oh-my-codex 0.21.30 → 0.21.31

package/Cargo.lock

@@ -32,7 +32,7 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "omx-api"
-version = "0.21.30"
+version = "0.21.31"
 dependencies = [
  "serde",
  "serde_json",
@@ -40,14 +40,14 @@ dependencies = [
 
 [[package]]
 name = "omx-explore-harness"
-version = "0.21.30"
+version = "0.21.31"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "omx-mux"
-version = "0.21.30"
+version = "0.21.31"
 dependencies = [
  "serde",
  "serde_json",
@@ -55,7 +55,7 @@ dependencies = [
 
 [[package]]
 name = "omx-runtime"
-version = "0.21.30"
+version = "0.21.31"
 dependencies = [
  "fs2",
  "libc",
@@ -67,7 +67,7 @@ dependencies = [
 
 [[package]]
 name = "omx-runtime-core"
-version = "0.21.30"
+version = "0.21.31"
 dependencies = [
  "fs2",
  "serde",
@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "omx-sparkshell"
-version = "0.21.30"
+version = "0.21.31"
 dependencies = [
  "omx-mux",
 ]

package/Cargo.toml

@@ -11,7 +11,7 @@ resolver = "2"
 
 [workspace.package]
 
-version = "0.21.30"
+version = "0.21.31"
 
 edition = "2021"
 rust-version = "1.73"

package/dist/cli/__tests__/setup-symlink-destinations.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=setup-symlink-destinations.test.d.ts.map

package/dist/cli/__tests__/setup-symlink-destinations.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-symlink-destinations.test.d.ts","sourceRoot":"","sources":["../../../src/cli/__tests__/setup-symlink-destinations.test.ts"],"names":[],"mappings":""}

package/dist/cli/__tests__/setup-symlink-destinations.test.js

@@ -0,0 +1,180 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { setup } from '../setup.js';
+function setMockHome(home) {
+    const previousHome = process.env.HOME;
+    const previousCodexHome = process.env.CODEX_HOME;
+    process.env.HOME = home;
+    process.env.CODEX_HOME = join(home, '.codex');
+    return () => {
+        if (typeof previousHome === 'string')
+            process.env.HOME = previousHome;
+        else
+            delete process.env.HOME;
+        if (typeof previousCodexHome === 'string')
+            process.env.CODEX_HOME = previousCodexHome;
+        else
+            delete process.env.CODEX_HOME;
+    };
+}
+async function withRepo(run) {
+    const parent = await mkdtemp(join(tmpdir(), 'omx-setup-symlink-'));
+    const repo = join(parent, 'repo');
+    await mkdir(repo);
+    const restoreHome = setMockHome(join(parent, 'home'));
+    const previousCwd = process.cwd();
+    try {
+        process.chdir(repo);
+        await run(repo, parent);
+    }
+    finally {
+        process.chdir(previousCwd);
+        restoreHome();
+        await rm(parent, { recursive: true, force: true });
+    }
+}
+describe('omx setup symlink destinations', () => {
+    it('refuses a symlinked project .gitignore and leaves the target untouched', async () => {
+        await withRepo(async (repo, parent) => {
+            const victim = join(parent, 'victim.txt');
+            await writeFile(victim, 'ORIGINAL-SECRET-CONTENT\n');
+            await symlink('../victim.txt', join(repo, '.gitignore'));
+            const gitignorePath = join(repo, '.gitignore');
+            await assert.rejects(setup({ scope: 'project' }), (err) => {
+                const msg = err?.message || '';
+                return (msg.includes('Refusing to install through symlink') &&
+                    msg.includes(gitignorePath) &&
+                    msg.includes('Either remove the symlink'));
+            });
+            assert.equal(await readFile(victim, 'utf8'), 'ORIGINAL-SECRET-CONTENT\n');
+        });
+    });
+    it('refuses a symlinked prompt destination and leaves the target untouched', async () => {
+        await withRepo(async (repo, parent) => {
+            await mkdir(join(repo, '.codex', 'prompts'), { recursive: true });
+            const victim = join(parent, 'victim-prompt.txt');
+            await writeFile(victim, 'ORIGINAL-PROMPT-CONTENT\n');
+            const analystPath = join(repo, '.codex', 'prompts', 'analyst.md');
+            await symlink('../../../victim-prompt.txt', analystPath);
+            await assert.rejects(setup({ scope: 'project' }), (err) => {
+                const msg = err?.message || '';
+                return (msg.includes('Refusing to install through symlink') &&
+                    msg.includes(analystPath) &&
+                    msg.includes('Either remove the symlink'));
+            });
+            assert.equal(await readFile(victim, 'utf8'), 'ORIGINAL-PROMPT-CONTENT\n');
+        });
+    });
+    it('rejects a symlinked ancestor directory (.codex)', async () => {
+        await withRepo(async (repo, parent) => {
+            const targetDir = join(parent, 'external-codex');
+            await mkdir(targetDir);
+            const victim = join(targetDir, 'secret.txt');
+            await writeFile(victim, 'EXTERNAL-SECRET\n');
+            // Create .codex as a symlink to external directory
+            await symlink(targetDir, join(repo, '.codex'));
+            await assert.rejects(setup({ scope: 'project' }), (err) => {
+                const msg = err?.message || '';
+                return ((msg.includes('Refusing to install through symlink') || msg.includes('Refusing native hook transaction')) &&
+                    msg.includes('symlink') &&
+                    (msg.includes('Either remove the symlink') || msg.includes('is a symbolic link')));
+            });
+            assert.equal(await readFile(victim, 'utf8'), 'EXTERNAL-SECRET\n');
+        });
+    });
+    it('rejects a symlinked auth directory', async () => {
+        await withRepo(async (repo, parent) => {
+            const targetDir = join(parent, 'external-auth');
+            await mkdir(targetDir);
+            const victim = join(targetDir, 'token.txt');
+            await writeFile(victim, 'SECRET-TOKEN\n');
+            // Create .omx as a symlink to external directory
+            await symlink(targetDir, join(repo, '.omx'));
+            await assert.rejects(setup({ scope: 'project' }), (err) => {
+                const msg = err?.message || '';
+                return (msg.includes('Refusing to install through symlink') &&
+                    msg.includes('.omx') &&
+                    msg.includes('Either remove the symlink'));
+            });
+            assert.equal(await readFile(victim, 'utf8'), 'SECRET-TOKEN\n');
+        });
+    });
+    it('rejects a symlinked state directory that setup manages', async () => {
+        await withRepo(async (repo, parent) => {
+            const targetDir = join(parent, 'external-state');
+            await mkdir(targetDir);
+            const victim = join(targetDir, 'installed-skills.json');
+            await writeFile(victim, '{"version": 1}\n');
+            // Create .omx/state as a symlink to external directory, which setup writes to for installed-skills.json
+            await mkdir(join(repo, '.omx'), { recursive: true });
+            await symlink(targetDir, join(repo, '.omx', 'state'));
+            await assert.rejects(setup({ scope: 'project' }), (err) => {
+                const msg = err?.message || '';
+                return (msg.includes('Refusing to install through symlink') &&
+                    msg.includes('.omx') &&
+                    msg.includes('Either remove the symlink'));
+            });
+            assert.equal(await readFile(victim, 'utf8'), '{"version": 1}\n');
+        });
+    });
+    it('rejects a symlinked .omx directory even when hud-config.json would already exist', async () => {
+        await withRepo(async (repo, parent) => {
+            const targetDir = join(parent, 'external-omx');
+            await mkdir(targetDir);
+            // Create hud-config.json in the target so that the old code would skip validation
+            await mkdir(join(targetDir), { recursive: true });
+            await writeFile(join(targetDir, 'hud-config.json'), '{"preset": "focused"}\n');
+            // Create .omx as a symlink to external directory
+            await symlink(targetDir, join(repo, '.omx'));
+            await assert.rejects(setup({ scope: 'project' }), (err) => {
+                const msg = err?.message || '';
+                return (msg.includes('Refusing to install through symlink') &&
+                    msg.includes('.omx') &&
+                    msg.includes('Either remove the symlink'));
+            });
+        });
+    });
+    it('rejects a symlinked .omx/backups when backing up a managed file', async () => {
+        await withRepo(async (repo, parent) => {
+            const targetDir = join(parent, 'external-backups');
+            await mkdir(targetDir);
+            const victim = join(targetDir, 'secret-backup.txt');
+            // Create .omx/backups as a symlink to external directory
+            await mkdir(join(repo, '.omx'), { recursive: true });
+            await symlink(targetDir, join(repo, '.omx', 'backups'));
+            // Create an existing .gitignore to trigger the backup code path
+            await writeFile(join(repo, '.gitignore'), 'original-gitignore\n');
+            await assert.rejects(setup({ scope: 'project' }), (err) => {
+                const msg = err?.message || '';
+                return (msg.includes('Refusing to install through symlink') &&
+                    msg.includes('backups') &&
+                    msg.includes('Either remove the symlink'));
+            });
+            // Verify nothing was written to the victim directory
+            assert.equal(existsSync(victim), false, 'Backup should not be written outside the scope');
+        });
+    });
+    it('succeeds when scope root is under a symlinked parent (like /tmp on macOS) while still rejecting symlinks inside the managed tree', async () => {
+        // Regression test for issue #3887: On macOS, /tmp is a symlink to /private/tmp,
+        // so the setup should not reject paths just because they're under /tmp,
+        // but should still reject symlinks inside the managed scope (.codex, .omx, etc).
+        await withRepo(async (repo, parent) => {
+            // The repo is already under /tmp (symlinked parent), so this tests that
+            // OS-level symlinks are not rejected.
+            // Create a file to install
+            const skillDir = join(repo, '.codex', 'skills', 'test-skill');
+            await mkdir(skillDir, { recursive: true });
+            await writeFile(join(skillDir, 'SKILL.md'), '# Test Skill\n\nA test skill');
+            // Setup should succeed even though the scope root is under the /tmp symlink
+            await assert.doesNotReject(setup({ scope: 'project' }), 'Setup should succeed when scope root is under /tmp (symlinked OS directory)');
+            // Verify the setup actually completed
+            assert(existsSync(join(repo, '.gitignore')), '.gitignore should be created');
+            assert(existsSync(join(repo, '.codex', 'config.toml')), 'config.toml should be created');
+        });
+    });
+});
+//# sourceMappingURL=setup-symlink-destinations.test.js.map

package/dist/cli/__tests__/setup-symlink-destinations.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-symlink-destinations.test.js","sourceRoot":"","sources":["../../../src/cli/__tests__/setup-symlink-destinations.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACtC,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;;YACjE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,OAAO,iBAAiB,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,iBAAiB,CAAC;;YACjF,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoD;IAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3B,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC1C,MAAM,SAAS,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YAEzD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC/C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,CAAC,GAAQ,EAAE,EAAE;gBACX,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC/B,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;oBAC3B,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAC1C,CAAC;YACJ,CAAC,CACF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YACjD,MAAM,SAAS,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAClE,MAAM,OAAO,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAAC;YAEzD,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,CAAC,GAAQ,EAAE,EAAE;gBACX,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC/B,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACzB,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAC1C,CAAC;YACJ,CAAC,CACF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAC7C,MAAM,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAE7C,mDAAmD;YACnD,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAE/C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,CAAC,GAAQ,EAAE,EAAE;gBACX,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC/B,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;oBACzG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;oBACvB,CAAC,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAClF,CAAC;YACJ,CAAC,CACF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAChD,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,SAAS,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAE1C,iDAAiD;YACjD,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAE7C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,CAAC,GAAQ,EAAE,EAAE;gBACX,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC/B,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpB,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAC1C,CAAC;YACJ,CAAC,CACF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;YACxD,MAAM,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAE5C,wGAAwG;YACxG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAEtD,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,CAAC,GAAQ,EAAE,EAAE;gBACX,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC/B,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpB,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAC1C,CAAC;YACJ,CAAC,CACF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,kFAAkF;YAClF,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAE/E,iDAAiD;YACjD,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAE7C,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,CAAC,GAAQ,EAAE,EAAE;gBACX,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC/B,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpB,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAC1C,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;YAEpD,yDAAyD;YACzD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;YAExD,gEAAgE;YAChE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAElE,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,CAAC,GAAQ,EAAE,EAAE;gBACX,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC/B,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;oBACvB,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAC1C,CAAC;YACJ,CAAC,CACF,CAAC;YACF,qDAAqD;YACrD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gDAAgD,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kIAAkI,EAAE,KAAK,IAAI,EAAE;QAChJ,gFAAgF;QAChF,wEAAwE;QACxE,iFAAiF;QACjF,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACpC,wEAAwE;YACxE,sCAAsC;YACtC,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAE5E,4EAA4E;YAC5E,MAAM,MAAM,CAAC,aAAa,CACxB,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC3B,6EAA6E,CAC9E,CAAC;YAEF,sCAAsC;YACtC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC7E,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/cli/setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,IAAI,CAAC;AAMvD,OAAO,EAQN,KAAK,gCAAgC,EACrC,MAAM,gCAAgC,CAAC;AAiFxC,OAAO,EAEN,KAAK,aAAa,EAClB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EACN,mBAAmB,EACnB,eAAe,EACf,YAAY,EAKZ,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAiDhC,UAAU,YAAY;IACrB,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACzC,iBAAiB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACxC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACrE,0BAA0B,CAAC,EAAE,CAC5B,WAAW,EAAE,OAAO,CAAC,mBAAmB,CAAC,KACrC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,iBAAiB,CAAC,EAAE,CACnB,WAAW,EAAE,gBAAgB,KACzB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,kBAAkB,CAAC,EAAE,CACpB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,oBAAoB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,iCAAiC,CAAC,EAAE,CACnC,UAAU,EAAE,MAAM,KACd,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC,CAAC;IAC/D,0BAA0B,CAAC,EAAE,CAC5B,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EAAE,KACvB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,oBAAoB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAUD,UAAU,kBAAkB;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAOD,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACpB;AAuHD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAyB9F;AA0BD,KAAK,4BAA4B,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAgEhE,KAAK,iCAAiC,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AAClF,KAAK,iCAAiC,GACnC,qBAAqB,GACrB,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,+BAA+B,GAC/B,cAAc,GACd,eAAe,GACf,+BAA+B,GAC/B,cAAc,GACd,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,gCAAgC,GAChC,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,CAAC;AAG1B,KAAK,6BAA6B,GAC/B;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,UAAU,qCAAqC;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,6BAA6B,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,6BAA6B;IACtC,IAAI,EAAE,iCAAiC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qCAAqC,CAAC;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,6BAA6B,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC/B;AAED,UAAU,iCAAiC;IAC1C,IAAI,EAAE,iCAAiC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qCAAqC,CAAC;CAC9C;AAkDD,gFAAgF;AAChF,wBAAgB,8CAA8C,CAC7D,QAAQ,EACL,CAAC,CACF,KAAK,EAAE,iCAAiC,EACxC,MAAM,EAAE,6BAA6B,GAAG,iCAAiC,KACrE,IAAI,CAAC,GACR,SAAS,GACV,MAAM,IAAI,CAMZ;AAED,yFAAyF;AACzF,wBAAgB,uCAAuC,CACtD,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,GAChC,MAAM,IAAI,CAMZ;AAED,0EAA0E;AAC1E,wBAAgB,uCAAuC,CACtD,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,GACnC,MAAM,IAAI,CAMZ;AAED,wFAAwF;AACxF,wBAAgB,4CAA4C,CAC3D,QAAQ,EACL,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,KAAK,MAAM,CAAC,GACvD,SAAS,GAGV,MAAM,IAAI,CAMZ;AAED,yEAAyE;AACzE,wBAAgB,8CAA8C,CAC7D,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,GAC9D,MAAM,IAAI,CAMZ;AAED,yEAAyE;AACzE,wBAAgB,4CAA4C,CAC3D,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,SAAS,GAC3D,MAAM,IAAI,CAMZ;AAED,+EAA+E;AAC/E,wBAAgB,0CAA0C,CACzD,UAAU,EAAE,gCAAgC,GAAG,SAAS,GACtD,MAAM,IAAI,CAMZ;AAmYD,KAAK,sCAAsC,GACxC,gBAAgB,GAChB,YAAY,GACZ,WAAW,CAAC;AAsFf;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CACnD,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,QAAQ,EAAE,MAAM,GACd,sCAAsC,CA0CxC;AA6iCD,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,SAAa,GACnB,wBAAwB,CA6C1B;AAED,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;AAoND,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,GACjB,gBAAgB,CAoBlB;AAggDD,wBAAsB,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2qCrE;AAyqBD,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,kBAAkB,EACjC,OAAO,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAoK/B"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/cli/setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,IAAI,CAAC;AAMvD,OAAO,EAQN,KAAK,gCAAgC,EACrC,MAAM,gCAAgC,CAAC;AAiFxC,OAAO,EAEN,KAAK,aAAa,EAClB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EACN,mBAAmB,EACnB,eAAe,EACf,YAAY,EAKZ,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAiDhC,UAAU,YAAY;IACrB,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACzC,iBAAiB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACxC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACrE,0BAA0B,CAAC,EAAE,CAC5B,WAAW,EAAE,OAAO,CAAC,mBAAmB,CAAC,KACrC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,iBAAiB,CAAC,EAAE,CACnB,WAAW,EAAE,gBAAgB,KACzB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,kBAAkB,CAAC,EAAE,CACpB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,oBAAoB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,iCAAiC,CAAC,EAAE,CACnC,UAAU,EAAE,MAAM,KACd,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC,CAAC;IAC/D,0BAA0B,CAAC,EAAE,CAC5B,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EAAE,KACvB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,oBAAoB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAUD,UAAU,kBAAkB;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAOD,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACpB;AAuHD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAyB9F;AA0BD,KAAK,4BAA4B,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAgEhE,KAAK,iCAAiC,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AAClF,KAAK,iCAAiC,GACnC,qBAAqB,GACrB,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,+BAA+B,GAC/B,cAAc,GACd,eAAe,GACf,+BAA+B,GAC/B,cAAc,GACd,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,gCAAgC,GAChC,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,CAAC;AAG1B,KAAK,6BAA6B,GAC/B;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,UAAU,qCAAqC;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,6BAA6B,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,6BAA6B;IACtC,IAAI,EAAE,iCAAiC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qCAAqC,CAAC;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,6BAA6B,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC/B;AAED,UAAU,iCAAiC;IAC1C,IAAI,EAAE,iCAAiC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qCAAqC,CAAC;CAC9C;AAkDD,gFAAgF;AAChF,wBAAgB,8CAA8C,CAC7D,QAAQ,EACL,CAAC,CACF,KAAK,EAAE,iCAAiC,EACxC,MAAM,EAAE,6BAA6B,GAAG,iCAAiC,KACrE,IAAI,CAAC,GACR,SAAS,GACV,MAAM,IAAI,CAMZ;AAED,yFAAyF;AACzF,wBAAgB,uCAAuC,CACtD,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,GAChC,MAAM,IAAI,CAMZ;AAED,0EAA0E;AAC1E,wBAAgB,uCAAuC,CACtD,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,GACnC,MAAM,IAAI,CAMZ;AAED,wFAAwF;AACxF,wBAAgB,4CAA4C,CAC3D,QAAQ,EACL,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,KAAK,MAAM,CAAC,GACvD,SAAS,GAGV,MAAM,IAAI,CAMZ;AAED,yEAAyE;AACzE,wBAAgB,8CAA8C,CAC7D,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,GAC9D,MAAM,IAAI,CAMZ;AAED,yEAAyE;AACzE,wBAAgB,4CAA4C,CAC3D,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,SAAS,GAC3D,MAAM,IAAI,CAMZ;AAED,+EAA+E;AAC/E,wBAAgB,0CAA0C,CACzD,UAAU,EAAE,gCAAgC,GAAG,SAAS,GACtD,MAAM,IAAI,CAMZ;AAmYD,KAAK,sCAAsC,GACxC,gBAAgB,GAChB,YAAY,GACZ,WAAW,CAAC;AAsFf;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CACnD,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,QAAQ,EAAE,MAAM,GACd,sCAAsC,CA0CxC;AAyoCD,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,SAAa,GACnB,wBAAwB,CA6C1B;AAED,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;AA0ND,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,GACjB,gBAAgB,CAoBlB;AAigDD,wBAAsB,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6rCrE;AAgrBD,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,kBAAkB,EACjC,OAAO,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAyK/B"}

package/dist/cli/setup.js

@@ -2,7 +2,7 @@
  * omx setup - Automated installation of oh-my-codex
  * Installs skills, prompts, MCP servers config, and AGENTS.md
  */
-import { mkdir, cp, copyFile, readdir, readFile, rename, writeFile, stat, lstat, rm, open, chmod, } from "fs/promises";
+import { mkdir, cp, copyFile, readdir, readFile, rename, writeFile, stat, lstat, realpath, rm, open, chmod, } from "fs/promises";
 import { join, dirname, relative, basename, isAbsolute, sep, win32 } from "path";
 import { constants, existsSync } from "fs";
 import { spawnSync } from "child_process";
@@ -1241,7 +1241,88 @@ async function commitNativeHookTransaction(artifacts, preconditions, ancestorPre
         throw new Error(`Native hook transaction failed and was rolled back: ${message}`);
     }
 }
+/**
+ * Validates that a destination path is safe for managed setup operations (install, read, compare).
+ * Refuses if the destination is a symlink or lies outside the specified scope root,
+ * or if any ancestor component within the scope is a symlink.
+ *
+ * This guard prevents symlink attacks that would redirect reads, backups, and writes outside
+ * the managed tree. It validates every path component without following symlinks, but only
+ * checks ancestors within the scope root—never rejects OS-level symlinks above the managed
+ * scope (e.g., /var, /tmp on macOS which may be systemwide symlinks).
+ *
+ * MUST be called BEFORE reading/comparing contents and BEFORE mkdir of any intermediate dir.
+ * It is the single authoritative source of symlink validation for all managed scope writes.
+ *
+ * Addresses Codex findings:
+ * - 4351464979: validate before compare (filesDiffer) ✓
+ * - 4351464989: validate before compare (readFile) ✓
+ * - 4351560195: respects CODEX_HOME via codexHome() ✓
+ * - 4351560207: validate before compare ✓
+ * - 4351560219: validate before mkdir ✓
+ */
+async function assertManagedDestination(destinationPath, scopeRoot) {
+    // Resolve paths to absolute forms
+    const absolutePath = isAbsolute(destinationPath) ? destinationPath : join(process.cwd(), destinationPath);
+    const absoluteScopeRoot = isAbsolute(scopeRoot) ? scopeRoot : join(process.cwd(), scopeRoot);
+    // Resolve scope root to its real path (following all symlinks) to properly handle
+    // OS-level symlinks like /tmp -> /private/tmp on macOS. This allows us to detect when
+    // a destination lies outside the real managed scope.
+    let realScopeRoot;
+    try {
+        realScopeRoot = await realpath(absoluteScopeRoot);
+    }
+    catch (error) {
+        if (isMissingPathError(error)) {
+            // Scope root doesn't exist yet; use absolute path
+            realScopeRoot = absoluteScopeRoot;
+        }
+        else {
+            throw error;
+        }
+    }
+    // Verify destination is within the managed scope by checking relative path.
+    // Using realScopeRoot ensures we detect when symlinks in ancestors would escape the scope.
+    const relFromScope = relative(realScopeRoot, absolutePath);
+    if (relFromScope === '..' || relFromScope.startsWith(`..${sep}`)) {
+        throw new Error(`Destination ${absolutePath} is outside managed scope ${realScopeRoot}.`);
+    }
+    // Walk from destination up to and including the scope root, checking each component
+    // for symlinks. We do NOT resolve symlinks while walking (to catch them).
+    // Stop at the scope root (don't check parents of the scope root).
+    let currentPath = absolutePath;
+    const visited = new Set();
+    while (currentPath && currentPath !== dirname(currentPath)) {
+        if (visited.has(currentPath))
+            break; // Avoid infinite loops
+        visited.add(currentPath);
+        // Stop before checking ancestors beyond the scope root
+        if (currentPath === realScopeRoot)
+            break;
+        // Check if this path component is a symlink (using lstat, not stat)
+        let stats;
+        try {
+            stats = await lstat(currentPath);
+        }
+        catch (error) {
+            if (isMissingPathError(error)) {
+                // Path doesn't exist yet, move to parent
+                currentPath = dirname(currentPath);
+                continue;
+            }
+            throw error;
+        }
+        if (stats.isSymbolicLink()) {
+            const msg = `Refusing to install through symlink ${currentPath}. ` +
+                `Either remove the symlink (rm ${currentPath}), ` +
+                `or move the target to the expected location before running setup again.`;
+            throw new Error(msg);
+        }
+        currentPath = dirname(currentPath);
+    }
+}
 async function ensureBackup(destinationPath, contentChanged, backupContext, options) {
+    await assertManagedDestination(destinationPath, backupContext.baseRoot);
     if (!contentChanged || !existsSync(destinationPath))
         return false;
     const relativePath = relative(backupContext.baseRoot, destinationPath);
@@ -1250,6 +1331,7 @@ async function ensureBackup(destinationPath, contentChanged, backupContext, opti
         : relativePath;
     const backupPath = join(backupContext.backupRoot, safeRelativePath);
     if (!options.dryRun) {
+        await assertManagedDestination(backupPath, backupContext.baseRoot);
         await mkdir(dirname(backupPath), { recursive: true });
         await copyFile(destinationPath, backupPath);
     }
@@ -1435,7 +1517,7 @@ async function isUnmodifiedRecordedInstall(receiptPath, skillName, skillDir) {
  * The receipt therefore describes the installer's own output, and any extra entry present at
  * retirement time makes the comparison fail, which retains the directory.
  */
-async function writeInstalledSkillReceipt(receiptPath, skillsDir, writtenFilesBySkill, options) {
+async function writeInstalledSkillReceipt(receiptPath, skillsDir, writtenFilesBySkill, options, scopeRoot) {
     if (options.dryRun)
         return;
     const receipt = await readInstalledSkillReceipt(receiptPath);
@@ -1458,11 +1540,16 @@ async function writeInstalledSkillReceipt(receiptPath, skillsDir, writtenFilesBy
             delete receipt.skills[name];
     }
     try {
+        await assertManagedDestination(receiptPath, scopeRoot);
         await mkdir(dirname(receiptPath), { recursive: true });
         await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
     }
-    catch {
-        // A receipt we cannot persist simply means the next refresh retains conservatively.
+    catch (error) {
+        // Symlink assertions must propagate to prevent writes through symlinks
+        if (error instanceof Error && error.message.includes('Refusing to install through symlink')) {
+            throw error;
+        }
+        // A receipt we cannot persist for other reasons simply means the next refresh retains conservatively.
     }
 }
 async function isOmxManagedInstalledSkillDir(skillDir) {
@@ -1945,6 +2032,7 @@ function stripLegacyGitignoreEntries(content, legacyEntries) {
 }
 async function ensureProjectGitignore(projectRoot, backupContext, options) {
     const gitignorePath = join(projectRoot, ".gitignore");
+    await assertManagedDestination(gitignorePath, projectRoot);
     const destinationExists = existsSync(gitignorePath);
     const existing = destinationExists
         ? await readFile(gitignorePath, "utf-8")
@@ -2557,6 +2645,21 @@ export async function setup(options = {}) {
     const { disableHooks = false, force = false, repairPluginCache = false, dryRun = false, installMode: requestedInstallMode, mcpMode: requestedMcpMode, teamMode: requestedTeamMode, scope: requestedScope, verbose = false, skipNativeAgentRefresh: requestedSkipNativeAgentRefresh = false, setupScopePrompt, persistedSetupReviewPrompt, installModePrompt, modelUpgradePrompt, pluginAgentsMdPrompt, pluginDeveloperInstructionsPrompt, firstPartyMcpRemovalPrompt, } = options;
     const pkgRoot = getPackageRoot();
     const projectRoot = process.cwd();
+    // Validate .omx is never a symlink before any operations touch it
+    if (!dryRun) {
+        const omxPath = join(projectRoot, ".omx");
+        try {
+            await assertManagedDestination(omxPath, projectRoot);
+        }
+        catch (error) {
+            // Missing .omx is fine, but symlinks must be refused
+            if (error instanceof Error && error.message.includes("Refusing to install through symlink")) {
+                throw error;
+            }
+            // Any other error is unexpected
+            throw error;
+        }
+    }
     const persistedPreferences = await readPersistedSetupPreferences(projectRoot, { warnOnLegacyScope: true });
     let persistedReviewDecision = "keep";
     const effectiveScopeForInstallMode = requestedScope ?? persistedPreferences?.scope ?? DEFAULT_SETUP_SCOPE;
@@ -2788,25 +2891,23 @@ export async function setup(options = {}) {
     }
     // Step 1: Ensure directories exist
     console.log("[1/8] Creating directories...");
-    const dirs = isPluginInstallMode
-        ? [
-            scopeDirs.codexHomeDir,
-            scopeDirs.nativeAgentsDir,
-            omxStateDir(projectRoot),
-            omxPlansDir(projectRoot),
-            omxLogsDir(projectRoot),
-        ]
-        : [
-            scopeDirs.codexHomeDir,
-            scopeDirs.promptsDir,
-            scopeDirs.skillsDir,
-            scopeDirs.nativeAgentsDir,
-            omxStateDir(projectRoot),
-            omxPlansDir(projectRoot),
-            omxLogsDir(projectRoot),
-        ];
-    for (const dir of dirs) {
+    const userScopeDirs = isPluginInstallMode
+        ? [scopeDirs.codexHomeDir, scopeDirs.nativeAgentsDir]
+        : [scopeDirs.codexHomeDir, scopeDirs.promptsDir, scopeDirs.skillsDir, scopeDirs.nativeAgentsDir];
+    const projectScopeDirs = [omxStateDir(projectRoot), omxPlansDir(projectRoot), omxLogsDir(projectRoot)];
+    // Validate and create user-scope directories against user authority root
+    for (const dir of userScopeDirs) {
+        if (!dryRun) {
+            await assertManagedDestination(dir, backupContext.baseRoot);
+            await mkdir(dir, { recursive: true });
+        }
+        if (verbose)
+            console.log(`  mkdir ${dir}`);
+    }
+    // Validate and create project-scope directories against project authority root
+    for (const dir of projectScopeDirs) {
         if (!dryRun) {
+            await assertManagedDestination(dir, projectRoot);
             await mkdir(dir, { recursive: true });
         }
         if (verbose)
@@ -3305,6 +3406,10 @@ export async function setup(options = {}) {
     // Step 8: Configure HUD
     console.log("[8/8] Configuring HUD...");
     const hudConfigPath = join(projectRoot, ".omx", "hud-config.json");
+    // Validate .omx even when hud-config.json already exists to catch symlinks
+    if (!dryRun) {
+        await assertManagedDestination(hudConfigPath, projectRoot);
+    }
     if (force || !existsSync(hudConfigPath)) {
         if (!dryRun) {
             const defaultHudConfig = { preset: "focused" };
@@ -3415,6 +3520,7 @@ function isGitHubCliConfigured() {
     return cachedGitHubCliConfigured;
 }
 async function syncManagedFileFromDisk(srcPath, dstPath, summary, backupContext, options, verboseLabel) {
+    await assertManagedDestination(dstPath, backupContext.baseRoot);
     const destinationExists = existsSync(dstPath);
     const changed = !destinationExists || (await filesDiffer(srcPath, dstPath));
     if (!changed) {
@@ -3434,6 +3540,7 @@ async function syncManagedFileFromDisk(srcPath, dstPath, summary, backupContext,
     }
 }
 async function syncManagedContent(content, dstPath, summary, backupContext, options, verboseLabel) {
+    await assertManagedDestination(dstPath, backupContext.baseRoot);
     const destinationExists = existsSync(dstPath);
     let changed = true;
     if (destinationExists) {
@@ -3490,8 +3597,9 @@ async function readNativeAgentInstallManifest(agentsDir) {
         return { version: 1, files: {} };
     }
 }
-async function writeNativeAgentInstallManifest(agentsDir, manifest) {
+async function writeNativeAgentInstallManifest(agentsDir, manifest, scopeRoot) {
     const manifestPath = nativeAgentInstallManifestPath(agentsDir);
+    await assertManagedDestination(manifestPath, scopeRoot);
     await mkdir(dirname(manifestPath), { recursive: true });
     const sortedFiles = Object.fromEntries(Object.entries(manifest.files).sort(([left], [right]) => left.localeCompare(right)));
     await writeFile(manifestPath, JSON.stringify({ version: 1, files: sortedFiles }, null, 2) + "\n");
@@ -3499,6 +3607,7 @@ async function writeNativeAgentInstallManifest(agentsDir, manifest) {
 async function syncNativeAgentToml(content, dstPath, summary, backupContext, options, verboseLabel, manifest) {
     const fileName = basename(dstPath);
     const nextHash = hashContent(content);
+    await assertManagedDestination(dstPath, backupContext.baseRoot);
     const destinationExists = existsSync(dstPath);
     if (!destinationExists) {
         if (!options.dryRun) {
@@ -3718,6 +3827,7 @@ async function cleanupGeneratedNonInstallableNativeAgents(agentsDir, manifest, b
 async function refreshNativeAgentConfigs(pkgRoot, agentsDir, backupContext, options) {
     const summary = createEmptyCategorySummary();
     if (!options.dryRun) {
+        await assertManagedDestination(agentsDir, backupContext.baseRoot);
         await mkdir(agentsDir, { recursive: true });
     }
     const nativeAgentManifest = await readNativeAgentInstallManifest(agentsDir);
@@ -3800,7 +3910,7 @@ async function refreshNativeAgentConfigs(pkgRoot, agentsDir, backupContext, opti
         }
     }
     if (!options.dryRun) {
-        await writeNativeAgentInstallManifest(agentsDir, nativeAgentManifest);
+        await writeNativeAgentInstallManifest(agentsDir, nativeAgentManifest, backupContext.baseRoot);
     }
     return summary;
 }
@@ -3850,6 +3960,10 @@ export async function installSkills(srcDir, dstDir, backupContext, options) {
     const summary = createEmptyCategorySummary();
     if (!existsSync(srcDir))
         return summary;
+    // Validate the skills directory before creating any skill subdirectories
+    if (!options.dryRun) {
+        await assertManagedDestination(dstDir, backupContext.baseRoot);
+    }
     const installableSkillNames = getSetupInstallableSkillNames();
     const installableSkills = [];
     const manifest = tryReadCatalogManifest();
@@ -3906,6 +4020,7 @@ export async function installSkills(srcDir, dstDir, backupContext, options) {
         const skillSrc = skill.sourceDir;
         const skillDst = skill.destinationDir;
         if (!options.dryRun) {
+            await assertManagedDestination(skillDst, backupContext.baseRoot);
             await mkdir(skillDst, { recursive: true });
         }
         const skillFiles = await readdir(skillSrc);
@@ -3929,7 +4044,7 @@ export async function installSkills(srcDir, dstDir, backupContext, options) {
     // Without an authority path, refuse to create a receipt rather than placing deletion authority
     // in the user-writable skills directory.
     if (options.skillReceiptPath) {
-        await writeInstalledSkillReceipt(options.skillReceiptPath, dstDir, writtenFilesBySkill, options);
+        await writeInstalledSkillReceipt(options.skillReceiptPath, dstDir, writtenFilesBySkill, options, backupContext.baseRoot);
     }
     if (manifest && existsSync(dstDir)) {
         for (const staleSkill of staleCandidateSkillNames) {