oh-my-codex 0.14.4 → 0.15.1

package/src/scripts/__tests__/generate-release-body.test.ts

@@ -8,6 +8,7 @@ import {
   buildFullChangelogLine,
   generateReleaseBody,
   renderContributorsSection,
+  verifyCompareRange,
   type Contributor,
 } from '../generate-release-body.js';
 
@@ -94,6 +95,18 @@ describe('generate-release-body', () => {
   it('prefers GitHub contributor handles when compare metadata is available', async () => {
     const root = await mkdtemp(join(tmpdir(), 'omx-generate-release-body-gh-'));
     try {
+      git(root, ['init']);
+      git(root, ['config', 'user.name', 'Release Bot']);
+      git(root, ['config', 'user.email', 'release@example.com']);
+      await writeFile(join(root, 'notes.txt'), 'base\n');
+      git(root, ['add', '.']);
+      git(root, ['commit', '-m', 'base']);
+      git(root, ['tag', 'v0.13.0']);
+      await writeFile(join(root, 'notes.txt'), 'release\n');
+      git(root, ['add', 'notes.txt']);
+      git(root, ['commit', '-m', 'release']);
+      git(root, ['tag', 'v0.13.1']);
+
       await writeFile(join(root, 'RELEASE_BODY.md'), TEMPLATE);
       const originalFetch = global.fetch;
       global.fetch = (async () => new Response(JSON.stringify({
@@ -126,9 +139,105 @@ describe('generate-release-body', () => {
   });
 
 
+  it('skips off-ancestry semver-previous tags when auto-resolving the compare base', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'omx-generate-release-body-off-ancestry-'));
+    try {
+      git(root, ['init']);
+      git(root, ['config', 'user.name', 'Release Bot']);
+      git(root, ['config', 'user.email', 'release@example.com']);
+      await writeFile(join(root, 'notes.txt'), 'base\n');
+      git(root, ['add', '.']);
+      git(root, ['commit', '-m', 'base']);
+      git(root, ['tag', 'v0.14.3']);
+
+      await writeFile(join(root, 'notes.txt'), 'dev train\n');
+      git(root, ['add', 'notes.txt']);
+      git(root, ['commit', '-m', 'dev train']);
+      git(root, ['tag', 'v0.15.1']);
+
+      git(root, ['checkout', '-b', 'side-release', 'v0.14.3']);
+      await writeFile(join(root, 'side.txt'), 'side release\n');
+      git(root, ['add', 'side.txt']);
+      git(root, ['commit', '-m', 'side release']);
+      git(root, ['tag', 'v0.15.0']);
+      git(root, ['checkout', 'v0.15.1']);
+
+      await writeFile(join(root, 'RELEASE_BODY.md'), TEMPLATE);
+      await generateReleaseBody({
+        cwd: root,
+        templatePath: 'RELEASE_BODY.md',
+        outPath: 'RELEASE_BODY.generated.md',
+        currentTag: 'v0.15.1',
+        repo: 'example/oh-my-codex',
+      });
+
+      const generated = await readFile(join(root, 'RELEASE_BODY.generated.md'), 'utf-8');
+      assert.match(generated, /`v0\.14\.3\.\.\.v0\.15\.1`/);
+      assert.doesNotMatch(generated, /`v0\.15\.0\.\.\.v0\.15\.1`/);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+
+  it('rejects missing or inverted compare refs before rendering a compare link', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'omx-generate-release-body-range-'));
+    try {
+      git(root, ['init']);
+      git(root, ['config', 'user.name', 'Release Bot']);
+      git(root, ['config', 'user.email', 'release@example.com']);
+      await writeFile(join(root, 'notes.txt'), 'base\n');
+      git(root, ['add', '.']);
+      git(root, ['commit', '-m', 'base']);
+      git(root, ['tag', 'v0.13.0']);
+      await writeFile(join(root, 'notes.txt'), 'release\n');
+      git(root, ['add', 'notes.txt']);
+      git(root, ['commit', '-m', 'release']);
+      git(root, ['tag', 'v0.13.1']);
+
+      assert.doesNotThrow(() => verifyCompareRange(root, 'v0.13.1', 'v0.13.0'));
+      assert.throws(
+        () => verifyCompareRange(root, 'v0.13.1', 'v9.99.9'),
+        /unable to verify previous tag ref for release compare: v9\.99\.9/,
+      );
+      assert.throws(
+        () => verifyCompareRange(root, 'v0.13.0', 'v0.13.1'),
+        /invalid release compare range: v0\.13\.1 is not an ancestor of v0\.13\.0/,
+      );
+
+      await writeFile(join(root, 'RELEASE_BODY.md'), TEMPLATE);
+      await assert.rejects(
+        generateReleaseBody({
+          cwd: root,
+          templatePath: 'RELEASE_BODY.md',
+          outPath: 'RELEASE_BODY.generated.md',
+          currentTag: 'v0.13.1',
+          previousTag: 'v9.99.9',
+          repo: 'example/oh-my-codex',
+        }),
+        /unable to verify previous tag ref for release compare: v9\.99\.9/,
+      );
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+
   it('fails validation when the template is missing required metadata anchors', async () => {
     const root = await mkdtemp(join(tmpdir(), 'omx-generate-release-body-invalid-'));
     try {
+      git(root, ['init']);
+      git(root, ['config', 'user.name', 'Release Bot']);
+      git(root, ['config', 'user.email', 'release@example.com']);
+      await writeFile(join(root, 'notes.txt'), 'base\n');
+      git(root, ['add', '.']);
+      git(root, ['commit', '-m', 'base']);
+      git(root, ['tag', 'v0.13.0']);
+      await writeFile(join(root, 'notes.txt'), 'release\n');
+      git(root, ['add', 'notes.txt']);
+      git(root, ['commit', '-m', 'release']);
+      git(root, ['tag', 'v0.13.1']);
+
       await writeFile(join(root, 'RELEASE_BODY.md'), `# oh-my-codex v0.0.0
 
 ## Summary

package/src/scripts/__tests__/hook-derived-watcher.test.ts

@@ -1,7 +1,8 @@
 import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
+import { once } from 'node:events';
 import { existsSync } from 'node:fs';
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { appendFile, mkdir, mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, it } from 'node:test';
@@ -18,7 +19,34 @@ function todaySessionDir(baseHome: string): string {
   );
 }
 
+async function sleep(ms: number): Promise<void> {
+  await new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function waitFor(predicate: () => Promise<boolean>, timeoutMs: number = 3000, stepMs: number = 50): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await predicate()) return;
+    await sleep(stepMs);
+  }
+  throw new Error(`waitFor timed out after ${timeoutMs}ms`);
+}
+
 describe('hook-derived-watcher', () => {
+  it('uses offset-bounded rollout reads instead of re-reading whole tracked files', async () => {
+    const source = await readFile(new URL('../hook-derived-watcher.js', import.meta.url), 'utf-8');
+
+    assert.match(source, /async function readFileDelta/);
+    assert.match(source, /while \(totalBytesRead < length\)/);
+    assert.match(source, /nextOffset: offset \+ totalBytesRead/);
+    assert.match(source, /new StringDecoder\('utf8'\)/);
+    assert.match(source, /decoder\.write\(bytes\)/);
+    assert.match(source, /const fileStat = await stat\(path\)\.catch\(\(\) => null\);\s*if \(!fileStat\)\s*continue;/);
+    assert.match(source, /if \(currentSize < meta\.offset\) \{\s*meta\.offset = 0;\s*meta\.partial = '';/);
+    assert.doesNotMatch(source, /const content = await readFile\(path, 'utf-8'\)[\s\S]*const delta = content\.slice\(meta\.offset\)/);
+    assert.doesNotMatch(source, /stat\(path\)\.catch\(\(\) => \(\{ size: 0 \}\)\)/);
+  });
+
   it('dispatches needs-input for assistant_message content arrays', async () => {
     const base = await mkdtemp(join(tmpdir(), 'omx-hook-derived-array-'));
     const homeDir = join(base, 'home');
@@ -108,4 +136,106 @@ export async function onHookEvent(event) {
       await rm(base, { recursive: true, force: true });
     }
   });
+
+  it('preserves multibyte assistant text split across polling reads', async () => {
+    const base = await mkdtemp(join(tmpdir(), 'omx-hook-derived-utf8-'));
+    const homeDir = join(base, 'home');
+    const cwd = join(base, 'cwd');
+    const hookLogPath = join(cwd, '.omx', 'hook-events.jsonl');
+
+    try {
+      await mkdir(todaySessionDir(homeDir), { recursive: true });
+      await mkdir(join(cwd, '.omx', 'hooks'), { recursive: true });
+
+      await writeFile(
+        join(cwd, '.omx', 'hooks', 'capture-needs-input.mjs'),
+        `import { appendFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+
+export async function onHookEvent(event) {
+  await mkdir(dirname(${JSON.stringify(hookLogPath)}), { recursive: true });
+  await appendFile(${JSON.stringify(hookLogPath)}, JSON.stringify(event) + '\\n');
+}
+`,
+      );
+
+      const rolloutPath = join(todaySessionDir(homeDir), 'rollout-hook-derived-utf8.jsonl');
+      await writeFile(
+        rolloutPath,
+        `${JSON.stringify({
+          type: 'session_meta',
+          payload: {
+            id: 'thread-hook-utf8',
+            cwd,
+          },
+        })}\n`,
+      );
+
+      const watcherScript = new URL('../hook-derived-watcher.js', import.meta.url).pathname;
+      const child = spawn(
+        process.execPath,
+        [watcherScript, '--cwd', cwd, '--poll-ms', '75'],
+        {
+          cwd,
+          stdio: 'ignore',
+          env: {
+            ...process.env,
+            HOME: homeDir,
+            OMX_HOOK_DERIVED_SIGNALS: '1',
+            OMX_HOOK_PLUGINS: '1',
+          },
+        },
+      );
+
+      const watcherStatePath = join(cwd, '.omx', 'state', 'hook-derived-watcher-state.json');
+      await waitFor(async () => {
+        try {
+          const state = JSON.parse(await readFile(watcherStatePath, 'utf-8'));
+          return state.tracked_files === 1;
+        } catch {
+          return false;
+        }
+      });
+
+      const questionText = 'Can you preserve split emoji 🧪 please?';
+      const eventLine = `${JSON.stringify({
+        timestamp: new Date().toISOString(),
+        type: 'event_msg',
+        payload: {
+          type: 'assistant_message',
+          turn_id: 'turn-hook-utf8',
+          content: [{ type: 'output_text', text: questionText }],
+        },
+      })}\n`;
+      const bytes = Buffer.from(eventLine, 'utf8');
+      const emojiOffset = bytes.indexOf(Buffer.from('🧪', 'utf8'));
+      assert.ok(emojiOffset > 0, 'expected test payload to contain emoji bytes');
+
+      await appendFile(rolloutPath, bytes.subarray(0, emojiOffset + 1));
+      await sleep(250);
+      assert.equal(existsSync(hookLogPath), false, 'incomplete UTF-8 and JSON line should not dispatch');
+
+      const hiddenRolloutPath = `${rolloutPath}.missing`;
+      await rename(rolloutPath, hiddenRolloutPath);
+      await sleep(250);
+      assert.equal(existsSync(hookLogPath), false, 'transient missing file should preserve buffered bytes');
+      await rename(hiddenRolloutPath, rolloutPath);
+
+      await appendFile(rolloutPath, bytes.subarray(emojiOffset + 1));
+      await waitFor(async () => {
+        if (!existsSync(hookLogPath)) return false;
+        const raw = await readFile(hookLogPath, 'utf-8');
+        return raw.includes('turn-hook-utf8') && raw.includes(questionText);
+      }, 4000, 75);
+
+      child.kill('SIGTERM');
+      await once(child, 'exit');
+
+      const raw = await readFile(hookLogPath, 'utf-8');
+      assert.match(raw, /turn-hook-utf8/);
+      assert.match(raw, /Can you preserve split emoji 🧪 please\?/);
+    } finally {
+      await rm(base, { recursive: true, force: true });
+    }
+  });
 });

package/src/scripts/__tests__/postinstall.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, it } from "node:test";
@@ -24,70 +24,58 @@ describe("isGlobalInstallLifecycle", () => {
 });
 
 describe("runPostinstall", () => {
-  it("runs interactive setup only for bumped global installs", async () => {
+  it("records the installed version and prints an explicit opt-in setup hint for bumped global installs", async () => {
     const root = await mkdtemp(join(tmpdir(), "omx-postinstall-"));
     const stampPath = join(root, ".codex", ".omx", "install-state.json");
     const logs: string[] = [];
-    let setupCalls = 0;
 
     try {
       const result = await runPostinstall({
         env: { npm_config_global: "true" },
         getCurrentVersion: async () => "0.14.1",
-        isInteractive: () => true,
         log: (message) => logs.push(message),
         readStamp: async () => ({
           installed_version: "0.14.0",
           setup_completed_version: "0.14.0",
           updated_at: "2026-04-20T00:00:00.000Z",
         }),
-        runSetup: async () => {
-          setupCalls += 1;
-        },
         writeStamp: async (stamp) => writeUserInstallStamp(stamp, stampPath),
       });
 
-      assert.equal(result.status, "setup-ran");
-      assert.equal(setupCalls, 1);
-      assert.match(logs.join("\n"), /Launching interactive setup/);
+      assert.equal(result.status, "hinted");
+      assert.match(logs.join("\n"), /OMX setup is explicit opt-in; run `omx setup` or `omx update` when you're ready/);
 
       const stamp = JSON.parse(await readFile(stampPath, "utf-8")) as {
         installed_version: string;
         setup_completed_version: string;
       };
       assert.equal(stamp.installed_version, "0.14.1");
-      assert.equal(stamp.setup_completed_version, "0.14.1");
+      assert.equal(stamp.setup_completed_version, "0.14.0");
     } finally {
       await rm(root, { recursive: true, force: true });
     }
   });
 
-  it("records the installed version and prints a hint when no TTY is available", async () => {
+  it("records the installed version and preserves prior setup state when printing the postinstall hint", async () => {
     const root = await mkdtemp(join(tmpdir(), "omx-postinstall-"));
     const stampPath = join(root, ".codex", ".omx", "install-state.json");
     const logs: string[] = [];
-    let setupCalls = 0;
 
     try {
       const result = await runPostinstall({
         env: { npm_config_global: "true" },
         getCurrentVersion: async () => "0.14.1",
-        isInteractive: () => false,
         log: (message) => logs.push(message),
         readStamp: async () => ({
           installed_version: "0.14.0",
           setup_completed_version: "0.14.0",
           updated_at: "2026-04-20T00:00:00.000Z",
         }),
-        runSetup: async () => {
-          setupCalls += 1;
-        },
         writeStamp: async (stamp) => writeUserInstallStamp(stamp, stampPath),
       });
 
       assert.equal(result.status, "hinted");
-      assert.equal(setupCalls, 0);
-      assert.match(logs.join("\n"), /Run `omx setup` \(interactive\) or `omx update`/);
+      assert.match(logs.join("\n"), /run `omx setup` or `omx update` when you're ready/i);
 
       const stamp = JSON.parse(await readFile(stampPath, "utf-8")) as {
         installed_version: string;
@@ -101,110 +89,25 @@ describe("runPostinstall", () => {
   });
 
   it("skips local installs", async () => {
-    let setupCalls = 0;
     const result = await runPostinstall({
       env: { npm_config_global: "false" },
       getCurrentVersion: async () => "0.14.1",
-      isInteractive: () => true,
-      runSetup: async () => {
-        setupCalls += 1;
-      },
     });
 
     assert.equal(result.status, "noop-local");
-    assert.equal(setupCalls, 0);
   });
 
   it("does not rerun setup when the installed version matches the saved stamp", async () => {
-    let setupCalls = 0;
     const result = await runPostinstall({
       env: { npm_config_global: "true" },
       getCurrentVersion: async () => "0.14.1",
-      isInteractive: () => true,
       readStamp: async () => ({
         installed_version: "0.14.1",
         setup_completed_version: "0.14.1",
         updated_at: "2026-04-20T00:00:00.000Z",
       }),
-      runSetup: async () => {
-        setupCalls += 1;
-      },
     });
 
     assert.equal(result.status, "noop-same-version");
-    assert.equal(setupCalls, 0);
-  });
-
-  it("warns and exits cleanly when setup fails", async () => {
-    const warnings: string[] = [];
-    const result = await runPostinstall({
-      env: { npm_config_global: "true" },
-      getCurrentVersion: async () => "0.14.1",
-      isInteractive: () => true,
-      readStamp: async () => ({
-        installed_version: "0.14.0",
-        setup_completed_version: "0.14.0",
-        updated_at: "2026-04-20T00:00:00.000Z",
-      }),
-      runSetup: async () => {
-        throw new Error("boom");
-      },
-      warn: (message) => warnings.push(message),
-      writeStamp: async () => {},
-    });
-
-    assert.equal(result.status, "setup-failed");
-    assert.match(warnings.join("\n"), /non-fatal error: boom/);
-  });
-
-  it("runs interactive setup from the npm install prefix instead of the package dir or INIT_CWD", async () => {
-    const installRoot = await mkdtemp(join(tmpdir(), "omx-postinstall-install-root-"));
-    const packageRoot = await mkdtemp(join(tmpdir(), "omx-postinstall-package-root-"));
-    const initCwd = await mkdtemp(join(tmpdir(), "omx-postinstall-init-cwd-"));
-    const originalCwd = process.cwd();
-    const scopeFile = join(installRoot, ".omx", "setup-scope.json");
-    const packageScopeFile = join(packageRoot, ".omx", "setup-scope.json");
-    const initCwdScopeFile = join(initCwd, ".omx", "setup-scope.json");
-
-    try {
-      process.chdir(packageRoot);
-
-      const result = await runPostinstall({
-        env: {
-          npm_config_global: "true",
-          npm_config_prefix: installRoot,
-          INIT_CWD: initCwd,
-        },
-        getCurrentVersion: async () => "0.14.1",
-        isInteractive: () => true,
-        readStamp: async () => ({
-          installed_version: "0.14.0",
-          setup_completed_version: "0.14.0",
-          updated_at: "2026-04-20T00:00:00.000Z",
-        }),
-        runSetup: async () => {
-          await mkdir(join(process.cwd(), ".omx"), { recursive: true });
-          await writeFile(
-            join(process.cwd(), ".omx", "setup-scope.json"),
-            JSON.stringify({ scope: "project" }),
-          );
-        },
-        writeStamp: async () => {},
-      });
-
-      assert.equal(result.status, "setup-ran");
-      assert.equal(process.cwd(), packageRoot);
-      assert.equal(
-        JSON.parse(await readFile(scopeFile, "utf-8")).scope,
-        "project",
-      );
-      await assert.rejects(() => readFile(packageScopeFile, "utf-8"));
-      await assert.rejects(() => readFile(initCwdScopeFile, "utf-8"));
-    } finally {
-      process.chdir(originalCwd);
-      await rm(installRoot, { recursive: true, force: true });
-      await rm(packageRoot, { recursive: true, force: true });
-      await rm(initCwd, { recursive: true, force: true });
-    }
   });
 });

package/src/scripts/__tests__/prompt-inventory.test.ts

@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, it } from 'node:test';
+import { buildPromptInventory, listPromptSurfacePaths, renderPromptInventoryMarkdown } from '../prompt-inventory.js';
+
+describe('prompt inventory', () => {
+  it('counts prompt surfaces, absolute directives, markers, and duplicate fragments', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'omx-prompt-inventory-'));
+    try {
+      await mkdir(join(root, 'templates'), { recursive: true });
+      await mkdir(join(root, 'prompts'), { recursive: true });
+      await mkdir(join(root, 'skills', 'worker'), { recursive: true });
+      await mkdir(join(root, 'docs', 'prompt-guidance-fragments'), { recursive: true });
+      await mkdir(join(root, 'src', 'hooks'), { recursive: true });
+      await mkdir(join(root, 'src', 'config'), { recursive: true });
+      await mkdir(join(root, 'src', 'cli'), { recursive: true });
+
+      const repeated = 'AUTO-CONTINUE for clear, already-requested, low-risk, reversible local work with evidence.';
+      await writeFile(join(root, 'AGENTS.md'), `# Root\n${repeated}\n<!-- omx:generated:agents-md -->\n`);
+      await writeFile(
+        join(root, 'templates', 'AGENTS.md'),
+        `# Template\nMUST preserve markers.\n${repeated}\n<!-- OMX:RUNTIME:START -->\n<!-- OMX:RUNTIME:END -->\n`,
+      );
+      await writeFile(join(root, 'prompts', 'executor.md'), `# Executor\nDO NOT stop early.\n${repeated}\n`);
+      await writeFile(join(root, 'skills', 'worker', 'SKILL.md'), '# Worker\nALWAYS claim tasks.\n');
+      await writeFile(join(root, 'docs', 'prompt-guidance-contract.md'), '# Contract\n');
+      await writeFile(join(root, 'docs', 'guidance-schema.md'), '# Schema\n');
+      await writeFile(join(root, 'docs', 'prompt-guidance-fragments', 'core.md'), 'fragment\n');
+      await writeFile(join(root, 'src', 'hooks', 'prompt-guidance-contract.ts'), 'export {};\n');
+      await writeFile(join(root, 'src', 'config', 'generator.ts'), 'export {};\n');
+      await writeFile(join(root, 'src', 'cli', 'setup.ts'), 'export {};\n');
+
+      const paths = listPromptSurfacePaths(root);
+      assert.deepEqual(paths, [
+        'AGENTS.md',
+        'docs/guidance-schema.md',
+        'docs/prompt-guidance-contract.md',
+        'docs/prompt-guidance-fragments/core.md',
+        'prompts/executor.md',
+        'skills/worker/SKILL.md',
+        'src/cli/setup.ts',
+        'src/config/generator.ts',
+        'src/hooks/prompt-guidance-contract.ts',
+        'templates/AGENTS.md',
+      ]);
+
+      const report = buildPromptInventory(root, '2026-01-01T00:00:00.000Z');
+      assert.equal(report.totals.files, paths.length);
+      assert.ok(report.totals.lines > 0);
+      assert.ok(report.totals.approximateTokens > 0);
+      assert.equal(report.totals.absoluteDirectiveCount, 6);
+      assert.equal(
+        report.surfaces.find((surface) => surface.path === 'templates/AGENTS.md')?.markers['<!-- OMX:RUNTIME:START -->'],
+        1,
+      );
+      assert.equal(report.duplicateFragmentFamilies[0]?.count, 3);
+      assert.match(renderPromptInventoryMarkdown(report), /# Prompt Inventory/);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});

package/src/scripts/__tests__/run-test-files.test.ts

@@ -0,0 +1,72 @@
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+function runCompiledRunner(root: string, envOverrides: Record<string, string> = {}, timeoutMs = 5_000) {
+  return spawnSync(process.execPath, ['dist/scripts/run-test-files.js', root], {
+    cwd: process.cwd(),
+    encoding: 'utf-8',
+    env: {
+      ...process.env,
+      ...envOverrides,
+    },
+    timeout: timeoutMs,
+  });
+}
+
+describe('run-test-files diagnostics', () => {
+  it('applies a bounded node --test timeout so hanging tests fail with file context', () => {
+    const wd = mkdtempSync(join(tmpdir(), 'omx-run-test-files-'));
+    try {
+      const testsDir = join(wd, '__tests__');
+      mkdirSync(testsDir, { recursive: true });
+      const testPath = join(testsDir, 'hang.test.js');
+      writeFileSync(
+        testPath,
+        [
+          "import { test } from 'node:test';",
+          "test('never resolves', async () => { await new Promise(() => setInterval(() => {}, 1_000)); });",
+          '',
+        ].join('\n'),
+      );
+
+      const result = runCompiledRunner(wd, {
+        OMX_NODE_TEST_TIMEOUT_MS: '250',
+        OMX_NODE_TEST_RUNNER_TIMEOUT_MS: '750',
+      });
+
+      assert.notEqual(result.status, 0);
+      assert.match(result.stderr, /per-test timeout 250ms/);
+      assert.match(result.stderr, /node --test did not exit normally|runner timeout 750ms/);
+      assert.match(`${result.stdout}\n${result.stderr}`, /hang\.test\.js|never resolves|cancelled/i);
+    } finally {
+      rmSync(wd, { recursive: true, force: true });
+    }
+  });
+
+  it('logs that per-test timeout is disabled by default', () => {
+    const wd = mkdtempSync(join(tmpdir(), 'omx-run-test-files-'));
+    try {
+      const testsDir = join(wd, '__tests__');
+      mkdirSync(testsDir, { recursive: true });
+      writeFileSync(
+        join(testsDir, 'pass.test.js'),
+        [
+          "import { test } from 'node:test';",
+          "test('passes', () => {});",
+          '',
+        ].join('\n'),
+      );
+
+      const result = runCompiledRunner(wd);
+
+      assert.equal(result.status, 0, result.stderr || result.stdout);
+      assert.match(result.stderr, /per-test timeout disabled/);
+    } finally {
+      rmSync(wd, { recursive: true, force: true });
+    }
+  });
+});

package/src/scripts/__tests__/smoke-packed-install.test.ts

@@ -8,6 +8,7 @@ import {
   ensureRepoDependencies,
   hasUsableNodeModules,
   PACKED_INSTALL_SMOKE_CORE_COMMANDS,
+  parseNpmPackJsonOutput,
   resolveGitCommonDir,
   resolveReusableNodeModulesSource,
 } from '../smoke-packed-install.js';
@@ -23,6 +24,20 @@ test('packed install smoke stays limited to boot + core commands', () => {
   );
 });
 
+test('parseNpmPackJsonOutput ignores prepack logs before npm pack JSON', () => {
+  const parsed = parseNpmPackJsonOutput([
+    '[sync-plugin-mirror] synced 29 canonical skill directories and plugin metadata',
+    '[',
+    '  {',
+    '    "filename": "oh-my-codex-0.15.0.tgz"',
+    '  }',
+    ']',
+    '',
+  ].join('\n'));
+
+  assert.deepEqual(parsed, [{ filename: 'oh-my-codex-0.15.0.tgz' }]);
+});
+
 test('resolveGitCommonDir resolves relative git common dir output against the repo root', () => {
   const commonDir = resolveGitCommonDir('/tmp/worktree', () => ({
     status: 0,