@stanco323/oh-my-claude-code 4.10.3

package/dist/lib/project-memory-merge.js

@@ -0,0 +1,156 @@
+/**
+ * Project Memory - Deep merge strategy for cross-session sync.
+ *
+ * Fixes issue #1168: cross-session sync previously used full overwrite
+ * (shallow spread) which lost nested fields when merging project memory.
+ *
+ * This module provides field-level deep merge with array-specific strategies:
+ * - Plain objects: recursively merged (new keys added, existing keys deep-merged)
+ * - Arrays with identifiable items (objects with identity keys):
+ *   deduplicated by identity, newer entries win on conflict
+ * - Primitive arrays: union (deduplicated)
+ * - Scalars: incoming value wins (last-write-wins at leaf level)
+ */
+// ---------------------------------------------------------------------------
+// Generic deep-merge utilities
+// ---------------------------------------------------------------------------
+/**
+ * Check if a value is a plain object (not an array, null, Date, etc.).
+ */
+function isPlainObject(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        !(value instanceof Date) &&
+        !(value instanceof RegExp));
+}
+/**
+ * Deep merge two plain objects. `incoming` values take precedence at leaf level.
+ * Arrays are handled by `mergeArrays` with type-aware deduplication.
+ *
+ * @param base - The existing (on-disk) object
+ * @param incoming - The new (incoming) object whose values take precedence
+ * @returns A new merged object (neither input is mutated)
+ */
+export function deepMerge(base, incoming) {
+    const result = { ...base };
+    for (const key of Object.keys(incoming)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
+        const baseVal = base[key];
+        const incomingVal = incoming[key];
+        // Incoming explicitly null/undefined -> take it (intentional clear)
+        if (incomingVal === null || incomingVal === undefined) {
+            result[key] = incomingVal;
+            continue;
+        }
+        // Both are plain objects -> recurse
+        if (isPlainObject(baseVal) && isPlainObject(incomingVal)) {
+            result[key] = deepMerge(baseVal, incomingVal);
+            continue;
+        }
+        // Both are arrays -> type-aware merge
+        if (Array.isArray(baseVal) && Array.isArray(incomingVal)) {
+            result[key] = mergeArrays(key, baseVal, incomingVal);
+            continue;
+        }
+        // Scalar or type mismatch -> incoming wins (last-write-wins)
+        result[key] = incomingVal;
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Array merge strategies
+// ---------------------------------------------------------------------------
+/**
+ * Merge two arrays with field-aware deduplication based on the field name.
+ *
+ * - `customNotes`: deduplicate by category+content, keep newer timestamp
+ * - `userDirectives`: deduplicate by directive text, keep newer timestamp
+ * - `hotPaths`: deduplicate by path, merge access counts
+ * - `languages`, `frameworks`: deduplicate by name, incoming wins
+ * - `workspaces`, `mainDirectories`, `keyFiles`, `markers`: string union
+ * - Default: union by JSON equality
+ */
+function mergeArrays(fieldName, base, incoming) {
+    switch (fieldName) {
+        case 'customNotes':
+            return mergeByKey(base, incoming, (note) => `${note.category}::${note.content}`, (a, b) => (b.timestamp >= a.timestamp ? b : a));
+        case 'userDirectives':
+            return mergeByKey(base, incoming, (d) => d.directive, (a, b) => (b.timestamp >= a.timestamp ? b : a));
+        case 'hotPaths':
+            return mergeByKey(base, incoming, (hp) => hp.path, (a, b) => ({
+                ...b,
+                accessCount: Math.max(a.accessCount, b.accessCount),
+                lastAccessed: Math.max(a.lastAccessed, b.lastAccessed),
+            }));
+        case 'languages':
+        case 'frameworks':
+            return mergeByKey(base, incoming, (item) => item.name, (_a, b) => b);
+        case 'workspaces':
+        case 'mainDirectories':
+        case 'keyFiles':
+        case 'markers':
+            return mergeScalarArray(base, incoming);
+        default:
+            return mergeScalarArray(base, incoming);
+    }
+}
+/**
+ * Merge two arrays of objects by a key function.
+ * When both arrays contain an item with the same key, `resolve` picks the winner.
+ * Order: base items first (updated in place), then new incoming items appended.
+ */
+function mergeByKey(base, incoming, keyFn, resolve) {
+    const seen = new Map();
+    for (const item of base) {
+        seen.set(keyFn(item), item);
+    }
+    for (const item of incoming) {
+        const key = keyFn(item);
+        const existing = seen.get(key);
+        if (existing) {
+            seen.set(key, resolve(existing, item));
+        }
+        else {
+            seen.set(key, item);
+        }
+    }
+    return Array.from(seen.values());
+}
+/**
+ * Merge two scalar arrays via union (deduplicate by JSON string equality).
+ */
+function mergeScalarArray(base, incoming) {
+    const seen = new Set();
+    const result = [];
+    for (const item of [...base, ...incoming]) {
+        const key = JSON.stringify(item);
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(item);
+        }
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Project Memory merge
+// ---------------------------------------------------------------------------
+/**
+ * Merge incoming partial project memory into the existing on-disk memory.
+ *
+ * Uses deep merge with field-specific array strategies to prevent data loss
+ * during cross-session sync. Metadata fields (`version`, `lastScanned`,
+ * `projectRoot`) always take the incoming value when provided.
+ *
+ * @param existing - The current on-disk project memory
+ * @param incoming - Partial update from another session or tool call
+ * @returns Merged ProjectMemory (new object, inputs not mutated)
+ */
+export function mergeProjectMemory(existing, incoming) {
+    const merged = deepMerge(existing, incoming);
+    // Ensure metadata fields are sensible after merge
+    merged.lastScanned = incoming.lastScanned ?? existing.lastScanned;
+    return merged;
+}
+//# sourceMappingURL=project-memory-merge.js.map

package/dist/lib/project-memory-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-memory-merge.js","sourceRoot":"","sources":["../../src/lib/project-memory-merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC;QACxB,CAAC,CAAC,KAAK,YAAY,MAAM,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,IAAO,EACP,QAAoB;IAEpB,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QAClF,MAAM,OAAO,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,WAAW,GAAI,QAAoC,CAAC,GAAG,CAAC,CAAC;QAE/D,oEAAoE;QACpE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,oCAAoC;QACpC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,6DAA6D;QAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5B,CAAC;IAED,OAAO,MAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,SAAiB,EAAE,IAAe,EAAE,QAAmB;IAC1E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,UAAU,CACf,IAAoB,EACpB,QAAwB,EACxB,CAAC,IAAgB,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,EACzD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;QAEJ,KAAK,gBAAgB;YACnB,OAAO,UAAU,CACf,IAAuB,EACvB,QAA2B,EAC3B,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EACjC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;QAEJ,KAAK,UAAU;YACb,OAAO,UAAU,CACf,IAAiB,EACjB,QAAqB,EACrB,CAAC,EAAW,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EACxB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACT,GAAG,CAAC;gBACJ,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;gBACnD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;aACvD,CAAC,CACH,CAAC;QAEJ,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY;YACf,OAAO,UAAU,CACf,IAA+B,EAC/B,QAAmC,EACnC,CAAC,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EACrC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CACb,CAAC;QAEJ,KAAK,YAAY,CAAC;QAClB,KAAK,iBAAiB,CAAC;QACvB,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC,IAAgB,EAAE,QAAoB,CAAC,CAAC;QAElE;YACE,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAS,EACT,QAAa,EACb,KAA0B,EAC1B,OAAoC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAe,EAAE,QAAmB;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAuB,EACvB,QAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CACtB,QAA8C,EAC9C,QAA8C,CACnB,CAAC;IAE9B,kDAAkD;IAClD,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;IAElE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/security-config.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Unified Security Configuration
+ *
+ * Single entry point for all OMC security settings.
+ * Two layers of configuration:
+ *
+ * 1. OMC_SECURITY env var — master switch
+ *    - "strict": all security features enabled
+ *    - unset/other: per-feature defaults apply
+ *
+ * 2. Config file (.claude/omc.jsonc or ~/.config/claude-omc/config.jsonc)
+ *    security section — granular overrides (highest precedence)
+ *
+ * Precedence: config file > OMC_SECURITY env var > defaults (all off)
+ */
+export interface SecurityConfig {
+    /** Restrict ast_grep_search/replace path to project root */
+    restrictToolPaths: boolean;
+    /** Sandbox python_repl with blocked modules/builtins */
+    pythonSandbox: boolean;
+    /** Disable project-level .omc/skills/ loading */
+    disableProjectSkills: boolean;
+    /** Disable silent auto-update */
+    disableAutoUpdate: boolean;
+    /** Hard max iterations for persistent modes (0 = unlimited) */
+    hardMaxIterations: number;
+    /** Disable remote MCP servers (Exa, Context7) */
+    disableRemoteMcp: boolean;
+    /** Disable external LLM providers (Codex, Gemini) in team mode */
+    disableExternalLLM: boolean;
+}
+/**
+ * Resolve the full security configuration.
+ * Precedence: config file > OMC_SECURITY env > defaults
+ */
+export declare function getSecurityConfig(): SecurityConfig;
+/** Clear cached config (for testing) */
+export declare function clearSecurityConfigCache(): void;
+/** Convenience: is tool path restriction enabled? */
+export declare function isToolPathRestricted(): boolean;
+/** Convenience: is python sandbox enabled? */
+export declare function isPythonSandboxEnabled(): boolean;
+/** Convenience: are project-level skills disabled? */
+export declare function isProjectSkillsDisabled(): boolean;
+/** Convenience: is auto-update disabled? */
+export declare function isAutoUpdateDisabled(): boolean;
+/** Convenience: get hard max iterations (0 = unlimited) */
+export declare function getHardMaxIterations(): number;
+/** Convenience: are remote MCP servers disabled? */
+export declare function isRemoteMcpDisabled(): boolean;
+/** Convenience: are external LLM providers disabled? */
+export declare function isExternalLLMDisabled(): boolean;
+//# sourceMappingURL=security-config.d.ts.map

package/dist/lib/security-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-config.d.ts","sourceRoot":"","sources":["../../src/lib/security-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,aAAa,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iCAAiC;IACjC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAmDD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CA+BlD;AAED,wCAAwC;AACxC,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,qDAAqD;AACrD,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,8CAA8C;AAC9C,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,sDAAsD;AACtD,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED,4CAA4C;AAC5C,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,oDAAoD;AACpD,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED,wDAAwD;AACxD,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}

package/dist/lib/security-config.js

@@ -0,0 +1,132 @@
+/**
+ * Unified Security Configuration
+ *
+ * Single entry point for all OMC security settings.
+ * Two layers of configuration:
+ *
+ * 1. OMC_SECURITY env var — master switch
+ *    - "strict": all security features enabled
+ *    - unset/other: per-feature defaults apply
+ *
+ * 2. Config file (.claude/omc.jsonc or ~/.config/claude-omc/config.jsonc)
+ *    security section — granular overrides (highest precedence)
+ *
+ * Precedence: config file > OMC_SECURITY env var > defaults (all off)
+ */
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { parseJsonc } from "../utils/jsonc.js";
+import { getConfigDir } from "../utils/paths.js";
+const DEFAULTS = {
+    restrictToolPaths: false,
+    pythonSandbox: false,
+    disableProjectSkills: false,
+    disableAutoUpdate: false,
+    hardMaxIterations: 500,
+    disableRemoteMcp: false,
+    disableExternalLLM: false,
+};
+const STRICT_OVERRIDES = {
+    restrictToolPaths: true,
+    pythonSandbox: true,
+    disableProjectSkills: true,
+    disableAutoUpdate: true,
+    hardMaxIterations: 200,
+    disableRemoteMcp: true,
+    disableExternalLLM: true,
+};
+/** Cached config to avoid re-reading files on every call */
+let cachedConfig = null;
+/**
+ * Load the security section from config files.
+ * Checks project config first, then user config.
+ */
+function loadSecurityFromConfigFiles() {
+    const paths = [
+        join(process.cwd(), ".claude", "omc.jsonc"),
+        join(getConfigDir(), "claude-omc", "config.jsonc"),
+    ];
+    for (const configPath of paths) {
+        if (!existsSync(configPath))
+            continue;
+        try {
+            const content = readFileSync(configPath, "utf-8");
+            const parsed = parseJsonc(content);
+            if (parsed?.security && typeof parsed.security === "object") {
+                return parsed.security;
+            }
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    return {};
+}
+/**
+ * Resolve the full security configuration.
+ * Precedence: config file > OMC_SECURITY env > defaults
+ */
+export function getSecurityConfig() {
+    if (cachedConfig)
+        return cachedConfig;
+    const isStrict = process.env.OMC_SECURITY === "strict";
+    const base = isStrict ? { ...STRICT_OVERRIDES } : { ...DEFAULTS };
+    const fileOverrides = loadSecurityFromConfigFiles();
+    if (isStrict) {
+        // In strict mode, config file can only TIGHTEN security, not relax it
+        cachedConfig = {
+            restrictToolPaths: base.restrictToolPaths || (fileOverrides.restrictToolPaths ?? false),
+            pythonSandbox: base.pythonSandbox || (fileOverrides.pythonSandbox ?? false),
+            disableProjectSkills: base.disableProjectSkills || (fileOverrides.disableProjectSkills ?? false),
+            disableAutoUpdate: base.disableAutoUpdate || (fileOverrides.disableAutoUpdate ?? false),
+            disableRemoteMcp: base.disableRemoteMcp || (fileOverrides.disableRemoteMcp ?? false),
+            disableExternalLLM: base.disableExternalLLM || (fileOverrides.disableExternalLLM ?? false),
+            hardMaxIterations: Math.min(base.hardMaxIterations, fileOverrides.hardMaxIterations ?? base.hardMaxIterations),
+        };
+    }
+    else {
+        cachedConfig = {
+            restrictToolPaths: fileOverrides.restrictToolPaths ?? base.restrictToolPaths,
+            pythonSandbox: fileOverrides.pythonSandbox ?? base.pythonSandbox,
+            disableProjectSkills: fileOverrides.disableProjectSkills ?? base.disableProjectSkills,
+            disableAutoUpdate: fileOverrides.disableAutoUpdate ?? base.disableAutoUpdate,
+            disableRemoteMcp: fileOverrides.disableRemoteMcp ?? base.disableRemoteMcp,
+            disableExternalLLM: fileOverrides.disableExternalLLM ?? base.disableExternalLLM,
+            hardMaxIterations: fileOverrides.hardMaxIterations ?? base.hardMaxIterations,
+        };
+    }
+    return cachedConfig;
+}
+/** Clear cached config (for testing) */
+export function clearSecurityConfigCache() {
+    cachedConfig = null;
+}
+/** Convenience: is tool path restriction enabled? */
+export function isToolPathRestricted() {
+    return getSecurityConfig().restrictToolPaths;
+}
+/** Convenience: is python sandbox enabled? */
+export function isPythonSandboxEnabled() {
+    return getSecurityConfig().pythonSandbox;
+}
+/** Convenience: are project-level skills disabled? */
+export function isProjectSkillsDisabled() {
+    return getSecurityConfig().disableProjectSkills;
+}
+/** Convenience: is auto-update disabled? */
+export function isAutoUpdateDisabled() {
+    return getSecurityConfig().disableAutoUpdate;
+}
+/** Convenience: get hard max iterations (0 = unlimited) */
+export function getHardMaxIterations() {
+    return getSecurityConfig().hardMaxIterations;
+}
+/** Convenience: are remote MCP servers disabled? */
+export function isRemoteMcpDisabled() {
+    return getSecurityConfig().disableRemoteMcp;
+}
+/** Convenience: are external LLM providers disabled? */
+export function isExternalLLMDisabled() {
+    return getSecurityConfig().disableExternalLLM;
+}
+//# sourceMappingURL=security-config.js.map

package/dist/lib/security-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-config.js","sourceRoot":"","sources":["../../src/lib/security-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAmBjD,MAAM,QAAQ,GAAmB;IAC/B,iBAAiB,EAAE,KAAK;IACxB,aAAa,EAAE,KAAK;IACpB,oBAAoB,EAAE,KAAK;IAC3B,iBAAiB,EAAE,KAAK;IACxB,iBAAiB,EAAE,GAAG;IACtB,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,KAAK;CAC1B,CAAC;AAEF,MAAM,gBAAgB,GAAmB;IACvC,iBAAiB,EAAE,IAAI;IACvB,aAAa,EAAE,IAAI;IACnB,oBAAoB,EAAE,IAAI;IAC1B,iBAAiB,EAAE,IAAI;IACvB,iBAAiB,EAAE,GAAG;IACtB,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAEF,4DAA4D;AAC5D,IAAI,YAAY,GAA0B,IAAI,CAAC;AAE/C;;;GAGG;AACH,SAAS,2BAA2B;IAClC,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC;KACnD,CAAC;IAEF,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAA4B,CAAC;YAC9D,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC5D,OAAO,MAAM,CAAC,QAAmC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;IAClE,MAAM,aAAa,GAAG,2BAA2B,EAAE,CAAC;IAEpD,IAAI,QAAQ,EAAE,CAAC;QACb,sEAAsE;QACtE,YAAY,GAAG;YACb,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC,aAAa,CAAC,iBAAiB,IAAI,KAAK,CAAC;YACvF,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,aAAa,IAAI,KAAK,CAAC;YAC3E,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,KAAK,CAAC;YAChG,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC,aAAa,CAAC,iBAAiB,IAAI,KAAK,CAAC;YACvF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,CAAC,gBAAgB,IAAI,KAAK,CAAC;YACpF,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,CAAC,kBAAkB,IAAI,KAAK,CAAC;YAC1F,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,CAAC;SAC/G,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG;YACb,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB;YAC5E,aAAa,EAAE,aAAa,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;YAChE,oBAAoB,EAAE,aAAa,CAAC,oBAAoB,IAAI,IAAI,CAAC,oBAAoB;YACrF,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB;YAC5E,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB;YACzE,kBAAkB,EAAE,aAAa,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB;YAC/E,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB;SAC7E,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,wBAAwB;IACtC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,oBAAoB;IAClC,OAAO,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;AAC/C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,sBAAsB;IACpC,OAAO,iBAAiB,EAAE,CAAC,aAAa,CAAC;AAC3C,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,uBAAuB;IACrC,OAAO,iBAAiB,EAAE,CAAC,oBAAoB,CAAC;AAClD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,oBAAoB;IAClC,OAAO,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;AAC/C,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB;IAClC,OAAO,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;AAC/C,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,mBAAmB;IACjC,OAAO,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;AAC9C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,qBAAqB;IACnC,OAAO,iBAAiB,EAAE,CAAC,kBAAkB,CAAC;AAChD,CAAC"}

package/dist/lib/session-isolation.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Session Isolation - Shared utility for consistent session-scoped state guards.
+ *
+ * The codebase has historically used three different patterns for checking
+ * whether a state object belongs to the current session:
+ *
+ *   1. Lenient:  `state.session_id && state.session_id !== sessionId` (skip only if mismatch)
+ *   2. Strict:   `state.session_id !== sessionId` (skip if missing OR mismatch)
+ *   3. Guarded:  `!state.session_id || !sessionId || state.session_id !== sessionId`
+ *
+ * This module provides a single canonical function so all callers behave the same.
+ */
+/**
+ * Check whether a state object belongs to the given session.
+ *
+ * Semantics (strict by default):
+ * - If `sessionId` is not provided, returns `true` (no session to check against — allow).
+ * - If the state has no `stateSessionId`, returns `false` (legacy/ownerless state — reject
+ *   when a session is active, to prevent cross-session leakage).
+ * - Otherwise, returns `stateSessionId === sessionId`.
+ *
+ * Use `lenient: true` for backward-compatible code paths where legacy ownerless
+ * state should still be accepted.
+ *
+ * @param stateSessionId - The session_id stored in the state object (may be undefined).
+ * @param sessionId - The current request's session ID (may be undefined).
+ * @param options.lenient - When true, ownerless state (no stateSessionId) is accepted.
+ */
+export declare function isStateForSession(stateSessionId: string | undefined | null, sessionId: string | undefined | null, options?: {
+    lenient?: boolean;
+}): boolean;
+//# sourceMappingURL=session-isolation.d.ts.map

package/dist/lib/session-isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-isolation.d.ts","sourceRoot":"","sources":["../../src/lib/session-isolation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACpC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAUT"}

package/dist/lib/session-isolation.js

@@ -0,0 +1,39 @@
+/**
+ * Session Isolation - Shared utility for consistent session-scoped state guards.
+ *
+ * The codebase has historically used three different patterns for checking
+ * whether a state object belongs to the current session:
+ *
+ *   1. Lenient:  `state.session_id && state.session_id !== sessionId` (skip only if mismatch)
+ *   2. Strict:   `state.session_id !== sessionId` (skip if missing OR mismatch)
+ *   3. Guarded:  `!state.session_id || !sessionId || state.session_id !== sessionId`
+ *
+ * This module provides a single canonical function so all callers behave the same.
+ */
+/**
+ * Check whether a state object belongs to the given session.
+ *
+ * Semantics (strict by default):
+ * - If `sessionId` is not provided, returns `true` (no session to check against — allow).
+ * - If the state has no `stateSessionId`, returns `false` (legacy/ownerless state — reject
+ *   when a session is active, to prevent cross-session leakage).
+ * - Otherwise, returns `stateSessionId === sessionId`.
+ *
+ * Use `lenient: true` for backward-compatible code paths where legacy ownerless
+ * state should still be accepted.
+ *
+ * @param stateSessionId - The session_id stored in the state object (may be undefined).
+ * @param sessionId - The current request's session ID (may be undefined).
+ * @param options.lenient - When true, ownerless state (no stateSessionId) is accepted.
+ */
+export function isStateForSession(stateSessionId, sessionId, options) {
+    // No session context — cannot filter, allow everything.
+    if (!sessionId)
+        return true;
+    // State has no owner.
+    if (!stateSessionId) {
+        return options?.lenient === true;
+    }
+    return stateSessionId === sessionId;
+}
+//# sourceMappingURL=session-isolation.js.map

package/dist/lib/session-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-isolation.js","sourceRoot":"","sources":["../../src/lib/session-isolation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,cAAyC,EACzC,SAAoC,EACpC,OAA+B;IAE/B,wDAAwD;IACxD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,sBAAsB;IACtB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,OAAO,cAAc,KAAK,SAAS,CAAC;AACtC,CAAC"}

package/dist/lib/shared-memory.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Shared Memory State Layer
+ *
+ * Filesystem-based key-value store for cross-session memory sync
+ * between agents in /team and /pipeline workflows.
+ *
+ * Storage: .omc/state/shared-memory/{namespace}/{key}.json
+ *
+ * Each entry is a JSON file containing:
+ * - key: string identifier
+ * - value: arbitrary JSON-serializable data
+ * - namespace: grouping identifier (session group, pipeline run, etc.)
+ * - createdAt: ISO timestamp
+ * - updatedAt: ISO timestamp
+ * - ttl: optional time-to-live in seconds
+ * - expiresAt: optional ISO timestamp (computed from ttl)
+ *
+ * @see https://github.com/anthropics/oh-my-claudecode/issues/1119
+ */
+export interface SharedMemoryEntry {
+    key: string;
+    value: unknown;
+    namespace: string;
+    createdAt: string;
+    updatedAt: string;
+    /** TTL in seconds. Omitted or 0 means no expiry. */
+    ttl?: number;
+    /** Absolute expiry timestamp (ISO). Computed from ttl on write. */
+    expiresAt?: string;
+}
+export interface SharedMemoryListItem {
+    key: string;
+    updatedAt: string;
+    expiresAt?: string;
+}
+/**
+ * Check if shared memory is enabled via config.
+ *
+ * Reads `agents.sharedMemory.enabled` from ~/.claude/.omc-config.json.
+ * Defaults to true when the config key is absent (opt-out rather than opt-in
+ * once the feature ships, but tools check this gate).
+ */
+export declare function isSharedMemoryEnabled(): boolean;
+/**
+ * Write a key-value pair to shared memory.
+ *
+ * Creates or updates the entry. If ttl is provided, computes expiresAt.
+ */
+export declare function writeEntry(namespace: string, key: string, value: unknown, ttl?: number, worktreeRoot?: string): SharedMemoryEntry;
+/**
+ * Read a key from shared memory.
+ *
+ * Returns null if the key doesn't exist or has expired.
+ * Expired entries are automatically deleted on read.
+ */
+export declare function readEntry(namespace: string, key: string, worktreeRoot?: string): SharedMemoryEntry | null;
+/**
+ * List all keys in a namespace.
+ *
+ * Expired entries are filtered out (but not deleted during list).
+ */
+export declare function listEntries(namespace: string, worktreeRoot?: string): SharedMemoryListItem[];
+/**
+ * Delete a specific key from shared memory.
+ *
+ * Returns true if the key existed and was deleted.
+ */
+export declare function deleteEntry(namespace: string, key: string, worktreeRoot?: string): boolean;
+/**
+ * Clean up expired entries in a namespace (or all namespaces).
+ *
+ * Returns the count of entries removed.
+ */
+export declare function cleanupExpired(namespace?: string, worktreeRoot?: string): {
+    removed: number;
+    namespaces: string[];
+};
+/**
+ * List all namespaces that have shared memory entries.
+ */
+export declare function listNamespaces(worktreeRoot?: string): string[];
+//# sourceMappingURL=shared-memory.d.ts.map

package/dist/lib/shared-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-memory.d.ts","sourceRoot":"","sources":["../../src/lib/shared-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAQD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAe/C;AAqED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,iBAAiB,CAkDnB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,YAAY,CAAC,EAAE,MAAM,GACpB,iBAAiB,GAAG,IAAI,CAoB1B;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,oBAAoB,EAAE,CA8BxB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAaT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CA0D3C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAe9D"}