omo-ai 5.1.35 → 5.1.40

package/bin/lib/engine-environment.js

@@ -0,0 +1,113 @@
+import { existsSync, realpathSync } from "node:fs"
+import { delimiter, isAbsolute, join, relative, sep } from "node:path"
+import { canonicalAgentDir } from "./agent-dir.js"
+import { HERDR_AGENT_MARKER } from "./herdr-agent-hint.js"
+import { nearestNodeBin, packageManifest, packageRoot, readJson, releaseChannel, updateTarget } from "./package-paths.js"
+
+// Identity the engine adopts for this install: what the user sees, where state lives, which
+// environment prefix is read first, what goes on the wire, and which channel to check for
+// updates. The engine consumes this once and scrubs it, so nested engine processes are
+// unaffected.
+function pluginChangelogSource() {
+  try {
+    const pluginRoot = join(packageRoot, "plugin")
+    const changelogPath = join(pluginRoot, "CHANGELOG.md")
+    if (!existsSync(changelogPath)) return undefined
+    const version = readJson(join(pluginRoot, "package.json")).version
+    return typeof version === "string" && version ? { path: changelogPath, version } : { path: changelogPath }
+  } catch {
+    return undefined
+  }
+}
+
+function brandProfile() {
+  const update = updateTarget()
+  // The changelog source is advisory: a missing plugin manifest or file must disable
+  // startup notes, never fail the launch.
+  const changelog = pluginChangelogSource()
+  return {
+    name: "OmO",
+    command: "omo",
+    displayVersion: packageManifest().version,
+    configDir: ".omo",
+    // Engine state lives at the canonical `~/.omo/agent`, never directly under the config
+    // directory: a flat home would disagree with the directory every omo surface resolves.
+    flatLayout: false,
+    envPrefix: "OMO",
+    userAgent: "omo",
+    originator: "omo",
+    ...(changelog ? { changelog } : {}),
+    update: {
+      packageName: "omo-ai",
+      distTag: releaseChannel(),
+      command: update.command,
+      changelogUrl: "https://github.com/code-yeongyu/oh-my-openagent/releases",
+    },
+  }
+}
+
+function canonicalPath(path) {
+  try {
+    return realpathSync.native(path)
+  } catch {
+    return path
+  }
+}
+
+function containsPath(root, target) {
+  const rel = relative(canonicalPath(root), canonicalPath(target))
+  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
+}
+
+// A compiled omo session exports its own payload as the brand-scoped package dir, and every shell it
+// spawns inherits that. The engine reads these names before the legacy PI_PACKAGE_DIR, so a release
+// omo started from such a shell would run on the foreign payload. A deliberate relocation names this
+// install's engine and survives; a root that does not contain the engine belongs to another install.
+function dropForeignPackageDirs(env, senpiRoot) {
+  for (const name of ["OMO_PACKAGE_DIR", "SENPI_PACKAGE_DIR"]) {
+    const root = env[name]
+    if (root && !containsPath(root, senpiRoot)) delete env[name]
+  }
+}
+
+/**
+ * The one environment every engine this launcher starts gets. `overrides` (a host call's own
+ * environment) is merged in here, before the last step, so nothing a caller passes can put back
+ * what this function removes.
+ */
+export function senpiEnvironment(senpiRoot, overrides = {}) {
+  const env = { ...process.env }
+  delete env.OMO_BIN
+  delete env.SENPI_BIN
+  dropForeignPackageDirs(env, senpiRoot)
+  // One directory for every surface. The legacy name travels too, so a bare senpi spawned by a
+  // tool inherits the same state instead of falling back to its own home.
+  const agentDir = canonicalAgentDir(env)
+  env.OMO_CODING_AGENT_DIR = agentDir
+  env.SENPI_CODING_AGENT_DIR = agentDir
+  // senpi's footer reads this marker to show the OmO Native badge for omo-ai installs, which load
+  // the plugin via --extension and therefore never match the settings-packages detection gates.
+  env.OMO_NATIVE = "1"
+  // This launcher already decided which runtime the product runs on, possibly by re-execing itself
+  // under bun. Handing that answer down stops the engine from making its own, conflicting choice.
+  env.SENPI_RUNTIME = process.versions.bun ? "bun" : "node"
+  env.SENPI_BRAND = JSON.stringify(brandProfile())
+  const binDir = nearestNodeBin(senpiRoot)
+  if (binDir) {
+    const pathKey = Object.keys(env).find((key) => key.toLowerCase() === "path") ?? "PATH"
+    const path = env[pathKey]
+    env[pathKey] = path ? `${binDir}${delimiter}${path}` : binDir
+    const shim = join(binDir, process.platform === "win32" ? "senpi.cmd" : "senpi")
+    if (existsSync(shim)) env.SENPI_BIN = shim
+  }
+  // Anything resolving the product by name must re-enter through this launcher, otherwise it
+  // would reach the engine directly and lose the brand.
+  env.OMO_BIN = join(packageRoot, "bin", "omo.js")
+  const merged = { ...env, ...overrides }
+  // Only the interactive launch writes this record of the herdr hint it set (herdr-agent-hint.js),
+  // after this function returns. No engine started here may carry one from the parent environment
+  // or from a caller's overrides: the plugin would treat it as the launcher's and could remove a
+  // HERDR_AGENT the user set (#10448).
+  delete merged[HERDR_AGENT_MARKER]
+  return merged
+}

package/bin/lib/herdr-agent-hint.js

@@ -0,0 +1,29 @@
+// herdr names the agent that owns a pane from the pane's foreground process (#10448). The engine
+// runs as `bun …/cli.js` (or `node …/cli.js`), which herdr cannot place, so `herdr agent prompt`
+// refused every OmO pane. HERDR_AGENT is the hint herdr reads from that process's environment; OmO
+// is a pi-family agent to herdr, which already lists these panes as `pi`.
+//
+// The hint is only for an interactive engine the user sees in the pane: a TTY on stdin and no
+// print or protocol flag before `--`. A HERDR_AGENT the user set is left alone. The launcher also
+// sets OMO_HERDR_AGENT_HINT to the value it wrote, so the plugin releases only a hint the launcher
+// set (packages/omo-senpi/src/extension/herdr-agent-hint.ts). Only this function writes that
+// record: one inherited from the parent environment is dropped first, so it can never vouch for a
+// HERDR_AGENT the user set.
+
+const NON_INTERACTIVE_FLAGS = new Set(["-p", "--print", "--mode"])
+
+export const HERDR_AGENT_LABEL = "pi"
+export const HERDR_AGENT_MARKER = "OMO_HERDR_AGENT_HINT"
+
+export function withHerdrAgentHint(env, args, stdinIsTTY = process.stdin.isTTY === true) {
+  delete env[HERDR_AGENT_MARKER]
+  if (env.HERDR_ENV !== "1") return env
+  if (env.HERDR_AGENT !== undefined && env.HERDR_AGENT !== "") return env
+  if (!stdinIsTTY) return env
+  const end = args.indexOf("--")
+  const flags = end === -1 ? args : args.slice(0, end)
+  if (flags.some((arg) => NON_INTERACTIVE_FLAGS.has(arg) || arg.startsWith("--mode="))) return env
+  env.HERDR_AGENT = HERDR_AGENT_LABEL
+  env[HERDR_AGENT_MARKER] = HERDR_AGENT_LABEL
+  return env
+}

package/bin/lib/launcher.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process"
-import { existsSync, realpathSync } from "node:fs"
-import { delimiter, isAbsolute, join, relative, sep } from "node:path"
+import { existsSync } from "node:fs"
+import { join } from "node:path"
 import { isEngineCommand } from "./engine-commands.js"
 import { spawnNode } from "./child-process.js"
 import { doctorCoverageLines } from "./category-coverage.js"
@@ -13,7 +13,9 @@ import { runDoctor } from "./doctor.js"
 import { ensureEnginePrepared, preparePluginLaunchSpec } from "./engine-prepare.js"
 import { migrateLegacyBunGlobalManifest } from "./legacy-bun-global-migration.js"
 import { adoptLegacyFlatState, canonicalAgentDir } from "./agent-dir.js"
-import { nearestNodeBin, packageManifest, packageRoot, readJson, releaseBanner, releaseChannel, resolveSenpi, updateTarget } from "./package-paths.js"
+import { senpiEnvironment } from "./engine-environment.js"
+import { withHerdrAgentHint } from "./herdr-agent-hint.js"
+import { packageManifest, packageRoot, readJson, releaseBanner, resolveSenpi, updateTarget } from "./package-paths.js"
 import { runSelfUpdate } from "./self-update.js"
 import { isSelfUpdate } from "./update-args.js"
 import { detectHarnesses } from "./setup-detect.js"
@@ -21,48 +23,6 @@ import { readSetupSuggestionCache, spawnSetupSuggestionRefresh } from "./setup-d
 import { printSetupReport } from "./setup-report.js"
 import { refuseRetiredCommand } from "./retired-command.js"
 
-// Identity the engine adopts for this install: what the user sees, where state lives, which
-// environment prefix is read first, what goes on the wire, and which channel to check for
-// updates. The engine consumes this once and scrubs it, so nested engine processes are
-// unaffected.
-function pluginChangelogSource() {
-  try {
-    const pluginRoot = join(packageRoot, "plugin")
-    const changelogPath = join(pluginRoot, "CHANGELOG.md")
-    if (!existsSync(changelogPath)) return undefined
-    const version = readJson(join(pluginRoot, "package.json")).version
-    return typeof version === "string" && version ? { path: changelogPath, version } : { path: changelogPath }
-  } catch {
-    return undefined
-  }
-}
-
-function brandProfile() {
-  const update = updateTarget()
-  // The changelog source is advisory: a missing plugin manifest or file must disable
-  // startup notes, never fail the launch.
-  const changelog = pluginChangelogSource()
-  return {
-    name: "OmO",
-    command: "omo",
-    displayVersion: packageManifest().version,
-    configDir: ".omo",
-    // Engine state lives at the canonical `~/.omo/agent`, never directly under the config
-    // directory: a flat home would disagree with the directory every omo surface resolves.
-    flatLayout: false,
-    envPrefix: "OMO",
-    userAgent: "omo",
-    originator: "omo",
-    ...(changelog ? { changelog } : {}),
-    update: {
-      packageName: "omo-ai",
-      distTag: releaseChannel(),
-      command: update.command,
-      changelogUrl: "https://github.com/code-yeongyu/oh-my-openagent/releases",
-    },
-  }
-}
-
 function engineVersion() {
   try {
     return readJson(join(resolveSenpi().packageRoot, "package.json")).version
@@ -71,62 +31,6 @@ function engineVersion() {
   }
 }
 
-function canonicalPath(path) {
-  try {
-    return realpathSync.native(path)
-  } catch {
-    return path
-  }
-}
-
-function containsPath(root, target) {
-  const rel = relative(canonicalPath(root), canonicalPath(target))
-  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
-}
-
-// A compiled omo session exports its own payload as the brand-scoped package dir, and every shell it
-// spawns inherits that. The engine reads these names before the legacy PI_PACKAGE_DIR, so a release
-// omo started from such a shell would run on the foreign payload. A deliberate relocation names this
-// install's engine and survives; a root that does not contain the engine belongs to another install.
-function dropForeignPackageDirs(env, senpiRoot) {
-  for (const name of ["OMO_PACKAGE_DIR", "SENPI_PACKAGE_DIR"]) {
-    const root = env[name]
-    if (root && !containsPath(root, senpiRoot)) delete env[name]
-  }
-}
-
-function senpiEnvironment(senpiRoot) {
-  const env = { ...process.env }
-  delete env.OMO_BIN
-  delete env.SENPI_BIN
-  dropForeignPackageDirs(env, senpiRoot)
-  // One directory for every surface. The legacy name travels too, so a bare senpi spawned by a
-  // tool inherits the same state instead of falling back to its own home.
-  const agentDir = canonicalAgentDir(env)
-  env.OMO_CODING_AGENT_DIR = agentDir
-  env.SENPI_CODING_AGENT_DIR = agentDir
-  // senpi's footer reads this marker to show the OmO Native badge for omo-ai installs, which load
-  // the plugin via --extension and therefore never match the settings-packages detection gates.
-  env.OMO_NATIVE = "1"
-  // This launcher already decided which runtime the product runs on, possibly by re-execing itself
-  // under bun. Handing that answer down stops the engine from making its own, conflicting choice.
-  env.SENPI_RUNTIME = process.versions.bun ? "bun" : "node"
-  env.SENPI_BRAND = JSON.stringify(brandProfile())
-
-  const binDir = nearestNodeBin(senpiRoot)
-  if (binDir) {
-    const pathKey = Object.keys(env).find((key) => key.toLowerCase() === "path") ?? "PATH"
-    const path = env[pathKey]
-    env[pathKey] = path ? `${binDir}${delimiter}${path}` : binDir
-    const shim = join(binDir, process.platform === "win32" ? "senpi.cmd" : "senpi")
-    if (existsSync(shim)) env.SENPI_BIN = shim
-  }
-  // Anything resolving the product by name must re-enter through this launcher, otherwise it
-  // would reach the engine directly and lose the brand.
-  env.OMO_BIN = join(packageRoot, "bin", "omo.js")
-  return env
-}
-
 function preparedSenpi() {
   preparePluginLaunchSpec({ pluginRoot: join(packageRoot, "plugin") })
   const senpi = resolveSenpi()
@@ -144,6 +48,7 @@ async function spawnSenpi(args, withExtension) {
     ? ["--extension", join(packageRoot, "plugin"), ...args]
     : args
   const env = senpiEnvironment(senpi.packageRoot)
+  if (withExtension) withHerdrAgentHint(env, args)
   if (process.platform !== "win32" && typeof process.execve === "function") {
     try {
       process.execve(process.execPath, [process.execPath, senpi.cliPath, ...finalArgs], env)
@@ -203,7 +108,7 @@ export function engineHostCall(engineArgs, options) {
   const senpi = preparedSenpi()
   const result = spawnSync(process.execPath, [senpi.cliPath, ...engineArgs], {
     encoding: "utf8",
-    env: { ...senpiEnvironment(senpi.packageRoot), ...options.env },
+    env: senpiEnvironment(senpi.packageRoot, options.env),
     windowsHide: true,
   })
   return { exitCode: result.status ?? 1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" }

package/bin/lib/provider-map.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Derived from @code-yeongyu/senpi 2026.10.16 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
+  "_comment": "Derived from @code-yeongyu/senpi 2026.10.19-2 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
   "builtinProviderIds": [
     "alibaba-token-plan",
     "amazon-bedrock",

package/bin/lib/setup-assets-import.js

@@ -119,7 +119,8 @@ export function planAssets({ runtime, agentDir }) {
   const notices = [...source.notices]
   const present = source.mcpServers.length > 0 || source.skills.length > 0
   const paths = { mcp: join(agentDir, "mcp.json"), skills: join(agentDir, "skills") }
-  const result = classifyAssets(source, paths, bundledSkillNames(join(packageRoot, "plugin", "skills")))
+  const pluginRoot = runtime.pluginRoot ?? join(packageRoot, "plugin")
+  const result = classifyAssets(source, paths, bundledSkillNames(join(pluginRoot, "skills")))
   if (result.servers.blocked.length > 0) notices.push(`WARN senpi: malformed mcp.json; these servers were not imported: ${result.servers.blocked.join(", ")}`)
   return {
     agentDir,

package/bin/lib/setup-credentials.js

@@ -165,7 +165,13 @@ export async function planCredentials(runtime, target, customProviderIds) {
   }
 }
 
-export function applyCredentials(plan) {
+/**
+ * The stage's one writer. With `options.writeAuth` (the engine's locked credential store) the
+ * additions merge into whatever the store holds under its lock; the CLI path keeps its direct
+ * backup-and-write.
+ */
+export function applyCredentials(plan, options = {}) {
+  if (options.writeAuth !== undefined) return options.writeAuth(plan.target, plan.result.additions)
   writeAuthStore(plan.target, plan.current, plan.result.additions)
 }
 

package/bin/lib/setup-import.js

@@ -1,20 +1,16 @@
 /**
- * `omo setup`: every stage's plan is built first (nothing is written while planning), the one
- * summary renders them all, one consent covers the whole plan, then each stage applies its part.
- * `--ask-each` asks per stage instead; `--yes` consents; `--dry-run` prints the summary and exits.
+ * `omo setup`: every stage's plan is built first from the setup stream (nothing is written while
+ * planning), the one summary renders them all, one consent covers the whole plan, then each stage
+ * applies its part. `--ask-each` asks per stage instead; `--yes` consents; `--dry-run` prints the
+ * summary and exits.
  */
 
 import { homedir } from "node:os"
-import { dirname, join, relative } from "node:path"
+import { dirname, relative } from "node:path"
 import { createInterface } from "node:readline/promises"
 import { canonicalAgentDir } from "./agent-dir.js"
 import { setupCoverage } from "./category-coverage.js"
-import { detectHarnesses } from "./setup-detect.js"
-import { applyCredentials, credentialCounts, credentialPlanLines, credentialQuestion, opencodeOauthProviders, planCredentials } from "./setup-credentials.js"
-import { applyAssets, assetCounts, assetPlanLines, assetQuestion, planAssets } from "./setup-assets-import.js"
-import { planOpencodeProviders } from "./setup-opencode-providers.js"
-import { applyProviders, planProviders, providerCounts, providerPlanLines, providerQuestion } from "./setup-providers-import.js"
-import { applyModelChoices, modelChoiceCounts, modelChoicePlanLines, modelChoiceQuestion, planModelChoices } from "./setup-model-choices-import.js"
+import { applySetupStages, collectSetupPlans, scanSetup, setupStages } from "./setup-stream.js"
 import { displayPath, formatSetupSummary, TELEMETRY_NOTICE } from "./setup-summary.js"
 
 function write(lines) {
@@ -37,17 +33,6 @@ async function ask(question, options, defaultYes) {
   }
 }
 
-// In apply order: the model-choice stage runs last because a default model or category may name a
-// custom provider the stage before it carries. `present` stages report counts after the run.
-function stageList(plans) {
-  return [
-    { plan: plans.credentials, present: !plans.credentials.malformed, lines: credentialPlanLines, counts: credentialCounts, question: credentialQuestion, apply: applyCredentials },
-    { plan: plans.assets, present: plans.assets.present, lines: assetPlanLines, counts: assetCounts, question: assetQuestion, apply: applyAssets },
-    { plan: plans.providers, present: plans.providers.present, lines: providerPlanLines, counts: providerCounts, question: providerQuestion, apply: applyProviders },
-    { plan: plans.modelChoices, present: plans.modelChoices.present, lines: modelChoicePlanLines, counts: modelChoiceCounts, question: modelChoiceQuestion, apply: applyModelChoices },
-  ]
-}
-
 // The directories the whole plan writes into, a directory inside another one folded into it.
 function targetRoots(plans, agentDir, home) {
   const choiceDirs = plans.modelChoices.items.filter((item) => item.state === "pending").map((item) => dirname(item.target.path))
@@ -56,51 +41,20 @@ function targetRoots(plans, agentDir, home) {
   return roots.filter((path) => !roots.some((root) => inside(path, root))).map((path) => displayPath(path, home))
 }
 
-async function planAll(runtime, agentDir) {
-  const providerSource = planOpencodeProviders(runtime)
-  // A provider the custom-provider stage described (carried or refused with its reason) is reported there only.
-  const described = new Set([...providerSource.providers.map((item) => item.id), ...providerSource.skipped])
-  const credentials = await planCredentials(runtime, join(agentDir, "auth.json"), described)
-  const assets = planAssets({ runtime, agentDir })
-  const providers = planProviders(providerSource, agentDir)
-  const oauthProviders = opencodeOauthProviders(runtime)
-  const planChoices = (customProviders) => planModelChoices({ runtime, agentDir, customProviders, oauthProviders })
-  return { credentials, assets, providers, modelChoices: await planChoices(providers.result.added), planChoices }
-}
-
-// Per-stage consent. A declined provider stage leaves models.json as it is, so the model choices
-// are re-planned against it rather than against providers that will not exist.
-async function applyEach(plans, confirm) {
-  const applied = new Set()
-  for (const [index, stage] of stageList(plans).entries()) {
-    if (index === 3 && plans.providers.pending > 0 && !applied.has(2)) {
-      const shown = new Set(plans.modelChoices.notices)
-      plans.modelChoices = await plans.planChoices([])
-      stage.plan = plans.modelChoices
-      write(plans.modelChoices.notices.filter((notice) => !shown.has(notice)))
-    }
-    if (stage.plan.pending === 0) continue
-    if (!await confirm(stage.question(stage.plan), false)) continue
-    stage.apply(stage.plan)
-    applied.add(index)
-  }
-  return applied
-}
-
 export async function runSetup(args = process.argv.slice(2), options = {}) {
   const home = options.home ?? homedir()
   const env = options.env ?? process.env
   const agentDir = canonicalAgentDir(env, home)
   const runtime = { stdin: process.stdin, stdout: process.stdout, ...options, home, env }
   const dryRun = args.includes("--dry-run")
-  const inventory = await detectHarnesses(runtime)
-  const plans = await planAll(runtime, agentDir)
+  // The CLI has always carried OpenCode's custom providers; the onboarding RPC leaves them opt-in.
+  const { inventory, plans } = await collectSetupPlans(scanSetup(runtime, agentDir, { includeCustomProviders: true }))
   if (dryRun) process.stdout.write("DRY RUN: no files will be written\n")
   const categories = await setupCoverage({ agentDir, home, env, plans, loadRuntime: options.loadCoverageRuntime, loadEngine: options.loadCoverageEngine })
   process.stdout.write(formatSetupSummary({ home, agentDir, inventory, ...plans, categories }))
   process.stdout.write(`${TELEMETRY_NOTICE}\n`)
   if (dryRun) {
-    write(stageList(plans).filter((stage) => stage.present).flatMap((stage) => stage.lines(stage.plan)))
+    write(setupStages(plans).filter((stage) => stage.present).flatMap((stage) => stage.lines(stage.plan)))
     return
   }
   const confirm = async (question, defaultYes) => {
@@ -108,19 +62,15 @@ export async function runSetup(args = process.argv.slice(2), options = {}) {
     if (!accepted && runtime.stdin.isTTY === true) process.stdout.write("Import cancelled\n")
     return accepted
   }
-  const pending = stageList(plans).reduce((total, stage) => total + stage.plan.pending, 0)
+  const pending = setupStages(plans).reduce((total, stage) => total + stage.plan.pending, 0)
   let applied = new Set()
   if (pending === 0) {
     process.stdout.write("Nothing new to import.\n")
   } else if (args.includes("--ask-each")) {
-    applied = await applyEach(plans, confirm)
+    applied = await applySetupStages(plans, (stage) => confirm(stage.question(stage.plan), false), (line) => write([line]))
   } else {
     if (!await confirm(`Import all of the above into ${targetRoots(plans, agentDir, home).join(" and ")}? [Y/n] `, true)) return
-    for (const [index, stage] of stageList(plans).entries()) {
-      if (stage.plan.pending === 0) continue
-      stage.apply(stage.plan)
-      applied.add(index)
-    }
+    applied = await applySetupStages(plans, () => true, (line) => write([line]))
   }
-  write(stageList(plans).filter((stage, index) => stage.present && (applied.has(index) || stage.plan.pending === 0)).flatMap((stage) => stage.counts(stage.plan)))
+  write(setupStages(plans).filter((stage) => stage.present && (applied.has(stage.id) || stage.plan.pending === 0)).flatMap((stage) => stage.counts(stage.plan)))
 }

package/bin/lib/setup-model-choices-import.js

@@ -151,7 +151,7 @@ function writeText(target, text) {
 
 // Every edit is an insertion into the file's own text (comments, order and formatting survive);
 // a file the edit cannot reproduce exactly is left untouched and reported.
-function writeTarget(target, items) {
+function writeTarget(target, items, report) {
   try {
     let text = target.text ?? "{}\n"
     for (const item of items) {
@@ -160,7 +160,7 @@ function writeTarget(target, items) {
     writeText(target, text)
     return items.map((item) => item.label)
   } catch (error) {
-    process.stdout.write(`WARN senpi: could not edit ${target.path} safely (${error.message}); these model choices were not written: ${items.map((item) => item.label).join(", ")}\n`)
+    report(`WARN senpi: could not edit ${target.path} safely (${error.message}); these model choices were not written: ${items.map((item) => item.label).join(", ")}`)
     return []
   }
 }
@@ -177,7 +177,11 @@ export async function planModelChoices(stage) {
   if (!hasModelChoices(raw)) return empty
   let registry
   try {
-    registry = await (stage.loadRegistry ?? loadEngineModels)({ agentDir: stage.agentDir, customProviders: stage.customProviders })
+    registry = await (stage.loadRegistry ?? loadEngineModels)({
+      agentDir: stage.agentDir,
+      customProviders: stage.customProviders,
+      loadCatalog: stage.runtime.loadModelCatalog,
+    })
   } catch (error) {
     return { ...empty, notices: [...raw.notices, `WARN senpi: could not read the engine's model list (${error.message}); model choices were not carried`] }
   }
@@ -194,9 +198,12 @@ export async function planModelChoices(stage) {
   }
 }
 
-/** The stage's one writer; records what it wrote as `plan.carried` for the counts. */
-export function applyModelChoices(plan) {
+/** The stage's one writer; records what it wrote as `plan.carried` for the counts. `options.report`
+ * receives the warning when a target cannot be edited (the CLI prints it; callers inside the
+ * engine route it to their own reply). */
+export function applyModelChoices(plan, options = {}) {
+  const report = options.report ?? ((line) => process.stdout.write(`${line}\n`))
   const pending = plan.items.filter((item) => item.state === "pending")
   const targets = [...new Set(pending.map((item) => item.target))]
-  plan.carried = targets.flatMap((target) => writeTarget(target, pending.filter((item) => item.target === target)))
+  plan.carried = targets.flatMap((target) => writeTarget(target, pending.filter((item) => item.target === target), report))
 }

package/bin/lib/setup-providers-import.js

@@ -101,18 +101,25 @@ function writeModels(path, target, added) {
 export function planProviders(source, agentDir) {
   const paths = { models: join(agentDir, "models.json"), auth: join(agentDir, "auth.json") }
   const models = readModelsTarget(paths.models)
-  const result = classify(source, models, readAuthStore(paths.auth))
+  const auth = readAuthStore(paths.auth)
+  const result = classify(source, models, auth)
   const notices = [...source.notices]
   if (result.blocked.length > 0) notices.push(`WARN senpi: malformed models.json; these custom providers were not imported: ${result.blocked.join(", ")}`)
-  return { paths, models, notices, result, skipped: source.skipped, present: source.providers.length > 0, pending: result.added.length }
+  return { paths, models, authBytes: auth.bytes, notices, result, skipped: source.skipped, present: source.providers.length > 0, pending: result.added.length }
 }
 
-export function applyProviders(plan) {
+/**
+ * The stage's one writer. With `options.writeAuth` the provider keys merge into whatever the
+ * store holds under its lock; the CLI path keeps its direct backup-and-write.
+ */
+export function applyProviders(plan, options = {}) {
   writeModels(plan.paths.models, plan.models, plan.result.added)
   // Re-read: the credential stage of the same run may have just written auth.json, after this plan
   // was classified. A mapped credential target can also be a custom provider id (claude-sdk-oauth ->
   // anthropic-subscription), so a key written since the plan is kept, never overwritten.
   const auth = readAuthStore(plan.paths.auth)
   plan.result.keys = auth.malformed ? [] : plan.result.keys.filter((item) => !Object.hasOwn(auth.entries, item.provider))
-  if (plan.result.keys.length > 0) writeAuthStore(plan.paths.auth, auth, plan.result.keys)
+  if (plan.result.keys.length === 0) return
+  if (options.writeAuth !== undefined) return options.writeAuth(plan.paths.auth, plan.result.keys)
+  writeAuthStore(plan.paths.auth, auth, plan.result.keys)
 }

package/bin/lib/setup-stream-items.js

@@ -0,0 +1,64 @@
+/**
+ * One `{id, kind, state, detail?}` row per thing a setup source found, built from the stage plan
+ * the summary renders. Rows travel over RPC, so they carry ids and states only: never a key.
+ */
+
+const MODEL_CHOICE_STATES = { pending: "import", kept: "exists", carried: "carried", blocked: "blocked" }
+
+function rows(ids, kind, state) {
+  return ids.map((id) => ({ id, kind, state }))
+}
+
+function detectItems(inventory) {
+  return inventory.harnesses
+    .filter((harness) => harness.installed)
+    .map((harness) => ({ id: harness.id, kind: "harness", state: "found", detail: `${harness.entryCount} login(s), ${harness.importableCount} importable` }))
+}
+
+function providerItems(plan) {
+  const { result } = plan
+  return [
+    ...result.added.map((provider) => ({ id: provider.id, kind: "provider", state: "import", detail: `${provider.config.models.length} model(s)` })),
+    ...rows(result.skippedExisting, "provider", "exists"),
+    ...rows(result.blocked, "provider", "blocked"),
+    ...rows(plan.skipped, "provider", "skipped"),
+  ]
+}
+
+function credentialItems(plan) {
+  if (plan.malformed) return []
+  const { result, guidance } = plan
+  return [
+    ...result.additions.map((item) => ({ id: item.provider, kind: "api-key", state: "import", detail: `from ${item.source}` })),
+    ...rows(result.skippedExisting, "api-key", "exists"),
+    ...guidance.logins.map((login) => ({ id: login.provider, kind: "oauth", state: login.state, ...(login.target === undefined ? {} : { detail: `/login ${login.target}` }) })),
+    ...rows(result.skippedUnmapped, "api-key", "unmapped"),
+  ]
+}
+
+function assetItems({ result }) {
+  return [
+    ...result.servers.added.map((server) => ({ id: server.name, kind: "mcp", state: "import" })),
+    ...rows(result.servers.skippedExisting, "mcp", "exists"),
+    ...rows(result.servers.blocked, "mcp", "blocked"),
+    ...result.skills.added.map((skill) => ({ id: skill.name, kind: "skill", state: "import" })),
+    ...rows(result.skills.skippedExisting, "skill", "exists"),
+    ...rows(result.skills.skippedBundled, "skill", "bundled"),
+  ]
+}
+
+function modelChoiceItems(plan) {
+  return plan.items.map((item) => ({ id: item.label, kind: item.kind, state: MODEL_CHOICE_STATES[item.state] ?? item.state }))
+}
+
+const ITEMS_BY_SOURCE = {
+  detect: detectItems,
+  providers: providerItems,
+  credentials: credentialItems,
+  assets: assetItems,
+  "model-choices": modelChoiceItems,
+}
+
+export function setupStageItems(source, plan) {
+  return ITEMS_BY_SOURCE[source](plan)
+}