omo-ai 5.1.38 → 5.1.40

package/bin/lib/provider-map.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Derived from @code-yeongyu/senpi 2026.10.19 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
+  "_comment": "Derived from @code-yeongyu/senpi 2026.10.19-2 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
   "builtinProviderIds": [
     "alibaba-token-plan",
     "amazon-bedrock",

package/bin/lib/setup-credentials.js

@@ -165,7 +165,13 @@ export async function planCredentials(runtime, target, customProviderIds) {
   }
 }
 
-export function applyCredentials(plan) {
+/**
+ * The stage's one writer. With `options.writeAuth` (the engine's locked credential store) the
+ * additions merge into whatever the store holds under its lock; the CLI path keeps its direct
+ * backup-and-write.
+ */
+export function applyCredentials(plan, options = {}) {
+  if (options.writeAuth !== undefined) return options.writeAuth(plan.target, plan.result.additions)
   writeAuthStore(plan.target, plan.current, plan.result.additions)
 }
 

package/bin/lib/setup-import.js

@@ -1,20 +1,16 @@
 /**
- * `omo setup`: every stage's plan is built first (nothing is written while planning), the one
- * summary renders them all, one consent covers the whole plan, then each stage applies its part.
- * `--ask-each` asks per stage instead; `--yes` consents; `--dry-run` prints the summary and exits.
+ * `omo setup`: every stage's plan is built first from the setup stream (nothing is written while
+ * planning), the one summary renders them all, one consent covers the whole plan, then each stage
+ * applies its part. `--ask-each` asks per stage instead; `--yes` consents; `--dry-run` prints the
+ * summary and exits.
  */
 
 import { homedir } from "node:os"
-import { dirname, join, relative } from "node:path"
+import { dirname, relative } from "node:path"
 import { createInterface } from "node:readline/promises"
 import { canonicalAgentDir } from "./agent-dir.js"
 import { setupCoverage } from "./category-coverage.js"
-import { detectHarnesses } from "./setup-detect.js"
-import { applyCredentials, credentialCounts, credentialPlanLines, credentialQuestion, opencodeOauthProviders, planCredentials } from "./setup-credentials.js"
-import { applyAssets, assetCounts, assetPlanLines, assetQuestion, planAssets } from "./setup-assets-import.js"
-import { planOpencodeProviders } from "./setup-opencode-providers.js"
-import { applyProviders, planProviders, providerCounts, providerPlanLines, providerQuestion } from "./setup-providers-import.js"
-import { applyModelChoices, modelChoiceCounts, modelChoicePlanLines, modelChoiceQuestion, planModelChoices } from "./setup-model-choices-import.js"
+import { applySetupStages, collectSetupPlans, scanSetup, setupStages } from "./setup-stream.js"
 import { displayPath, formatSetupSummary, TELEMETRY_NOTICE } from "./setup-summary.js"
 
 function write(lines) {
@@ -37,17 +33,6 @@ async function ask(question, options, defaultYes) {
   }
 }
 
-// In apply order: the model-choice stage runs last because a default model or category may name a
-// custom provider the stage before it carries. `present` stages report counts after the run.
-function stageList(plans) {
-  return [
-    { plan: plans.credentials, present: !plans.credentials.malformed, lines: credentialPlanLines, counts: credentialCounts, question: credentialQuestion, apply: applyCredentials },
-    { plan: plans.assets, present: plans.assets.present, lines: assetPlanLines, counts: assetCounts, question: assetQuestion, apply: applyAssets },
-    { plan: plans.providers, present: plans.providers.present, lines: providerPlanLines, counts: providerCounts, question: providerQuestion, apply: applyProviders },
-    { plan: plans.modelChoices, present: plans.modelChoices.present, lines: modelChoicePlanLines, counts: modelChoiceCounts, question: modelChoiceQuestion, apply: applyModelChoices },
-  ]
-}
-
 // The directories the whole plan writes into, a directory inside another one folded into it.
 function targetRoots(plans, agentDir, home) {
   const choiceDirs = plans.modelChoices.items.filter((item) => item.state === "pending").map((item) => dirname(item.target.path))
@@ -56,51 +41,20 @@ function targetRoots(plans, agentDir, home) {
   return roots.filter((path) => !roots.some((root) => inside(path, root))).map((path) => displayPath(path, home))
 }
 
-async function planAll(runtime, agentDir) {
-  const providerSource = planOpencodeProviders(runtime)
-  // A provider the custom-provider stage described (carried or refused with its reason) is reported there only.
-  const described = new Set([...providerSource.providers.map((item) => item.id), ...providerSource.skipped])
-  const credentials = await planCredentials(runtime, join(agentDir, "auth.json"), described)
-  const assets = planAssets({ runtime, agentDir })
-  const providers = planProviders(providerSource, agentDir)
-  const oauthProviders = opencodeOauthProviders(runtime)
-  const planChoices = (customProviders) => planModelChoices({ runtime, agentDir, customProviders, oauthProviders })
-  return { credentials, assets, providers, modelChoices: await planChoices(providers.result.added), planChoices }
-}
-
-// Per-stage consent. A declined provider stage leaves models.json as it is, so the model choices
-// are re-planned against it rather than against providers that will not exist.
-async function applyEach(plans, confirm) {
-  const applied = new Set()
-  for (const [index, stage] of stageList(plans).entries()) {
-    if (index === 3 && plans.providers.pending > 0 && !applied.has(2)) {
-      const shown = new Set(plans.modelChoices.notices)
-      plans.modelChoices = await plans.planChoices([])
-      stage.plan = plans.modelChoices
-      write(plans.modelChoices.notices.filter((notice) => !shown.has(notice)))
-    }
-    if (stage.plan.pending === 0) continue
-    if (!await confirm(stage.question(stage.plan), false)) continue
-    stage.apply(stage.plan)
-    applied.add(index)
-  }
-  return applied
-}
-
 export async function runSetup(args = process.argv.slice(2), options = {}) {
   const home = options.home ?? homedir()
   const env = options.env ?? process.env
   const agentDir = canonicalAgentDir(env, home)
   const runtime = { stdin: process.stdin, stdout: process.stdout, ...options, home, env }
   const dryRun = args.includes("--dry-run")
-  const inventory = await detectHarnesses(runtime)
-  const plans = await planAll(runtime, agentDir)
+  // The CLI has always carried OpenCode's custom providers; the onboarding RPC leaves them opt-in.
+  const { inventory, plans } = await collectSetupPlans(scanSetup(runtime, agentDir, { includeCustomProviders: true }))
   if (dryRun) process.stdout.write("DRY RUN: no files will be written\n")
   const categories = await setupCoverage({ agentDir, home, env, plans, loadRuntime: options.loadCoverageRuntime, loadEngine: options.loadCoverageEngine })
   process.stdout.write(formatSetupSummary({ home, agentDir, inventory, ...plans, categories }))
   process.stdout.write(`${TELEMETRY_NOTICE}\n`)
   if (dryRun) {
-    write(stageList(plans).filter((stage) => stage.present).flatMap((stage) => stage.lines(stage.plan)))
+    write(setupStages(plans).filter((stage) => stage.present).flatMap((stage) => stage.lines(stage.plan)))
     return
   }
   const confirm = async (question, defaultYes) => {
@@ -108,19 +62,15 @@ export async function runSetup(args = process.argv.slice(2), options = {}) {
     if (!accepted && runtime.stdin.isTTY === true) process.stdout.write("Import cancelled\n")
     return accepted
   }
-  const pending = stageList(plans).reduce((total, stage) => total + stage.plan.pending, 0)
+  const pending = setupStages(plans).reduce((total, stage) => total + stage.plan.pending, 0)
   let applied = new Set()
   if (pending === 0) {
     process.stdout.write("Nothing new to import.\n")
   } else if (args.includes("--ask-each")) {
-    applied = await applyEach(plans, confirm)
+    applied = await applySetupStages(plans, (stage) => confirm(stage.question(stage.plan), false), (line) => write([line]))
   } else {
     if (!await confirm(`Import all of the above into ${targetRoots(plans, agentDir, home).join(" and ")}? [Y/n] `, true)) return
-    for (const [index, stage] of stageList(plans).entries()) {
-      if (stage.plan.pending === 0) continue
-      stage.apply(stage.plan)
-      applied.add(index)
-    }
+    applied = await applySetupStages(plans, () => true, (line) => write([line]))
   }
-  write(stageList(plans).filter((stage, index) => stage.present && (applied.has(index) || stage.plan.pending === 0)).flatMap((stage) => stage.counts(stage.plan)))
+  write(setupStages(plans).filter((stage) => stage.present && (applied.has(stage.id) || stage.plan.pending === 0)).flatMap((stage) => stage.counts(stage.plan)))
 }

package/bin/lib/setup-model-choices-import.js

@@ -151,7 +151,7 @@ function writeText(target, text) {
 
 // Every edit is an insertion into the file's own text (comments, order and formatting survive);
 // a file the edit cannot reproduce exactly is left untouched and reported.
-function writeTarget(target, items) {
+function writeTarget(target, items, report) {
   try {
     let text = target.text ?? "{}\n"
     for (const item of items) {
@@ -160,7 +160,7 @@ function writeTarget(target, items) {
     writeText(target, text)
     return items.map((item) => item.label)
   } catch (error) {
-    process.stdout.write(`WARN senpi: could not edit ${target.path} safely (${error.message}); these model choices were not written: ${items.map((item) => item.label).join(", ")}\n`)
+    report(`WARN senpi: could not edit ${target.path} safely (${error.message}); these model choices were not written: ${items.map((item) => item.label).join(", ")}`)
     return []
   }
 }
@@ -198,9 +198,12 @@ export async function planModelChoices(stage) {
   }
 }
 
-/** The stage's one writer; records what it wrote as `plan.carried` for the counts. */
-export function applyModelChoices(plan) {
+/** The stage's one writer; records what it wrote as `plan.carried` for the counts. `options.report`
+ * receives the warning when a target cannot be edited (the CLI prints it; callers inside the
+ * engine route it to their own reply). */
+export function applyModelChoices(plan, options = {}) {
+  const report = options.report ?? ((line) => process.stdout.write(`${line}\n`))
   const pending = plan.items.filter((item) => item.state === "pending")
   const targets = [...new Set(pending.map((item) => item.target))]
-  plan.carried = targets.flatMap((target) => writeTarget(target, pending.filter((item) => item.target === target)))
+  plan.carried = targets.flatMap((target) => writeTarget(target, pending.filter((item) => item.target === target), report))
 }

package/bin/lib/setup-providers-import.js

@@ -101,18 +101,25 @@ function writeModels(path, target, added) {
 export function planProviders(source, agentDir) {
   const paths = { models: join(agentDir, "models.json"), auth: join(agentDir, "auth.json") }
   const models = readModelsTarget(paths.models)
-  const result = classify(source, models, readAuthStore(paths.auth))
+  const auth = readAuthStore(paths.auth)
+  const result = classify(source, models, auth)
   const notices = [...source.notices]
   if (result.blocked.length > 0) notices.push(`WARN senpi: malformed models.json; these custom providers were not imported: ${result.blocked.join(", ")}`)
-  return { paths, models, notices, result, skipped: source.skipped, present: source.providers.length > 0, pending: result.added.length }
+  return { paths, models, authBytes: auth.bytes, notices, result, skipped: source.skipped, present: source.providers.length > 0, pending: result.added.length }
 }
 
-export function applyProviders(plan) {
+/**
+ * The stage's one writer. With `options.writeAuth` the provider keys merge into whatever the
+ * store holds under its lock; the CLI path keeps its direct backup-and-write.
+ */
+export function applyProviders(plan, options = {}) {
   writeModels(plan.paths.models, plan.models, plan.result.added)
   // Re-read: the credential stage of the same run may have just written auth.json, after this plan
   // was classified. A mapped credential target can also be a custom provider id (claude-sdk-oauth ->
   // anthropic-subscription), so a key written since the plan is kept, never overwritten.
   const auth = readAuthStore(plan.paths.auth)
   plan.result.keys = auth.malformed ? [] : plan.result.keys.filter((item) => !Object.hasOwn(auth.entries, item.provider))
-  if (plan.result.keys.length > 0) writeAuthStore(plan.paths.auth, auth, plan.result.keys)
+  if (plan.result.keys.length === 0) return
+  if (options.writeAuth !== undefined) return options.writeAuth(plan.paths.auth, plan.result.keys)
+  writeAuthStore(plan.paths.auth, auth, plan.result.keys)
 }

package/bin/lib/setup-stream-items.js

@@ -0,0 +1,64 @@
+/**
+ * One `{id, kind, state, detail?}` row per thing a setup source found, built from the stage plan
+ * the summary renders. Rows travel over RPC, so they carry ids and states only: never a key.
+ */
+
+const MODEL_CHOICE_STATES = { pending: "import", kept: "exists", carried: "carried", blocked: "blocked" }
+
+function rows(ids, kind, state) {
+  return ids.map((id) => ({ id, kind, state }))
+}
+
+function detectItems(inventory) {
+  return inventory.harnesses
+    .filter((harness) => harness.installed)
+    .map((harness) => ({ id: harness.id, kind: "harness", state: "found", detail: `${harness.entryCount} login(s), ${harness.importableCount} importable` }))
+}
+
+function providerItems(plan) {
+  const { result } = plan
+  return [
+    ...result.added.map((provider) => ({ id: provider.id, kind: "provider", state: "import", detail: `${provider.config.models.length} model(s)` })),
+    ...rows(result.skippedExisting, "provider", "exists"),
+    ...rows(result.blocked, "provider", "blocked"),
+    ...rows(plan.skipped, "provider", "skipped"),
+  ]
+}
+
+function credentialItems(plan) {
+  if (plan.malformed) return []
+  const { result, guidance } = plan
+  return [
+    ...result.additions.map((item) => ({ id: item.provider, kind: "api-key", state: "import", detail: `from ${item.source}` })),
+    ...rows(result.skippedExisting, "api-key", "exists"),
+    ...guidance.logins.map((login) => ({ id: login.provider, kind: "oauth", state: login.state, ...(login.target === undefined ? {} : { detail: `/login ${login.target}` }) })),
+    ...rows(result.skippedUnmapped, "api-key", "unmapped"),
+  ]
+}
+
+function assetItems({ result }) {
+  return [
+    ...result.servers.added.map((server) => ({ id: server.name, kind: "mcp", state: "import" })),
+    ...rows(result.servers.skippedExisting, "mcp", "exists"),
+    ...rows(result.servers.blocked, "mcp", "blocked"),
+    ...result.skills.added.map((skill) => ({ id: skill.name, kind: "skill", state: "import" })),
+    ...rows(result.skills.skippedExisting, "skill", "exists"),
+    ...rows(result.skills.skippedBundled, "skill", "bundled"),
+  ]
+}
+
+function modelChoiceItems(plan) {
+  return plan.items.map((item) => ({ id: item.label, kind: item.kind, state: MODEL_CHOICE_STATES[item.state] ?? item.state }))
+}
+
+const ITEMS_BY_SOURCE = {
+  detect: detectItems,
+  providers: providerItems,
+  credentials: credentialItems,
+  assets: assetItems,
+  "model-choices": modelChoiceItems,
+}
+
+export function setupStageItems(source, plan) {
+  return ITEMS_BY_SOURCE[source](plan)
+}

package/bin/lib/setup-stream.d.ts

@@ -0,0 +1,94 @@
+// Types for setup-stream.js, which omo-senpi's onboarding scan imports across the package
+// boundary: omo-ai ships this module as plain JS, so it is the single source of the setup stream.
+
+export type SetupSource = "detect" | "providers" | "credentials" | "assets" | "model-choices"
+export type SetupStageId = "credentials" | "assets" | "providers" | "model-choices"
+
+export const SETUP_SOURCES: readonly SetupSource[]
+
+export type SetupItem = {
+  readonly id: string
+  readonly kind: string
+  readonly state: string
+  readonly detail?: string
+}
+
+export type SetupStagePlan = {
+  readonly pending: number
+  readonly notices?: readonly string[]
+  readonly [field: string]: unknown
+}
+
+export type SetupStageResult = {
+  readonly source: SetupSource
+  readonly items: readonly SetupItem[]
+  readonly notices: readonly string[]
+  readonly plan: SetupStagePlan
+  readonly disabled?: true
+  readonly error?: Error
+}
+
+export type SetupRuntime = {
+  readonly home: string
+  readonly env: Readonly<Record<string, string | undefined>>
+  readonly pluginRoot?: string
+  readonly loadModelCatalog?: () => Promise<readonly unknown[]>
+  readonly loadSqlite?: () => Promise<unknown>
+}
+
+export type SetupScanOptions = {
+  readonly includeCustomProviders?: boolean
+  readonly onSourceStart?: (source: SetupSource) => void
+}
+
+export type SetupInventory = {
+  readonly harnesses: readonly { readonly id: string; readonly installed: boolean }[]
+}
+
+export type SetupPlans = { readonly [stage: string]: unknown }
+
+export type SetupApplyStage = {
+  readonly id: SetupStageId
+  readonly plan: SetupStagePlan
+}
+
+export function canonicalAgentDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string
+
+export function scanSetup(runtime: SetupRuntime, agentDir: string, options?: SetupScanOptions): AsyncGenerator<SetupStageResult, void, undefined>
+
+export function collectSetupPlans(stream: AsyncIterable<SetupStageResult> | Iterable<SetupStageResult>): Promise<{ inventory: SetupInventory; plans: SetupPlans }>
+
+export type SetupAuthEntry = {
+  readonly provider: string
+  readonly key: string
+}
+
+/** Per-apply writer options: how credential additions and notice lines travel. */
+export type SetupApplyOptions = {
+  /** Routes credential additions through a locked credential store (the engine's AuthStorage) instead of the CLI's direct writer. */
+  readonly writeAuth?: (target: string, additions: readonly SetupAuthEntry[]) => Promise<void> | void
+  /** Receives the apply's notice lines (the CLI prints them; an RPC caller collects them into its reply). */
+  readonly report?: (line: string) => void
+}
+
+/** Refused by `applySetupStages` when `staleGuard` finds a target that changed since planning. */
+export class SetupStaleError extends Error {
+  readonly paths: readonly string[]
+  readonly applied: readonly SetupStageId[]
+}
+
+/** The target paths of the given stages whose content changed since their plans read them (content hash, never mtime alone). */
+export function staleSetupTargets(plans: SetupPlans, stageIds: Iterable<SetupStageId>, written?: ReadonlySet<string>): string[]
+
+/** True when any of the given stages would write into a credential store. */
+export function authWritesPending(plans: SetupPlans, stageIds: Iterable<SetupStageId>): boolean
+
+export function applySetupStages(
+  plans: SetupPlans,
+  confirm: (stage: SetupApplyStage) => boolean | Promise<boolean>,
+  report?: (line: string) => void,
+  options?: SetupApplyOptions & {
+    /** Re-checked right before each stage writes; a non-empty result refuses that stage with `SetupStaleError`. */
+    readonly staleGuard?: (stageId: SetupStageId, written: ReadonlySet<string>) => readonly string[] | undefined
+  },
+): Promise<Set<SetupStageId>>

package/bin/lib/setup-stream.js

@@ -0,0 +1,238 @@
+/**
+ * The detection and planning half of `omo setup` as one stream: each source is read, classified
+ * and yielded on its own, in the order later sources depend on. `omo setup` and the engine's
+ * onboarding scan RPC (omo-senpi `components/onboarding/scan-runtime.ts`) both consume it, so the
+ * import logic exists once. Nothing is written until a caller hands the collected plans to
+ * `applySetupStages`. No source opens a socket or calls a model: the model-choice stage reads the
+ * engine's offline model catalog only.
+ */
+
+import { createHash } from "node:crypto"
+import { existsSync, readFileSync } from "node:fs"
+import { join, resolve } from "node:path"
+import { detectHarnesses } from "./setup-detect.js"
+import { applyCredentials, credentialCounts, credentialPlanLines, credentialQuestion, opencodeOauthProviders, planCredentials } from "./setup-credentials.js"
+import { applyAssets, assetCounts, assetPlanLines, assetQuestion, planAssets } from "./setup-assets-import.js"
+import { planOpencodeProviders } from "./setup-opencode-providers.js"
+import { applyProviders, planProviders, providerCounts, providerPlanLines, providerQuestion } from "./setup-providers-import.js"
+import { applyModelChoices, modelChoiceCounts, modelChoicePlanLines, modelChoiceQuestion, planModelChoices } from "./setup-model-choices-import.js"
+import { setupStageItems } from "./setup-stream-items.js"
+
+export { canonicalAgentDir } from "./agent-dir.js"
+
+/** Every source, in stream order: a later source reads what an earlier one decided. */
+export const SETUP_SOURCES = ["detect", "providers", "credentials", "assets", "model-choices"]
+
+const NO_PROVIDERS = { providers: [], skipped: [], notices: [] }
+
+async function settle(work) {
+  try {
+    return { plan: await work() }
+  } catch (error) {
+    return { error: error instanceof Error ? error : new Error(String(error)) }
+  }
+}
+
+function stageResult(source, settled, disabled = false) {
+  if (settled.error !== undefined) return { source, items: [], notices: [], plan: { pending: 0 }, error: settled.error }
+  const plan = settled.plan
+  return { source, items: disabled ? [] : setupStageItems(source, plan), notices: plan.notices ?? [], plan, ...(disabled ? { disabled: true } : {}) }
+}
+
+/**
+ * Streams every source's plan. Custom providers (OpenCode `provider.<id>` blocks and catalog
+ * providers) are read only with `includeCustomProviders`; without it the provider stage yields
+ * disabled and empty, and a key for such a provider stays unmapped. `onSourceStart` is called
+ * right before an enabled source starts reading. A source that throws yields its `error` and the
+ * stream goes on with the sources after it.
+ */
+export async function* scanSetup(runtime, agentDir, options = {}) {
+  const includeCustomProviders = options.includeCustomProviders === true
+  const start = (source) => options.onSourceStart?.(source)
+
+  start("detect")
+  const detect = await settle(() => detectHarnesses(runtime))
+  yield stageResult("detect", detect)
+
+  if (includeCustomProviders) start("providers")
+  let providerSource = NO_PROVIDERS
+  const providers = await settle(() => {
+    if (includeCustomProviders) providerSource = planOpencodeProviders(runtime)
+    return planProviders(providerSource, agentDir)
+  })
+  if (providers.error !== undefined) providerSource = NO_PROVIDERS
+  yield stageResult("providers", providers, !includeCustomProviders)
+
+  start("credentials")
+  // A provider the custom-provider stage described (carried or refused with its reason) is reported there only.
+  const described = new Set([...providerSource.providers.map((item) => item.id), ...providerSource.skipped])
+  yield stageResult("credentials", await settle(() => planCredentials(runtime, join(agentDir, "auth.json"), described)))
+
+  start("assets")
+  yield stageResult("assets", await settle(() => planAssets({ runtime, agentDir })))
+
+  start("model-choices")
+  let planChoices
+  const modelChoices = await settle(() => {
+    const oauthProviders = opencodeOauthProviders(runtime)
+    planChoices = (customProviders) => planModelChoices({ runtime, agentDir, customProviders, oauthProviders })
+    return planChoices(providers.plan?.result.added ?? [])
+  })
+  yield { ...stageResult("model-choices", modelChoices), ...(planChoices === undefined ? {} : { replan: planChoices }) }
+}
+
+/**
+ * Drains a stream into the detect inventory and the stage plans `omo setup` renders and applies.
+ * The CLI cannot summarize a partial plan, so the first failed source is rethrown.
+ */
+export async function collectSetupPlans(stream) {
+  const plans = {}
+  let inventory = { harnesses: [] }
+  for await (const result of stream) {
+    if (result.error !== undefined) throw result.error
+    if (result.source === "detect") inventory = result.plan
+    else if (result.source === "model-choices") {
+      plans.modelChoices = result.plan
+      plans.planChoices = result.replan
+    } else plans[result.source] = result.plan
+  }
+  return { inventory, plans }
+}
+
+/**
+ * In apply order: the model-choice stage runs last because a default model or category may name a
+ * custom provider the stage before it carries. `present` stages report counts after the run. A
+ * stage whose source failed has no plan and is never applied.
+ */
+export function setupStages(plans) {
+  return [
+    { id: "credentials", plan: plans.credentials, present: plans.credentials !== undefined && !plans.credentials.malformed, lines: credentialPlanLines, counts: credentialCounts, question: credentialQuestion, apply: (plan, options) => applyCredentials(plan, options) },
+    { id: "assets", plan: plans.assets, present: plans.assets?.present === true, lines: assetPlanLines, counts: assetCounts, question: assetQuestion, apply: (plan) => applyAssets(plan) },
+    { id: "providers", plan: plans.providers, present: plans.providers?.present === true, lines: providerPlanLines, counts: providerCounts, question: providerQuestion, apply: (plan, options) => applyProviders(plan, options) },
+    { id: "model-choices", plan: plans.modelChoices, present: plans.modelChoices?.present === true, lines: modelChoicePlanLines, counts: modelChoiceCounts, question: modelChoiceQuestion, apply: (plan, options) => applyModelChoices(plan, options) },
+  ]
+}
+
+/** Thrown by `applySetupStages` when its `staleGuard` finds a target that changed since planning. */
+export class SetupStaleError extends Error {
+  constructor(paths, applied) {
+    super(`setup targets changed since planning: ${paths.join(", ")}`)
+    this.name = "SetupStaleError"
+    this.paths = paths
+    this.applied = applied
+  }
+}
+
+// Every plan holds the bytes its target had when it was read. A target whose content hash no longer
+// matches would be overwritten with the scan-time copy, so it counts as stale; an absent file is its
+// own expected state, and mtime alone never decides anything.
+function targetDigest(bytes) {
+  return createHash("sha256").update(bytes === undefined ? "\0absent" : bytes).digest("hex")
+}
+
+function staleTarget(path, expectedBytes) {
+  let current
+  try {
+    current = readFileSync(path, "utf8")
+  } catch {
+    current = undefined
+  }
+  return targetDigest(current) !== targetDigest(expectedBytes)
+}
+
+// A skill directory planned as new is stale once anything exists at its path: it is a directory, so
+// reading it as a file would always look absent (#10496 review).
+function staleAbsentPath(path) {
+  return existsSync(path)
+}
+
+/**
+ * The target paths of the given stages whose content changed since their plans read them. Paths in
+ * `written` were rewritten by an earlier stage of the same apply (the credentials stage and the
+ * provider keys share auth.json), so they are not the user's change and do not count (#10496 review).
+ */
+export function staleSetupTargets(plans, stageIds, written = new Set()) {
+  const changed = new Set()
+  const mark = (path, expectedBytes) => {
+    if (written.has(resolve(path))) return
+    if (staleTarget(path, expectedBytes)) changed.add(path)
+  }
+  const markAbsent = (path) => {
+    if (written.has(resolve(path))) return
+    if (staleAbsentPath(path)) changed.add(path)
+  }
+  for (const id of stageIds) {
+    if (id === "credentials") {
+      const plan = plans.credentials
+      if (plan === undefined || plan.malformed || plan.pending === 0) continue
+      mark(plan.target, plan.current?.bytes)
+    } else if (id === "assets") {
+      const plan = plans.assets
+      if (plan?.present !== true || plan.pending === 0) continue
+      if (plan.result.target.malformed !== true) mark(plan.paths.mcp, plan.result.target.bytes)
+      for (const skill of plan.result.skills.added) markAbsent(join(plan.paths.skills, skill.name))
+    } else if (id === "providers") {
+      const plan = plans.providers
+      if (plan?.present !== true || plan.pending === 0) continue
+      if (plan.models.malformed !== true) mark(plan.paths.models, plan.models.bytes)
+      if ((plan.result.keys?.length ?? 0) > 0) mark(plan.paths.auth, plan.authBytes)
+    } else if (id === "model-choices") {
+      const plan = plans.modelChoices
+      if (plan?.present !== true || plan.pending === 0) continue
+      for (const item of plan.items) {
+        if (item.state === "pending" && item.target.malformed !== true) mark(item.target.path, item.target.text)
+      }
+    }
+  }
+  return [...changed]
+}
+
+/** The files a stage writes when it applies (resolved), so later stages of one apply can tell them apart. */
+function stageWrittenPaths(plans, id) {
+  if (id === "credentials") return plans.credentials?.target === undefined ? [] : [plans.credentials.target]
+  if (id === "assets") return plans.assets?.paths?.mcp === undefined ? [] : [plans.assets.paths.mcp, ...(plans.assets.result?.skills?.added ?? []).map((skill) => join(plans.assets.paths.skills, skill.name))]
+  if (id === "providers") return [plans.providers?.paths?.models, plans.providers?.paths?.auth].filter((path) => path !== undefined)
+  if (id === "model-choices") return (plans.modelChoices?.items ?? []).map((item) => item.target?.path).filter((path) => path !== undefined)
+  return []
+}
+
+/** True when any of the given stages would write into a credential store. */
+export function authWritesPending(plans, stageIds) {
+  const ids = new Set(stageIds)
+  const credentials = ids.has("credentials") && plans.credentials !== undefined && !plans.credentials.malformed && plans.credentials.pending > 0
+  const keys = ids.has("providers") && plans.providers !== undefined && (plans.providers.result?.keys?.length ?? 0) > 0
+  return credentials || keys
+}
+
+/**
+ * Applies every stage `confirm` accepts and returns the ids it applied. A declined provider stage
+ * leaves models.json as it is, so the model choices are re-planned against it rather than against
+ * providers that will not exist; the notices that re-plan adds go to `report`. `options.writeAuth`
+ * routes credential additions through a locked credential store instead of the CLI's direct writer,
+ * and `options.staleGuard`, re-checked right before each write, refuses a stage whose target
+ * changed since planning by throwing `SetupStaleError`.
+ */
+export async function applySetupStages(plans, confirm, report = () => {}, options = {}) {
+  const applied = new Set()
+  // Files this apply already rewrote: a later stage's stale check must not mistake them for a
+  // user's change (the credentials stage and the provider keys share auth.json; #10496 review).
+  const written = new Set()
+  for (const stage of setupStages(plans)) {
+    if (stage.id === "model-choices" && stage.plan !== undefined && plans.planChoices !== undefined && (plans.providers?.pending ?? 0) > 0 && !applied.has("providers")) {
+      const shown = new Set(plans.modelChoices.notices)
+      plans.modelChoices = await plans.planChoices([])
+      stage.plan = plans.modelChoices
+      for (const notice of plans.modelChoices.notices) if (!shown.has(notice)) report(notice)
+    }
+    if (stage.plan === undefined || stage.plan.pending === 0) continue
+    if (!await confirm(stage)) continue
+    if (options.staleGuard !== undefined) {
+      const stale = options.staleGuard(stage.id, written)
+      if (stale !== undefined && stale.length > 0) throw new SetupStaleError(stale, [...applied])
+    }
+    await stage.apply(stage.plan, { ...options, report })
+    applied.add(stage.id)
+    for (const path of stageWrittenPaths(plans, stage.id)) written.add(resolve(path))
+  }
+  return applied
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omo-ai",
-  "version": "5.1.38",
+  "version": "5.1.40",
   "type": "module",
   "description": "OmO Native - the standalone omo command with the OMO extension built in: bun add -g omo-ai",
   "bin": {
@@ -17,7 +17,7 @@
     "postinstall": "node bin/senpi-patch.mjs"
   },
   "dependencies": {
-    "@code-yeongyu/senpi": "2026.10.19"
+    "@code-yeongyu/senpi": "2026.10.19-2"
   },
   "repository": {
     "type": "git",