oh-my-opencode 4.13.0 → 4.14.1

package/docs/reference/github-attachment-upload.md

@@ -0,0 +1,51 @@
+# GitHub PR Attachment Uploads
+
+Use this reference when a PR or issue body needs screenshots or other short-lived evidence images without committing them, creating a release asset, or using an external image host.
+
+## Contract
+
+- Upload through GitHub's own web attachment flow and use the resulting `https://github.com/user-attachments/assets/<uuid>` URL.
+- Keep temporary files under `/tmp` or an untracked evidence directory such as `.omo/evidence/...`.
+- Never commit generated screenshots, terminal PNGs, upload scripts with secrets, cookies, tokens, S3 form fields, or copied request headers.
+- Never use GitHub Releases for PR evidence images.
+- Never use external image hosters.
+
+## Direct Upload Flow
+
+The flow depends on an authenticated GitHub web session, not only a `gh` API token. GitHub's same-site cookie/session requirements mean the requests must carry the browser session cookies for `github.com`, the expected same-site/referrer context, and the CSRF tokens issued for the current PR or issue page. Treat every cookie and token as a secret.
+
+1. Open the target PR or issue page in an authenticated GitHub web session.
+2. Read the page's file-attachment CSRF token and repository id from the same page/session context.
+3. `POST https://github.com/upload/policies/assets` with:
+
+```json
+{
+  "repository_id": "REPOSITORY_ID",
+  "name": "terminal.png",
+  "size": 12345,
+  "content_type": "image/png",
+  "authenticity_token": "FILE_ATTACHMENT_CSRF_TOKEN"
+}
+```
+
+4. Upload the file bytes to S3 using the policy response's returned upload URL and form fields exactly as returned.
+5. `PUT https://github.com/upload/assets/:id` with the returned `asset_upload_authenticity_token`.
+6. Use only the final `https://github.com/user-attachments/assets/<uuid>` URL in the PR body.
+
+## Secret Handling
+
+Do not print cookies, authenticity tokens, S3 fields, authorization headers, or raw browser storage. A helper may print only the final user-attachments URL and non-secret file metadata such as filename, byte size, and content type. If a temporary script is needed, write it under `/tmp`, inspect it for accidental logging, and delete it after updating the PR body.
+
+For PR body editing, write the body to `/tmp/pr-body.md`, inspect it, then pass it to `gh pr edit --body-file /tmp/pr-body.md`. The body should include the final attachment URLs and local evidence paths, but never the upload transaction details.
+
+## Evidence Pattern
+
+```markdown
+## Visual Evidence
+
+- ANSI terminal rendering: https://github.com/user-attachments/assets/<uuid>
+- Long-line wrapping: https://github.com/user-attachments/assets/<uuid>
+- Local evidence: `.omo/evidence/20260623-web-terminal-rendering/`
+```
+
+If the authenticated browser session is unavailable, leave the PR ready with local evidence paths and state the blocker. Do not fall back to releases or external hosting.

package/docs/reference/web-terminal-visual-qa.md

@@ -0,0 +1,81 @@
+# Web Terminal Visual QA
+
+Use `script/qa/web-terminal-visual-qa.mjs` whenever QA needs TUI visual evidence. It turns a terminal or tmux transcript into browser-rendered evidence so PRs can carry the same artifacts as web UI visual QA.
+
+## Evidence Contract
+
+Each run writes these files under the chosen evidence directory:
+
+- `terminal.txt`: redacted plain terminal text for review and assertions.
+- `terminal-ansi.txt`: redacted ANSI capture when available.
+- `terminal.html`: browser-renderable terminal frame that preserves ANSI colors and SGR styles.
+- `terminal.png`: Chrome/Chromium screenshot with the same ANSI styling, unless `--no-browser` is used.
+- `metadata.json`: connector, source, output paths, and cleanup receipt.
+
+The PR should cite `metadata.json` and attach or link `terminal.png` for OpenCode/Codex TUI proof. For PR-body image hosting, use GitHub user attachments as documented in [docs/reference/github-attachment-upload.md](github-attachment-upload.md); do not commit temporary PNGs, use releases, or use external image hosts.
+
+## Redaction Contract
+
+The helper redacts terminal content before writing `terminal.txt`, `terminal-ansi.txt`, `terminal.html`, or `terminal.png`. Built-in rules cover common authorization headers, token/password/key assignments, GitHub tokens, and OpenAI-style `sk-...` tokens.
+
+Add exact local values with `--redact <literal>` and project-specific patterns with `--redact-regex <expr>`:
+
+```bash
+node script/qa/web-terminal-visual-qa.mjs \
+  --title "Codex TUI QA" \
+  --from-file .omo/evidence/run/capture.txt \
+  --evidence-dir .omo/evidence/run/codex-web-terminal \
+  --redact "$LOCAL_TOKEN" \
+  --redact-regex 'session_[A-Za-z0-9]+'
+```
+
+Custom `--redact-regex` rules replace the full regex match, even when the expression contains capture groups. Prefix-preserving redaction is reserved for the built-in authorization and key-assignment rules.
+
+Do not rely on screenshots to hide secrets. If a capture might include cookies, auth headers, raw env dumps, launchd environments, provider keys, or browser storage, redact first or summarize the run instead of storing the transcript.
+
+## Replay An Existing Capture
+
+Use this path for maximum OS compatibility, including Windows hosts without tmux:
+
+```bash
+node script/qa/web-terminal-visual-qa.mjs \
+  --title "Codex TUI QA" \
+  --from-file .omo/evidence/run/capture.txt \
+  --evidence-dir .omo/evidence/run/codex-web-terminal
+```
+
+Long terminal lines wrap by default for readable PR evidence. Pass `--no-wrap` only when horizontal scrolling is part of the behavior under test.
+
+## Run Through The PTY Connector
+
+Use this when `tmux` is available on macOS/Linux or a Windows environment that provides tmux, such as Git Bash/MSYS2:
+
+```bash
+node script/qa/web-terminal-visual-qa.mjs \
+  --title "OpenCode TUI QA" \
+  --command "opencode --help" \
+  --source-label "opencode help smoke" \
+  --cwd "$PWD" \
+  --evidence-dir .omo/evidence/run/opencode-web-terminal
+```
+
+`--command` starts a short-lived tmux-backed PTY connector, captures the pane, renders the web evidence, then records a `tmux kill-session` cleanup receipt in `metadata.json`. The raw --command string is process data and may contain inline secrets, so it is never persisted to metadata; use `--source-label` for a reviewer-safe description.
+
+## OS Notes
+
+- macOS/Linux: prefer `--command` when `tmux` is installed; otherwise replay a saved pane with `--from-file`.
+- Windows: prefer `--from-file` for native shells. Git Bash/MSYS2 environments with tmux may use `--command`.
+- Windows-native ConPTY live capture should plug into this same artifact and metadata contract before becoming required.
+
+## QA Guidance
+
+For OpenCode/Codex QA, pair the harness-specific smoke with this helper:
+
+1. Drive the TUI through the normal QA skill or script.
+2. Capture the pane or use the helper's `--command` mode.
+3. Store the output under `.omo/evidence/<YYYYMMDD>-<slug>/`.
+4. Review `terminal.txt`, `terminal-ansi.txt`, and `metadata.json` for accidental secrets before citing them.
+5. Include `terminal.png`, `terminal.txt`, and `metadata.json` in the evidence summary.
+6. Verify cleanup receipts: no leftover tmux sessions, PIDs, ports, or temp state.
+
+Tests alone are not TUI visual QA. The passing artifact is the rendered terminal evidence plus a binary observation, such as expected text present, no overflow, and no obvious border misalignment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-opencode",
-  "version": "4.13.0",
+  "version": "4.14.1",
   "description": "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
   "main": "./dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,6 +41,12 @@
     "dist",
     "bin",
     "postinstall.mjs",
+    "script/qa/web-terminal-redaction.d.mts",
+    "script/qa/web-terminal-redaction.mjs",
+    "script/qa/web-terminal-renderer.mjs",
+    "script/qa/web-terminal-visual-qa.mjs",
+    "docs/reference/github-attachment-upload.md",
+    "docs/reference/web-terminal-visual-qa.md",
     ".opencode/command",
     ".opencode/skills",
     ".agents/command",
@@ -59,7 +65,20 @@
     "packages/omo-codex/marketplace.json",
     "packages/omo-codex/lazycodex-repository",
     "packages/omo-codex/plugin",
+    "packages/omo-codex/plugin/components/bootstrap/dist/cli.js",
+    "packages/omo-codex/plugin/components/bootstrap/scripts/bootstrap.ps1",
+    "packages/omo-codex/plugin/components/bootstrap/scripts/node-dispatch.ps1",
+    "packages/omo-codex/plugin/components/codegraph/dist/cli.js",
+    "packages/omo-codex/plugin/components/codegraph/dist/serve.js",
+    "packages/omo-codex/plugin/components/comment-checker/dist/cli.js",
+    "packages/omo-codex/plugin/components/git-bash/dist/cli.js",
+    "packages/omo-codex/plugin/components/lazycodex-executor-verify/dist/cli.js",
+    "packages/omo-codex/plugin/components/lsp/dist/cli.js",
+    "packages/omo-codex/plugin/components/rules/dist/cli.js",
     "packages/omo-codex/plugin/components/start-work-continuation/dist/cli.js",
+    "packages/omo-codex/plugin/components/teammode/dist/cli.js",
+    "packages/omo-codex/plugin/components/telemetry/dist/cli.js",
+    "packages/omo-codex/plugin/components/ultrawork/dist/cli.js",
     "packages/omo-codex/plugin/components/ulw-loop/dist/cli.js",
     "packages/omo-codex/plugin/.codex-plugin",
     "!packages/omo-codex/plugin/node_modules",
@@ -100,7 +119,7 @@
     "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json && tsgo --noEmit -p packages/git-bash-mcp/tsconfig.json && tsgo --noEmit -p packages/lsp-core/tsconfig.json && tsgo --noEmit -p packages/utils/tsconfig.json && tsgo --noEmit -p packages/model-core/tsconfig.json && tsgo --noEmit -p packages/prompts-core/tsconfig.json && tsgo --noEmit -p packages/comment-checker-core/tsconfig.json && tsgo --noEmit -p packages/hashline-core/tsconfig.json && tsgo --noEmit -p packages/tmux-core/tsconfig.json && tsgo --noEmit -p packages/team-core/tsconfig.json && tsgo --noEmit -p packages/openclaw-core/tsconfig.json && tsgo --noEmit -p packages/boulder-state/tsconfig.json && tsgo --noEmit -p packages/telemetry-core/tsconfig.json && tsgo --noEmit -p packages/claude-code-compat-core/tsconfig.json && tsgo --noEmit -p packages/skills-loader-core/tsconfig.json && tsgo --noEmit -p packages/agents-md-core/tsconfig.json && tsgo --noEmit -p packages/omo-codex/plugin/shared/tsconfig.json && tsgo --noEmit -p packages/omo-codex/tsconfig.json && tsgo --noEmit -p packages/omo-opencode/tsconfig.json",
     "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",
     "test": "bun test",
-    "test:codex": "bun run build:codex-install && bun run build:git-bash-mcp && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && npm --prefix packages/lsp-tools-mcp test && npm --prefix packages/omo-codex/plugin ci && bun run --cwd packages/omo-codex/plugin build && node scripts/check-third-party-notices.mjs --ship && bun test packages/omo-opencode/src/cli/cli-installer.platform.test.ts packages/omo-codex/src/install/codex-cache.test.ts packages/omo-codex/src/install/codex-cleanup.test.ts packages/omo-codex/src/install/codex-config-agent-cleanup.test.ts packages/omo-codex/src/install/codex-config-autonomous-features.test.ts packages/omo-codex/src/install/codex-config-reasoning.test.ts packages/omo-codex/src/install/codex-config-toml.test.ts packages/omo-codex/src/install/codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex.test.ts packages/omo-codex/src/install/install-codex-packaged.test.ts packages/omo-codex/src/install/link-cached-plugin-agents.test.ts packages/omo-codex/src/**/*.test.ts packages/utils/src/jsonc-parser.test.ts packages/utils/src/frontmatter.test.ts packages/hashline-core/src/hash-computation.test.ts packages/hashline-core/src/smoke-untested-modules.test.ts packages/rules-engine/src/index.test.ts packages/rules-engine/src/security-boundary.test.ts packages/agents-md-core/src/injector.test.ts packages/omo-codex/plugin/components/lsp/test/package-smoke.test.ts && node --test packages/omo-codex/plugin/test/*.test.mjs packages/omo-codex/scripts/install-cache-copy.test.mjs packages/omo-codex/scripts/install-cli-args.test.mjs packages/omo-codex/scripts/install-delegated-command.test.mjs packages/omo-codex/scripts/install-config-autonomous-features.test.mjs packages/omo-codex/scripts/install-config-autonomous.test.mjs packages/omo-codex/scripts/install-config-reasoning.test.mjs packages/omo-codex/scripts/install-config.test.mjs packages/omo-codex/scripts/install-hook-targets.test.mjs packages/omo-codex/scripts/install-project-local-cleanup.test.mjs packages/omo-codex/scripts/install-lazycodex-version-stamp.test.mjs packages/omo-codex/scripts/install-local-entrypoint.test.mjs packages/omo-codex/scripts/install-local-git-bash-preflight.test.mjs packages/omo-codex/scripts/install-local.test.mjs packages/omo-codex/scripts/install-marketplace-cache.test.mjs packages/omo-codex/scripts/install-mcp-runtime.test.mjs packages/omo-codex/scripts/install-packaged-local.test.mjs packages/omo-codex/scripts/install-generated-bundle.test.mjs packages/omo-codex/scripts/install-agent-links.test.mjs packages/omo-codex/scripts/install-bin-links.test.mjs",
+    "test:codex": "bun run build:codex-install && bun run build:git-bash-mcp && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && npm --prefix packages/lsp-tools-mcp test && npm --prefix packages/omo-codex/plugin ci && bun run --cwd packages/omo-codex/plugin build && npm --prefix packages/omo-codex/plugin/components/codegraph run typecheck && npm --prefix packages/omo-codex/plugin/components/codegraph test && node scripts/check-third-party-notices.mjs --ship && bun test packages/omo-opencode/src/cli/cli-installer.platform.test.ts packages/omo-codex/src/install/codex-cache.test.ts packages/omo-codex/src/install/codex-cleanup.test.ts packages/omo-codex/src/install/codex-config-agent-cleanup.test.ts packages/omo-codex/src/install/codex-config-autonomous-features.test.ts packages/omo-codex/src/install/codex-config-reasoning.test.ts packages/omo-codex/src/install/codex-config-toml.test.ts packages/omo-codex/src/install/codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex-project-local-cleanup.test.ts packages/omo-codex/src/install/install-codex.test.ts packages/omo-codex/src/install/install-codex-packaged.test.ts packages/omo-codex/src/install/link-cached-plugin-agents.test.ts packages/omo-codex/src/**/*.test.ts packages/utils/src/jsonc-parser.test.ts packages/utils/src/frontmatter.test.ts packages/hashline-core/src/hash-computation.test.ts packages/hashline-core/src/smoke-untested-modules.test.ts packages/rules-engine/src/index.test.ts packages/rules-engine/src/security-boundary.test.ts packages/agents-md-core/src/injector.test.ts packages/omo-codex/plugin/components/lsp/test/package-smoke.test.ts && node --test packages/omo-codex/plugin/test/*.test.mjs packages/omo-codex/scripts/install-cache-copy.test.mjs packages/omo-codex/scripts/install-cli-args.test.mjs packages/omo-codex/scripts/install-delegated-command.test.mjs packages/omo-codex/scripts/install-config-autonomous-features.test.mjs packages/omo-codex/scripts/install-config-autonomous.test.mjs packages/omo-codex/scripts/install-config-reasoning.test.mjs packages/omo-codex/scripts/install-config.test.mjs packages/omo-codex/scripts/install-hook-targets.test.mjs packages/omo-codex/scripts/install-project-local-cleanup.test.mjs packages/omo-codex/scripts/install-lazycodex-version-stamp.test.mjs packages/omo-codex/scripts/install-local-entrypoint.test.mjs packages/omo-codex/scripts/install-local-git-bash-preflight.test.mjs packages/omo-codex/scripts/install-local.test.mjs packages/omo-codex/scripts/install-marketplace-cache.test.mjs packages/omo-codex/scripts/install-mcp-context7-runtime.test.mjs packages/omo-codex/scripts/install-mcp-runtime.test.mjs packages/omo-codex/scripts/install-packaged-local.test.mjs packages/omo-codex/scripts/install-generated-bundle.test.mjs packages/omo-codex/scripts/install-agent-links.test.mjs packages/omo-codex/scripts/install-bin-links.test.mjs",
     "test:windows-codex": "bun run test:codex",
     "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build"
   },
@@ -172,18 +191,18 @@
     "typescript": "^6.0.3"
   },
   "optionalDependencies": {
-    "oh-my-opencode-darwin-arm64": "4.13.0",
-    "oh-my-opencode-darwin-x64": "4.13.0",
-    "oh-my-opencode-darwin-x64-baseline": "4.13.0",
-    "oh-my-opencode-linux-arm64": "4.13.0",
-    "oh-my-opencode-linux-arm64-musl": "4.13.0",
-    "oh-my-opencode-linux-x64": "4.13.0",
-    "oh-my-opencode-linux-x64-baseline": "4.13.0",
-    "oh-my-opencode-linux-x64-musl": "4.13.0",
-    "oh-my-opencode-linux-x64-musl-baseline": "4.13.0",
-    "oh-my-opencode-windows-arm64": "4.13.0",
-    "oh-my-opencode-windows-x64": "4.13.0",
-    "oh-my-opencode-windows-x64-baseline": "4.13.0"
+    "oh-my-opencode-darwin-arm64": "4.14.1",
+    "oh-my-opencode-darwin-x64": "4.14.1",
+    "oh-my-opencode-darwin-x64-baseline": "4.14.1",
+    "oh-my-opencode-linux-arm64": "4.14.1",
+    "oh-my-opencode-linux-arm64-musl": "4.14.1",
+    "oh-my-opencode-linux-x64": "4.14.1",
+    "oh-my-opencode-linux-x64-baseline": "4.14.1",
+    "oh-my-opencode-linux-x64-musl": "4.14.1",
+    "oh-my-opencode-linux-x64-musl-baseline": "4.14.1",
+    "oh-my-opencode-windows-arm64": "4.14.1",
+    "oh-my-opencode-windows-x64": "4.14.1",
+    "oh-my-opencode-windows-x64-baseline": "4.14.1"
   },
   "overrides": {
     "hono": "^4.12.18",

package/packages/git-bash-mcp/dist/cli.js

@@ -381,6 +381,8 @@ async function runMcpStdioServer(input, output, options = {}) {
     output,
     handler: handleGitBashMcpRequest,
     handlerOptions: options,
+    idleTimeoutMs: 0,
+    log: options.lifecycleLog,
     parseErrorResponse: () => errorResponse(null, -32601, "Method not found")
   });
 }

package/packages/lsp-core/src/lsp/process.ts

@@ -88,7 +88,10 @@ function wrap(proc: ChildProcess): SpawnedProcess {
 
 function killProcessTree(proc: ChildProcess, signal: NodeJS.Signals): void {
 	if (process.platform === "win32" && proc.pid) {
-		const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+		const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+			stdio: "ignore",
+			windowsHide: true,
+		});
 		if (!result.error && result.status === 0) return;
 		if (result.error) reportKillError("windows process tree kill", result.error);
 	}

package/packages/lsp-core/src/mcp.ts

@@ -55,6 +55,7 @@ export async function runMcpStdioServer(
 	await runJsonRpcStdioServer({
 		input,
 		output,
+		idleTimeoutMs: 0,
 		handler: handleLspMcpRequest,
 		handlerOptions: undefined,
 	});

package/packages/lsp-daemon/dist/cli.js

@@ -644,7 +644,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -3402,6 +3405,7 @@ function unlinkQuietly(path) {
 var PROBE_TIMEOUT_MS = 500;
 var DEFAULT_READY_TIMEOUT_MS = 5000;
 var DEFAULT_POLL_INTERVAL_MS = 100;
+var CODEX_LSP_DAEMON_CLI_ENV = "CODEX_LSP_DAEMON_CLI";
 
 class DaemonUnreachableError extends Error {
   constructor(socketPath) {
@@ -3462,7 +3466,7 @@ function spawnDaemonProcess(paths) {
   mkdirSync3(dirname5(paths.log), { recursive: true });
   const logFd = openSync2(paths.log, "a");
   try {
-    const cliPath = fileURLToPath3(new URL("./cli.js", import.meta.url));
+    const cliPath = resolveDaemonCliPath();
     const child = spawn2(execPath, [cliPath, "daemon"], {
       detached: true,
       stdio: ["ignore", logFd, logFd]
@@ -3472,6 +3476,12 @@ function spawnDaemonProcess(paths) {
     closeSync2(logFd);
   }
 }
+function resolveDaemonCliPath(env = process.env) {
+  const override = env[CODEX_LSP_DAEMON_CLI_ENV]?.trim();
+  if (override)
+    return override;
+  return fileURLToPath3(new URL("./cli.js", import.meta.url));
+}
 function defaultEnsureDaemonDeps() {
   return {
     probe: (socketPath) => probeSocket(socketPath),
@@ -3482,8 +3492,7 @@ function defaultEnsureDaemonDeps() {
     },
     spawnDaemon: (paths) => spawnDaemonProcess(paths),
     sleep: (ms) => new Promise((resolve6) => {
-      const timer = setTimeout(resolve6, ms);
-      timer.unref?.();
+      setTimeout(resolve6, ms);
     }),
     now: () => Date.now()
   };
@@ -3496,6 +3505,7 @@ import { homedir as homedir3, tmpdir } from "node:os";
 import { join as join8 } from "node:path";
 var requireFromHere = createRequire(import.meta.url);
 var MAX_SOCKET_PATH_LENGTH = 100;
+var CODEX_LSP_DAEMON_VERSION_ENV = "CODEX_LSP_DAEMON_VERSION";
 function resolveDaemonVersion(requireFn = requireFromHere) {
   for (const candidate of ["./package.json", "../package.json"]) {
     try {
@@ -3517,7 +3527,7 @@ function daemonBaseDir(env = process.env) {
   const home = codexHome && codexHome.length > 0 ? codexHome : join8(homedir3(), ".codex");
   return join8(home, "codex-lsp", "daemon");
 }
-function daemonPaths(env = process.env, version = resolveDaemonVersion()) {
+function daemonPaths(env = process.env, version = resolveDaemonVersionFromEnv(env) ?? resolveDaemonVersion()) {
   const dir = join8(daemonBaseDir(env), `v${version}`);
   return {
     version,
@@ -3528,6 +3538,10 @@ function daemonPaths(env = process.env, version = resolveDaemonVersion()) {
     log: join8(dir, "daemon.log")
   };
 }
+function resolveDaemonVersionFromEnv(env = process.env) {
+  const version = env[CODEX_LSP_DAEMON_VERSION_ENV]?.trim();
+  return version && version.length > 0 ? version : null;
+}
 function resolveSocketPath(dir, version) {
   const digest = createHash("sha256").update(dir).digest("hex").slice(0, 16);
   if (process.platform === "win32") {
@@ -3735,6 +3749,7 @@ async function runMcpStdioProxy(options = {}) {
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleProxyRequest,
     handlerOptions: callOptions,
     onHandlerError: (error) => {

package/packages/lsp-daemon/dist/ensure-daemon.d.ts

@@ -18,4 +18,5 @@ export interface EnsureDaemonOptions {
 export declare function ensureDaemonRunning(paths: DaemonPaths, deps?: EnsureDaemonDeps, options?: EnsureDaemonOptions): Promise<void>;
 export declare function probeSocket(socketPath: string, timeoutMs?: number): Promise<boolean>;
 export declare function spawnDaemonProcess(paths: DaemonPaths): void;
+export declare function resolveDaemonCliPath(env?: NodeJS.ProcessEnv): string;
 export declare function defaultEnsureDaemonDeps(): EnsureDaemonDeps;

package/packages/lsp-daemon/dist/ensure-daemon.js

@@ -8,6 +8,7 @@ import { tryAcquireLock, unlinkQuietly } from "./lock.js";
 const PROBE_TIMEOUT_MS = 500;
 const DEFAULT_READY_TIMEOUT_MS = 5_000;
 const DEFAULT_POLL_INTERVAL_MS = 100;
+const CODEX_LSP_DAEMON_CLI_ENV = "CODEX_LSP_DAEMON_CLI";
 export class DaemonUnreachableError extends Error {
     constructor(socketPath) {
         super(`LSP daemon did not become reachable at ${socketPath}`);
@@ -68,7 +69,7 @@ export function spawnDaemonProcess(paths) {
     mkdirSync(dirname(paths.log), { recursive: true });
     const logFd = openSync(paths.log, "a");
     try {
-        const cliPath = fileURLToPath(new URL("./cli.js", import.meta.url));
+        const cliPath = resolveDaemonCliPath();
         const child = spawn(execPath, [cliPath, "daemon"], {
             detached: true,
             stdio: ["ignore", logFd, logFd],
@@ -79,6 +80,12 @@ export function spawnDaemonProcess(paths) {
         closeSync(logFd);
     }
 }
+export function resolveDaemonCliPath(env = process.env) {
+    const override = env[CODEX_LSP_DAEMON_CLI_ENV]?.trim();
+    if (override)
+        return override;
+    return fileURLToPath(new URL("./cli.js", import.meta.url));
+}
 export function defaultEnsureDaemonDeps() {
     return {
         probe: (socketPath) => probeSocket(socketPath),
@@ -89,8 +96,7 @@ export function defaultEnsureDaemonDeps() {
         },
         spawnDaemon: (paths) => spawnDaemonProcess(paths),
         sleep: (ms) => new Promise((resolve) => {
-            const timer = setTimeout(resolve, ms);
-            timer.unref?.();
+            setTimeout(resolve, ms);
         }),
         now: () => Date.now(),
     };

package/packages/lsp-daemon/dist/index.js

@@ -419,7 +419,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -1482,6 +1485,7 @@ function unlinkQuietly(path) {
 var PROBE_TIMEOUT_MS = 500;
 var DEFAULT_READY_TIMEOUT_MS = 5000;
 var DEFAULT_POLL_INTERVAL_MS = 100;
+var CODEX_LSP_DAEMON_CLI_ENV = "CODEX_LSP_DAEMON_CLI";
 
 class DaemonUnreachableError extends Error {
   constructor(socketPath) {
@@ -1542,7 +1546,7 @@ function spawnDaemonProcess(paths) {
   mkdirSync2(dirname2(paths.log), { recursive: true });
   const logFd = openSync2(paths.log, "a");
   try {
-    const cliPath = fileURLToPath(new URL("./cli.js", import.meta.url));
+    const cliPath = resolveDaemonCliPath();
     const child = spawn2(execPath, [cliPath, "daemon"], {
       detached: true,
       stdio: ["ignore", logFd, logFd]
@@ -1552,6 +1556,12 @@ function spawnDaemonProcess(paths) {
     closeSync2(logFd);
   }
 }
+function resolveDaemonCliPath(env = process.env) {
+  const override = env[CODEX_LSP_DAEMON_CLI_ENV]?.trim();
+  if (override)
+    return override;
+  return fileURLToPath(new URL("./cli.js", import.meta.url));
+}
 function defaultEnsureDaemonDeps() {
   return {
     probe: (socketPath) => probeSocket(socketPath),
@@ -1562,8 +1572,7 @@ function defaultEnsureDaemonDeps() {
     },
     spawnDaemon: (paths) => spawnDaemonProcess(paths),
     sleep: (ms) => new Promise((resolve2) => {
-      const timer = setTimeout(resolve2, ms);
-      timer.unref?.();
+      setTimeout(resolve2, ms);
     }),
     now: () => Date.now()
   };
@@ -1576,6 +1585,7 @@ import { homedir, tmpdir } from "node:os";
 import { join as join2 } from "node:path";
 var requireFromHere = createRequire(import.meta.url);
 var MAX_SOCKET_PATH_LENGTH = 100;
+var CODEX_LSP_DAEMON_VERSION_ENV = "CODEX_LSP_DAEMON_VERSION";
 function resolveDaemonVersion(requireFn = requireFromHere) {
   for (const candidate of ["./package.json", "../package.json"]) {
     try {
@@ -1597,7 +1607,7 @@ function daemonBaseDir(env = process.env) {
   const home = codexHome && codexHome.length > 0 ? codexHome : join2(homedir(), ".codex");
   return join2(home, "codex-lsp", "daemon");
 }
-function daemonPaths(env = process.env, version = resolveDaemonVersion()) {
+function daemonPaths(env = process.env, version = resolveDaemonVersionFromEnv(env) ?? resolveDaemonVersion()) {
   const dir = join2(daemonBaseDir(env), `v${version}`);
   return {
     version,
@@ -1608,6 +1618,10 @@ function daemonPaths(env = process.env, version = resolveDaemonVersion()) {
     log: join2(dir, "daemon.log")
   };
 }
+function resolveDaemonVersionFromEnv(env = process.env) {
+  const version = env[CODEX_LSP_DAEMON_VERSION_ENV]?.trim();
+  return version && version.length > 0 ? version : null;
+}
 function resolveSocketPath(dir, version) {
   const digest = createHash("sha256").update(dir).digest("hex").slice(0, 16);
   if (process.platform === "win32") {
@@ -3728,6 +3742,7 @@ async function runMcpStdioProxy(options = {}) {
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleProxyRequest,
     handlerOptions: callOptions,
     onHandlerError: (error) => {

package/packages/lsp-daemon/dist/paths.d.ts

@@ -9,3 +9,4 @@ export interface DaemonPaths {
 export declare function resolveDaemonVersion(requireFn?: (id: string) => unknown): string;
 export declare function daemonBaseDir(env?: NodeJS.ProcessEnv): string;
 export declare function daemonPaths(env?: NodeJS.ProcessEnv, version?: string): DaemonPaths;
+export declare function resolveDaemonVersionFromEnv(env?: NodeJS.ProcessEnv): string | null;

package/packages/lsp-daemon/dist/paths.js

@@ -4,6 +4,7 @@ import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 const requireFromHere = createRequire(import.meta.url);
 const MAX_SOCKET_PATH_LENGTH = 100;
+const CODEX_LSP_DAEMON_VERSION_ENV = "CODEX_LSP_DAEMON_VERSION";
 export function resolveDaemonVersion(requireFn = requireFromHere) {
     for (const candidate of ["./package.json", "../package.json"]) {
         try {
@@ -26,7 +27,7 @@ export function daemonBaseDir(env = process.env) {
     const home = codexHome && codexHome.length > 0 ? codexHome : join(homedir(), ".codex");
     return join(home, "codex-lsp", "daemon");
 }
-export function daemonPaths(env = process.env, version = resolveDaemonVersion()) {
+export function daemonPaths(env = process.env, version = resolveDaemonVersionFromEnv(env) ?? resolveDaemonVersion()) {
     const dir = join(daemonBaseDir(env), `v${version}`);
     return {
         version,
@@ -37,6 +38,10 @@ export function daemonPaths(env = process.env, version = resolveDaemonVersion())
         log: join(dir, "daemon.log"),
     };
 }
+export function resolveDaemonVersionFromEnv(env = process.env) {
+    const version = env[CODEX_LSP_DAEMON_VERSION_ENV]?.trim();
+    return version && version.length > 0 ? version : null;
+}
 function resolveSocketPath(dir, version) {
     const digest = createHash("sha256").update(dir).digest("hex").slice(0, 16);
     if (process.platform === "win32") {

package/packages/lsp-daemon/dist/proxy.js

@@ -12,6 +12,7 @@ export async function runMcpStdioProxy(options = {}) {
     await runJsonRpcStdioServer({
         input,
         output,
+        idleTimeoutMs: 0,
         handler: handleProxyRequest,
         handlerOptions: callOptions,
         onHandlerError: (error) => {

package/packages/lsp-tools-mcp/dist/cli.js

@@ -421,7 +421,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -3297,6 +3300,7 @@ async function runMcpStdioServer(input = process.stdin, output = process.stdout)
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleLspMcpRequest,
     handlerOptions: undefined
   });

package/packages/lsp-tools-mcp/dist/lsp/manager.js

@@ -419,7 +419,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)

package/packages/lsp-tools-mcp/dist/mcp.js

@@ -639,7 +639,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)
@@ -3296,6 +3299,7 @@ async function runMcpStdioServer(input = process.stdin, output = process.stdout)
   await runJsonRpcStdioServer({
     input,
     output,
+    idleTimeoutMs: 0,
     handler: handleLspMcpRequest,
     handlerOptions: undefined
   });

package/packages/lsp-tools-mcp/dist/tools.js

@@ -436,7 +436,10 @@ function wrap(proc) {
 }
 function killProcessTree(proc, signal) {
   if (process.platform === "win32" && proc.pid) {
-    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], { stdio: "ignore" });
+    const result = spawnSync("taskkill", ["/pid", String(proc.pid), "/f", "/t"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
     if (!result.error && result.status === 0)
       return;
     if (result.error)

package/packages/omo-codex/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omo",
-  "version": "4.13.0",
+  "version": "4.14.1",
   "description": "One Codex plugin namespace for Yeongyu's local Codex components.",
   "author": {
     "name": "Yeongyu Kim",