@inetafrica/open-claudia 3.4.5 → 3.4.7

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## v3.4.7 — Keep scheduled follow-ups queued while the chat is busy
+
+- Scheduler: busy chats keep wakeups queued without consuming execution retries. Watch triggers and expiries are saved once, survive restart, and stop polling while delivery is pending. Concurrent callbacks cannot start overlapping runs; advisory notifications are attempted once per occurrence. Real execution failures retain bounded retries.
+
+## v3.4.6 — Codex runs again: the gate stopped asking for the impossible
+
+- **Every Codex turn since Codex CLI 0.153.x failed with `OpenAI Codex is incompatible: Codex rejected the isolated PreToolUse configuration or could not disable uncovered tool transports`.** The mandatory tool-hook gate ran `codex features list` with our overrides and required `unified_exec` to read `false`. Codex 0.153.2, 0.153.3 and 0.153.4 all ignore `-c features.unified_exec=false` (the feature is locked on and `codex features list` reports `unified_exec stable true` regardless), so the gate refused the provider on every turn — the failure Sumeet hit right after switching to gpt-6-astra on 3.4.5.
+- **Why it is safe to stop requiring it off.** Probed live on 0.153.4 (2026-09-05): a shell command run through unified exec still arrives at the PreToolUse hook as tool_name `Bash` with `tool_input.command`, and the real deny gate caught the probe command (deny audited, marker file never written). Unified exec is a covered transport, not an uncovered one. Plugins stay forced off and hooks stay forced on; project trust stays untrusted.
+- **What changed.** `core/providers/codex-hook.js` no longer emits the `features.unified_exec=false` override nor checks its state. Fixtures and the tool-hook tests now model Codex as it is (`unified_exec stable true`) and assert no unified_exec override is generated. Fleet pods are affected identically (the 3.4.4 and 3.4.5 images carry Codex 0.153.x), so Codex on pods works only from this release onward.
+
 ## v3.4.5 — Astra on the picker, two shortcuts fewer
 
 - **gpt-6-astra is offered by the codex provider.** OpenAI rolled GPT-6 (Astra) out to ChatGPT-plan Codex accounts on 2026-09-05 — the earlier 400 (`not supported when using Codex with a ChatGPT account`) was a staged rollout, not client staleness. It sits first in `CODEX_MODELS`, so it appears as a `/model` button; the typed form `/model gpt-6-astra` already worked because the typed path never validated against the list. The default model is unchanged (`gpt-5.6-sol` unless `CODEX_MODEL` is set).

package/core/providers/codex-hook.js

@@ -38,7 +38,12 @@ function buildCodexHookOverrides({ cwd, nodePath, cliPath } = {}) {
   return Object.freeze({
     featuresHooks: "features.hooks=true",
     featuresPlugins: "features.plugins=false",
-    featuresUnifiedExec: "features.unified_exec=false",
+    // unified_exec is deliberately NOT forced off. Probed live 2026-09-05 on
+    // Codex 0.153.4 (0.153.2 and 0.153.3 behave the same): `-c
+    // features.unified_exec=false` is silently ignored — the feature is locked
+    // on — while unified-exec shell calls still reach PreToolUse as tool_name
+    // "Bash" (the deny gate observed the probe command, marker not executed).
+    // Requiring it off made every Codex turn fail MANDATORY_TOOL_HOOK_UNAVAILABLE.
     // A path is a dynamic TOML map key. Current Codex `-c` parsing rejects a
     // quoted path inside dotted-key notation, so replace the isolated projects
     // table with one explicit inline table (user config is ignored below).
@@ -58,7 +63,6 @@ function hookArgs(overrides) {
     "--strict-config",
     "-c", overrides.featuresHooks,
     "-c", overrides.featuresPlugins,
-    "-c", overrides.featuresUnifiedExec,
     "-c", overrides.projectTrust,
     "-c", overrides.preToolUse,
     "--dangerously-bypass-hook-trust",
@@ -150,15 +154,13 @@ function checkCodexHookCompatibility({ binary, runCommand, env, cwd, prepared =
       "features",
       "-c", o.featuresHooks,
       "-c", o.featuresPlugins,
-      "-c", o.featuresUnifiedExec,
       "-c", o.projectTrust,
       "-c", o.preToolUse,
       "list",
     ], opts);
     const configured = features.ok
       && featureState(features.output, "hooks", true)
-      && featureState(features.output, "plugins", false)
-      && featureState(features.output, "unified_exec", false);
+      && featureState(features.output, "plugins", false);
     result = configured
       ? { ok: true, code: null, reason: null }
       : {

package/core/scheduler.js

@@ -120,6 +120,7 @@ function createSchedulerService(dependencies = {}) {
   const admit = dependencies.admitRunContext || ((...args) => require("./runner").admitRunContext(...args));
   const timers = new Map();
   const checksInFlight = new Set();
+  const firesInFlight = new Set();
   // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
   // agent; non-zero → still idle, skip silently. Runs in the job's project
   // dir with the process env, output discarded (exit code is the contract),
@@ -344,18 +345,15 @@ function createSchedulerService(dependencies = {}) {
   function markBusy(job) {
     const latest = jobsStore.get(job.id) || job;
     const busyDeferralCount = (latest.busyDeferralCount || 0) + 1;
-    const dead = busyDeferralCount >= (latest.maxAttempts || 1);
     const patch = {
-      status: dead ? "dead-letter" : "deferred",
-      disabled: dead,
+      status: "deferred",
+      disabled: false,
       busyDeferralCount,
-      nextAttemptAt: dead ? null : now() + busyDelayMs,
-      lastError: dead ? { code: "SCHEDULED_BUSY_EXHAUSTED", message: "Channel remained busy through every bounded deferral" } : null,
+      nextAttemptAt: now() + busyDelayMs,
     };
     const updated = jobsStore.update(job.id, patch) || { ...latest, ...patch };
-    if (!dead) armRetry(updated, busyDelayMs);
-    else unscheduleJob(job.id);
-    return { ok: false, deferred: !dead, status: updated.status, job: updated };
+    armRetry(updated, busyDelayMs);
+    return { ok: false, deferred: true, status: updated.status, job: updated };
   }
 
   async function settleSuccess(job, result, target) {
@@ -396,6 +394,10 @@ function createSchedulerService(dependencies = {}) {
       attemptCount: 0,
       busyDeferralCount: 0,
       nextAttemptAt: null,
+      watchTriggeredOccurrenceId: null,
+      watchTriggeredAt: null,
+      watchExpired: false,
+      advisoryOccurrenceId: null,
     });
     if (reset && timers.get(job.id)?.timeout) scheduleJob(reset);
     return reset
@@ -404,6 +406,14 @@ function createSchedulerService(dependencies = {}) {
   }
 
   async function fireJob(idOrJob, options = {}) {
+    const id = typeof idOrJob === "string" ? idOrJob : idOrJob?.id;
+    if (firesInFlight.has(id)) return { ok: false, status: "running", skipped: true, inFlight: true };
+    firesInFlight.add(id);
+    try { return await executeJob(idOrJob, options); }
+    finally { firesInFlight.delete(id); }
+  }
+
+  async function executeJob(idOrJob, options = {}) {
     const requested = typeof idOrJob === "string" ? jobsStore.get(idOrJob) : idOrJob;
     let job = requested?.id && jobsStore.get(requested.id) ? jobsStore.get(requested.id) : requested;
     if (!job) return { ok: false, status: "missing" };
@@ -423,7 +433,7 @@ function createSchedulerService(dependencies = {}) {
     // runs the check and only wakes the agent when it exits 0. A non-zero exit
     // is the normal idle case: skip silently, mark nothing, leave the job
     // pending so the next tick polls again. Never marks failure; never chats.
-    if (job.check) {
+    if (job.check && job.watchTriggeredOccurrenceId !== job.occurrenceId) {
       if (!watchesEnabled()) {
         logWatch(job, "skipped (watches disabled globally)");
         return { ok: false, status: "watch-disabled", skipped: true };
@@ -443,27 +453,30 @@ function createSchedulerService(dependencies = {}) {
           logWatch(job, check && check.timedOut ? "idle (check timed out)" : `idle (check exit ${check ? check.code : "?"})`);
           return { ok: false, status: "watch-idle", skipped: true };
         }
-        logWatch(job, `expired without firing (check exit ${check ? check.code : "?"}) — waking agent`);
         // Expiry ends the watch's window: one-shot removal even for --repeat
         // (the woken agent re-arms if still wanted). Persisted so a retry of a
         // failed expiry fire keeps the same semantics across restarts.
-        try {
-          const marked = jobsStore.update(job.id, { repeat: false, watchExpired: true });
-          if (marked) job = marked;
-          else { job.repeat = false; job.watchExpired = true; }
-        } catch (_) { job.repeat = false; job.watchExpired = true; }
+        job = { ...job, repeat: false, watchExpired: true };
       } else {
-        logWatch(job, "triggered (check passed) — waking agent");
-        if (job.watchExpired) {
-          // A prior expiry fire failed and the condition came true before the
-          // retry: report it as a real trigger, not an expiry.
-          try {
-            const cleared = jobsStore.update(job.id, { watchExpired: false });
-            if (cleared) job = cleared;
-            else job.watchExpired = false;
-          } catch (_) { job.watchExpired = false; }
-        }
+        job = { ...job, watchExpired: false };
       }
+      // Latch the condition before admission or notification. Delivery retries
+      // and restarts must not run the check again or change an expiry's meaning.
+      try {
+        const marked = jobsStore.update(job.id, {
+          status: "deferred",
+          nextAttemptAt: now(),
+          repeat: job.repeat,
+          watchExpired: job.watchExpired,
+          watchTriggeredOccurrenceId: job.occurrenceId,
+          watchTriggeredAt: now(),
+        });
+        if (!marked) throw new Error("watch trigger could not be persisted");
+        job = marked;
+      } catch (error) {
+        return { ok: false, status: "failed", error: stableFailure(error) };
+      }
+      logWatch(job, job.watchExpired ? "expired without firing — delivery queued" : "triggered (check passed) — delivery queued");
     }
 
     const adapter = resolveAdapter(job);
@@ -557,7 +570,14 @@ function createSchedulerService(dependencies = {}) {
         : target.fallbackFrom
           ? `\n⚠️ ${target.fallbackFrom} is unavailable — running on fallback ${target.provider}.`
           : "";
-      try { await send(`${advisory}${providerNote}`); } catch (_) { /* advisory only */ }
+      if (job.advisoryOccurrenceId !== job.occurrenceId) {
+        // At-most-once advisory: persist before sending so a restart cannot
+        // repeat it. A crash between these steps may omit this optional notice.
+        try {
+          if (!jobsStore.update(job.id, { advisoryOccurrenceId: job.occurrenceId })) throw new Error("advisory marker could not be persisted");
+          await send(`${advisory}${providerNote}`);
+        } catch (_) { /* advisory only */ }
+      }
       let result;
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {

package/docs/PROVIDER_MIGRATION.md

@@ -64,4 +64,8 @@ The pointer, provider-tagged history lineage, and tuple-scoped usage checkpoint
 
 Scheduled work uses a versioned `{schemaVersion, jobs, archived}` document. Every runnable occurrence stores its canonical user, channel, project, provider, provider-settings snapshot, native session lineage, origin run, and stable occurrence ID. A fresh foreground turn can create a job before its native session is known; terminal session persistence binds that job by origin run ID. Compaction descendants are followed only when recorded lineage proves the relationship, and an older scheduled branch cannot replace an unrelated live session pointer.
 
-Wakeups and crons wait for terminal provider completion, transcript/usage/session persistence, and required delivery. A one-shot receives a durable success marker before deletion. Busy or failed occurrences retain their occurrence ID and bounded attempt state across restart; exhaustion and wakeups outside the missed-fire grace window remain visible as disabled dead letters. Provider fallback is empty by default. When `PROVIDER_FALLBACKS` is explicitly configured, a fallback starts a fresh provider session with an archived provider-neutral brief and never receives another provider's native session ID. Legacy `crons.json` remains byte-for-byte untouched after its ambiguous records are copied into the disabled archive.
+Wakeups and crons wait for terminal provider completion, transcript/usage/session persistence, and required delivery. A one-shot receives a durable success marker before deletion. Busy occurrences retain their occurrence ID across restart and wait until the chat is idle, without consuming execution attempts or expiring under the missed-fire grace window. Genuine execution failures still have bounded retries; exhaustion and wakeups never admitted within the missed-fire grace window remain visible as disabled dead letters.
+
+A watch persists its trigger (or expiry) before delivery and does not poll its check again while that occurrence is pending. Repeat watches resume polling only after successful delivery advances the occurrence. An in-process guard prevents overlapping callbacks from starting the same occurrence, even when a run lasts longer than its retry delay. Advisory notifications are marked before sending and attempted at most once per occurrence across retries/restarts; a crash between marking and sending can omit this optional notice. An interrupted provider run may still retry with the same occurrence ID if no durable success marker exists; this is not an exactly-once guarantee for external side effects. Previously dead-lettered jobs are not automatically revived because their queued actions may now be stale.
+
+Provider fallback is empty by default. When `PROVIDER_FALLBACKS` is explicitly configured, a fallback starts a fresh provider session with an archived provider-neutral brief and never receives another provider's native session ID. Legacy `crons.json` remains byte-for-byte untouched after its ambiguous records are copied into the disabled archive.

package/docs/permissions-audit-2026-07.md

@@ -246,7 +246,9 @@ Verified-OK pathways (no change needed): scheduler re-runs stamp
 `OC_CHANNEL_USER_ID` (file gate stays live on approved external re-runs);
 Spaces turns flow through the common router (triage covered); sub-agents
 spawn read-only and inherit channel env; codex transport confinement
-(hooks on, plugins/unified_exec off, untrusted trust) is mandatory-or-refuse.
+(hooks on, plugins off, untrusted trust) is mandatory-or-refuse. unified_exec is
+no longer forced off (2026-09-05): Codex 0.153.x locks it on and its shell calls
+still reach the PreToolUse hook as "Bash".
 
 G3 closed with P3 (test-approval-cards.js pins the `apr:` handler). `tool run`
 remains the one authorised channel reachable on external turns — by design:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.5",
+  "version": "3.4.7",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-fixtures/fake-agent-cli.js

@@ -143,7 +143,7 @@ function handleCompatibilityCommand() {
     process.stdout.write([
       `hooks stable ${overrides.includes("features.hooks=true")}`,
       `plugins stable ${!overrides.includes("features.plugins=false")}`,
-      `unified_exec stable ${!overrides.includes("features.unified_exec=false")}`,
+      "unified_exec stable true",
     ].join("\n") + "\n");
     return true;
   }
@@ -160,7 +160,6 @@ function runHookProbe() {
     && !argv.includes("--profile")
     && overrides.includes("features.hooks=true")
     && overrides.includes("features.plugins=false")
-    && overrides.includes("features.unified_exec=false")
     && overrides.some((value) => /^projects=\{.+trust_level="untrusted".+\}$/.test(value))
     && hookOverrides.length === 1
     && /matcher\s*=\s*"\^\(Bash\|apply_patch\)\$"/.test(hookOverrides[0]);

package/test-provider-boot-matrix.js

@@ -34,7 +34,7 @@ if (same("--version")) {
     ? "--config --json --sandbox --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n"
     : "--config --json --sandbox --image --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n")});
 } else if (${JSON.stringify(kind)} === "codex" && args[0] === "features" && args.at(-1) === "list") {
-  process.stdout.write("hooks stable true\\nplugins stable false\\nunified_exec stable false\\n");
+  process.stdout.write("hooks stable true\\nplugins stable false\\nunified_exec stable true\\n");
 } else if (${JSON.stringify(kind)} === "codex" && same("login", "status")) {
   if (${JSON.stringify(mode)} === "unauthenticated") {
     process.stderr.write("not logged in\\n");

package/test-provider-language.js

@@ -456,7 +456,15 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // joins CODEX_MODELS first; the /claude and /codex shortcuts go — /backend and
 // the /model picker already switch providers; Codex CLI bumped to 0.153.4 on
 // the operator host and the image (unpinned install) picks it up at build.
-assert.strictEqual(pkg.version, "3.4.5", "release version must remain unchanged without explicit approval");
+// 3.4.6 prepared 2026-09-05 after Sumeet sent a screenshot of the first Codex
+// turn on 3.4.5 failing ("Codex rejected the isolated PreToolUse configuration
+// or could not disable uncovered tool transports"): Codex 0.153.x ignores
+// `-c features.unified_exec=false` (locked on), so the hook gate refused every
+// Codex turn. Live probe: unified-exec shell calls still reach PreToolUse as
+// tool_name "Bash" and the deny gate caught the probe, so the gate no longer
+// requires unified_exec off. Push approved by Sumeet before release.
+// 3.4.7: owner approved scheduler fix and push on 2026-09-05.
+assert.strictEqual(pkg.version, "3.4.7", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-scheduler.js

@@ -633,6 +633,88 @@ async function busyRestartAndMissedProbe(createSchedulerService) {
   assert.strictEqual(missedTimers.length, 1, "a missed wakeup gets exactly one startup attempt");
 }
 
+async function durablePendingProbe(createSchedulerService, jobsApi) {
+  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), "oc-pending-restart-"));
+  let clock = 1_720_000_000_500;
+  const openStore = () => jobsApi.createJobsStore({ configDir, jobsFile: path.join(configDir, "jobs.json"), now: () => clock });
+  const success = { ok: true, status: "succeeded", delivery: { ok: true } };
+  try {
+    for (const kind of ["wakeup", "watch", "expiry"]) {
+      const store = openStore();
+      store.add(baseJob({ id: kind, ...(kind === "wakeup" ? {} : {
+        kind: "cron", schedule: "* * * * *", check: "fixture-check", repeat: true,
+        expiresAt: kind === "expiry" ? clock - 1 : clock + 1000,
+      }) }));
+      let checks = 0;
+      const h = schedulerHarness(createSchedulerService, [], {
+        jobsStore: store, now: () => clock,
+        runWatchCheck: async () => { checks++; return { code: kind === "expiry" ? 1 : 0 }; },
+      });
+      h.state.runningProcess = { pid: 1 };
+      for (let tick = 0; tick < 12; tick++) {
+        clock += 60 * 60 * 1000;
+        const result = await h.service.fireJob(kind);
+        assert.strictEqual(result.deferred, true, "hours of busy time must remain queued");
+      }
+      assert.strictEqual(store.get(kind).attemptCount, 0);
+      assert.strictEqual(store.get(kind).disabled, false);
+      assert.strictEqual(checks, kind === "wakeup" ? 0 : 1);
+      assert.strictEqual(h.sends.length, 0);
+      h.service.stopAll();
+
+      // Reopen the real on-disk store and construct a new scheduler, as boot does.
+      const reloaded = openStore();
+      const terminal = deferred();
+      const restarted = schedulerHarness(createSchedulerService, [], {
+        jobsStore: reloaded, now: () => clock, outcomes: [terminal.promise, success],
+        runWatchCheck: async () => { throw new Error("pending watch must not poll after restart"); },
+      });
+      restarted.service.init();
+      const firing = restarted.scheduled[0].fn();
+      await nextTurn();
+      clock += 60 * 60 * 1000;
+      assert.strictEqual((await restarted.service.fireJob(kind)).inFlight, true, "long runs cannot re-enter after retry delay");
+      assert.strictEqual(restarted.runCalls.length, 1);
+      assert.strictEqual(restarted.sends.length, 1);
+      if (kind === "expiry") assert.match(restarted.runCalls[0].prompt, /Watch expired/);
+      terminal.resolve(success);
+      await firing;
+      if (kind === "watch") {
+        assert.strictEqual(reloaded.get(kind).status, "pending");
+        assert.strictEqual(reloaded.get(kind).watchTriggeredOccurrenceId, null);
+        restarted.service.removeJob(kind);
+      } else assert.strictEqual(reloaded.get(kind), null);
+      restarted.service.stopAll();
+      const finalBoot = schedulerHarness(createSchedulerService, [], { jobsStore: openStore(), now: () => clock });
+      finalBoot.service.init();
+      assert.strictEqual(finalBoot.scheduled.length, 0, "successful one-shot cannot replay on restart");
+    }
+
+    const store = openStore();
+    store.add(baseJob({ id: "failure", kind: "cron", schedule: "* * * * *", check: "fixture" }));
+    const failed = schedulerHarness(createSchedulerService, [], {
+      jobsStore: store, now: () => clock,
+      runWatchCheck: async () => ({ code: 0 }), outcomes: [{ ok: false, error: { code: "FIXTURE_FAILED" } }],
+    });
+    await failed.service.fireJob("failure");
+    failed.service.stopAll();
+    clock += 2000;
+    const retry = schedulerHarness(createSchedulerService, [], {
+      jobsStore: openStore(), now: () => clock,
+      runWatchCheck: async () => { throw new Error("do not recheck"); },
+      outcomes: [{ ok: false }, { ok: false }],
+    });
+    await retry.service.fireJob("failure");
+    await retry.service.fireJob("failure");
+    assert.strictEqual(retry.jobsStore.get("failure").status, "dead-letter", "real failures retain bounded retries");
+    assert.strictEqual(retry.jobsStore.get("failure").attemptCount, 3);
+    assert.strictEqual(retry.sends.length, 0, "advisory is not repeated across failure/restart");
+    retry.service.stopAll();
+  } finally {
+    fs.rmSync(configDir, { recursive: true, force: true });
+  }
+}
+
 async function unavailableAndFallbackProbe(createSchedulerService) {
   const noFallback = schedulerHarness(createSchedulerService, [baseJob({ id: "unavailable" })], {
     providerStatus: () => ({ availability: { state: "missing" }, auth: { state: "not_checked" } }),
@@ -960,6 +1042,7 @@ async function main() {
   await failureAndRetryProbe(schedulerApi.createSchedulerService);
   await detachedHistoricalBranchProbe(schedulerApi.createSchedulerService);
   await busyRestartAndMissedProbe(schedulerApi.createSchedulerService);
+  await durablePendingProbe(schedulerApi.createSchedulerService, jobsApi);
   await unavailableAndFallbackProbe(schedulerApi.createSchedulerService);
   await cronOccurrenceProbe(schedulerApi.createSchedulerService);
   await watchGateProbe(schedulerApi.createSchedulerService);

package/test-provider-tool-hooks.js

@@ -59,7 +59,7 @@ function compatibleCodexCommand(_binary, args) {
       output: [
         "hooks stable true",
         "plugins stable false",
-        "unified_exec stable false",
+        "unified_exec stable true",
       ].join("\n"),
       code: 0,
     };
@@ -137,12 +137,15 @@ try {
   assert.ok(defaultClaudeInvocation.args.includes("--settings"), "Claude factories enforce the generated hook by default");
 
   // Codex uses only transient, generated CLI overrides. User config is ignored,
-  // the current project is explicitly untrusted, plugin hooks and unified_exec
-  // are disabled, and hook trust is bypassed only after exact verification.
+  // the current project is explicitly untrusted, plugin hooks are disabled, and
+  // hook trust is bypassed only after exact verification. unified_exec is NOT
+  // forced off: Codex 0.153.x ignores the override (locked on) and its shell
+  // calls still arrive as tool_name "Bash" (probed live 2026-09-05).
   const overrides = buildCodexHookOverrides({ cwd: projectDir });
   assert.strictEqual(overrides.featuresHooks, "features.hooks=true");
   assert.strictEqual(overrides.featuresPlugins, "features.plugins=false");
-  assert.strictEqual(overrides.featuresUnifiedExec, "features.unified_exec=false");
+  assert.strictEqual(overrides.featuresUnifiedExec, undefined, "unified_exec is no longer forced off (Codex ignores it)");
+  assert.ok(!Object.values(overrides).some((value) => String(value).includes("unified_exec")), "no unified_exec override is generated");
   assert.match(overrides.projectTrust, /^projects=\{.+trust_level="untrusted".+\}$/);
   assert.match(overrides.preToolUse, /^hooks\.PreToolUse=/);
   assert.match(overrides.preToolUse, /deny-gate-hook/);
@@ -158,6 +161,7 @@ try {
   assert.ok(prepared.args.includes("--ignore-user-config"));
   assert.ok(prepared.args.includes("--strict-config"));
   assert.ok(prepared.args.includes("--dangerously-bypass-hook-trust"));
+  assert.ok(!prepared.args.some((value) => String(value).includes("features.unified_exec")), "argv carries no unified_exec override");
   assert.ok(!prepared.args.includes("--profile"), "a merging Codex profile is never trusted");
   const tampered = Object.freeze({ ...prepared, args: Object.freeze([...prepared.args, "--profile", "project-hooks"]) });
   assert.strictEqual(verifyPreparedCodexHook(tampered), false, "trust bypass rejects non-generated argv");