oh-my-codex 0.17.3 → 0.18.1

package/crates/omx-sparkshell/tests/execution.rs

@@ -1,7 +1,11 @@
 use std::env;
 use std::fs;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
 use std::path::{Path, PathBuf};
 use std::process::Command;
+use std::sync::{Arc, Mutex};
+use std::thread::{self, JoinHandle};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 fn sparkshell_bin() -> &'static str {
@@ -32,6 +36,80 @@ fn write_executable(path: &Path, body: &str) {
     }
 }
 
+fn start_api_server<F>(expected_requests: usize, mut handler: F) -> (String, JoinHandle<()>)
+where
+    F: FnMut(String) -> (u16, String) + Send + 'static,
+{
+    let listener = TcpListener::bind("127.0.0.1:0").expect("bind api server");
+    let address = listener.local_addr().expect("api address");
+    let handle = thread::spawn(move || {
+        for _ in 0..expected_requests {
+            let (stream, _) = listener.accept().expect("accept api request");
+            let request = read_http_request(stream.try_clone().expect("clone stream"));
+            let (status, body) = handler(request);
+            write_http_response(stream, status, &body);
+        }
+    });
+    (format!("http://{}", address), handle)
+}
+
+fn read_http_request(mut stream: TcpStream) -> String {
+    let mut buffer = Vec::new();
+    let mut scratch = [0; 1024];
+    loop {
+        let count = stream.read(&mut scratch).expect("read request");
+        assert!(count > 0, "connection closed before request headers");
+        buffer.extend_from_slice(&scratch[..count]);
+        if buffer.windows(4).any(|window| window == b"\r\n\r\n") {
+            break;
+        }
+    }
+    let request = String::from_utf8_lossy(&buffer).into_owned();
+    let content_length = request
+        .lines()
+        .find_map(|line| {
+            line.strip_prefix("Content-Length:")
+                .or_else(|| line.strip_prefix("content-length:"))
+                .and_then(|value| value.trim().parse::<usize>().ok())
+        })
+        .unwrap_or(0);
+    let body_start = buffer
+        .windows(4)
+        .position(|window| window == b"\r\n\r\n")
+        .expect("header boundary")
+        + 4;
+    while buffer.len() - body_start < content_length {
+        let count = stream.read(&mut scratch).expect("read request body");
+        assert!(count > 0, "connection closed before request body");
+        buffer.extend_from_slice(&scratch[..count]);
+    }
+    String::from_utf8_lossy(&buffer).into_owned()
+}
+
+fn write_http_response(mut stream: TcpStream, status: u16, body: &str) {
+    let reason = if (200..300).contains(&status) {
+        "OK"
+    } else {
+        "ERROR"
+    };
+    let response = format!(
+        "HTTP/1.1 {status} {reason}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+        body.len()
+    );
+    stream
+        .write_all(response.as_bytes())
+        .expect("write response");
+}
+
+fn response_json(text: &str) -> String {
+    format!(
+        "{{\"object\":\"response\",\"output_text\":\"{}\"}}",
+        text.replace('\\', "\\\\")
+            .replace('"', "\\\"")
+            .replace('\n', "\\n")
+    )
+}
+
 #[test]
 fn raw_mode_preserves_stdout_and_stderr() {
     let output = Command::new(sparkshell_bin())
@@ -48,27 +126,19 @@ fn raw_mode_preserves_stdout_and_stderr() {
 }
 
 #[test]
-fn summary_mode_uses_codex_exec_and_model_override() {
-    let temp = unique_temp_dir("codex-success");
-    let codex = temp.join("codex");
-    let args_log = temp.join("args.log");
-    let prompt_log = temp.join("prompt.log");
-    write_executable(
-        &codex,
-        &format!(
-            "#!/bin/sh\nprintf '%s\n' \"$@\" > '{}'\ncat > '{}'\nprintf '%s\n' '- summary: command produced long output' '- warnings: stderr was empty'\n",
-            args_log.display(),
-            prompt_log.display()
-        ),
-    );
+fn summary_mode_uses_local_api_and_model_override() {
+    let request_log = Arc::new(Mutex::new(String::new()));
+    let request_log_for_server = Arc::clone(&request_log);
+    let (base_url, server) = start_api_server(1, move |request| {
+        *request_log_for_server.lock().expect("request log") = request;
+        (
+            200,
+            response_json("- summary: command produced long output\n- warnings: stderr was empty"),
+        )
+    });
 
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .env("OMX_SPARKSHELL_MODEL", "spark-test-model")
         .arg("sh")
@@ -76,6 +146,7 @@ fn summary_mode_uses_codex_exec_and_model_override() {
         .arg("printf 'one\ntwo\n'")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
     let stdout = String::from_utf8_lossy(&output.stdout);
@@ -83,42 +154,65 @@ fn summary_mode_uses_codex_exec_and_model_override() {
     assert!(stdout.contains("- warnings: stderr was empty"));
     assert!(String::from_utf8_lossy(&output.stderr).is_empty());
 
-    let args = fs::read_to_string(args_log).expect("args log");
-    assert!(args.contains("exec"));
-    assert!(args.contains("--model"));
-    assert!(args.contains("spark-test-model"));
-    assert!(args.contains("model_reasoning_effort=\"low\""));
+    let request = request_log.lock().expect("request log");
+    assert!(request.starts_with("POST /v1/responses HTTP/1.1"));
+    assert!(request.contains("\"model\":\"spark-test-model\""));
+    assert!(request.contains("\"reasoning\":{\"effort\":\"low\"}"));
+    assert!(request.contains("Command family: generic-shell"));
+    assert!(request.contains("<<<STDOUT"));
+    assert!(request.contains("one\\ntwo"));
+}
 
-    let prompt = fs::read_to_string(prompt_log).expect("prompt log");
-    assert!(prompt.contains("Command family: generic-shell"));
-    assert!(prompt.contains("<<<STDOUT"));
-    assert!(prompt.contains("one\ntwo"));
+#[test]
+fn summary_mode_redacts_secret_like_output_before_prompt_request() {
+    let request_log = Arc::new(Mutex::new(String::new()));
+    let request_log_for_server = Arc::clone(&request_log);
+    let (base_url, server) = start_api_server(1, move |request| {
+        *request_log_for_server.lock().expect("request log") = request;
+        (200, response_json("- summary: redacted output summarized"))
+    });
 
-    let _ = fs::remove_dir_all(temp);
+    let output = Command::new(sparkshell_bin())
+        .env("OMX_API_BASE_URL", base_url)
+        .env("OMX_SPARKSHELL_LINES", "1")
+        .env("CHILD_API_TOKEN", "super-secret-token")
+        .env("CHILD_BEARER", "bearer-secret-token")
+        .arg("sh")
+        .arg("-c")
+        .arg("printf 'API_TOKEN=%s\\nline-2\\n' \"$CHILD_API_TOKEN\"; printf 'Authorization: Bearer %s\\n' \"$CHILD_BEARER\" >&2")
+        .output()
+        .expect("run sparkshell");
+    server.join().expect("api server");
+
+    assert!(output.status.success());
+    assert!(String::from_utf8_lossy(&output.stdout).contains("redacted output summarized"));
+
+    let request = request_log.lock().expect("request log");
+    assert!(request.contains("API_TOKEN=[REDACTED]"));
+    assert!(request.contains("Authorization: Bearer [REDACTED]"));
+    assert!(request.contains("line-2"));
+    assert!(!request.contains("super-secret-token"));
+    assert!(!request.contains("bearer-secret-token"));
 }
 
 #[test]
 fn summary_mode_injects_model_instructions_file_override() {
-    let temp = unique_temp_dir("codex-instructions-file");
-    let codex = temp.join("codex");
-    let args_log = temp.join("args.log");
+    let temp = unique_temp_dir("api-instructions-file");
     let instructions_file = temp.join("sparkshell-lightweight-AGENTS.md");
-    write_executable(
-        &codex,
-        &format!(
-            "#!/bin/sh\nprintf '%s\n' \"$@\" > '{}'\nprintf '%s\n' '- summary: command produced long output'\n",
-            args_log.display()
-        ),
-    );
     fs::write(&instructions_file, "# sparkshell instructions\n").expect("write instructions file");
 
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
+    let request_log = Arc::new(Mutex::new(String::new()));
+    let request_log_for_server = Arc::clone(&request_log);
+    let (base_url, server) = start_api_server(1, move |request| {
+        *request_log_for_server.lock().expect("request log") = request;
+        (
+            200,
+            response_json("- summary: command produced long output"),
+        )
+    });
+
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .env(
             "OMX_SPARKSHELL_MODEL_INSTRUCTIONS_FILE",
@@ -129,87 +223,64 @@ fn summary_mode_injects_model_instructions_file_override() {
         .arg("printf 'one\ntwo\n'")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
-    let args = fs::read_to_string(args_log).expect("args log");
-    assert!(args.contains("model_reasoning_effort=\"low\""));
-    assert!(args.contains(&format!(
-        "model_instructions_file=\"{}\"",
-        instructions_file
-            .display()
-            .to_string()
-            .replace('\\', "\\\\")
-            .replace('"', "\\\"")
-    )));
+    let request = request_log.lock().expect("request log");
+    assert!(request.contains("\"reasoning\":{\"effort\":\"low\"}"));
+    assert!(request.contains("\"instructions\":\"# sparkshell instructions\\n\""));
 
     let _ = fs::remove_dir_all(temp);
 }
 
 #[test]
 fn summary_failure_falls_back_to_raw_output_with_notice() {
-    let temp = unique_temp_dir("codex-fail");
-    let codex = temp.join("codex");
-    write_executable(
-        &codex,
-        "#!/bin/sh\nprintf '%s\n' 'bridge failed' >&2\nexit 9\n",
-    );
+    let (base_url, server) = start_api_server(1, |_request| {
+        (503, "{\"error\":\"bridge failed\"}".to_string())
+    });
 
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .arg("/bin/sh")
         .arg("-c")
         .arg("printf 'one\ntwo\n'; printf 'child-err\n' >&2")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
     assert_eq!(String::from_utf8_lossy(&output.stdout), "one\ntwo\n");
     let stderr = String::from_utf8_lossy(&output.stderr);
     assert!(stderr.contains("child-err"));
     assert!(stderr.contains("summary unavailable"));
-
-    let _ = fs::remove_dir_all(temp);
+    assert!(stderr.contains("showing raw output instead"));
 }
 
 #[test]
 fn summary_mode_retries_with_fallback_model_when_spark_is_unavailable() {
-    let temp = unique_temp_dir("codex-fallback-model");
-    let codex = temp.join("codex");
-    let args_log = temp.join("args.log");
-    write_executable(
-        &codex,
-        &format!(
-            "#!/bin/sh
-printf '%s\n' \"$@\" >> '{}'
-model=''
-prev=''
-for arg in \"$@\"; do
-  if [ \"$prev\" = '--model' ]; then model=\"$arg\"; fi
-  prev=\"$arg\"
-done
-if [ \"$model\" = 'spark-test-model' ]; then
-  printf '%s\n' 'rate limit exceeded for spark model' >&2
-  exit 17
-fi
-printf '%s\n' '- summary: fallback model recovered summary'
-",
-            args_log.display()
-        ),
-    );
+    let request_log = Arc::new(Mutex::new(Vec::new()));
+    let request_log_for_server = Arc::clone(&request_log);
+    let (base_url, server) = start_api_server(2, move |request| {
+        request_log_for_server
+            .lock()
+            .expect("request log")
+            .push(request.clone());
+        if request.contains("\"model\":\"spark-test-model\"") {
+            (
+                429,
+                "{\"error\":\"rate limit exceeded for spark model\"}".to_string(),
+            )
+        } else {
+            (
+                200,
+                response_json("- summary: fallback model recovered summary"),
+            )
+        }
+    });
 
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .env("OMX_SPARKSHELL_MODEL", "spark-test-model")
         .env("OMX_SPARKSHELL_FALLBACK_MODEL", "frontier-test-model")
@@ -218,47 +289,36 @@ printf '%s\n' '- summary: fallback model recovered summary'
         .arg("printf 'one\ntwo\n'")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
     assert!(String::from_utf8_lossy(&output.stdout).contains("fallback model recovered summary"));
     assert!(String::from_utf8_lossy(&output.stderr).is_empty());
 
-    let args = fs::read_to_string(args_log).expect("args log");
-    assert!(args.contains("spark-test-model"));
-    assert!(args.contains("frontier-test-model"));
-
-    let _ = fs::remove_dir_all(temp);
+    let requests = request_log.lock().expect("request log");
+    assert_eq!(requests.len(), 2);
+    assert!(requests[0].contains("\"model\":\"spark-test-model\""));
+    assert!(requests[1].contains("\"model\":\"frontier-test-model\""));
 }
 
 #[test]
 fn summary_mode_reports_both_models_when_fallback_also_fails() {
-    let temp = unique_temp_dir("codex-fallback-model-fail");
-    let codex = temp.join("codex");
-    write_executable(
-        &codex,
-        "#!/bin/sh
-model=''
-prev=''
-for arg in \"$@\"; do
-  if [ \"$prev\" = '--model' ]; then model=\"$arg\"; fi
-  prev=\"$arg\"
-done
-if [ \"$model\" = 'spark-test-model' ]; then
-  printf '%s\n' 'quota exhausted for spark model' >&2
-  exit 17
-fi
-printf '%s\n' 'fallback backend unavailable' >&2
-exit 29
-",
-    );
+    let (base_url, server) = start_api_server(2, |request| {
+        if request.contains("\"model\":\"spark-test-model\"") {
+            (
+                429,
+                "{\"error\":\"quota exhausted for spark model\"}".to_string(),
+            )
+        } else {
+            (
+                503,
+                "{\"error\":\"fallback backend unavailable\"}".to_string(),
+            )
+        }
+    });
 
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .env("OMX_SPARKSHELL_MODEL", "spark-test-model")
         .env("OMX_SPARKSHELL_FALLBACK_MODEL", "frontier-test-model")
@@ -267,6 +327,7 @@ exit 29
         .arg("printf 'one\ntwo\n'; printf 'child-err\n' >&2")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
     assert_eq!(String::from_utf8_lossy(&output.stdout), "one\ntwo\n");
@@ -274,48 +335,34 @@ exit 29
     assert!(stderr.contains("child-err"));
     assert!(stderr.contains("primary model `spark-test-model`"));
     assert!(stderr.contains("fallback model `frontier-test-model`"));
-
-    let _ = fs::remove_dir_all(temp);
 }
 
 #[test]
 fn summary_mode_preserves_child_exit_code() {
-    let temp = unique_temp_dir("codex-exit");
-    let codex = temp.join("codex");
-    write_executable(
-        &codex,
-        "#!/bin/sh\nprintf '%s\n' '- failures: command exited non-zero'\n",
-    );
+    let (base_url, server) = start_api_server(1, |_request| {
+        (200, response_json("- failures: command exited non-zero"))
+    });
 
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .arg("sh")
         .arg("-c")
         .arg("printf 'one\ntwo\n'; exit 7")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert_eq!(output.status.code(), Some(7));
     assert!(String::from_utf8_lossy(&output.stdout).contains("- failures: command exited non-zero"));
     assert!(String::from_utf8_lossy(&output.stderr).is_empty());
-
-    let _ = fs::remove_dir_all(temp);
 }
 
 #[test]
 fn tmux_pane_mode_captures_large_tail_and_summarizes() {
     let temp = unique_temp_dir("tmux-pane-summary");
     let tmux = temp.join("tmux");
-    let codex = temp.join("codex");
     let args_log = temp.join("tmux-args.log");
-    let prompt_log = temp.join("pane-prompt.log");
-
     write_executable(
         &tmux,
         &format!(
@@ -323,13 +370,16 @@ fn tmux_pane_mode_captures_large_tail_and_summarizes() {
             args_log.display()
         ),
     );
-    write_executable(
-        &codex,
-        &format!(
-            "#!/bin/sh\ncat > '{}'\nprintf '%s\n' '- summary: tmux pane summarized' '- warnings: tail captured'\n",
-            prompt_log.display()
-        ),
-    );
+
+    let request_log = Arc::new(Mutex::new(String::new()));
+    let request_log_for_server = Arc::clone(&request_log);
+    let (base_url, server) = start_api_server(1, move |request| {
+        *request_log_for_server.lock().expect("request log") = request;
+        (
+            200,
+            response_json("- summary: tmux pane summarized\n- warnings: tail captured"),
+        )
+    });
 
     let path = format!(
         "{}:{}",
@@ -338,6 +388,7 @@ fn tmux_pane_mode_captures_large_tail_and_summarizes() {
     );
     let output = Command::new(sparkshell_bin())
         .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .arg("--tmux-pane")
         .arg("%17")
@@ -345,6 +396,7 @@ fn tmux_pane_mode_captures_large_tail_and_summarizes() {
         .arg("400")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
     let stdout = String::from_utf8_lossy(&output.stdout);
@@ -356,36 +408,16 @@ fn tmux_pane_mode_captures_large_tail_and_summarizes() {
     assert!(tmux_args.contains("%17"));
     assert!(tmux_args.contains("-400"));
 
-    let prompt = fs::read_to_string(prompt_log).expect("prompt log");
-    assert!(prompt.contains("Command: tmux capture-pane"));
-    assert!(prompt.contains("line-1"));
+    let request = request_log.lock().expect("request log");
+    assert!(request.contains("Command: tmux capture-pane"));
+    assert!(request.contains("line-1"));
 
     let _ = fs::remove_dir_all(temp);
 }
 
 #[test]
 fn raw_mode_keeps_boundary_output_without_summary() {
-    let temp = unique_temp_dir("boundary-raw");
-    let codex = temp.join("codex");
-    let codex_log = temp.join("codex.log");
-    write_executable(
-        &codex,
-        &format!(
-            "#!/bin/sh
-printf '%s\n' invoked > '{}'
-exit 0
-",
-            codex_log.display()
-        ),
-    );
-
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
         .env("OMX_SPARKSHELL_LINES", "2")
         .arg("sh")
         .arg("-c")
@@ -394,67 +426,47 @@ exit 0
         .expect("run sparkshell");
 
     assert!(output.status.success());
-    assert_eq!(
-        String::from_utf8_lossy(&output.stdout),
-        "one
-two
-"
-    );
-    assert!(
-        !codex_log.exists(),
-        "codex should not run at the raw/summary boundary"
-    );
-
-    let _ = fs::remove_dir_all(temp);
+    assert_eq!(String::from_utf8_lossy(&output.stdout), "one\ntwo\n");
 }
 
 #[test]
 fn summary_mode_uses_combined_stdout_and_stderr_threshold() {
-    let temp = unique_temp_dir("combined-threshold");
-    let codex = temp.join("codex");
-    let prompt_log = temp.join("prompt.log");
-    write_executable(
-        &codex,
-        &format!(
-            "#!/bin/sh
-cat > '{}'
-printf '%s\n' '- summary: combined output exceeded threshold'
-",
-            prompt_log.display()
-        ),
-    );
+    let request_log = Arc::new(Mutex::new(String::new()));
+    let request_log_for_server = Arc::clone(&request_log);
+    let (base_url, server) = start_api_server(1, move |request| {
+        *request_log_for_server.lock().expect("request log") = request;
+        (
+            200,
+            response_json("- summary: combined output exceeded threshold"),
+        )
+    });
 
-    let path = format!(
-        "{}:{}",
-        temp.display(),
-        env::var("PATH").unwrap_or_default()
-    );
     let output = Command::new(sparkshell_bin())
-        .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "2")
         .arg("sh")
         .arg("-c")
         .arg("printf 'one\n' && printf 'warn\nextra\n' >&2")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
     assert!(String::from_utf8_lossy(&output.stdout).contains("combined output exceeded threshold"));
-    let prompt = fs::read_to_string(prompt_log).expect("prompt log");
-    assert!(prompt.contains("<<<STDERR"));
-    assert!(prompt.contains(
-        "warn
-extra"
-    ));
-
-    let _ = fs::remove_dir_all(temp);
+    let request = request_log.lock().expect("request log");
+    assert!(request.contains("<<<STDERR"));
+    assert!(request.contains("warn\\nextra"));
 }
 
 #[test]
-fn summary_failure_when_codex_is_missing_falls_back_to_raw_output() {
-    let empty_path = unique_temp_dir("missing-codex");
+fn summary_failure_when_api_is_missing_falls_back_to_raw_output() {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("reserve port");
+    let base_url = format!("http://{}", listener.local_addr().expect("address"));
+    drop(listener);
+
     let output = Command::new(sparkshell_bin())
-        .env("PATH", empty_path.display().to_string())
+        .env("OMX_API_BASE_URL", base_url)
+        .env("OMX_SPARKSHELL_SUMMARY_TIMEOUT_MS", "500")
         .env("OMX_SPARKSHELL_LINES", "1")
         .arg("/bin/sh")
         .arg("-c")
@@ -463,41 +475,53 @@ fn summary_failure_when_codex_is_missing_falls_back_to_raw_output() {
         .expect("run sparkshell");
 
     assert!(output.status.success());
-    assert_eq!(
-        String::from_utf8_lossy(&output.stdout),
-        "one
-two
-"
-    );
+    assert_eq!(String::from_utf8_lossy(&output.stdout), "one\ntwo\n");
     let stderr = String::from_utf8_lossy(&output.stderr);
     assert!(stderr.contains("child-err"));
     assert!(stderr.contains("summary unavailable"));
+    assert!(stderr.contains("showing raw output instead"));
+}
 
-    let _ = fs::remove_dir_all(empty_path);
+#[test]
+fn json_summary_failure_reports_raw_output_omitted() {
+    let (base_url, server) = start_api_server(1, |_request| {
+        (503, "{\"error\":\"bridge failed\"}".to_string())
+    });
+
+    let output = Command::new(sparkshell_bin())
+        .env("OMX_API_BASE_URL", base_url)
+        .env("OMX_SPARKSHELL_LINES", "1")
+        .arg("--json")
+        .arg("sh")
+        .arg("-c")
+        .arg("printf 'one\ntwo\n'")
+        .output()
+        .expect("run sparkshell");
+    server.join().expect("api server");
+
+    assert!(output.status.success());
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("summary unavailable"));
+    assert!(stdout.contains("raw output omitted from JSON report"));
+    assert!(!stdout.contains("raw output included"));
+    assert!(String::from_utf8_lossy(&output.stderr).is_empty());
 }
 
 #[test]
 fn tmux_pane_mode_uses_default_tail_lines_when_not_overridden() {
     let temp = unique_temp_dir("tmux-default-tail");
     let tmux = temp.join("tmux");
-    let codex = temp.join("codex");
     let args_log = temp.join("tmux-args.log");
     write_executable(
         &tmux,
         &format!(
-            "#!/bin/sh
-printf '%s\n' \"$@\" > '{}'
-printf 'line-1\nline-2\nline-3\n'
-",
+            "#!/bin/sh\nprintf '%s\n' \"$@\" > '{}'\nprintf 'line-1\nline-2\nline-3\n'\n",
             args_log.display()
         ),
     );
-    write_executable(
-        &codex,
-        "#!/bin/sh
-printf '%s\n' '- summary: used default tmux tail'
-",
-    );
+    let (base_url, server) = start_api_server(1, |_request| {
+        (200, response_json("- summary: used default tmux tail"))
+    });
 
     let path = format!(
         "{}:{}",
@@ -506,11 +530,13 @@ printf '%s\n' '- summary: used default tmux tail'
     );
     let output = Command::new(sparkshell_bin())
         .env("PATH", path)
+        .env("OMX_API_BASE_URL", base_url)
         .env("OMX_SPARKSHELL_LINES", "1")
         .arg("--tmux-pane")
         .arg("%21")
         .output()
         .expect("run sparkshell");
+    server.join().expect("api server");
 
     assert!(output.status.success());
     let tmux_args = fs::read_to_string(args_log).expect("tmux args");
@@ -519,3 +545,442 @@ printf '%s\n' '- summary: used default tmux tail'
 
     let _ = fs::remove_dir_all(temp);
 }
+
+#[test]
+fn summary_module_does_not_shell_out_to_codex() {
+    let source =
+        fs::read_to_string(Path::new(env!("CARGO_MANIFEST_DIR")).join("src/codex_bridge.rs"))
+            .expect("source");
+    assert!(!source.contains("Command::new(\"codex\")"));
+    assert!(!source.contains(".arg(\"exec\")"));
+    assert!(!source.contains("codex exec"));
+}
+
+#[test]
+fn json_mode_emits_machine_readable_contract() {
+    let output = Command::new(sparkshell_bin())
+        .arg("--json")
+        .arg("sh")
+        .arg("-c")
+        .arg("printf 'ok\n'")
+        .output()
+        .expect("run sparkshell");
+
+    assert!(output.status.success());
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("\"ok\": true"));
+    assert!(stdout.contains("\"mode\": \"command\""));
+    assert!(stdout.contains("\"status\": \"ok\""));
+    assert!(stdout.contains("\"summary\":"));
+    assert!(stdout.contains("\"evidence\":"));
+    assert!(stdout.contains("\"raw_hash\":"));
+}
+
+#[test]
+fn json_mode_reports_failed_command_details() {
+    let output = Command::new(sparkshell_bin())
+        .arg("--json")
+        .arg("sh")
+        .arg("-c")
+        .arg("printf 'bad\n' >&2; exit 9")
+        .output()
+        .expect("run sparkshell");
+
+    assert_eq!(output.status.code(), Some(9));
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("\"ok\": false"));
+    assert!(stdout.contains("\"status\": \"failed\""));
+    assert!(stdout.contains("\"exit_code\": 9"));
+    assert!(stdout.contains("bad"));
+}
+
+#[test]
+fn json_mode_classifies_auth_errors() {
+    let output = Command::new(sparkshell_bin())
+        .arg("--json")
+        .arg("sh")
+        .arg("-c")
+        .arg("printf 'Authorization failed\n' >&2; exit 1")
+        .output()
+        .expect("run sparkshell");
+
+    assert_eq!(output.status.code(), Some(1));
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("\"classification\": \"auth_error\""));
+    assert!(stdout.contains("authentication-like error"));
+}
+
+#[test]
+fn direct_command_preserves_child_json_flag() {
+    let temp = unique_temp_dir("child-json-flag");
+    let script = temp.join("echo-argv");
+    write_executable(
+        &script,
+        r#"#!/usr/bin/env bash
+printf '%s\n' "$@"
+"#,
+    );
+
+    let output = Command::new(sparkshell_bin())
+        .arg(script)
+        .arg("--json")
+        .arg("value")
+        .output()
+        .expect("run sparkshell");
+
+    assert!(output.status.success());
+    assert_eq!(String::from_utf8_lossy(&output.stdout), "--json\nvalue\n");
+    let _ = fs::remove_dir_all(temp);
+}
+
+#[test]
+fn team_diagnostics_reads_last_turn_at_heartbeat() {
+    let temp = unique_temp_dir("last-turn-heartbeat");
+    let worker_dir = temp.join("team/demo/workers/worker-1");
+    fs::create_dir_all(&worker_dir).expect("worker dir");
+    fs::write(
+        worker_dir.join("heartbeat.json"),
+        r#"{"last_turn_at":"1970-01-01T00:00:00.000Z"}"#,
+    )
+    .expect("heartbeat");
+    fs::write(
+        worker_dir.join("status.json"),
+        r#"{"state":"working","current_task_id":"1","updated_at":"2026-05-17T20:00:00.000Z"}"#,
+    )
+    .expect("status");
+
+    let output = Command::new(sparkshell_bin())
+        .env("OMX_TEAM_STATE_ROOT", temp.display().to_string())
+        .arg("--json")
+        .arg("--team")
+        .arg("demo")
+        .arg("--worker")
+        .arg("worker-1")
+        .arg("printf")
+        .arg("ok\n")
+        .output()
+        .expect("run sparkshell");
+
+    assert!(output.status.success());
+    assert!(
+        String::from_utf8_lossy(&output.stdout).contains("\"classification\": \"stale_heartbeat\"")
+    );
+    let _ = fs::remove_dir_all(temp);
+}
+
+fn run_team_status_diagnostics(status_json: &str) -> String {
+    let temp = unique_temp_dir("team-status");
+    let worker_dir = temp.join("team/demo/workers/worker-1");
+    fs::create_dir_all(&worker_dir).expect("worker dir");
+    fs::write(worker_dir.join("status.json"), status_json).expect("status");
+
+    let output = Command::new(sparkshell_bin())
+        .env("OMX_TEAM_STATE_ROOT", temp.display().to_string())
+        .arg("--json")
+        .arg("--team")
+        .arg("demo")
+        .arg("--worker")
+        .arg("worker-1")
+        .arg("sh")
+        .arg("-c")
+        .arg("printf 'quiet\n'")
+        .output()
+        .expect("run sparkshell");
+
+    let _ = fs::remove_dir_all(temp);
+    assert!(output.status.success());
+    String::from_utf8_lossy(&output.stdout).into_owned()
+}
+
+#[test]
+fn json_mode_treats_worker_status_working_as_busy() {
+    let stdout = run_team_status_diagnostics(
+        r#"{"state":"working","current_task_id":"1","updated_at":"2026-05-17T20:00:00.000Z"}"#,
+    );
+
+    assert!(stdout.contains("\"classification\": \"busy_processing\""));
+    assert!(stdout.contains("\"next_action\": \"wait\""));
+    assert!(stdout.contains("do not shutdown yet"));
+    assert!(!stdout.contains("\"classification\": \"unknown\""));
+}
+
+#[test]
+fn json_mode_reports_blocked_worker_status() {
+    let stdout = run_team_status_diagnostics(
+        r#"{"state":"blocked","updated_at":"2026-05-17T20:00:00.000Z"}"#,
+    );
+
+    assert!(stdout.contains("\"classification\": \"waiting_for_input\""));
+    assert!(stdout.contains("\"next_action\": \"inspect raw pane\""));
+}
+
+#[test]
+fn json_mode_reports_failed_worker_status() {
+    let stdout = run_team_status_diagnostics(
+        r#"{"state":"failed","updated_at":"2026-05-17T20:00:00.000Z"}"#,
+    );
+
+    assert!(stdout.contains("\"classification\": \"test_failure\""));
+    assert!(stdout.contains("worker status is failed"));
+}
+
+#[test]
+fn json_mode_leaves_inactive_worker_statuses_to_output_heuristics() {
+    for state in ["idle", "done", "draining", "unknown"] {
+        let stdout = run_team_status_diagnostics(&format!(
+            r#"{{"state":"{state}","updated_at":"2026-05-17T20:00:00.000Z"}}"#
+        ));
+
+        assert!(stdout.contains("\"classification\": \"unknown\""));
+        assert!(!stdout.contains("do not shutdown yet"));
+    }
+}
+
+#[test]
+fn json_mode_reads_team_state_from_env_root() {
+    let temp = unique_temp_dir("team-state");
+    let worker_dir = temp.join("team/demo/workers/worker-1");
+    fs::create_dir_all(&worker_dir).expect("worker dir");
+    fs::write(
+        worker_dir.join("status.json"),
+        r#"{"state":"busy","task":"in_progress"}"#,
+    )
+    .expect("status");
+
+    let output = Command::new(sparkshell_bin())
+        .env("OMX_TEAM_STATE_ROOT", temp.display().to_string())
+        .arg("--json")
+        .arg("--team")
+        .arg("demo")
+        .arg("--worker")
+        .arg("worker-1")
+        .arg("sh")
+        .arg("-c")
+        .arg("printf 'quiet\n'")
+        .output()
+        .expect("run sparkshell");
+
+    assert!(output.status.success());
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("\"classification\": \"busy_processing\""));
+    assert!(stdout.contains("do not shutdown yet"));
+
+    let _ = fs::remove_dir_all(temp);
+}
+
+#[test]
+fn pane_json_cache_reports_hits_and_since_last_changes() {
+    let temp = unique_temp_dir("pane-cache");
+    let tmux = temp.join("tmux");
+    let cache = temp.join("cache");
+    let pane = temp.join("pane.txt");
+    fs::write(&pane, "line-1\nline-2\n").expect("pane");
+    write_executable(&tmux, &format!("#!/bin/sh\ncat {}\n", pane.display()));
+    let path = format!(
+        "{}:{}",
+        temp.display(),
+        env::var("PATH").unwrap_or_default()
+    );
+
+    let first = Command::new(sparkshell_bin())
+        .env("PATH", &path)
+        .env("OMX_SPARKSHELL_CACHE_DIR", cache.display().to_string())
+        .arg("--json")
+        .arg("--tmux-pane")
+        .arg("%31")
+        .output()
+        .expect("first");
+    assert!(first.status.success());
+    assert!(String::from_utf8_lossy(&first.stdout).contains("\"cache_hit\":false"));
+
+    let second = Command::new(sparkshell_bin())
+        .env("PATH", &path)
+        .env("OMX_SPARKSHELL_CACHE_DIR", cache.display().to_string())
+        .arg("--json")
+        .arg("--tmux-pane")
+        .arg("%31")
+        .output()
+        .expect("second");
+    assert!(second.status.success());
+    assert!(String::from_utf8_lossy(&second.stdout).contains("\"cache_hit\":true"));
+
+    fs::write(&pane, "line-1\nline-2\nline-3\n").expect("pane update");
+    let third = Command::new(sparkshell_bin())
+        .env("PATH", &path)
+        .env("OMX_SPARKSHELL_CACHE_DIR", cache.display().to_string())
+        .arg("--json")
+        .arg("--since-last")
+        .arg("--tmux-pane")
+        .arg("%31")
+        .output()
+        .expect("third");
+    assert!(third.status.success());
+    let stdout = String::from_utf8_lossy(&third.stdout);
+    assert!(stdout.contains("\"changed_line_ranges\":[\"3-3\"]"));
+    assert!(stdout.contains("new findings since last observation"));
+    assert!(stdout.contains("line-3"));
+
+    let _ = fs::remove_dir_all(temp);
+}
+
+#[test]
+fn pane_cache_key_does_not_escape_cache_dir_for_path_like_pane_ids() {
+    let temp = unique_temp_dir("pane-cache-traversal");
+    let tmux = temp.join("tmux");
+    let cache = temp.join("cache");
+    let intermediate = cache.join("pane-..");
+    let outside = temp.join("outside-pr2371.txt");
+
+    fs::create_dir_all(&intermediate).expect("intermediate cache dir");
+    write_executable(
+        &tmux,
+        "#!/bin/sh
+printf 'safe pane output
+'
+",
+    );
+    let path = format!(
+        "{}:{}",
+        temp.display(),
+        env::var("PATH").unwrap_or_default()
+    );
+
+    let output = Command::new(sparkshell_bin())
+        .env("PATH", &path)
+        .env("OMX_SPARKSHELL_CACHE_DIR", cache.display().to_string())
+        .arg("--json")
+        .arg("--tmux-pane")
+        .arg("../../../outside-pr2371")
+        .output()
+        .expect("run sparkshell");
+
+    assert!(
+        output.status.success(),
+        "sparkshell failed: stdout={} stderr={}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(
+        !outside.exists(),
+        "path-like pane id wrote outside cache dir at {}",
+        outside.display()
+    );
+
+    let cache_files = fs::read_dir(&cache)
+        .expect("cache dir")
+        .map(|entry| entry.expect("cache entry").path())
+        .collect::<Vec<_>>();
+    assert!(
+        cache_files.iter().any(|path| {
+            path.is_file()
+                && path.parent() == Some(cache.as_path())
+                && path
+                    .file_name()
+                    .and_then(|name| name.to_str())
+                    .is_some_and(|name| name.starts_with("pane-h") && name.ends_with(".txt"))
+        }),
+        "expected sanitized pane cache file directly under cache dir, got {cache_files:?}"
+    );
+
+    let _ = fs::remove_dir_all(temp);
+}
+
+#[test]
+fn pane_cache_does_not_persist_raw_secret_like_text() {
+    let temp = unique_temp_dir("pane-cache-secret");
+    let tmux = temp.join("tmux");
+    let cache = temp.join("cache");
+    let pane = temp.join("pane.txt");
+    let secret_line = "OPENAI_API_KEY=sk-test-secret";
+    fs::write(
+        &pane,
+        format!(
+            "starting
+{secret_line}
+finished
+"
+        ),
+    )
+    .expect("pane");
+    write_executable(
+        &tmux,
+        &format!(
+            "#!/bin/sh
+cat {}
+",
+            pane.display()
+        ),
+    );
+    let path = format!(
+        "{}:{}",
+        temp.display(),
+        env::var("PATH").unwrap_or_default()
+    );
+
+    let output = Command::new(sparkshell_bin())
+        .env("PATH", &path)
+        .env("OMX_SPARKSHELL_CACHE_DIR", cache.display().to_string())
+        .arg("--json")
+        .arg("--tmux-pane")
+        .arg("%99")
+        .output()
+        .expect("run sparkshell");
+
+    assert!(output.status.success());
+    let cache_file = cache.join("pane-pct99.txt");
+    let cached = fs::read_to_string(&cache_file).expect("cache file");
+    assert!(
+        !cached.contains(secret_line),
+        "cache file persisted raw secret-like pane text: {cached}"
+    );
+    assert!(
+        !cached.contains("sk-test-secret"),
+        "cache file persisted raw token value: {cached}"
+    );
+    assert!(
+        !cached.contains("OPENAI_API_KEY"),
+        "cache file persisted raw secret variable name: {cached}"
+    );
+    assert!(cached.contains("omx-sparkshell-cache-v2"));
+    assert!(cached.contains("lines=3"));
+
+    let _ = fs::remove_dir_all(temp);
+}
+
+#[test]
+fn raw_mode_preserves_non_utf8_bytes() {
+    let temp = unique_temp_dir("raw-non-utf8");
+    let script = temp.join("raw-bytes");
+    write_executable(
+        &script,
+        r#"#!/usr/bin/env bash
+printf '\xff\xfe\n'
+"#,
+    );
+
+    let output = Command::new(sparkshell_bin())
+        .arg(script)
+        .output()
+        .expect("run sparkshell");
+
+    assert!(output.status.success());
+    assert_eq!(output.stdout, vec![0xff, 0xfe, b'\n']);
+    let _ = fs::remove_dir_all(temp);
+}
+
+#[test]
+fn shell_mode_executes_explicit_shell_and_redacts_json_output() {
+    let output = Command::new(sparkshell_bin())
+        .arg("--json")
+        .arg("--shell")
+        .arg("printf 'left && right\n'; printf 'Authorization: Bearer secret-token\n' >&2")
+        .output()
+        .expect("run sparkshell");
+
+    assert!(output.status.success());
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("\"mode\": \"shell\""));
+    assert!(stdout.contains("left && right"));
+    assert!(stdout.contains("Authorization: Bearer [REDACTED]"));
+    assert!(stdout.contains(r#""redactions": {"count": 1}"#));
+}