oh-my-codex 0.15.0 → 0.15.2

package/dist/cli/__tests__/index.test.js

@@ -6,7 +6,7 @@ import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { once } from "node:events";
-import { HELP, normalizeCodexLaunchArgs, buildTmuxShellCommand, buildTmuxPaneCommand, buildWindowsPromptCommand, buildTmuxSessionName, resolveCliInvocation, commandOwnsLocalHelp, resolveCodexLaunchPolicy, resolveLeaderLaunchPolicyOverride, classifyCodexExecFailure, resolveSignalExitCode, parseTmuxPaneSnapshot, findHudWatchPaneIds, buildHudPaneCleanupTargets, readTopLevelTomlString, upsertTopLevelTomlString, collectInheritableTeamWorkerArgs, resolveTeamWorkerLaunchArgsEnv, injectModelInstructionsBypassArgs, resolveWorkerSparkModel, resolveSetupInstallModeArg, resolveSetupScopeArg, readPersistedSetupPreferences, readPersistedSetupScope, resolveCodexConfigPathForLaunch, resolveCodexHomeForLaunch, buildDetachedSessionBootstrapSteps, buildDetachedTmuxSessionName, buildDetachedSessionFinalizeSteps, buildDetachedSessionRollbackSteps, detectDetachedSessionWindowIndex, resolveNotifyTempContract, buildNotifyTempStartupMessages, buildNotifyFallbackWatcherEnv, shouldEnableNotifyFallbackWatcher, reapStaleNotifyFallbackWatcher, cleanupLaunchOrphanedMcpProcesses, reapPostLaunchOrphanedMcpProcesses, cleanupPostLaunchModeStateFiles, resolveBackgroundHelperLaunchMode, shouldDetachBackgroundHelper, resolveNotifyFallbackWatcherScript, resolveHookDerivedWatcherScript, resolveNotifyHookScript, buildDetachedWindowsBootstrapScript, acquireTmuxExtendedKeysLease, resolveNativeSessionName, releaseTmuxExtendedKeysLease, withTmuxExtendedKeys, } from "../index.js";
+import { HELP, normalizeCodexLaunchArgs, buildTmuxShellCommand, buildTmuxPaneCommand, buildWindowsPromptCommand, buildTmuxSessionName, resolveCliInvocation, commandOwnsLocalHelp, resolveCodexLaunchPolicy, resolveEffectiveLeaderLaunchPolicyOverride, resolveEnvLaunchPolicyOverride, resolveLeaderLaunchPolicyOverride, classifyCodexExecFailure, resolveSignalExitCode, parseTmuxPaneSnapshot, findHudWatchPaneIds, buildHudPaneCleanupTargets, readTopLevelTomlString, upsertTopLevelTomlString, collectInheritableTeamWorkerArgs, resolveTeamWorkerLaunchArgsEnv, injectModelInstructionsBypassArgs, resolveWorkerSparkModel, resolveSetupInstallModeArg, resolveSetupScopeArg, readPersistedSetupPreferences, readPersistedSetupScope, resolveCodexConfigPathForLaunch, resolveCodexHomeForLaunch, resolveProjectLocalCodexHomeForLaunch, buildDetachedSessionBootstrapSteps, buildDetachedTmuxSessionName, buildDetachedSessionFinalizeSteps, buildDetachedSessionRollbackSteps, detectDetachedSessionWindowIndex, resolveNotifyTempContract, buildNotifyTempStartupMessages, buildNotifyFallbackWatcherEnv, shouldEnableNotifyFallbackWatcher, reapStaleNotifyFallbackWatcher, cleanupLaunchOrphanedMcpProcesses, reapPostLaunchOrphanedMcpProcesses, cleanupPostLaunchModeStateFiles, resolveBackgroundHelperLaunchMode, shouldDetachBackgroundHelper, resolveNotifyFallbackWatcherScript, resolveHookDerivedWatcherScript, resolveNotifyHookScript, buildDetachedWindowsBootstrapScript, acquireTmuxExtendedKeysLease, resolveNativeSessionName, releaseTmuxExtendedKeysLease, withTmuxExtendedKeys, } from "../index.js";
 import { ensureReusableNodeModules } from "../../utils/repo-deps.js";
 import { readAllState } from "../../hud/state.js";
 import { generateOverlay } from "../../hooks/agents-overlay.js";
@@ -138,6 +138,11 @@ describe("normalizeCodexLaunchArgs", () => {
             "--yolo",
         ]);
     });
+    it("strips --direct from leader codex args", () => {
+        assert.deepEqual(normalizeCodexLaunchArgs(["--direct", "--yolo"]), [
+            "--yolo",
+        ]);
+    });
     it("preserves literal --tmux after -- in leader codex args", () => {
         assert.deepEqual(normalizeCodexLaunchArgs(["--", "--tmux", "--yolo"]), [
             "--",
@@ -145,17 +150,64 @@ describe("normalizeCodexLaunchArgs", () => {
             "--yolo",
         ]);
     });
+    it("preserves literal --direct after -- in leader codex args", () => {
+        assert.deepEqual(normalizeCodexLaunchArgs(["--", "--direct", "--yolo"]), [
+            "--",
+            "--direct",
+            "--yolo",
+        ]);
+    });
 });
 describe("resolveLeaderLaunchPolicyOverride", () => {
     it("detects explicit detached tmux launch requests", () => {
         assert.equal(resolveLeaderLaunchPolicyOverride(["--tmux", "--model", "gpt-5"]), "detached-tmux");
     });
+    it("detects explicit direct launch requests", () => {
+        assert.equal(resolveLeaderLaunchPolicyOverride(["--direct", "--model", "gpt-5"]), "direct");
+    });
+    it("uses the last CLI launch policy flag before --", () => {
+        assert.equal(resolveLeaderLaunchPolicyOverride(["--direct", "--tmux"]), "detached-tmux");
+        assert.equal(resolveLeaderLaunchPolicyOverride(["--tmux", "--direct"]), "direct");
+    });
     it("returns undefined when no explicit policy override is present", () => {
         assert.equal(resolveLeaderLaunchPolicyOverride(["--model", "gpt-5"]), undefined);
     });
     it("stops scanning for --tmux after the end-of-options marker", () => {
         assert.equal(resolveLeaderLaunchPolicyOverride(["--", "--tmux", "--model", "gpt-5"]), undefined);
     });
+    it("stops scanning for --direct after the end-of-options marker", () => {
+        assert.equal(resolveLeaderLaunchPolicyOverride(["--", "--direct", "--model", "gpt-5"]), undefined);
+    });
+});
+describe("resolveEnvLaunchPolicyOverride", () => {
+    it("accepts direct, tmux, detached-tmux, auto, and empty policy values", () => {
+        assert.equal(resolveEnvLaunchPolicyOverride({ OMX_LAUNCH_POLICY: "direct" }), "direct");
+        assert.equal(resolveEnvLaunchPolicyOverride({ OMX_LAUNCH_POLICY: "tmux" }), "detached-tmux");
+        assert.equal(resolveEnvLaunchPolicyOverride({ OMX_LAUNCH_POLICY: "detached-tmux" }), "detached-tmux");
+        assert.equal(resolveEnvLaunchPolicyOverride({ OMX_LAUNCH_POLICY: "auto" }), undefined);
+        assert.equal(resolveEnvLaunchPolicyOverride({ OMX_LAUNCH_POLICY: "" }), undefined);
+    });
+    it("warns once for invalid OMX_LAUNCH_POLICY and falls back to auto", () => {
+        const warn = mock.method(console, "warn", () => { });
+        assert.equal(resolveEnvLaunchPolicyOverride({ OMX_LAUNCH_POLICY: "banana" }), undefined);
+        assert.equal(resolveEnvLaunchPolicyOverride({ OMX_LAUNCH_POLICY: "banana" }), undefined);
+        assert.equal(warn.mock.callCount(), 1);
+    });
+});
+describe("resolveEffectiveLeaderLaunchPolicyOverride", () => {
+    it("uses env policy when no CLI policy flag is present", () => {
+        assert.equal(resolveEffectiveLeaderLaunchPolicyOverride(["--yolo"], {
+            OMX_LAUNCH_POLICY: "direct",
+        }), "direct");
+    });
+    it("lets CLI policy flags override OMX_LAUNCH_POLICY", () => {
+        assert.equal(resolveEffectiveLeaderLaunchPolicyOverride(["--tmux", "--yolo"], {
+            OMX_LAUNCH_POLICY: "direct",
+        }), "detached-tmux");
+        assert.equal(resolveEffectiveLeaderLaunchPolicyOverride(["--direct", "--yolo"], {
+            OMX_LAUNCH_POLICY: "tmux",
+        }), "direct");
+    });
 });
 describe("resolveNotifyTempContract", () => {
     it("activates from --notify-temp with no providers", () => {
@@ -717,13 +769,31 @@ describe("resolveCliInvocation", () => {
     it("advertises the explicit update command in top-level help", () => {
         assert.match(HELP, /omx update\s+Check npm now, update the global install immediately, then refresh setup/);
     });
+    it("advertises direct launch policy controls in top-level help", () => {
+        assert.match(HELP, /--direct\s+Launch the interactive leader directly/);
+        assert.match(HELP, /OMX_LAUNCH_POLICY=direct\|tmux\|detached-tmux\|auto/);
+        assert.match(HELP, /unset OMX_LAUNCH_POLICY/);
+        assert.match(HELP, /omx --direct --yolo/);
+        assert.match(HELP, /OMX_LAUNCH_POLICY=direct omx --tmux --yolo/);
+        assert.match(HELP, /Config files are intentionally not used/);
+    });
 });
 describe("resolveSetupInstallModeArg", () => {
-    it("maps --plugin to plugin install mode", () => {
+    it("maps explicit setup install mode flags", () => {
         assert.equal(resolveSetupInstallModeArg(["--dry-run"]), undefined);
         assert.equal(resolveSetupInstallModeArg(["--plugin"]), "plugin");
+        assert.equal(resolveSetupInstallModeArg(["--legacy"]), "legacy");
+        assert.equal(resolveSetupInstallModeArg(["--install-mode", "legacy"]), "legacy");
+        assert.equal(resolveSetupInstallModeArg(["--install-mode=plugin"]), "plugin");
         assert.equal(resolveSetupInstallModeArg(["--scope", "project", "--plugin"]), "plugin");
     });
+    it("rejects invalid setup install mode flags", () => {
+        assert.throws(() => resolveSetupInstallModeArg(["--install-mode"]), /Missing setup install mode value after --install-mode/);
+        assert.throws(() => resolveSetupInstallModeArg(["--install-mode", "workspace"]), /Invalid setup install mode: workspace/);
+        assert.throws(() => resolveSetupInstallModeArg(["--plugin", "--legacy"]), /Conflicting setup install mode flags/);
+        assert.throws(() => resolveSetupInstallModeArg(["--plugin", "--install-mode", "legacy"]), /Conflicting setup install mode flags/);
+        assert.throws(() => resolveSetupInstallModeArg(["--legacy", "--install-mode=plugin"]), /Conflicting setup install mode flags/);
+    });
 });
 describe("resolveSetupScopeArg", () => {
     it("returns undefined when scope is omitted", () => {
@@ -815,6 +885,30 @@ describe("project launch scope helpers", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("marks only persisted project CODEX_HOME as project-local cleanup target", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-launch-scope-"));
+        try {
+            await mkdir(join(wd, ".omx"), { recursive: true });
+            await writeFile(join(wd, ".omx", "setup-scope.json"), JSON.stringify({ scope: "project" }));
+            assert.equal(resolveProjectLocalCodexHomeForLaunch(wd, {}), join(wd, ".codex"));
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("does not mark explicit CODEX_HOME as project-local cleanup target", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-launch-scope-"));
+        try {
+            await mkdir(join(wd, ".omx"), { recursive: true });
+            await writeFile(join(wd, ".omx", "setup-scope.json"), JSON.stringify({ scope: "project" }));
+            assert.equal(resolveProjectLocalCodexHomeForLaunch(wd, {
+                CODEX_HOME: "/tmp/user-global-codex-home",
+            }), undefined);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("keeps explicit CODEX_HOME override from env", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-launch-scope-"));
         try {
@@ -886,6 +980,18 @@ describe("resolveCodexLaunchPolicy", () => {
     it("honors explicit detached tmux launch requests when tmux is available", () => {
         assert.equal(resolveCodexLaunchPolicy({}, "linux", true, false, true, true, "detached-tmux"), "detached-tmux");
     });
+    it("honors explicit direct launch requests outside tmux", () => {
+        assert.equal(resolveCodexLaunchPolicy({}, "linux", true, false, true, true, "direct"), "direct");
+    });
+    it("honors explicit direct launch requests inside tmux", () => {
+        assert.equal(resolveCodexLaunchPolicy({ TMUX: "/tmp/tmux-1000/default,123,0" }, "linux", true, false, true, true, "direct"), "direct");
+    });
+    it("keeps explicit tmux policy tmux-aware inside tmux", () => {
+        assert.equal(resolveCodexLaunchPolicy({ TMUX: "/tmp/tmux-1000/default,123,0" }, "linux", true, false, true, true, "detached-tmux"), "inside-tmux");
+    });
+    it("falls back directly for explicit tmux requests when tmux is unavailable", () => {
+        assert.equal(resolveCodexLaunchPolicy({}, "linux", false, false, true, true, "detached-tmux"), "direct");
+    });
     it("launches directly when stdin is not a tty outside tmux", () => {
         assert.equal(resolveCodexLaunchPolicy({}, "linux", true, false, false, true), "direct");
     });
@@ -1037,9 +1143,18 @@ describe("detached tmux new-session sequencing", () => {
     it("buildDetachedSessionBootstrapSteps forwards OMX_SESSION_ID to detached tmux session", () => {
         const steps = buildDetachedSessionBootstrapSteps("omx-demo", "/tmp/project", "'env' 'OMX_SESSION_ID=sess-detached-managed' 'codex' '--model' 'gpt-5'", "'node' '/tmp/omx.js' 'hud' '--watch'", null, undefined, null, false, "sess-detached-managed");
         const newSession = steps.find((step) => step.name === "new-session");
+        const tagSession = steps.find((step) => step.name === "tag-session");
         assert.ok(newSession);
+        assert.ok(tagSession);
         assert.equal(newSession.args.includes("-e") &&
             newSession.args.some((arg) => arg === "OMX_SESSION_ID=sess-detached-managed"), true);
+        assert.deepEqual(tagSession.args, [
+            "set-option",
+            "-t",
+            "omx-demo",
+            "@omx_instance_id",
+            "sess-detached-managed",
+        ]);
     });
     it("buildDetachedSessionBootstrapSteps forwards CODEX_HOME override to detached tmux session", () => {
         const steps = buildDetachedSessionBootstrapSteps("omx-demo", "/tmp/project", "'codex' '--model' 'gpt-5'", "'node' '/tmp/omx.js' 'hud' '--watch'", null, "/tmp/project/.codex", null, false, "sess-detached-managed");
@@ -1050,7 +1165,7 @@ describe("detached tmux new-session sequencing", () => {
     });
     it("runCodex builds inside-tmux HUD command with OMX_SESSION_ID", async () => {
         const source = await readFile(join(repoRoot, 'src', 'cli', 'index.ts'), 'utf-8');
-        assert.match(source, /buildTmuxPaneCommand\("env", \[`OMX_SESSION_ID=\$\{sessionId\}`, "node", omxBin, "hud", "--watch"\]\)/);
+        assert.match(source, /buildTmuxPaneCommand\("env",\s*\[\s*`OMX_SESSION_ID=\$\{sessionId\}`,\s*"node",\s*omxBin,\s*"hud",\s*"--watch",?\s*\]\)/);
     });
     it("buildDetachedSessionBootstrapSteps starts native Windows detached sessions with powershell", () => {
         const hudCmd = buildWindowsPromptCommand("node", [
@@ -1352,6 +1467,25 @@ exit 0
             ["set-option", "-sq", "extended-keys", "off"],
         ]);
     });
+    it("acquireTmuxExtendedKeysLease can bind lease liveness to a long-lived owner pid", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-tmux-lease-owner-pid-"));
+        try {
+            const execStub = (_file, args) => {
+                if (args[0] === "display-message")
+                    return "/tmp/tmux-owner-pid.sock\n";
+                if (args[0] === "show-options")
+                    return "off\n";
+                return "";
+            };
+            const lease = acquireTmuxExtendedKeysLease(cwd, execStub, 12345);
+            assert.match(lease ?? "", /^\/tmp\/tmux-owner-pid\.sock\t12345-/);
+            if (lease)
+                releaseTmuxExtendedKeysLease(cwd, lease, execStub);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("overlapping tmux extended-keys leases restore only after the last holder exits", async () => {
         const cwd = await mkdtemp(join(tmpdir(), "omx-tmux-lease-overlap-"));
         const calls = [];
@@ -1494,6 +1628,145 @@ exit 0
             releaseTmuxExtendedKeysLease(cwd, lease, execStub);
         await rm(cwd, { recursive: true, force: true });
     });
+    it("acquireTmuxExtendedKeysLease reaps dead holders and restores before taking a new lease", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-tmux-dead-holder-acquire-"));
+        try {
+            const leaseDir = join(cwd, ".omx", "state", "tmux-extended-keys");
+            const leasePath = join(leaseDir, "tmp-stale-holder-sock.json");
+            await mkdir(leaseDir, { recursive: true });
+            await writeFile(leasePath, JSON.stringify({
+                originalMode: "off",
+                holders: ["2147483647-stale-holder"],
+            }), "utf-8");
+            const calls = [];
+            const execStub = (_file, args) => {
+                calls.push([...args]);
+                if (args[0] === "display-message")
+                    return "/tmp/stale-holder.sock\n";
+                if (args[0] === "show-options")
+                    return "off\n";
+                return "";
+            };
+            const lease = acquireTmuxExtendedKeysLease(cwd, execStub);
+            assert.equal(typeof lease, "string");
+            const persisted = JSON.parse(await readFile(leasePath, "utf-8"));
+            assert.equal(persisted.holders.length, 1);
+            const holder = persisted.holders[0];
+            const holderId = typeof holder === "string" ? holder : holder?.id ?? "";
+            assert.match(holderId, new RegExp(`^${process.pid}-`));
+            assert.equal(typeof holder === "object" ? holder.pid : process.pid, process.pid);
+            assert.doesNotMatch(JSON.stringify(persisted), /2147483647-stale-holder/);
+            if (lease)
+                releaseTmuxExtendedKeysLease(cwd, lease, execStub);
+            assert.deepEqual(calls, [
+                ["display-message", "-p", "#{socket_path}"],
+                ["set-option", "-sq", "extended-keys", "off"],
+                ["show-options", "-sv", "extended-keys"],
+                ["set-option", "-sq", "extended-keys", "always"],
+                ["set-option", "-sq", "extended-keys", "off"],
+            ]);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("releaseTmuxExtendedKeysLease preserves live legacy string holders", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-tmux-live-legacy-holder-"));
+        try {
+            const leaseDir = join(cwd, ".omx", "state", "tmux-extended-keys");
+            const leasePath = join(leaseDir, "tmp-live-legacy-sock.json");
+            const legacyHolder = `${process.pid}-legacy-holder`;
+            await mkdir(leaseDir, { recursive: true });
+            await writeFile(leasePath, JSON.stringify({
+                originalMode: "off",
+                holders: [legacyHolder],
+            }), "utf-8");
+            const calls = [];
+            const execStub = (_file, args) => {
+                calls.push([...args]);
+                return "";
+            };
+            releaseTmuxExtendedKeysLease(cwd, "/tmp/live-legacy.sock\tmissing-holder", execStub);
+            const persisted = JSON.parse(await readFile(leasePath, "utf-8"));
+            assert.deepEqual(persisted.holders, [legacyHolder]);
+            assert.deepEqual(calls, [], "live legacy string holders should not be restored away");
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("acquireTmuxExtendedKeysLease reaps Linux PID-reuse identity mismatches", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-tmux-pid-reuse-holder-"));
+        try {
+            const leaseDir = join(cwd, ".omx", "state", "tmux-extended-keys");
+            const leasePath = join(leaseDir, "tmp-pid-reuse-sock.json");
+            await mkdir(leaseDir, { recursive: true });
+            await writeFile(leasePath, JSON.stringify({
+                originalMode: "off",
+                holders: [{
+                        id: `${process.pid}-reused-holder`,
+                        pid: process.pid,
+                        platform: "linux",
+                        linuxStartTicks: -1,
+                    }],
+            }), "utf-8");
+            const calls = [];
+            const execStub = (_file, args) => {
+                calls.push([...args]);
+                if (args[0] === "display-message")
+                    return "/tmp/pid-reuse.sock\n";
+                if (args[0] === "show-options")
+                    return "off\n";
+                return "";
+            };
+            const lease = acquireTmuxExtendedKeysLease(cwd, execStub);
+            assert.equal(typeof lease, "string");
+            const persisted = JSON.parse(await readFile(leasePath, "utf-8"));
+            const holderIds = persisted.holders.map((holder) => typeof holder === "string" ? holder : holder.id ?? "");
+            if (process.platform === "linux") {
+                assert.equal(persisted.holders.length, 1);
+                assert.match(holderIds[0] ?? "", new RegExp(`^${process.pid}-`));
+                assert.doesNotMatch(JSON.stringify(persisted), /reused-holder/);
+                assert.deepEqual(calls, [
+                    ["display-message", "-p", "#{socket_path}"],
+                    ["set-option", "-sq", "extended-keys", "off"],
+                    ["show-options", "-sv", "extended-keys"],
+                    ["set-option", "-sq", "extended-keys", "always"],
+                ]);
+            }
+            else {
+                assert.ok(holderIds.includes(`${process.pid}-reused-holder`));
+            }
+            if (lease)
+                releaseTmuxExtendedKeysLease(cwd, lease, execStub);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("releaseTmuxExtendedKeysLease restores when all remaining holders are dead", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-tmux-dead-holder-release-"));
+        try {
+            const leaseDir = join(cwd, ".omx", "state", "tmux-extended-keys");
+            const leasePath = join(leaseDir, "tmp-dead-release-sock.json");
+            await mkdir(leaseDir, { recursive: true });
+            await writeFile(leasePath, JSON.stringify({
+                originalMode: "off",
+                holders: ["2147483647-stale-holder"],
+            }), "utf-8");
+            const calls = [];
+            const execStub = (_file, args) => {
+                calls.push([...args]);
+                return "";
+            };
+            releaseTmuxExtendedKeysLease(cwd, "/tmp/dead-release.sock\tmissing-holder", execStub);
+            assert.ok(!existsSync(leasePath), "stale-only lease file should be removed");
+            assert.deepEqual(calls, [["set-option", "-sq", "extended-keys", "off"]]);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("buildDetachedSessionFinalizeSteps keeps schedule after split-capture and before attach", () => {
         const steps = buildDetachedSessionFinalizeSteps("omx-demo", "%12", "3", true);
         const names = steps.map((step) => step.name);
@@ -1578,6 +1851,12 @@ describe("buildTmuxPaneCommand", () => {
         assert.ok(!result.startsWith("'/bin/sh' -c "), "should not fall back to /bin/sh for supported Homebrew zsh");
         assert.ok(result.includes("source ~/.zshrc"), "should source .zshrc");
     });
+    it("keeps MacPorts zsh instead of downgrading to /bin/sh", () => {
+        const result = buildTmuxPaneCommand("codex", ["--model", "gpt-5"], "/opt/local/bin/zsh");
+        assert.ok(result.startsWith("'/opt/local/bin/zsh' -c "), "should preserve MacPorts zsh when SHELL points to it");
+        assert.ok(!result.startsWith("'/bin/sh' -c "), "should not fall back to /bin/sh for supported MacPorts zsh");
+        assert.ok(result.includes("source ~/.zshrc"), "should source .zshrc");
+    });
     it("wraps command with bash profile sourcing while preserving tmux cwd", () => {
         const result = buildTmuxPaneCommand("codex", [], "/bin/bash");
         assert.ok(result.startsWith("'/bin/bash' -c "), "should start with bash non-login shell to preserve tmux cwd");
@@ -1738,6 +2017,16 @@ describe("team worker launch arg inheritance helpers", () => {
     it("collectInheritableTeamWorkerArgs supports --model=<value> syntax", () => {
         assert.deepEqual(collectInheritableTeamWorkerArgs(["--model=gpt-5.3-codex"]), ["--model", "gpt-5.3-codex"]);
     });
+    it("collectInheritableTeamWorkerArgs preserves only safe model_provider config overrides", () => {
+        assert.deepEqual(collectInheritableTeamWorkerArgs([
+            "-c",
+            'sandbox_mode="danger-full-access"',
+            "-c",
+            'model_provider="cheapRouter"',
+            "--model",
+            "gpt-5.5",
+        ]), ["-c", 'model_provider="cheapRouter"', "--model", "gpt-5.5"]);
+    });
     it("resolveTeamWorkerLaunchArgsEnv merges and normalizes with de-dupe + last reasoning/model wins", () => {
         assert.equal(resolveTeamWorkerLaunchArgsEnv('--dangerously-bypass-approvals-and-sandbox -c model_reasoning_effort="high" --model old-a --no-alt-screen --model=old-b', [
             "-c",