oh-my-codex 0.18.12 → 0.18.14

package/src/scripts/codex-native-pre-post.ts

@@ -325,6 +325,11 @@ function tokenizeShellCommandWithBoundaries(commandText: string): ShellToken[] |
   let quote: "'" | "\"" | null = null;
   let escaping = false;
   let nextTokenStartsCommand = false;
+  // Command substitution executes even inside double quotes, so we track an
+  // active `"$(…)"` (paren depth) or `` "`…`" `` (backtick) substitution to
+  // restore double-quote mode once it closes.
+  let dquoteSubstParenDepth = 0;
+  let backtickFromDquote = false;
 
   const pushCurrent = () => {
     if (!current) return;
@@ -357,6 +362,25 @@ function tokenizeShellCommandWithBoundaries(commandText: string): ShellToken[] |
         if (isDoubleQuotedShellEscapeTarget(trimmed[index + 1])) escaping = true;
         else current += char;
       }
+      // Command substitution runs inside double quotes, so `"$(cmd …)"` and
+      // `` "`cmd …`" `` are real invocations, not literal mentions. Treat the
+      // opener as a command-position boundary and parse the substitution body
+      // unquoted so the command-head walk resumes, then restore double-quote
+      // mode when it closes. Parameter expansion (`${VAR}`), `$HOME`, and an
+      // escaped `\$(` stay literal text (no false positive on `grep "(x"`).
+      else if (char === "$" && trimmed[index + 1] === "(") {
+        pushCurrent();
+        nextTokenStartsCommand = true;
+        index += 1;
+        dquoteSubstParenDepth = 1;
+        quote = null;
+      }
+      else if (char === "`") {
+        pushCurrent();
+        nextTokenStartsCommand = true;
+        backtickFromDquote = true;
+        quote = null;
+      }
       else current += char;
       continue;
     }
@@ -368,6 +392,48 @@ function tokenizeShellCommandWithBoundaries(commandText: string): ShellToken[] |
       continue;
     }
 
+    // Grouping / command-substitution openers act as command-position
+    // boundaries so the command-head walk resumes after them, mirroring the
+    // legacy `[\n;&|(]` boundary set. This catches a real command immediately
+    // after `(`, `((`, `$(` (command substitution), or a backtick — e.g.
+    // `(apply_patch …)`, `true | (apply_patch …)`, `x=$(apply_patch …)`. We
+    // are outside quotes here, so a literal like `grep "(apply_patch"` is left
+    // intact and not split.
+    // Closing backtick of a command substitution opened inside double quotes
+    // ends the substitution and restores the surrounding double-quoted literal.
+    if (char === "`" && backtickFromDquote) {
+      pushCurrent();
+      backtickFromDquote = false;
+      quote = "\"";
+      continue;
+    }
+
+    if (char === "(" || char === ")" || char === "`") {
+      pushCurrent();
+      nextTokenStartsCommand = true;
+      // Track paren depth of a `"$(…)"` substitution opened inside double
+      // quotes so the matching `)` restores double-quote mode (nested `$(`
+      // and `(` inside it are balanced before we return to the literal).
+      if (dquoteSubstParenDepth > 0) {
+        if (char === "(") {
+          dquoteSubstParenDepth += 1;
+        } else if (char === ")") {
+          dquoteSubstParenDepth -= 1;
+          if (dquoteSubstParenDepth === 0) quote = "\"";
+        }
+      }
+      continue;
+    }
+
+    // `{` is a group opener only as its own word (`{ apply_patch …; }`):
+    // require an empty pending token (preceded by start/whitespace/boundary)
+    // and a following whitespace/newline so brace expansion (`{a,b}`) and
+    // parameter expansion (`${VAR}`) are left intact.
+    if (char === "{" && current === "" && /\s/.test(trimmed[index + 1] ?? " ")) {
+      nextTokenStartsCommand = true;
+      continue;
+    }
+
     if (/\s/.test(char)) {
       pushCurrent();
       continue;
@@ -488,6 +554,77 @@ function findGitCommandTokenIndex(tokens: ShellToken[]): number {
   return -1;
 }
 
+const APPLY_PATCH_COMMAND_WRAPPER_TOKENS = new Set(["sudo", "command", "exec"]);
+
+// Detects a real `apply_patch` invocation at a shell command position using the
+// same tokenized command-head walk the git commit guard uses
+// (`findGitCommandTokenIndex`): after every statement boundary skip leading
+// inline `NAME=VALUE` assignments, the `env` executable with its full option
+// grammar (`-i`/`--ignore-environment`, `-u`/`--unset`/`--unset=`, `-C`/`-S`,
+// `--`, interleaved assignments), and `sudo`/`command`/`exec` wrappers — in any
+// order — then match when the resolved command token's basename is
+// `apply_patch`. This blocks path-qualified (`/usr/bin/apply_patch`,
+// `./apply_patch`), env-flag (`env -i apply_patch`, `env -u FOO apply_patch`),
+// and reordered (`FOO=bar env apply_patch`, `exec env FOO=bar apply_patch`)
+// forms, while read-only diagnostics that merely mention the literal token
+// (e.g. `grep -n "apply_patch" file`) are not misread as write intent. Heredoc
+// bodies are stripped first so patch payloads cannot break tokenization.
+export function commandInvokesApplyPatch(command: string): boolean {
+  const tokens = tokenizeShellCommandWithBoundaries(removeHereDocBodies(command));
+  if (!tokens) return false;
+
+  for (let commandStart = 0; commandStart < tokens.length; commandStart = nextCommandStart(tokens, commandStart)) {
+    let index = commandStart;
+    const commandEnd = nextCommandStart(tokens, commandStart);
+
+    let advanced = true;
+    while (advanced && index < commandEnd) {
+      advanced = false;
+
+      while (index < commandEnd && isInlineShellEnvAssignment(tokens[index]?.value ?? "")) {
+        index += 1;
+        advanced = true;
+      }
+
+      while (index < commandEnd && isEnvExecutableToken(tokens[index]?.value ?? "")) {
+        index += 1;
+        advanced = true;
+        while (index < commandEnd) {
+          const token = tokens[index]?.value ?? "";
+          if (token === "--") {
+            index += 1;
+            break;
+          }
+          if (isInlineShellEnvAssignment(token)) {
+            index += 1;
+            continue;
+          }
+          if (token === "-i" || token === "--ignore-environment" || token.startsWith("--unset=")) {
+            index += 1;
+            continue;
+          }
+          if (token.startsWith("-")) {
+            index += envOptionConsumesNextValue(token) ? 2 : 1;
+            continue;
+          }
+          break;
+        }
+      }
+
+      while (index < commandEnd && APPLY_PATCH_COMMAND_WRAPPER_TOKENS.has((tokens[index]?.value ?? "").toLowerCase())) {
+        index += 1;
+        advanced = true;
+      }
+    }
+
+    if (index < commandEnd && shellCommandBasename(tokens[index]?.value ?? "") === "apply_patch") return true;
+    if (commandEnd <= commandStart) break;
+    commandStart = commandEnd - 1;
+  }
+
+  return false;
+}
+
 function tokenValues(tokens: ShellToken[]): string[] {
   return tokens.map((token) => token.value);
 }

package/src/scripts/notify-hook/team-tmux-guard.ts

@@ -11,6 +11,28 @@ import {
 } from '../tmux-hook-engine.js';
 
 export const PANE_READINESS_UNVERIFIED_REASON = 'pane_readiness_unverified';
+let nextTmuxBufferId = 0;
+
+function buildSafePasteArgv(target: string, prompt: string): {
+  bufferName: string;
+  setBufferArgv: string[];
+  showBufferArgv: string[];
+  clearComposerArgv: string[];
+  pasteBufferArgv: string[];
+  deleteBufferArgv: string[];
+} {
+  nextTmuxBufferId += 1;
+  const bufferName = `omx-pane-input-${process.pid}-${Date.now()}-${nextTmuxBufferId}`;
+  return {
+    bufferName,
+    setBufferArgv: ['set-buffer', '-b', bufferName, '--', prompt],
+    showBufferArgv: ['show-buffer', '-b', bufferName],
+    clearComposerArgv: ['send-keys', '-t', target, 'C-u'],
+    pasteBufferArgv: ['paste-buffer', '-t', target, '-b', bufferName, '-p', '-d'],
+    deleteBufferArgv: ['delete-buffer', '-b', bufferName],
+  };
+}
+
 
 export function mapPaneInjectionReadinessReason(reason: any): any {
   return reason === 'pane_running_shell' ? 'agent_not_running' : reason;
@@ -145,24 +167,82 @@ export async function sendPaneInput({
     ? Math.max(0, Math.floor(submitKeyPresses))
     : 2;
   const literalPrompt = safeString(prompt);
-  const argv = normalizedSubmitKeyPresses === 0
-    ? {
-      typeArgv: ['send-keys', '-t', target, '-l', literalPrompt],
-      submitArgv: [] as string[][],
-    }
+  const submitArgv = normalizedSubmitKeyPresses === 0
+    ? [] as string[][]
     : buildSendKeysArgv({
       paneTarget: target,
       prompt: literalPrompt,
       dryRun: false,
       submitKeyPresses: normalizedSubmitKeyPresses,
-    });
-  if (!argv) {
+    })?.submitArgv;
+  if (!submitArgv) {
     return { ok: false, sent: false, reason: 'send_failed', paneTarget: target };
   }
+  const pasteArgv = buildSafePasteArgv(target, literalPrompt);
+  const argv = {
+    typeArgv: pasteArgv.pasteBufferArgv,
+    submitArgv,
+    bufferName: pasteArgv.bufferName,
+    setBufferArgv: pasteArgv.setBufferArgv,
+    showBufferArgv: pasteArgv.showBufferArgv,
+    clearComposerArgv: pasteArgv.clearComposerArgv,
+    pasteBufferArgv: pasteArgv.pasteBufferArgv,
+    deleteBufferArgv: pasteArgv.deleteBufferArgv,
+  };
 
+  let bufferSet = false;
   try {
     if (typePrompt) {
-      await runProcess('tmux', argv.typeArgv, 3000);
+      try {
+        await runProcess('tmux', pasteArgv.setBufferArgv, 3000);
+        bufferSet = true;
+      } catch (error) {
+        return {
+          ok: false,
+          sent: false,
+          reason: 'buffer_set_failed',
+          paneTarget: target,
+          argv,
+          error: error instanceof Error ? error.message : safeString(error),
+        };
+      }
+      let verifiedBuffer;
+      try {
+        verifiedBuffer = await runProcess('tmux', pasteArgv.showBufferArgv, 3000);
+      } catch (error) {
+        return {
+          ok: false,
+          sent: false,
+          reason: 'buffer_show_failed',
+          paneTarget: target,
+          argv,
+          error: error instanceof Error ? error.message : safeString(error),
+        };
+      }
+      if (verifiedBuffer.stdout !== literalPrompt) {
+        return {
+          ok: false,
+          sent: false,
+          reason: 'buffer_verify_failed',
+          paneTarget: target,
+          argv,
+          expectedBytes: literalPrompt.length,
+          actualBytes: verifiedBuffer.stdout.length,
+        };
+      }
+      try {
+        await runProcess('tmux', pasteArgv.clearComposerArgv, 3000);
+        await runProcess('tmux', pasteArgv.pasteBufferArgv, 3000);
+      } catch (error) {
+        return {
+          ok: false,
+          sent: false,
+          reason: 'buffer_paste_failed',
+          paneTarget: target,
+          argv,
+          error: error instanceof Error ? error.message : safeString(error),
+        };
+      }
     }
     if (queueFirstSubmit && argv.submitArgv.length > 0) {
       await runProcess('tmux', ['send-keys', '-t', target, 'Tab'], 3000);
@@ -186,6 +266,10 @@ export async function sendPaneInput({
       argv,
       error: error instanceof Error ? error.message : safeString(error),
     };
+  } finally {
+    if (bufferSet) {
+      await runProcess('tmux', pasteArgv.deleteBufferArgv, 3000).catch(() => {});
+    }
   }
 }
 

package/src/scripts/notify-hook/tmux-injection.ts

@@ -71,7 +71,7 @@ async function finalizeResolvedPane(paneId: string, reason: string, expectedCwd:
 
 async function resolveCanonicalPaneFromPaneTarget(paneTarget: any, expectedCwd: any): Promise<any> {
   const paneResult = await runProcess('tmux', ['display-message', '-p', '-t', paneTarget, '#{pane_id}']);
-  const paneId = safeString(paneResult.stdout).trim();
+  const paneId = safeString(paneResult.stdout).trim() || (safeString(paneTarget).trim().match(/^%\d+$/) ? safeString(paneTarget).trim() : '');
   if (!paneId) return { paneTarget: null, reason: 'target_not_found' };
 
   let startCommand = '';

package/src/scripts/run-compiled-ci.ts

@@ -0,0 +1,85 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+const SOURCE_CHECKOUT_SENTINELS = [
+  "src/catalog/manifest.json",
+  "docs/troubleshooting.md",
+  ".github/workflows/ci.yml",
+] as const;
+
+const INSTALLED_PACKAGE_TEST_FILES = [
+  "dist/scripts/__tests__/smoke-packed-install.test.js",
+  "dist/cli/__tests__/nested-help-routing.test.js",
+  "dist/cli/__tests__/mcp-parity.test.js",
+] as const;
+
+const INSTALLED_PACKAGE_CLI_SMOKE_COMMANDS = [
+  ["--help"],
+  ["version"],
+  ["api", "--help"],
+  ["sparkshell", "--help"],
+  ["notepad", "--help"],
+  ["project-memory", "--help"],
+  ["trace", "--help"],
+  ["code-intel", "--help"],
+] as const;
+
+function npmBin(): string {
+  return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+
+function run(command: string, args: readonly string[]): void {
+  const result = spawnSync(command, [...args], {
+    cwd: process.cwd(),
+    env: {
+      ...process.env,
+      OMX_AUTO_UPDATE: "0",
+      OMX_NOTIFY_FALLBACK: "0",
+      OMX_HOOK_DERIVED_SIGNALS: "0",
+    },
+    stdio: "inherit",
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(`Command failed: ${command} ${args.join(" ")}`);
+  }
+}
+
+function isSourceCheckout(): boolean {
+  return SOURCE_CHECKOUT_SENTINELS.every((sentinel) =>
+    existsSync(join(process.cwd(), sentinel)),
+  );
+}
+
+function runSourceCheckoutGate(): void {
+  run(npmBin(), ["run", "verify:native-agents"]);
+  run(npmBin(), ["run", "verify:plugin-bundle"]);
+  run(npmBin(), ["run", "test:node"]);
+  run(process.execPath, ["dist/scripts/generate-catalog-docs.js", "--check"]);
+}
+
+function runInstalledPackageGate(): void {
+  run(npmBin(), ["run", "verify:native-agents"]);
+  run(npmBin(), ["run", "verify:plugin-bundle"]);
+  run(process.execPath, [
+    "dist/scripts/run-test-files.js",
+    ...INSTALLED_PACKAGE_TEST_FILES,
+  ]);
+  for (const argv of INSTALLED_PACKAGE_CLI_SMOKE_COMMANDS) {
+    run(process.execPath, ["dist/cli/omx.js", ...argv]);
+  }
+}
+
+try {
+  if (isSourceCheckout()) {
+    runSourceCheckoutGate();
+  } else {
+    runInstalledPackageGate();
+  }
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}

package/src/scripts/sync-plugin-mirror.ts

@@ -59,6 +59,7 @@ const SETUP_OWNED_PLUGIN_MANIFEST_FIELDS = [
 ] as const;
 const OMX_PLUGIN_HOOK_COMMAND =
 	'node "${PLUGIN_ROOT}/hooks/codex-native-hook.mjs"';
+// The launcher itself must not shell-wrap node.exe on Windows; see GH #2858.
 const OMX_PLUGIN_HOOK_LAUNCHER_CONTRACT_MARKER =
 	"omx-plugin-hook-launcher:v1";
 // Plugin-scoped Codex hooks intentionally mirror the setup-managed lifecycle

package/templates/AGENTS.md

@@ -157,6 +157,12 @@ When to use what:
 - Use normal Codex repository inspection tools/subagents for repository lookup and implementation context.
 - Use `omx sparkshell --tmux-pane` only as an explicit opt-in operator aid for shell-native tmux evidence or bounded verification; it does not replace raw evidence capture.
 
+Supervisor tmux handoff safety:
+- Never paste from tmux's implicit/current buffer. Load handoff text into a fresh named buffer with `tmux set-buffer -b <name> -- "$message"` or a temp-file-backed `tmux load-buffer -b <name> <file>`; never use `tmux load-buffer -- <message>`.
+- Verify the named buffer with `tmux show-buffer -b <name>` before any paste. A failed load or mismatched buffer is a blocker; do not run `paste-buffer` or submit keys after it.
+- Clear the pane composer with `tmux send-keys -t <pane> C-u` immediately before paste, then use bracketed paste (`tmux paste-buffer -t <pane> -b <name> -p -d`) and submit intentionally.
+- Recapture the pane after paste/Enter and verify the intended turn was accepted rather than leaving stale draft text visible.
+
 Leader vs worker: leaders choose mode, delegate bounded work, integrate, and own verification; workers execute their slice and escalate blockers, scope expansion, shared-file conflicts, or mode mismatch upward. Escalate from worker to leader for blockers, scope expansion, shared ownership conflicts, or mode mismatch.
 
 Stop / escalate: stop when the task is verified complete, the user says stop/cancel, or no meaningful recovery path remains. Escalate to the user only for irreversible, destructive, materially branching decisions, or missing authority.