oh-my-opencode 4.13.0 → 4.14.0

package/packages/omo-codex/plugin/components/codegraph/src/serve.ts

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
-import { spawn } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, extname, join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import {
 	cwd as processCwd,
 	env as processEnv,
-	execPath as processExecPath,
 	stdin as processStdin,
 	stderr as processStderr,
 	stdout as processStdout,
@@ -14,7 +12,7 @@ import {
 import type { Readable, Writable } from "node:stream";
 import { fileURLToPath } from "node:url";
 
-import { buildCodegraphEnv } from "../../../../../utils/src/codegraph/env.ts";
+import { buildCodegraphChildEnv, buildCodegraphEnv } from "../../../../../utils/src/codegraph/env.ts";
 import {
 	buildCodegraphNodeSkipHint,
 	evaluateCodegraphNodeSupport,
@@ -31,12 +29,19 @@ import {
 } from "../../../../../utils/src/codegraph/resolve.ts";
 import { getCodexOmoConfig, type CodexOmoConfig } from "../../../shared/src/config-loader.ts";
 import type { CodegraphConfig } from "./hook.js";
+import { runBridgedCodegraphProcess } from "./mcp-bridge.js";
 import { runUnavailableCodegraphMcpServer } from "./mcp-unavailable.js";
+import { SESSION_START_CWD_ENV } from "./session-start-worker.js";
+export { resolveServeProcessInvocation } from "./serve-invocation.js";
 
-export type ServeStdio = "inherit";
+export type ServeStdio = "pipe";
 
 export interface CodegraphServeProcessOptions {
+	readonly cwd: string;
 	readonly env: Record<string, string | undefined>;
+	readonly input: Readable;
+	readonly output: Writable;
+	readonly stderr: CodegraphServeStderr;
 	readonly stdio: ServeStdio;
 }
 
@@ -49,11 +54,6 @@ export type CodegraphProvisioner = (
 	options: EnsureCodegraphProvisionedOptions,
 ) => ReturnType<typeof ensureCodegraphProvisioned>;
 
-export interface ServeProcessInvocation {
-	readonly args: readonly string[];
-	readonly command: string;
-}
-
 export interface CodegraphServeStderr {
 	readonly write: (chunk: string) => void;
 }
@@ -79,13 +79,14 @@ const CODEGRAPH_SKIP_HINT =
 const CODEGRAPH_DISABLED_HINT =
 	"CodeGraph MCP skipped: disabled by OMO SOT config. Set [codex].codegraph.enabled=true to enable it.\n";
 const CODEGRAPH_VERSION = "1.0.1";
-const WINDOWS_CMD_EXTENSIONS = new Set([".bat", ".cmd"]);
-const WINDOWS_NODE_SCRIPT_EXTENSIONS = new Set([".cjs", ".js", ".mjs"]);
+const PROJECT_CWD_ENV_KEYS = ["OMO_CODEGRAPH_PROJECT_CWD", SESSION_START_CWD_ENV, "PWD"] as const;
 
 export async function runCodegraphServe(options: RunCodegraphServeOptions = {}): Promise<number> {
 	const env = options.env ?? processEnv;
 	const homeDir = options.homeDir ?? homedir();
-	const config = options.config ?? getCodexOmoConfig({ cwd: options.cwd ?? processCwd(), env, homeDir });
+	const wrapperCwd = options.cwd ?? processCwd();
+	const projectCwd = resolveProjectCwd(env, wrapperCwd);
+	const config = options.config ?? getCodexOmoConfig({ cwd: projectCwd, env, homeDir });
 	const codegraphConfig = config.codegraph ?? {};
 	if (codegraphConfig.enabled === false) {
 		return runUnavailableMcp(CODEGRAPH_DISABLED_HINT, options);
@@ -120,15 +121,16 @@ export async function runCodegraphServe(options: RunCodegraphServeOptions = {}):
 		return runUnavailableMcp(buildCodegraphNodeSkipHint(nodeSupport), options);
 	}
 
-	const runProcess = options.runProcess ?? runChildProcess;
+	const runProcess = options.runProcess ?? runBridgedCodegraphProcess;
 	const codegraphEnv = codegraphEnvForConfig(trustedInstallDir, homeDir, options.buildEnv);
-	const mergedEnv = {
-		...env,
-		...codegraphEnv,
-	};
+	const mergedEnv = buildCodegraphChildEnv({ ambientEnv: env, codegraphEnv, runtimeEnv: env });
 	return runProcess(resolution.command, [...resolution.argsPrefix, "serve", "--mcp"], {
+		cwd: projectCwd,
 		env: mergedEnv,
-		stdio: "inherit",
+		input: options.stdin ?? processStdin,
+		output: options.stdout ?? processStdout,
+		stderr: options.stderr ?? processStderr,
+		stdio: "pipe",
 	});
 }
 
@@ -185,6 +187,16 @@ function codegraphEnvForConfig(
 	return trustedInstallDir === undefined ? env : { ...env, CODEGRAPH_INSTALL_DIR: trustedInstallDir };
 }
 
+function resolveProjectCwd(env: Record<string, string | undefined>, fallback: string): string {
+	for (const key of PROJECT_CWD_ENV_KEYS) {
+		const candidate = env[key]?.trim();
+		if (candidate === undefined || candidate.length === 0) continue;
+		const resolved = resolve(candidate);
+		if (existsSync(resolved)) return resolved;
+	}
+	return resolve(fallback);
+}
+
 function provisionedBinFromInstallDir(installDir: string | undefined): string | null {
 	if (installDir === undefined) return null;
 	const candidate = join(installDir, "bin", process.platform === "win32" ? "codegraph.cmd" : "codegraph");
@@ -195,44 +207,6 @@ export async function runCodegraphServeCli(): Promise<void> {
 	process.exitCode = await runCodegraphServe();
 }
 
-async function runChildProcess(
-	command: string,
-	args: readonly string[],
-	options: CodegraphServeProcessOptions,
-): Promise<number> {
-	const invocation = resolveServeProcessInvocation(command, args);
-	const child = spawn(invocation.command, invocation.args, { env: options.env, stdio: options.stdio });
-	return new Promise<number>((resolve, reject) => {
-		child.once("error", reject);
-		child.once("exit", (code, signal) => {
-			if (code !== null) {
-				resolve(code);
-				return;
-			}
-			resolve(signal === null ? 0 : 1);
-		});
-	});
-}
-
-export function resolveServeProcessInvocation(
-	command: string,
-	args: readonly string[],
-	platform: NodeJS.Platform = process.platform,
-): ServeProcessInvocation {
-	if (platform !== "win32") return { args: [...args], command };
-
-	const extension = extname(command).toLowerCase();
-	if (WINDOWS_NODE_SCRIPT_EXTENSIONS.has(extension)) {
-		return { args: [command, ...args], command: processExecPath };
-	}
-
-	if (WINDOWS_CMD_EXTENSIONS.has(extension)) {
-		return { args: ["/d", "/s", "/c", command, ...args], command: "cmd.exe" };
-	}
-
-	return { args: [...args], command };
-}
-
 if (isDirectInvocation(process.argv[1])) {
 	runCodegraphServeCli().catch((error: unknown) => {
 		processStderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);

package/packages/omo-codex/plugin/components/codegraph/src/session-start-worker.ts

@@ -2,10 +2,10 @@ import { execFile } from "node:child_process";
 import { appendFileSync, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { extname, join } from "node:path";
-import { cwd as processCwd, env as processEnv, stderr as processStderr } from "node:process";
+import { cwd as processCwd, env as processEnv, execPath as processExecPath, stderr as processStderr } from "node:process";
 
 import { getCodexOmoConfig } from "../../../shared/src/config-loader.ts";
-import { buildCodegraphEnv } from "../../../../../utils/src/codegraph/env.ts";
+import { buildCodegraphChildEnv, buildCodegraphEnv } from "../../../../../utils/src/codegraph/env.ts";
 import { evaluateCodegraphNodeSupport, type CodegraphNodeSupport } from "../../../../../utils/src/codegraph/node-support.ts";
 import { ensureCodegraphProvisioned } from "../../../../../utils/src/codegraph/provision.ts";
 import {
@@ -28,6 +28,7 @@ export const SESSION_START_CWD_ENV = "OMO_CODEGRAPH_SESSION_START_CWD";
 const CODEGRAPH_VERSION = "1.0.1";
 const COMMAND_TIMEOUT_MS = 60_000;
 const WINDOWS_CMD_EXTENSIONS = new Set([".bat", ".cmd"]);
+const WINDOWS_NODE_SCRIPT_EXTENSIONS = new Set([".cjs", ".js", ".mjs"]);
 type CodegraphBootstrapConfig = CodegraphConfig & {
 	readonly trustedCodegraphInstallDir?: string;
 };
@@ -160,7 +161,7 @@ function jsonSaysInitialized(value: unknown): boolean | undefined {
 async function runCodegraphCommand(projectRoot: string, command: string, args: readonly string[], options: { readonly env: Record<string, string>; readonly timeoutMs: number }): Promise<CodegraphCommandResult> {
 	const invocation = resolveCodegraphCommandInvocation(command, args);
 	return new Promise((resolvePromise) => {
-		execFile(invocation.command, [...invocation.args], { cwd: projectRoot, encoding: "utf8", env: { ...process.env, ...options.env }, maxBuffer: 1024 * 1024, timeout: options.timeoutMs, windowsHide: true }, (error, stdout, stderr) => {
+		execFile(invocation.command, [...invocation.args], { cwd: projectRoot, encoding: "utf8", env: buildCodegraphChildEnv({ ambientEnv: processEnv, codegraphEnv: options.env }), maxBuffer: 1024 * 1024, timeout: options.timeoutMs, windowsHide: true }, (error, stdout, stderr) => {
 			if (error === null) {
 				resolvePromise({ exitCode: 0, stderr: toOutputText(stderr), stdout: toOutputText(stdout), timedOut: false });
 				return;
@@ -176,7 +177,9 @@ export function resolveCodegraphCommandInvocation(
 	platform: NodeJS.Platform = process.platform,
 ): { readonly args: readonly string[]; readonly command: string } {
 	if (platform !== "win32") return { args: [...args], command };
-	if (!WINDOWS_CMD_EXTENSIONS.has(extname(command).toLowerCase())) return { args: [...args], command };
+	const extension = extname(command).toLowerCase();
+	if (WINDOWS_NODE_SCRIPT_EXTENSIONS.has(extension)) return { args: [command, ...args], command: processExecPath };
+	if (!WINDOWS_CMD_EXTENSIONS.has(extension)) return { args: [...args], command };
 	return { args: ["/d", "/s", "/c", command, ...args], command: "cmd.exe" };
 }
 

package/packages/omo-codex/plugin/components/codegraph/test/hook.test.ts

@@ -15,6 +15,13 @@ import {
 const pluginRoot = resolve(fileURLToPath(new URL("../../..", import.meta.url)));
 const pluginConfigPath = resolve(pluginRoot, ".codex-plugin/plugin.json");
 
+function expectOmoCodegraphProjectStoreGuidance(context: string): void {
+	expect(context).toContain(".omo");
+	expect(context).toContain("codegraph");
+	expect(context).toContain("projects");
+	expect(context).toContain("project-");
+}
+
 describe("CodeGraph SessionStart hook", () => {
 	it("#given hook session-start cli args #when invoked with empty JSON input #then it emits valid JSON and exits zero", async () => {
 		// given
@@ -30,6 +37,7 @@ describe("CodeGraph SessionStart hook", () => {
 				stdin: Readable.from(["{}"]),
 				stdout: { write: (chunk) => stdout.push(chunk) },
 				spawnWorker: (invocation) => spawned.push(invocation),
+				statusProbe: () => Promise.resolve(false),
 			});
 
 			// then
@@ -67,12 +75,9 @@ describe("CodeGraph SessionStart hook", () => {
 		const parsed = JSON.parse(output);
 
 		// then
-		expect(parsed).toEqual({
-			hookSpecificOutput: {
-				hookEventName: "PostToolUse",
-				additionalContext: expect.stringContaining('"/Users/me/.omo/codegraph/projects/project-'),
-			},
-		});
+		expect(parsed.hookSpecificOutput.hookEventName).toBe("PostToolUse");
+		expect(parsed.hookSpecificOutput.additionalContext).toContain('CodeGraph is not initialized for "/Users/me/project"');
+		expectOmoCodegraphProjectStoreGuidance(parsed.hookSpecificOutput.additionalContext);
 		expect(parsed.hookSpecificOutput.additionalContext).toContain('run `codegraph init` from "/Users/me/project"');
 	});
 
@@ -92,7 +97,7 @@ describe("CodeGraph SessionStart hook", () => {
 
 		// then
 		expect(parsed.hookSpecificOutput.additionalContext).toContain('CodeGraph is not initialized for "/Users/me/project"');
-		expect(parsed.hookSpecificOutput.additionalContext).toContain('"/Users/me/.omo/codegraph/projects/project-');
+		expectOmoCodegraphProjectStoreGuidance(parsed.hookSpecificOutput.additionalContext);
 	});
 
 	it("#given CodeGraph is disabled by Codex SOT config #when SessionStart fires #then it skips without spawning", async () => {
@@ -214,10 +219,11 @@ describe("CodeGraph SessionStart hook", () => {
 			const result = await executeCodegraphSessionStartHook({
 				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
 				cwd: workspace,
-				env: { HOME: "/tmp/home", KEEP: "1" },
+				env: { HOME: "/tmp/home", KEEP: "1", OPENAI_API_KEY: "sk-test-secret" },
 				stdin: Readable.from(["{}"]),
 				stdout: { write: (chunk) => stdout.push(chunk) },
 				spawnWorker: (invocation) => spawned.push(invocation),
+				statusProbe: () => Promise.resolve(false),
 				workerCliPath: "/plugin/components/codegraph/dist/cli.js",
 			});
 
@@ -229,11 +235,12 @@ describe("CodeGraph SessionStart hook", () => {
 					command: process.execPath,
 					env: {
 						HOME: "/tmp/home",
-						KEEP: "1",
 						OMO_CODEGRAPH_SESSION_START_CWD: workspace,
 					},
 				},
 			]);
+			expect(spawned[0]?.env["OPENAI_API_KEY"]).toBeUndefined();
+			expect(spawned[0]?.env["KEEP"]).toBeUndefined();
 			expect(JSON.parse(stdout.join(""))).toEqual({
 				hookSpecificOutput: {
 					additionalContext: "LazyCodex CodeGraph bootstrap scheduled in background",
@@ -245,6 +252,33 @@ describe("CodeGraph SessionStart hook", () => {
 		}
 	});
 
+	it("#given CodeGraph is already initialized #when SessionStart fires #then it stays silent without spawning", async () => {
+		// given
+		const stdout: string[] = [];
+		const spawned: WorkerSpawnInvocation[] = [];
+		const workspace = mkdtempSync(join(tmpdir(), "omo-codegraph-initialized-workspace-"));
+
+		try {
+			// when
+			const result = await executeCodegraphSessionStartHook({
+				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
+				cwd: workspace,
+				env: { HOME: "/tmp/home", KEEP: "1" },
+				stdin: Readable.from(["{}"]),
+				stdout: { write: (chunk) => stdout.push(chunk) },
+				spawnWorker: (invocation) => spawned.push(invocation),
+				statusProbe: () => Promise.resolve(true),
+			});
+
+			// then
+			expect(result).toEqual({ action: "skipped-initialized", exitCode: 0 });
+			expect(spawned).toEqual([]);
+			expect(stdout.join("")).toBe("");
+		} finally {
+			rmSync(workspace, { recursive: true, force: true });
+		}
+	});
+
 	it("#given malformed hook input with CodeGraph disabled #when SessionStart fires #then it stays silent and exits zero", async () => {
 		// given
 		const stdout: string[] = [];

package/packages/omo-codex/plugin/components/codegraph/test/serve-mcp-bridge.test.ts

@@ -0,0 +1,146 @@
+import { describe, expect, it } from "bun:test";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PassThrough } from "node:stream";
+
+import { runCodegraphServe } from "../src/serve.ts";
+
+describe("runCodegraphServe MCP protocol bridge", () => {
+	it("#given Codex framed stdio and a newline-json CodeGraph child #when listing tools #then it bridges frames and serves from the project cwd", async () => {
+		// given
+		const tempRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-bridge-"));
+		const projectRoot = join(tempRoot, "project");
+		const pluginCacheRoot = join(tempRoot, "plugin-cache");
+		const fakeCodegraph = join(tempRoot, "codegraph-fake.cjs");
+		const childLog = join(tempRoot, "child.log");
+		const input = new PassThrough();
+		const output = new PassThrough();
+		let stdout = "";
+		output.on("data", (chunk: Buffer) => {
+			stdout += chunk.toString("utf8");
+		});
+
+		try {
+			mkdirSync(projectRoot, { recursive: true });
+			mkdirSync(pluginCacheRoot, { recursive: true });
+			writeFakeNewlineCodegraph(fakeCodegraph);
+
+			const run = runCodegraphServe({
+				cwd: pluginCacheRoot,
+				env: {
+					CODEGRAPH_ALLOW_UNSAFE_NODE: "1",
+					CODEGRAPH_FAKE_LOG: childLog,
+					OMO_CODEGRAPH_BIN: fakeCodegraph,
+					OMO_CODEGRAPH_PROJECT_CWD: projectRoot,
+					PATH: process.env["PATH"],
+				},
+				nodeVersion: "22.14.0",
+				buildEnv: () => ({}),
+				resolve: () => ({ argsPrefix: [], command: fakeCodegraph, exists: true, source: "env" }),
+				stderr: { write: () => undefined },
+				stdin: input,
+				stdout: output,
+			});
+
+			// when
+			input.end([
+				frameMcpRequest({
+					id: 1,
+					method: "initialize",
+					params: {
+						capabilities: {},
+						clientInfo: { name: "codex", version: "0.141.0" },
+						protocolVersion: "2025-06-18",
+					},
+				}),
+				frameMcpRequest({
+					id: 2,
+					method: "tools/list",
+					params: {},
+				}),
+			].join(""));
+			const exitCode = await run;
+
+			// then
+			expect(exitCode).toBe(0);
+			const bodies = parseMcpBodies(stdout);
+			expect(bodies).toEqual([
+				{
+					id: 1,
+					jsonrpc: "2.0",
+					result: {
+						capabilities: { tools: { listChanged: false } },
+						protocolVersion: "2025-06-18",
+						serverInfo: { name: "codegraph", version: "1.0.1" },
+					},
+				},
+				{
+					id: 2,
+					jsonrpc: "2.0",
+					result: {
+						tools: [
+							{ name: "codegraph_search" },
+							{ name: "codegraph_node" },
+							{ name: "codegraph_explore" },
+							{ name: "codegraph_callers" },
+						],
+					},
+				},
+			]);
+			expect(readFileSync(childLog, "utf8")).toContain(`cwd=${realpathSync(projectRoot)}`);
+		} finally {
+			rmSync(tempRoot, { recursive: true, force: true });
+		}
+	});
+});
+
+function writeFakeNewlineCodegraph(filePath: string): void {
+	writeFileSync(
+		filePath,
+		[
+			"#!/usr/bin/env node",
+			"const fs = require('node:fs');",
+			"const readline = require('node:readline');",
+			"fs.writeFileSync(process.env.CODEGRAPH_FAKE_LOG, `cwd=${process.cwd()}\\n`);",
+			"const rl = readline.createInterface({ input: process.stdin });",
+			"rl.on('line', (line) => {",
+			"  const request = JSON.parse(line);",
+			"  if (request.method === 'initialize') {",
+			"    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { capabilities: { tools: { listChanged: false } }, protocolVersion: request.params.protocolVersion, serverInfo: { name: 'codegraph', version: '1.0.1' } } }) + '\\n');",
+			"  }",
+			"  if (request.method === 'tools/list') {",
+			"    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { tools: [{ name: 'codegraph_search' }, { name: 'codegraph_node' }, { name: 'codegraph_explore' }, { name: 'codegraph_callers' }] } }) + '\\n');",
+			"  }",
+			"});",
+		].join("\n"),
+	);
+	chmodSync(filePath, 0o755);
+}
+
+function frameMcpRequest(request: {
+	readonly id: number;
+	readonly method: string;
+	readonly params: Record<string, unknown>;
+}): string {
+	const body = JSON.stringify({ jsonrpc: "2.0", ...request });
+	return `Content-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`;
+}
+
+function parseMcpBodies(transcript: string): readonly unknown[] {
+	const bodies: unknown[] = [];
+	let cursor = 0;
+	while (cursor < transcript.length) {
+		const headerEnd = transcript.indexOf("\r\n\r\n", cursor);
+		if (headerEnd === -1) break;
+		const header = transcript.slice(cursor, headerEnd);
+		const match = /^Content-Length: (?<length>\d+)$/m.exec(header);
+		if (match?.groups?.["length"] === undefined) break;
+		const length = Number.parseInt(match.groups["length"], 10);
+		const bodyStart = headerEnd + 4;
+		const body = transcript.slice(bodyStart, bodyStart + length);
+		bodies.push(JSON.parse(body));
+		cursor = bodyStart + length;
+	}
+	return bodies;
+}

package/packages/omo-codex/plugin/components/codegraph/test/serve.test.ts

@@ -10,18 +10,21 @@ import { resolveServeProcessInvocation, runCodegraphServe } from "../src/serve.t
 const componentRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 describe("runCodegraphServe", () => {
-	it("#given CodeGraph resolves #when serving MCP #then execs codegraph serve --mcp with inherited stdio and telemetry disabled", async () => {
+	it("#given CodeGraph resolves #when serving MCP #then execs codegraph serve --mcp with bridged stdio and telemetry disabled", async () => {
 		// given
+		const runCwd = componentRoot;
 		const calls: Array<{
 			readonly args: readonly string[];
 			readonly command: string;
+			readonly cwd: string;
 			readonly env: Record<string, string | undefined>;
-			readonly stdio: "inherit";
+			readonly stdio: "pipe";
 		}> = [];
 
 		// when
 		const exitCode = await runCodegraphServe({
-			env: { CUSTOM: "keep", HOME: "/tmp/home" },
+			cwd: runCwd,
+			env: { CUSTOM: "drop", HOME: "/tmp/home", OPENAI_API_KEY: "sk-test-secret" },
 			nodeVersion: "22.14.0",
 			homeDir: "/tmp/home",
 			buildEnv: ({ homeDir }) => ({
@@ -34,9 +37,9 @@ describe("runCodegraphServe", () => {
 			runProcess: (
 				command: string,
 				args: readonly string[],
-				options: { readonly env: Record<string, string | undefined>; readonly stdio: "inherit" },
+				options: { readonly cwd: string; readonly env: Record<string, string | undefined>; readonly stdio: "pipe" },
 			) => {
-				calls.push({ args, command, env: options.env, stdio: options.stdio });
+				calls.push({ args, command, cwd: options.cwd, env: options.env, stdio: options.stdio });
 				return Promise.resolve(7);
 			},
 			stderr: { write: () => undefined },
@@ -48,17 +51,19 @@ describe("runCodegraphServe", () => {
 			{
 				args: ["shim.js", "serve", "--mcp"],
 				command: "node",
+				cwd: resolve(runCwd),
 				env: {
 					CODEGRAPH_INSTALL_DIR: "/tmp/home/.omo/codegraph",
 					CODEGRAPH_NO_DOWNLOAD: "1",
 					CODEGRAPH_TELEMETRY: "0",
-					CUSTOM: "keep",
 					DO_NOT_TRACK: "1",
 					HOME: "/tmp/home",
 				},
-				stdio: "inherit",
+				stdio: "pipe",
 			},
 		]);
+		expect(calls[0]?.env["CUSTOM"]).toBeUndefined();
+		expect(calls[0]?.env["OPENAI_API_KEY"]).toBeUndefined();
 	});
 
 	it("#given an unsupported local Node but the unsafe override is set #when serving MCP #then it still spawns codegraph", async () => {

package/packages/omo-codex/plugin/components/codegraph/test/session-start-worker-flow.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -79,6 +79,20 @@ describe("CodeGraph SessionStart worker flow", () => {
 		});
 	});
 
+	it("#given Windows CodeGraph resolves to a Node script #when default worker runner builds invocation #then Node executes it", () => {
+		// given
+		const command = "C:\\Users\\test\\.omo\\codegraph\\bin\\codegraph.cjs";
+
+		// when
+		const invocation = resolveCodegraphCommandInvocation(command, ["status", "--json"], "win32");
+
+		// then
+		expect(invocation).toEqual({
+			args: [command, "status", "--json"],
+			command: process.execPath,
+		});
+	});
+
 	it("#given non-Windows codegraph command #when default worker runner builds invocation #then it executes directly", () => {
 		// given
 		const command = "/home/test/.omo/codegraph/bin/codegraph";
@@ -137,6 +151,62 @@ describe("CodeGraph SessionStart worker flow", () => {
 			}
 		}
 	});
+
+	it("#given ambient provider tokens #when default worker runner spawns CodeGraph #then child env only gets safe and controlled variables", async () => {
+		// given
+		const workspace = mkdtempSync(join(tmpdir(), "omo-codegraph-worker-env-"));
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-worker-env-home-"));
+		const logPath = join(homeDir, "child-env.jsonl");
+		const originalOpenAiKey = process.env["OPENAI_API_KEY"];
+		process.env["OPENAI_API_KEY"] = "sk-test-secret";
+
+		try {
+			const fakeCodegraphScript = [
+				"const fs = require('node:fs');",
+				`fs.appendFileSync(${JSON.stringify(logPath)}, JSON.stringify({install:process.env.CODEGRAPH_INSTALL_DIR,openai:process.env.OPENAI_API_KEY}) + '\\n');`,
+				"process.stdout.write('{\"initialized\":true}');",
+			].join("");
+
+			// when
+			const result = await runCodegraphSessionStartWorker({
+				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
+				cwd: workspace,
+				env: { HOME: homeDir },
+				logOutcome: () => undefined,
+				nodeVersion: "22.14.0",
+				deps: {
+					ensureGitignored: () => true,
+					ensureProvisioned: () => {
+						throw new Error("provisioning should not run when command is resolved");
+					},
+					prepareWorkspace: () => ({
+						dataDir: join(homeDir, ".omo/codegraph/projects/test"),
+						dataRoot: join(homeDir, ".omo/codegraph"),
+						linked: true,
+						mode: "global-linked",
+						projectLink: join(workspace, ".codegraph"),
+					}),
+					resolveCommand: () => ({ argsPrefix: ["-e", fakeCodegraphScript], command: process.execPath, exists: true, source: "bundled" }),
+				},
+			});
+
+			// then
+			expect(result).toEqual({ action: "synced" });
+			const captured = readFileSync(logPath, "utf8")
+				.trim()
+				.split("\n")
+				.map((line) => JSON.parse(line));
+			expect(captured).toEqual([
+				{ install: join(homeDir, ".omo", "codegraph") },
+				{ install: join(homeDir, ".omo", "codegraph") },
+			]);
+		} finally {
+			if (originalOpenAiKey === undefined) delete process.env["OPENAI_API_KEY"];
+			else process.env["OPENAI_API_KEY"] = originalOpenAiKey;
+			rmSync(workspace, { recursive: true, force: true });
+			rmSync(homeDir, { recursive: true, force: true });
+		}
+	});
 });
 
 async function withProcessPlatform(platform: NodeJS.Platform, run: () => Promise<void>): Promise<void> {

package/packages/omo-codex/plugin/components/comment-checker/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-comment-checker",
-	"version": "4.13.0",
+	"version": "4.14.0",
 	"description": "Codex plugin that runs comment-checker after edit-like PostToolUse hooks.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/git-bash/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sisyphuslabs/codex-git-bash-hook",
-	"version": "4.13.0",
+	"version": "4.14.0",
 	"description": "Codex hook component that reminds Windows sessions to prefer the OMO git_bash MCP.",
 	"type": "module",
 	"private": true,

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-lazycodex-executor-verify",
-	"version": "4.13.0",
+	"version": "4.14.0",
 	"description": "Codex SubagentStop evidence verifier for LazyCodex executor completions.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/lsp/dist/cli.js

@@ -446,7 +446,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)

package/packages/omo-codex/plugin/components/lsp/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-lsp",
-	"version": "4.13.0",
+	"version": "4.14.0",
 	"description": "Codex plugin that exposes Language Server Protocol tools and post-edit diagnostics.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/rules/dist/cli.js

@@ -4032,8 +4032,8 @@ function getSparkShellRuntimeAwareness(env = process.env, deps = {}) {
   return [
     SPARKSHELL_AWARENESS_MARKER,
     "",
-    `- Use \`${command} sparkshell <command>\` first for repo inspection, CLI smoke tests, git/history checks, and bounded command output. Raw \`rg\`/\`grep\`/\`cat\`/\`git\` are fallbacks when Sparkshell is unavailable or too narrow for the task.`,
-    `- Use \`${command} sparkshell --shell '<command>'\` only for shell metacharacters or pipelines.`,
+    `- Use \`${command} sparkshell <command> [args...]\` first for repo inspection, CLI smoke tests, git/history checks, and bounded command output. Pass ordinary commands as executable and arguments in separate argv tokens, for example \`${command} sparkshell rg --files\`; not \`${command} sparkshell 'rg --files'\`, because the quoted string is treated as one executable name. Raw \`rg\`/\`grep\`/\`cat\`/\`git\` are fallbacks when Sparkshell is unavailable or too narrow for the task.`,
+    `- Use \`${command} sparkshell --shell '<command>'\` only for shell syntax such as metacharacters, pipelines, redirects, command substitution, or variable expansion.`,
     `- Use \`${command} sparkshell --tmux-pane <pane-id> --tail-lines 400\` only to inspect an existing pane, never to launch ordinary commands. Tail lines must stay between 100 and 1000.`,
     "- When no native sidecar or appserver is available, Sparkshell silently falls back to raw command execution. `OMO_SPARKSHELL_BIN` selects a native sidecar path.",
     "- When `CODEX_THREAD_ID` identifies a Codex session, Sparkshell feeds recent session context (first/latest user request + last 5 conversation messages) into oversized-output condensation for relevance ranking, but never appends that context to command output. `OMO_SPARKSHELL_SESSION_CONTEXT=0` disables the lookup.",