oh-my-codex 0.16.4 → 0.17.1

package/dist/mcp/hermes-server.d.ts

@@ -0,0 +1,374 @@
+/**
+ * OMX Hermes Coordination MCP Server
+ * Small product-facing bridge for dispatch/status/artifact coordination.
+ */
+export declare function buildHermesServerTools(): ({
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            allow_mutation?: undefined;
+            session_id?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            limit?: undefined;
+            status?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required?: undefined;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            prompt: {
+                type: string;
+            };
+            worktreeName: {
+                type: string;
+            };
+            allow_mutation: {
+                type: string;
+                description: string;
+            };
+            session_id?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            limit?: undefined;
+            status?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            session_id: {
+                type: string;
+                description: string;
+            };
+            prompt: {
+                type: string;
+            };
+            actor: {
+                type: string;
+            };
+            allow_mutation: {
+                type: string;
+                description: string;
+            };
+            worktreeName?: undefined;
+            lines?: undefined;
+            limit?: undefined;
+            status?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            session_id: {
+                type: string;
+                description: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            allow_mutation?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            limit?: undefined;
+            status?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required?: undefined;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            lines: {
+                type: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            allow_mutation?: undefined;
+            session_id?: undefined;
+            actor?: undefined;
+            limit?: undefined;
+            status?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required?: undefined;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            limit: {
+                type: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            allow_mutation?: undefined;
+            session_id?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            status?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required?: undefined;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            session_id: {
+                type: string;
+                description: string;
+            };
+            status: {
+                type: string;
+                enum: string[];
+            };
+            limit: {
+                type: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            allow_mutation?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required?: undefined;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            session_id: {
+                type: string;
+                description: string;
+            };
+            question_id: {
+                type: string;
+            };
+            answer: {
+                type: string;
+            };
+            answers: {
+                type: string;
+                items: {
+                    type: string;
+                };
+            };
+            allow_mutation: {
+                type: string;
+                description: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            limit?: undefined;
+            status?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            path: {
+                type: string;
+            };
+            max_bytes: {
+                type: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            allow_mutation?: undefined;
+            session_id?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            limit?: undefined;
+            status?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            summary?: undefined;
+            pr_url?: undefined;
+            blocker?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workingDirectory: {
+                type: string;
+                description: string;
+            };
+            session_id: {
+                type: string;
+                description: string;
+            };
+            status: {
+                type: string;
+                enum: string[];
+            };
+            summary: {
+                type: string;
+            };
+            pr_url: {
+                type: string;
+            };
+            blocker: {
+                type: string;
+            };
+            allow_mutation: {
+                type: string;
+                description: string;
+            };
+            prompt?: undefined;
+            worktreeName?: undefined;
+            actor?: undefined;
+            lines?: undefined;
+            limit?: undefined;
+            question_id?: undefined;
+            answer?: undefined;
+            answers?: undefined;
+            path?: undefined;
+            max_bytes?: undefined;
+        };
+        required: string[];
+    };
+})[];
+export declare function handleHermesToolCall(request: {
+    params: {
+        name: string;
+        arguments?: Record<string, unknown>;
+    };
+}): Promise<{
+    isError?: boolean | undefined;
+    content: {
+        type: string;
+        text: string;
+    }[];
+}>;
+//# sourceMappingURL=hermes-server.d.ts.map

package/dist/mcp/hermes-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-server.d.ts","sourceRoot":"","sources":["../../src/mcp/hermes-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,wBAAgB,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsHrC;AAkBD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAC/D;;;;;;GAYA"}

package/dist/mcp/hermes-server.js

@@ -0,0 +1,158 @@
+/**
+ * OMX Hermes Coordination MCP Server
+ * Small product-facing bridge for dispatch/status/artifact coordination.
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { autoStartStdioMcpServer } from "./bootstrap.js";
+import { hermesListArtifacts, hermesListQuestionEvents, hermesListQuestions, hermesListSessions, hermesReadArtifact, hermesReadStatus, hermesReadTail, hermesReportStatus, hermesSendPrompt, hermesSubmitQuestionAnswer, hermesStartSession, } from "./hermes-bridge.js";
+const server = new Server({ name: "omx-hermes", version: "0.1.0" }, { capabilities: { tools: {} } });
+export function buildHermesServerTools() {
+    const workingDirectory = { type: "string", description: "Bounded OMX project/worktree directory" };
+    const sessionId = { type: "string", description: "OMX session_id (A-Z, a-z, 0-9, _, -)" };
+    const allowMutation = {
+        type: "boolean",
+        description: "Must be true for mutating operations; read tools ignore it.",
+    };
+    return [
+        {
+            name: "hermes_list_sessions",
+            description: "List known OMX session state for a bounded worktree without reading terminal UI.",
+            inputSchema: { type: "object", properties: { workingDirectory } },
+        },
+        {
+            name: "hermes_start_session",
+            description: "Start a new isolated OMX tmux session in disposable worktree mode for one bounded prompt.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    workingDirectory,
+                    prompt: { type: "string" },
+                    worktreeName: { type: "string" },
+                    allow_mutation: allowMutation,
+                },
+                required: ["workingDirectory", "prompt", "allow_mutation"],
+            },
+        },
+        {
+            name: "hermes_send_prompt",
+            description: "Queue one explicit prompt for a selected OMX exec session via the audited follow-up queue.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    workingDirectory,
+                    session_id: sessionId,
+                    prompt: { type: "string" },
+                    actor: { type: "string" },
+                    allow_mutation: allowMutation,
+                },
+                required: ["session_id", "prompt", "allow_mutation"],
+            },
+        },
+        {
+            name: "hermes_read_status",
+            description: "Read selected session/mode status JSON from OMX state files.",
+            inputSchema: { type: "object", properties: { workingDirectory, session_id: sessionId } },
+        },
+        {
+            name: "hermes_read_tail",
+            description: "Read the bounded OMX session history log tail, not tmux scrollback.",
+            inputSchema: { type: "object", properties: { workingDirectory, lines: { type: "number" } } },
+        },
+        {
+            name: "hermes_list_question_events",
+            description: "Read structured question lifecycle events for coordinator bridge correlation.",
+            inputSchema: { type: "object", properties: { workingDirectory, limit: { type: "number" } } },
+        },
+        {
+            name: "hermes_list_questions",
+            description: "List bounded structured question records without reading terminal UI.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    workingDirectory,
+                    session_id: sessionId,
+                    status: { type: "string", enum: ["open", "pending", "prompting", "answered", "aborted", "error"] },
+                    limit: { type: "number" },
+                },
+            },
+        },
+        {
+            name: "hermes_submit_question_answer",
+            description: "Submit a bounded structured answer by question id; never proxies arbitrary terminal input.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    workingDirectory,
+                    session_id: sessionId,
+                    question_id: { type: "string" },
+                    answer: { type: "object" },
+                    answers: { type: "array", items: { type: "object" } },
+                    allow_mutation: allowMutation,
+                },
+                required: ["question_id", "allow_mutation"],
+            },
+        },
+        {
+            name: "hermes_list_artifacts",
+            description: "List known safe result artifact files under .omx plans/specs/goals/context/reports.",
+            inputSchema: { type: "object", properties: { workingDirectory, limit: { type: "number" } } },
+        },
+        {
+            name: "hermes_read_artifact",
+            description: "Read one safe .omx result artifact by relative path with byte truncation.",
+            inputSchema: {
+                type: "object",
+                properties: { workingDirectory, path: { type: "string" }, max_bytes: { type: "number" } },
+                required: ["path"],
+            },
+        },
+        {
+            name: "hermes_report_status",
+            description: "Write a small final/blocker status report for Hermes without owning merge policy.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    workingDirectory,
+                    session_id: sessionId,
+                    status: { type: "string", enum: ["running", "blocked", "failed", "complete"] },
+                    summary: { type: "string" },
+                    pr_url: { type: "string" },
+                    blocker: { type: "string" },
+                    allow_mutation: allowMutation,
+                },
+                required: ["status", "allow_mutation"],
+            },
+        },
+    ];
+}
+const TOOL_HANDLERS = {
+    hermes_list_sessions: hermesListSessions,
+    hermes_start_session: hermesStartSession,
+    hermes_send_prompt: hermesSendPrompt,
+    hermes_list_question_events: hermesListQuestionEvents,
+    hermes_list_questions: hermesListQuestions,
+    hermes_submit_question_answer: hermesSubmitQuestionAnswer,
+    hermes_read_status: hermesReadStatus,
+    hermes_read_tail: hermesReadTail,
+    hermes_list_artifacts: hermesListArtifacts,
+    hermes_read_artifact: hermesReadArtifact,
+    hermes_report_status: hermesReportStatus,
+};
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: buildHermesServerTools() }));
+export async function handleHermesToolCall(request) {
+    const { name, arguments: args = {} } = request.params;
+    const handler = TOOL_HANDLERS[name];
+    if (!handler) {
+        return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
+    }
+    const result = await handler(args);
+    const isError = typeof result === "object" && result !== null && result.ok === false;
+    return {
+        content: [{ type: "text", text: JSON.stringify(result) }],
+        ...(isError ? { isError: true } : {}),
+    };
+}
+server.setRequestHandler(CallToolRequestSchema, handleHermesToolCall);
+autoStartStdioMcpServer("hermes", server);
+//# sourceMappingURL=hermes-server.js.map

package/dist/mcp/hermes-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-server.js","sourceRoot":"","sources":["../../src/mcp/hermes-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,MAAM,UAAU,sBAAsB;IACpC,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACnG,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IAC1F,MAAM,aAAa,GAAG;QACpB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,6DAA6D;KAC3E,CAAC;IACF,OAAO;QACL;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,kFAAkF;YAC/F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,EAAE;SAClE;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,2FAA2F;YACxG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,gBAAgB;oBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAChC,cAAc,EAAE,aAAa;iBAC9B;gBACD,QAAQ,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,CAAC;aAC3D;SACF;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,4FAA4F;YACzG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,gBAAgB;oBAChB,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,cAAc,EAAE,aAAa;iBAC9B;gBACD,QAAQ,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC;aACrD;SACF;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,8DAA8D;YAC3E,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE;SACzF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,qEAAqE;YAClF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC7F;QACD;YACE,IAAI,EAAE,6BAA6B;YACnC,WAAW,EAAE,+EAA+E;YAC5F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC7F;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,uEAAuE;YACpF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,gBAAgB;oBAChB,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;oBAClG,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;aACF;SACF;QACD;YACE,IAAI,EAAE,+BAA+B;YACrC,WAAW,EAAE,4FAA4F;YACzG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,gBAAgB;oBAChB,UAAU,EAAE,SAAS;oBACrB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACrD,cAAc,EAAE,aAAa;iBAC9B;gBACD,QAAQ,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;aAC5C;SACF;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,qFAAqF;YAClG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC7F;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,2EAA2E;YACxF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACzF,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,mFAAmF;YAChG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,gBAAgB;oBAChB,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE;oBAC9E,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,cAAc,EAAE,aAAa;iBAC9B;gBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC;aACvC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAwE;IACzF,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,kBAAkB;IACxC,kBAAkB,EAAE,gBAAgB;IACpC,2BAA2B,EAAE,wBAAwB;IACrD,qBAAqB,EAAE,mBAAmB;IAC1C,6BAA6B,EAAE,0BAA0B;IACzD,kBAAkB,EAAE,gBAAgB;IACpC,gBAAgB,EAAE,cAAc;IAChC,qBAAqB,EAAE,mBAAmB;IAC1C,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,kBAAkB;CACzC,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAE1C;IACC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAA2B,CAAC,EAAE,KAAK,KAAK,CAAC;IAC3G,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;AACtE,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC"}

package/dist/mcp/state-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state-paths.d.ts","sourceRoot":"","sources":["../../src/mcp/state-paths.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,kBAAkB,QAA0B,CAAC;AAC1D,eAAO,MAAM,0BAA0B,QAA0B,CAAC;AAOlE,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASxE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAkB9D;AAMD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAkB/D;AAoBD,wBAAgB,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAgCjF;AAqCD,wBAAgB,eAAe,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBjE;AAED,wBAAgB,WAAW,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAGjF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAExG;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkBjG;AAED,wBAAsB,iBAAiB,CACrC,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACnD,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED,wBAAsB,4BAA4B,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ/F;AAED,wBAAsB,qBAAqB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAcD,wBAAsB,qCAAqC,CACzD,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAc7B"}
+{"version":3,"file":"state-paths.d.ts","sourceRoot":"","sources":["../../src/mcp/state-paths.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,kBAAkB,QAA0B,CAAC;AAC1D,eAAO,MAAM,0BAA0B,QAA0B,CAAC;AAOlE,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASxE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAkB9D;AAMD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAkB/D;AAoBD,wBAAgB,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BjF;AAqED,wBAAgB,eAAe,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBjE;AAED,wBAAgB,WAAW,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAGjF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAExG;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkBjG;AAED,wBAAsB,iBAAiB,CACrC,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACnD,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED,wBAAsB,4BAA4B,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ/F;AAED,wBAAsB,qBAAqB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAcD,wBAAsB,qCAAqC,CACzD,gBAAgB,CAAC,EAAE,MAAM,EACzB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAc7B"}

package/dist/mcp/state-paths.js

@@ -1,5 +1,5 @@
 import { delimiter, isAbsolute, join, relative, resolve as resolvePath } from 'path';
-import { existsSync } from 'fs';
+import { existsSync, realpathSync } from 'fs';
 import { readFile, readdir } from 'fs/promises';
 import { isSessionStateUsable, readUsableSessionState, } from '../hooks/session.js';
 export const SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
@@ -87,8 +87,7 @@ export function resolveWorkingDirectoryForState(workingDirectory) {
     }
     if (!raw) {
         const cwd = resolvePath(process.cwd());
-        enforceWorkingDirectoryPolicy(cwd);
-        return cwd;
+        return enforceWorkingDirectoryPolicy(cwd);
     }
     let normalized = raw;
     if (process.platform === 'win32') {
@@ -107,8 +106,34 @@ export function resolveWorkingDirectoryForState(workingDirectory) {
         throw new Error('workingDirectory contains a NUL byte');
     }
     const resolved = resolvePath(normalized);
-    enforceWorkingDirectoryPolicy(resolved);
-    return resolved;
+    return enforceWorkingDirectoryPolicy(resolved);
+}
+function canonicalizeExistingPath(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    let current = path;
+    const suffixes = [];
+    while (true) {
+        const parent = resolvePath(current, '..');
+        if (parent === current)
+            break;
+        suffixes.unshift(current.substring(parent.length).replace(/^[\\/]+/, ''));
+        current = parent;
+        try {
+            const realParent = realpathSync.native(current);
+            return suffixes.reduce((acc, segment) => resolvePath(acc, segment), realParent);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    return path;
 }
 function parseAllowedWorkingDirectoryRoots() {
     const raw = process.env[WORKDIR_ALLOWLIST_ENV];
@@ -122,7 +147,12 @@ function parseAllowedWorkingDirectoryRoots() {
         if (part.includes('\0')) {
             throw new Error(`${WORKDIR_ALLOWLIST_ENV} contains an invalid root with a NUL byte`);
         }
-        return resolvePath(part);
+        const resolvedRoot = resolvePath(part);
+        const realRoot = canonicalizeExistingPath(resolvedRoot);
+        if (realRoot !== resolvedRoot) {
+            throw new Error(`${WORKDIR_ALLOWLIST_ENV} root "${resolvedRoot}" resolves through a symlink to "${realRoot}"`);
+        }
+        return realRoot;
     });
     return [...new Set(roots)];
 }
@@ -133,11 +163,13 @@ function isWithinRoot(path, root) {
 function enforceWorkingDirectoryPolicy(resolvedWorkingDirectory) {
     const roots = parseAllowedWorkingDirectoryRoots();
     if (roots.length === 0)
-        return;
-    const allowed = roots.some((root) => isWithinRoot(resolvedWorkingDirectory, root));
+        return resolvedWorkingDirectory;
+    const canonicalWorkingDirectory = canonicalizeExistingPath(resolvedWorkingDirectory);
+    const allowed = roots.some((root) => isWithinRoot(canonicalWorkingDirectory, root));
     if (!allowed) {
-        throw new Error(`workingDirectory "${resolvedWorkingDirectory}" is outside allowed roots (${WORKDIR_ALLOWLIST_ENV})`);
+        throw new Error(`workingDirectory "${canonicalWorkingDirectory}" is outside allowed roots (${WORKDIR_ALLOWLIST_ENV})`);
     }
+    return canonicalWorkingDirectory;
 }
 export function getBaseStateDir(workingDirectory) {
     const teamStateRootOverride = process.env.OMX_TEAM_STATE_ROOT?.trim();