lazycodex-ai 5.0.0-beta.49 → 5.0.0-beta.50

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/dist/cli.js

@@ -74,7 +74,8 @@ function runSubagentStopHook(input, fs) {
     return "";
   if (transcriptHasContextPressureMarker(input.transcript_path, fs))
     return "";
-  if (hasValidEvidenceReceipt(input, fs)) {
+  const receiptFailure = getEvidenceReceiptFailure(input, fs);
+  if (receiptFailure === null) {
     clearAttemptState(input.cwd, input.session_id, input.agent_id, fs);
     return "";
   }
@@ -87,7 +88,9 @@ function runSubagentStopHook(input, fs) {
   writeAttemptState(input.cwd, input.session_id, input.agent_id, { attempts }, fs);
   return JSON.stringify({
     decision: "block",
-    reason: renderDirective(attempts, input.last_assistant_message)
+    reason: `Evidence receipt rejected: ${receiptFailure}.
+
+${renderDirective(attempts, input.last_assistant_message)}`
   });
 }
 var CONTEXT_PRESSURE_MARKERS = [
@@ -109,19 +112,19 @@ function transcriptHasContextPressureMarker(transcriptPath, fs) {
     throw error;
   }
 }
-function hasValidEvidenceReceipt(input, fs) {
+function getEvidenceReceiptFailure(input, fs) {
   const receiptPath = extractEvidencePath(input.last_assistant_message);
   if (receiptPath === null)
-    return false;
+    return "invalid";
   const evidenceRoot = resolve(input.cwd, ".omo", "evidence");
   const resolvedPath = isAbsolute(receiptPath) ? resolve(receiptPath) : resolve(input.cwd, receiptPath);
   if (!isPathInsideDirectory(resolvedPath, evidenceRoot))
-    return false;
+    return "invalid";
   try {
-    return isNonEmptyFileInsideEvidenceRoot(resolvedPath, evidenceRoot, input.cwd, fs);
+    return getEvidenceFileFailure(resolvedPath, evidenceRoot, input, fs);
   } catch (error) {
     if (error instanceof Error)
-      return false;
+      return "invalid";
     throw error;
   }
 }
@@ -129,28 +132,36 @@ function isPathInsideDirectory(filePath, directoryPath) {
   const relativePath = relative(directoryPath, filePath);
   return relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath);
 }
-function isNonEmptyFileInsideEvidenceRoot(filePath, evidenceRoot, cwd, fs) {
+function getEvidenceFileFailure(filePath, evidenceRoot, input, fs) {
   if (!fs.existsSync(filePath))
-    return false;
-  const realCwd = realPath(cwd, fs);
+    return "invalid";
+  const realCwd = realPath(input.cwd, fs);
   const realEvidenceRoot = realPath(evidenceRoot, fs);
   const realFilePath = realPath(filePath, fs);
   if (!isPathInsideDirectory(realEvidenceRoot, realCwd))
-    return false;
+    return "invalid";
   if (!isPathInsideDirectory(realFilePath, realEvidenceRoot))
-    return false;
-  return isNonEmptyFile(filePath, fs);
-}
-function isNonEmptyFile(filePath, fs) {
-  if (!fs.existsSync(filePath))
-    return false;
+    return "invalid";
   const linkStat = fs.lstatSync?.(filePath) ?? nodeLstatSync(filePath);
   if (linkStat.isSymbolicLink?.() === true)
-    return false;
+    return "invalid";
   const stat = fs.statSync(filePath);
-  if (stat.size <= 0)
-    return false;
-  return stat.isFile?.() ?? true;
+  if (stat.isFile?.() === false)
+    return "invalid";
+  if (stat.size <= 0 || fs.readFileSync(filePath, "utf8").trim().length < 40)
+    return "placeholder";
+  let transcriptStat;
+  try {
+    transcriptStat = fs.statSync(input.transcript_path);
+  } catch (error) {
+    if (error instanceof Error)
+      return null;
+    throw error;
+  }
+  const transcriptStart = transcriptStat.birthtimeMs ?? transcriptStat.ctimeMs;
+  if (transcriptStart !== undefined && (stat.mtimeMs === undefined || stat.mtimeMs < transcriptStart))
+    return "stale";
+  return null;
 }
 function realPath(path, fs) {
   return fs.realpathSync?.(path) ?? nodeRealpathSync(path);
@@ -211,13 +222,13 @@ function parseHookInput(raw) {
   }
 }
 function readStdin() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     let data = "";
     processStdin.setEncoding("utf8");
     processStdin.on("data", (chunk) => {
       data += chunk;
     });
-    processStdin.once("error", () => resolve2(data));
-    processStdin.once("end", () => resolve2(data));
+    processStdin.once("error", () => resolve(data));
+    processStdin.once("end", () => resolve(data));
   });
 }

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/dist/codex-hook.js

@@ -11,7 +11,8 @@ export function runSubagentStopHook(input, fs) {
         return "";
     if (transcriptHasContextPressureMarker(input.transcript_path, fs))
         return "";
-    if (hasValidEvidenceReceipt(input, fs)) {
+    const receiptFailure = getEvidenceReceiptFailure(input, fs);
+    if (receiptFailure === null) {
         clearAttemptState(input.cwd, input.session_id, input.agent_id, fs);
         return "";
     }
@@ -24,7 +25,7 @@ export function runSubagentStopHook(input, fs) {
     writeAttemptState(input.cwd, input.session_id, input.agent_id, { attempts }, fs);
     return JSON.stringify({
         decision: "block",
-        reason: renderDirective(attempts, input.last_assistant_message),
+        reason: `Evidence receipt rejected: ${receiptFailure}.\n\n${renderDirective(attempts, input.last_assistant_message)}`,
     });
 }
 const CONTEXT_PRESSURE_MARKERS = [
@@ -47,20 +48,20 @@ function transcriptHasContextPressureMarker(transcriptPath, fs) {
         throw error;
     }
 }
-function hasValidEvidenceReceipt(input, fs) {
+function getEvidenceReceiptFailure(input, fs) {
     const receiptPath = extractEvidencePath(input.last_assistant_message);
     if (receiptPath === null)
-        return false;
+        return "invalid";
     const evidenceRoot = resolve(input.cwd, ".omo", "evidence");
     const resolvedPath = isAbsolute(receiptPath) ? resolve(receiptPath) : resolve(input.cwd, receiptPath);
     if (!isPathInsideDirectory(resolvedPath, evidenceRoot))
-        return false;
+        return "invalid";
     try {
-        return isNonEmptyFileInsideEvidenceRoot(resolvedPath, evidenceRoot, input.cwd, fs);
+        return getEvidenceFileFailure(resolvedPath, evidenceRoot, input, fs);
     }
     catch (error) {
         if (error instanceof Error)
-            return false;
+            return "invalid";
         throw error;
     }
 }
@@ -68,28 +69,37 @@ function isPathInsideDirectory(filePath, directoryPath) {
     const relativePath = relative(directoryPath, filePath);
     return relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath);
 }
-function isNonEmptyFileInsideEvidenceRoot(filePath, evidenceRoot, cwd, fs) {
+function getEvidenceFileFailure(filePath, evidenceRoot, input, fs) {
     if (!fs.existsSync(filePath))
-        return false;
-    const realCwd = realPath(cwd, fs);
+        return "invalid";
+    const realCwd = realPath(input.cwd, fs);
     const realEvidenceRoot = realPath(evidenceRoot, fs);
     const realFilePath = realPath(filePath, fs);
     if (!isPathInsideDirectory(realEvidenceRoot, realCwd))
-        return false;
+        return "invalid";
     if (!isPathInsideDirectory(realFilePath, realEvidenceRoot))
-        return false;
-    return isNonEmptyFile(filePath, fs);
-}
-function isNonEmptyFile(filePath, fs) {
-    if (!fs.existsSync(filePath))
-        return false;
+        return "invalid";
     const linkStat = fs.lstatSync?.(filePath) ?? nodeLstatSync(filePath);
     if (linkStat.isSymbolicLink?.() === true)
-        return false;
+        return "invalid";
     const stat = fs.statSync(filePath);
-    if (stat.size <= 0)
-        return false;
-    return stat.isFile?.() ?? true;
+    if (stat.isFile?.() === false)
+        return "invalid";
+    if (stat.size <= 0 || fs.readFileSync(filePath, "utf8").trim().length < 40)
+        return "placeholder";
+    let transcriptStat;
+    try {
+        transcriptStat = fs.statSync(input.transcript_path);
+    }
+    catch (error) {
+        if (error instanceof Error)
+            return null;
+        throw error;
+    }
+    const transcriptStart = transcriptStat.birthtimeMs ?? transcriptStat.ctimeMs;
+    if (transcriptStart !== undefined && (stat.mtimeMs === undefined || stat.mtimeMs < transcriptStart))
+        return "stale";
+    return null;
 }
 function realPath(path, fs) {
     return fs.realpathSync?.(path) ?? nodeRealpathSync(path);

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/dist/types.d.ts

@@ -18,6 +18,9 @@ export type StopHookOutput = {
 };
 export type FileStat = {
     readonly size: number;
+    readonly mtimeMs?: number;
+    readonly birthtimeMs?: number;
+    readonly ctimeMs?: number;
     readonly isFile?: () => boolean;
     readonly isSymbolicLink?: () => boolean;
 };

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/components/lazycodex-executor-verify/dist/cli.js\" hook subagent-stop",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.49) Verifying LazyCodex Executor Evidence"
+						"statusMessage": "(OmO 5.0.0-beta.50) Verifying LazyCodex Executor Evidence"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-lazycodex-executor-verify",
-	"version": "5.0.0-beta.49",
+	"version": "5.0.0-beta.50",
 	"description": "Codex SubagentStop evidence verifier for LazyCodex executor completions.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/src/codex-hook.ts

@@ -3,16 +3,19 @@ import { isAbsolute, relative, resolve } from "node:path";
 
 import { renderDirective } from "./directive.js";
 import { clearAttemptState, MAX_ATTEMPTS, readAttemptState, writeAttemptState } from "./state.js";
-import type { HookFileSystem, StopHookOutput, SubagentStopInput } from "./types.js";
+import type { FileStat, HookFileSystem, StopHookOutput, SubagentStopInput } from "./types.js";
 import { SUBAGENT_STOP_EVENT } from "./types.js";
 
 const RECEIPT_ENFORCED_AGENTS = new Set(["lazycodex-worker-low", "lazycodex-worker-medium", "lazycodex-worker-high"]);
 
+type EvidenceReceiptFailure = "invalid" | "placeholder" | "stale" | null;
+
 export function runSubagentStopHook(input: unknown, fs: HookFileSystem): string {
 	if (!isSubagentStopInput(input)) return "";
 	if (!RECEIPT_ENFORCED_AGENTS.has(input.agent_type)) return "";
 	if (transcriptHasContextPressureMarker(input.transcript_path, fs)) return "";
-	if (hasValidEvidenceReceipt(input, fs)) {
+	const receiptFailure = getEvidenceReceiptFailure(input, fs);
+	if (receiptFailure === null) {
 		clearAttemptState(input.cwd, input.session_id, input.agent_id, fs);
 		return "";
 	}
@@ -25,7 +28,7 @@ export function runSubagentStopHook(input: unknown, fs: HookFileSystem): string
 	writeAttemptState(input.cwd, input.session_id, input.agent_id, { attempts }, fs);
 	return JSON.stringify({
 		decision: "block",
-		reason: renderDirective(attempts, input.last_assistant_message),
+		reason: `Evidence receipt rejected: ${receiptFailure}.\n\n${renderDirective(attempts, input.last_assistant_message)}`,
 	} satisfies StopHookOutput);
 }
 
@@ -49,16 +52,16 @@ function transcriptHasContextPressureMarker(transcriptPath: string, fs: HookFile
 	}
 }
 
-function hasValidEvidenceReceipt(input: SubagentStopInput, fs: HookFileSystem): boolean {
+function getEvidenceReceiptFailure(input: SubagentStopInput, fs: HookFileSystem): EvidenceReceiptFailure {
 	const receiptPath = extractEvidencePath(input.last_assistant_message);
-	if (receiptPath === null) return false;
+	if (receiptPath === null) return "invalid";
 	const evidenceRoot = resolve(input.cwd, ".omo", "evidence");
 	const resolvedPath = isAbsolute(receiptPath) ? resolve(receiptPath) : resolve(input.cwd, receiptPath);
-	if (!isPathInsideDirectory(resolvedPath, evidenceRoot)) return false;
+	if (!isPathInsideDirectory(resolvedPath, evidenceRoot)) return "invalid";
 	try {
-		return isNonEmptyFileInsideEvidenceRoot(resolvedPath, evidenceRoot, input.cwd, fs);
+		return getEvidenceFileFailure(resolvedPath, evidenceRoot, input, fs);
 	} catch (error) {
-		if (error instanceof Error) return false;
+		if (error instanceof Error) return "invalid";
 		throw error;
 	}
 }
@@ -68,28 +71,33 @@ function isPathInsideDirectory(filePath: string, directoryPath: string): boolean
 	return relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath);
 }
 
-function isNonEmptyFileInsideEvidenceRoot(
+function getEvidenceFileFailure(
 	filePath: string,
 	evidenceRoot: string,
-	cwd: string,
+	input: SubagentStopInput,
 	fs: HookFileSystem,
-): boolean {
-	if (!fs.existsSync(filePath)) return false;
-	const realCwd = realPath(cwd, fs);
+): EvidenceReceiptFailure {
+	if (!fs.existsSync(filePath)) return "invalid";
+	const realCwd = realPath(input.cwd, fs);
 	const realEvidenceRoot = realPath(evidenceRoot, fs);
 	const realFilePath = realPath(filePath, fs);
-	if (!isPathInsideDirectory(realEvidenceRoot, realCwd)) return false;
-	if (!isPathInsideDirectory(realFilePath, realEvidenceRoot)) return false;
-	return isNonEmptyFile(filePath, fs);
-}
-
-function isNonEmptyFile(filePath: string, fs: HookFileSystem): boolean {
-	if (!fs.existsSync(filePath)) return false;
+	if (!isPathInsideDirectory(realEvidenceRoot, realCwd)) return "invalid";
+	if (!isPathInsideDirectory(realFilePath, realEvidenceRoot)) return "invalid";
 	const linkStat = fs.lstatSync?.(filePath) ?? nodeLstatSync(filePath);
-	if (linkStat.isSymbolicLink?.() === true) return false;
+	if (linkStat.isSymbolicLink?.() === true) return "invalid";
 	const stat = fs.statSync(filePath);
-	if (stat.size <= 0) return false;
-	return stat.isFile?.() ?? true;
+	if (stat.isFile?.() === false) return "invalid";
+	if (stat.size <= 0 || fs.readFileSync(filePath, "utf8").trim().length < 40) return "placeholder";
+	let transcriptStat: FileStat;
+	try {
+		transcriptStat = fs.statSync(input.transcript_path);
+	} catch (error) {
+		if (error instanceof Error) return null;
+		throw error;
+	}
+	const transcriptStart = transcriptStat.birthtimeMs ?? transcriptStat.ctimeMs;
+	if (transcriptStart !== undefined && (stat.mtimeMs === undefined || stat.mtimeMs < transcriptStart)) return "stale";
+	return null;
 }
 
 function realPath(path: string, fs: HookFileSystem): string {

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/src/types.ts

@@ -21,6 +21,9 @@ export type StopHookOutput = {
 
 export type FileStat = {
 	readonly size: number;
+	readonly mtimeMs?: number;
+	readonly birthtimeMs?: number;
+	readonly ctimeMs?: number;
 	readonly isFile?: () => boolean;
 	readonly isSymbolicLink?: () => boolean;
 };

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/test/cli.test.ts

@@ -59,7 +59,7 @@ describe("lazycodex executor verify CLI", () => {
 		const cwd = createWorkspace();
 		const artifactPath = join(cwd, ".omo", "evidence", "receipt.txt");
 		mkdirSync(join(cwd, ".omo", "evidence"), { recursive: true });
-		writeFileSync(artifactPath, "verified\n");
+		writeFileSync(artifactPath, "Command: verify\nExit code: 0\nOutput: all checks passed.\n");
 		const payload = JSON.stringify(
 			createPayload(cwd, { last_assistant_message: `EVIDENCE_RECORDED: ${artifactPath}` }),
 		);

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/test/codex-hook.test.ts

@@ -12,12 +12,12 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { platform } from "node:process";
 import { afterEach, describe, expect, it } from "vitest";
 
 import { runSubagentStopHook } from "../src/codex-hook.js";
-import type { SubagentStopInput } from "../src/types.js";
+import type { FileStat, HookFileSystem, SubagentStopInput } from "../src/types.js";
 
 const cleanupRoots: string[] = [];
 
@@ -71,7 +71,7 @@ describe("lazycodex executor SubagentStop verifier", () => {
 		runSubagentStopHook(createInput(cwd), nodeFileSystem);
 		const artifactPath = join(cwd, ".omo", "evidence", "receipt.txt");
 		mkdirSync(join(cwd, ".omo", "evidence"), { recursive: true });
-		writeFileSync(artifactPath, "verified\n");
+		writeFileSync(artifactPath, "Command: verify\nExit code: 0\nOutput: all checks passed.\n");
 
 		// when
 		const output = runSubagentStopHook(
@@ -140,7 +140,7 @@ describe("lazycodex executor SubagentStop verifier", () => {
 		const outsideReceipt = join(outsideRoot, "receipt.txt");
 		const linkPath = join(cwd, ".omo", "evidence", "outside-dir");
 		mkdirSync(join(cwd, ".omo", "evidence"), { recursive: true });
-		writeFileSync(outsideReceipt, "outside\n");
+		writeFileSync(outsideReceipt, "outside evidence root\n".repeat(3));
 		symlinkSync(outsideRoot, linkPath, platform === "win32" ? "junction" : "dir");
 
 		// when
@@ -186,7 +186,7 @@ describe("lazycodex executor SubagentStop verifier", () => {
 		// given
 		const cwd = createWorkspace();
 		mkdirSync(join(cwd, ".omo"), { recursive: true });
-		writeFileSync(join(cwd, ".omo", "outside.txt"), "outside\n");
+		writeFileSync(join(cwd, ".omo", "outside.txt"), "outside evidence root\n".repeat(3));
 
 		// when
 		const output = runSubagentStopHook(
@@ -251,6 +251,132 @@ describe("lazycodex executor SubagentStop verifier", () => {
 	});
 });
 
+describe("receipt content and freshness", () => {
+	it.each(["placeholder evidence\n", "x".repeat(39), `  ${"x".repeat(39)}\n`])(
+		"#given a short trimmed receipt %j #when the worker stops #then blocks as placeholder",
+		(content) => {
+			// given
+			const { input, fs } = createMemoryReceipt(content, { mtimeMs: 2_000 }, { birthtimeMs: 1_000 });
+
+			// when
+			const output = runSubagentStopHook(input, fs);
+
+			// then
+			expect(parseBlockOutput(output).reason).toContain("placeholder");
+		},
+	);
+
+	it("#given a 200-character receipt older than transcript birth #when the worker stops #then blocks as stale", () => {
+		// given
+		const { input, fs } = createMemoryReceipt("x".repeat(200), { mtimeMs: 999 }, { birthtimeMs: 1_000 });
+
+		// when
+		const output = runSubagentStopHook(input, fs);
+
+		// then
+		expect(parseBlockOutput(output).reason).toContain("stale");
+	});
+
+	it("#given a fresh 200-character receipt #when transcript birth precedes ctime #then passes using birthtime", () => {
+		// given
+		const { input, fs } = createMemoryReceipt(
+			"x".repeat(200),
+			{ mtimeMs: 1_001 },
+			{ birthtimeMs: 1_000, ctimeMs: 3_000 },
+		);
+
+		// when
+		const output = runSubagentStopHook(input, fs);
+
+		// then
+		expect(output).toBe("");
+	});
+
+	it("#given a 200-character receipt and unstatable transcript #when the worker stops #then skips freshness", () => {
+		// given
+		const { input, fs } = createMemoryReceipt("x".repeat(200), { mtimeMs: 0 });
+
+		// when
+		const output = runSubagentStopHook({ ...input, transcript_path: "/nonexistent" }, fs);
+
+		// then
+		expect(output).toBe("");
+	});
+
+	it("#given 40 trimmed characters with mtime equal to transcript birth #when the worker stops #then passes", () => {
+		// given
+		const { input, fs } = createMemoryReceipt(`  ${"x".repeat(40)}\n`, { mtimeMs: 1_000 }, { birthtimeMs: 1_000 });
+
+		// when
+		const output = runSubagentStopHook(input, fs);
+
+		// then
+		expect(output).toBe("");
+	});
+
+	it.each([999, 1_000])(
+		"#given no transcript birthtime and receipt mtime %i #when the worker stops #then uses ctime",
+		(mtimeMs) => {
+			// given
+			const { input, fs } = createMemoryReceipt("x".repeat(200), { mtimeMs }, { ctimeMs: 1_000 });
+
+			// when
+			const output = runSubagentStopHook(input, fs);
+
+			// then
+			if (mtimeMs < 1_000) expect(parseBlockOutput(output).reason).toContain("stale");
+			else expect(output).toBe("");
+		},
+	);
+});
+
+function createMemoryReceipt(
+	content: string,
+	receiptStat: Partial<FileStat>,
+	transcriptStat?: Partial<FileStat>,
+): { readonly input: SubagentStopInput; readonly fs: HookFileSystem } {
+	const cwd = resolve("receipt-workspace");
+	const transcriptPath = join(cwd, "transcript.jsonl");
+	const files = new Map<string, { readonly content: string; readonly stat: Partial<FileStat> }>([
+		[join(cwd, ".omo", "evidence", "receipt.txt"), { content, stat: receiptStat }],
+	]);
+	if (transcriptStat !== undefined) files.set(transcriptPath, { content: "", stat: transcriptStat });
+	const fileAt = (path: string) => {
+		const file = files.get(path);
+		if (file === undefined) throw new Error(`ENOENT: ${path}`);
+		return file;
+	};
+	const statAt = (path: string): FileStat => {
+		const file = fileAt(path);
+		return { size: file.content.length, isFile: () => true, isSymbolicLink: () => false, ...file.stat };
+	};
+	const fs: HookFileSystem = {
+		existsSync: (path) => files.has(path),
+		lstatSync: statAt,
+		mkdirSync: () => undefined,
+		readFileSync: (path) => fileAt(path).content,
+		realpathSync: (path) => resolve(path),
+		renameSync: (oldPath, newPath) => {
+			files.set(newPath, fileAt(oldPath));
+			files.delete(oldPath);
+		},
+		rmSync: (path) => {
+			files.delete(path);
+		},
+		statSync: statAt,
+		writeFileSync: (path, data) => {
+			files.set(path, { content: data, stat: {} });
+		},
+	};
+	return {
+		input: createInput(cwd, {
+			transcript_path: transcriptPath,
+			last_assistant_message: "done\nEVIDENCE_RECORDED: .omo/evidence/receipt.txt",
+		}),
+		fs,
+	};
+}
+
 type BlockOutput = {
 	readonly decision: "block";
 	readonly reason: string;
@@ -278,7 +404,7 @@ function createWorkspaceWithParentOutsideReceipt(): { readonly cwd: string } {
 	const root = createWorkspace();
 	const cwd = join(root, "project");
 	mkdirSync(cwd, { recursive: true });
-	writeFileSync(join(root, "outside.txt"), "outside\n");
+	writeFileSync(join(root, "outside.txt"), "outside evidence root\n".repeat(3));
 	return { cwd };
 }
 
@@ -291,7 +417,7 @@ function existingReceiptTargetOutsideEvidenceRoot(): string {
 	if (existsSync("/etc/passwd") && statSync("/etc/passwd").size > 0) return "/etc/passwd";
 	const root = createWorkspace();
 	const receiptPath = join(root, "outside.txt");
-	writeFileSync(receiptPath, "outside\n");
+	writeFileSync(receiptPath, "outside evidence root\n".repeat(3));
 	return receiptPath;
 }
 

package/packages/omo-codex/plugin/components/lcx/skills/lcx-doctor/SKILL.md

@@ -66,6 +66,7 @@ sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/openai-codex-source"
    - Installed LazyCodex version: the `version` in the installed plugin manifest, discoverable with `find "${CODEX_HOME:-$HOME/.codex}/plugins" -path '*/.codex-plugin/plugin.json'`. Installed plugins live under `$CODEX_HOME/plugins/cache/<marketplace>/<name>/<version>/`.
    - Latest LazyCodex version from `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` (release tags or the version stamped in the repo) and latest Codex release (`gh release view --repo openai/codex`).
    - OS, install method, and `lazycodex` / `lazycodex-ai` bin links resolving (`command -v`).
+   - Astra readiness. The LazyCodex catalog default is `gpt-6-astra`, which Codex only knows from codex-cli 0.153.1 onward. First release tag containing the `models.json` change: `rust-v0.153.1` (backport commit `5cc1c94b8e`). Reproduce on a full clone with tags: `git -C <codex-clone> log --format='%h %d' -S gpt-6-astra -- codex-rs/models-manager/models.json`, then `git -C <codex-clone> tag --contains 5cc1c94b8e | sort -V | head -1`; a shallow clone or one without tags returns nothing. Record the installed version from `codex --version`, the root `model` in `$CODEX_HOME/config.toml` (informational only, it doesn't change the verdict), and, when `$CODEX_HOME/models_cache.json` exists, whether it contains `gpt-6-astra` (`grep -c gpt-6-astra "${CODEX_HOME:-$HOME/.codex}/models_cache.json"`). Verdict: PASS when `codex --version` is 0.153.1 or newer and `models_cache.json` is either absent or lists `gpt-6-astra`. WARN when the version is older than 0.153.1, or the cache exists but lacks `gpt-6-astra`; remediation is upgrading Codex (`npm install -g @openai/codex@latest`, or the package manager that installed `codex`), then starting Codex once so `models_cache.json` refreshes.
 3. Check config and wiring against the latest installer, not against assumptions. Read what the current installer under `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` writes (installer sources live in the omo-codex package, e.g. `scripts/install/`), then verify the local equivalents:
    - `$CODEX_HOME/config.toml` exists and parses; LazyCodex-managed entries match what the latest installer would write.
    - Plugin payload present and non-empty: read `.codex-plugin/plugin.json`; when that manifest declares a `hooks` array, validate every direct hook path declared by the manifest; require `hooks/hooks.json` only when the manifest declares it; do not require retired paths such as `components/workflow-selector` or `hooks/user-prompt-submit-selecting-lazycodex-workflow.json` unless the current manifest declares them.
@@ -96,6 +97,7 @@ sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/openai-codex-source"
 | Check | Verdict | Evidence |
 | --- | --- | --- |
 | Versions current | PASS/WARN/FAIL | [command output or file:line] |
+| Astra readiness | PASS/WARN | [`codex --version` vs the 0.153.1 floor; `gpt-6-astra` present/absent in `$CODEX_HOME/models_cache.json`; configured root `model`] |
 | config.toml integrity | PASS/WARN/FAIL | [evidence] |
 | Plugin payload wiring | PASS/WARN/FAIL | [evidence] |
 | Bin links / aliases | PASS/WARN/FAIL | [evidence] |
@@ -103,7 +105,7 @@ sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/openai-codex-source"
 | Drift vs latest source | PASS/WARN/FAIL | [evidence, citing `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` or `$LAZYCODEX_SOURCE_ROOT/openai-codex-source` paths] |
 
 ### Remediations
-1. [Most important fix first: exact command or config edit, and what it resolves.]
+1. [Most important fix first: exact command or config edit, and what it resolves. When Astra readiness is WARN: upgrade Codex to 0.153.1 or newer and relaunch it once so `models_cache.json` picks up `gpt-6-astra`.]
 
 ### Known Issues Matched
 - [issue URL — or "none found"]

package/packages/omo-codex/plugin/components/lsp/dist/.omo-runtime-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "version": "5.0.0-beta.49",
-  "inputDigest": "sha256:2558d595e0ff9f7b1fe251d3ce11a05dadf64b039021b5a34d5469762671b6de",
+  "version": "5.0.0-beta.50",
+  "inputDigest": "sha256:27672c2cd34eb3b44fc226b7e4e9137af0d0acedbb729fe92cdd663602ae6846",
   "outputs": [
     {
       "path": "cli.d.ts",
@@ -9,7 +9,7 @@
     },
     {
       "path": "cli.js",
-      "sha256": "bddbb2f82db0dffb0c2ec7b69778a63e77cac2c6a0f8bfb6d7a62980a49d14bb"
+      "sha256": "54d3621c04697495054be69fd6328d7b9044034801b295868b23bd92d344a816"
     },
     {
       "path": "codex-hook-cli.d.ts",