oh-my-opencode 4.13.0 → 4.14.0

package/docs/reference/github-attachment-upload.md

@@ -0,0 +1,51 @@
+# GitHub PR Attachment Uploads
+
+Use this reference when a PR or issue body needs screenshots or other short-lived evidence images without committing them, creating a release asset, or using an external image host.
+
+## Contract
+
+- Upload through GitHub's own web attachment flow and use the resulting `https://github.com/user-attachments/assets/<uuid>` URL.
+- Keep temporary files under `/tmp` or an untracked evidence directory such as `.omo/evidence/...`.
+- Never commit generated screenshots, terminal PNGs, upload scripts with secrets, cookies, tokens, S3 form fields, or copied request headers.
+- Never use GitHub Releases for PR evidence images.
+- Never use external image hosters.
+
+## Direct Upload Flow
+
+The flow depends on an authenticated GitHub web session, not only a `gh` API token. GitHub's same-site cookie/session requirements mean the requests must carry the browser session cookies for `github.com`, the expected same-site/referrer context, and the CSRF tokens issued for the current PR or issue page. Treat every cookie and token as a secret.
+
+1. Open the target PR or issue page in an authenticated GitHub web session.
+2. Read the page's file-attachment CSRF token and repository id from the same page/session context.
+3. `POST https://github.com/upload/policies/assets` with:
+
+```json
+{
+  "repository_id": "REPOSITORY_ID",
+  "name": "terminal.png",
+  "size": 12345,
+  "content_type": "image/png",
+  "authenticity_token": "FILE_ATTACHMENT_CSRF_TOKEN"
+}
+```
+
+4. Upload the file bytes to S3 using the policy response's returned upload URL and form fields exactly as returned.
+5. `PUT https://github.com/upload/assets/:id` with the returned `asset_upload_authenticity_token`.
+6. Use only the final `https://github.com/user-attachments/assets/<uuid>` URL in the PR body.
+
+## Secret Handling
+
+Do not print cookies, authenticity tokens, S3 fields, authorization headers, or raw browser storage. A helper may print only the final user-attachments URL and non-secret file metadata such as filename, byte size, and content type. If a temporary script is needed, write it under `/tmp`, inspect it for accidental logging, and delete it after updating the PR body.
+
+For PR body editing, write the body to `/tmp/pr-body.md`, inspect it, then pass it to `gh pr edit --body-file /tmp/pr-body.md`. The body should include the final attachment URLs and local evidence paths, but never the upload transaction details.
+
+## Evidence Pattern
+
+```markdown
+## Visual Evidence
+
+- ANSI terminal rendering: https://github.com/user-attachments/assets/<uuid>
+- Long-line wrapping: https://github.com/user-attachments/assets/<uuid>
+- Local evidence: `.omo/evidence/20260623-web-terminal-rendering/`
+```
+
+If the authenticated browser session is unavailable, leave the PR ready with local evidence paths and state the blocker. Do not fall back to releases or external hosting.

package/docs/reference/web-terminal-visual-qa.md

@@ -0,0 +1,81 @@
+# Web Terminal Visual QA
+
+Use `script/qa/web-terminal-visual-qa.mjs` whenever QA needs TUI visual evidence. It turns a terminal or tmux transcript into browser-rendered evidence so PRs can carry the same artifacts as web UI visual QA.
+
+## Evidence Contract
+
+Each run writes these files under the chosen evidence directory:
+
+- `terminal.txt`: redacted plain terminal text for review and assertions.
+- `terminal-ansi.txt`: redacted ANSI capture when available.
+- `terminal.html`: browser-renderable terminal frame that preserves ANSI colors and SGR styles.
+- `terminal.png`: Chrome/Chromium screenshot with the same ANSI styling, unless `--no-browser` is used.
+- `metadata.json`: connector, source, output paths, and cleanup receipt.
+
+The PR should cite `metadata.json` and attach or link `terminal.png` for OpenCode/Codex TUI proof. For PR-body image hosting, use GitHub user attachments as documented in [docs/reference/github-attachment-upload.md](github-attachment-upload.md); do not commit temporary PNGs, use releases, or use external image hosts.
+
+## Redaction Contract
+
+The helper redacts terminal content before writing `terminal.txt`, `terminal-ansi.txt`, `terminal.html`, or `terminal.png`. Built-in rules cover common authorization headers, token/password/key assignments, GitHub tokens, and OpenAI-style `sk-...` tokens.
+
+Add exact local values with `--redact <literal>` and project-specific patterns with `--redact-regex <expr>`:
+
+```bash
+node script/qa/web-terminal-visual-qa.mjs \
+  --title "Codex TUI QA" \
+  --from-file .omo/evidence/run/capture.txt \
+  --evidence-dir .omo/evidence/run/codex-web-terminal \
+  --redact "$LOCAL_TOKEN" \
+  --redact-regex 'session_[A-Za-z0-9]+'
+```
+
+Custom `--redact-regex` rules replace the full regex match, even when the expression contains capture groups. Prefix-preserving redaction is reserved for the built-in authorization and key-assignment rules.
+
+Do not rely on screenshots to hide secrets. If a capture might include cookies, auth headers, raw env dumps, launchd environments, provider keys, or browser storage, redact first or summarize the run instead of storing the transcript.
+
+## Replay An Existing Capture
+
+Use this path for maximum OS compatibility, including Windows hosts without tmux:
+
+```bash
+node script/qa/web-terminal-visual-qa.mjs \
+  --title "Codex TUI QA" \
+  --from-file .omo/evidence/run/capture.txt \
+  --evidence-dir .omo/evidence/run/codex-web-terminal
+```
+
+Long terminal lines wrap by default for readable PR evidence. Pass `--no-wrap` only when horizontal scrolling is part of the behavior under test.
+
+## Run Through The PTY Connector
+
+Use this when `tmux` is available on macOS/Linux or a Windows environment that provides tmux, such as Git Bash/MSYS2:
+
+```bash
+node script/qa/web-terminal-visual-qa.mjs \
+  --title "OpenCode TUI QA" \
+  --command "opencode --help" \
+  --source-label "opencode help smoke" \
+  --cwd "$PWD" \
+  --evidence-dir .omo/evidence/run/opencode-web-terminal
+```
+
+`--command` starts a short-lived tmux-backed PTY connector, captures the pane, renders the web evidence, then records a `tmux kill-session` cleanup receipt in `metadata.json`. The raw --command string is process data and may contain inline secrets, so it is never persisted to metadata; use `--source-label` for a reviewer-safe description.
+
+## OS Notes
+
+- macOS/Linux: prefer `--command` when `tmux` is installed; otherwise replay a saved pane with `--from-file`.
+- Windows: prefer `--from-file` for native shells. Git Bash/MSYS2 environments with tmux may use `--command`.
+- Windows-native ConPTY live capture should plug into this same artifact and metadata contract before becoming required.
+
+## QA Guidance
+
+For OpenCode/Codex QA, pair the harness-specific smoke with this helper:
+
+1. Drive the TUI through the normal QA skill or script.
+2. Capture the pane or use the helper's `--command` mode.
+3. Store the output under `.omo/evidence/<YYYYMMDD>-<slug>/`.
+4. Review `terminal.txt`, `terminal-ansi.txt`, and `metadata.json` for accidental secrets before citing them.
+5. Include `terminal.png`, `terminal.txt`, and `metadata.json` in the evidence summary.
+6. Verify cleanup receipts: no leftover tmux sessions, PIDs, ports, or temp state.
+
+Tests alone are not TUI visual QA. The passing artifact is the rendered terminal evidence plus a binary observation, such as expected text present, no overflow, and no obvious border misalignment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-opencode",
-  "version": "4.13.0",
+  "version": "4.14.0",
   "description": "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
   "main": "./dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,6 +41,12 @@
     "dist",
     "bin",
     "postinstall.mjs",
+    "script/qa/web-terminal-redaction.d.mts",
+    "script/qa/web-terminal-redaction.mjs",
+    "script/qa/web-terminal-renderer.mjs",
+    "script/qa/web-terminal-visual-qa.mjs",
+    "docs/reference/github-attachment-upload.md",
+    "docs/reference/web-terminal-visual-qa.md",
     ".opencode/command",
     ".opencode/skills",
     ".agents/command",
@@ -100,7 +106,7 @@
     "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json && tsgo --noEmit -p packages/git-bash-mcp/tsconfig.json && tsgo --noEmit -p packages/lsp-core/tsconfig.json && tsgo --noEmit -p packages/utils/tsconfig.json && tsgo --noEmit -p packages/model-core/tsconfig.json && tsgo --noEmit -p packages/prompts-core/tsconfig.json && tsgo --noEmit -p packages/comment-checker-core/tsconfig.json && tsgo --noEmit -p packages/hashline-core/tsconfig.json && tsgo --noEmit -p packages/tmux-core/tsconfig.json && tsgo --noEmit -p packages/team-core/tsconfig.json && tsgo --noEmit -p packages/openclaw-core/tsconfig.json && tsgo --noEmit -p packages/boulder-state/tsconfig.json && tsgo --noEmit -p packages/telemetry-core/tsconfig.json && tsgo --noEmit -p packages/claude-code-compat-core/tsconfig.json && tsgo --noEmit -p packages/skills-loader-core/tsconfig.json && tsgo --noEmit -p packages/agents-md-core/tsconfig.json && tsgo --noEmit -p packages/omo-codex/plugin/shared/tsconfig.json && tsgo --noEmit -p packages/omo-codex/tsconfig.json && tsgo --noEmit -p packages/omo-opencode/tsconfig.json",
     "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",
     "test": "bun test",
-    "test:codex": "bun run build:codex-install && bun run build:git-bash-mcp && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && npm --prefix packages/lsp-tools-mcp test && npm --prefix packages/omo-codex/plugin ci && bun run --cwd packages/omo-codex/plugin build && node scripts/check-third-party-notices.mjs --ship && bun test packages/omo-opencode/src/cli/cli-installer.platform.test.ts packages/omo-codex/src/install/codex-cache.test.ts packages/omo-codex/src/install/codex-cleanup.test.ts packages/omo-codex/src/install/codex-config-agent-cleanup.test.ts packages/omo-codex/src/install/codex-config-autonomous-features.test.ts packages/omo-codex/src/install/codex-config-reasoning.test.ts packages/omo-codex/src/install/codex-config-toml.test.ts packages/omo-codex/src/install/codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex.test.ts packages/omo-codex/src/install/install-codex-packaged.test.ts packages/omo-codex/src/install/link-cached-plugin-agents.test.ts packages/omo-codex/src/**/*.test.ts packages/utils/src/jsonc-parser.test.ts packages/utils/src/frontmatter.test.ts packages/hashline-core/src/hash-computation.test.ts packages/hashline-core/src/smoke-untested-modules.test.ts packages/rules-engine/src/index.test.ts packages/rules-engine/src/security-boundary.test.ts packages/agents-md-core/src/injector.test.ts packages/omo-codex/plugin/components/lsp/test/package-smoke.test.ts && node --test packages/omo-codex/plugin/test/*.test.mjs packages/omo-codex/scripts/install-cache-copy.test.mjs packages/omo-codex/scripts/install-cli-args.test.mjs packages/omo-codex/scripts/install-delegated-command.test.mjs packages/omo-codex/scripts/install-config-autonomous-features.test.mjs packages/omo-codex/scripts/install-config-autonomous.test.mjs packages/omo-codex/scripts/install-config-reasoning.test.mjs packages/omo-codex/scripts/install-config.test.mjs packages/omo-codex/scripts/install-hook-targets.test.mjs packages/omo-codex/scripts/install-project-local-cleanup.test.mjs packages/omo-codex/scripts/install-lazycodex-version-stamp.test.mjs packages/omo-codex/scripts/install-local-entrypoint.test.mjs packages/omo-codex/scripts/install-local-git-bash-preflight.test.mjs packages/omo-codex/scripts/install-local.test.mjs packages/omo-codex/scripts/install-marketplace-cache.test.mjs packages/omo-codex/scripts/install-mcp-runtime.test.mjs packages/omo-codex/scripts/install-packaged-local.test.mjs packages/omo-codex/scripts/install-generated-bundle.test.mjs packages/omo-codex/scripts/install-agent-links.test.mjs packages/omo-codex/scripts/install-bin-links.test.mjs",
+    "test:codex": "bun run build:codex-install && bun run build:git-bash-mcp && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && npm --prefix packages/lsp-tools-mcp test && npm --prefix packages/omo-codex/plugin ci && bun run --cwd packages/omo-codex/plugin build && npm --prefix packages/omo-codex/plugin/components/codegraph run typecheck && npm --prefix packages/omo-codex/plugin/components/codegraph test && node scripts/check-third-party-notices.mjs --ship && bun test packages/omo-opencode/src/cli/cli-installer.platform.test.ts packages/omo-codex/src/install/codex-cache.test.ts packages/omo-codex/src/install/codex-cleanup.test.ts packages/omo-codex/src/install/codex-config-agent-cleanup.test.ts packages/omo-codex/src/install/codex-config-autonomous-features.test.ts packages/omo-codex/src/install/codex-config-reasoning.test.ts packages/omo-codex/src/install/codex-config-toml.test.ts packages/omo-codex/src/install/codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex.test.ts packages/omo-codex/src/install/install-codex-packaged.test.ts packages/omo-codex/src/install/link-cached-plugin-agents.test.ts packages/omo-codex/src/**/*.test.ts packages/utils/src/jsonc-parser.test.ts packages/utils/src/frontmatter.test.ts packages/hashline-core/src/hash-computation.test.ts packages/hashline-core/src/smoke-untested-modules.test.ts packages/rules-engine/src/index.test.ts packages/rules-engine/src/security-boundary.test.ts packages/agents-md-core/src/injector.test.ts packages/omo-codex/plugin/components/lsp/test/package-smoke.test.ts && node --test packages/omo-codex/plugin/test/*.test.mjs packages/omo-codex/scripts/install-cache-copy.test.mjs packages/omo-codex/scripts/install-cli-args.test.mjs packages/omo-codex/scripts/install-delegated-command.test.mjs packages/omo-codex/scripts/install-config-autonomous-features.test.mjs packages/omo-codex/scripts/install-config-autonomous.test.mjs packages/omo-codex/scripts/install-config-reasoning.test.mjs packages/omo-codex/scripts/install-config.test.mjs packages/omo-codex/scripts/install-hook-targets.test.mjs packages/omo-codex/scripts/install-project-local-cleanup.test.mjs packages/omo-codex/scripts/install-lazycodex-version-stamp.test.mjs packages/omo-codex/scripts/install-local-entrypoint.test.mjs packages/omo-codex/scripts/install-local-git-bash-preflight.test.mjs packages/omo-codex/scripts/install-local.test.mjs packages/omo-codex/scripts/install-marketplace-cache.test.mjs packages/omo-codex/scripts/install-mcp-context7-runtime.test.mjs packages/omo-codex/scripts/install-mcp-runtime.test.mjs packages/omo-codex/scripts/install-packaged-local.test.mjs packages/omo-codex/scripts/install-generated-bundle.test.mjs packages/omo-codex/scripts/install-agent-links.test.mjs packages/omo-codex/scripts/install-bin-links.test.mjs",
     "test:windows-codex": "bun run test:codex",
     "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build"
   },
@@ -172,18 +178,18 @@
     "typescript": "^6.0.3"
   },
   "optionalDependencies": {
-    "oh-my-opencode-darwin-arm64": "4.13.0",
-    "oh-my-opencode-darwin-x64": "4.13.0",
-    "oh-my-opencode-darwin-x64-baseline": "4.13.0",
-    "oh-my-opencode-linux-arm64": "4.13.0",
-    "oh-my-opencode-linux-arm64-musl": "4.13.0",
-    "oh-my-opencode-linux-x64": "4.13.0",
-    "oh-my-opencode-linux-x64-baseline": "4.13.0",
-    "oh-my-opencode-linux-x64-musl": "4.13.0",
-    "oh-my-opencode-linux-x64-musl-baseline": "4.13.0",
-    "oh-my-opencode-windows-arm64": "4.13.0",
-    "oh-my-opencode-windows-x64": "4.13.0",
-    "oh-my-opencode-windows-x64-baseline": "4.13.0"
+    "oh-my-opencode-darwin-arm64": "4.14.0",
+    "oh-my-opencode-darwin-x64": "4.14.0",
+    "oh-my-opencode-darwin-x64-baseline": "4.14.0",
+    "oh-my-opencode-linux-arm64": "4.14.0",
+    "oh-my-opencode-linux-arm64-musl": "4.14.0",
+    "oh-my-opencode-linux-x64": "4.14.0",
+    "oh-my-opencode-linux-x64-baseline": "4.14.0",
+    "oh-my-opencode-linux-x64-musl": "4.14.0",
+    "oh-my-opencode-linux-x64-musl-baseline": "4.14.0",
+    "oh-my-opencode-windows-arm64": "4.14.0",
+    "oh-my-opencode-windows-x64": "4.14.0",
+    "oh-my-opencode-windows-x64-baseline": "4.14.0"
   },
   "overrides": {
     "hono": "^4.12.18",

package/packages/lsp-core/src/lsp/process.ts

@@ -88,7 +88,10 @@ function wrap(proc: ChildProcess): SpawnedProcess {
 
 function killProcessTree(proc: ChildProcess, signal: NodeJS.Signals): void {
 	if (process.platform === "win32" && proc.pid) {
-		const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+		const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+			stdio: "ignore",
+			windowsHide: true,
+		});
 		if (!result.error && result.status === 0) return;
 		if (result.error) reportKillError("windows process tree kill", result.error);
 	}

package/packages/lsp-core/src/mcp.ts

@@ -55,6 +55,7 @@ export async function runMcpStdioServer(
 	await runJsonRpcStdioServer({
 		input,
 		output,
+		idleTimeoutMs: 0,
 		handler: handleLspMcpRequest,
 		handlerOptions: undefined,
 	});

package/packages/lsp-daemon/dist/cli.js

@@ -644,7 +644,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -3735,6 +3738,7 @@ async function runMcpStdioProxy(options = {}) {
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleProxyRequest,
     handlerOptions: callOptions,
     onHandlerError: (error) => {

package/packages/lsp-daemon/dist/index.js

@@ -419,7 +419,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -3728,6 +3731,7 @@ async function runMcpStdioProxy(options = {}) {
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleProxyRequest,
     handlerOptions: callOptions,
     onHandlerError: (error) => {

package/packages/lsp-daemon/dist/proxy.js

@@ -12,6 +12,7 @@ export async function runMcpStdioProxy(options = {}) {
     await runJsonRpcStdioServer({
         input,
         output,
+        idleTimeoutMs: 0,
         handler: handleProxyRequest,
         handlerOptions: callOptions,
         onHandlerError: (error) => {

package/packages/lsp-tools-mcp/dist/cli.js

@@ -421,7 +421,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -3297,6 +3300,7 @@ async function runMcpStdioServer(input = process.stdin, output = process.stdout)
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleLspMcpRequest,
     handlerOptions: undefined
   });

package/packages/lsp-tools-mcp/dist/lsp/manager.js

@@ -419,7 +419,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)

package/packages/lsp-tools-mcp/dist/mcp.js

@@ -639,7 +639,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -3296,6 +3299,7 @@ async function runMcpStdioServer(input = process.stdin, output = process.stdout)
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleLspMcpRequest,
     handlerOptions: undefined
   });

package/packages/lsp-tools-mcp/dist/tools.js

@@ -436,7 +436,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)

package/packages/omo-codex/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omo",
-  "version": "4.13.0",
+  "version": "4.14.0",
   "description": "One Codex plugin namespace for Yeongyu's local Codex components.",
   "author": {
     "name": "Yeongyu Kim",