oh-my-codex 0.16.3 → 0.17.0

package/dist/cli/__tests__/setup-install-mode.test.js

@@ -3,7 +3,7 @@ import assert from "node:assert/strict";
 import { existsSync } from "node:fs";
 import { cp, mkdir, mkdtemp, readFile, readdir, rm, writeFile, } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { parse as parseToml } from "@iarna/toml";
 import { setup } from "../setup.js";
 import { uninstall } from "../uninstall.js";
@@ -128,14 +128,71 @@ describe("notify setup scope", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("does not preserve stale OMX dispatcher metadata as previous notify", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-stale-dispatcher-notify-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await mkdir(codexHomeDir, { recursive: true });
+                const metadataPath = join(codexHomeDir, ".omx", "notify-dispatch.json");
+                const stalePkgRoot = join(wd, "old-global", "oh-my-codex");
+                const staleDispatcher = join(stalePkgRoot, "dist", "scripts", "notify-dispatcher.js");
+                await mkdir(dirname(metadataPath), { recursive: true });
+                await writeFile(join(codexHomeDir, "config.toml"), `notify = ["node", "${staleDispatcher}", "--metadata", "${metadataPath}"]\napproval_policy = "on-failure"\n`);
+                await writeFile(metadataPath, JSON.stringify({
+                    managedBy: "oh-my-codex",
+                    version: 1,
+                    previousNotify: [
+                        "node",
+                        staleDispatcher,
+                        "--metadata",
+                        metadataPath,
+                    ],
+                    omxNotify: [
+                        "node",
+                        join(stalePkgRoot, "dist", "scripts", "notify-hook.js"),
+                    ],
+                    dispatcherNotify: ["node", staleDispatcher, "--metadata", metadataPath],
+                }));
+                await withTempCwd(wd, async () => {
+                    await setup({ scope: "user" });
+                });
+                const config = await readFile(join(codexHomeDir, "config.toml"), "utf-8");
+                assert.match(config, /^notify = \["node", ".*notify-hook\.js"\]$/m);
+                assert.doesNotMatch(config, /notify-dispatcher\.js/);
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("does not wrap stale global OMX notify hooks as user notify commands", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-stale-hook-notify-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await mkdir(codexHomeDir, { recursive: true });
+                const staleHook = join("/opt", "homebrew", "lib", "node_modules", "oh-my-codex", "dist", "scripts", "notify-hook.js");
+                await writeFile(join(codexHomeDir, "config.toml"), `notify = ["node", "${staleHook}"]\napproval_policy = "on-failure"\n`);
+                await withTempCwd(wd, async () => {
+                    await setup({ scope: "user" });
+                });
+                const config = await readFile(join(codexHomeDir, "config.toml"), "utf-8");
+                assert.match(config, /^notify = \["node", ".*notify-hook\.js"\]$/m);
+                assert.doesNotMatch(config, /notify-dispatcher\.js/);
+                assert.doesNotMatch(config, /lib\/node_modules\/oh-my-codex\/dist\/scripts\/notify-hook\.js/);
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
 });
 async function assertProjectPluginModeArtifacts(wd) {
     const hooks = await readFile(join(wd, ".codex", "hooks.json"), "utf-8");
     assert.match(hooks, /codex-native-hook\.js/);
     const config = await readFile(join(wd, ".codex", "config.toml"), "utf-8");
-    assert.match(config, /^codex_hooks = true$/m);
+    assert.match(config, /^hooks = true$/m);
     assert.match(config, /^goals = true$/m);
-    assert.doesNotMatch(config, /developer_instructions|notify-hook|mcp_servers/);
+    assert.doesNotMatch(config, /developer_instructions|notify-hook/g);
     assert.equal(existsSync(join(wd, ".codex", "skills", "ask", "SKILL.md")), false);
     assert.equal(existsSync(join(wd, ".codex", "agents", "planner.toml")), false);
     assert.equal(existsSync(join(wd, ".codex", "prompts", "executor.md")), false);
@@ -144,6 +201,7 @@ async function assertProjectPluginModeArtifacts(wd) {
     assert.deepEqual(persisted, {
         scope: "project",
         installMode: "plugin",
+        mcpMode: "none",
     });
 }
 async function captureConsoleOutput(fn) {
@@ -189,6 +247,10 @@ async function seedStalePluginDiscoveryCache(codexHomeDir) {
     await writeFile(join(artifactPath, "skills", "old-only", "SKILL.md"), "# old\n");
     return artifactPath;
 }
+async function packagedPluginCacheDir(codexHomeDir) {
+    const manifest = JSON.parse(await readFile(join(packageRoot, "plugins", "oh-my-codex", ".codex-plugin", "plugin.json"), "utf-8"));
+    return join(codexHomeDir, "plugins", "cache", "oh-my-codex-local", "oh-my-codex", manifest.version);
+}
 describe("omx setup install mode behavior", () => {
     it("summarizes and keeps persisted setup preferences when review chooses keep", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
@@ -208,7 +270,7 @@ describe("omx setup install mode behavior", () => {
                             },
                         });
                     });
-                    assert.match(output, /Setup preference review: keep \(scope=user, installMode=legacy\)/);
+                    assert.match(output, /Setup preference review: keep \(scope=user, installMode=legacy, mcpMode=not recorded\)/);
                     assert.match(output, /Using setup scope: user \(from \.omx\/setup-scope\.json\)/);
                     assert.match(output, /Using setup install mode: legacy \(from \.omx\/setup-scope\.json\)/);
                 });
@@ -237,7 +299,11 @@ describe("omx setup install mode behavior", () => {
                         },
                     });
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "user", installMode: "plugin" });
+                    assert.deepEqual(persisted, {
+                        scope: "user",
+                        installMode: "plugin",
+                        mcpMode: "none",
+                    });
                 });
             });
         }
@@ -260,7 +326,7 @@ describe("omx setup install mode behavior", () => {
                         },
                     });
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "project" });
+                    assert.deepEqual(persisted, { scope: "project", mcpMode: "none" });
                 });
             });
         }
@@ -289,7 +355,11 @@ describe("omx setup install mode behavior", () => {
                     });
                     assert.equal(reviewed, true);
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "user", installMode: "plugin" });
+                    assert.deepEqual(persisted, {
+                        scope: "user",
+                        installMode: "plugin",
+                        mcpMode: "none",
+                    });
                 });
             });
         }
@@ -318,7 +388,11 @@ describe("omx setup install mode behavior", () => {
                     });
                     assert.equal(reviewed, true);
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "user", installMode: "plugin" });
+                    assert.deepEqual(persisted, {
+                        scope: "user",
+                        installMode: "plugin",
+                        mcpMode: "none",
+                    });
                 });
             });
         }
@@ -345,7 +419,11 @@ describe("omx setup install mode behavior", () => {
                         },
                     });
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "user", installMode: "legacy" });
+                    assert.deepEqual(persisted, {
+                        scope: "user",
+                        installMode: "legacy",
+                        mcpMode: "none",
+                    });
                 });
             });
         }
@@ -395,7 +473,43 @@ describe("omx setup install mode behavior", () => {
                 });
             });
             const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-            assert.deepEqual(persisted, { scope: "user", installMode: "plugin" });
+            assert.deepEqual(persisted, {
+                scope: "user",
+                installMode: "plugin",
+                mcpMode: "none",
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("defaults setup to no first-party MCP blocks", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-mcp-mode-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    await setup({ scope: "user", installMode: "legacy" });
+                });
+                const config = await readFile(join(codexHomeDir, "config.toml"), "utf-8");
+                assert.doesNotMatch(config, /^\[mcp_servers\.omx_state\]$/m);
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("emits first-party MCP blocks when compat MCP mode is requested", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-mcp-mode-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    await setup({ scope: "user", installMode: "legacy", mcpMode: "compat" });
+                });
+                const config = await readFile(join(codexHomeDir, "config.toml"), "utf-8");
+                assert.match(config, /^\[mcp_servers\.omx_state\]$/m);
+                const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
+                assert.equal(persisted.mcpMode, "compat");
+            });
         }
         finally {
             await rm(wd, { recursive: true, force: true });
@@ -411,7 +525,11 @@ describe("omx setup install mode behavior", () => {
                     await writeFile(join(pluginDir, ".codex-plugin", "plugin.json"), JSON.stringify({ name: "oh-my-codex", version: "local" }));
                     await setup({ scope: "user" });
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "user", installMode: "plugin" });
+                    assert.deepEqual(persisted, {
+                        scope: "user",
+                        installMode: "plugin",
+                        mcpMode: "none",
+                    });
                     assert.equal(existsSync(join(codexHomeDir, "skills", "ask", "SKILL.md")), false);
                     const hooks = await readFile(join(codexHomeDir, "hooks.json"), "utf-8");
                     assert.match(hooks, /codex-native-hook\.js/);
@@ -431,7 +549,8 @@ describe("omx setup install mode behavior", () => {
                     const output = await captureConsoleOutput(async () => {
                         await setup({ scope: "user", installMode: "plugin" });
                     });
-                    assert.equal(existsSync(cacheDir), false);
+                    assert.equal(existsSync(join(cacheDir, "skills", "old-only", "SKILL.md")), false);
+                    assert.equal(existsSync(join(await packagedPluginCacheDir(codexHomeDir), "skills", "ask", "SKILL.md")), true);
                     assert.match(output, /Invalidated 1 stale Codex plugin discovery cache entry/);
                     assert.equal(existsSync(join(codexHomeDir, "skills", "old-only", "SKILL.md")), false);
                 });
@@ -459,6 +578,24 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("reports plugin cache materialization during dry-run without writing cache", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    const output = await captureConsoleOutput(async () => {
+                        await setup({ scope: "user", installMode: "plugin", dryRun: true });
+                    });
+                    const cacheDir = await packagedPluginCacheDir(codexHomeDir);
+                    assert.equal(existsSync(cacheDir), false);
+                    assert.match(output, /Would install local Codex plugin cache/);
+                });
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("does not prompt for install mode during project-scoped setup", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         let promptCalls = 0;
@@ -474,7 +611,7 @@ describe("omx setup install mode behavior", () => {
             });
             assert.equal(promptCalls, 0);
             const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-            assert.deepEqual(persisted, { scope: "project" });
+            assert.deepEqual(persisted, { scope: "project", mcpMode: "none" });
         }
         finally {
             await rm(wd, { recursive: true, force: true });
@@ -488,11 +625,11 @@ describe("omx setup install mode behavior", () => {
                     await setup({ scope: "user", installMode: "plugin" });
                     await setup({ scope: "project" });
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "project" });
+                    assert.deepEqual(persisted, { scope: "project", mcpMode: "none" });
                     assert.equal(existsSync(join(wd, ".codex", "skills", "ask", "SKILL.md")), true);
                     await setup({ scope: "project" });
                     const repeatedPersisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(repeatedPersisted, { scope: "project" });
+                    assert.deepEqual(repeatedPersisted, { scope: "project", mcpMode: "none" });
                     assert.equal(existsSync(join(wd, ".codex", "agents", "planner.toml")), true);
                     assert.equal(existsSync(join(wd, ".codex", "prompts", "executor.md")), true);
                 });
@@ -510,7 +647,11 @@ describe("omx setup install mode behavior", () => {
                     await setup({ scope: "project", installMode: "plugin" });
                     await setup({ scope: "user" });
                     const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                    assert.deepEqual(persisted, { scope: "user", installMode: "legacy" });
+                    assert.deepEqual(persisted, {
+                        scope: "user",
+                        installMode: "legacy",
+                        mcpMode: "none",
+                    });
                     assert.equal(existsSync(join(codexHomeDir, "skills", "ask", "SKILL.md")), true);
                     assert.equal(existsSync(join(codexHomeDir, "agents", "planner.toml")), true);
                     assert.equal(existsSync(join(codexHomeDir, "prompts", "executor.md")), true);
@@ -549,7 +690,14 @@ describe("omx setup install mode behavior", () => {
                     assert.equal(parsed.marketplaces?.other?.source, "/tmp/other");
                     assert.equal((config.match(/^\[marketplaces\.oh-my-codex-local\]$/gm) ?? [])
                         .length, 1);
-                    assert.match(config, /^codex_hooks = true$/m);
+                    assert.equal((config.match(/^\[plugins\."oh-my-codex@oh-my-codex-local"\]$/gm) ?? [])
+                        .length, 1);
+                    assert.equal(parsed.plugins?.["oh-my-codex@oh-my-codex-local"]?.enabled, true);
+                    const cacheDir = await packagedPluginCacheDir(codexHomeDir);
+                    assert.equal(existsSync(join(cacheDir, ".codex-plugin", "plugin.json")), true);
+                    assert.equal(existsSync(join(cacheDir, "skills", "ask", "SKILL.md")), true);
+                    assert.match(config, /^hooks = true$/m);
+                    assert.doesNotMatch(config, /^codex_hooks = true$/m);
                     assert.doesNotMatch(config, /\[mcp_servers\./);
                     assert.equal(existsSync(join(codexHomeDir, "skills", "ask", "SKILL.md")), false);
                     assert.equal(existsSync(join(codexHomeDir, "agents", "planner.toml")), false);
@@ -561,6 +709,67 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("enables the local Codex plugin while preserving plugin subtable policy", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    const configPath = join(codexHomeDir, "config.toml");
+                    await writeFile(configPath, [
+                        "[plugins.\"oh-my-codex@oh-my-codex-local\"]",
+                        "enabled = false",
+                        "",
+                        "[plugins.\"oh-my-codex@oh-my-codex-local\".mcp_servers.omx_state]",
+                        "enabled = false",
+                        "",
+                    ].join("\n"));
+                    await setup({ scope: "user", installMode: "plugin", force: true });
+                    await setup({ scope: "user", installMode: "plugin", force: true });
+                    const config = await readFile(configPath, "utf-8");
+                    const parsed = parseToml(config);
+                    assert.equal((config.match(/^\[plugins\."oh-my-codex@oh-my-codex-local"\]$/gm) ?? [])
+                        .length, 1);
+                    assert.equal(parsed.plugins?.["oh-my-codex@oh-my-codex-local"]?.enabled, true);
+                    assert.equal(parsed.plugins?.["oh-my-codex@oh-my-codex-local"]?.mcp_servers
+                        ?.omx_state?.enabled, false);
+                });
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("enables plugin MCP subtables only when compat MCP mode is requested", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    const configPath = join(codexHomeDir, "config.toml");
+                    await setup({
+                        scope: "user",
+                        installMode: "plugin",
+                        mcpMode: "compat",
+                        force: true,
+                    });
+                    let parsed = parseToml(await readFile(configPath, "utf-8"));
+                    assert.equal(parsed.plugins?.["oh-my-codex@oh-my-codex-local"]?.mcp_servers
+                        ?.omx_state?.enabled, true);
+                    await setup({
+                        scope: "user",
+                        installMode: "plugin",
+                        mcpMode: "none",
+                        force: true,
+                    });
+                    parsed = parseToml(await readFile(configPath, "utf-8"));
+                    assert.equal(parsed.plugins?.["oh-my-codex@oh-my-codex-local"]?.mcp_servers
+                        ?.omx_state?.enabled, false);
+                });
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("reports plugin marketplace registration during dry-run without mutating config", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
@@ -593,13 +802,13 @@ describe("omx setup install mode behavior", () => {
                     const parsed = parseToml(config);
                     const managedHookStateKeys = Object.keys(parsed.hooks?.state ?? {}).filter((key) => key.includes(`${codexHomeDir}/hooks.json:`));
                     assert.equal(managedHookStateKeys.length, 7);
-                    assert.match(config, /^codex_hooks = true$/m);
-                    assert.doesNotMatch(config, /^hooks = true$/m);
+                    assert.match(config, /^hooks = true$/m);
+                    assert.doesNotMatch(config, /^codex_hooks = true$/m);
                     assert.match(config, /^goals = true$/m);
                     assert.match(config, /^\[hooks\.state\.".*hooks\.json:pre_tool_use:0:0"\]$/m);
                     assert.equal((config.match(/^\[hooks\.state\.".*hooks\.json:pre_tool_use:0:0"\]$/gm) ?? []).length, 1);
                     assert.match(config, /^trusted_hash = "sha256:[a-f0-9]{64}"$/m);
-                    assert.doesNotMatch(config, /developer_instructions|notify-hook|mcp_servers/);
+                    assert.doesNotMatch(config, /developer_instructions|notify-hook/g);
                     assert.equal(existsSync(join(codexHomeDir, "skills", "ask", "SKILL.md")), false);
                     assert.equal(existsSync(join(codexHomeDir, "agents", "planner.toml")), false);
                     assert.equal(existsSync(join(codexHomeDir, "prompts", "executor.md")), false);
@@ -634,8 +843,10 @@ describe("omx setup install mode behavior", () => {
                     assert.match(config, /Setup-owned prompt files and native-agent TOML defaults are intentionally omitted unless explicitly installed/);
                     assert.doesNotMatch(config, /Native subagents live in \.codex\/agents/);
                     assert.doesNotMatch(config, /Treat installed prompts as narrower execution surfaces/);
-                    assert.match(config, /^codex_hooks = true$/m);
-                    assert.doesNotMatch(config, /notify-hook|mcp_servers/);
+                    assert.match(config, /^hooks = true$/m);
+                    assert.doesNotMatch(config, /notify-hook/);
+                    assert.doesNotMatch(config, /^\s*\[mcp_servers[.\]]/m);
+                    assert.match(config, /mcp_servers\.omx_state]\nenabled = false/);
                     const agentsMd = await readFile(join(codexHomeDir, "AGENTS.md"), "utf-8");
                     assert.match(agentsMd, /oh-my-codex - Intelligent Multi-Agent Orchestration/);
                     assert.match(agentsMd, /<!-- omx:generated:agents-md -->/);
@@ -695,7 +906,7 @@ describe("omx setup install mode behavior", () => {
                     });
                     const config = await readFile(configPath, "utf-8");
                     assert.match(config, /^developer_instructions = "custom"$/m);
-                    assert.match(config, /^codex_hooks = true$/m);
+                    assert.match(config, /^hooks = true$/m);
                     assert.equal((config.match(/^developer_instructions\s*=/gm) ?? []).length, 1);
                 });
             });
@@ -721,7 +932,7 @@ describe("omx setup install mode behavior", () => {
                     assert.match(config, /You have oh-my-codex installed/);
                     assert.doesNotMatch(config, /^developer_instructions = "custom"$/m);
                     assert.equal((config.match(/^developer_instructions\s*=/gm) ?? []).length, 1);
-                    assert.match(config, /^codex_hooks = true$/m);
+                    assert.match(config, /^hooks = true$/m);
                     assert.match(config, /^\[hooks\.state\.".*hooks\.json:pre_tool_use:0:0"\]$/m);
                 });
             });
@@ -730,6 +941,27 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("uses legacy codex_hooks only when the installed Codex reports that hook feature", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    await setup({
+                        scope: "user",
+                        installMode: "plugin",
+                        codexFeaturesProbe: () => "codex_hooks                             experimental       true\n",
+                        codexVersionProbe: () => "codex-cli 0.129.0",
+                    });
+                    const config = await readFile(join(codexHomeDir, "config.toml"), "utf-8");
+                    assert.match(config, /^codex_hooks = true$/m);
+                    assert.doesNotMatch(config, /^hooks = true$/m);
+                });
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("preserves existing user hooks while installing plugin-mode native hooks", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
@@ -743,7 +975,7 @@ describe("omx setup install mode behavior", () => {
                     assert.match(hooks, /"UserPromptSubmit"/);
                     assert.match(hooks, /codex-native-hook\.js/);
                     const config = await readFile(join(codexHomeDir, "config.toml"), "utf-8");
-                    assert.match(config, /^codex_hooks = true$/m);
+                    assert.match(config, /^hooks = true$/m);
                 });
             });
         }
@@ -760,6 +992,7 @@ describe("omx setup install mode behavior", () => {
                 assert.deepEqual(persisted, {
                     scope: "project",
                     installMode: "plugin",
+                    mcpMode: "none",
                 });
                 await setup({ scope: "project" });
                 assert.equal(existsSync(join(wd, ".codex", "skills", "ask", "SKILL.md")), false);
@@ -781,7 +1014,7 @@ describe("omx setup install mode behavior", () => {
                 await writeFile(join(wd, ".omx", "setup-scope.json"), JSON.stringify({ scope: "project", installMode: "plugin" }));
                 await setup({ scope: "project", installMode: "legacy" });
                 const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
-                assert.deepEqual(persisted, { scope: "project" });
+                assert.deepEqual(persisted, { scope: "project", mcpMode: "none" });
                 assert.equal(existsSync(join(wd, ".codex", "skills", "ask", "SKILL.md")), true);
                 assert.equal(existsSync(join(wd, ".codex", "agents", "planner.toml")), true);
                 assert.equal(existsSync(join(wd, ".codex", "prompts", "executor.md")), true);
@@ -803,6 +1036,7 @@ describe("omx setup install mode behavior", () => {
                     assert.deepEqual(persisted, {
                         scope: "user",
                         installMode: "legacy",
+                        mcpMode: "none",
                     });
                     assert.equal(existsSync(join(codexHomeDir, "skills", "ask", "SKILL.md")), true);
                     assert.equal(existsSync(join(codexHomeDir, "agents", "planner.toml")), true);
@@ -814,6 +1048,44 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("dedupes plugin-mode hook trust state when switching user setup back to legacy", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    const configPath = join(codexHomeDir, "config.toml");
+                    await setup({ scope: "user", installMode: "plugin", force: true });
+                    const pluginConfig = await readFile(configPath, "utf-8");
+                    const staleUnfencedPluginConfig = pluginConfig
+                        .split(/\r?\n/)
+                        .filter((line) => line.trim() !== "# OMX-owned Codex hook trust state" &&
+                        line.trim() !==
+                            "# Trusts only setup-managed codex-native-hook.js wrappers." &&
+                        line.trim() !== "# End OMX-owned Codex hook trust state")
+                        .join("\n");
+                    await writeFile(configPath, staleUnfencedPluginConfig);
+                    assert.doesNotThrow(() => parseToml(staleUnfencedPluginConfig));
+                    await setup({ scope: "user", installMode: "legacy", force: true });
+                    const legacyConfig = await readFile(configPath, "utf-8");
+                    assert.doesNotThrow(() => parseToml(legacyConfig));
+                    assert.equal(legacyConfig
+                        .split(/\r?\n/)
+                        .filter((line) => line.trim() ===
+                        `[hooks.state."${join(codexHomeDir, "hooks.json")}:post_compact:0:0"]`).length, 1, "legacy setup should replace stale plugin-mode hook trust state instead of duplicating it");
+                    assert.match(legacyConfig, /# OMX-owned Codex hook trust state[\s\S]*# End OMX-owned Codex hook trust state/);
+                    const persisted = JSON.parse(await readFile(join(wd, ".omx", "setup-scope.json"), "utf-8"));
+                    assert.deepEqual(persisted, {
+                        scope: "user",
+                        installMode: "legacy",
+                        mcpMode: "none",
+                    });
+                });
+            });
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("installs project-scoped native hooks when plugin mode is explicitly requested", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
@@ -902,7 +1174,7 @@ describe("omx setup install mode behavior", () => {
                     const hooks = await readFile(hooksPath, "utf-8");
                     assert.match(hooks, /codex-native-hook\.js/);
                     const config = await readFile(configPath, "utf-8");
-                    assert.match(config, /^codex_hooks = true$/m);
+                    assert.match(config, /^hooks = true$/m);
                     assert.doesNotMatch(config, /^\s*(?:notify|developer_instructions)\s*=|^\s*\[mcp_servers[.\]]/m);
                 });
             });