oh-my-opencode 4.5.1 → 4.5.12

package/packages/omo-codex/scripts/install/config.mjs

@@ -0,0 +1,229 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+
+import { ensureCodexMultiAgentV2Config } from "./multi-agent-v2-config.mjs";
+import { appendBlock, findTomlSection, replaceOrInsertSetting } from "./toml-editor.mjs";
+import { exists } from "./utils.mjs";
+
+const LEGACY_CODEX_PLUGIN_MARKETPLACE = ["code", "yeongyu", "codex", "plugins"].join("-");
+const SISYPHUS_LEGACY_MARKETPLACES = ["lazycodex", LEGACY_CODEX_PLUGIN_MARKETPLACE];
+const MANAGED_CODEX_AGENT_NAMES = [
+	"codex-ultrawork-reviewer",
+	"explorer",
+	"librarian",
+	"metis",
+	"momus",
+	"plan",
+];
+
+export async function updateCodexConfig({
+	configPath,
+	repoRoot,
+	marketplaceName,
+	marketplaceSource = defaultMarketplaceSource(marketplaceName, repoRoot),
+	pluginNames,
+	trustedHookStates = [],
+	agentConfigs = [],
+}) {
+	await mkdir(dirname(configPath), { recursive: true });
+	let config = "";
+	if (await exists(configPath)) config = await readFile(configPath, "utf8");
+
+	for (const legacyMarketplaceName of legacyMarketplaceNames(marketplaceName)) {
+		config = removeMarketplaceBlock(config, legacyMarketplaceName);
+		config = removeStaleMarketplacePluginBlocks(config, legacyMarketplaceName, new Set());
+		config = removeStaleMarketplaceHookStateBlocks(config, legacyMarketplaceName, new Set());
+	}
+	config = removeStaleMarketplacePluginBlocks(config, marketplaceName, new Set(pluginNames));
+	config = removeStaleMarketplaceHookStateBlocks(config, marketplaceName, new Set(pluginNames));
+	config = removeStaleManagedAgentBlocks(config, new Set(agentConfigs.map((agentConfig) => agentConfig.name)));
+	config = ensureFeatureEnabled(config, "plugins");
+	config = ensureFeatureEnabled(config, "plugin_hooks");
+	config = ensureCodexMultiAgentV2Config(config);
+	config = ensureMarketplaceBlock(config, marketplaceName, marketplaceSource);
+	for (const pluginName of pluginNames) {
+		config = ensurePluginEnabled(config, `${pluginName}@${marketplaceName}`);
+	}
+	for (const state of trustedHookStates) {
+		config = ensureHookTrusted(config, state.key, state.trustedHash);
+	}
+	for (const agentConfig of agentConfigs) {
+		config = ensureAgentConfig(config, agentConfig);
+	}
+
+	await writeFile(configPath, config.trimEnd() + "\n");
+}
+
+function legacyMarketplaceNames(marketplaceName) {
+	return marketplaceName === "sisyphuslabs" ? SISYPHUS_LEGACY_MARKETPLACES : [];
+}
+
+function removeMarketplaceBlock(config, marketplaceName) {
+	return removeTomlSections(config, (header) => header === `marketplaces.${marketplaceName}`);
+}
+
+function defaultMarketplaceSource(marketplaceName, repoRoot) {
+	return {
+		sourceType: "local",
+		source: repoRoot,
+	};
+}
+
+function removeStaleMarketplacePluginBlocks(config, marketplaceName, keepPluginNames) {
+	return removeTomlSections(config, (header) => {
+		const pluginKey = parsePluginHeaderKey(header);
+		if (pluginKey === null) return false;
+		const suffix = `@${marketplaceName}`;
+		if (!pluginKey.endsWith(suffix)) return false;
+		return !keepPluginNames.has(pluginKey.slice(0, -suffix.length));
+	});
+}
+
+function removeStaleMarketplaceHookStateBlocks(config, marketplaceName, keepPluginNames) {
+	return removeTomlSections(config, (header) => {
+		const prefix = "hooks.state.";
+		if (!header.startsWith(prefix)) return false;
+		const hookKey = parseJsonString(header.slice(prefix.length));
+		if (hookKey === null) return false;
+		const separator = hookKey.indexOf(":");
+		if (separator === -1) return false;
+		const pluginKey = hookKey.slice(0, separator);
+		const suffix = `@${marketplaceName}`;
+		if (!pluginKey.endsWith(suffix)) return false;
+		return !keepPluginNames.has(pluginKey.slice(0, -suffix.length));
+	});
+}
+
+function removeStaleManagedAgentBlocks(config, keepAgentNames) {
+	const managedAgentNames = new Set(MANAGED_CODEX_AGENT_NAMES);
+	return splitTomlSections(config)
+		.filter((section) => {
+			if (section.header === null) return true;
+			const agentName = parseAgentHeaderName(section.header);
+			if (agentName === null || !managedAgentNames.has(agentName) || keepAgentNames.has(agentName)) return true;
+			return !section.text.includes(`config_file = ${JSON.stringify(`./agents/${agentName}.toml`)}`);
+		})
+		.map((section) => section.text)
+		.join("")
+		.replace(/\n{3,}/g, "\n\n");
+}
+
+function ensureFeatureEnabled(config, featureName) {
+	const section = findTomlSection(config, "features");
+	if (!section) return appendBlock(config, `[features]\n${featureName} = true\n`);
+	return replaceOrInsertSetting(config, section, featureName, "true");
+}
+
+function ensureMarketplaceBlock(config, marketplaceName, source) {
+	const header = `marketplaces.${marketplaceName}`;
+	const block = [
+		`[${header}]`,
+		`last_updated = "${new Date().toISOString().replace(/\.\d{3}Z$/, "Z")}"`,
+		`source_type = ${JSON.stringify(source.sourceType)}`,
+		`source = ${JSON.stringify(source.source)}`,
+		source.ref === undefined ? null : `ref = ${JSON.stringify(source.ref)}`,
+		"",
+	].filter((line) => line !== null).join("\n");
+	const section = findTomlSection(config, header);
+	if (section) return config.slice(0, section.start) + block + config.slice(section.end);
+	return appendBlock(config, block);
+}
+
+function ensurePluginEnabled(config, pluginKey) {
+	const header = `plugins.${JSON.stringify(pluginKey)}`;
+	const section = findTomlSection(config, header);
+	if (!section) return appendBlock(config, `[${header}]\nenabled = true\n`);
+	return replaceOrInsertSetting(config, section, "enabled", "true");
+}
+
+function ensureHookTrusted(config, key, trustedHash) {
+	const header = `hooks.state.${JSON.stringify(key)}`;
+	const section = findTomlSection(config, header);
+	if (!section) return appendBlock(config, `[${header}]\ntrusted_hash = ${JSON.stringify(trustedHash)}\n`);
+	return replaceOrInsertSetting(config, section, "trusted_hash", JSON.stringify(trustedHash));
+}
+
+function ensureAgentConfig(config, agentConfig) {
+	const header = `agents.${tomlKeySegment(agentConfig.name)}`;
+	const section = findTomlSection(config, header);
+	const configFile = JSON.stringify(agentConfig.configFile);
+	if (!section) return appendBlock(config, `[${header}]\nconfig_file = ${configFile}\n`);
+	return replaceOrInsertSetting(config, section, "config_file", configFile);
+}
+
+function tomlKeySegment(value) {
+	return /^[A-Za-z0-9_-]+$/.test(value) ? value : JSON.stringify(value);
+}
+
+function removeTomlSections(config, shouldRemove) {
+	return splitTomlSections(config)
+		.filter((section) => section.header === null || !shouldRemove(section.header))
+		.map((section) => section.text)
+		.join("")
+		.replace(/\n{3,}/g, "\n\n");
+}
+
+function splitTomlSections(config) {
+	const lines = config.match(/[^\n]*\n?|$/g) ?? [];
+	const sections = [];
+	let current = { header: null, text: "" };
+	for (const line of lines) {
+		if (line.length === 0) break;
+		const header = parseTomlHeader(line);
+		if (header !== null) {
+			if (current.text.length > 0) sections.push(current);
+			current = { header, text: line };
+		} else {
+			current.text += line;
+		}
+	}
+	if (current.text.length > 0) sections.push(current);
+	return sections;
+}
+
+function parseTomlHeader(line) {
+	const trimmed = line.trim();
+	if (!trimmed.startsWith("[") || !trimmed.endsWith("]")) return null;
+	if (trimmed.startsWith("[[")) return null;
+	return trimmed.slice(1, -1);
+}
+
+function parsePluginHeaderKey(header) {
+	const prefix = "plugins.";
+	if (!header.startsWith(prefix)) return null;
+	return parseLeadingJsonString(header.slice(prefix.length));
+}
+
+function parseAgentHeaderName(header) {
+	const prefix = "agents.";
+	if (!header.startsWith(prefix)) return null;
+	const key = header.slice(prefix.length);
+	return key.startsWith('"') ? parseLeadingJsonString(key) : key;
+}
+
+function parseLeadingJsonString(value) {
+	if (!value.startsWith('"')) return parseJsonString(value);
+	let escaped = false;
+	for (let index = 1; index < value.length; index += 1) {
+		const char = value[index];
+		if (escaped) {
+			escaped = false;
+			continue;
+		}
+		if (char === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (char === '"') return parseJsonString(value.slice(0, index + 1));
+	}
+	return null;
+}
+
+function parseJsonString(value) {
+	try {
+		const parsed = JSON.parse(value);
+		return typeof parsed === "string" ? parsed : null;
+	} catch {
+		return null;
+	}
+}

package/packages/omo-codex/scripts/install/hook-trust.mjs

@@ -0,0 +1,84 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { exists, isRecord } from "./utils.mjs";
+
+const EVENT_LABELS = new Map([
+	["PreToolUse", "pre_tool_use"],
+	["PermissionRequest", "permission_request"],
+	["PostToolUse", "post_tool_use"],
+	["PreCompact", "pre_compact"],
+	["PostCompact", "post_compact"],
+	["SessionStart", "session_start"],
+	["UserPromptSubmit", "user_prompt_submit"],
+	["SubagentStart", "subagent_start"],
+	["SubagentStop", "subagent_stop"],
+	["Stop", "stop"],
+]);
+
+export async function trustedHookStatesForPlugin({ marketplaceName, pluginName, pluginRoot }) {
+	const manifestPath = join(pluginRoot, ".codex-plugin", "plugin.json");
+	if (!(await exists(manifestPath))) return [];
+	const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+	if (!isRecord(manifest) || typeof manifest.hooks !== "string") return [];
+
+	const hooksPath = join(pluginRoot, manifest.hooks);
+	if (!(await exists(hooksPath))) return [];
+	const parsed = JSON.parse(await readFile(hooksPath, "utf8"));
+	if (!isRecord(parsed) || !isRecord(parsed.hooks)) return [];
+
+	const keySource = `${pluginName}@${marketplaceName}:${stripDotSlash(manifest.hooks)}`;
+	const states = [];
+	for (const [eventName, groups] of Object.entries(parsed.hooks)) {
+		if (!Array.isArray(groups)) continue;
+		const eventLabel = EVENT_LABELS.get(eventName);
+		if (eventLabel === undefined) continue;
+		for (const [groupIndex, group] of groups.entries()) {
+			if (!isRecord(group) || !Array.isArray(group.hooks)) continue;
+			for (const [handlerIndex, handler] of group.hooks.entries()) {
+				if (!isRecord(handler) || handler.type !== "command") continue;
+				if (handler.async === true) continue;
+				if (typeof handler.command !== "string" || handler.command.trim() === "") continue;
+				const key = `${keySource}:${eventLabel}:${groupIndex}:${handlerIndex}`;
+				states.push({
+					key,
+					trustedHash: commandHookHash(eventLabel, group.matcher, handler),
+				});
+			}
+		}
+	}
+	return states;
+}
+
+function commandHookHash(eventName, matcher, handler) {
+	const command = handler.command;
+	const timeout = Math.max(Number(handler.timeout ?? 600), 1);
+	const normalizedHandler = {
+		type: "command",
+		command,
+		timeout,
+		async: false,
+	};
+	if (typeof handler.statusMessage === "string") normalizedHandler.statusMessage = handler.statusMessage;
+	const identity = {
+		event_name: eventName,
+		hooks: [normalizedHandler],
+	};
+	if (typeof matcher === "string") identity.matcher = matcher;
+	return `sha256:${createHash("sha256").update(JSON.stringify(canonicalJson(identity))).digest("hex")}`;
+}
+
+function canonicalJson(value) {
+	if (Array.isArray(value)) return value.map(canonicalJson);
+	if (!isRecord(value)) return value;
+	const result = {};
+	for (const key of Object.keys(value).sort()) {
+		result[key] = canonicalJson(value[key]);
+	}
+	return result;
+}
+
+function stripDotSlash(value) {
+	return value.startsWith("./") ? value.slice(2) : value;
+}

package/packages/omo-codex/scripts/install/legacy-bins.mjs

@@ -0,0 +1,57 @@
+import { lstat, readFile, readlink, rm } from "node:fs/promises";
+import { join } from "node:path";
+
+import { COMMAND_SHIM_MARKER } from "./command-shim.mjs";
+
+const LEGACY_CODEX_COMPONENT_BINS = [
+	{ name: "codex-comment-checker", component: "comment-checker" },
+	{ name: "codex-rules", component: "rules" },
+	{ name: "codex-start-work-continuation", component: "start-work-continuation" },
+	{ name: "codex-telemetry", component: "telemetry" },
+	{ name: "codex-ultrawork", component: "ultrawork" },
+];
+
+export async function removeLegacyCodexComponentBins(binDir, platform) {
+	for (const entry of LEGACY_CODEX_COMPONENT_BINS) {
+		const linkPath = join(binDir, platform === "win32" ? `${entry.name}.cmd` : entry.name);
+		await removeLegacyCodexComponentBin(linkPath, entry.component, platform);
+	}
+}
+
+async function removeLegacyCodexComponentBin(linkPath, component, platform) {
+	try {
+		const stat = await lstat(linkPath);
+		if (platform !== "win32") {
+			if (!stat.isSymbolicLink()) return;
+			const target = await readlink(linkPath);
+			if (isManagedLegacyComponentTarget(target, component)) await rm(linkPath, { force: true });
+			return;
+		}
+		if (!stat.isFile()) return;
+		const content = await readFile(linkPath, "utf8");
+		if (content.includes(COMMAND_SHIM_MARKER)) await rm(linkPath, { force: true });
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+}
+
+function isManagedLegacyComponentTarget(target, component) {
+	const parts = target.split(/[\\/]+/);
+	const suffixStart = parts.length - 4;
+	const suffix = parts.slice(-4);
+	return (
+		suffix[0] === "components" &&
+		suffix[1] === component &&
+		suffix[2] === "dist" &&
+		suffix[3] === "cli.js" &&
+		hasPluginCachePrefix(parts, suffixStart)
+	);
+}
+
+function hasPluginCachePrefix(parts, endExclusive) {
+	for (let index = 0; index < endExclusive - 1; index += 1) {
+		if (parts[index] === "plugins" && parts[index + 1] === "cache") return true;
+	}
+	return false;
+}

package/packages/omo-codex/scripts/install/marketplace.mjs

@@ -0,0 +1,104 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { isRecord } from "./utils.mjs";
+
+const DEFAULT_MARKETPLACE_PATH = "packages/omo-codex/marketplace.json";
+
+export async function readMarketplace(repoRoot, options = {}) {
+	const marketplacePath = options.marketplacePath ?? join(repoRoot, DEFAULT_MARKETPLACE_PATH);
+	const raw = await readFile(marketplacePath, "utf8");
+	const parsed = JSON.parse(raw);
+	if (!isRecord(parsed)) throw new Error("marketplace.json must be an object");
+	if (typeof parsed.name !== "string" || parsed.name.trim() === "") {
+		throw new Error("marketplace.json name must be a non-empty string");
+	}
+	validatePathSegment(parsed.name, "marketplace name");
+	if (!Array.isArray(parsed.plugins)) throw new Error("marketplace.json plugins must be an array");
+
+	return {
+		name: parsed.name,
+		plugins: parsed.plugins.map((plugin, index) => normalizeMarketplacePlugin(plugin, index)),
+	};
+}
+
+export function resolvePluginSource(marketplaceRoot, plugin, options = {}) {
+	const sourcePath = localSourcePath(options.pathOverride ?? plugin.source);
+	const relativePath = sourcePath.slice(2);
+	return join(marketplaceRoot, ...relativePath.split(/[\\/]/));
+}
+
+export async function readPluginManifest(pluginRoot) {
+	const raw = await readFile(join(pluginRoot, ".codex-plugin", "plugin.json"), "utf8");
+	const parsed = JSON.parse(raw);
+	if (!isRecord(parsed)) throw new Error(`${pluginRoot} plugin.json must be an object`);
+	if (typeof parsed.name !== "string" || parsed.name.trim() === "") {
+		throw new Error(`${pluginRoot} plugin.json name must be a non-empty string`);
+	}
+	const manifest = { name: parsed.name };
+	if (parsed.version !== undefined) {
+		if (typeof parsed.version !== "string" || parsed.version.trim() === "") {
+			throw new Error(`${pluginRoot} plugin.json version must be a non-empty string`);
+		}
+		manifest.version = parsed.version.trim();
+	}
+	return manifest;
+}
+
+export function validatePathSegment(value, label) {
+	if (!/^[A-Za-z0-9._+-]+$/.test(value)) {
+		throw new Error(`${label} contains unsupported characters: ${value}`);
+	}
+	if (value === "." || value === "..") {
+		throw new Error(`${label} must not be a path traversal segment`);
+	}
+}
+
+function normalizeMarketplacePlugin(plugin, index) {
+	if (!isRecord(plugin)) throw new Error(`marketplace plugin ${index} must be an object`);
+	if (typeof plugin.name !== "string" || plugin.name.trim() === "") {
+		throw new Error(`marketplace plugin ${index} name must be a non-empty string`);
+	}
+	validatePathSegment(plugin.name, "plugin name");
+	if (plugin.source === undefined || typeof plugin.source === "string") {
+		if (typeof plugin.source === "string") validateLocalSourcePath(plugin.source);
+		return {
+			name: plugin.name,
+			source: plugin.source,
+		};
+	}
+	if (isRecord(plugin.source) && plugin.source.source === "local" && typeof plugin.source.path === "string") {
+		validateLocalSourcePath(plugin.source.path);
+		return {
+			name: plugin.name,
+			source: { source: "local", path: plugin.source.path },
+		};
+	}
+	throw new Error("local plugin source must be a string path or { source: \"local\", path } object");
+}
+
+function localSourcePath(source) {
+	if (typeof source === "string") return validateLocalSourcePath(source);
+	if (
+		isRecord(source) &&
+		source.source === "local" &&
+		typeof source.path === "string"
+	) {
+		return validateLocalSourcePath(source.path);
+	}
+	throw new Error("local plugin source must be a string path or { source: \"local\", path } object");
+}
+
+function validateLocalSourcePath(path) {
+	if (!path.startsWith("./")) {
+		throw new Error("local plugin source path must start with ./");
+	}
+	const relative = path.slice(2);
+	if (relative.length === 0) throw new Error("local plugin source path must not be empty");
+	for (const part of relative.split(/[\\/]/)) {
+		if (part === "" || part === "." || part === "..") {
+			throw new Error("local plugin source path must stay within the marketplace root");
+		}
+	}
+	return path;
+}

package/packages/omo-codex/scripts/install/mcp-runtime-cache.mjs

@@ -0,0 +1,77 @@
+import { existsSync } from "node:fs";
+import { cp } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+
+export function createCachedMcpRuntimeArgRewriter({ copyDist = cp } = {}) {
+	const copiedDistRoots = new Map();
+	return async function rewriteCachedMcpRuntimeArg({ arg, pluginRoot, serverName, sourceRoot }) {
+		return rewriteCachedMcpRuntimeArgWithCache({ arg, pluginRoot, serverName, sourceRoot }, { copiedDistRoots, copyDist });
+	};
+}
+
+export async function rewriteCachedMcpRuntimeArg(args) {
+	return createCachedMcpRuntimeArgRewriter()(args);
+}
+
+async function rewriteCachedMcpRuntimeArgWithCache({ arg, pluginRoot, serverName, sourceRoot }, { copiedDistRoots, copyDist }) {
+	if (typeof arg !== "string" || (!arg.startsWith("./") && !arg.startsWith("../"))) return arg;
+	const fallback = resolveCachedRuntimePath(pluginRoot, sourceRoot, arg);
+	const targetPath = resolve(pluginRoot, arg);
+	const runtimePath = isPathInside(targetPath, pluginRoot) ? targetPath : resolve(sourceRoot, arg);
+	const packageRoot = resolveExternalMcpPackageRoot(runtimePath, sourceRoot);
+	if (packageRoot === undefined) return fallback;
+	const distRoot = join(packageRoot, "dist");
+	const distPath = relative(distRoot, runtimePath);
+	if (distPath.startsWith("..") || isAbsolute(distPath)) return fallback;
+	const cachedRoot = join(pluginRoot, "mcp", safePathSegment(serverName));
+	const cacheKey = `${distRoot}\0${cachedRoot}`;
+	let copyPromise = copiedDistRoots.get(cacheKey);
+	if (copyPromise === undefined) {
+		copyPromise = copyDist(distRoot, join(cachedRoot, "dist"), { recursive: true });
+		copiedDistRoots.set(cacheKey, copyPromise);
+	}
+	await copyPromise;
+	return join(cachedRoot, "dist", distPath);
+}
+
+function resolveExternalMcpPackageRoot(runtimePath, sourceRoot) {
+	const packagesRoot = findPackagesRoot(sourceRoot);
+	if (packagesRoot === undefined) return undefined;
+	if (!isPathInside(runtimePath, packagesRoot)) return undefined;
+	let packageRoot = dirname(runtimePath);
+	while (packageRoot !== packagesRoot) {
+		if (existsSync(join(packageRoot, "package.json")) && isPathInside(runtimePath, join(packageRoot, "dist"))) {
+			return packageRoot;
+		}
+		const parent = dirname(packageRoot);
+		if (parent === packageRoot) return undefined;
+		packageRoot = parent;
+	}
+	return undefined;
+}
+
+function findPackagesRoot(path) {
+	let current = resolve(path);
+	for (let index = 0; index < 8; index++) {
+		if (basename(current) === "packages") return current;
+		const parent = dirname(current);
+		if (parent === current) return undefined;
+		current = parent;
+	}
+	return undefined;
+}
+
+function resolveCachedRuntimePath(pluginRoot, sourceRoot, runtimePath) {
+	const targetPath = resolve(pluginRoot, runtimePath);
+	if (isPathInside(targetPath, pluginRoot)) return targetPath;
+	return resolve(sourceRoot, runtimePath);
+}
+
+function isPathInside(candidatePath, rootPath) {
+	const pathFromRoot = relative(rootPath, candidatePath);
+	return pathFromRoot === "" || (!pathFromRoot.startsWith("..") && !isAbsolute(pathFromRoot));
+}
+
+function safePathSegment(value) {
+	return value.replace(/[^A-Za-z0-9._-]/g, "_");
+}

package/packages/omo-codex/scripts/install/multi-agent-v2-config.mjs

@@ -0,0 +1,32 @@
+import { appendBlock, findTomlSection, removeSetting, replaceOrInsertSetting } from "./toml-editor.mjs";
+
+const CODEX_MULTI_AGENT_V2_HEADER = "features.multi_agent_v2";
+const CODEX_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION = 10000;
+
+export function ensureCodexMultiAgentV2Config(config) {
+	const normalizedConfig = removeFeatureFlagSetting(config, "multi_agent_v2");
+	const section = findTomlSection(normalizedConfig, CODEX_MULTI_AGENT_V2_HEADER);
+	const maxThreadsValue = CODEX_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION.toString();
+	if (!section) {
+		return appendBlock(
+			normalizedConfig,
+			`[${CODEX_MULTI_AGENT_V2_HEADER}]\nenabled = true\nmax_concurrent_threads_per_session = ${maxThreadsValue}\n`,
+		);
+	}
+
+	const enabledConfig = replaceOrInsertSetting(normalizedConfig, section, "enabled", "true");
+	const updatedSection = findTomlSection(enabledConfig, CODEX_MULTI_AGENT_V2_HEADER);
+	if (!updatedSection) {
+		return appendBlock(
+			enabledConfig,
+			`[${CODEX_MULTI_AGENT_V2_HEADER}]\nenabled = true\nmax_concurrent_threads_per_session = ${maxThreadsValue}\n`,
+		);
+	}
+	return replaceOrInsertSetting(enabledConfig, updatedSection, "max_concurrent_threads_per_session", maxThreadsValue);
+}
+
+function removeFeatureFlagSetting(config, featureName) {
+	const section = findTomlSection(config, "features");
+	if (!section) return config;
+	return removeSetting(config, section, featureName);
+}

package/packages/omo-codex/scripts/install/process.mjs

@@ -0,0 +1,19 @@
+import { spawn } from "node:child_process";
+
+export async function defaultRunCommand(command, args, options) {
+	await new Promise((resolvePromise, reject) => {
+		const child = spawn(command, args, {
+			cwd: options.cwd,
+			stdio: "inherit",
+		});
+		child.once("error", reject);
+		child.once("exit", (code, signal) => {
+			if (code === 0) {
+				resolvePromise();
+				return;
+			}
+			const suffix = signal ? `signal ${signal}` : `exit code ${code}`;
+			reject(new Error(`${command} ${args.join(" ")} failed in ${options.cwd} with ${suffix}`));
+		});
+	});
+}

package/packages/omo-codex/scripts/install/snapshot.mjs

@@ -0,0 +1,54 @@
+import { cp, mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { join, sep } from "node:path";
+
+import { rewriteCachedMcpManifest } from "./cache.mjs";
+
+const INSTALLED_MARKETPLACES_DIR = ".tmp/marketplaces";
+
+export async function writeInstalledMarketplaceSnapshot({ codexHome, marketplace, plugins }) {
+	const marketplaceRoot = installedMarketplaceRoot(codexHome, marketplace.name);
+	await mkdir(marketplaceRoot, { recursive: true });
+	await writeMarketplaceManifest(marketplaceRoot, marketplace);
+
+	const snapshotPlugins = [];
+	for (const plugin of plugins) {
+		snapshotPlugins.push(await writeSnapshotPlugin(marketplaceRoot, plugin));
+	}
+	return snapshotPlugins;
+}
+
+export function installedMarketplaceRoot(codexHome, marketplaceName) {
+	return join(codexHome, INSTALLED_MARKETPLACES_DIR, marketplaceName);
+}
+
+async function writeMarketplaceManifest(marketplaceRoot, marketplace) {
+	const manifestDir = join(marketplaceRoot, ".agents", "plugins");
+	await mkdir(manifestDir, { recursive: true });
+	const tempPath = join(manifestDir, `.marketplace-${process.pid}-${Date.now()}.json.tmp`);
+	await writeFile(tempPath, `${JSON.stringify(marketplace, null, "\t")}\n`);
+	await rename(tempPath, join(manifestDir, "marketplace.json"));
+}
+
+async function writeSnapshotPlugin(marketplaceRoot, plugin) {
+	const pluginsDir = join(marketplaceRoot, "plugins");
+	await mkdir(pluginsDir, { recursive: true });
+	const targetPath = join(pluginsDir, plugin.name);
+	const tempPath = join(pluginsDir, `.tmp-${plugin.name}-${process.pid}-${Date.now()}`);
+	await rm(tempPath, { recursive: true, force: true });
+	await cp(plugin.sourcePath, tempPath, {
+		recursive: true,
+		filter: (source) => shouldCopyMarketplaceSourcePath(source, plugin.sourcePath),
+	});
+	await rm(targetPath, { recursive: true, force: true });
+	await rename(tempPath, targetPath);
+	await rewriteCachedMcpManifest(targetPath, plugin.sourcePath);
+	return { name: plugin.name, path: targetPath };
+}
+
+function shouldCopyMarketplaceSourcePath(path, root) {
+	const relative = path === root ? "" : path.slice(root.length + sep.length);
+	if (relative === "") return true;
+	const parts = relative.split(sep);
+	if (parts[parts.length - 1] === "package-lock.json") return false;
+	return !parts.some((part) => part === ".git" || part === "node_modules");
+}