oh-my-codex 0.16.3 → 0.17.0

package/dist/config/generator.js

@@ -11,15 +11,19 @@
  */
 import { readFile, writeFile } from "fs/promises";
 import { existsSync } from "fs";
-import { isAbsolute, join, resolve } from "path";
+import { join, resolve } from "path";
 import TOML from "@iarna/toml";
 import { AGENT_DEFINITIONS } from "../agents/definitions.js";
 import { DEFAULT_FRONTIER_MODEL } from "./models.js";
-import { getOmxFirstPartySetupMcpServers } from "./omx-first-party-mcp.js";
-import { buildManagedCodexHookTrustToml } from "./codex-hooks.js";
+import { DEFAULT_CODEX_HOOK_FEATURE_FLAG, CODEX_HOOK_FEATURE_FLAGS, formatCodexHookFeatureFlagLine, normalizeCodexHookFeatureFlag, } from "./codex-feature-flags.js";
+import { OMX_FIRST_PARTY_MCP_SERVER_NAMES, getOmxFirstPartySetupMcpServers, } from "./omx-first-party-mcp.js";
+import { buildManagedCodexHookTrustToml, } from "./codex-hooks.js";
 function escapeTomlString(value) {
     return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 // ---------------------------------------------------------------------------
 // Top-level OMX keys (must live before any [table] header)
 // ---------------------------------------------------------------------------
@@ -206,23 +210,37 @@ export function getRootTomlArray(config, key) {
         return null;
     }
 }
+function resolveNotifyEntrypoint(command) {
+    if (!/(?:^|[\\/])node(?:\.exe)?$/i.test(command[0] ?? "")) {
+        return command[0];
+    }
+    return command.slice(1).find((arg) => !arg.startsWith("-"));
+}
 export function isOmxManagedNotifyCommand(command, pkgRoot) {
     if (!command)
         return false;
+    const entrypoint = resolveNotifyEntrypoint(command);
+    if (!entrypoint)
+        return false;
+    if (!/(?:^|[\\/])notify-(?:hook|dispatcher)\.js$/.test(entrypoint)) {
+        return false;
+    }
     const managedScripts = pkgRoot
         ? new Set([
             resolve(pkgRoot, "dist", "scripts", "notify-hook.js"),
             resolve(pkgRoot, "dist", "scripts", "notify-dispatcher.js"),
         ])
         : new Set();
-    return command.some((part) => {
-        if (!/(?:^|[\\/])notify-(?:hook|dispatcher)\.js$/.test(part))
-            return false;
-        if (pkgRoot) {
-            return isAbsolute(part) && managedScripts.has(resolve(part));
-        }
-        return /(?:^|[\\/])oh-my-codex(?:[\\/]|$)/.test(part);
-    });
+    if (pkgRoot && managedScripts.has(resolve(entrypoint)))
+        return true;
+    return /(?:^|[\\/])oh-my-codex(?:[\\/]|$)/.test(entrypoint);
+}
+export function sanitizePreviousNotifyCommand(command, pkgRoot) {
+    if (!command || command.length === 0)
+        return null;
+    if (isOmxManagedNotifyCommand(command, pkgRoot))
+        return null;
+    return [...command];
 }
 function getOmxTopLevelLines(pkgRoot, existingConfig = "", modelOverride, notifyCommand = getDefaultNotifyCommand(pkgRoot)) {
     const rootValues = parseRootKeyValues(existingConfig);
@@ -346,16 +364,56 @@ export function stripOmxTopLevelKeys(config) {
 // ---------------------------------------------------------------------------
 // [features] upsert
 // ---------------------------------------------------------------------------
-function upsertFeatureFlags(config) {
+function isFeatureFlagLine(line, featureFlag) {
+    return new RegExp(`^\\s*${featureFlag}\\s*=`).test(line);
+}
+function isAnyCodexHookFeatureFlagLine(line) {
+    return CODEX_HOOK_FEATURE_FLAGS.some((flag) => isFeatureFlagLine(line, flag));
+}
+function upsertCodexHookFeatureFlagInSection(lines, featuresStart, sectionEnd, codexHookFeatureFlag) {
+    const featureFlag = normalizeCodexHookFeatureFlag(codexHookFeatureFlag);
+    let featureFlagIdx = -1;
+    let fallbackAliasIdx = -1;
+    for (let i = featuresStart + 1; i < sectionEnd; i++) {
+        if (isFeatureFlagLine(lines[i], featureFlag)) {
+            featureFlagIdx = i;
+        }
+        else if (isAnyCodexHookFeatureFlagLine(lines[i]) && fallbackAliasIdx < 0) {
+            fallbackAliasIdx = i;
+        }
+    }
+    if (featureFlagIdx < 0 && fallbackAliasIdx >= 0) {
+        featureFlagIdx = fallbackAliasIdx;
+    }
+    if (featureFlagIdx >= 0) {
+        lines[featureFlagIdx] = formatCodexHookFeatureFlagLine(featureFlag);
+    }
+    else {
+        lines.splice(sectionEnd, 0, formatCodexHookFeatureFlagLine(featureFlag));
+        featureFlagIdx = sectionEnd;
+        sectionEnd += 1;
+    }
+    for (let i = sectionEnd - 1; i > featuresStart; i--) {
+        if (i !== featureFlagIdx && isAnyCodexHookFeatureFlagLine(lines[i])) {
+            lines.splice(i, 1);
+            sectionEnd -= 1;
+            if (featureFlagIdx > i)
+                featureFlagIdx -= 1;
+        }
+    }
+    return { sectionEnd, featureFlagIndex: featureFlagIdx };
+}
+function upsertFeatureFlags(config, codexHookFeatureFlag = DEFAULT_CODEX_HOOK_FEATURE_FLAG) {
     const lines = config.split(/\r?\n/);
     const featuresStart = lines.findIndex((line) => /^\s*\[features\]\s*$/.test(line));
+    const hookFeatureFlagLine = formatCodexHookFeatureFlagLine(codexHookFeatureFlag);
     if (featuresStart < 0) {
         const base = config.trimEnd();
         const featureBlock = [
             "[features]",
             "multi_agent = true",
             "child_agents_md = true",
-            "codex_hooks = true",
+            hookFeatureFlagLine,
             "goals = true",
             "",
         ].join("\n");
@@ -381,9 +439,6 @@ function upsertFeatureFlags(config) {
     }
     let multiAgentIdx = -1;
     let childAgentsIdx = -1;
-    let codexHooksIdx = -1;
-    let unsupportedHooksIdx = -1;
-    let goalsIdx = -1;
     for (let i = featuresStart + 1; i < sectionEnd; i++) {
         if (/^\s*multi_agent\s*=/.test(lines[i])) {
             multiAgentIdx = i;
@@ -391,15 +446,6 @@ function upsertFeatureFlags(config) {
         else if (/^\s*child_agents_md\s*=/.test(lines[i])) {
             childAgentsIdx = i;
         }
-        else if (/^\s*hooks\s*=/.test(lines[i])) {
-            unsupportedHooksIdx = i;
-        }
-        else if (/^\s*codex_hooks\s*=/.test(lines[i])) {
-            codexHooksIdx = i;
-        }
-        else if (/^\s*goals\s*=/.test(lines[i])) {
-            goalsIdx = i;
-        }
     }
     if (multiAgentIdx >= 0) {
         lines[multiAgentIdx] = "multi_agent = true";
@@ -415,27 +461,11 @@ function upsertFeatureFlags(config) {
         lines.splice(sectionEnd, 0, "child_agents_md = true");
         sectionEnd += 1;
     }
-    if (codexHooksIdx >= 0) {
-        lines[codexHooksIdx] = "codex_hooks = true";
-    }
-    else if (unsupportedHooksIdx >= 0) {
-        lines[unsupportedHooksIdx] = "codex_hooks = true";
-        codexHooksIdx = unsupportedHooksIdx;
-        unsupportedHooksIdx = -1;
-    }
-    else {
-        lines.splice(sectionEnd, 0, "codex_hooks = true");
-        codexHooksIdx = sectionEnd;
-        sectionEnd += 1;
-    }
-    for (let i = sectionEnd - 1; i > featuresStart; i--) {
-        if (i !== codexHooksIdx && /^\s*hooks\s*=/.test(lines[i])) {
-            lines.splice(i, 1);
-            sectionEnd -= 1;
-            if (codexHooksIdx > i)
-                codexHooksIdx -= 1;
-            if (goalsIdx > i)
-                goalsIdx -= 1;
+    ({ sectionEnd } = upsertCodexHookFeatureFlagInSection(lines, featuresStart, sectionEnd, codexHookFeatureFlag));
+    let goalsIdx = -1;
+    for (let i = featuresStart + 1; i < sectionEnd; i++) {
+        if (/^\s*goals\s*=/.test(lines[i])) {
+            goalsIdx = i;
         }
     }
     if (goalsIdx >= 0) {
@@ -469,29 +499,59 @@ export function stripManagedCodexHookTrustState(config) {
     }
     return kept.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd();
 }
-export function upsertManagedCodexHookTrustState(config, pkgRoot, codexHooksFile) {
-    const stripped = stripManagedCodexHookTrustState(config);
-    const hookTrustToml = buildManagedCodexHookTrustToml(codexHooksFile, pkgRoot);
+function managedCodexHookTrustStateHeaders(hookTrustToml) {
+    const headers = new Set();
+    for (const line of hookTrustToml.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (/^\[hooks\.state\./.test(trimmed)) {
+            headers.add(trimmed);
+        }
+    }
+    return headers;
+}
+function stripUnfencedManagedCodexHookTrustState(config, hookTrustToml) {
+    const managedHeaders = managedCodexHookTrustStateHeaders(hookTrustToml);
+    if (managedHeaders.size === 0)
+        return config;
+    const lines = config.split(/\r?\n/);
+    const kept = [];
+    for (let i = 0; i < lines.length;) {
+        if (!managedHeaders.has(lines[i].trim())) {
+            kept.push(lines[i]);
+            i += 1;
+            continue;
+        }
+        i += 1;
+        while (i < lines.length && !TOML_TABLE_HEADER_PATTERN.test(lines[i])) {
+            i += 1;
+        }
+    }
+    return kept.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd();
+}
+export function upsertManagedCodexHookTrustState(config, pkgRoot, codexHooksFile, options = {}) {
+    const hookTrustToml = buildManagedCodexHookTrustToml(codexHooksFile, pkgRoot, options);
+    const stripped = stripUnfencedManagedCodexHookTrustState(stripManagedCodexHookTrustState(config), hookTrustToml);
     if (!hookTrustToml)
         return `${stripped}\n`;
     return [
         stripped,
         "",
         OMX_HOOK_TRUST_START_MARKER,
-        "# Trusts only setup-managed codex-native-hook.js wrappers.",
+        "# Trusts only setup-managed native hook wrappers.",
         hookTrustToml,
         OMX_HOOK_TRUST_END_MARKER,
         "",
     ].filter((line, index) => index !== 0 || line.length > 0).join("\n");
 }
-export function upsertPluginModeRuntimeFeatureFlags(config) {
+export function upsertPluginModeRuntimeFeatureFlags(config, codexHookFeatureFlag = DEFAULT_CODEX_HOOK_FEATURE_FLAG) {
     const lines = config.split(/\r?\n/);
     const featuresStart = lines.findIndex((line) => /^\s*\[features\]\s*$/.test(line));
+    const hookFeatureFlagLine = formatCodexHookFeatureFlagLine(codexHookFeatureFlag);
     if (featuresStart < 0) {
         const base = config.trimEnd();
         const featureBlock = [
             "[features]",
-            "codex_hooks = true",
+            hookFeatureFlagLine,
             "goals = true",
             "",
         ].join("\n");
@@ -515,43 +575,13 @@ export function upsertPluginModeRuntimeFeatureFlags(config) {
             sectionEnd -= 1;
         }
     }
-    let codexHooksIdx = -1;
-    let unsupportedHooksIdx = -1;
+    ({ sectionEnd } = upsertCodexHookFeatureFlagInSection(lines, featuresStart, sectionEnd, codexHookFeatureFlag));
     let goalsIdx = -1;
     for (let i = featuresStart + 1; i < sectionEnd; i++) {
-        if (/^\s*hooks\s*=/.test(lines[i])) {
-            unsupportedHooksIdx = i;
-        }
-        else if (/^\s*codex_hooks\s*=/.test(lines[i])) {
-            codexHooksIdx = i;
-        }
-        else if (/^\s*goals\s*=/.test(lines[i])) {
+        if (/^\s*goals\s*=/.test(lines[i])) {
             goalsIdx = i;
         }
     }
-    if (codexHooksIdx >= 0) {
-        lines[codexHooksIdx] = "codex_hooks = true";
-    }
-    else if (unsupportedHooksIdx >= 0) {
-        lines[unsupportedHooksIdx] = "codex_hooks = true";
-        codexHooksIdx = unsupportedHooksIdx;
-        unsupportedHooksIdx = -1;
-    }
-    else {
-        lines.splice(sectionEnd, 0, "codex_hooks = true");
-        codexHooksIdx = sectionEnd;
-        sectionEnd++;
-    }
-    for (let i = sectionEnd - 1; i > featuresStart; i--) {
-        if (i !== codexHooksIdx && /^\s*hooks\s*=/.test(lines[i])) {
-            lines.splice(i, 1);
-            sectionEnd--;
-            if (codexHooksIdx > i)
-                codexHooksIdx--;
-            if (goalsIdx > i)
-                goalsIdx--;
-        }
-    }
     if (goalsIdx >= 0) {
         lines[goalsIdx] = "goals = true";
     }
@@ -767,12 +797,13 @@ export function stripOmxFeatureFlags(config) {
  * Preserve native Codex hook enablement without re-adding other OMX feature
  * flags. Used by uninstall when user-owned hooks remain in hooks.json.
  */
-export function upsertCodexHooksFeatureFlag(config) {
+export function upsertCodexHooksFeatureFlag(config, codexHookFeatureFlag = DEFAULT_CODEX_HOOK_FEATURE_FLAG) {
     const lines = config.split(/\r?\n/);
     const featuresStart = lines.findIndex((line) => /^\s*\[features\]\s*$/.test(line));
+    const hookFeatureFlagLine = formatCodexHookFeatureFlagLine(codexHookFeatureFlag);
     if (featuresStart < 0) {
         const base = config.trimEnd();
-        const featureBlock = ["[features]", "codex_hooks = true", ""].join("\n");
+        const featureBlock = ["[features]", hookFeatureFlagLine, ""].join("\n");
         return base.length === 0 ? featureBlock : `${base}\n${featureBlock}`;
     }
     let sectionEnd = lines.length;
@@ -782,31 +813,7 @@ export function upsertCodexHooksFeatureFlag(config) {
             break;
         }
     }
-    let codexHooksIdx = -1;
-    for (let i = featuresStart + 1; i < sectionEnd; i++) {
-        if (/^\s*codex_hooks\s*=/.test(lines[i])) {
-            codexHooksIdx = i;
-            lines[i] = "codex_hooks = true";
-            break;
-        }
-        if (codexHooksIdx < 0 && /^\s*hooks\s*=/.test(lines[i])) {
-            codexHooksIdx = i;
-            lines[i] = "codex_hooks = true";
-        }
-    }
-    if (codexHooksIdx < 0) {
-        lines.splice(sectionEnd, 0, "codex_hooks = true");
-        codexHooksIdx = sectionEnd;
-        sectionEnd += 1;
-    }
-    for (let i = sectionEnd - 1; i > featuresStart; i--) {
-        if (i !== codexHooksIdx && /^\s*hooks\s*=/.test(lines[i])) {
-            lines.splice(i, 1);
-            sectionEnd -= 1;
-            if (codexHooksIdx > i)
-                codexHooksIdx -= 1;
-        }
-    }
+    upsertCodexHookFeatureFlagInSection(lines, featuresStart, sectionEnd, codexHookFeatureFlag);
     return lines.join("\n");
 }
 export function stripOmxEnvSettings(config) {
@@ -822,6 +829,13 @@ export function stripOmxEnvSettings(config) {
  * Check whether a TOML table name belongs to a legacy OMX-managed agent entry.
  * Handles both `agents.name` and `agents."name"` forms.
  */
+function isOmxFirstPartyMcpSection(tableName) {
+    const match = tableName.match(/^mcp_servers\.(?:"([^"]+)"|([A-Za-z0-9_-]+))$/);
+    const name = match?.[1] ?? match?.[2];
+    return Boolean(name &&
+        (OMX_FIRST_PARTY_MCP_SERVER_NAMES.includes(name) ||
+            name === "omx_team_run"));
+}
 function isLegacyOmxAgentSection(tableName) {
     const m = tableName.match(/^agents\.(?:"([^"]+)"|(\w[\w-]*))$/);
     if (!m)
@@ -834,7 +848,8 @@ function isLegacyOmxAgentSection(tableName) {
  * This covers legacy configs that were written before markers were added,
  * or configs where the marker was accidentally removed.
  *
- * Targets: [mcp_servers.omx_*], legacy [agents.<name>] entries, [tui]
+ * Targets: exact first-party [mcp_servers.<name>] entries, retired
+ * [mcp_servers.omx_team_run], and legacy [agents.<name>] entries.
  */
 function stripOrphanedOmxSections(config) {
     const lines = config.split(/\r?\n/);
@@ -848,7 +863,7 @@ function stripOrphanedOmxSections(config) {
             // Note: [tui] is NOT stripped here because it could be user-owned.
             // The marker-based stripExistingOmxBlocks already handles [tui]
             // when it lives inside the OMX marker block.
-            const isOmxSection = /^mcp_servers\.omx_/.test(tableName) ||
+            const isOmxSection = isOmxFirstPartyMcpSection(tableName) ||
                 isLegacyOmxAgentSection(tableName);
             if (isOmxSection) {
                 // Remove preceding OMX comment lines and blank lines
@@ -1088,6 +1103,72 @@ export function stripExistingSharedMcpRegistryBlock(config) {
     }
     return { cleaned, removed };
 }
+function getExistingSharedMcpRegistryBlocks(config) {
+    const blocks = [];
+    let cursor = 0;
+    while (cursor < config.length) {
+        const markerIdx = config.indexOf(SHARED_MCP_REGISTRY_MARKER, cursor);
+        if (markerIdx < 0)
+            break;
+        let blockStart = config.lastIndexOf("\n", markerIdx);
+        blockStart = blockStart >= 0 ? blockStart + 1 : 0;
+        const previousLineEnd = blockStart - 1;
+        if (previousLineEnd >= 0) {
+            const previousLineStart = config.lastIndexOf("\n", previousLineEnd - 1);
+            const previousLine = config.slice(previousLineStart + 1, previousLineEnd);
+            if (/^# =+$/.test(previousLine.trim())) {
+                blockStart = previousLineStart >= 0 ? previousLineStart + 1 : 0;
+            }
+        }
+        let blockEnd = config.length;
+        const endIdx = config.indexOf(SHARED_MCP_REGISTRY_END_MARKER, markerIdx);
+        if (endIdx >= 0) {
+            const endLineBreak = config.indexOf("\n", endIdx);
+            blockEnd = endLineBreak >= 0 ? endLineBreak + 1 : config.length;
+        }
+        blocks.push(config.slice(blockStart, blockEnd));
+        cursor = blockEnd;
+    }
+    return blocks;
+}
+export function extractSharedMcpRegistryServersFromConfig(config) {
+    const servers = [];
+    let sourcePath;
+    for (const block of getExistingSharedMcpRegistryBlocks(config)) {
+        sourcePath ??= block.match(/^# Source:\s*(.+?)\s*$/m)?.[1];
+        let parsed;
+        try {
+            parsed = TOML.parse(block);
+        }
+        catch {
+            continue;
+        }
+        if (!isRecord(parsed) || !isRecord(parsed.mcp_servers))
+            continue;
+        for (const [name, value] of Object.entries(parsed.mcp_servers)) {
+            if (!isRecord(value) || typeof value.command !== "string")
+                continue;
+            const args = Array.isArray(value.args)
+                ? value.args.filter((arg) => typeof arg === "string")
+                : [];
+            const enabled = typeof value.enabled === "boolean" ? value.enabled : true;
+            const timeoutCandidate = typeof value.startup_timeout_sec === "number"
+                ? value.startup_timeout_sec
+                : value.startupTimeoutSec;
+            const startupTimeoutSec = typeof timeoutCandidate === "number" && Number.isFinite(timeoutCandidate)
+                ? timeoutCandidate
+                : undefined;
+            servers.push({
+                name,
+                command: value.command,
+                args,
+                enabled,
+                ...(startupTimeoutSec !== undefined ? { startupTimeoutSec } : {}),
+            });
+        }
+    }
+    return { servers, sourcePath };
+}
 function toMcpServerTableKey(name) {
     if (/^[A-Za-z0-9_-]+$/.test(name)) {
         return `mcp_servers.${name}`;
@@ -1207,11 +1288,25 @@ function getSharedMcpRegistryBlock(servers, sourcePath, existingConfig) {
     lines.push(SHARED_MCP_REGISTRY_END_MARKER);
     return lines.join("\n");
 }
+export function mergeSharedMcpRegistryBlock(config, servers, sourcePath) {
+    const stripped = stripExistingSharedMcpRegistryBlock(config);
+    const existing = stripped.cleaned;
+    const sharedRegistryBlock = getSharedMcpRegistryBlock(servers, sourcePath, existing);
+    const body = existing.trimEnd();
+    const merged = sharedRegistryBlock
+        ? body
+            ? `${body}\n\n${sharedRegistryBlock}\n`
+            : `${sharedRegistryBlock}\n`
+        : body
+            ? `${body}\n`
+            : "";
+    return addDefaultLauncherMcpStartupTimeouts(merged);
+}
 /**
  * OMX table-section block (MCP servers, TUI).
  * Contains ONLY [table] sections — no bare keys.
  */
-function getOmxTablesBlock(pkgRoot, includeTui = true, statusLinePreset = DEFAULT_STATUS_LINE_PRESET, codexHooksFile) {
+function getOmxTablesBlock(pkgRoot, includeTui = true, statusLinePreset = DEFAULT_STATUS_LINE_PRESET, codexHooksFile, hookOptions = {}, includeFirstPartyMcp = false) {
     const lines = [
         "",
         "# ============================================================",
@@ -1219,24 +1314,26 @@ function getOmxTablesBlock(pkgRoot, includeTui = true, statusLinePreset = DEFAUL
         "# Managed by omx setup - manual edits preserved on next setup",
         "# ============================================================",
     ];
-    for (const server of getOmxFirstPartySetupMcpServers(pkgRoot)) {
-        lines.push("");
-        lines.push(server.title);
-        lines.push(`[mcp_servers.${server.name}]`);
-        lines.push(`command = "${escapeTomlString(server.command)}"`);
-        lines.push(`args = [${server.args
-            .map((arg) => `"${escapeTomlString(arg)}"`)
-            .join(", ")}]`);
-        lines.push(`enabled = ${server.enabled ? "true" : "false"}`);
-        if (typeof server.startupTimeoutSec === "number") {
-            lines.push(`startup_timeout_sec = ${server.startupTimeoutSec}`);
+    if (includeFirstPartyMcp) {
+        for (const server of getOmxFirstPartySetupMcpServers(pkgRoot)) {
+            lines.push("");
+            lines.push(server.title);
+            lines.push(`[mcp_servers.${server.name}]`);
+            lines.push(`command = "${escapeTomlString(server.command)}"`);
+            lines.push(`args = [${server.args
+                .map((arg) => `"${escapeTomlString(arg)}"`)
+                .join(", ")}]`);
+            lines.push(`enabled = ${server.enabled ? "true" : "false"}`);
+            if (typeof server.startupTimeoutSec === "number") {
+                lines.push(`startup_timeout_sec = ${server.startupTimeoutSec}`);
+            }
         }
     }
-    const hookTrustToml = buildManagedCodexHookTrustToml(codexHooksFile, pkgRoot);
+    const hookTrustToml = buildManagedCodexHookTrustToml(codexHooksFile, pkgRoot, hookOptions);
     if (hookTrustToml) {
         lines.push("");
         lines.push("# OMX-owned Codex hook trust state");
-        lines.push("# Trusts only setup-managed codex-native-hook.js wrappers.");
+        lines.push("# Trusts only setup-managed native hook wrappers.");
         lines.push(hookTrustToml);
         lines.push("# End OMX-owned Codex hook trust state");
     }
@@ -1295,11 +1392,15 @@ export function buildMergedConfig(existingConfig, pkgRoot, options = {}) {
     }
     existing = stripOrphanedManagedNotify(existing, pkgRoot);
     existing = stripManagedCodexHookTrustState(existing);
+    existing = stripUnfencedManagedCodexHookTrustState(existing, buildManagedCodexHookTrustToml(options.codexHooksFile, pkgRoot, {
+        codexHomeDir: options.codexHomeDir,
+        platform: options.hookCommandPlatform,
+    }));
     if (options.modelOverride) {
         existing = stripRootLevelKeys(existing, ["model"]);
     }
     existing = stripOrphanedOmxSections(existing);
-    existing = upsertFeatureFlags(existing);
+    existing = upsertFeatureFlags(existing, options.codexHookFeatureFlag);
     existing = upsertEnvSettings(existing);
     existing = upsertAgentsSettings(existing);
     const tuiUpsert = includeTui
@@ -1311,7 +1412,10 @@ export function buildMergedConfig(existingConfig, pkgRoot, options = {}) {
     const topLines = getOmxTopLevelLines(pkgRoot, existing, options.modelOverride, options.notifyCommand === undefined
         ? getDefaultNotifyCommand(pkgRoot)
         : options.notifyCommand);
-    const tablesBlock = getOmxTablesBlock(pkgRoot, includeTui && !tuiUpsert.hadExistingTui, statusLinePreset, options.codexHooksFile);
+    const tablesBlock = getOmxTablesBlock(pkgRoot, includeTui && !tuiUpsert.hadExistingTui, statusLinePreset, options.codexHooksFile, {
+        codexHomeDir: options.codexHomeDir,
+        platform: options.hookCommandPlatform,
+    }, options.includeFirstPartyMcp === true);
     const sharedRegistryBlock = getSharedMcpRegistryBlock(options.sharedMcpServers ?? [], options.sharedMcpRegistrySource, existing);
     let body = existing.trimEnd();
     if (sharedRegistryBlock) {