oh-my-opencode 4.12.1 → 4.13.0

package/packages/shared-skills/skills/ultimate-browsing/scripts/tests/test_cookie_domain_filter.py

@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import shutil
+import sqlite3
+import sys
+import tempfile
+import unittest
+from collections.abc import Callable
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from extract_cookies import extract_cookies  # noqa: E402
+
+
+def _make_chromium_db(path: Path, rows: list[tuple[str, bytes, str]]) -> None:
+    conn = sqlite3.connect(str(path))
+    conn.execute(
+        "CREATE TABLE cookies (name TEXT, encrypted_value BLOB, host_key TEXT, path TEXT, "
+        "expires_utc INTEGER, is_secure INTEGER, is_httponly INTEGER, samesite INTEGER)"
+    )
+    conn.executemany(
+        "INSERT INTO cookies VALUES (?,?,?,?,?,?,?,?)",
+        [
+            (name, value, host, "/", 13_300_000_000_000_000, 1, 1, 1)
+            for name, value, host in rows
+        ],
+    )
+    conn.commit()
+    conn.close()
+
+
+def _make_firefox_db(path: Path, rows: list[tuple[str, str, str]]) -> None:
+    conn = sqlite3.connect(str(path))
+    conn.execute(
+        "CREATE TABLE moz_cookies (name TEXT, value TEXT, host TEXT, path TEXT, "
+        "expiry INTEGER, isSecure INTEGER, isHttpOnly INTEGER, sameSite INTEGER)"
+    )
+    conn.executemany(
+        "INSERT INTO moz_cookies VALUES (?,?,?,?,?,?,?,?)",
+        [
+            (name, value, host, "/", 9999999999, 1, 1, 1)
+            for name, value, host in rows
+        ],
+    )
+    conn.commit()
+    conn.close()
+
+
+class DomainFilter(unittest.TestCase):
+    def _base_with_db(self, rel: str, make: Callable[[Path], None]) -> Path:
+        base = Path(tempfile.mkdtemp())
+        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
+        db = base / rel
+        db.parent.mkdir(parents=True)
+        make(db)
+        return base
+
+    def test_chromium_does_not_overmatch_suffix_text(self) -> None:
+        base = self._base_with_db(
+            "Google/Chrome/User Data/Default/Cookies",
+            lambda p: _make_chromium_db(
+                p,
+                [
+                    ("exact", b"exact-value", "example.com"),
+                    ("sub", b"sub-value", ".login.example.com"),
+                    ("near", b"near-value", ".example.com"),
+                ],
+            ),
+        )
+
+        near = extract_cookies(
+            "chrome", ["ample.com"], platform="win32",
+            keyring_reader=lambda _s: b"k" * 32, base_override=base,
+        )
+        exact = extract_cookies(
+            "chrome", ["example.com"], platform="win32",
+            keyring_reader=lambda _s: b"k" * 32, base_override=base,
+        )
+
+        self.assertEqual(near, [])
+        self.assertEqual({cookie["name"] for cookie in exact}, {"exact", "near", "sub"})
+
+    def test_firefox_does_not_overmatch_suffix_text(self) -> None:
+        base = self._base_with_db(
+            "Firefox/Profiles/abc.default/cookies.sqlite",
+            lambda p: _make_firefox_db(
+                p,
+                [
+                    ("exact", "exact-value", "example.com"),
+                    ("sub", "sub-value", ".login.example.com"),
+                    ("near", "near-value", ".example.com"),
+                ],
+            ),
+        )
+
+        near = extract_cookies(
+            "firefox", ["ample.com"], platform="darwin", base_override=base,
+        )
+        exact = extract_cookies(
+            "firefox", ["example.com"], platform="darwin", base_override=base,
+        )
+
+        self.assertEqual(near, [])
+        self.assertEqual({cookie["name"] for cookie in exact}, {"exact", "near", "sub"})
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)

package/packages/shared-skills/skills/ultimate-browsing/scripts/tests/test_extract_cookies.py

@@ -0,0 +1,245 @@
+#!/usr/bin/env python3
+"""Synthetic-fixture tests for cross-platform cookie extraction (no live browser)."""
+from __future__ import annotations
+
+import shutil
+import sqlite3
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from typing import Callable
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from cookie_crypto import decrypt_chromium_value, derive_key  # noqa: E402
+from cookie_paths import UnsupportedPlatform, resolve_cookie_db  # noqa: E402
+from extract_cookies import extract_cookies, inject_cookies, write_cookie_file  # noqa: E402
+
+
+def _make_chromium_db(path: Path, name: str, encrypted_value: bytes, host: str) -> None:
+    conn = sqlite3.connect(str(path))
+    conn.execute(
+        "CREATE TABLE cookies (name TEXT, encrypted_value BLOB, host_key TEXT, path TEXT, "
+        "expires_utc INTEGER, is_secure INTEGER, is_httponly INTEGER, samesite INTEGER)"
+    )
+    conn.execute(
+        "INSERT INTO cookies VALUES (?,?,?,?,?,?,?,?)",
+        (name, encrypted_value, host, "/", 13_300_000_000_000_000, 1, 1, 1),
+    )
+    conn.commit()
+    conn.close()
+
+
+def _make_firefox_db(path: Path, name: str, value: str, host: str) -> None:
+    conn = sqlite3.connect(str(path))
+    conn.execute(
+        "CREATE TABLE moz_cookies (name TEXT, value TEXT, host TEXT, path TEXT, "
+        "expiry INTEGER, isSecure INTEGER, isHttpOnly INTEGER, sameSite INTEGER)"
+    )
+    conn.execute("INSERT INTO moz_cookies VALUES (?,?,?,?,?,?,?,?)", (name, value, host, "/", 9999999999, 1, 1, 1))
+    conn.commit()
+    conn.close()
+
+
+def _encrypt_cbc_v10(key: bytes, plaintext: str) -> bytes:
+    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+    data = plaintext.encode()
+    pad = 16 - (len(data) % 16)
+    padded = data + bytes([pad]) * pad
+    encryptor = Cipher(algorithms.AES128(key), modes.CBC(b" " * 16)).encryptor()
+    return b"v10" + encryptor.update(padded) + encryptor.finalize()
+
+
+def _encrypt_gcm_v10(key: bytes, plaintext: str) -> bytes:
+    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+    nonce = b"n" * 12
+    encryptor = Cipher(algorithms.AES(key), modes.GCM(nonce)).encryptor()
+    ciphertext = encryptor.update(plaintext.encode()) + encryptor.finalize()
+    return b"v10" + nonce + ciphertext + encryptor.tag
+
+
+class PathResolution(unittest.TestCase):
+    def test_macos_chromium_path(self) -> None:
+        base = Path(self.tmp())
+        target = base / "Google/Chrome/Default/Cookies"
+        target.parent.mkdir(parents=True)
+        target.write_bytes(b"")
+        self.assertEqual(resolve_cookie_db("chrome", "darwin", base_override=base), target)
+
+    def test_linux_chromium_network_path(self) -> None:
+        base = Path(self.tmp())
+        target = base / "google-chrome/Default/Network/Cookies"
+        target.parent.mkdir(parents=True)
+        target.write_bytes(b"")
+        self.assertEqual(resolve_cookie_db("chrome", "linux", base_override=base), target)
+
+    def test_windows_chromium_path(self) -> None:
+        base = Path(self.tmp())
+        target = base / "Google/Chrome/User Data/Default/Cookies"
+        target.parent.mkdir(parents=True)
+        target.write_bytes(b"")
+        self.assertEqual(resolve_cookie_db("chrome", "win32", base_override=base), target)
+
+    def test_unsupported_platform_raises(self) -> None:
+        with self.assertRaises(UnsupportedPlatform):
+            resolve_cookie_db("chrome", "sunos")
+
+    def test_unsupported_browser_raises(self) -> None:
+        with self.assertRaises(UnsupportedPlatform):
+            resolve_cookie_db("nonexistent", "darwin")
+
+    def tmp(self) -> str:
+        import tempfile
+
+        d = tempfile.mkdtemp()
+        self.addCleanup(lambda: __import__("shutil").rmtree(d, ignore_errors=True))
+        return d
+
+
+class KeyDerivation(unittest.TestCase):
+    def test_macos_iters_differ_from_linux(self) -> None:
+        secret = b"some-keychain-secret"
+        self.assertNotEqual(derive_key("darwin", secret), derive_key("linux", secret))
+        self.assertEqual(len(derive_key("darwin", secret)), 16)
+
+    def test_windows_passthrough_32_bytes(self) -> None:
+        key = b"k" * 32
+        self.assertEqual(derive_key("win32", key), key)
+
+    def test_windows_rejects_wrong_length(self) -> None:
+        with self.assertRaises(ValueError):
+            derive_key("win32", b"short")
+
+    def test_unsupported_platform_raises(self) -> None:
+        with self.assertRaises(UnsupportedPlatform):
+            derive_key("sunos", b"x")
+
+
+class Decryption(unittest.TestCase):
+    def test_macos_cbc_roundtrip(self) -> None:
+        key = derive_key("darwin", b"secret")
+        blob = _encrypt_cbc_v10(key, "session-token-123")
+        self.assertEqual(decrypt_chromium_value("darwin", key, blob), "session-token-123")
+
+    def test_windows_gcm_roundtrip(self) -> None:
+        key = b"k" * 32
+        blob = _encrypt_gcm_v10(key, "win-token-xyz")
+        self.assertEqual(decrypt_chromium_value("win32", key, blob), "win-token-xyz")
+
+
+class EndToEnd(unittest.TestCase):
+    def _base_with_db(self, rel: str, make: Callable[[Path], None]) -> Path:
+        base = Path(tempfile.mkdtemp())
+        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
+        db = base / rel
+        db.parent.mkdir(parents=True)
+        make(db)
+        return base
+
+    def test_chromium_extract_with_injected_keyring(self) -> None:
+        key = derive_key("darwin", b"secret")
+        blob = _encrypt_cbc_v10(key, "logged-in")
+        base = self._base_with_db(
+            "Google/Chrome/Default/Cookies",
+            lambda p: _make_chromium_db(p, "SID", blob, ".youtube.com"),
+        )
+        cookies = extract_cookies(
+            "chrome", ["youtube.com"], platform="darwin",
+            keyring_reader=lambda _s: b"secret", base_override=base,
+        )
+        self.assertEqual(len(cookies), 1)
+        self.assertEqual(cookies[0]["value"], "logged-in")
+        self.assertEqual(cookies[0]["name"], "SID")
+
+    def test_firefox_extract_unencrypted(self) -> None:
+        base = self._base_with_db(
+            "Firefox/Profiles/abc.default/cookies.sqlite",
+            lambda p: _make_firefox_db(p, "auth", "plain-value", ".example.com"),
+        )
+        cookies = extract_cookies("firefox", ["example.com"], platform="darwin", base_override=base)
+        self.assertEqual(len(cookies), 1)
+        self.assertEqual(cookies[0]["value"], "plain-value")
+
+
+class SecretHandling(unittest.TestCase):
+    def test_cookie_output_file_is_owner_only(self) -> None:
+        base = Path(tempfile.mkdtemp())
+        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
+        output = base / "cookies.json"
+
+        write_cookie_file(output, [{"name": "SID", "value": "secret"}])
+
+        self.assertEqual(output.stat().st_mode & 0o777, 0o600)
+        self.assertIn("secret", output.read_text())
+
+    def test_cookie_output_replaces_existing_file_only_after_private_temp_write(self) -> None:
+        base = Path(tempfile.mkdtemp())
+        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
+        output = base / "cookies.json"
+        output.write_text("old\n")
+        output.chmod(0o644)
+
+        def _dump(_cookies, f, indent: int) -> None:
+            self.assertEqual(output.read_text(), "old\n")
+            self.assertEqual(output.stat().st_mode & 0o777, 0o644)
+            temp_files = list(base.glob(".cookies.json.*.tmp"))
+            self.assertEqual(len(temp_files), 1)
+            self.assertEqual(temp_files[0].stat().st_mode & 0o777, 0o600)
+            f.write('[{"name": "SID", "value": "secret"}]')
+
+        with patch("extract_cookies.json.dump", side_effect=_dump):
+            write_cookie_file(output, [{"name": "SID", "value": "secret"}])
+
+        self.assertEqual(output.stat().st_mode & 0o777, 0o600)
+        self.assertIn("secret", output.read_text())
+
+    def test_cookie_output_refuses_symlinks(self) -> None:
+        base = Path(tempfile.mkdtemp())
+        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
+        target = base / "target.json"
+        target.write_text("{}")
+        link = base / "cookies.json"
+        link.symlink_to(target)
+
+        with self.assertRaises(ValueError):
+            write_cookie_file(link, [{"name": "SID", "value": "secret"}])
+
+    def test_cookie_output_refuses_dangling_symlinks(self) -> None:
+        base = Path(tempfile.mkdtemp())
+        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
+        link = base / "cookies.json"
+        link.symlink_to(base / "missing.json")
+
+        with self.assertRaises(ValueError):
+            write_cookie_file(link, [{"name": "SID", "value": "secret"}])
+
+    def test_inject_cookies_sends_values_over_stdin_not_argv(self) -> None:
+        cookie = {
+            "name": "SID",
+            "value": "secret-token",
+            "domain": ".youtube.com",
+            "path": "/",
+            "expires": 9999999999,
+            "secure": True,
+            "httpOnly": True,
+            "sameSite": "Lax",
+        }
+
+        with patch("extract_cookies.subprocess.run") as run:
+            run.return_value.returncode = 0
+            run.return_value.stdout = "1"
+            run.return_value.stderr = ""
+
+            inject_cookies([cookie], 9242)
+
+        command = run.call_args.args[0]
+        self.assertNotIn("secret-token", command)
+        self.assertIn("secret-token", run.call_args.kwargs["input"])
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)

package/packages/shared-skills/skills/ultraresearch/ATTRIBUTION.md

@@ -0,0 +1,49 @@
+# ATTRIBUTION / NOTICE
+
+This skill (`ultraresearch`, part of `@oh-my-opencode/shared-skills`) is authored by
+the oh-my-openagent project. One design idea is adapted from a third-party project,
+credited below. No third-party source is vendored here — only the verification idea
+is adapted into this skill's prompt contract.
+
+---
+
+## 1. insane-research (fivetaku) — inspiration for the claim-ledger verification gate
+
+The non-code claim-ledger verification gate (Phase 3b: a data-flow-lock where the
+synthesis may assert a high-risk non-code claim only after it clears `>= 2 independent
+source domains + 1 counter-search + a primary source`, otherwise it is abstained to an
+unresolved/refuted annex) is inspired by the data-flow-lock verification design in
+**insane-research** by fivetaku.
+
+- Source: https://github.com/fivetaku/insane-research
+- License: MIT (declared in the project's `README.md`).
+- **What is adapted:** the IDEA only — a verification gate whose output is the sole
+  allowlist the synthesis draws from, so skipping verification leaves nothing to
+  synthesize. No insane-research code is copied or redistributed. The upstream gate is
+  a Python checker (`validate_ledger.py`); this skill translates the concept into a
+  runtime-agnostic prompt + message-text contract, because the Codex Light edition has
+  no guaranteed Python.
+
+```
+MIT License
+
+Copyright (c) 2026 fivetaku
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/packages/shared-skills/skills/ultraresearch/SKILL.md

@@ -130,7 +130,7 @@ Role protocols — embed the relevant one in each spawn message; every worker ge
 
 - **Codebase (explore), 2-4 workers.** Grep with 3+ keyword variations; structural/AST search; LSP definitions and references; file-name globs; `git log --all -S '<keyword>'` and `--grep` for history including deleted code. Cross-validate hits across tools. Report absolute file paths, patterns with `file:line`, and how findings connect.
 - **Web (librarian), 3-6 workers.** At least 10 distinct websearch queries per worker, each with a different operator or angle (see Search craft); fetch the full page for every result that matters — snippets lie. Context7 with 3+ queries per known library. grep.app and `gh search code|repos|issues` for real-world usage. Official docs via sitemap discovery (`<base>/sitemap.xml`), then targeted pages.
-- **Browsing, 0-3 workers.** Pages plain fetch cannot read (WAF, dynamic rendering, login): use the browsing skill; capture screenshots when visual context matters.
+- **Browsing, 0-3 workers.** Pages plain fetch cannot read (WAF, 403, Cloudflare, dynamic rendering, login): the worker loads the `ultimate-browsing` skill and escalates through its tiers — Tier-1 insane-search engine first, then Tier-2 Chrome stealth — rather than abandoning the source. Capture screenshots when visual context matters. When one blocked territory hides many leads, fan out more browsing subagents in parallel for breadth instead of serializing one worker through them.
 - **Repo deep-dive (librarian), 0-2 workers.** Shallow-clone the most relevant repos to `${TMPDIR:-/tmp}`, pin the HEAD SHA, read core modules, follow call chains, return SHA-pinned permalinks.
 
 Example spawn (codebase axis; librarian, browsing, and repo-dive follow the same contract with their own protocol):
@@ -179,6 +179,25 @@ Reply with: the exact code, the full output, environment (OS, runtime, dependenc
 
 Journal each verdict to `verify-<slug>.md`.
 
+## Phase 3b — Lock non-code claims through a claim ledger
+
+Code settles code-shaped claims (Phase 3). Numeric, market-share, legal, dated, causal, and financial claims cannot be run — so they pass through a data-flow-lock instead (the verification idea adapted from fivetaku/insane-research): the synthesis may assert a high-risk non-code claim **only** if it cleared this gate, and the gate's output is the sole allowlist the synthesis draws from. Skip the gate and there is nothing to synthesize — the lock is self-enforcing.
+
+The claim ledger is orchestrator-owned. Workers only return verified-claim markers as message text, the same channel as EXPAND markers — never a file. As leads resolve, you record one ledger entry per asserted claim and compute its status; workers report claim candidates in their replies, and you decide.
+
+A high-risk claim clears the gate to `verified-claims` only when all hold:
+
+- **>= 2 independent source domains** corroborate it (two pages on the same domain count once).
+- **One counter-search** actively looked for a refutation and did not find a stronger one.
+- **A primary source** (the standard, filing, dataset, or first-party doc) backs it, not only secondary commentary.
+
+Anything that fails goes to an `Unresolved` (insufficient evidence) or `Refuted` (counter-search won) annex — abstention is a correct outcome, not a gap to paper over. Maintain `claim-ledger.md` with one row per claim — `claim | risk | domains | counter-search | primary? | status (verified/unresolved/refuted)` — and write the cleared rows into a `verified-claims` digest. Worker reply marker (message text, same channel as EXPAND):
+
+```
+## CLAIMS
+- CLAIM: <non-code assertion> — RISK: high|normal — SOURCES: <domain1, domain2> — COUNTER: <refutation search result> — PRIMARY: <primary source or none>
+```
+
 ## Phase 4 — Synthesize
 
 After convergence and all verifications, re-read the whole journal and write `SYNTHESIS.md`:
@@ -191,13 +210,13 @@ Workers: <total> · Waves: <count> · Sources: <count> · Verifications: <count>
 ## Findings by theme        — per theme: consensus, evidence links, key quote (<20 words, attributed), verified yes/no
 ## Codebase findings        — absolute paths with line references
 ## Sources (ranked)         — URL, what it contains, reliability, access date
-## Verified claims          — claim | verdict | verify-<slug>.md
+## Verified claims          — code: claim | verdict | verify-<slug>.md · non-code: only rows cleared into verified-claims
 ## Contradictions           — source A vs source B, resolution with evidence
-## Gaps                     — what saturation could not answer
+## Gaps                     — what saturation could not answer · unresolved/refuted claim-ledger rows
 ## Expansion trace          — per wave: workers → markers; convergence reason
 ```
 
-Deliver the synthesis with inline `[Source N]` citations on every claim. When no report was requested, this is the deliverable.
+Deliver the synthesis with inline `[Source N]` citations on every claim. Every high-risk non-code claim you assert must be a verified-claims row from Phase 3b — assert nothing the gate left in the unresolved/refuted annex. When no report was requested, this is the deliverable.
 
 ## Phase 5 — Report (only when requested)
 

package/packages/shared-skills/skills/ulw-plan/SKILL.md

@@ -15,7 +15,10 @@ Outcome-first: explore a lot, ask few sharp questions - or none, when the intent
 
 ## INTENT ROUTING - pick ONE intent reference
 
-After grounding, make ONE judgment and load ONE intent reference (you ALSO read `references/full-workflow.md` for the shared mechanics - see below). The test keys on whether the desired **OUTCOME** is clear, NOT on request length.
+After grounding, make ONE judgment, **ANNOUNCE it to the user in one line**, then load ONE intent reference (you ALSO read `references/full-workflow.md` for the shared mechanics - see below). The test keys on whether the desired **OUTCOME** is clear, NOT on request length. The announcement is the user's first signal of whether they will be interviewed — never skip it.
+
+> "Intent: **CLEAR** — you specified the exact endpoint and behavior. I will ask you the genuine forks I cannot resolve from the codebase."
+> "Intent: **UNCLEAR** — 'make auth better' is open-ended. I will research best-practice defaults and present them for your veto, no interview."
 
 - **OVERRIDE - explicit ask wins:** if the user explicitly asks to be questioned or interviewed ("ask me", "interview me", "why aren't you asking me" - in any language), route **CLEAR**, run the interview, and turn the adopt-default filter OFF: the user has claimed the forks, so every surviving one is ASKED, not defaulted. This beats the OUTCOME test below, even on a fuzzy brief.
 - **CLEAR** - the user knows the outcome; the only open items are preferences/tradeoffs the repo cannot answer (genuine owner-decisions). Read **`references/intent-clear.md`**: ask the surviving forks with WHY, run the normal approval gate, high-accuracy review is OPTIONAL (offered as one question).

package/packages/omo-codex/plugin/components/codegraph/dist/cli.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/packages/omo-codex/plugin/components/codegraph/dist/serve.d.ts

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-export type ServeStdio = "inherit";
-export type CodegraphCommandSource = "bundled" | "env" | "path" | "provisioned";
-export interface CodegraphCommandResolution {
-    readonly argsPrefix: readonly string[];
-    readonly command: string;
-    readonly exists: boolean;
-    readonly source: CodegraphCommandSource;
-}
-export interface CodegraphServeProcessOptions {
-    readonly env: Record<string, string | undefined>;
-    readonly stdio: ServeStdio;
-}
-export type CodegraphServeProcessRunner = (command: string, args: readonly string[], options: CodegraphServeProcessOptions) => Promise<number>;
-export interface CodegraphServeStderr {
-    readonly write: (chunk: string) => void;
-}
-export interface RunCodegraphServeOptions {
-    readonly buildEnv?: (options: {
-        readonly homeDir: string;
-    }) => Record<string, string>;
-    readonly env?: Record<string, string | undefined>;
-    readonly homeDir?: string;
-    readonly resolve?: (options: {
-        readonly env: Record<string, string | undefined>;
-        readonly homeDir: string;
-    }) => CodegraphCommandResolution;
-    readonly runProcess?: CodegraphServeProcessRunner;
-    readonly stderr?: CodegraphServeStderr;
-}
-export declare function runCodegraphServe(options?: RunCodegraphServeOptions): Promise<number>;
-export declare function runCodegraphServeCli(): Promise<void>;