oh-my-codex 0.18.6 → 0.18.8

package/src/scripts/codex-native-pre-post.ts

@@ -1223,6 +1223,85 @@ function hasActionableBashHardFailure(normalized: NormalizedPostToolUsePayload):
   return containsHardFailure(`${normalized.stderrText}\n${normalized.stdoutText}`);
 }
 
+function isShellEnvAssignment(token: string): boolean {
+  return /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(token);
+}
+
+function shellCommandBasename(token: string): string {
+  const normalized = token.replace(/\\/g, "/");
+  return (normalized.split("/").pop() || normalized).toLowerCase();
+}
+
+function skipEnvWrapper(tokens: string[]): number {
+  let index = 0;
+  while (isShellEnvAssignment(tokens[index] || "")) index += 1;
+  if (!isEnvExecutableToken(tokens[index] || "")) return index;
+
+  index += 1;
+  while (index < tokens.length) {
+    const token = tokens[index] || "";
+    if (token === "--") {
+      index += 1;
+      break;
+    }
+    if (isShellEnvAssignment(token)) {
+      index += 1;
+      continue;
+    }
+    if (envOptionConsumesNextValue(token)) {
+      index += 2;
+      continue;
+    }
+    if (token === "-i" || token === "--ignore-environment" || token.startsWith("-u") && token.length > 2) {
+      index += 1;
+      continue;
+    }
+    break;
+  }
+  return index;
+}
+
+function skipGhGlobalOptions(tokens: string[], startIndex: number): number {
+  let index = startIndex;
+  const optionsWithValue = new Set(["--repo", "-R", "--hostname", "--config-dir"]);
+  while (index < tokens.length) {
+    const token = tokens[index] || "";
+    if (optionsWithValue.has(token)) {
+      index += 2;
+      continue;
+    }
+    if (/^(?:--repo|--hostname|--config-dir)=/.test(token)) {
+      index += 1;
+      continue;
+    }
+    if (token.startsWith("-") && token !== "-") {
+      index += 1;
+      continue;
+    }
+    break;
+  }
+  return index;
+}
+
+function isReviewableGhPrChecksTokens(tokens: string[]): boolean {
+  const commandIndex = skipEnvWrapper(tokens);
+  const basename = shellCommandBasename(tokens[commandIndex] || "");
+  if (basename !== "gh" && basename !== "gh.exe") return false;
+  const subcommandIndex = skipGhGlobalOptions(tokens, commandIndex + 1);
+  return tokens[subcommandIndex] === "pr" && tokens[subcommandIndex + 1] === "checks";
+}
+
+function isReviewableNonZeroBashCommand(command: string): boolean {
+  const boundaryTokens = tokenizeShellCommandWithBoundaries(removeHereDocBodies(command));
+  if (!boundaryTokens) return false;
+  for (let commandStart = 0; commandStart < boundaryTokens.length; commandStart = nextCommandStart(boundaryTokens, commandStart)) {
+    const commandEnd = nextCommandStart(boundaryTokens, commandStart);
+    const commandTokens = boundaryTokens.slice(commandStart, commandEnd).map((candidate) => candidate.value);
+    if (isReviewableGhPrChecksTokens(commandTokens)) return true;
+  }
+  return false;
+}
+
 export function buildNativePostToolUseOutput(
   payload: CodexHookPayload,
 ): Record<string, unknown> | null {
@@ -1264,6 +1343,7 @@ export function buildNativePostToolUseOutput(
     && normalized.exitCode !== 0
     && combined.length > 0
     && !containsHardFailure(combined)
+    && isReviewableNonZeroBashCommand(normalized.normalizedCommand)
   ) {
     return {
       decision: "block",

package/src/scripts/demo-team-e2e.sh

@@ -89,10 +89,8 @@ OMX_TEAM_WORKER_LAUNCH_ARGS="${OMX_TEAM_WORKER_LAUNCH_ARGS:--c model_reasoning_e
 TEAM_STARTED=0
 cleanup() {
   if ((TEAM_STARTED == 1)); then
-    echo "[cleanup] shutting down team: $TEAM_NAME"
-    omx team shutdown "$TEAM_NAME" >/dev/null 2>&1 || true
-    echo "[cleanup] cleaning state for team: $TEAM_NAME"
-    omx team api cleanup --input "{\"team_name\":\"$TEAM_NAME\"}" --json >/dev/null 2>&1 || true
+    echo "[cleanup] force-cleaning demo team: $TEAM_NAME"
+    omx team api cleanup --input "{\"team_name\":\"$TEAM_NAME\",\"force\":true,\"confirm_issues\":true}" --json >/dev/null 2>&1 || true
   fi
 }
 trap cleanup EXIT
@@ -106,7 +104,13 @@ echo "OMX_TEAM_WORKER_CLI_MAP=$OMX_TEAM_WORKER_CLI_MAP"
 echo "OMX_TEAM_WORKER_LAUNCH_ARGS=$OMX_TEAM_WORKER_LAUNCH_ARGS"
 
 echo "[1/8] start team (${WORKER_COUNT} mixed workers)"
-omx team "${WORKER_COUNT}:executor" "$TEAM_TASK"
+START_OUTPUT="$(omx team "${WORKER_COUNT}:executor" "$TEAM_TASK")"
+echo "$START_OUTPUT"
+ACTUAL_TEAM_NAME="$(echo "$START_OUTPUT" | sed -nE 's/^Team started: ([^[:space:]]+)$/\1/p' | head -n 1)"
+if [[ -n "$ACTUAL_TEAM_NAME" && "$ACTUAL_TEAM_NAME" != "$TEAM_NAME" ]]; then
+  echo "TEAM_NAME_RESOLVED=$ACTUAL_TEAM_NAME"
+  TEAM_NAME="$ACTUAL_TEAM_NAME"
+fi
 TEAM_STARTED=1
 
 echo "[2/8] status"
@@ -174,8 +178,7 @@ SUMMARY_JSON="$(omx team api get-summary --input "$SUMMARY_INPUT" --json)"
 echo "$SUMMARY_JSON" | jq -e '.schema_version == "1.0" and .operation == "get-summary" and .ok == true' >/dev/null
 
 echo "[8/8] shutdown + cleanup"
-omx team shutdown "$TEAM_NAME"
-omx team api cleanup --input "{\"team_name\":\"$TEAM_NAME\"}" --json >/dev/null
+omx team api cleanup --input "{\"team_name\":\"$TEAM_NAME\",\"force\":true,\"confirm_issues\":true}" --json >/dev/null
 TEAM_STARTED=0
 
 echo "E2E demo complete."

package/src/scripts/eval/eval-parity-smoke.ts

@@ -9,7 +9,7 @@ if (build.status !== 0) {
 }
 
 const test = spawnSync('node', [
-  '--test',
+  'dist/scripts/run-test-files.js',
   'dist/autoresearch/__tests__/contracts.test.js',
   'dist/autoresearch/__tests__/runtime.test.js',
   'dist/cli/__tests__/autoresearch.test.js',

package/src/scripts/hook-payload-guard.ts

@@ -0,0 +1,113 @@
+export const MAX_NOTIFY_ARGV_JSON_BYTES = 64 * 1024;
+export const MAX_NATIVE_STDIN_JSON_BYTES = 1024 * 1024;
+export const RAW_JSON_FIELD_SCAN_BYTES = 64 * 1024;
+
+export const CODEX_HOOK_EVENT_NAMES = [
+  "SessionStart",
+  "PreToolUse",
+  "PostToolUse",
+  "UserPromptSubmit",
+  "PreCompact",
+  "PostCompact",
+  "Stop",
+] as const;
+
+export type RawCodexHookEventName = typeof CODEX_HOOK_EVENT_NAMES[number];
+
+export function utf8ByteLength(value: string): number {
+  return Buffer.byteLength(value, "utf-8");
+}
+
+function skipJsonWhitespace(raw: string, index: number): number {
+  while (index < raw.length && /\s/.test(raw[index] ?? "")) index += 1;
+  return index;
+}
+
+function readJsonStringLiteral(raw: string, quoteIndex: number): { value: string; endIndex: number } | null {
+  if (raw[quoteIndex] !== '"') return null;
+  let value = "";
+  for (let index = quoteIndex + 1; index < raw.length; index += 1) {
+    const char = raw[index];
+    if (char === '"') return { value, endIndex: index + 1 };
+    if (char !== "\\") {
+      value += char;
+      continue;
+    }
+
+    index += 1;
+    if (index >= raw.length) return null;
+    const escaped = raw[index];
+    switch (escaped) {
+      case '"':
+      case "\\":
+      case "/":
+        value += escaped;
+        break;
+      case "b":
+        value += "\b";
+        break;
+      case "f":
+        value += "\f";
+        break;
+      case "n":
+        value += "\n";
+        break;
+      case "r":
+        value += "\r";
+        break;
+      case "t":
+        value += "\t";
+        break;
+      case "u": {
+        const hex = raw.slice(index + 1, index + 5);
+        if (!/^[0-9a-fA-F]{4}$/.test(hex)) return null;
+        value += String.fromCharCode(Number.parseInt(hex, 16));
+        index += 4;
+        break;
+      }
+      default:
+        return null;
+    }
+  }
+  return null;
+}
+
+export function extractRawJsonStringField(rawInput: string, fieldNames: readonly string[]): string | null {
+  const raw = rawInput.slice(0, RAW_JSON_FIELD_SCAN_BYTES);
+  const wanted = new Set(fieldNames);
+  let depth = 0;
+  let index = 0;
+
+  while (index < raw.length) {
+    const char = raw[index];
+    if (char === '"') {
+      const key = readJsonStringLiteral(raw, index);
+      if (!key) return null;
+      index = key.endIndex;
+      const afterKey = skipJsonWhitespace(raw, index);
+      if (depth === 1 && raw[afterKey] === ":" && wanted.has(key.value)) {
+        const valueStart = skipJsonWhitespace(raw, afterKey + 1);
+        const value = readJsonStringLiteral(raw, valueStart);
+        return value?.value ?? null;
+      }
+      continue;
+    }
+    if (char === "{") depth += 1;
+    else if (char === "}") depth = Math.max(0, depth - 1);
+    index += 1;
+  }
+
+  return null;
+}
+
+export function extractRawCodexHookEventName(rawInput: string): RawCodexHookEventName | null {
+  const raw = extractRawJsonStringField(rawInput, [
+    "hook_event_name",
+    "hookEventName",
+    "event",
+    "name",
+  ]);
+  return CODEX_HOOK_EVENT_NAMES.includes(raw as RawCodexHookEventName)
+    ? raw as RawCodexHookEventName
+    : null;
+}

package/src/scripts/notify-fallback-watcher.ts

@@ -1963,10 +1963,15 @@ function shutdown(signal: string): void {
 }
 
 async function main(): Promise<void> {
+  if (process.env.NODE_ENV === 'test' && process.env.OMX_NOTIFY_FALLBACK_TEST_FATAL === '1') {
+    throw new Error('test fatal notify fallback failure');
+  }
   await mkdir(logsDir, { recursive: true }).catch(() => {});
   await mkdir(stateDir, { recursive: true }).catch(() => {});
   if (!existsSync(notifyScript)) {
+    const reason = `notify script missing: ${notifyScript}`;
     await eventLog({ type: 'watcher_error', reason: 'notify_script_missing', notify_script: notifyScript });
+    process.stderr.write(`notify-fallback-watcher: ${reason}\n`);
     process.exit(1);
   }
 
@@ -2006,10 +2011,12 @@ async function main(): Promise<void> {
 
 main().catch(async (err) => {
   await mkdir(dirname(logPath), { recursive: true }).catch(() => {});
+  const message = err instanceof Error ? err.message : safeString(err);
   await eventLog({
     type: 'watcher_error',
     reason: 'fatal',
-    error: err instanceof Error ? err.message : safeString(err),
+    error: message,
   });
+  process.stderr.write(`notify-fallback-watcher: fatal: ${message || 'unknown error'}\n`);
   process.exit(1);
 });

package/src/scripts/notify-hook/__tests__/payload-guard.test.ts

@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, it } from 'node:test';
+import { MAX_NOTIFY_ARGV_JSON_BYTES } from '../../hook-payload-guard.js';
+
+function notifyHookScriptPath(): string {
+  return join(process.cwd(), 'dist', 'scripts', 'notify-hook.js');
+}
+
+describe('notify-hook raw payload guard', () => {
+  it('ignores oversized argv JSON before parsing or writing hook state', async () => {
+    const cwd = await mkdtemp(join(tmpdir(), 'omx-notify-hook-oversized-'));
+    try {
+      await mkdir(join(cwd, '.omx'), { recursive: true });
+      await writeFile(join(cwd, '.omx', 'setup-scope.json'), '{}', 'utf-8');
+      const payload = JSON.stringify({
+        cwd,
+        type: 'agent-turn-complete',
+        session_id: 'sess-notify-oversized',
+        turn_id: 'turn-notify-oversized',
+        input_messages: ['hello'],
+        last_assistant_message: 'x'.repeat(MAX_NOTIFY_ARGV_JSON_BYTES + 1),
+      });
+
+      execFileSync(process.execPath, [notifyHookScriptPath(), payload], {
+        cwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: process.env,
+      });
+
+      assert.equal(existsSync(join(cwd, '.omx', 'logs')), false);
+      assert.equal(existsSync(join(cwd, '.omx', 'state')), false);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+});

package/src/scripts/notify-hook/auto-nudge.ts

@@ -269,7 +269,9 @@ export async function syncSkillStateFromTurn(stateDir, payload) {
 
 
 export async function isDeepInterviewStateActive(stateDir, sessionId) {
-  const modeState = await readScopedJsonIfExists(stateDir, 'deep-interview-state.json', sessionId, null);
+  const modeState = typeof sessionId === 'string' && sessionId.trim()
+    ? await readScopedJsonIfExists(stateDir, 'deep-interview-state.json', sessionId, null)
+    : await readJsonIfExists(join(stateDir, 'deep-interview-state.json'), null);
   return Boolean(modeState && modeState.active === true);
 }
 

package/src/scripts/notify-hook/ralph-session-resume.ts

@@ -1,8 +1,7 @@
 import { existsSync } from 'fs';
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'fs/promises';
-import { dirname, join, resolve } from 'path';
+import { dirname, join } from 'path';
 import { captureTmuxPaneFromEnv } from '../../state/mode-state-context.js';
-import { isSessionStateUsable } from '../../hooks/session.js';
 import { resolveCodexPane } from '../tmux-hook-engine.js';
 import { safeString } from './utils.js';
 
@@ -222,15 +221,10 @@ function readSessionIdFromEnvironment(env: NodeJS.ProcessEnv = process.env): str
 
 async function readCurrentOmxSessionId(stateDir: string, env: NodeJS.ProcessEnv = process.env): Promise<string> {
   const envSessionId = readSessionIdFromEnvironment(env);
-  if (envSessionId) {
-    const envScopedDir = join(stateDir, 'sessions', envSessionId);
-    if (existsSync(envScopedDir)) return envSessionId;
-  }
+  if (envSessionId) return envSessionId;
 
-  const cwd = resolve(stateDir, '..', '..');
   const session = await readJson(join(stateDir, 'session.json'));
   if (!session || typeof session !== 'object') return '';
-  if (!isSessionStateUsable(session as any, cwd)) return '';
   const sessionId = safeString(session?.session_id).trim();
   return SESSION_ID_PATTERN.test(sessionId) ? sessionId : '';
 }

package/src/scripts/notify-hook/state-io.ts

@@ -3,12 +3,10 @@
  */
 
 import { mkdir, readFile, readdir, writeFile } from 'fs/promises';
-import { dirname, join, resolve } from 'path';
-import { existsSync } from 'fs';
-import { isSessionStateUsable } from '../../hooks/session.js';
+import { dirname, join } from 'path';
+import { validateSessionId } from '../../mcp/state-paths.js';
 import { asNumber, safeString } from './utils.js';
 
-const SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 
 export { readdir };
 
@@ -25,46 +23,90 @@ function isSafeStateFileName(fileName: string): boolean {
     && !fileName.includes('\\');
 }
 
-function readSessionIdFromEnvironment(env: NodeJS.ProcessEnv = process.env): string | undefined {
-  const candidates = [env.OMX_SESSION_ID, env.CODEX_SESSION_ID, env.SESSION_ID];
-  for (const candidate of candidates) {
-    const sessionId = safeString(candidate).trim();
-    if (!SESSION_ID_PATTERN.test(sessionId)) continue;
-    return sessionId;
+interface SessionMetadata {
+  sessionId?: string;
+  nativeAliases: string[];
+}
+
+async function readSessionMetadataFromBaseStateDir(baseStateDir: string): Promise<SessionMetadata> {
+  const session = await readJsonIfExists(join(baseStateDir, 'session.json'), null);
+  let sessionId: string | undefined;
+  try {
+    sessionId = validateSessionId(session?.session_id);
+  } catch {
+    sessionId = undefined;
   }
-  return undefined;
+  const nativeAliases = [
+    session?.native_session_id,
+    session?.codex_session_id,
+    session?.previous_native_session_id,
+  ]
+    .map((value) => safeString(value).trim())
+    .filter(Boolean);
+  return { sessionId, nativeAliases: [...new Set(nativeAliases)] };
 }
 
-export async function readCurrentSessionId(baseStateDir: string): Promise<string | undefined> {
-  const envSessionId = readSessionIdFromEnvironment();
-  if (envSessionId) {
-    const envScopedDir = join(baseStateDir, 'sessions', envSessionId);
-    if (existsSync(envScopedDir)) return envSessionId;
+function readSessionIdFromEnvironment(): string | undefined {
+  for (const candidate of [process.env.OMX_SESSION_ID, process.env.CODEX_SESSION_ID, process.env.SESSION_ID]) {
+    if (typeof candidate !== 'string') continue;
+    const trimmed = candidate.trim();
+    if (!trimmed) continue;
+    try {
+      const sessionId = validateSessionId(trimmed);
+      if (sessionId) return sessionId;
+    } catch {
+      continue;
+    }
   }
+  return undefined;
+}
 
-  const cwd = resolve(baseStateDir, '..', '..');
-  const session = await readJsonIfExists(join(baseStateDir, 'session.json'), null);
-  if (!session || typeof session !== 'object') return undefined;
-  if (!isSessionStateUsable(session, cwd)) return undefined;
-  const sessionId = safeString(session?.session_id);
-  return SESSION_ID_PATTERN.test(sessionId) ? sessionId : undefined;
+function resolveCanonicalSessionId(candidate: string | undefined, metadata: SessionMetadata): string | undefined {
+  if (!candidate) return undefined;
+  return metadata.sessionId && metadata.nativeAliases.includes(candidate)
+    ? metadata.sessionId
+    : candidate;
 }
 
-export async function resolveScopedStateDir(
+async function resolveBaseScopedStateDir(
   baseStateDir: string,
   explicitSessionId?: string,
 ): Promise<string> {
-  const normalizedExplicit = safeString(explicitSessionId).trim();
-  if (SESSION_ID_PATTERN.test(normalizedExplicit)) {
-    return join(baseStateDir, 'sessions', normalizedExplicit);
-  }
+  const normalizedExplicit = typeof explicitSessionId === 'string' && explicitSessionId.trim()
+    ? explicitSessionId.trim()
+    : undefined;
+  const validatedExplicit = validateSessionId(normalizedExplicit);
+  const metadata = await readSessionMetadataFromBaseStateDir(baseStateDir);
+  const sessionId = resolveCanonicalSessionId(validatedExplicit, metadata)
+    ?? resolveCanonicalSessionId(readSessionIdFromEnvironment(), metadata)
+    ?? metadata.sessionId;
+  return sessionId ? join(baseStateDir, 'sessions', sessionId) : baseStateDir;
+}
 
-  const currentSessionId = await readCurrentSessionId(baseStateDir);
-  if (currentSessionId) {
-    return join(baseStateDir, 'sessions', currentSessionId);
-  }
+async function resolveBaseScopedStateDirs(
+  baseStateDir: string,
+  explicitSessionId?: string,
+  options: { includeRootFallback?: boolean } = {},
+): Promise<string[]> {
+  const scopedDir = await resolveBaseScopedStateDir(baseStateDir, explicitSessionId);
+  return options.includeRootFallback === true && scopedDir !== baseStateDir
+    ? [scopedDir, baseStateDir]
+    : [scopedDir];
+}
+
+
+
+
+export async function readCurrentSessionId(baseStateDir: string): Promise<string | undefined> {
+  const metadata = await readSessionMetadataFromBaseStateDir(baseStateDir);
+  return resolveCanonicalSessionId(readSessionIdFromEnvironment(), metadata) ?? metadata.sessionId;
+}
 
-  return baseStateDir;
+export async function resolveScopedStateDir(
+  baseStateDir: string,
+  explicitSessionId?: string,
+): Promise<string> {
+  return resolveBaseScopedStateDir(baseStateDir, explicitSessionId);
 }
 
 export async function getScopedStateDirsForCurrentSession(
@@ -72,11 +114,7 @@ export async function getScopedStateDirsForCurrentSession(
   explicitSessionId?: string,
   options: { includeRootFallback?: boolean } = {},
 ): Promise<string[]> {
-  const scopedDir = await resolveScopedStateDir(baseStateDir, explicitSessionId);
-  if (scopedDir === baseStateDir || options.includeRootFallback !== true) {
-    return [scopedDir];
-  }
-  return [scopedDir, baseStateDir];
+  return resolveBaseScopedStateDirs(baseStateDir, explicitSessionId, options);
 }
 
 export async function getScopedStatePath(

package/src/scripts/notify-hook/team-leader-nudge.ts

@@ -25,6 +25,7 @@ import { writeTeamLeaderAttention } from '../../team/state.js';
 import { readLatestTeamProgressEvidenceMs } from '../../team/progress-evidence.js';
 import { validateSessionId } from '../../mcp/state-paths.js';
 import { TEAM_NAME_SAFE_PATTERN } from '../../team/contracts.js';
+import { isDeepInterviewStateActive } from './auto-nudge.js';
 const LEADER_PANE_MISSING_NO_INJECTION_REASON = 'leader_pane_missing_no_injection';
 const LEADER_PANE_SHELL_NO_INJECTION_REASON = 'leader_pane_shell_no_injection';
 const LEADER_PANE_SAME_CLASSIFIED_STATE_SUPPRESSED_REASON = 'pane_already_shows_same_classified_state';
@@ -571,6 +572,12 @@ export async function maybeNudgeTeamLeader({
 
   const candidateTeamNames = new Set();
   const currentSessionId = await resolveCurrentSessionId(stateDir);
+  const deepInterviewActive = currentSessionId
+    ? await isDeepInterviewStateActive(stateDir, currentSessionId).catch(() => false)
+    : await isDeepInterviewStateActive(stateDir, undefined).catch(() => false);
+  if (deepInterviewActive) {
+    return;
+  }
   try {
     const scopedDirs = await getScopedStateDirsForCurrentSession(stateDir);
     const candidateStateDirs = [...new Set([...scopedDirs, stateDir])];