oh-my-copilot 5.6.1 → 5.6.2

package/docs/CLAUDE.md

@@ -1,5 +1,5 @@
 <!-- OMC:START -->
-<!-- OMC:VERSION:5.6.1 -->
+<!-- OMC:VERSION:5.6.2 -->
 
 # oh-my-copilot - Intelligent Multi-Agent Orchestration
 

package/docs/MIGRATION.md

@@ -8,6 +8,7 @@ This guide covers all migration paths for oh-my-copilot. Find your current versi
 
 - [Unreleased: Team Instance Ownership](#unreleased-team-instance-ownership)
 - [Unreleased: Cancellation Scope](#unreleased-cancellation-scope)
+- [v5.6.1 → v5.6.2: Postinstall Hook](#v561--v562-postinstall-hook)
 - [v5.5.0 → v5.6.1: Fork Upgrade Guide](#v550--v561-fork-upgrade-guide)
 - [v5.1.0 → v5.5.0: Fork Upgrade Guide](#v510--v550-fork-upgrade-guide)
 - [v4.13.102 → v5.0.0: Fork Upgrade Guide](#v413102--v500-fork-upgrade-guide)
@@ -121,6 +122,22 @@ locations and descendants of system temp/OS roots are never used as roots.
 
 ---
 
+## v5.6.1 → v5.6.2: Postinstall Hook
+
+Fork **v5.6.2** ports upstream oh-my-claudecode `dev` 4280efb1f..486b85bbb.
+There is nothing to migrate: no config, command or skill changes.
+
+- Update with `npm install -g oh-my-copilot@5.6.2` or
+  `copilot plugin update oh-my-copilot@omc`.
+- `npm install` now runs `scripts/postinstall-contained-fs.mjs`. On macOS it
+  builds the contained-fs native addon if it is missing; if Node headers or
+  Xcode Command Line Tools are unavailable it prints a warning and you can
+  build later with `node scripts/build-contained-fs.mjs` from the package
+  root. On Linux and Windows it does nothing. The hook always exits 0, so it
+  never fails the install.
+
+---
+
 ## v5.5.0 → v5.6.1: Fork Upgrade Guide
 
 This section covers the upgrade from fork **v5.5.0** to fork **v5.6.1**. The

package/docs/REFERENCE.md

@@ -2,7 +2,7 @@
 
 Complete reference for oh-my-copilot. For quick start, see the main [README.md](../README.md).
 
-For v5.6.1, the plugin ships 20 agents, 61 skills, 21 command files, and one configured MCP server exposing exactly 55 tools.
+For v5.6.2, the plugin ships 20 agents, 61 skills, 21 command files, and one configured MCP server exposing exactly 55 tools.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-copilot",
-  "version": "5.6.1",
+  "version": "5.6.2",
   "description": "Multi-agent orchestration system for Copilot CLI - Inspired by oh-my-opencode",
   "type": "module",
   "main": "dist/index.js",
@@ -34,6 +34,9 @@
     "bridge/runtime-cli.cjs",
     "commands",
     "hooks",
+    "scripts/build-contained-fs.mjs",
+    "scripts/postinstall-contained-fs.mjs",
+    "scripts/verify-graph-contained-fs.mjs",
     "scripts",
     "skills",
     "templates",
@@ -92,6 +95,7 @@
     "generate:prompt-projections": "node scripts/generate-prompt-projections.mjs",
     "verify:prompt-projections": "node scripts/generate-prompt-projections.mjs --verify",
     "build:contained-fs": "node scripts/build-contained-fs.mjs",
+    "postinstall": "node scripts/postinstall-contained-fs.mjs",
     "build:copilot-hooks": "node scripts/copilot/build-hooks.mjs --write",
     "verify:copilot-hooks": "node scripts/copilot/build-hooks.mjs --verify",
     "build:copilot-agents": "node scripts/copilot/build-agents.mjs --write",
@@ -155,5 +159,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "ce5f338d6bc2e4dff0e6af4c15f0c1bb09d93c54"
+  "gitHead": "dff284086ef69f7bd488ba13346e66a90180d671"
 }

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-copilot",
-  "version": "5.6.1",
+  "version": "5.6.2",
   "description": "Multi-agent orchestration system for GitHub Copilot CLI",
   "author": {
     "name": "oh-my-copilot contributors"

package/scripts/build-contained-fs.mjs

@@ -6,8 +6,24 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 // Build-time only. Runtime never invokes a compiler or downloads a binary.
-if (process.platform !== 'darwin' && !process.argv.includes('--force')) process.exit(0);
-if (!['darwin', 'linux'].includes(process.platform)) throw new Error('Unsupported native build platform');
+
+// Original behavior: darwin only, unless --optional or --force is passed
+const isOptional = process.argv.includes('--optional');
+const isForceBuild = process.argv.includes('--force');
+
+// Skip on non-darwin platforms unless explicitly forced or optional
+if (process.platform !== 'darwin' && !isForceBuild && !isOptional) {
+  process.exit(0);
+}
+
+// Fail loudly if platform is unsupported AND not optional
+if (!['darwin', 'linux'].includes(process.platform)) {
+  if (isOptional) {
+    process.exit(0);
+  }
+  throw new Error('Unsupported native build platform');
+}
+
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const explicit = process.argv.find(arg => arg.startsWith('--headers='))?.slice('--headers='.length);
 const version = process.versions.node;
@@ -20,10 +36,16 @@ const candidates = [
   '/usr/local/include/node',
   '/usr/include/node',
 ].filter(Boolean);
+
 const headers = candidates.find(path => existsSync(join(path, 'node_api.h')));
 if (!headers) {
+  if (isOptional) {
+    // Graceful skip for optional builds
+    process.exit(0);
+  }
   throw new Error('Node development headers are required. Supply --headers=/absolute/path/to/include/node (node_api.h), or populate the node-gyp cache before building. No headers are downloaded by this script.');
 }
+
 for (const arch of process.platform === 'darwin' ? ['arm64', 'x64'] : [process.arch]) {
   const output = join(root, 'native', `contained-fs-${process.platform}-${arch}.node`);
   mkdirSync(dirname(output), { recursive: true });

package/scripts/git-guardrails.mjs

@@ -554,6 +554,14 @@ async function main() {
     process.exit(0);
   }
 
+  // Blocking requires both a destructive command and an active guard. The
+  // command parse is pure and cheap; the mode lookup reads state and runs git,
+  // so only pay for it when the command could actually be blocked (#4221).
+  const command = commandFromPayload(payload);
+  if (!command) process.exit(0);
+  const label = destructiveCommandLabel(command);
+  if (!label) process.exit(0);
+
   const explicit = process.env.OMC_GIT_GUARDRAILS === '1';
   let activeMode = null;
   if (!explicit) {
@@ -566,15 +574,8 @@ async function main() {
     if (!activeMode) process.exit(0);
   }
 
-  const command = commandFromPayload(payload);
-  if (!command) process.exit(0);
-
-  const label = destructiveCommandLabel(command);
-  if (label) {
-    process.stderr.write(`${guardMessage(label, activeMode)}\n`);
-    process.exit(2);
-  }
-  process.exit(0);
+  process.stderr.write(`${guardMessage(label, activeMode)}\n`);
+  process.exit(2);
 }
 
 await main();

package/scripts/postinstall-contained-fs.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+/**
+ * Optional postinstall hook for contained-fs native module.
+ * 
+ * Follows the same platform constraints as build-contained-fs.mjs:
+ * - darwin: always attempt to build
+ * - linux: skip gracefully (not built by default)
+ * - other: skip gracefully
+ * 
+ * Also skips in development environments (when .git exists).
+ */
+
+import { existsSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+// Determine package root
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const packageRoot = resolve(scriptDir, '..');
+
+// Skip if we're in development (source repo has .git)
+if (existsSync(resolve(packageRoot, '.git'))) {
+  process.exit(0);
+}
+
+// Skip on non-darwin platforms (consistent with build script default)
+if (process.platform !== 'darwin') {
+  process.exit(0);
+}
+
+// Check if native binary already exists for darwin
+const nativePath = `contained-fs-${process.platform}-${process.arch}.node`;
+const nativeBinary = resolve(packageRoot, 'native', nativePath);
+if (existsSync(nativeBinary)) {
+  process.exit(0);
+}
+
+// Attempt to build the optional native module on darwin. A failed build must
+// not fail `npm install`, but it must tell the user how to recover.
+const buildScript = resolve(scriptDir, 'build-contained-fs.mjs');
+const result = spawnSync(process.execPath, [buildScript, '--optional'], {
+  stdio: ['ignore', 'ignore', 'pipe'],
+  timeout: 120000,
+});
+
+if (!existsSync(nativeBinary)) {
+  const detail = result.error?.message ?? result.stderr?.toString().trim().split('\n').pop() ?? '';
+  console.warn(
+    `[oh-my-copilot] contained-fs native addon was not built${detail ? ` (${detail})` : ''}. ` +
+    `omg team/graph commands need it: run \`node scripts/build-contained-fs.mjs\` from ${packageRoot} ` +
+    '(requires Xcode Command Line Tools and Node headers).',
+  );
+}
+
+process.exit(0);

package/scripts/run.cjs

@@ -166,6 +166,7 @@ function resolveInnerTimeoutMs(manifestHook, platform = process.platform) {
 const TRUSTED_WORKER_HOOKS = new Map([
   ['keyword-detector.mjs', { event: 'UserPromptSubmit', timeoutCapMs: 8000 }],
   ['skill-injector.mjs', { event: 'UserPromptSubmit', timeoutCapMs: 12000 }],
+  ['git-guardrails.mjs', { event: 'PreToolUse' }],
   ['pre-tool-enforcer.mjs', { event: 'PreToolUse' }],
   ['post-tool-verifier.mjs', { event: 'PostToolUse' }],
   ['project-memory-posttool.mjs', { event: 'PostToolUse' }],
@@ -930,6 +931,15 @@ import(targetUrl).then(
 );
 `;
 
+/**
+ * git-guardrails.mjs is a no-op when explicitly disabled; skip starting its
+ * worker entirely. Returns 0 to exit, or null to run the worker.
+ */
+function gitGuardrailsPreCheck() {
+  if (process.env.OMC_GIT_GUARDRAILS === '0') return 0;
+  return null;
+}
+
 async function runWorker(targetPath, manifestHook, timeoutMs) {
   let worker;
   let terminal = false;
@@ -1034,6 +1044,14 @@ if (require.main === module) {
       const extraArgs = process.argv.slice(3);
       const workerManifestHook = resolveWorkerTarget(resolution, extraArgs);
       if (workerManifestHook) {
+        // Pre-check for git-guardrails: exit immediately if guard is disabled
+        if (basename(resolution.targetPath) === 'git-guardrails.mjs') {
+          const preCheckResult = gitGuardrailsPreCheck();
+          if (preCheckResult === 0) {
+            process.exitCode = 0;
+            return;
+          }
+        }
         const workerTimeoutMs = resolveTrustedWorkerTimeoutMs(resolution.targetPath, workerManifestHook);
         runWorker(resolution.targetPath, workerManifestHook, workerTimeoutMs).then(status => {
           process.exitCode = status;