {}) {
+  const spawn = options.spawn ?? spawnSync
+  const url = options.url ?? NPM_DIST_TAGS_URL
+  const timeoutMs = options.timeoutMs ?? NPM_FETCH_TIMEOUT_MS
+  try {
+    const result = spawn(process.execPath, ["-e", distTagsFetchScript(url, timeoutMs)], {
+      encoding: "utf8",
+      timeout: timeoutMs + 500,
+      windowsHide: true,
+      env: process.env,
+    })
+    if (result.error || result.status !== 0 || typeof result.stdout !== "string" || result.stdout.trim() === "") return null
+    const parsed = JSON.parse(result.stdout)
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null
+  } catch {
+    return null
+  }
+}

package/bin/lib/package-paths.js

@@ -20,6 +20,13 @@ export function releaseChannel(version = packageManifest().version) {
   return typeof version === "string" && version.includes("-") ? "beta" : "latest"
 }
 
+/** The version the npm dist-tag of `version`'s channel names, or undefined when the tags lack it. */
+export function channelDistTagVersion(distTags, version = packageManifest().version) {
+  if (distTags === null || distTags === undefined || typeof distTags !== "object") return undefined
+  const value = distTags[releaseChannel(version)]
+  return typeof value === "string" && value.length > 0 ? value : undefined
+}
+
 /** The startup banner line: a prerelease names its beta channel, a stable release does not. */
 export function releaseBanner(version = packageManifest().version) {
   return releaseChannel(version) === "beta" ? `omo (omo-ai beta ${version})` : `omo (omo-ai ${version})`
@@ -38,14 +45,27 @@ function installedVersion(root) {
   }
 }
 
+/**
+ * The package-manager command that updates the install at `root`. `targetVersion` pins the exact
+ * `omo-ai@<version>` spec; without it the channel spec is installed.
+ *
+ * @param {string} [root]
+ * @param {NodeJS.Platform} [platform]
+ * @param {string} [version]
+ * @param {string} [homeDir]
+ * @param {(path: string) => boolean} [exists]
+ * @param {string} [targetVersion]
+ */
 export function updateTarget(
   root = packageRoot,
   platform = process.platform,
   version = installedVersion(root),
   homeDir = process.env.HOME || process.env.USERPROFILE || homedir(),
   exists = existsSync,
+  targetVersion = undefined,
 ) {
-  const spec = channelPackageSpec(version)
+  // A resolved target installs that exact version; without one the channel spec is the only answer.
+  const spec = targetVersion === undefined ? channelPackageSpec(version) : `omo-ai@${targetVersion}`
   const updateCwd = dirname(join(root, "package.json"))
   const normalizedRoot = updateCwd.replaceAll("\\", "/")
   const normalizedHome = homeDir.replaceAll("\\", "/").replace(/\/+$/, "")

package/bin/lib/provider-map.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Derived from @code-yeongyu/senpi 2026.9.29 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
+  "_comment": "Derived from @code-yeongyu/senpi 2026.9.29-4 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
   "builtinProviderIds": [
     "alibaba-token-plan",
     "amazon-bedrock",

package/bin/lib/rpc-stream-errors.js

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
 
-const serialization = 'return JSON.stringify(value.type === "message_update" ? toJsonEvent(value) : value);'
-const guardedSerialization = `try {
+export const serialization = 'return JSON.stringify(value.type === "message_update" ? toJsonEvent(value) : value);'
+export const guardedSerialization = `try {
                     ${serialization}
                 } catch (error) {
                     if (!(error instanceof Error)) throw error;