oh-my-codex 0.18.2 → 0.18.4

package/dist/auth/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAgB,aAAa,IAAI,YAAY,CAE5C;AAED,wBAAsB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAa3E;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM5F;AAeD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,OAAa,GACf,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED,wBAAsB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAGxE;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,OAAa,GACf,OAAO,CAAC,cAAc,CAAC,CAezB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,OAAa,GACf,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpF"}

package/dist/auth/storage.js

@@ -0,0 +1,111 @@
+import { randomBytes } from "crypto";
+import { dirname } from "path";
+import { readFile, rename, rm, writeFile, chmod } from "fs/promises";
+import { existsSync } from "fs";
+import { AUTH_FILE_MODE, assertNoSymlink, assertReadableFile, ensurePrivateDir, resolveAuthMetadataPath, resolveOmxAuthDir, resolveSlotPath, validateSlotName, } from "./paths.js";
+export async function atomicWriteFile(targetPath, data, options = {}) {
+    const dir = dirname(targetPath);
+    await ensurePrivateDir(dir);
+    await assertNoSymlink(targetPath, "auth target");
+    const tempPath = `${targetPath}.tmp-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}`;
+    try {
+        await writeFile(tempPath, data, { mode: options.mode ?? AUTH_FILE_MODE });
+        if (process.platform !== "win32")
+            await chmod(tempPath, options.mode ?? AUTH_FILE_MODE).catch(() => undefined);
+        await options.beforeRename?.(tempPath);
+        await rename(tempPath, targetPath);
+        if (process.platform !== "win32")
+            await chmod(targetPath, options.mode ?? AUTH_FILE_MODE).catch(() => undefined);
+    }
+    catch (err) {
+        await rm(tempPath, { force: true }).catch(() => undefined);
+        throw err;
+    }
+}
+export function emptyMetadata() {
+    return { version: 1, slots: [] };
+}
+export async function readAuthMetadata(home) {
+    const path = resolveAuthMetadataPath(home);
+    if (!existsSync(path))
+        return emptyMetadata();
+    const parsed = JSON.parse(await readFile(path, "utf-8"));
+    return {
+        version: 1,
+        currentSlot: typeof parsed.currentSlot === "string" ? parsed.currentSlot : undefined,
+        slots: Array.isArray(parsed.slots)
+            ? parsed.slots
+                .filter((slot) => Boolean(slot && typeof slot.slot === "string"))
+                .map((slot) => ({ ...slot, slot: validateSlotName(slot.slot) }))
+            : [],
+    };
+}
+export async function writeAuthMetadata(metadata, home) {
+    const authDir = resolveOmxAuthDir(home);
+    await ensurePrivateDir(authDir);
+    await atomicWriteFile(resolveAuthMetadataPath(home), `${JSON.stringify(metadata, null, 2)}\n`, {
+        mode: AUTH_FILE_MODE,
+    });
+}
+function upsertSlotRecord(metadata, slot, nowIso) {
+    const safeSlot = validateSlotName(slot);
+    const existing = metadata.slots.find((record) => record.slot === safeSlot);
+    if (existing) {
+        existing.updatedAt = nowIso;
+        return existing;
+    }
+    const record = { slot: safeSlot, createdAt: nowIso, updatedAt: nowIso };
+    metadata.slots.push(record);
+    metadata.slots.sort((a, b) => a.slot.localeCompare(b.slot));
+    return record;
+}
+export async function addSlotFromAuthFile(slot, liveAuthPath, home, now = new Date()) {
+    const safeSlot = validateSlotName(slot);
+    await assertReadableFile(liveAuthPath, "live Codex auth.json");
+    await ensurePrivateDir(resolveOmxAuthDir(home));
+    const data = await readFile(liveAuthPath);
+    const target = resolveSlotPath(safeSlot, home);
+    await atomicWriteFile(target, data, { mode: AUTH_FILE_MODE });
+    const metadata = await readAuthMetadata(home);
+    const record = upsertSlotRecord(metadata, safeSlot, now.toISOString());
+    await writeAuthMetadata(metadata, home);
+    return record;
+}
+export async function listSlots(home) {
+    const metadata = await readAuthMetadata(home);
+    return metadata.slots.filter((slot) => existsSync(resolveSlotPath(slot.slot, home)));
+}
+export async function useSlot(slot, liveAuthPath, home, now = new Date()) {
+    const safeSlot = validateSlotName(slot);
+    const slotPath = resolveSlotPath(safeSlot, home);
+    await assertReadableFile(slotPath, `auth slot ${safeSlot}`);
+    await ensurePrivateDir(dirname(liveAuthPath));
+    await assertNoSymlink(liveAuthPath, "live Codex auth.json");
+    const data = await readFile(slotPath);
+    await atomicWriteFile(liveAuthPath, data, { mode: AUTH_FILE_MODE });
+    const metadata = await readAuthMetadata(home);
+    const record = upsertSlotRecord(metadata, safeSlot, now.toISOString());
+    record.lastUsedAt = now.toISOString();
+    delete record.exhaustedAt;
+    metadata.currentSlot = safeSlot;
+    await writeAuthMetadata(metadata, home);
+    return record;
+}
+export async function markSlotQuota(slot, home, now = new Date()) {
+    const safeSlot = validateSlotName(slot);
+    const metadata = await readAuthMetadata(home);
+    const record = upsertSlotRecord(metadata, safeSlot, now.toISOString());
+    record.lastQuotaAt = now.toISOString();
+    record.exhaustedAt = now.toISOString();
+    await writeAuthMetadata(metadata, home);
+    return metadata;
+}
+export async function clearSlotExhaustion(slot, home) {
+    const metadata = await readAuthMetadata(home);
+    const record = metadata.slots.find((entry) => entry.slot === validateSlotName(slot));
+    if (record) {
+        delete record.exhaustedAt;
+        await writeAuthMetadata(metadata, home);
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/auth/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EACL,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAsBpB,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,IAAqB,EACrB,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACpG,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/G,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAa;IAClD,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAA0B,CAAC;IAClF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACpF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,KAAK;iBACT,MAAM,CAAC,CAAC,IAAI,EAA0B,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;iBACxF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAsB,EAAE,IAAa;IAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,eAAe,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC7F,IAAI,EAAE,cAAc;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAsB,EAAE,IAAY,EAAE,MAAc;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACxF,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,YAAoB,EACpB,IAAa,EACb,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,kBAAkB,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC/D,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAa;IAC3C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAY,EACZ,YAAoB,EACpB,IAAa,EACb,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,kBAAkB,CAAC,QAAQ,EAAE,aAAa,QAAQ,EAAE,CAAC,CAAC;IAC5D,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9C,MAAM,eAAe,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,eAAe,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,CAAC;IAC1B,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC;IAChC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,IAAa,EACb,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAa;IACnE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,WAAW,CAAC;QAC1B,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/cli/__tests__/auth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth.test.d.ts.map

package/dist/cli/__tests__/auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.d.ts","sourceRoot":"","sources":["../../../src/cli/__tests__/auth.test.ts"],"names":[],"mappings":""}

package/dist/cli/__tests__/auth.test.js

@@ -0,0 +1,168 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+function omxBin() {
+    const testDir = dirname(fileURLToPath(import.meta.url));
+    return join(testDir, "..", "..", "..", "dist", "cli", "omx.js");
+}
+function runOmx(cwd, argv, env = {}) {
+    const result = spawnSync(process.execPath, [omxBin(), ...argv], {
+        cwd,
+        encoding: "utf-8",
+        env: {
+            ...process.env,
+            HOME: env.HOME,
+            CODEX_HOME: env.CODEX_HOME ?? "",
+            NODE_OPTIONS: "",
+            OMX_AUTO_UPDATE: "0",
+            OMX_NOTIFY_FALLBACK: "0",
+            OMX_HOOK_DERIVED_SIGNALS: "0",
+            ...env,
+        },
+    });
+    return { status: result.status, stdout: result.stdout || "", stderr: result.stderr || "", error: result.error?.message || "" };
+}
+async function writeFakeCodex(binDir, script) {
+    await mkdir(binDir, { recursive: true });
+    const path = join(binDir, "codex");
+    await writeFile(path, script);
+    await chmod(path, 0o755);
+    return path;
+}
+describe("omx auth CLI", () => {
+    it("shows nested help and top-level hotswap help", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-auth-help-"));
+        try {
+            const help = runOmx(wd, ["auth", "--help"], { HOME: wd });
+            assert.equal(help.status, 0, help.stderr);
+            assert.match(help.stdout, /omx auth add <slot>/);
+            const top = runOmx(wd, ["--help"], { HOME: wd });
+            assert.match(top.stdout, /--hotswap/);
+            assert.match(top.stdout, /omx auth/);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("adds, lists, and uses slots through the compiled CLI without leaking tokens", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-auth-cli-"));
+        try {
+            const home = join(wd, "home");
+            const codexHome = join(home, ".codex");
+            const bin = join(wd, "bin");
+            await mkdir(codexHome, { recursive: true });
+            await writeFakeCodex(bin, `#!/bin/sh\nif [ "$1" = "login" ]; then mkdir -p "$CODEX_HOME"; printf '{"access_token":"sentinel-secret"}\\n' > "$CODEX_HOME/auth.json"; exit 0; fi\necho unexpected "$@" >&2\nexit 2\n`);
+            const env = { HOME: home, CODEX_HOME: codexHome, PATH: `${bin}:/usr/bin:/bin` };
+            const add = runOmx(wd, ["auth", "add", "work"], env);
+            assert.equal(add.status, 0, add.stderr);
+            assert.doesNotMatch(add.stdout + add.stderr, /sentinel-secret/);
+            const list = runOmx(wd, ["auth", "list", "--json"], env);
+            assert.equal(list.status, 0, list.stderr);
+            assert.match(list.stdout, /"slot": "work"/);
+            await writeFile(join(codexHome, "auth.json"), '{"access_token":"other"}\n');
+            const use = runOmx(wd, ["auth", "use", "work"], env);
+            assert.equal(use.status, 0, use.stderr);
+            assert.doesNotMatch(use.stdout + use.stderr, /sentinel-secret/);
+            assert.equal(await readFile(join(codexHome, "auth.json"), "utf-8"), '{"access_token":"sentinel-secret"}\n');
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("adds project-scope slots from the same CODEX_HOME used by launch", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-auth-project-add-"));
+        try {
+            const home = join(wd, "home");
+            const bin = join(wd, "bin");
+            await mkdir(join(wd, ".omx"), { recursive: true });
+            await writeFile(join(wd, ".omx", "setup-scope.json"), '{"scope":"project"}\n');
+            await writeFakeCodex(bin, `#!/bin/sh
+if [ "$1" = "login" ]; then case "$CODEX_HOME" in ${JSON.stringify(`${wd}/.codex`)}) mkdir -p "$CODEX_HOME"; printf '{"access_token":"project-secret"}\n' > "$CODEX_HOME/auth.json"; exit 0;; *) echo "wrong CODEX_HOME=$CODEX_HOME" >&2; exit 4;; esac; fi
+echo unexpected "$@" >&2
+exit 2
+`);
+            const env = { HOME: home, PATH: `${bin}:/usr/bin:/bin` };
+            const add = runOmx(wd, ["auth", "add", "project"], env);
+            assert.equal(add.status, 0, add.stderr);
+            assert.doesNotMatch(add.stdout + add.stderr, /project-secret/);
+            assert.equal(await readFile(join(home, ".omx", "auth", "project.json"), "utf-8"), '{"access_token":"project-secret"}\n');
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("fails soft when no slots are configured", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-auth-noslots-"));
+        try {
+            const result = runOmx(wd, ["--hotswap", "--direct"], { HOME: join(wd, "home"), PATH: `/usr/bin:/bin` });
+            assert.equal(result.status, 1);
+            assert.match(result.stderr, /no slots configured/);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("hotswaps on 429 and resumes the latest rollout with the next slot", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-auth-hotswap-"));
+        try {
+            const home = join(wd, "home");
+            const codexHome = join(home, ".codex");
+            const authDir = join(home, ".omx", "auth");
+            const bin = join(wd, "bin");
+            const countFile = join(wd, "count");
+            const argvFile = join(wd, "argv.log");
+            await mkdir(authDir, { recursive: true });
+            await mkdir(codexHome, { recursive: true });
+            await writeFile(join(authDir, "first.json"), '{"access_token":"first-secret"}\n');
+            await writeFile(join(authDir, "second.json"), '{"access_token":"second-secret"}\n');
+            await writeFile(join(authDir, "slots.json"), JSON.stringify({ version: 1, currentSlot: "first", slots: [
+                    { slot: "first", createdAt: "now", updatedAt: "now" },
+                    { slot: "second", createdAt: "now", updatedAt: "now" }
+                ] }, null, 2));
+            await writeFakeCodex(bin, `#!/bin/sh\ncount=0\n[ -f ${JSON.stringify(countFile)} ] && count=$(cat ${JSON.stringify(countFile)})\ncount=$((count+1))\nprintf '%s' "$count" > ${JSON.stringify(countFile)}\nprintf '%s\\n' "$*" >> ${JSON.stringify(argvFile)}\nif [ "$count" -eq 1 ]; then mkdir -p "$CODEX_HOME/sessions/2026/05/24"; printf '{}\\n' > "$CODEX_HOME/sessions/2026/05/24/rollout-session-123.jsonl"; echo 'HTTP 429 quota exceeded access_token=stderr-secret Bearer abc.def' >&2; exit 1; fi\ncase "$*" in *"resume session-123"*--model*"gpt-review"*) exit 0;; *) echo 'missing resume args or model flag' >&2; exit 3;; esac\n`);
+            const env = { HOME: home, CODEX_HOME: codexHome, PATH: `${bin}:/usr/bin:/bin` };
+            const result = runOmx(wd, ["--hotswap", "--direct", "--model", "gpt-review"], env);
+            assert.equal(result.status, 0, result.stderr + result.stdout);
+            assert.match(result.stderr, /HTTP 429 quota exceeded/);
+            const argvLog = await readFile(argvFile, "utf-8");
+            assert.match(argvLog, /resume session-123/);
+            assert.match(argvLog, /--model gpt-review/);
+            assert.equal(await readFile(join(codexHome, "auth.json"), "utf-8"), '{"access_token":"second-secret"}\n');
+            assert.doesNotMatch(result.stderr + result.stdout, /first-secret|second-secret|stderr-secret|abc\.def/);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("emits one clean error when all hotswap slots are exhausted", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-auth-exhausted-"));
+        try {
+            const home = join(wd, "home");
+            const codexHome = join(home, ".codex");
+            const authDir = join(home, ".omx", "auth");
+            const bin = join(wd, "bin");
+            await mkdir(authDir, { recursive: true });
+            await mkdir(codexHome, { recursive: true });
+            await writeFile(join(authDir, "first.json"), '{"access_token":"first-secret"}\n');
+            await writeFile(join(authDir, "second.json"), '{"access_token":"second-secret"}\n');
+            await writeFile(join(authDir, "slots.json"), JSON.stringify({ version: 1, currentSlot: "first", slots: [
+                    { slot: "first", createdAt: "now", updatedAt: "now" },
+                    { slot: "second", createdAt: "now", updatedAt: "now" }
+                ] }, null, 2));
+            await writeFakeCodex(bin, `#!/bin/sh\nmkdir -p "$CODEX_HOME/sessions/2026/05/24"\nprintf '{}\\n' > "$CODEX_HOME/sessions/2026/05/24/rollout-session-429.jsonl"\necho 'HTTP 429 quota exceeded' >&2\nexit 1\n`);
+            const result = runOmx(wd, ["--hotswap", "--direct"], { HOME: home, CODEX_HOME: codexHome, PATH: `${bin}:/usr/bin:/bin` });
+            assert.equal(result.status, 1);
+            const matches = result.stderr.match(/all slots exhausted: first, second/g) ?? [];
+            assert.equal(matches.length, 1, result.stderr);
+            assert.doesNotMatch(result.stderr + result.stdout, /first-secret|second-secret/);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=auth.test.js.map

package/dist/cli/__tests__/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../src/cli/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,SAAS,MAAM;IACb,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,IAAc,EAAE,MAA8B,EAAE;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE;QAC9D,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;YAChC,YAAY,EAAE,EAAE;YAChB,eAAe,EAAE,GAAG;YACpB,mBAAmB,EAAE,GAAG;YACxB,wBAAwB,EAAE,GAAG;YAC7B,GAAG,GAAG;SACP;KACF,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;AACjI,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc;IAC1D,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,cAAc,CAAC,GAAG,EAAE,yLAAyL,CAAC,CAAC;YACrN,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC;YAChF,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC5C,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,4BAA4B,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAC9G,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC/E,MAAM,cAAc,CAAC,GAAG,EAAE;oDACoB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC;;;CAGjF,CAAC,CAAC;YACG,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,EAAE,qCAAqC,CAAC,CAAC;QAC3H,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YACxG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YACtC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,mCAAmC,CAAC,CAAC;YAClF,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,oCAAoC,CAAC,CAAC;YACpF,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE;oBACrG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE;oBACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE;iBACvD,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,cAAc,CAAC,GAAG,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,uXAAuX,CAAC,CAAC;YACpnB,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;YACnF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,EAAE,oCAAoC,CAAC,CAAC;YAC1G,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;QAC1G,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,mCAAmC,CAAC,CAAC;YAClF,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,oCAAoC,CAAC,CAAC;YACpF,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE;oBACrG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE;oBACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE;iBACvD,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,cAAc,CAAC,GAAG,EAAE,mLAAmL,CAAC,CAAC;YAC/M,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC,CAAC;YAC1H,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,IAAI,EAAE,CAAC;YACjF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/__tests__/doctor-warning-copy.test.js

@@ -180,7 +180,7 @@ command = "node"
             await rm(wd, { recursive: true, force: true });
         }
     });
-    it("treats plugin-mode setup omissions as expected and verifies marketplace registration", async () => {
+    it("recognizes setup-installed native reviewer roles separately from healthy plugin skills and hooks", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-doctor-plugin-mode-"));
         try {
             const home = join(wd, "home");
@@ -204,6 +204,8 @@ command = "node"
             assert.match(res.stdout, /Resolved setup MCP mode: none/);
             assert.match(res.stdout, /Prompts: plugin mode intentionally omits setup-owned prompts; Codex plugin discovery supplies workflow surfaces/);
             assert.match(res.stdout, /Skills: plugin marketplace oh-my-codex-local registered; OMX skills are supplied by/);
+            assert.match(res.stdout, /\[OK\] Native reviewer roles: required RALPLAN\/Autopilot native reviewer roles are available \(architect, critic\); advisory scholastic role is also available/);
+            assert.doesNotMatch(res.stdout, /role-specific subagent calls may degrade/);
             assert.match(res.stdout, /MCP Servers: CLI-first plugin mode: first-party MCP compatibility explicitly disabled/);
             assert.doesNotMatch(res.stdout, /Prompts: prompts directory not found/);
             assert.doesNotMatch(res.stdout, /Skills: skills directory not found/);
@@ -214,6 +216,37 @@ command = "node"
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("accepts plugin mode when required native reviewer roles are available from agent files and config", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-doctor-plugin-native-roles-ok-"));
+        try {
+            const home = join(wd, "home");
+            const codexDir = join(home, ".codex");
+            await mkdir(codexDir, { recursive: true });
+            const setupRes = runOmx(wd, ["setup", "--scope", "user", "--plugin", "--force"], {
+                HOME: home,
+                CODEX_HOME: codexDir,
+            });
+            if (shouldSkipForSpawnPermissions(setupRes.error))
+                return;
+            assert.equal(setupRes.status, 0, setupRes.stderr || setupRes.stdout);
+            await mkdir(join(codexDir, "agents"), { recursive: true });
+            await writeFile(join(codexDir, "agents", "architect.toml"), 'name = "architect"\ndescription = "Architect reviewer"\n');
+            await writeFile(join(codexDir, "config.toml"), `${await readFile(join(codexDir, "config.toml"), "utf-8")}\n[agents.critic]\ndescription = "Critic reviewer"\n\n[agents.scholastic]\ndescription = "Scholastic advisory reviewer"\n`);
+            const res = runOmx(wd, ["doctor"], {
+                HOME: home,
+                CODEX_HOME: codexDir,
+            });
+            if (shouldSkipForSpawnPermissions(res.error))
+                return;
+            assert.equal(res.status, 0, res.stderr || res.stdout);
+            assert.match(res.stdout, /\[OK\] Native reviewer roles: required RALPLAN\/Autopilot native reviewer roles are available \(architect, critic\); advisory scholastic role is also available/);
+            assert.match(res.stdout, /Skills: plugin marketplace oh-my-codex-local registered; OMX skills are supplied by/);
+            assert.doesNotMatch(res.stdout, /role-specific subagent calls may degrade/);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("warns when plugin cache manifest version is stale even when skills match", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-doctor-plugin-cache-stale-version-"));
         try {
@@ -460,7 +493,7 @@ enabled = true
             }
         });
     });
-    it("warns when explore routing is explicitly disabled in config.toml", async () => {
+    it("passes when deprecated explore routing is explicitly disabled by environment/config", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-doctor-explore-routing-"));
         try {
             const home = join(wd, "home");
@@ -473,11 +506,12 @@ USE_OMX_EXPLORE_CMD = "off"
             const res = runOmx(wd, ["doctor"], {
                 HOME: home,
                 CODEX_HOME: join(home, ".codex"),
+                USE_OMX_EXPLORE_CMD: "off",
             });
             if (shouldSkipForSpawnPermissions(res.error))
                 return;
             assert.equal(res.status, 0, res.stderr || res.stdout);
-            assert.match(res.stdout, /Explore routing: disabled in config\.toml; set USE_OMX_EXPLORE_CMD = "1" under \[shell_environment_policy\.set\] to restore default explore-first routing/);
+            assert.match(res.stdout, /Explore routing: deprecated compatibility routing disabled by environment override \(recommended\)/);
         }
         finally {
             await rm(wd, { recursive: true, force: true });
@@ -619,6 +653,57 @@ OMX_LORE_COMMIT_GUARD = "truee"
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("accepts plugin-scoped native hooks when hooks.json contains user-owned hooks", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-doctor-plugin-scoped-hooks-user-"));
+        try {
+            const home = join(wd, "home");
+            const codexDir = join(home, ".codex");
+            await mkdir(join(wd, ".omx"), { recursive: true });
+            await mkdir(codexDir, { recursive: true });
+            const cacheDir = await installPluginCacheFixture(codexDir);
+            await writeFile(join(wd, ".omx", "setup-scope.json"), `${JSON.stringify({ scope: "user", installMode: "plugin", mcpMode: "none" }, null, 2)}\n`);
+            await writeFile(join(codexDir, "config.toml"), [
+                "plugin_hooks = true",
+                "goals = true",
+                "",
+                "[marketplaces.oh-my-codex-local]",
+                'source_type = "local"',
+                `source = ${JSON.stringify(repoRoot())}`,
+                "",
+                '[plugins."oh-my-codex@oh-my-codex-local"]',
+                "enabled = true",
+                "",
+            ].join("\n"));
+            await writeFile(join(codexDir, "hooks.json"), JSON.stringify({
+                hooks: {
+                    Stop: [
+                        {
+                            hooks: [
+                                {
+                                    type: "command",
+                                    command: "/usr/bin/python3 /tmp/user-notify.py",
+                                    timeout: 5,
+                                },
+                            ],
+                        },
+                    ],
+                },
+            }, null, 2));
+            const res = runOmx(wd, ["doctor"], {
+                HOME: home,
+                CODEX_HOME: codexDir,
+            });
+            if (shouldSkipForSpawnPermissions(res.error))
+                return;
+            assert.equal(res.status, 0, res.stderr || res.stdout);
+            assert.match(res.stdout, new RegExp(`\\[OK\\] Native hooks: plugin-scoped hooks are enabled; existing hooks\\.json at .*\\.codex[\\/]+hooks\\.json is treated as user-owned because plugin-scoped hooks are enabled, and plugin cache native hook coverage smoke passed via ${join(cacheDir, "hooks", "hooks.json").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`));
+            assert.doesNotMatch(res.stdout, /hooks\.json is missing OMX-managed coverage/);
+            assert.doesNotMatch(res.stdout, /run "omx setup --force" to restore native hooks/);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("warns when hooks.json is missing OMX-managed native hook coverage", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-doctor-hooks-coverage-"));
         try {