oh-my-opencode 4.18.0 → 4.18.2

package/packages/lsp-daemon/dist/ipc-protocol.d.ts

@@ -0,0 +1,46 @@
+import { type Stats } from "node:fs";
+import type { DaemonPaths } from "./paths.js";
+export declare const OMO_DAEMON_PROTOCOL_VERSION = 1;
+export declare const AUTH_ERROR_CODE = -32001;
+export declare const PROTOCOL_ERROR_CODE = -32002;
+export type DaemonAuthEnvelope = {
+    readonly protocolVersion: typeof OMO_DAEMON_PROTOCOL_VERSION;
+    readonly token: string;
+};
+export type JsonRpcErrorResponse = {
+    readonly jsonrpc: "2.0";
+    readonly id: string | number | null;
+    readonly error: {
+        readonly code: number;
+        readonly message: string;
+        readonly data: {
+            readonly code: string;
+        };
+    };
+};
+export type AuthenticatedMessage = {
+    readonly input: Record<string, unknown>;
+    readonly id: string | number | null;
+    readonly method: string | undefined;
+};
+export type PrivateDirectoryStats = Pick<Stats, "dev" | "ino" | "uid" | "isDirectory" | "isSymbolicLink">;
+export interface PrivateDirectoryOptions {
+    readonly currentUid?: () => number | undefined;
+    readonly lstat?: (path: string) => PrivateDirectoryStats;
+}
+export declare class UnsafePrivateDirectoryError extends Error {
+    readonly path: string;
+    readonly reason: "changed_during_chmod" | "not_directory" | "symlink" | "wrong_owner";
+    readonly name = "UnsafePrivateDirectoryError";
+    readonly code = "unsafe_private_directory";
+    constructor(path: string, reason: "changed_during_chmod" | "not_directory" | "symlink" | "wrong_owner");
+}
+export declare function authEnvelope(token: string): DaemonAuthEnvelope;
+export declare function readAuthToken(paths: DaemonPaths): string | null;
+export declare function readOrCreateAuthToken(paths: DaemonPaths): string;
+export declare function rotateAuthToken(paths: DaemonPaths): string;
+export declare function authenticateMessage(raw: unknown, expectedToken: string): AuthenticatedMessage | JsonRpcErrorResponse;
+export declare function isAuthErrorResponse(message: unknown): boolean;
+export declare function writePrivateFile(path: string, data: string): void;
+export declare function ensurePrivateDirectory(path: string, options?: PrivateDirectoryOptions): void;
+export declare function setPrivateFileMode(path: string): void;

package/packages/lsp-daemon/dist/ipc-protocol.js

@@ -0,0 +1,187 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, closeSync, constants, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, unlinkSync, writeSync, } from "node:fs";
+import { dirname } from "node:path";
+import { isPlainRecord } from "@oh-my-opencode/mcp-stdio-core/record";
+export const OMO_DAEMON_PROTOCOL_VERSION = 1;
+export const AUTH_ERROR_CODE = -32001;
+export const PROTOCOL_ERROR_CODE = -32002;
+const AUTH_TOKEN_BYTES = 32;
+export class UnsafePrivateDirectoryError extends Error {
+    constructor(path, reason) {
+        super(`unsafe private directory ${path}: ${reason}`);
+        this.path = path;
+        this.reason = reason;
+        this.name = "UnsafePrivateDirectoryError";
+        this.code = "unsafe_private_directory";
+    }
+}
+export function authEnvelope(token) {
+    return { protocolVersion: OMO_DAEMON_PROTOCOL_VERSION, token };
+}
+export function readAuthToken(paths) {
+    try {
+        const token = readFileSync(paths.auth, "utf8").trim();
+        return token.length > 0 ? token : null;
+    }
+    catch (error) {
+        if (error instanceof Error)
+            return null;
+        throw error;
+    }
+}
+export function readOrCreateAuthToken(paths) {
+    const existing = readAuthToken(paths);
+    if (existing)
+        return existing;
+    return createAuthToken(paths);
+}
+export function rotateAuthToken(paths) {
+    try {
+        unlinkSync(paths.auth);
+    }
+    catch (error) {
+        if (!(error instanceof Error))
+            throw error;
+    }
+    return createAuthToken(paths);
+}
+export function authenticateMessage(raw, expectedToken) {
+    const id = jsonRpcId(raw);
+    if (!isPlainRecord(raw))
+        return authError(id);
+    const params = raw["params"];
+    if (!isPlainRecord(params))
+        return authError(id);
+    const envelope = params["_omo"];
+    if (!isPlainRecord(envelope))
+        return authError(id);
+    const protocolVersion = envelope["protocolVersion"];
+    if (protocolVersion !== OMO_DAEMON_PROTOCOL_VERSION)
+        return protocolError(id);
+    const token = envelope["token"];
+    if (typeof token !== "string" || !tokenMatches(token, expectedToken))
+        return authError(id);
+    const cleanParams = { ...params };
+    delete cleanParams["_omo"];
+    return { input: { ...raw, params: cleanParams }, id, method: typeof raw["method"] === "string" ? raw["method"] : undefined };
+}
+export function isAuthErrorResponse(message) {
+    if (!isPlainRecord(message))
+        return false;
+    const error = message["error"];
+    if (!isPlainRecord(error))
+        return false;
+    const data = error["data"];
+    return error["code"] === AUTH_ERROR_CODE && isPlainRecord(data) && data["code"] === "daemon_authentication_failed";
+}
+export function writePrivateFile(path, data) {
+    const fd = openSync(path, "w", 0o600);
+    try {
+        writeSync(fd, data);
+    }
+    finally {
+        closeSync(fd);
+    }
+    setPrivateFileMode(path);
+}
+export function ensurePrivateDirectory(path, options = {}) {
+    try {
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+    }
+    catch (error) {
+        if (errorCode(error) !== "EEXIST")
+            throw error;
+    }
+    if (process.platform === "win32")
+        return;
+    const before = validatePrivateDirectory(path, options);
+    const fd = openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        fchmodSync(fd, 0o700);
+        const after = validatePrivateDirectory(path, options);
+        const openStats = fstatSync(fd);
+        if (!sameDirectory(before, after) || !sameDirectory(before, openStats)) {
+            throw new UnsafePrivateDirectoryError(path, "changed_during_chmod");
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function setPrivateFileMode(path) {
+    if (process.platform !== "win32")
+        chmodSync(path, 0o600);
+}
+function createAuthToken(paths) {
+    ensurePrivateDirectory(dirname(paths.auth));
+    const token = randomBytes(AUTH_TOKEN_BYTES).toString("base64url");
+    let fd;
+    try {
+        fd = openSync(paths.auth, "wx", 0o600);
+    }
+    catch (error) {
+        if (errorCode(error) === "EEXIST") {
+            const existing = readAuthToken(paths);
+            if (existing)
+                return existing;
+        }
+        throw error;
+    }
+    try {
+        writeSync(fd, `${token}\n`);
+    }
+    finally {
+        closeSync(fd);
+    }
+    setPrivateFileMode(paths.auth);
+    return token;
+}
+function errorCode(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return undefined;
+    const code = Reflect.get(error, "code");
+    return typeof code === "string" ? code : undefined;
+}
+function validatePrivateDirectory(path, options) {
+    const stats = options.lstat ? options.lstat(path) : lstatPrivateDirectory(path);
+    if (stats.isSymbolicLink())
+        throw new UnsafePrivateDirectoryError(path, "symlink");
+    if (!stats.isDirectory())
+        throw new UnsafePrivateDirectoryError(path, "not_directory");
+    const currentUid = options.currentUid ? options.currentUid() : process.getuid?.();
+    if (currentUid !== undefined && stats.uid !== currentUid) {
+        throw new UnsafePrivateDirectoryError(path, "wrong_owner");
+    }
+    return stats;
+}
+function lstatPrivateDirectory(path) {
+    return lstatSync(path);
+}
+function sameDirectory(a, b) {
+    return a.dev === b.dev && a.ino === b.ino;
+}
+function tokenMatches(candidate, expected) {
+    const candidateBytes = Buffer.from(candidate);
+    const expectedBytes = Buffer.from(expected);
+    return candidateBytes.length === expectedBytes.length && timingSafeEqual(candidateBytes, expectedBytes);
+}
+function jsonRpcId(raw) {
+    if (!isPlainRecord(raw))
+        return null;
+    const id = raw["id"];
+    return typeof id === "string" || typeof id === "number" || id === null ? id : null;
+}
+function authError(id) {
+    return {
+        jsonrpc: "2.0",
+        id,
+        error: { code: AUTH_ERROR_CODE, message: "daemon authentication failed", data: { code: "daemon_authentication_failed" } },
+    };
+}
+function protocolError(id) {
+    return {
+        jsonrpc: "2.0",
+        id,
+        error: { code: PROTOCOL_ERROR_CODE, message: "daemon protocol mismatch", data: { code: "daemon_protocol_mismatch" } },
+    };
+}

package/packages/lsp-daemon/dist/lock.js

@@ -8,7 +8,9 @@ export function isProcessAlive(pid) {
         return true;
     }
     catch (error) {
-        return error.code === "EPERM";
+        if (error instanceof Error)
+            return errorCode(error) === "EPERM";
+        throw error;
     }
 }
 export function readLockPid(lockPath) {
@@ -33,13 +35,13 @@ export function tryAcquireLock(lockPath, ownerPid = process.pid) {
 }
 function writeLockFile(lockPath, ownerPid) {
     try {
-        const fd = openSync(lockPath, "wx");
+        const fd = openSync(lockPath, "wx", 0o600);
         writeSync(fd, `${ownerPid}\n`);
         closeSync(fd);
         return { release: () => unlinkQuietly(lockPath) };
     }
     catch (error) {
-        if (error.code === "EEXIST")
+        if (errorCode(error) === "EEXIST")
             return null;
         throw error;
     }
@@ -56,6 +58,14 @@ export function unlinkQuietly(path) {
         unlinkSync(path);
     }
     catch (error) {
-        void error;
+        if (error instanceof Error)
+            return;
+        throw error;
     }
 }
+function errorCode(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return undefined;
+    const code = Reflect.get(error, "code");
+    return typeof code === "string" ? code : undefined;
+}

package/packages/lsp-daemon/dist/ownership.d.ts

@@ -0,0 +1,49 @@
+import { type LockHandle } from "./lock.js";
+import type { DaemonPaths } from "./paths.js";
+export type EndpointIdentity = {
+    readonly kind: "unix";
+    readonly path: string;
+    readonly dev: number;
+    readonly ino: number;
+} | {
+    readonly kind: "windows";
+    readonly path: string;
+} | {
+    readonly kind: "missing";
+    readonly path: string;
+};
+export type DaemonOwner = {
+    readonly pid: number;
+    readonly nonce: string;
+    readonly startedAt: string;
+    readonly endpoint: EndpointIdentity;
+};
+export type StartupLease = {
+    readonly lock: LockHandle;
+    readonly token: string;
+    readonly owner: DaemonOwner;
+};
+export declare class DaemonAlreadyRunningError extends Error {
+    readonly name = "DaemonAlreadyRunningError";
+    readonly code = "daemon_already_running";
+}
+export declare class DaemonStartupDeferredError extends Error {
+    readonly reason: string;
+    readonly name = "DaemonStartupDeferredError";
+    readonly code = "daemon_startup_deferred";
+    constructor(reason: string);
+}
+export type OwnerPing = {
+    readonly pid: number;
+    readonly nonce: string;
+    readonly startedAt: string;
+    readonly endpoint: EndpointIdentity;
+};
+export declare function acquireStartupLease(paths: DaemonPaths, pingOwner: (token: string) => Promise<OwnerPing | null>): Promise<StartupLease>;
+export declare function ensureDaemonDirectories(paths: DaemonPaths): void;
+export declare function readDaemonOwner(paths: DaemonPaths): DaemonOwner | null;
+export declare function writeDaemonOwner(paths: DaemonPaths, owner: DaemonOwner): void;
+export declare function removeDaemonMetadataForOwner(paths: DaemonPaths, owner: DaemonOwner): void;
+export declare function endpointIdentity(endpointPath: string): EndpointIdentity;
+export declare function sameEndpoint(a: EndpointIdentity, b: EndpointIdentity): boolean;
+export declare function sameOwner(a: DaemonOwner, b: DaemonOwner): boolean;

package/packages/lsp-daemon/dist/ownership.js

@@ -0,0 +1,168 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { dirname } from "node:path";
+import { tryAcquireLock, isProcessAlive, unlinkQuietly } from "./lock.js";
+import { ensurePrivateDirectory, readAuthToken, readOrCreateAuthToken, rotateAuthToken, writePrivateFile, } from "./ipc-protocol.js";
+export class DaemonAlreadyRunningError extends Error {
+    constructor() {
+        super(...arguments);
+        this.name = "DaemonAlreadyRunningError";
+        this.code = "daemon_already_running";
+    }
+}
+export class DaemonStartupDeferredError extends Error {
+    constructor(reason) {
+        super(`LSP daemon startup deferred: ${reason}`);
+        this.reason = reason;
+        this.name = "DaemonStartupDeferredError";
+        this.code = "daemon_startup_deferred";
+    }
+}
+export async function acquireStartupLease(paths, pingOwner) {
+    ensureDaemonDirectories(paths);
+    const lock = tryAcquireLock(paths.lock);
+    if (!lock) {
+        const token = readAuthToken(paths);
+        if (token && (await pingOwner(token)))
+            throw new DaemonAlreadyRunningError("LSP daemon already running");
+        throw new DaemonStartupDeferredError("startup_lock_busy");
+    }
+    try {
+        const token = await validateExistingOwner(paths, pingOwner);
+        return { lock, token, owner: newOwner(paths) };
+    }
+    catch (error) {
+        lock.release();
+        throw error;
+    }
+}
+export function ensureDaemonDirectories(paths) {
+    ensurePrivateDirectory(paths.dir);
+    if (process.platform !== "win32")
+        ensurePrivateDirectory(dirname(paths.socket));
+}
+export function readDaemonOwner(paths) {
+    try {
+        return parseOwner(JSON.parse(readFileSync(paths.owner, "utf8")));
+    }
+    catch (error) {
+        if (error instanceof Error)
+            return null;
+        throw error;
+    }
+}
+export function writeDaemonOwner(paths, owner) {
+    writePrivateFile(paths.pid, `${owner.pid}\n`);
+    writePrivateFile(paths.endpoint, owner.endpoint.path);
+    writePrivateFile(paths.owner, `${JSON.stringify(owner)}\n`);
+}
+export function removeDaemonMetadataForOwner(paths, owner) {
+    const current = readDaemonOwner(paths);
+    if (!current || !sameOwner(current, owner))
+        return;
+    unlinkQuietly(paths.socket);
+    unlinkQuietly(paths.pid);
+    unlinkQuietly(paths.endpoint);
+    unlinkQuietly(paths.owner);
+}
+export function endpointIdentity(endpointPath) {
+    if (process.platform === "win32")
+        return { kind: "windows", path: endpointPath };
+    try {
+        const stats = statSync(endpointPath);
+        return { kind: "unix", path: endpointPath, dev: stats.dev, ino: stats.ino };
+    }
+    catch (error) {
+        if (error instanceof Error)
+            return { kind: "missing", path: endpointPath };
+        throw error;
+    }
+}
+export function sameEndpoint(a, b) {
+    if (a.kind !== b.kind || a.path !== b.path)
+        return false;
+    switch (a.kind) {
+        case "unix":
+            return b.kind === "unix" && a.dev === b.dev && a.ino === b.ino;
+        case "windows":
+            return true;
+        case "missing":
+            return true;
+    }
+}
+export function sameOwner(a, b) {
+    return a.pid === b.pid && a.nonce === b.nonce && sameEndpoint(a.endpoint, b.endpoint);
+}
+async function validateExistingOwner(paths, pingOwner) {
+    let token = readOrCreateAuthToken(paths);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const owner = readDaemonOwner(paths);
+        if (!owner)
+            return token;
+        const ping = await pingOwner(token);
+        if (ping && owner.nonce === ping.nonce && sameEndpoint(owner.endpoint, ping.endpoint)) {
+            throw new DaemonAlreadyRunningError("LSP daemon already running");
+        }
+        if (ping)
+            continue;
+        if (isProcessAlive(owner.pid))
+            throw new DaemonStartupDeferredError("owner_pid_live_unreachable");
+        const reread = readDaemonOwner(paths);
+        const endpoint = endpointIdentity(owner.endpoint.path);
+        if (!reread || reread.nonce !== owner.nonce || !sameEndpoint(endpoint, owner.endpoint)) {
+            throw new DaemonStartupDeferredError("owner_changed_during_cleanup");
+        }
+        cleanupDeadOwner(paths, owner);
+        token = rotateAuthToken(paths);
+        return token;
+    }
+    throw new DaemonStartupDeferredError("reachable_owner_mismatch");
+}
+function cleanupDeadOwner(paths, owner) {
+    if (process.platform !== "win32" && existsSync(owner.endpoint.path)) {
+        const stat = lstatSync(owner.endpoint.path);
+        if (stat.isSocket())
+            unlinkSync(owner.endpoint.path);
+    }
+    unlinkQuietly(paths.pid);
+    unlinkQuietly(paths.endpoint);
+    unlinkQuietly(paths.owner);
+}
+function newOwner(paths) {
+    return {
+        pid: process.pid,
+        nonce: randomUUID(),
+        startedAt: new Date().toISOString(),
+        endpoint: endpointIdentity(paths.socket),
+    };
+}
+function parseOwner(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const pid = Reflect.get(value, "pid");
+    const nonce = Reflect.get(value, "nonce");
+    const startedAt = Reflect.get(value, "startedAt");
+    const endpoint = parseEndpoint(Reflect.get(value, "endpoint"));
+    if (typeof pid !== "number" || typeof nonce !== "string" || typeof startedAt !== "string" || !endpoint)
+        return null;
+    return { pid, nonce, startedAt, endpoint };
+}
+function parseEndpoint(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const kind = Reflect.get(value, "kind");
+    const path = Reflect.get(value, "path");
+    if (typeof path !== "string")
+        return null;
+    if (kind === undefined)
+        return endpointIdentity(path);
+    if (kind === "windows")
+        return { kind, path };
+    if (kind === "missing")
+        return { kind, path };
+    const dev = Reflect.get(value, "dev");
+    const ino = Reflect.get(value, "ino");
+    if (kind === "unix" && typeof dev === "number" && typeof ino === "number")
+        return { kind, path, dev, ino };
+    return null;
+}

package/packages/lsp-daemon/dist/paths.d.ts

@@ -1,12 +1,36 @@
+import { type DaemonRuntimeDefaults } from "./runtime-contract.js";
+export { InvalidDaemonVersionError, OMO_LSP_DAEMON_DIR, OMO_LSP_DAEMON_VERSION, validateDaemonVersion, } from "./runtime-contract.js";
+export interface DaemonPathOperations {
+    readonly isAbsolute: (value: string) => boolean;
+    readonly join: (...parts: string[]) => string;
+    readonly resolve: (...parts: string[]) => string;
+}
+export interface DaemonPlatform {
+    readonly platform: NodeJS.Platform;
+    readonly homedir: () => string;
+    readonly tmpdir: () => string;
+    readonly getuid: () => number | undefined;
+    readonly username: () => string;
+    readonly path: DaemonPathOperations;
+}
+export declare class InvalidDaemonDirectoryError extends Error {
+    readonly code = "invalid_daemon_directory";
+    readonly directory: string;
+    constructor(directory: string);
+}
 export interface DaemonPaths {
-    version: string;
-    dir: string;
-    socket: string;
-    lock: string;
-    pid: string;
-    log: string;
+    readonly version: string;
+    readonly cliPath: string;
+    readonly dir: string;
+    readonly socket: string;
+    readonly lock: string;
+    readonly pid: string;
+    readonly auth: string;
+    readonly endpoint: string;
+    readonly owner: string;
+    readonly log: string;
 }
 export declare function resolveDaemonVersion(requireFn?: (id: string) => unknown): string;
-export declare function daemonBaseDir(env?: NodeJS.ProcessEnv): string;
-export declare function daemonPaths(env?: NodeJS.ProcessEnv, version?: string): DaemonPaths;
-export declare function resolveDaemonVersionFromEnv(env?: NodeJS.ProcessEnv): string | null;
+export declare function packagedRuntimeDefaults(): DaemonRuntimeDefaults;
+export declare function daemonBaseDir(env?: NodeJS.ProcessEnv, platform?: DaemonPlatform): string;
+export declare function daemonPaths(env?: NodeJS.ProcessEnv, runtimeDefaults?: DaemonRuntimeDefaults, platform?: DaemonPlatform): DaemonPaths;

package/packages/lsp-daemon/dist/paths.js

@@ -1,54 +1,93 @@
 import { createHash } from "node:crypto";
 import { createRequire } from "node:module";
-import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { homedir, tmpdir, userInfo } from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { OMO_LSP_DAEMON_DIR, resolveDaemonRuntime, validateDaemonVersion, } from "./runtime-contract.js";
+export { InvalidDaemonVersionError, OMO_LSP_DAEMON_DIR, OMO_LSP_DAEMON_VERSION, validateDaemonVersion, } from "./runtime-contract.js";
 const requireFromHere = createRequire(import.meta.url);
 const MAX_SOCKET_PATH_LENGTH = 100;
-const CODEX_LSP_DAEMON_VERSION_ENV = "CODEX_LSP_DAEMON_VERSION";
+export class InvalidDaemonDirectoryError extends Error {
+    constructor(directory) {
+        super(`${OMO_LSP_DAEMON_DIR} must be an absolute path`);
+        this.code = "invalid_daemon_directory";
+        this.name = "InvalidDaemonDirectoryError";
+        this.directory = directory;
+    }
+}
 export function resolveDaemonVersion(requireFn = requireFromHere) {
     for (const candidate of ["./package.json", "../package.json"]) {
+        let loaded;
         try {
-            const pkg = requireFn(candidate);
-            if (typeof pkg.version === "string" && pkg.version.length > 0)
-                return pkg.version;
+            loaded = requireFn(candidate);
+        }
+        catch (error) {
+            if (!(error instanceof Error))
+                throw error;
+            continue;
+        }
+        if (typeof loaded === "object" && loaded !== null && "version" in loaded) {
+            const version = Reflect.get(loaded, "version");
+            if (typeof version === "string")
+                return validateDaemonVersion(version);
         }
-        catch { }
     }
     return "0";
 }
-export function daemonBaseDir(env = process.env) {
-    const explicit = env["CODEX_LSP_DAEMON_DIR"]?.trim();
-    if (explicit)
-        return explicit;
-    const pluginData = env["PLUGIN_DATA"]?.trim();
-    if (pluginData)
-        return join(pluginData, "daemon");
-    const codexHome = env["CODEX_HOME"]?.trim();
-    const home = codexHome && codexHome.length > 0 ? codexHome : join(homedir(), ".codex");
-    return join(home, "codex-lsp", "daemon");
-}
-export function daemonPaths(env = process.env, version = resolveDaemonVersionFromEnv(env) ?? resolveDaemonVersion()) {
-    const dir = join(daemonBaseDir(env), `v${version}`);
+export function packagedRuntimeDefaults() {
+    return {
+        cliPath: fileURLToPath(new URL("./cli.js", import.meta.url)),
+        version: resolveDaemonVersion(),
+    };
+}
+export function daemonBaseDir(env = process.env, platform = defaultDaemonPlatform()) {
+    const override = env[OMO_LSP_DAEMON_DIR];
+    if (override !== undefined) {
+        if (!platform.path.isAbsolute(override))
+            throw new InvalidDaemonDirectoryError(override);
+        return platform.path.resolve(override);
+    }
+    return platform.path.resolve(platform.path.join(platform.homedir(), ".omo", "lsp-daemon"));
+}
+export function daemonPaths(env = process.env, runtimeDefaults = packagedRuntimeDefaults(), platform = defaultDaemonPlatform()) {
+    const runtime = resolveDaemonRuntime(env, runtimeDefaults);
+    const baseDir = daemonBaseDir(env, platform);
+    const dir = platform.path.resolve(platform.path.join(baseDir, `v${runtime.version}`));
     return {
-        version,
+        version: runtime.version,
+        cliPath: runtime.cliPath,
         dir,
-        socket: resolveSocketPath(dir, version),
-        lock: join(dir, "daemon.lock"),
-        pid: join(dir, "daemon.pid"),
-        log: join(dir, "daemon.log"),
+        socket: resolveSocketPath(dir, runtime.version, platform),
+        lock: platform.path.join(dir, "daemon.lock"),
+        pid: platform.path.join(dir, "daemon.pid"),
+        auth: platform.path.join(dir, "daemon.auth"),
+        endpoint: platform.path.join(dir, "daemon.endpoint"),
+        owner: platform.path.join(dir, "daemon.owner"),
+        log: platform.path.join(dir, "daemon.log"),
     };
 }
-export function resolveDaemonVersionFromEnv(env = process.env) {
-    const version = env[CODEX_LSP_DAEMON_VERSION_ENV]?.trim();
-    return version && version.length > 0 ? version : null;
+function defaultDaemonPlatform() {
+    return {
+        platform: process.platform,
+        homedir,
+        tmpdir,
+        getuid: () => (typeof process.getuid === "function" ? process.getuid() : undefined),
+        username: () => userInfo().username,
+        path,
+    };
 }
-function resolveSocketPath(dir, version) {
-    const digest = createHash("sha256").update(dir).digest("hex").slice(0, 16);
-    if (process.platform === "win32") {
+function resolveSocketPath(dir, version, platform) {
+    const canonicalVersionDir = platform.path.resolve(dir);
+    if (platform.platform === "win32") {
+        const currentUserDiscriminator = `${platform.getuid() ?? "win"}:${platform.username()}:${platform.path.resolve(platform.homedir())}`;
+        const digest = shortDigest(`${canonicalVersionDir}\0${currentUserDiscriminator}`);
         return `\\\\.\\pipe\\omo-lsp-${version}-${digest}`;
     }
-    const natural = join(dir, "daemon.sock");
+    const natural = platform.path.join(canonicalVersionDir, "daemon.sock");
     if (natural.length < MAX_SOCKET_PATH_LENGTH)
         return natural;
-    return join(tmpdir(), `omo-lsp-${version}-${digest}.sock`);
+    return platform.path.join(platform.tmpdir(), `omo-lsp-${version}-${shortDigest(canonicalVersionDir)}`, "daemon.sock");
+}
+function shortDigest(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 16);
 }

package/packages/lsp-daemon/dist/proxy.d.ts

@@ -4,8 +4,13 @@ import { type DaemonPaths } from "./paths.js";
 export interface ProxyOptions {
     input?: Readable;
     output?: Writable;
+    stderr?: Writable;
     paths?: DaemonPaths;
     context?: DaemonToolContext;
+    cwd?: string;
+    env?: Record<string, string | undefined>;
+    homeDir?: string;
     ensure?: CallToolOptions["ensure"];
+    startupTimeoutMs?: number;
 }
 export declare function runMcpStdioProxy(options?: ProxyOptions): Promise<void>;