v1.2.4

New Features

• omk provider adopt [<id>] [--from <source>] [--dry-run] [--json] [--status] copies an existing Codex CLI or Claude Code CLI login into OMK's credential store, so a subscription does not have to be signed in twice. Sources are read-only, --from narrows to the provider's own mapping, and no token material reaches output.

Fixed

• A credential store that cannot be read is no longer treated as "no credential": request auth refuses to substitute stale environment or models.json keys, agent-session reports the store error instead of advising /login, and a transient lock contention is retried instead of deciding authentication for the whole process lifetime.
• omk provider doctor accepts engine-registered API types (devin-agent, cursor-agent) instead of rejecting them as unsupported.
• Compaction commits survive append-only extension state written while the summary is generated; only provably inert custom tails are rebased, and a length stop that produced no summary text fails instead of committing an empty summary. The compaction source-entry bound is 65,536.
• addOAuthAccount merges imported accounts inside the storage lock (no lost update across concurrent sessions) and never overwrites a usable stored refresh token with an absent one.
• A post-dispatch rejection that provably never spawned (a deadline crossing between the dispatch journal and the supervisor call) now journals the exit and settles the run instead of leaving the execution id open forever.