oh-my-opencode 4.5.12 → 4.7.0

package/packages/omo-codex/scripts/install/cli-args.mjs

@@ -0,0 +1,112 @@
+const CODEX_ONLY_ERROR = "lazycodex-ai installs the Codex Light edition only. Use the omo installer for OpenCode or both-platform installs.";
+const PASSTHROUGH_COMMANDS = new Set(["doctor", "cleanup", "get-local-version", "boulder", "refresh-model-capabilities", "run", "ulw-loop"]);
+
+export function parseLazyCodexInstallCliArgs(argv) {
+	const args = [...argv];
+	if (args.length === 0) return { kind: "install", autonomousPermissions: undefined, repoRoot: undefined };
+
+	let repoRoot;
+	let command;
+	let dryRun = false;
+	let noTui = false;
+	let skipAuth = false;
+	let autonomousPermissions;
+	let index = 0;
+	while (index < args.length) {
+		const arg = args[index];
+		if (arg === "--help" || arg === "-h" || arg === "help") return { kind: "help" };
+		if (arg === "--version" || arg === "-v" || arg === "version") return { kind: "version" };
+		if (arg === "--dry-run") {
+			dryRun = true;
+			index += 1;
+			continue;
+		}
+		if (arg === "--no-tui") {
+			noTui = true;
+			index += 1;
+			continue;
+		}
+		if (arg === "--skip-auth") {
+			skipAuth = true;
+			index += 1;
+			continue;
+		}
+		if (arg === "--codex-autonomous") {
+			autonomousPermissions = true;
+			index += 1;
+			continue;
+		}
+		if (arg === "--no-codex-autonomous") {
+			autonomousPermissions = false;
+			index += 1;
+			continue;
+		}
+		if (arg === "--platform") {
+			const platform = readOptionValue(args, index, "--platform");
+			if (platform !== "codex") throw new Error(CODEX_ONLY_ERROR);
+			index += 2;
+			continue;
+		}
+		if (typeof arg === "string" && arg.startsWith("--platform=")) {
+			const platform = arg.slice("--platform=".length);
+			if (platform.trim().length === 0) throw new Error("--platform requires a value");
+			if (platform !== "codex") throw new Error(CODEX_ONLY_ERROR);
+			index += 1;
+			continue;
+		}
+		if (arg === "--repo-root") {
+			repoRoot = readOptionValue(args, index, "--repo-root");
+			index += 2;
+			continue;
+		}
+		if (typeof arg === "string" && arg.startsWith("--repo-root=")) {
+			const value = arg.slice("--repo-root=".length);
+			if (value.trim().length === 0) throw new Error("--repo-root requires a path");
+			repoRoot = value;
+			index += 1;
+			continue;
+		}
+		if (arg === "install" || arg === "setup") {
+			if (command !== undefined) throw new Error(`Unsupported lazycodex-ai install option: ${String(arg)}`);
+			command = "install";
+			index += 1;
+			continue;
+		}
+		if (PASSTHROUGH_COMMANDS.has(arg)) {
+			return { kind: "command", command: arg, dryRun, args: args.slice(index + 1) };
+		}
+		if (command === undefined && typeof arg === "string" && !arg.startsWith("-")) {
+			throw new Error(`Unsupported lazycodex-ai command: ${String(arg)}`);
+		}
+		throw new Error(`Unsupported lazycodex-ai install option: ${String(arg)}`);
+	}
+
+	if (!dryRun) return { kind: "install", autonomousPermissions, repoRoot };
+
+	return {
+		kind: "command",
+		command: command ?? "install",
+		dryRun,
+		noTui,
+		skipAuth,
+		autonomousPermissions,
+		repoRoot,
+		args: [],
+	};
+}
+
+function readOptionValue(args, index, option) {
+	const value = args[index + 1];
+	if (typeof value !== "string" || value.trim().length === 0) {
+		throw new Error(`${option} requires a value`);
+	}
+	return value;
+}
+
+export function formatLazyCodexInstallHelp() {
+	return [
+		"Usage: lazycodex-ai install [--no-tui] [--codex-autonomous|--no-codex-autonomous] [--repo-root <path>]",
+		"",
+		"Installs the Codex Light edition into ~/.codex using Node/npm.",
+	].join("\n");
+}

package/packages/omo-codex/scripts/install/config.mjs

@@ -2,6 +2,9 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 
 import { ensureCodexMultiAgentV2Config } from "./multi-agent-v2-config.mjs";
+import { readCodexModelCatalog } from "./model-catalog.mjs";
+import { ensureCodexReasoningConfig } from "./reasoning-config.mjs";
+import { ensureAutonomousPermissions } from "./permissions.mjs";
 import { appendBlock, findTomlSection, replaceOrInsertSetting } from "./toml-editor.mjs";
 import { exists } from "./utils.mjs";
 
@@ -22,8 +25,10 @@ export async function updateCodexConfig({
 	marketplaceName,
 	marketplaceSource = defaultMarketplaceSource(marketplaceName, repoRoot),
 	pluginNames,
+	platform = process.platform,
 	trustedHookStates = [],
 	agentConfigs = [],
+	autonomousPermissions = false,
 }) {
 	await mkdir(dirname(configPath), { recursive: true });
 	let config = "";
@@ -39,11 +44,14 @@ export async function updateCodexConfig({
 	config = removeStaleManagedAgentBlocks(config, new Set(agentConfigs.map((agentConfig) => agentConfig.name)));
 	config = ensureFeatureEnabled(config, "plugins");
 	config = ensureFeatureEnabled(config, "plugin_hooks");
+	config = ensureCodexReasoningConfig(config, await readCodexModelCatalog(repoRoot));
 	config = ensureCodexMultiAgentV2Config(config);
+	if (autonomousPermissions === true) config = ensureAutonomousPermissions(config);
 	config = ensureMarketplaceBlock(config, marketplaceName, marketplaceSource);
 	for (const pluginName of pluginNames) {
 		config = ensurePluginEnabled(config, `${pluginName}@${marketplaceName}`);
 	}
+	config = ensureOmoGitBashMcpPolicy(config, { marketplaceName, pluginNames, platform });
 	for (const state of trustedHookStates) {
 		config = ensureHookTrusted(config, state.key, state.trustedHash);
 	}
@@ -136,6 +144,19 @@ function ensurePluginEnabled(config, pluginKey) {
 	return replaceOrInsertSetting(config, section, "enabled", "true");
 }
 
+function ensurePluginMcpEnabled(config, pluginKey, serverName, enabled) {
+	const header = `plugins.${JSON.stringify(pluginKey)}.mcp_servers.${serverName}`;
+	const section = findTomlSection(config, header);
+	const enabledValue = enabled ? "true" : "false";
+	if (!section) return appendBlock(config, `[${header}]\nenabled = ${enabledValue}\n`);
+	return replaceOrInsertSetting(config, section, "enabled", enabledValue);
+}
+
+function ensureOmoGitBashMcpPolicy(config, { marketplaceName, pluginNames, platform }) {
+	if (marketplaceName !== "sisyphuslabs" || !pluginNames.includes("omo")) return config;
+	return ensurePluginMcpEnabled(config, "omo@sisyphuslabs", "git_bash", platform === "win32");
+}
+
 function ensureHookTrusted(config, key, trustedHash) {
 	const header = `hooks.state.${JSON.stringify(key)}`;
 	const section = findTomlSection(config, header);
@@ -223,7 +244,8 @@ function parseJsonString(value) {
 	try {
 		const parsed = JSON.parse(value);
 		return typeof parsed === "string" ? parsed : null;
-	} catch {
+	} catch (error) {
+		if (error instanceof Error) return null;
 		return null;
 	}
 }

package/packages/omo-codex/scripts/install/delegated-command.mjs

@@ -0,0 +1,25 @@
+export async function runDelegatedOmoCommand(parsed, options) {
+	const invocation = buildDelegatedOmoInvocation(parsed);
+	if (parsed.dryRun) {
+		options.log(`${invocation.command} ${invocation.args.join(" ")}`);
+		return;
+	}
+	await options.runCommand(invocation.command, invocation.args, { cwd: options.cwd });
+}
+
+export function buildDelegatedOmoInvocation(parsed) {
+	const args = ["--yes", "--package", "oh-my-openagent", "omo", parsed.command];
+	if (parsed.command === "install") {
+		args.push("--platform=codex");
+		if (parsed.noTui) args.push("--no-tui");
+		if (parsed.skipAuth) args.push("--skip-auth");
+		if (parsed.autonomousPermissions !== false) args.push("--codex-autonomous");
+		if (parsed.autonomousPermissions === false) args.push("--no-codex-autonomous");
+		if (parsed.repoRoot) args.push(`--repo-root=${parsed.repoRoot}`);
+	} else if (parsed.command === "cleanup") {
+		args.push("--platform=codex", ...parsed.args);
+	} else {
+		args.push(...parsed.args);
+	}
+	return { command: "npx", args };
+}

package/packages/omo-codex/scripts/install/git-bash.mjs

@@ -0,0 +1,99 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+const GIT_BASH_ENV_KEY = "OMO_CODEX_GIT_BASH_PATH";
+const SKIP_GIT_BASH_AUTO_INSTALL_ENV_KEY = "OMO_CODEX_SKIP_GIT_BASH_AUTO_INSTALL";
+const PROGRAM_FILES_GIT_BASH = "C:\\Program Files\\Git\\bin\\bash.exe";
+const PROGRAM_FILES_X86_GIT_BASH = "C:\\Program Files (x86)\\Git\\bin\\bash.exe";
+const WINGET_INSTALL_ARGS = ["install", "--id", "Git.Git", "-e", "--source", "winget"];
+
+export function resolveGitBash({ platform, env, exists, where }) {
+	if (platform !== "win32") return { found: true, path: null, source: "not-required" };
+
+	const checkedPaths = [];
+	const envPath = nonEmptyEnvValue(env, GIT_BASH_ENV_KEY);
+	if (envPath !== undefined) {
+		checkedPaths.push(envPath);
+		if (isBashExePath(envPath) && exists(envPath)) return { found: true, path: envPath, source: "env" };
+		return missingGitBash(checkedPaths);
+	}
+
+	for (const candidate of [
+		{ path: PROGRAM_FILES_GIT_BASH, source: "program-files" },
+		{ path: PROGRAM_FILES_X86_GIT_BASH, source: "program-files-x86" },
+	]) {
+		checkedPaths.push(candidate.path);
+		if (exists(candidate.path)) return { found: true, path: candidate.path, source: candidate.source };
+	}
+
+	for (const pathCandidate of where("bash")) {
+		const candidate = pathCandidate.trim();
+		if (candidate.length === 0) continue;
+		checkedPaths.push(candidate);
+		if (isBashExePath(candidate) && exists(candidate)) return { found: true, path: candidate, source: "path" };
+	}
+
+	return missingGitBash(checkedPaths);
+}
+
+export function resolveGitBashForCurrentProcess(options = {}) {
+	return resolveGitBash({
+		platform: options.platform ?? process.platform,
+		env: options.env ?? process.env,
+		exists: existsSync,
+		where: whereCommand,
+	});
+}
+
+export async function prepareGitBashForInstall(options) {
+	const resolveGitBashWithDefaults = options.resolveGitBash
+		?? (() => resolveGitBashForCurrentProcess({ platform: options.platform, env: options.env }));
+	const initialResolution = resolveGitBashWithDefaults();
+	if (options.platform !== "win32" || initialResolution.found) return initialResolution;
+	if (options.env[SKIP_GIT_BASH_AUTO_INSTALL_ENV_KEY] === "1") return initialResolution;
+
+	try {
+		await options.runCommand("winget", WINGET_INSTALL_ARGS, { cwd: options.cwd });
+	} catch (error) {
+		if (!(error instanceof Error)) throw error;
+		return initialResolution;
+	}
+
+	return resolveGitBashWithDefaults();
+}
+
+function missingGitBash(checkedPaths) {
+	return {
+		found: false,
+		checkedPaths,
+		installHint: [
+			"Git Bash is required for native Windows Codex profile installs.",
+			"Install it with: winget install --id Git.Git -e --source winget",
+			`For a custom install, set ${GIT_BASH_ENV_KEY}=C:\\path\\to\\bash.exe`,
+			"Then rerun `npx lazycodex-ai install`.",
+		].join("\n"),
+	};
+}
+
+function nonEmptyEnvValue(env, key) {
+	const value = env[key];
+	if (typeof value !== "string") return undefined;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? undefined : trimmed;
+}
+
+function isBashExePath(path) {
+	return path.toLowerCase().endsWith("bash.exe");
+}
+
+function whereCommand(command) {
+	try {
+		return execFileSync("where", [command], { encoding: "utf8" })
+			.split(/\r?\n/)
+			.map((line) => line.trim())
+			.filter((line) => line.length > 0);
+	} catch (error) {
+		if (error instanceof Error) return [];
+		throw error;
+	}
+}

package/packages/omo-codex/scripts/install/git-bash.test.mjs

@@ -0,0 +1,174 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { prepareGitBashForInstall, resolveGitBash } from "./git-bash.mjs";
+
+const programFilesGitBash = "C:\\Program Files\\Git\\bin\\bash.exe";
+const programFilesX86GitBash = "C:\\Program Files (x86)\\Git\\bin\\bash.exe";
+
+test("#given non-Windows platform #when resolving Git Bash #then no preflight is required", () => {
+	const result = resolveGitBash({
+		platform: "linux",
+		env: {},
+		exists: () => false,
+		where: () => [],
+	});
+
+	assert.deepEqual(result, { found: true, path: null, source: "not-required" });
+});
+
+test("#given Windows env override to bash.exe #when the file exists #then env path wins", () => {
+	const overridePath = "D:\\Tools\\Git\\bin\\bash.exe";
+	const result = resolveGitBash({
+		platform: "win32",
+		env: { OMO_CODEX_GIT_BASH_PATH: overridePath },
+		exists: (path) => path === overridePath,
+		where: () => [programFilesGitBash],
+	});
+
+	assert.deepEqual(result, { found: true, path: overridePath, source: "env" });
+});
+
+test("#given Windows standard paths are absent and PATH contains bash #when resolving #then uses where bash candidate", () => {
+	const pathCandidate = "E:\\Git\\bin\\bash.exe";
+	const result = resolveGitBash({
+		platform: "win32",
+		env: {},
+		exists: (path) => path === pathCandidate,
+		where: () => ["C:\\Windows\\System32\\bash.exe", pathCandidate],
+	});
+
+	assert.deepEqual(result, { found: true, path: pathCandidate, source: "path" });
+});
+
+test("#given Windows invalid env override #when resolving #then returns guidance without falling through", () => {
+	const overridePath = "D:\\Tools\\Git\\bin\\git.exe";
+	const result = resolveGitBash({
+		platform: "win32",
+		env: { OMO_CODEX_GIT_BASH_PATH: overridePath },
+		exists: () => true,
+		where: () => [programFilesGitBash],
+	});
+
+	assert.equal(result.found, false);
+	assert.deepEqual(result.checkedPaths, [overridePath]);
+	assert.match(result.installHint, /OMO_CODEX_GIT_BASH_PATH=C:\\path\\to\\bash\.exe/);
+});
+
+test("#given Windows without Git Bash #when resolving #then returns install guidance", () => {
+	const result = resolveGitBash({
+		platform: "win32",
+		env: {},
+		exists: () => false,
+		where: () => [],
+	});
+
+	assert.equal(result.found, false);
+	assert.deepEqual(result.checkedPaths, [programFilesGitBash, programFilesX86GitBash]);
+	assert.match(result.installHint, /winget install --id Git\.Git -e --source winget/);
+	assert.match(result.installHint, /rerun `npx lazycodex-ai install`/);
+	assert.doesNotMatch(result.installHint, /bunx/);
+});
+
+test("#given Windows without Git Bash and winget is allowed #when preparing #then winget runs and resolver retries", async () => {
+	const runCalls = [];
+	const resolutions = [
+		{ found: false, checkedPaths: [programFilesGitBash], installHint: "install hint" },
+		{ found: true, path: programFilesGitBash, source: "program-files" },
+	];
+	let resolveCallCount = 0;
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: {},
+		cwd: "C:\\repo",
+		resolveGitBash: () => resolutions[resolveCallCount++] ?? resolutions[resolutions.length - 1],
+		runCommand: async (command, args, options) => {
+			runCalls.push([command, ...args, options.cwd].join(" "));
+		},
+	});
+
+	assert.deepEqual(runCalls, ["winget install --id Git.Git -e --source winget C:\\repo"]);
+	assert.equal(resolveCallCount, 2);
+	assert.deepEqual(result, { found: true, path: programFilesGitBash, source: "program-files" });
+});
+
+test("#given Windows without Git Bash and skip env is set #when preparing #then winget is not run and install hint remains", async () => {
+	const runCalls = [];
+	const missingResolution = {
+		found: false,
+		checkedPaths: [programFilesGitBash, programFilesX86GitBash],
+		installHint: "install hint",
+	};
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: { OMO_CODEX_SKIP_GIT_BASH_AUTO_INSTALL: "1" },
+		cwd: "C:\\repo",
+		resolveGitBash: () => missingResolution,
+		runCommand: async (command, args, options) => {
+			runCalls.push([command, ...args, options.cwd].join(" "));
+		},
+	});
+
+	assert.deepEqual(runCalls, []);
+	assert.deepEqual(result, missingResolution);
+});
+
+test("#given non-Windows platform #when preparing #then winget is never called", async () => {
+	const runCalls = [];
+	const result = await prepareGitBashForInstall({
+		platform: "linux",
+		env: {},
+		cwd: "/repo",
+		runCommand: async (command, args, options) => {
+			runCalls.push([command, ...args, options.cwd].join(" "));
+		},
+	});
+
+	assert.deepEqual(runCalls, []);
+	assert.deepEqual(result, { found: true, path: null, source: "not-required" });
+});
+
+test("#given Windows without Git Bash and winget fails #when preparing #then original install hint is preserved", async () => {
+	const missingResolution = {
+		found: false,
+		checkedPaths: [programFilesGitBash, programFilesX86GitBash],
+		installHint: "install hint",
+	};
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: {},
+		cwd: "C:\\repo",
+		resolveGitBash: () => missingResolution,
+		runCommand: async () => {
+			throw new Error("winget unavailable");
+		},
+	});
+
+	assert.deepEqual(result, missingResolution);
+});
+
+test("#given Windows without Git Bash and winget succeeds but bash is still missing #when preparing #then install hint remains", async () => {
+	const missingResolution = {
+		found: false,
+		checkedPaths: [programFilesGitBash, programFilesX86GitBash],
+		installHint: "install hint",
+	};
+	let resolveCallCount = 0;
+
+	const result = await prepareGitBashForInstall({
+		platform: "win32",
+		env: {},
+		cwd: "C:\\repo",
+		resolveGitBash: () => {
+			resolveCallCount += 1;
+			return missingResolution;
+		},
+		runCommand: async () => {},
+	});
+
+	assert.equal(resolveCallCount, 2);
+	assert.deepEqual(result, missingResolution);
+});

package/packages/omo-codex/scripts/install/legacy-bins.mjs

@@ -5,6 +5,7 @@ import { COMMAND_SHIM_MARKER } from "./command-shim.mjs";
 
 const LEGACY_CODEX_COMPONENT_BINS = [
 	{ name: "codex-comment-checker", component: "comment-checker" },
+	{ name: "codex-lsp", component: "lsp" },
 	{ name: "codex-rules", component: "rules" },
 	{ name: "codex-start-work-continuation", component: "start-work-continuation" },
 	{ name: "codex-telemetry", component: "telemetry" },

package/packages/omo-codex/scripts/install/mcp-runtime-cache.mjs

@@ -40,7 +40,7 @@ function resolveExternalMcpPackageRoot(runtimePath, sourceRoot) {
 	if (!isPathInside(runtimePath, packagesRoot)) return undefined;
 	let packageRoot = dirname(runtimePath);
 	while (packageRoot !== packagesRoot) {
-		if (existsSync(join(packageRoot, "package.json")) && isPathInside(runtimePath, join(packageRoot, "dist"))) {
+		if (isPathInside(runtimePath, join(packageRoot, "dist")) && isRuntimePackageRoot(packageRoot)) {
 			return packageRoot;
 		}
 		const parent = dirname(packageRoot);
@@ -50,6 +50,10 @@ function resolveExternalMcpPackageRoot(runtimePath, sourceRoot) {
 	return undefined;
 }
 
+function isRuntimePackageRoot(packageRoot) {
+	return existsSync(join(packageRoot, "package.json")) || existsSync(join(packageRoot, "dist"));
+}
+
 function findPackagesRoot(path) {
 	let current = resolve(path);
 	for (let index = 0; index < 8; index++) {

package/packages/omo-codex/scripts/install/model-catalog.mjs

@@ -0,0 +1,66 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+const FALLBACK_CODEX_MODEL_CATALOG = {
+	current: {
+		model: "gpt-5.5",
+		modelContextWindow: 400_000,
+		modelReasoningEffort: "high",
+		planModeReasoningEffort: "xhigh",
+	},
+	managedProfiles: [{ model: "gpt-5.2" }],
+};
+
+export async function readCodexModelCatalog(codexPackageRoot) {
+	try {
+		const parsed = JSON.parse(await readFile(join(codexPackageRoot, "plugin", "model-catalog.json"), "utf8"));
+		return parseCodexModelCatalog(parsed) ?? FALLBACK_CODEX_MODEL_CATALOG;
+	} catch (error) {
+		if (!(error instanceof Error)) throw error;
+		return FALLBACK_CODEX_MODEL_CATALOG;
+	}
+}
+
+export async function readCodexReasoningProfile(codexPackageRoot) {
+	return (await readCodexModelCatalog(codexPackageRoot)).current;
+}
+
+function parseCodexModelCatalog(value) {
+	if (!isRecord(value) || !isRecord(value.current) || !Array.isArray(value.managedProfiles)) return null;
+	const { current } = value;
+	if (
+		typeof current.model !== "string" ||
+		typeof current.model_context_window !== "number" ||
+		typeof current.model_reasoning_effort !== "string" ||
+		typeof current.plan_mode_reasoning_effort !== "string"
+	) {
+		return null;
+	}
+	const managedProfiles = [];
+	for (const profile of value.managedProfiles) {
+		if (!isRecord(profile) || !isRecord(profile.match)) return null;
+		managedProfiles.push(parseProfileMatch(profile.match));
+	}
+	return {
+		current: {
+			model: current.model,
+			modelContextWindow: current.model_context_window,
+			modelReasoningEffort: current.model_reasoning_effort,
+			planModeReasoningEffort: current.plan_mode_reasoning_effort,
+		},
+		managedProfiles,
+	};
+}
+
+function parseProfileMatch(match) {
+	const profile = {};
+	if (typeof match.model === "string") profile.model = match.model;
+	if (typeof match.model_context_window === "number") profile.modelContextWindow = match.model_context_window;
+	if (typeof match.model_reasoning_effort === "string") profile.modelReasoningEffort = match.model_reasoning_effort;
+	if (typeof match.plan_mode_reasoning_effort === "string") profile.planModeReasoningEffort = match.plan_mode_reasoning_effort;
+	return profile;
+}
+
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/packages/omo-codex/scripts/install/multi-agent-v2-config.mjs

@@ -4,7 +4,7 @@ const CODEX_MULTI_AGENT_V2_HEADER = "features.multi_agent_v2";
 const CODEX_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION = 10000;
 
 export function ensureCodexMultiAgentV2Config(config) {
-	const normalizedConfig = removeFeatureFlagSetting(config, "multi_agent_v2");
+	const normalizedConfig = removeLegacyAgentsMaxThreadsSetting(removeFeatureFlagSetting(config, "multi_agent_v2"));
 	const section = findTomlSection(normalizedConfig, CODEX_MULTI_AGENT_V2_HEADER);
 	const maxThreadsValue = CODEX_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION.toString();
 	if (!section) {
@@ -30,3 +30,9 @@ function removeFeatureFlagSetting(config, featureName) {
 	if (!section) return config;
 	return removeSetting(config, section, featureName);
 }
+
+function removeLegacyAgentsMaxThreadsSetting(config) {
+	const section = findTomlSection(config, "agents");
+	if (!section) return config;
+	return removeSetting(config, section, "max_threads");
+}

package/packages/omo-codex/scripts/install/permissions.d.mts

@@ -0,0 +1 @@
+export function ensureAutonomousPermissions(config: string): string;

package/packages/omo-codex/scripts/install/permissions.mjs

@@ -0,0 +1,26 @@
+import { appendBlock, findTomlSection, removeSetting, replaceOrInsertRootSetting, replaceOrInsertSetting } from "./toml-editor.mjs";
+
+export function ensureAutonomousPermissions(config) {
+	let next = replaceOrInsertRootSetting(config, "approval_policy", JSON.stringify("never"));
+	next = replaceOrInsertRootSetting(next, "sandbox_mode", JSON.stringify("danger-full-access"));
+	next = replaceOrInsertRootSetting(next, "network_access", JSON.stringify("enabled"));
+	next = removeWindowsSandboxSetting(next);
+	next = ensureNoticeEnabled(next, "hide_full_access_warning");
+	return ensureNoticeEnabled(next, "hide_world_writable_warning");
+}
+
+function removeWindowsSandboxSetting(config) {
+	const section = findTomlSection(config, "windows");
+	if (!section) return config;
+	return removeSetting(config, section, "sandbox");
+}
+
+function ensureNoticeEnabled(config, key) {
+	const section = findTomlSection(config, "notice");
+	if (!section) return appendNoticeBlock(config, key);
+	return replaceOrInsertSetting(config, section, key, "true");
+}
+
+function appendNoticeBlock(config, key) {
+	return appendBlock(config, `[notice]\n${key} = true\n`);
+}