@elisym/mcp 0.15.0 → 0.15.2

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, decodeJobPayload, utf8ByteLength, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
+import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, decodeJobPayload, utf8ByteLength, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, formatNetworkBaseline, KNOWN_ASSETS } from '@elisym/sdk';
 import { listAgents, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, resolveAgent, loadAgent, globalConfigPath, writeYaml, writeFileAtomic as writeFileAtomic$1 } from '@elisym/sdk/agent-store';
 import { createIrohTransport, loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
 import { getBase58Encoder, getBase58Decoder, generateKeyPairSigner, createSolanaRpc, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, createKeyPairSignerFromBytes, isAddress } from '@solana/kit';
 import { Command } from 'commander';
 import { generateSecretKey, nip19, getPublicKey } from 'nostr-tools';
-import { realpath, readFile, stat, rm, writeFile, rename, unlink } from 'node:fs/promises';
-import { tmpdir, homedir, platform } from 'node:os';
+import { realpath, readFile, stat, mkdir, rm, writeFile, rename, unlink } from 'node:fs/promises';
+import { tmpdir, platform, homedir } from 'node:os';
 import { dirname, join, resolve, isAbsolute, basename, relative } from 'node:path';
 import { readFileSync, mkdtempSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -370,6 +370,9 @@ function decodeNpub(npub) {
 function elisymPackageArgs() {
   return ["-y", `@elisym/mcp@~${PACKAGE_VERSION}`];
 }
+function userHome() {
+  return process.env.HOME ?? homedir();
+}
 function validateClientName(name) {
   if (name === void 0) {
     return;
@@ -399,8 +402,9 @@ async function safeRewriteJson(path, expectedRaw, newConfig) {
 var CLIENTS = [
   {
     name: "claude-desktop",
+    format: "json",
     configPath() {
-      const home = homedir();
+      const home = userHome();
       switch (platform()) {
         case "darwin":
           return join(home, "Library/Application Support/Claude/claude_desktop_config.json");
@@ -413,21 +417,29 @@ var CLIENTS = [
   },
   {
     name: "claude-code",
+    format: "json",
     // Claude Code CLI keeps user-scope MCP servers under `mcpServers` at the top
     // level of `~/.claude.json`. Project-scope (`.mcp.json` in cwd) and local-scope
     // (`projects.<path>.mcpServers` inside the same file) are deliberately not
     // touched here - this installer only writes user scope so the server is
     // available across all projects.
-    configPath: () => join(homedir(), ".claude.json")
+    configPath: () => join(userHome(), ".claude.json")
   },
   {
     name: "cursor",
-    configPath: () => join(homedir(), ".cursor/mcp.json")
+    format: "json",
+    configPath: () => join(userHome(), ".cursor/mcp.json")
+  },
+  {
+    name: "codex",
+    format: "codex-toml",
+    configPath: () => join(userHome(), ".codex/config.toml")
   },
   {
     name: "windsurf",
+    format: "json",
     configPath() {
-      const home = homedir();
+      const home = userHome();
       if (platform() === "darwin") {
         return join(home, "Library/Application Support/Windsurf/mcp.json");
       }
@@ -480,7 +492,7 @@ async function runInstall(options) {
       continue;
     }
     try {
-      const result = await installToConfig(path, entry, effectiveAgent);
+      const result = client.format === "codex-toml" ? await installToCodexConfig(path, entry, options.agent) : await installToConfig(path, entry, options.agent);
       if (result === "installed") {
         console.log(`Installed to ${client.name}: ${path}`);
         installed++;
@@ -499,7 +511,7 @@ async function runInstall(options) {
   }
 }
 async function resolveDefaultAgent() {
-  const agents = await listAgents(process.cwd());
+  const agents = await listAgents(userHome());
   const [first, second] = agents;
   if (!first) {
     return { kind: "none" };
@@ -523,6 +535,20 @@ async function runUpdate(options) {
     if (!path) {
       continue;
     }
+    if (client.format === "codex-toml") {
+      try {
+        const result = await updateCodexConfig(path, options.agent);
+        if (result === "updated") {
+          console.log(`Updated ${client.name}: ${path} -> @elisym/mcp@~${PACKAGE_VERSION}`);
+          updated++;
+        }
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          console.log(`Skipped ${client.name}: ${err.message}`);
+        }
+      }
+      continue;
+    }
     let raw;
     try {
       raw = await readFile(path, "utf-8");
@@ -561,12 +587,16 @@ async function runUpdate(options) {
     }
     const entry = existing;
     const newArgs = elisymPackageArgs();
+    const packageArg = newArgs[1];
+    if (packageArg === void 0) {
+      throw new Error("Internal error: missing package argument for elisym MCP install.");
+    }
     if (Array.isArray(entry.args)) {
       const idx = entry.args.findIndex(
         (a) => typeof a === "string" && a.startsWith("@elisym/mcp@")
       );
       if (idx >= 0) {
-        entry.args[idx] = newArgs[1];
+        entry.args[idx] = packageArg;
       } else {
         entry.args = newArgs;
       }
@@ -601,6 +631,16 @@ async function runUninstall(options) {
     if (!path) {
       continue;
     }
+    if (client.format === "codex-toml") {
+      try {
+        const result = await uninstallFromCodexConfig(path);
+        if (result === "removed") {
+          console.log(`Removed from ${client.name}: ${path}`);
+        }
+      } catch {
+      }
+      continue;
+    }
     let raw;
     try {
       raw = await readFile(path, "utf-8");
@@ -634,8 +674,7 @@ async function runList() {
     }
     try {
       const raw = await readFile(path, "utf-8");
-      const config = JSON.parse(raw);
-      const installed = !!config.mcpServers?.elisym;
+      const installed = client.format === "codex-toml" ? findCodexElisymBlock(raw) !== null : !!JSON.parse(raw).mcpServers?.elisym;
       console.log(`${client.name}: ${installed ? "installed" : "available"} (${path})`);
     } catch {
       console.log(`${client.name}: not found`);
@@ -687,6 +726,457 @@ async function installToConfig(path, entry, agentRebind) {
   await safeRewriteJson(path, raw, config);
   return "installed";
 }
+function findCodexElisymBlock(raw) {
+  const table = findTomlTableRange(raw, "mcp_servers.elisym");
+  if (!table) {
+    return null;
+  }
+  return { start: table.start, end: table.end, body: raw.slice(table.start, table.end) };
+}
+function findTomlTableRange(raw, path) {
+  return findTomlTableRanges(raw).find((table) => table.path === path) ?? null;
+}
+function findTomlTableRanges(raw) {
+  const lines = raw.match(/^.*(?:\n|$)/gm) ?? [];
+  const offsets = [];
+  let offset = 0;
+  for (const line of lines) {
+    offsets.push(offset);
+    offset += line.length;
+  }
+  const ranges = [];
+  for (const [lineIndex, line] of lines.entries()) {
+    const path = parseTomlTableHeader(line);
+    if (!path) {
+      continue;
+    }
+    let end = raw.length;
+    for (let nextLineIndex = lineIndex + 1; nextLineIndex < lines.length; nextLineIndex++) {
+      if (parseTomlTableHeader(lines[nextLineIndex] ?? "")) {
+        end = offsets[nextLineIndex] ?? raw.length;
+        break;
+      }
+    }
+    ranges.push({ start: offsets[lineIndex] ?? 0, end, path });
+  }
+  return ranges;
+}
+function parseTomlTableHeader(line) {
+  const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line.trimEnd());
+  return match ? match[1] : null;
+}
+function parseCodexEnv(block) {
+  const env = {};
+  let section = "other";
+  for (const line of block.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      if (/^\[mcp_servers\.elisym\]\s*(?:#.*)?$/.test(trimmed)) {
+        section = "elisym";
+      } else if (/^\[mcp_servers\.elisym\.env\]\s*(?:#.*)?$/.test(trimmed)) {
+        section = "env";
+      } else {
+        section = "other";
+      }
+      continue;
+    }
+    if (trimmed === "" || trimmed.startsWith("#")) {
+      continue;
+    }
+    if (section === "elisym") {
+      Object.assign(env, parseCodexInlineEnv(trimmed));
+    } else if (section === "env") {
+      const match = /^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+?)\s*(?:#.*)?$/.exec(trimmed);
+      if (!match) {
+        continue;
+      }
+      const [, key, rawValue] = match;
+      const value = parseTomlString(rawValue);
+      if (value !== void 0) {
+        env[key] = value;
+      }
+    }
+  }
+  return env;
+}
+function parseCodexInlineEnv(line) {
+  const env = {};
+  const match = /^env\s*=\s*\{(.*)\}\s*(?:#.*)?$/.exec(line);
+  if (!match) {
+    return env;
+  }
+  const [, body] = match;
+  for (const entry of splitInlineTableEntries(body)) {
+    const entryMatch = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+?)\s*$/.exec(entry);
+    if (!entryMatch) {
+      continue;
+    }
+    const [, key, rawValue] = entryMatch;
+    const value = parseTomlString(rawValue);
+    if (value !== void 0) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+function splitInlineTableEntries(body) {
+  const entries = [];
+  let current = "";
+  let inString = false;
+  let escaped = false;
+  for (const char of body) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\" && inString) {
+      current += char;
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      current += char;
+      inString = !inString;
+      continue;
+    }
+    if (char === "," && !inString) {
+      entries.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (current.trim() !== "") {
+    entries.push(current);
+  }
+  return entries;
+}
+function parseTomlString(rawValue) {
+  if (rawValue.startsWith("'") && rawValue.endsWith("'")) {
+    return rawValue.slice(1, -1);
+  }
+  try {
+    return JSON.parse(rawValue);
+  } catch {
+    return void 0;
+  }
+}
+function quoteTomlString(value) {
+  return JSON.stringify(value);
+}
+function renderTomlStringArray(values) {
+  return `[${values.map((value) => quoteTomlString(value)).join(", ")}]`;
+}
+function renderCodexTomlBlock(entry) {
+  const lines = [
+    "[mcp_servers.elisym]",
+    `command = ${quoteTomlString(String(entry.command ?? "npx"))}`,
+    `args = ${renderTomlStringArray(Array.isArray(entry.args) ? entry.args.map(String) : [])}`
+  ];
+  const env = entry.env && typeof entry.env === "object" && !Array.isArray(entry.env) ? entry.env : {};
+  const envEntries = Object.entries(env);
+  if (envEntries.length > 0) {
+    lines.push("", "[mcp_servers.elisym.env]");
+    for (const [key, value] of envEntries) {
+      lines.push(`${key} = ${quoteTomlString(String(value))}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+function updateCodexTomlBlock(body, env, rewriteEnv) {
+  const withFreshPackagePin = updateCodexPackagePin(body);
+  if (!rewriteEnv) {
+    return withFreshPackagePin;
+  }
+  const agent = env.ELISYM_AGENT;
+  if (agent === void 0) {
+    return withFreshPackagePin;
+  }
+  return replaceCodexAgentEnv(withFreshPackagePin, agent);
+}
+function updateCodexPackagePin(body) {
+  const lines = body.match(/^.*(?:\n|$)/gm) ?? [];
+  let section = "other";
+  for (const [lineIndex, line] of lines.entries()) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      if (/^\[mcp_servers\.elisym\]\s*(?:#.*)?$/.test(trimmed)) {
+        section = "elisym";
+      } else if (/^\[mcp_servers\.elisym\.env\]\s*(?:#.*)?$/.test(trimmed)) {
+        section = "env";
+      } else {
+        section = "other";
+      }
+      continue;
+    }
+    if (section !== "elisym" || !/^\s*args\s*=/.test(line)) {
+      continue;
+    }
+    const packageSpec = `@elisym/mcp@~${PACKAGE_VERSION}`;
+    const assignmentEndIndex = findTomlAssignmentEnd(lines, lineIndex);
+    const assignmentLines = lines.slice(lineIndex, assignmentEndIndex + 1);
+    const packageLineOffset = assignmentLines.findIndex(
+      (assignmentLine) => assignmentLine.includes("@elisym/mcp@")
+    );
+    if (packageLineOffset >= 0) {
+      const packageLineIndex = lineIndex + packageLineOffset;
+      const packageLine = lines[packageLineIndex] ?? "";
+      lines[packageLineIndex] = packageLine.replace(/@elisym\/mcp@[^"\],\s]+/, packageSpec);
+    } else {
+      lines.splice(
+        lineIndex,
+        assignmentEndIndex - lineIndex + 1,
+        replaceTomlAssignmentValue(line, renderTomlStringArray(elisymPackageArgs()))
+      );
+    }
+    break;
+  }
+  return lines.join("");
+}
+function findTomlAssignmentEnd(lines, startIndex) {
+  const firstLine = lines[startIndex] ?? "";
+  const assignmentStart = firstLine.indexOf("=");
+  if (assignmentStart < 0) {
+    return startIndex;
+  }
+  let depth = 0;
+  let sawArray = false;
+  for (let lineIndex = startIndex; lineIndex < lines.length; lineIndex++) {
+    const line = lines[lineIndex] ?? "";
+    if (lineIndex > startIndex && /^\s*\[/.test(line) && depth > 0) {
+      return lineIndex - 1;
+    }
+    const scanFrom = lineIndex === startIndex ? assignmentStart + 1 : 0;
+    const scan = scanTomlArrayLine(line, scanFrom, depth);
+    depth = scan.depth;
+    sawArray = sawArray || scan.sawArray;
+    if (!sawArray) {
+      return startIndex;
+    }
+    if (depth <= 0) {
+      return lineIndex;
+    }
+  }
+  return lines.length - 1;
+}
+function scanTomlArrayLine(line, startIndex, initialDepth) {
+  let depth = initialDepth;
+  let sawArray = false;
+  let inString = false;
+  let escaped = false;
+  for (let charIndex = startIndex; charIndex < line.length; charIndex++) {
+    const char = line[charIndex];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\" && inString) {
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      inString = !inString;
+      continue;
+    }
+    if (char === "#" && !inString) {
+      break;
+    }
+    if (char === "[" && !inString) {
+      depth++;
+      sawArray = true;
+    } else if (char === "]" && !inString) {
+      depth--;
+    }
+  }
+  return { depth, sawArray };
+}
+function replaceTomlAssignmentValue(line, value) {
+  const match = /^(\s*[A-Za-z_][A-Za-z0-9_]*\s*=\s*).*(\r?\n)?$/.exec(line);
+  if (!match) {
+    return line;
+  }
+  const [, prefix, newline = ""] = match;
+  return `${prefix}${value}${newline}`;
+}
+function replaceCodexAgentEnv(body, agent) {
+  const lines = body.match(/^.*(?:\n|$)/gm) ?? [];
+  let section = "other";
+  let envInsertionIndex = -1;
+  let elisymInsertionIndex = -1;
+  for (const [lineIndex, line] of lines.entries()) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      if (section === "env" && envInsertionIndex < 0) {
+        envInsertionIndex = lineIndex;
+      }
+      if (section === "elisym") {
+        elisymInsertionIndex = lineIndex;
+      }
+      const header = parseTomlTableHeader(trimmed);
+      if (header === "mcp_servers.elisym") {
+        section = "elisym";
+      } else if (header === "mcp_servers.elisym.env") {
+        section = "env";
+        continue;
+      } else {
+        section = "other";
+      }
+    }
+    if (section === "env") {
+      if (/^\s*ELISYM_AGENT\s*=/.test(line)) {
+        lines[lineIndex] = replaceTomlAssignmentValue(line, quoteTomlString(agent));
+        return lines.join("");
+      }
+      continue;
+    }
+    if (section === "elisym") {
+      elisymInsertionIndex = lineIndex + 1;
+      if (/^\s*env\s*=/.test(line)) {
+        const nextLine = replaceCodexInlineEnvAgent(line, agent);
+        if (nextLine !== null) {
+          lines[lineIndex] = nextLine;
+          return lines.join("");
+        }
+      }
+    }
+  }
+  if (section === "env") {
+    envInsertionIndex = lines.length;
+  } else if (section === "elisym") {
+    elisymInsertionIndex = lines.length;
+  }
+  const agentLine = `ELISYM_AGENT = ${quoteTomlString(agent)}
+`;
+  if (envInsertionIndex >= 0) {
+    lines.splice(envInsertionIndex, 0, agentLine);
+    return lines.join("");
+  }
+  const insertionIndex = elisymInsertionIndex >= 0 ? elisymInsertionIndex : lines.length;
+  lines.splice(insertionIndex, 0, "\n", "[mcp_servers.elisym.env]\n", agentLine);
+  return lines.join("");
+}
+function replaceCodexInlineEnvAgent(line, agent) {
+  const match = /^(\s*env\s*=\s*\{)(.*)(\}\s*(?:#.*)?(?:\r?\n)?)$/.exec(line);
+  if (!match) {
+    return null;
+  }
+  const [, prefix, body, suffix] = match;
+  const entries = splitInlineTableEntries(body);
+  const nextEntries = [];
+  let replaced = false;
+  for (const entry of entries) {
+    if (/^\s*ELISYM_AGENT\s*=/.test(entry)) {
+      const entryMatch = /^(\s*ELISYM_AGENT\s*=\s*).*$/.exec(entry);
+      if (!entryMatch) {
+        return null;
+      }
+      nextEntries.push(`${entryMatch[1]}${quoteTomlString(agent)}`);
+      replaced = true;
+    } else {
+      nextEntries.push(entry);
+    }
+  }
+  if (!replaced) {
+    nextEntries.push(` ELISYM_AGENT = ${quoteTomlString(agent)} `);
+  }
+  return `${prefix}${nextEntries.join(",")}${suffix}`;
+}
+function removeCodexElisymTables(raw) {
+  const ranges = findTomlTableRanges(raw).filter((table) => isCodexElisymPath(table.path)).sort((left, right) => right.start - left.start);
+  let nextRaw = raw;
+  for (const range of ranges) {
+    nextRaw = `${nextRaw.slice(0, range.start)}${nextRaw.slice(range.end)}`;
+  }
+  return nextRaw;
+}
+function isCodexElisymPath(path) {
+  return path === "mcp_servers.elisym" || path.startsWith("mcp_servers.elisym.");
+}
+function replaceCodexBlock(raw, block, replacement) {
+  {
+    let separator = "\n\n";
+    if (raw.length === 0 || raw.endsWith("\n\n")) {
+      separator = "";
+    } else if (raw.endsWith("\n")) {
+      separator = "\n";
+    }
+    return `${raw}${separator}${replacement}`;
+  }
+}
+async function installToCodexConfig(path, entry, agentRebind) {
+  let raw;
+  try {
+    raw = await readFile(path, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw err;
+    }
+    await mkdir(dirname(path), { recursive: true });
+    await writeFileAtomic(path, renderCodexTomlBlock(entry), 384);
+    return "installed";
+  }
+  const block = findCodexElisymBlock(raw);
+  if (block) {
+    if (agentRebind === void 0) {
+      return "unchanged";
+    }
+    const env = parseCodexEnv(raw);
+    if (env.ELISYM_AGENT === agentRebind) {
+      return "unchanged";
+    }
+    env.ELISYM_AGENT = agentRebind;
+    const replacement = updateCodexTomlBlock(raw, env, true);
+    await safeRewriteRaw(path, raw, replacement);
+    return "rebound";
+  }
+  await safeRewriteRaw(path, raw, replaceCodexBlock(raw, null, renderCodexTomlBlock(entry)));
+  return "installed";
+}
+async function updateCodexConfig(path, agentOverride) {
+  const raw = await readFile(path, "utf-8");
+  const block = findCodexElisymBlock(raw);
+  if (!block) {
+    return "unchanged";
+  }
+  const env = parseCodexEnv(raw);
+  const existingAgentRaw = typeof env.ELISYM_AGENT === "string" ? env.ELISYM_AGENT : void 0;
+  if (existingAgentRaw !== void 0 && agentOverride === void 0) {
+    validateAgentName(existingAgentRaw);
+  }
+  if (agentOverride !== void 0) {
+    env.ELISYM_AGENT = agentOverride;
+  }
+  const replacement = updateCodexTomlBlock(raw, env, agentOverride !== void 0);
+  await safeRewriteRaw(path, raw, replacement);
+  return "updated";
+}
+async function uninstallFromCodexConfig(path) {
+  const raw = await readFile(path, "utf-8");
+  const replacement = removeCodexElisymTables(raw);
+  if (replacement === raw) {
+    return "unchanged";
+  }
+  await safeRewriteRaw(path, raw, replacement);
+  return "removed";
+}
+async function safeRewriteRaw(path, expectedRaw, nextRaw) {
+  let recheck;
+  try {
+    recheck = await readFile(path, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `${path} disappeared between read and write: ${err.message}. Re-run after the file is restored.`
+    );
+  }
+  if (recheck !== expectedRaw) {
+    throw new Error(
+      `${path} was modified by another process during update. Close the MCP client and re-run.`
+    );
+  }
+  await writeFileAtomic(path, nextRaw, 384);
+}
 function ensureIrohTransport(agent) {
   if (agent.irohTransport) {
     return agent.irohTransport;
@@ -1244,11 +1734,45 @@ async function assertGitRepo(repoPath) {
     throw new Error(`"${repoPath}" is not inside a git work tree: ${message}`);
   }
 }
-async function computeGitDiff(repoPath, base) {
+async function validateRepoPath(repoPath, options) {
   if (repoPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`repo_path too long: ${repoPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
-  const absRepo = isAbsolute(repoPath) ? repoPath : resolve(process.cwd(), repoPath);
+  const cwd = resolve(process.cwd());
+  const logicalPath = isAbsolute(repoPath) ? resolve(repoPath) : resolve(cwd, repoPath);
+  let absPath;
+  try {
+    absPath = await realpath(logicalPath);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") {
+      throw new Error(`repo_path does not exist: ${logicalPath}`);
+    }
+    throw new Error(`Cannot resolve repo_path "${logicalPath}": ${e.message}`);
+  }
+  if (isSensitiveInputPath(absPath) || isSensitiveInputPath(logicalPath)) {
+    throw new Error(
+      `Refusing to review a sensitive path: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, absPath);
+    const insideCwd = rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `repo_path "${absPath}" resolves outside the working directory (${realCwd}). Move the repo under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
+  const stats = await stat(absPath);
+  if (!stats.isDirectory()) {
+    throw new Error(`repo_path is not a directory: ${absPath}`);
+  }
+  return absPath;
+}
+async function computeGitDiff(repoPath, base, options) {
+  const absRepo = await validateRepoPath(repoPath, options);
   await assertGitRepo(absRepo);
   let args;
   let describedRange;
@@ -1616,6 +2140,7 @@ async function findCustomerJobsByProvider(agentDir, providerPubkey) {
 
 // src/tools/customer.ts
 var PRE_PING_TIMEOUT_MS = 5e3;
+var UNVERIFIED_PROVIDER_NOTICE = "NOTE: no provider_npub was given, so the author of this result was NOT verified. Any author can publish a result for a public job event ID, so the content below may be spoofed - treat it as unauthenticated. Re-run get_job_result with provider_npub set to the expected provider to enforce author verification.";
 var CreateJobSchema = z.object({
   input: z.string().describe("The job prompt/input sent to the provider."),
   capability: z.string().min(1).max(64).default("general").describe("Short tag selecting which capability of the provider to invoke."),
@@ -1684,20 +2209,30 @@ var SubmitDiffReviewSchema = z.object({
   prompt: z.string().max(MAX_INPUT_LEN).default("").describe('Optional instructions prepended above the diff (e.g. "focus on auth flow").'),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
   timeout_secs: z.number().int().min(1).max(600).default(300),
-  max_price_lamports: z.number().int().optional()
+  max_price_lamports: z.number().int().optional(),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow reviewing a repo outside the MCP server working directory. Off by default - the diff is forwarded to the provider before payment and is invisible in the transcript, so the repo is confined to the working dir subtree unless this is set. Sensitive paths (secret keys, .env, SSH/keypair, ~/.elisym, /proc) are always refused."
+  )
 });
-function providerSolanaAddress(provider, dTag) {
+function paymentCardForCapability(provider, dTag) {
   const cards = provider.cards ?? [];
   const candidates = dTag ? cards.filter(
-    (c) => toDTag(c.name) === dTag || c.capabilities?.some((cap) => toDTag(cap) === dTag)
+    (card) => toDTag(card.name) === dTag || card.capabilities?.some((capability) => toDTag(capability) === dTag)
   ) : cards;
   for (const card of candidates.length > 0 ? candidates : cards) {
     if (card.payment?.chain === "solana" && card.payment?.address) {
-      return card.payment.address;
+      return card;
     }
   }
   return void 0;
 }
+function providerSolanaAddress(provider, dTag) {
+  return paymentCardForCapability(provider, dTag)?.payment?.address;
+}
+function advertisedPriceForCapability(provider, dTag) {
+  const card = paymentCardForCapability(provider, dTag);
+  return { price: card?.payment?.job_price ?? 0, asset: assetFromCardPayment(card?.payment) };
+}
 function wsUrlFor(httpUrl) {
   return httpUrl.replace(/^https:\/\//, "wss://").replace(/^http:\/\//, "ws://");
 }
@@ -1747,6 +2282,29 @@ ${formatNetworkBaseline(baseline)}`;
     return "";
   }
 }
+async function confirmPriceGate(opts) {
+  const { agent, providerLabel, capability, price, asset, maxPriceLamports, toolName } = opts;
+  if (maxPriceLamports !== void 0 && price > maxPriceLamports) {
+    return errorResult(
+      `Price ${formatAssetAmount(asset, BigInt(price))} exceeds max ${formatAssetAmount(asset, BigInt(maxPriceLamports))}`
+    );
+  }
+  if (price > 0 && maxPriceLamports === void 0) {
+    const gasLine = await gasHintForCardAsset(agent, asset);
+    const subject = toolName === "buy_capability" ? `Capability "${capability}" from "${providerLabel}"` : `Job for capability "${capability}" from "${providerLabel}"`;
+    const { text } = sanitizeUntrusted(
+      `${subject} costs ${formatAssetAmount(asset, BigInt(price))}.${gasLine}
+
+To confirm, call ${toolName} again with max_price_lamports set (e.g. ${price} or higher).`,
+      "text"
+    );
+    return { content: [{ type: "text", text }] };
+  }
+  return null;
+}
+function rejectWithProviderError(reject, providerError) {
+  reject(new Error(`Job error: ${sanitizeUntrusted(providerError, "text").text}`));
+}
 var paymentStrategy = new SolanaPaymentStrategy();
 async function executePaymentFlow(agent, paymentRequest, jobId, providerPubkey, expectedRecipient) {
   let requestData;
@@ -1989,6 +2547,22 @@ async function executeSubmitAndPay(ctx, agent, params) {
       `Cannot buy from yourself - your agent's Solana wallet (${buyerWallet}) matches the provider's payment address. Use a different agent or provider.`
     );
   }
+  const { price: advertisedPrice, asset: advertisedAsset } = advertisedPriceForCapability(
+    provider,
+    params.dTag
+  );
+  const priceGate = await confirmPriceGate({
+    agent,
+    providerLabel: sanitizeField(provider.name || params.providerNpub, 64),
+    capability: params.capability,
+    price: advertisedPrice,
+    asset: advertisedAsset,
+    maxPriceLamports: params.maxPriceLamports,
+    toolName: params.toolName
+  });
+  if (priceGate) {
+    return priceGate;
+  }
   const submittedAt = Date.now();
   const jobId = await agent.client.marketplace.submitJobRequest(agent.identity, {
     input: params.input,
@@ -2046,7 +2620,7 @@ ${sanitized.text}`);
             },
             onFeedback: payHandler.onFeedback,
             onError(error) {
-              reject(new Error(`Job error: ${sanitizeUntrusted(error, "text").text}`));
+              rejectWithProviderError(reject, error);
             },
             onTimeout(timeoutMs) {
               reject(new JobWaitTimeoutError(timeoutMs));
@@ -2216,7 +2790,7 @@ var customerTools = [
                 }
               },
               onError(error) {
-                reject(new Error(`Job error: ${error}`));
+                rejectWithProviderError(reject, error);
               },
               onTimeout(timeoutMs) {
                 reject(new JobWaitTimeoutError(timeoutMs));
@@ -2238,6 +2812,11 @@ var customerTools = [
         }
         return errorResult(`Failed to fetch result for event_id="${input.job_event_id}": ${msg}`);
       }
+      if (providerPubkey === void 0) {
+        return textResult(`${UNVERIFIED_PROVIDER_NOTICE}
+
+${result}`);
+      }
       return textResult(result);
     }
   }),
@@ -2425,7 +3004,7 @@ ${wrapped}`);
   }),
   defineTool({
     name: "submit_and_pay_job",
-    description: 'Full customer flow: submit job -> auto-pay -> wait for result. Validates that the payment recipient matches the provider card. If payment succeeded but no result arrives within the wait window, this returns a non-error "still processing" notice with the event ID (NOT a failure) - re-poll get_job_result later (results persist on the relays; for long jobs, poll periodically, e.g. from a subagent). Handles both free and paid providers automatically. If max_price_lamports is not set and provider requests payment, the job is rejected with the price - set max_price_lamports to auto-approve payments up to that limit. COST: input is sent inline in the tool call, so a large input pays output tokens on the calling LLM. For files or git diffs, prefer submit_and_pay_job_from_file or submit_diff_review respectively.',
+    description: 'Full customer flow: submit job -> auto-pay -> wait for result. Validates that the payment recipient matches the provider card. If payment succeeded but no result arrives within the wait window, this returns a non-error "still processing" notice with the event ID (NOT a failure) - re-poll get_job_result later (results persist on the relays; for long jobs, poll periodically, e.g. from a subagent). Handles both free and paid providers automatically. If max_price_lamports is not set and the capability is paid, this returns the advertised price for confirmation WITHOUT submitting a job - re-call with max_price_lamports set to approve payments up to that limit (this is a confirmation, not an error). COST: input is sent inline in the tool call, so a large input pays output tokens on the calling LLM. For files or git diffs, prefer submit_and_pay_job_from_file or submit_diff_review respectively.',
     schema: SubmitAndPayJobSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
@@ -2454,7 +3033,8 @@ ${wrapped}`);
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_and_pay_job"
       });
     }
   }),
@@ -2506,7 +3086,8 @@ ${wrapped}`);
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_and_pay_job_from_file"
       });
     }
   }),
@@ -2519,7 +3100,9 @@ ${wrapped}`);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
       let diffResult;
       try {
-        diffResult = await computeGitDiff(input.repo_path, input.base);
+        diffResult = await computeGitDiff(input.repo_path, input.base, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
@@ -2548,7 +3131,8 @@ ${diffResult.diff}`;
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_diff_review"
       });
     }
   }),
@@ -2590,30 +3174,17 @@ ${diffResult.diff}`;
         );
         return errorResult(text);
       }
-      const price = card.payment?.job_price ?? 0;
-      const cardAsset = assetFromCardPayment(card.payment);
-      if (input.max_price_lamports !== void 0 && price > input.max_price_lamports) {
-        return errorResult(
-          `Price ${formatAssetAmount(cardAsset, BigInt(price))} exceeds max ${formatAssetAmount(cardAsset, BigInt(input.max_price_lamports))}`
-        );
-      }
-      if (price > 0 && input.max_price_lamports === void 0) {
-        const gasLine = await gasHintForCardAsset(agent, cardAsset);
-        const safeProviderName = sanitizeField(provider.name || input.provider_npub, 64);
-        const { text } = sanitizeUntrusted(
-          `Capability "${input.capability}" from "${safeProviderName}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
-
-To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`,
-          "text"
-        );
-        return {
-          content: [
-            {
-              type: "text",
-              text
-            }
-          ]
-        };
+      const priceGate = await confirmPriceGate({
+        agent,
+        providerLabel: sanitizeField(provider.name || input.provider_npub, 64),
+        capability: input.capability,
+        price: card.payment?.job_price ?? 0,
+        asset: assetFromCardPayment(card.payment),
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "buy_capability"
+      });
+      if (priceGate) {
+        return priceGate;
       }
       const expectedRecipient = card.payment?.chain === "solana" ? card.payment.address : void 0;
       if (agent.solanaKeypair && !expectedRecipient) {
@@ -2682,7 +3253,7 @@ ${sanitized.text}`
                 },
                 onFeedback: payHandler.onFeedback,
                 onError(error) {
-                  reject(new Error(`Job error: ${error}`));
+                  rejectWithProviderError(reject, error);
                 },
                 onTimeout(timeoutMs) {
                   reject(new JobWaitTimeoutError(timeoutMs));
@@ -4365,7 +4936,10 @@ program.command("init [name]").description("Create a new agent identity").option
     }
   })
 );
-program.command("install").description("Install elisym MCP server into client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Bind to specific agent").option("--list", "List detected clients").action(
+program.command("install").description("Install elisym MCP server into client configs").option(
+  "--client <name>",
+  "Specific client (claude-desktop, claude-code, cursor, codex, windsurf)"
+).option("--agent <name>", "Bind to specific agent").option("--list", "List detected clients").action(
   safe(async (options) => {
     if (options.list) {
       await runList();
@@ -4374,7 +4948,10 @@ program.command("install").description("Install elisym MCP server into client co
     }
   })
 );
-program.command("update").description("Refresh the elisym MCP entry in installed client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Override the agent binding").action(
+program.command("update").description("Refresh the elisym MCP entry in installed client configs").option(
+  "--client <name>",
+  "Specific client (claude-desktop, claude-code, cursor, codex, windsurf)"
+).option("--agent <name>", "Override the agent binding").action(
   safe(async (options) => {
     await runUpdate({ client: options.client, agent: options.agent });
   })