oh-my-opencode 4.5.1 → 4.6.0

package/packages/omo-codex/scripts/install/git-bash.mjs

@@ -0,0 +1,99 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+const GIT_BASH_ENV_KEY = "OMO_CODEX_GIT_BASH_PATH";
+const SKIP_GIT_BASH_AUTO_INSTALL_ENV_KEY = "OMO_CODEX_SKIP_GIT_BASH_AUTO_INSTALL";
+const PROGRAM_FILES_GIT_BASH = "C:\\Program Files\\Git\\bin\\bash.exe";
+const PROGRAM_FILES_X86_GIT_BASH = "C:\\Program Files (x86)\\Git\\bin\\bash.exe";
+const WINGET_INSTALL_ARGS = ["install", "--id", "Git.Git", "-e", "--source", "winget"];
+
+export function resolveGitBash({ platform, env, exists, where }) {
+	if (platform !== "win32") return { found: true, path: null, source: "not-required" };
+
+	const checkedPaths = [];
+	const envPath = nonEmptyEnvValue(env, GIT_BASH_ENV_KEY);
+	if (envPath !== undefined) {
+		checkedPaths.push(envPath);
+		if (isBashExePath(envPath) && exists(envPath)) return { found: true, path: envPath, source: "env" };
+		return missingGitBash(checkedPaths);
+	}
+
+	for (const candidate of [
+		{ path: PROGRAM_FILES_GIT_BASH, source: "program-files" },
+		{ path: PROGRAM_FILES_X86_GIT_BASH, source: "program-files-x86" },
+	]) {
+		checkedPaths.push(candidate.path);
+		if (exists(candidate.path)) return { found: true, path: candidate.path, source: candidate.source };
+	}
+
+	for (const pathCandidate of where("bash")) {
+		const candidate = pathCandidate.trim();
+		if (candidate.length === 0) continue;
+		checkedPaths.push(candidate);
+		if (isBashExePath(candidate) && exists(candidate)) return { found: true, path: candidate, source: "path" };
+	}
+
+	return missingGitBash(checkedPaths);
+}
+
+export function resolveGitBashForCurrentProcess(options = {}) {
+	return resolveGitBash({
+		platform: options.platform ?? process.platform,
+		env: options.env ?? process.env,
+		exists: existsSync,
+		where: whereCommand,
+	});
+}
+
+export async function prepareGitBashForInstall(options) {
+	const resolveGitBashWithDefaults = options.resolveGitBash
+		?? (() => resolveGitBashForCurrentProcess({ platform: options.platform, env: options.env }));
+	const initialResolution = resolveGitBashWithDefaults();
+	if (options.platform !== "win32" || initialResolution.found) return initialResolution;
+	if (options.env[SKIP_GIT_BASH_AUTO_INSTALL_ENV_KEY] === "1") return initialResolution;
+
+	try {
+		await options.runCommand("winget", WINGET_INSTALL_ARGS, { cwd: options.cwd });
+	} catch (error) {
+		if (!(error instanceof Error)) throw error;
+		return initialResolution;
+	}
+
+	return resolveGitBashWithDefaults();
+}
+
+function missingGitBash(checkedPaths) {
+	return {
+		found: false,
+		checkedPaths,
+		installHint: [
+			"Git Bash is required for native Windows Codex profile installs.",
+			"Install it with: winget install --id Git.Git -e --source winget",
+			`For a custom install, set ${GIT_BASH_ENV_KEY}=C:\\path\\to\\bash.exe`,
+			"Then rerun `npx lazycodex-ai install`.",
+		].join("\n"),
+	};
+}
+
+function nonEmptyEnvValue(env, key) {
+	const value = env[key];
+	if (typeof value !== "string") return undefined;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? undefined : trimmed;
+}
+
+function isBashExePath(path) {
+	return path.toLowerCase().endsWith("bash.exe");
+}
+
+function whereCommand(command) {
+	try {
+		return execFileSync("where", [command], { encoding: "utf8" })
+			.split(/\r?\n/)
+			.map((line) => line.trim())
+			.filter((line) => line.length > 0);
+	} catch (error) {
+		if (error instanceof Error) return [];
+		throw error;
+	}
+}

package/packages/omo-codex/scripts/install/git-bash.test.mjs

@@ -0,0 +1,174 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { prepareGitBashForInstall, resolveGitBash } from "./git-bash.mjs";
+
+const programFilesGitBash = "C:\\Program Files\\Git\\bin\\bash.exe";
+const programFilesX86GitBash = "C:\\Program Files (x86)\\Git\\bin\\bash.exe";
+
+test("#given non-Windows platform #when resolving Git Bash #then no preflight is required", () => {
+	const result = resolveGitBash({
+		platform: "linux",
+		env: {},
+		exists: () => false,
+		where: () => [],
+	});
+
+	assert.deepEqual(result, { found: true, path: null, source: "not-required" });
+});
+
+test("#given Windows env override to bash.exe #when the file exists #then env path wins", () => {
+	const overridePath = "D:\\Tools\\Git\\bin\\bash.exe";
+	const result = resolveGitBash({
+		platform: "win32",
+		env: { OMO_CODEX_GIT_BASH_PATH: overridePath },
+		exists: (path) => path === overridePath,
+		where: () => [programFilesGitBash],
+	});
+
+	assert.deepEqual(result, { found: true, path: overridePath, source: "env" });
+});
+
+test("#given Windows standard paths are absent and PATH contains bash #when resolving #then uses where bash candidate", () => {
+	const pathCandidate = "E:\\Git\\bin\\bash.exe";
+	const result = resolveGitBash({
+		platform: "win32",
+		env: {},
+		exists: (path) => path === pathCandidate,
+		where: () => ["C:\\Windows\\System32\\bash.exe", pathCandidate],
+	});
+
+	assert.deepEqual(result, { found: true, path: pathCandidate, source: "path" });
+});
+
+test("#given Windows invalid env override #when resolving #then returns guidance without falling through", () => {
+	const overridePath = "D:\\Tools\\Git\\bin\\git.exe";
+	const result = resolveGitBash({
+		platform: "win32",
+		env: { OMO_CODEX_GIT_BASH_PATH: overridePath },
+		exists: () => true,
+		where: () => [programFilesGitBash],
+	});
+
+	assert.equal(result.found, false);
+	assert.deepEqual(result.checkedPaths, [overridePath]);
+	assert.match(result.installHint, /OMO_CODEX_GIT_BASH_PATH=C:\\path\\to\\bash\.exe/);
+});
+
+test("#given Windows without Git Bash #when resolving #then returns install guidance", () => {
+	const result = resolveGitBash({
+		platform: "win32",
+		env: {},
+		exists: () => false,
+		where: () => [],
+	});
+
+	assert.equal(result.found, false);
+	assert.deepEqual(result.checkedPaths, [programFilesGitBash, programFilesX86GitBash]);
+	assert.match(result.installHint, /winget install --id Git\.Git -e --source winget/);
+	assert.match(result.installHint, /rerun `npx lazycodex-ai install`/);
+	assert.doesNotMatch(result.installHint, /bunx/);
+});
+
+test("#given Windows without Git Bash and winget is allowed #when preparing #then winget runs and resolver retries", async () => {
+	const runCalls = [];
+	const resolutions = [
+		{ found: false, checkedPaths: [programFilesGitBash], installHint: "install hint" },
+		{ found: true, path: programFilesGitBash, source: "program-files" },
+	];
+	let resolveCallCount = 0;
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: {},
+		cwd: "C:\\repo",
+		resolveGitBash: () => resolutions[resolveCallCount++] ?? resolutions[resolutions.length - 1],
+		runCommand: async (command, args, options) => {
+			runCalls.push([command, ...args, options.cwd].join(" "));
+		},
+	});
+
+	assert.deepEqual(runCalls, ["winget install --id Git.Git -e --source winget C:\\repo"]);
+	assert.equal(resolveCallCount, 2);
+	assert.deepEqual(result, { found: true, path: programFilesGitBash, source: "program-files" });
+});
+
+test("#given Windows without Git Bash and skip env is set #when preparing #then winget is not run and install hint remains", async () => {
+	const runCalls = [];
+	const missingResolution = {
+		found: false,
+		checkedPaths: [programFilesGitBash, programFilesX86GitBash],
+		installHint: "install hint",
+	};
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: { OMO_CODEX_SKIP_GIT_BASH_AUTO_INSTALL: "1" },
+		cwd: "C:\\repo",
+		resolveGitBash: () => missingResolution,
+		runCommand: async (command, args, options) => {
+			runCalls.push([command, ...args, options.cwd].join(" "));
+		},
+	});
+
+	assert.deepEqual(runCalls, []);
+	assert.deepEqual(result, missingResolution);
+});
+
+test("#given non-Windows platform #when preparing #then winget is never called", async () => {
+	const runCalls = [];
+	const result = await prepareGitBashForInstall({
+		platform: "linux",
+		env: {},
+		cwd: "/repo",
+		runCommand: async (command, args, options) => {
+			runCalls.push([command, ...args, options.cwd].join(" "));
+		},
+	});
+
+	assert.deepEqual(runCalls, []);
+	assert.deepEqual(result, { found: true, path: null, source: "not-required" });
+});
+
+test("#given Windows without Git Bash and winget fails #when preparing #then original install hint is preserved", async () => {
+	const missingResolution = {
+		found: false,
+		checkedPaths: [programFilesGitBash, programFilesX86GitBash],
+		installHint: "install hint",
+	};
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: {},
+		cwd: "C:\\repo",
+		resolveGitBash: () => missingResolution,
+		runCommand: async () => {
+			throw new Error("winget unavailable");
+		},
+	});
+
+	assert.deepEqual(result, missingResolution);
+});
+
+test("#given Windows without Git Bash and winget succeeds but bash is still missing #when preparing #then install hint remains", async () => {
+	const missingResolution = {
+		found: false,
+		checkedPaths: [programFilesGitBash, programFilesX86GitBash],
+		installHint: "install hint",
+	};
+	let resolveCallCount = 0;
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: {},
+		cwd: "C:\\repo",
+		resolveGitBash: () => {
+			resolveCallCount += 1;
+			return missingResolution;
+		},
+		runCommand: async () => {},
+	});
+
+	assert.equal(resolveCallCount, 2);
+	assert.deepEqual(result, missingResolution);
+});

package/packages/omo-codex/scripts/install/hook-trust.mjs

@@ -0,0 +1,84 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { exists, isRecord } from "./utils.mjs";
+
+const EVENT_LABELS = new Map([
+	["PreToolUse", "pre_tool_use"],
+	["PermissionRequest", "permission_request"],
+	["PostToolUse", "post_tool_use"],
+	["PreCompact", "pre_compact"],
+	["PostCompact", "post_compact"],
+	["SessionStart", "session_start"],
+	["UserPromptSubmit", "user_prompt_submit"],
+	["SubagentStart", "subagent_start"],
+	["SubagentStop", "subagent_stop"],
+	["Stop", "stop"],
+]);
+
+export async function trustedHookStatesForPlugin({ marketplaceName, pluginName, pluginRoot }) {
+	const manifestPath = join(pluginRoot, ".codex-plugin", "plugin.json");
+	if (!(await exists(manifestPath))) return [];
+	const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+	if (!isRecord(manifest) || typeof manifest.hooks !== "string") return [];
+
+	const hooksPath = join(pluginRoot, manifest.hooks);
+	if (!(await exists(hooksPath))) return [];
+	const parsed = JSON.parse(await readFile(hooksPath, "utf8"));
+	if (!isRecord(parsed) || !isRecord(parsed.hooks)) return [];
+
+	const keySource = `${pluginName}@${marketplaceName}:${stripDotSlash(manifest.hooks)}`;
+	const states = [];
+	for (const [eventName, groups] of Object.entries(parsed.hooks)) {
+		if (!Array.isArray(groups)) continue;
+		const eventLabel = EVENT_LABELS.get(eventName);
+		if (eventLabel === undefined) continue;
+		for (const [groupIndex, group] of groups.entries()) {
+			if (!isRecord(group) || !Array.isArray(group.hooks)) continue;
+			for (const [handlerIndex, handler] of group.hooks.entries()) {
+				if (!isRecord(handler) || handler.type !== "command") continue;
+				if (handler.async === true) continue;
+				if (typeof handler.command !== "string" || handler.command.trim() === "") continue;
+				const key = `${keySource}:${eventLabel}:${groupIndex}:${handlerIndex}`;
+				states.push({
+					key,
+					trustedHash: commandHookHash(eventLabel, group.matcher, handler),
+				});
+			}
+		}
+	}
+	return states;
+}
+
+function commandHookHash(eventName, matcher, handler) {
+	const command = handler.command;
+	const timeout = Math.max(Number(handler.timeout ?? 600), 1);
+	const normalizedHandler = {
+		type: "command",
+		command,
+		timeout,
+		async: false,
+	};
+	if (typeof handler.statusMessage === "string") normalizedHandler.statusMessage = handler.statusMessage;
+	const identity = {
+		event_name: eventName,
+		hooks: [normalizedHandler],
+	};
+	if (typeof matcher === "string") identity.matcher = matcher;
+	return `sha256:${createHash("sha256").update(JSON.stringify(canonicalJson(identity))).digest("hex")}`;
+}
+
+function canonicalJson(value) {
+	if (Array.isArray(value)) return value.map(canonicalJson);
+	if (!isRecord(value)) return value;
+	const result = {};
+	for (const key of Object.keys(value).sort()) {
+		result[key] = canonicalJson(value[key]);
+	}
+	return result;
+}
+
+function stripDotSlash(value) {
+	return value.startsWith("./") ? value.slice(2) : value;
+}

package/packages/omo-codex/scripts/install/legacy-bins.mjs

@@ -0,0 +1,57 @@
+import { lstat, readFile, readlink, rm } from "node:fs/promises";
+import { join } from "node:path";
+
+import { COMMAND_SHIM_MARKER } from "./command-shim.mjs";
+
+const LEGACY_CODEX_COMPONENT_BINS = [
+	{ name: "codex-comment-checker", component: "comment-checker" },
+	{ name: "codex-rules", component: "rules" },
+	{ name: "codex-start-work-continuation", component: "start-work-continuation" },
+	{ name: "codex-telemetry", component: "telemetry" },
+	{ name: "codex-ultrawork", component: "ultrawork" },
+];
+
+export async function removeLegacyCodexComponentBins(binDir, platform) {
+	for (const entry of LEGACY_CODEX_COMPONENT_BINS) {
+		const linkPath = join(binDir, platform === "win32" ? `${entry.name}.cmd` : entry.name);
+		await removeLegacyCodexComponentBin(linkPath, entry.component, platform);
+	}
+}
+
+async function removeLegacyCodexComponentBin(linkPath, component, platform) {
+	try {
+		const stat = await lstat(linkPath);
+		if (platform !== "win32") {
+			if (!stat.isSymbolicLink()) return;
+			const target = await readlink(linkPath);
+			if (isManagedLegacyComponentTarget(target, component)) await rm(linkPath, { force: true });
+			return;
+		}
+		if (!stat.isFile()) return;
+		const content = await readFile(linkPath, "utf8");
+		if (content.includes(COMMAND_SHIM_MARKER)) await rm(linkPath, { force: true });
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+}
+
+function isManagedLegacyComponentTarget(target, component) {
+	const parts = target.split(/[\\/]+/);
+	const suffixStart = parts.length - 4;
+	const suffix = parts.slice(-4);
+	return (
+		suffix[0] === "components" &&
+		suffix[1] === component &&
+		suffix[2] === "dist" &&
+		suffix[3] === "cli.js" &&
+		hasPluginCachePrefix(parts, suffixStart)
+	);
+}
+
+function hasPluginCachePrefix(parts, endExclusive) {
+	for (let index = 0; index < endExclusive - 1; index += 1) {
+		if (parts[index] === "plugins" && parts[index + 1] === "cache") return true;
+	}
+	return false;
+}

package/packages/omo-codex/scripts/install/marketplace.mjs

@@ -0,0 +1,104 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { isRecord } from "./utils.mjs";
+
+const DEFAULT_MARKETPLACE_PATH = "packages/omo-codex/marketplace.json";
+
+export async function readMarketplace(repoRoot, options = {}) {
+	const marketplacePath = options.marketplacePath ?? join(repoRoot, DEFAULT_MARKETPLACE_PATH);
+	const raw = await readFile(marketplacePath, "utf8");
+	const parsed = JSON.parse(raw);
+	if (!isRecord(parsed)) throw new Error("marketplace.json must be an object");
+	if (typeof parsed.name !== "string" || parsed.name.trim() === "") {
+		throw new Error("marketplace.json name must be a non-empty string");
+	}
+	validatePathSegment(parsed.name, "marketplace name");
+	if (!Array.isArray(parsed.plugins)) throw new Error("marketplace.json plugins must be an array");
+
+	return {
+		name: parsed.name,
+		plugins: parsed.plugins.map((plugin, index) => normalizeMarketplacePlugin(plugin, index)),
+	};
+}
+
+export function resolvePluginSource(marketplaceRoot, plugin, options = {}) {
+	const sourcePath = localSourcePath(options.pathOverride ?? plugin.source);
+	const relativePath = sourcePath.slice(2);
+	return join(marketplaceRoot, ...relativePath.split(/[\\/]/));
+}
+
+export async function readPluginManifest(pluginRoot) {
+	const raw = await readFile(join(pluginRoot, ".codex-plugin", "plugin.json"), "utf8");
+	const parsed = JSON.parse(raw);
+	if (!isRecord(parsed)) throw new Error(`${pluginRoot} plugin.json must be an object`);
+	if (typeof parsed.name !== "string" || parsed.name.trim() === "") {
+		throw new Error(`${pluginRoot} plugin.json name must be a non-empty string`);
+	}
+	const manifest = { name: parsed.name };
+	if (parsed.version !== undefined) {
+		if (typeof parsed.version !== "string" || parsed.version.trim() === "") {
+			throw new Error(`${pluginRoot} plugin.json version must be a non-empty string`);
+		}
+		manifest.version = parsed.version.trim();
+	}
+	return manifest;
+}
+
+export function validatePathSegment(value, label) {
+	if (!/^[A-Za-z0-9._+-]+$/.test(value)) {
+		throw new Error(`${label} contains unsupported characters: ${value}`);
+	}
+	if (value === "." || value === "..") {
+		throw new Error(`${label} must not be a path traversal segment`);
+	}
+}
+
+function normalizeMarketplacePlugin(plugin, index) {
+	if (!isRecord(plugin)) throw new Error(`marketplace plugin ${index} must be an object`);
+	if (typeof plugin.name !== "string" || plugin.name.trim() === "") {
+		throw new Error(`marketplace plugin ${index} name must be a non-empty string`);
+	}
+	validatePathSegment(plugin.name, "plugin name");
+	if (plugin.source === undefined || typeof plugin.source === "string") {
+		if (typeof plugin.source === "string") validateLocalSourcePath(plugin.source);
+		return {
+			name: plugin.name,
+			source: plugin.source,
+		};
+	}
+	if (isRecord(plugin.source) && plugin.source.source === "local" && typeof plugin.source.path === "string") {
+		validateLocalSourcePath(plugin.source.path);
+		return {
+			name: plugin.name,
+			source: { source: "local", path: plugin.source.path },
+		};
+	}
+	throw new Error("local plugin source must be a string path or { source: \"local\", path } object");
+}
+
+function localSourcePath(source) {
+	if (typeof source === "string") return validateLocalSourcePath(source);
+	if (
+		isRecord(source) &&
+		source.source === "local" &&
+		typeof source.path === "string"
+	) {
+		return validateLocalSourcePath(source.path);
+	}
+	throw new Error("local plugin source must be a string path or { source: \"local\", path } object");
+}
+
+function validateLocalSourcePath(path) {
+	if (!path.startsWith("./")) {
+		throw new Error("local plugin source path must start with ./");
+	}
+	const relative = path.slice(2);
+	if (relative.length === 0) throw new Error("local plugin source path must not be empty");
+	for (const part of relative.split(/[\\/]/)) {
+		if (part === "" || part === "." || part === "..") {
+			throw new Error("local plugin source path must stay within the marketplace root");
+		}
+	}
+	return path;
+}

package/packages/omo-codex/scripts/install/mcp-runtime-cache.mjs

@@ -0,0 +1,81 @@
+import { existsSync } from "node:fs";
+import { cp } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+
+export function createCachedMcpRuntimeArgRewriter({ copyDist = cp } = {}) {
+	const copiedDistRoots = new Map();
+	return async function rewriteCachedMcpRuntimeArg({ arg, pluginRoot, serverName, sourceRoot }) {
+		return rewriteCachedMcpRuntimeArgWithCache({ arg, pluginRoot, serverName, sourceRoot }, { copiedDistRoots, copyDist });
+	};
+}
+
+export async function rewriteCachedMcpRuntimeArg(args) {
+	return createCachedMcpRuntimeArgRewriter()(args);
+}
+
+async function rewriteCachedMcpRuntimeArgWithCache({ arg, pluginRoot, serverName, sourceRoot }, { copiedDistRoots, copyDist }) {
+	if (typeof arg !== "string" || (!arg.startsWith("./") && !arg.startsWith("../"))) return arg;
+	const fallback = resolveCachedRuntimePath(pluginRoot, sourceRoot, arg);
+	const targetPath = resolve(pluginRoot, arg);
+	const runtimePath = isPathInside(targetPath, pluginRoot) ? targetPath : resolve(sourceRoot, arg);
+	const packageRoot = resolveExternalMcpPackageRoot(runtimePath, sourceRoot);
+	if (packageRoot === undefined) return fallback;
+	const distRoot = join(packageRoot, "dist");
+	const distPath = relative(distRoot, runtimePath);
+	if (distPath.startsWith("..") || isAbsolute(distPath)) return fallback;
+	const cachedRoot = join(pluginRoot, "mcp", safePathSegment(serverName));
+	const cacheKey = `${distRoot}\0${cachedRoot}`;
+	let copyPromise = copiedDistRoots.get(cacheKey);
+	if (copyPromise === undefined) {
+		copyPromise = copyDist(distRoot, join(cachedRoot, "dist"), { recursive: true });
+		copiedDistRoots.set(cacheKey, copyPromise);
+	}
+	await copyPromise;
+	return join(cachedRoot, "dist", distPath);
+}
+
+function resolveExternalMcpPackageRoot(runtimePath, sourceRoot) {
+	const packagesRoot = findPackagesRoot(sourceRoot);
+	if (packagesRoot === undefined) return undefined;
+	if (!isPathInside(runtimePath, packagesRoot)) return undefined;
+	let packageRoot = dirname(runtimePath);
+	while (packageRoot !== packagesRoot) {
+		if (isPathInside(runtimePath, join(packageRoot, "dist")) && isRuntimePackageRoot(packageRoot)) {
+			return packageRoot;
+		}
+		const parent = dirname(packageRoot);
+		if (parent === packageRoot) return undefined;
+		packageRoot = parent;
+	}
+	return undefined;
+}
+
+function isRuntimePackageRoot(packageRoot) {
+	return existsSync(join(packageRoot, "package.json")) || existsSync(join(packageRoot, "dist"));
+}
+
+function findPackagesRoot(path) {
+	let current = resolve(path);
+	for (let index = 0; index < 8; index++) {
+		if (basename(current) === "packages") return current;
+		const parent = dirname(current);
+		if (parent === current) return undefined;
+		current = parent;
+	}
+	return undefined;
+}
+
+function resolveCachedRuntimePath(pluginRoot, sourceRoot, runtimePath) {
+	const targetPath = resolve(pluginRoot, runtimePath);
+	if (isPathInside(targetPath, pluginRoot)) return targetPath;
+	return resolve(sourceRoot, runtimePath);
+}
+
+function isPathInside(candidatePath, rootPath) {
+	const pathFromRoot = relative(rootPath, candidatePath);
+	return pathFromRoot === "" || (!pathFromRoot.startsWith("..") && !isAbsolute(pathFromRoot));
+}
+
+function safePathSegment(value) {
+	return value.replace(/[^A-Za-z0-9._-]/g, "_");
+}

package/packages/omo-codex/scripts/install/multi-agent-v2-config.mjs

@@ -0,0 +1,38 @@
+import { appendBlock, findTomlSection, removeSetting, replaceOrInsertSetting } from "./toml-editor.mjs";
+
+const CODEX_MULTI_AGENT_V2_HEADER = "features.multi_agent_v2";
+const CODEX_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION = 10000;
+
+export function ensureCodexMultiAgentV2Config(config) {
+	const normalizedConfig = removeLegacyAgentsMaxThreadsSetting(removeFeatureFlagSetting(config, "multi_agent_v2"));
+	const section = findTomlSection(normalizedConfig, CODEX_MULTI_AGENT_V2_HEADER);
+	const maxThreadsValue = CODEX_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION.toString();
+	if (!section) {
+		return appendBlock(
+			normalizedConfig,
+			`[${CODEX_MULTI_AGENT_V2_HEADER}]\nenabled = true\nmax_concurrent_threads_per_session = ${maxThreadsValue}\n`,
+		);
+	}
+
+	const enabledConfig = replaceOrInsertSetting(normalizedConfig, section, "enabled", "true");
+	const updatedSection = findTomlSection(enabledConfig, CODEX_MULTI_AGENT_V2_HEADER);
+	if (!updatedSection) {
+		return appendBlock(
+			enabledConfig,
+			`[${CODEX_MULTI_AGENT_V2_HEADER}]\nenabled = true\nmax_concurrent_threads_per_session = ${maxThreadsValue}\n`,
+		);
+	}
+	return replaceOrInsertSetting(enabledConfig, updatedSection, "max_concurrent_threads_per_session", maxThreadsValue);
+}
+
+function removeFeatureFlagSetting(config, featureName) {
+	const section = findTomlSection(config, "features");
+	if (!section) return config;
+	return removeSetting(config, section, featureName);
+}
+
+function removeLegacyAgentsMaxThreadsSetting(config) {
+	const section = findTomlSection(config, "agents");
+	if (!section) return config;
+	return removeSetting(config, section, "max_threads");
+}

package/packages/omo-codex/scripts/install/permissions.d.mts

@@ -0,0 +1 @@
+export function ensureAutonomousPermissions(config: string): string;

package/packages/omo-codex/scripts/install/permissions.mjs

@@ -0,0 +1,26 @@
+import { appendBlock, findTomlSection, removeSetting, replaceOrInsertRootSetting, replaceOrInsertSetting } from "./toml-editor.mjs";
+
+export function ensureAutonomousPermissions(config) {
+	let next = replaceOrInsertRootSetting(config, "approval_policy", JSON.stringify("never"));
+	next = replaceOrInsertRootSetting(next, "sandbox_mode", JSON.stringify("danger-full-access"));
+	next = replaceOrInsertRootSetting(next, "network_access", JSON.stringify("enabled"));
+	next = removeWindowsSandboxSetting(next);
+	next = ensureNoticeEnabled(next, "hide_full_access_warning");
+	return ensureNoticeEnabled(next, "hide_world_writable_warning");
+}
+
+function removeWindowsSandboxSetting(config) {
+	const section = findTomlSection(config, "windows");
+	if (!section) return config;
+	return removeSetting(config, section, "sandbox");
+}
+
+function ensureNoticeEnabled(config, key) {
+	const section = findTomlSection(config, "notice");
+	if (!section) return appendNoticeBlock(config, key);
+	return replaceOrInsertSetting(config, section, key, "true");
+}
+
+function appendNoticeBlock(config, key) {
+	return appendBlock(config, `[notice]\n${key} = true\n`);
+}