Fix CVE-2025-66414 and reduce CLI method complexity

[Copilot]

CodeFactor flagged vulnerable @modelcontextprotocol/sdk dependency and three complex methods in src/cli/index.ts exceeding maintainability thresholds.

Changes

Security

• Update @modelcontextprotocol/sdk 1.20.1 → 1.26.0 (fixes CVE-2025-66414)

Refactoring

Extract helper functions into dedicated modules to reduce method complexity:

src/cli/hive-mind-helpers.ts - orchestration lifecycle

• executeGoapWorkflow() - GOAP execution
• executeTaskWithConsensus() - task dispatch with timeout/voting
• collectExecutionResults() - aggregate system metrics
• renderExecutionSummary() - formatted output
• setupWorkflowEventHandlers() - event subscription management

src/cli/doctor-helpers.ts - health checks

• checkCliBuildArtifact(), checkCliExecution(), checkCodexAuth() - validation
• renderHealthCheckResults() - diagnostic output

Type safety

• Add ExecutionResultData interface replacing any types
• JSDoc annotations on all exported functions

Example

Before (364-line monolithic handler):

.action(handleCommand('hive-mind.spawn', async (promptParts: string[], options) => {
  // 364 lines of GOAP setup, context building, orchestration, consensus, rendering...
}));

After (28-line orchestrator):

.action(handleCommand('hive-mind.spawn', async (promptParts: string[], options) => {
  // GOAP path
  if (strategy === 'goap') {
    await executeGoapWorkflow(system, manifest, goalId, originalPrompt, dryRun);
    return;
  }
  
  // Classic orchestration
  const { outcome, consensusResult, totalTime } = await executeTaskWithConsensus(/*...*/);
  const resultData = collectExecutionResults(/*...*/);
  await renderExecutionSummary(resultData, options);
}));

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.openai.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/codex-synaptic/codex-synaptic/dist/cli/index.js openai usage --json .mjs sh node_modules/.bin/node npm run build node n/node node n/ts�� run build k/codex-synaptic/codex-synaptic/node_modules/.bin/sh tsc && node scricodex node es/.bin/sh sh (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.