oh-my-codex 0.19.0 → 0.20.0

package/dist/scripts/__tests__/codex-native-hook.test.js

@@ -1479,6 +1479,166 @@ PY`,
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it("adds resume-by-id instructions for persisted subagents on SessionStart resume", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-subagent-reopen-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "omx-reopen-session";
+            await writeSessionStart(cwd, sessionId, { nativeSessionId: "codex-leader-reopen", pid: process.pid });
+            await writeJson(join(stateDir, "subagent-tracking.json"), {
+                schemaVersion: 1,
+                sessions: {
+                    [sessionId]: {
+                        session_id: sessionId,
+                        leader_thread_id: "codex-leader-reopen",
+                        updated_at: "2026-07-09T00:00:00.000Z",
+                        threads: {
+                            "codex-leader-reopen": {
+                                thread_id: "codex-leader-reopen",
+                                kind: "leader",
+                                first_seen_at: "2026-07-09T00:00:00.000Z",
+                                last_seen_at: "2026-07-09T00:00:00.000Z",
+                                turn_count: 1,
+                            },
+                            "thread-architect-reopen": {
+                                thread_id: "thread-architect-reopen",
+                                kind: "subagent",
+                                first_seen_at: "2026-07-09T00:01:00.000Z",
+                                last_seen_at: "2026-07-09T00:01:00.000Z",
+                                turn_count: 2,
+                                role: "architect",
+                                lane_id: "plan-review",
+                                scope: "SessionStart reopen",
+                                status: "available",
+                                last_handoff_summary: "reviewed the restart plan",
+                            },
+                        },
+                    },
+                },
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "SessionStart",
+                cwd,
+                session_id: "codex-leader-reopen",
+                source: "resume",
+            }, { cwd, sessionOwnerPid: process.pid });
+            const additionalContext = String(result.outputJson?.hookSpecificOutput?.additionalContext ?? "");
+            assert.match(additionalContext, /\[Persisted subagent reopen\]/);
+            assert.match(additionalContext, /resume_agent\("thread-architect-reopen"\)/);
+            assert.match(additionalContext, /role: architect; lane: plan-review; scope: SessionStart reopen; status: available/);
+            assert.match(additionalContext, /saved subagent ids found: 1/);
+            const tracking = JSON.parse(await readFile(join(stateDir, "subagent-tracking.json"), "utf-8"));
+            assert.match(tracking.sessions?.[sessionId]?.threads?.["thread-architect-reopen"]?.resume_requested_at ?? "", /^\d{4}-\d{2}-\d{2}T/);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("does not suggest duplicate same-role subagent spawns when reopen ids exist", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-subagent-no-duplicates-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "omx-reuse-session";
+            await writeSessionStart(cwd, sessionId, { nativeSessionId: "codex-leader-reuse", pid: process.pid });
+            await writeJson(join(stateDir, "subagent-tracking.json"), {
+                schemaVersion: 1,
+                sessions: {
+                    [sessionId]: {
+                        session_id: sessionId,
+                        leader_thread_id: "codex-leader-reuse",
+                        updated_at: "2026-07-09T00:00:00.000Z",
+                        threads: {
+                            "codex-leader-reuse": {
+                                thread_id: "codex-leader-reuse",
+                                kind: "leader",
+                                first_seen_at: "2026-07-09T00:00:00.000Z",
+                                last_seen_at: "2026-07-09T00:00:00.000Z",
+                                turn_count: 1,
+                            },
+                            "thread-critic-reuse": {
+                                thread_id: "thread-critic-reuse",
+                                kind: "subagent",
+                                first_seen_at: "2026-07-09T00:01:00.000Z",
+                                last_seen_at: "2026-07-09T00:01:00.000Z",
+                                turn_count: 1,
+                                role: "critic",
+                                lane_id: "risk-review",
+                                status: "closed",
+                            },
+                        },
+                    },
+                },
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "SessionStart",
+                cwd,
+                session_id: "codex-leader-reuse",
+                source: "startup",
+            }, { cwd, sessionOwnerPid: process.pid });
+            const additionalContext = String(result.outputJson?.hookSpecificOutput?.additionalContext ?? "");
+            assert.match(additionalContext, /resume_agent\("thread-critic-reuse"\)/);
+            assert.match(additionalContext, /avoid duplicate same-type subagent spawns/);
+            assert.match(additionalContext, /do not spawn a new agent solely because reopen failed/);
+            assert.doesNotMatch(additionalContext, /spawn.*critic.*replacement/i);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("surfaces clear warnings for unavailable persisted subagents without spawning replacements", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-subagent-warning-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "omx-warning-session";
+            await writeSessionStart(cwd, sessionId, { nativeSessionId: "codex-leader-warning", pid: process.pid });
+            await writeJson(join(stateDir, "subagent-tracking.json"), {
+                schemaVersion: 1,
+                sessions: {
+                    [sessionId]: {
+                        session_id: sessionId,
+                        leader_thread_id: "codex-leader-warning",
+                        updated_at: "2026-07-09T00:00:00.000Z",
+                        threads: {
+                            "codex-leader-warning": {
+                                thread_id: "codex-leader-warning",
+                                kind: "leader",
+                                first_seen_at: "2026-07-09T00:00:00.000Z",
+                                last_seen_at: "2026-07-09T00:00:00.000Z",
+                                turn_count: 1,
+                            },
+                            "thread-executor-unavailable": {
+                                thread_id: "thread-executor-unavailable",
+                                kind: "subagent",
+                                first_seen_at: "2026-07-09T00:01:00.000Z",
+                                last_seen_at: "2026-07-09T00:01:00.000Z",
+                                turn_count: 1,
+                                role: "executor",
+                                lane_id: "implementation",
+                                status: "unavailable",
+                                resume_failed_at: "2026-07-09T00:02:00.000Z",
+                                resume_failure_reason: "Codex reported missing thread id",
+                            },
+                        },
+                    },
+                },
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "SessionStart",
+                cwd,
+                session_id: "codex-leader-warning",
+                source: "resume",
+            }, { cwd, sessionOwnerPid: process.pid });
+            const additionalContext = String(result.outputJson?.hookSpecificOutput?.additionalContext ?? "");
+            assert.match(additionalContext, /No compatible saved subagent id is currently marked reopenable/);
+            assert.match(additionalContext, /Reopen warnings:/);
+            assert.match(additionalContext, /thread-executor-unavailable/);
+            assert.match(additionalContext, /last failure: Codex reported missing thread id/);
+            assert.doesNotMatch(additionalContext, /resume_agent\("thread-executor-unavailable"\)/);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("preserves canonical OMX session scope when native SessionStart arrives with a different id", async () => {
         const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-session-reconcile-"));
         try {
@@ -4150,6 +4310,66 @@ standardMaxRounds = 15
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it("keeps conductor guidance on autopilot activation after capacity-only native subagent evidence", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-autopilot-capacity-native-"));
+        try {
+            await mkdir(join(cwd, ".omx", "state"), { recursive: true });
+            await dispatchCodexNativeHook({
+                hook_event_name: "PostToolUse",
+                cwd,
+                session_id: "sess-autopilot-capacity-native",
+                thread_id: "thread-autopilot-capacity-native",
+                turn_id: "turn-autopilot-capacity-native-spawn",
+                tool_name: "multi_agent_v1.spawn_agent",
+                tool_response: { error: "collab spawn failed: agent thread limit reached" },
+            }, { cwd });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "UserPromptSubmit",
+                cwd,
+                session_id: "sess-autopilot-capacity-native",
+                thread_id: "thread-autopilot-capacity-native",
+                turn_id: "turn-autopilot-capacity-native-prompt",
+                prompt: "$autopilot implement issue #3078",
+            }, { cwd });
+            assert.equal(result.omxEventName, "keyword-detector");
+            assert.equal(result.skillState?.skill, "autopilot");
+            const message = String(result.outputJson?.hookSpecificOutput?.additionalContext || "");
+            assert.match(message, /Autopilot protocol:/);
+            assert.match(message, /Conductor mode contract:/);
+            assert.match(message, /Golden Rule: When the Main agent is acting in Conductor mode/);
+            assert.match(message, /Conductor reuse and ledger guidance:/);
+            assert.doesNotMatch(message, /Native subagent support is unavailable in this environment/);
+            assert.doesNotMatch(message, /Reason: agent_thread_limit_reached/);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("omits conductor block and emits unsupported native guidance for unsupported autopilot first-run payload", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-autopilot-unsupported-native-"));
+        try {
+            await mkdir(join(cwd, ".omx", "state"), { recursive: true });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "UserPromptSubmit",
+                cwd,
+                session_id: "sess-autopilot-unsupported-native",
+                thread_id: "thread-autopilot-unsupported-native",
+                turn_id: "turn-autopilot-unsupported-native",
+                prompt: "$autopilot implement issue #3078",
+                capabilities: { native_subagents: false, multi_agent_v1: false },
+            }, { cwd });
+            const message = String(result.outputJson?.hookSpecificOutput?.additionalContext || "");
+            assert.match(message, /Autopilot protocol:/);
+            assert.doesNotMatch(message, /Conductor mode contract:/);
+            assert.doesNotMatch(message, /Conductor reuse and ledger guidance:/);
+            assert.match(message, /Native subagent support is unavailable in this environment/);
+            assert.match(message, /Reason: native_subagents_unsupported/);
+            assert.match(message, /Do not call multi_agent_v1\.close_agent/);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("records ultragoal prompt skill activation with goal-tool handoff guidance", async () => {
         const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-ultragoal-"));
         try {
@@ -6035,6 +6255,71 @@ exit 0
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it("does not self-lock PreToolUse after completed deep-interview handoff leaves Autopilot in deep-interview phase", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-pretool-deep-interview-completed-autopilot-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-di-completed-autopilot";
+            const threadId = "thread-di-completed-autopilot";
+            const sessionDir = join(stateDir, "sessions", sessionId);
+            await mkdir(sessionDir, { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId, cwd });
+            await writeJson(join(sessionDir, "skill-active-state.json"), {
+                version: 1,
+                active: true,
+                skill: "autopilot",
+                keyword: "$autopilot",
+                phase: "deep-interview",
+                initialized_mode: "autopilot",
+                initialized_state_path: `.omx/state/sessions/${sessionId}/autopilot-state.json`,
+                session_id: sessionId,
+                thread_id: threadId,
+                active_skills: [{ skill: "autopilot", phase: "deep-interview", active: true, session_id: sessionId, thread_id: threadId }],
+            });
+            await writeJson(join(sessionDir, "deep-interview-state.json"), {
+                active: false,
+                mode: "deep-interview",
+                current_phase: "completed",
+                session_id: sessionId,
+                thread_id: threadId,
+                deep_interview_gate: {
+                    status: "complete",
+                    handoff_summary: "Requirements were clarified before the Autopilot handoff.",
+                },
+            });
+            await writeJson(join(sessionDir, "autopilot-state.json"), {
+                active: true,
+                mode: "autopilot",
+                current_phase: "deep-interview",
+                session_id: sessionId,
+                thread_id: threadId,
+            });
+            const implementationEdit = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: threadId,
+                tool_name: "Edit",
+                tool_use_id: "tool-di-completed-autopilot-edit",
+                tool_input: { file_path: "src/runtime.ts", old_string: "a", new_string: "b" },
+            }, { cwd });
+            assert.equal(implementationEdit.omxEventName, "pre-tool-use");
+            assert.equal(implementationEdit.outputJson, null);
+            const stateRepair = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: threadId,
+                tool_name: "mcp__omx_state__state_write",
+                tool_use_id: "tool-di-completed-autopilot-state-repair",
+                tool_input: { mode: "autopilot", current_phase: "ralplan", active: true },
+            }, { cwd });
+            assert.equal(stateRepair.outputJson, null);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("allows deep-interview artifact and state writes while blocking implementation Bash writes", async () => {
         const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-pretool-deep-interview-artifact-"));
         try {
@@ -6457,6 +6742,69 @@ exit 0
                 }, { cwd });
                 assert.equal(protectedWrite.outputJson?.decision, "block", `${filePath} should not be model-writable during deep-interview`);
             }
+            const runtimeRoot = await mkdtemp(join(tmpdir(), "omx-native-hook-pretool-deep-interview-runtime-root-"));
+            const previousOmxRoot = process.env.OMX_ROOT;
+            const runtimeSessionId = "sess-di-runtime-artifact";
+            const runtimeStateDir = join(runtimeRoot, ".omx", "state");
+            const runtimeSessionDir = join(runtimeStateDir, "sessions", runtimeSessionId);
+            try {
+                process.env.OMX_ROOT = runtimeRoot;
+                await mkdir(runtimeSessionDir, { recursive: true });
+                await writeJson(join(runtimeStateDir, "session.json"), { session_id: runtimeSessionId, cwd });
+                await writeJson(join(runtimeSessionDir, "skill-active-state.json"), {
+                    version: 1,
+                    active: true,
+                    skill: "deep-interview",
+                    phase: "planning",
+                    session_id: runtimeSessionId,
+                    thread_id: threadId,
+                    active_skills: [{ skill: "deep-interview", phase: "planning", active: true, session_id: runtimeSessionId, thread_id: threadId }],
+                });
+                await writeJson(join(runtimeSessionDir, "deep-interview-state.json"), {
+                    active: true,
+                    mode: "deep-interview",
+                    current_phase: "intent-first",
+                    session_id: runtimeSessionId,
+                    thread_id: threadId,
+                });
+                const allowedRuntimeStateWrite = await dispatchCodexNativeHook({
+                    hook_event_name: "PreToolUse",
+                    cwd,
+                    session_id: runtimeSessionId,
+                    thread_id: threadId,
+                    tool_name: "Write",
+                    tool_use_id: "tool-di-runtime-state-write",
+                    tool_input: { file_path: join(runtimeSessionDir, "deep-interview-state.json"), content: "{}\n" },
+                }, { cwd });
+                assert.equal(allowedRuntimeStateWrite.outputJson, null);
+                const blockedRuntimeStatePeerWrite = await dispatchCodexNativeHook({
+                    hook_event_name: "PreToolUse",
+                    cwd,
+                    session_id: runtimeSessionId,
+                    thread_id: threadId,
+                    tool_name: "Write",
+                    tool_use_id: "tool-di-runtime-peer-state-write",
+                    tool_input: { file_path: join(runtimeRoot, ".omx", "state", "sessions", "../outside", "deep-interview-state.json"), content: "{}\n" },
+                }, { cwd });
+                assert.equal(blockedRuntimeStatePeerWrite.outputJson?.decision, "block");
+                const blockedRuntimeUnrelatedWrite = await dispatchCodexNativeHook({
+                    hook_event_name: "PreToolUse",
+                    cwd,
+                    session_id: runtimeSessionId,
+                    thread_id: threadId,
+                    tool_name: "Write",
+                    tool_use_id: "tool-di-runtime-unrelated-write",
+                    tool_input: { file_path: join(runtimeRoot, "unrelated", "deep-interview-state.json"), content: "{}\n" },
+                }, { cwd });
+                assert.equal(blockedRuntimeUnrelatedWrite.outputJson?.decision, "block");
+            }
+            finally {
+                if (typeof previousOmxRoot === "string")
+                    process.env.OMX_ROOT = previousOmxRoot;
+                else
+                    delete process.env.OMX_ROOT;
+                await rm(runtimeRoot, { recursive: true, force: true });
+            }
             // Cross-mode non-terminal `omx state write` payloads are activations,
             // because state_write normalizes them to active=true after the hook.
             const blockedStateCliMutation = await preToolUse({
@@ -9306,6 +9654,32 @@ PY`,
             assert.equal(blocker.tool_name, "multi_agent_v1.spawn_agent");
             assert.match(String(blocker.error_summary), /agent thread limit reached/);
             assert.ok(Date.parse(String(blocker.expires_at)) > Date.parse(String(blocker.observed_at)));
+            assert.equal(existsSync(join(cwd, ".omx", "state", "native-subagent-support.json")), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("records unsupported native subagent support blocker from spawn_agent PostToolUse output", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-subagent-support-record-"));
+        try {
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "PostToolUse",
+                cwd,
+                session_id: "sess-subagent-support-record",
+                thread_id: "thread-subagent-support-record",
+                turn_id: "turn-subagent-support-record",
+                tool_name: "multi_agent_v1.spawn_agent",
+                tool_response: { error: "unknown tool: multi_agent_v1.spawn_agent is unavailable" },
+            }, { cwd });
+            assert.equal(result.omxEventName, "post-tool-use");
+            const blocker = JSON.parse(await readFile(join(cwd, ".omx", "state", "native-subagent-support.json"), "utf-8"));
+            assert.equal(blocker.status, "unsupported");
+            assert.equal(blocker.reason, "multi_agent_v1_unavailable");
+            assert.equal(blocker.session_id, "sess-subagent-support-record");
+            assert.equal(blocker.thread_id, "thread-subagent-support-record");
+            assert.equal(blocker.tool_name, "multi_agent_v1.spawn_agent");
+            assert.match(String(blocker.evidence), /unknown tool/);
         }
         finally {
             await rm(cwd, { recursive: true, force: true });
@@ -13406,13 +13780,14 @@ PY`,
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it("keeps blocking current session ralplan when canonical root inactive ralplan state lacks project context", async () => {
-        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-stop-ralplan-canonical-root-no-cwd-"));
+    it("clears stale ralplan Stop cache when authoritative state is terminal inactive", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-stop-ralplan-terminal-cache-"));
         try {
             const stateDir = join(cwd, ".omx", "state");
-            const sessionId = "sess-stop-ralplan-canonical-root-no-cwd";
+            const sessionId = "sess-stop-ralplan-terminal-cache";
+            const threadId = "thread-stop-ralplan-terminal-cache";
             await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
-            await writeJson(join(stateDir, "session.json"), { session_id: sessionId });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId, cwd });
             await writeJson(join(stateDir, "skill-active-state.json"), {
                 active: false,
                 skill: "ralplan",
@@ -13424,52 +13799,119 @@ PY`,
                 active: false,
                 mode: "ralplan",
                 current_phase: "complete",
+                status: "complete",
+                run_outcome: "complete",
                 session_id: sessionId,
+                cwd,
             });
             await writeJson(join(stateDir, "sessions", sessionId, "skill-active-state.json"), {
-                active: true,
+                active: false,
                 skill: "ralplan",
-                phase: "planning",
+                phase: "complete",
                 session_id: sessionId,
-                active_skills: [{
-                        skill: "ralplan",
-                        phase: "planning",
-                        active: true,
-                        session_id: sessionId,
-                    }],
+                active_skills: [],
             });
             await writeJson(join(stateDir, "sessions", sessionId, "ralplan-state.json"), {
-                active: true,
+                active: false,
                 mode: "ralplan",
-                current_phase: "planning",
+                current_phase: "complete",
+                status: "complete",
+                run_outcome: "complete",
                 session_id: sessionId,
                 cwd,
             });
+            await writeJson(join(stateDir, "native-stop-state.json"), {
+                sessions: {
+                    [sessionId]: {
+                        last_signature: `skill-stop|${sessionId}|${threadId}|no-message|skill_ralplan_planning_continue_artifact`,
+                        updated_at: "2026-07-04T00:00:00.000Z",
+                    },
+                    [threadId]: {
+                        last_signature: `skill-stop|${sessionId}|${threadId}|no-message|skill_ralplan_planning_continue_artifact`,
+                        updated_at: "2026-07-04T00:00:00.000Z",
+                    },
+                },
+            });
             const result = await dispatchCodexNativeHook({
                 hook_event_name: "Stop",
                 cwd,
                 session_id: sessionId,
+                thread_id: threadId,
+                stop_hook_active: true,
             }, { cwd });
             assert.equal(result.omxEventName, "stop");
-            assert.equal(result.outputJson?.decision, "block");
-            assert.equal(result.outputJson?.stopReason, "skill_ralplan_planning_continue_artifact");
+            assert.equal(result.outputJson, null);
+            const stopState = JSON.parse(await readFile(join(stateDir, "native-stop-state.json"), "utf-8"));
+            assert.deepEqual(stopState.sessions, {});
         }
         finally {
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it("keeps blocking current session ralplan when root inactive ralplan state belongs to another session", async () => {
-        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-stop-session-ralplan-root-other-session-"));
+    it("keeps blocking current session ralplan when canonical root inactive ralplan state lacks project context", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-stop-ralplan-canonical-root-no-cwd-"));
         try {
             const stateDir = join(cwd, ".omx", "state");
-            const sessionId = "sess-stop-current-active-ralplan";
+            const sessionId = "sess-stop-ralplan-canonical-root-no-cwd";
             await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
             await writeJson(join(stateDir, "session.json"), { session_id: sessionId });
             await writeJson(join(stateDir, "skill-active-state.json"), {
                 active: false,
                 skill: "ralplan",
                 phase: "complete",
-                session_id: "sess-stop-old-ralplan",
+                session_id: sessionId,
+                active_skills: [],
+            });
+            await writeJson(join(stateDir, "ralplan-state.json"), {
+                active: false,
+                mode: "ralplan",
+                current_phase: "complete",
+                session_id: sessionId,
+            });
+            await writeJson(join(stateDir, "sessions", sessionId, "skill-active-state.json"), {
+                active: true,
+                skill: "ralplan",
+                phase: "planning",
+                session_id: sessionId,
+                active_skills: [{
+                        skill: "ralplan",
+                        phase: "planning",
+                        active: true,
+                        session_id: sessionId,
+                    }],
+            });
+            await writeJson(join(stateDir, "sessions", sessionId, "ralplan-state.json"), {
+                active: true,
+                mode: "ralplan",
+                current_phase: "planning",
+                session_id: sessionId,
+                cwd,
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "Stop",
+                cwd,
+                session_id: sessionId,
+            }, { cwd });
+            assert.equal(result.omxEventName, "stop");
+            assert.equal(result.outputJson?.decision, "block");
+            assert.equal(result.outputJson?.stopReason, "skill_ralplan_planning_continue_artifact");
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("keeps blocking current session ralplan when root inactive ralplan state belongs to another session", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-stop-session-ralplan-root-other-session-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-stop-current-active-ralplan";
+            await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId });
+            await writeJson(join(stateDir, "skill-active-state.json"), {
+                active: false,
+                skill: "ralplan",
+                phase: "complete",
+                session_id: "sess-stop-old-ralplan",
                 active_skills: [],
             });
             await writeJson(join(stateDir, "ralplan-state.json"), {
@@ -17635,6 +18077,50 @@ PY`,
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it("blocks unsupported active conductor source edits with native delegation recovery guidance", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-unsupported-conductor-source-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-unsupported-conductor-source";
+            await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId });
+            await writeSessionSkillActiveState(stateDir, sessionId, "ultragoal", "planning");
+            await writeJson(join(stateDir, "sessions", sessionId, "ultragoal-state.json"), {
+                active: true,
+                mode: "ultragoal",
+                current_phase: "planning",
+                session_id: sessionId,
+            });
+            await writeJson(join(stateDir, "native-subagent-support.json"), {
+                schema_version: 1,
+                status: "unsupported",
+                reason: "multi_agent_v1_unavailable",
+                session_id: sessionId,
+                evidence: "unknown tool: multi_agent_v1.spawn_agent",
+                observed_at: new Date().toISOString(),
+                cwd,
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: "thread-unsupported-conductor-source",
+                tool_name: "Write",
+                tool_input: { file_path: "src/runtime.ts", content: "export const value = 1;\n" },
+            }, { cwd });
+            const output = result.outputJson;
+            const context = String(output?.hookSpecificOutput?.additionalContext ?? "");
+            assert.equal(output?.decision, "block");
+            assert.match(String(result.outputJson?.reason ?? ""), /Main-root Conductor mode is active \(ultragoal phase: planning\)/);
+            assert.match(context, /Native subagent support is unavailable in this environment/);
+            assert.match(context, /Reason: multi_agent_v1_unavailable/);
+            assert.match(context, /blocked\/cancelled/);
+            assert.match(context, /do not call multi_agent_v1\.close_agent/i);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("blocks Main-root ralplan writes even when payload has only a typed agent_role", async () => {
         const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-ralplan-agent-role-main-"));
         try {
@@ -17766,6 +18252,203 @@ PY`,
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it("allows conductor writes from tracked typed native subagents when PreToolUse omits thread_spawn source", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-conductor-tracked-subagent-no-source-"));
+        const originalOmxRoot = process.env.OMX_ROOT;
+        const originalOmxStateRoot = process.env.OMX_STATE_ROOT;
+        const originalOmxTeamStateRoot = process.env.OMX_TEAM_STATE_ROOT;
+        try {
+            process.env.OMX_ROOT = cwd;
+            delete process.env.OMX_STATE_ROOT;
+            delete process.env.OMX_TEAM_STATE_ROOT;
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-conductor-tracked-subagent-no-source";
+            const leaderThreadId = "thread-conductor-leader-no-source";
+            const childThreadId = "thread-conductor-child-no-source";
+            const nowIso = new Date().toISOString();
+            await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId, native_session_id: leaderThreadId });
+            await writeSessionSkillActiveState(stateDir, sessionId, "ultragoal", "executing");
+            await writeJson(join(stateDir, "sessions", sessionId, "ultragoal-state.json"), {
+                active: true,
+                mode: "ultragoal",
+                current_phase: "executing",
+                session_id: sessionId,
+            });
+            await writeJson(join(stateDir, "subagent-tracking.json"), {
+                schemaVersion: 1,
+                sessions: {
+                    [sessionId]: {
+                        session_id: sessionId,
+                        leader_thread_id: leaderThreadId,
+                        updated_at: nowIso,
+                        threads: {
+                            [leaderThreadId]: { thread_id: leaderThreadId, kind: "leader", first_seen_at: nowIso, last_seen_at: nowIso, turn_count: 1 },
+                            [childThreadId]: { thread_id: childThreadId, kind: "subagent", mode: "executor", first_seen_at: nowIso, last_seen_at: nowIso, turn_count: 1 },
+                        },
+                    },
+                },
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: childThreadId,
+                agent_role: "executor",
+                tool_name: "apply_patch",
+                tool_input: { file_path: "configs/ws/kalshi_ws_auth_evidence.json" },
+            }, { cwd });
+            assert.equal(result.outputJson, null);
+        }
+        finally {
+            if (originalOmxRoot === undefined)
+                delete process.env.OMX_ROOT;
+            else
+                process.env.OMX_ROOT = originalOmxRoot;
+            if (originalOmxStateRoot === undefined)
+                delete process.env.OMX_STATE_ROOT;
+            else
+                process.env.OMX_STATE_ROOT = originalOmxStateRoot;
+            if (originalOmxTeamStateRoot === undefined)
+                delete process.env.OMX_TEAM_STATE_ROOT;
+            else
+                process.env.OMX_TEAM_STATE_ROOT = originalOmxTeamStateRoot;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("blocks conductor writes when corrupt tracker state labels the leader as a subagent", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-conductor-corrupt-leader-subagent-"));
+        const originalOmxRoot = process.env.OMX_ROOT;
+        const originalOmxStateRoot = process.env.OMX_STATE_ROOT;
+        const originalOmxTeamStateRoot = process.env.OMX_TEAM_STATE_ROOT;
+        try {
+            process.env.OMX_ROOT = cwd;
+            delete process.env.OMX_STATE_ROOT;
+            delete process.env.OMX_TEAM_STATE_ROOT;
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-conductor-corrupt-leader-subagent";
+            const leaderThreadId = "thread-conductor-corrupt-leader";
+            const nowIso = new Date().toISOString();
+            await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId, native_session_id: leaderThreadId });
+            await writeSessionSkillActiveState(stateDir, sessionId, "ultragoal", "executing");
+            await writeJson(join(stateDir, "sessions", sessionId, "ultragoal-state.json"), {
+                active: true,
+                mode: "ultragoal",
+                current_phase: "executing",
+                session_id: sessionId,
+            });
+            await writeJson(join(stateDir, "subagent-tracking.json"), {
+                schemaVersion: 1,
+                sessions: {
+                    [sessionId]: {
+                        session_id: sessionId,
+                        leader_thread_id: leaderThreadId,
+                        updated_at: nowIso,
+                        threads: {
+                            [leaderThreadId]: { thread_id: leaderThreadId, kind: "subagent", mode: "executor", first_seen_at: nowIso, last_seen_at: nowIso, turn_count: 1 },
+                        },
+                    },
+                },
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: leaderThreadId,
+                agent_role: "executor",
+                tool_name: "apply_patch",
+                tool_input: { file_path: "configs/ws/kalshi_ws_auth_evidence.json" },
+            }, { cwd });
+            assert.equal(result.outputJson?.decision, "block");
+            assert.match(String(result.outputJson?.reason ?? ""), /Main-root Conductor mode is active \(ultragoal phase: executing\)/);
+        }
+        finally {
+            if (originalOmxRoot === undefined)
+                delete process.env.OMX_ROOT;
+            else
+                process.env.OMX_ROOT = originalOmxRoot;
+            if (originalOmxStateRoot === undefined)
+                delete process.env.OMX_STATE_ROOT;
+            else
+                process.env.OMX_STATE_ROOT = originalOmxStateRoot;
+            if (originalOmxTeamStateRoot === undefined)
+                delete process.env.OMX_TEAM_STATE_ROOT;
+            else
+                process.env.OMX_TEAM_STATE_ROOT = originalOmxTeamStateRoot;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("blocks conductor writes when thread_spawn provenance is attached to the leader thread", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-conductor-thread-spawn-leader-"));
+        const originalOmxRoot = process.env.OMX_ROOT;
+        const originalOmxStateRoot = process.env.OMX_STATE_ROOT;
+        const originalOmxTeamStateRoot = process.env.OMX_TEAM_STATE_ROOT;
+        try {
+            process.env.OMX_ROOT = cwd;
+            delete process.env.OMX_STATE_ROOT;
+            delete process.env.OMX_TEAM_STATE_ROOT;
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-conductor-thread-spawn-leader";
+            const leaderThreadId = "thread-conductor-thread-spawn-leader";
+            const nowIso = new Date().toISOString();
+            await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId, native_session_id: leaderThreadId });
+            await writeSessionSkillActiveState(stateDir, sessionId, "ultragoal", "executing");
+            await writeJson(join(stateDir, "sessions", sessionId, "ultragoal-state.json"), {
+                active: true,
+                mode: "ultragoal",
+                current_phase: "executing",
+                session_id: sessionId,
+            });
+            await writeJson(join(stateDir, "subagent-tracking.json"), {
+                schemaVersion: 1,
+                sessions: {
+                    [sessionId]: {
+                        session_id: sessionId,
+                        leader_thread_id: leaderThreadId,
+                        updated_at: nowIso,
+                        threads: {
+                            [leaderThreadId]: { thread_id: leaderThreadId, kind: "leader", first_seen_at: nowIso, last_seen_at: nowIso, turn_count: 1 },
+                        },
+                    },
+                },
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: leaderThreadId,
+                agent_role: "executor",
+                source: {
+                    subagent: {
+                        thread_spawn: {
+                            parent_thread_id: leaderThreadId,
+                        },
+                    },
+                },
+                tool_name: "apply_patch",
+                tool_input: { file_path: "configs/ws/kalshi_ws_auth_evidence.json" },
+            }, { cwd });
+            assert.equal(result.outputJson?.decision, "block");
+            assert.match(String(result.outputJson?.reason ?? ""), /Main-root Conductor mode is active \(ultragoal phase: executing\)/);
+        }
+        finally {
+            if (originalOmxRoot === undefined)
+                delete process.env.OMX_ROOT;
+            else
+                process.env.OMX_ROOT = originalOmxRoot;
+            if (originalOmxStateRoot === undefined)
+                delete process.env.OMX_STATE_ROOT;
+            else
+                process.env.OMX_STATE_ROOT = originalOmxStateRoot;
+            if (originalOmxTeamStateRoot === undefined)
+                delete process.env.OMX_TEAM_STATE_ROOT;
+            else
+                process.env.OMX_TEAM_STATE_ROOT = originalOmxTeamStateRoot;
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("blocks Main-root ralph conductor source and planning artifact writes while allowing .omx workflow state writes", async () => {
         const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-ralph-conductor-write-"));
         try {
@@ -17837,6 +18520,65 @@ PY`,
             await rm(cwd, { recursive: true, force: true });
         }
     });
+    it("allows structured ultragoal steering cleanup through dynamic nested shell loops", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-ultragoal-steer-cleanup-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-ultragoal-steer-cleanup";
+            await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId });
+            await writeSessionSkillActiveState(stateDir, sessionId, "ultragoal", "planning");
+            await writeJson(join(stateDir, "sessions", sessionId, "ultragoal-state.json"), {
+                active: true,
+                mode: "ultragoal",
+                current_phase: "planning",
+                session_id: sessionId,
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: "thread-ultragoal-steer-cleanup",
+                tool_name: "Bash",
+                tool_input: {
+                    command: `bash -lc 'for goal_id in G001-atomized G002-atomized; do omx ultragoal steer --kind mark_blocked_superseded --target-goal-id "$goal_id" --evidence ".omx/ultragoal cleanup supersedes atomized pseudo-goals." --rationale "Structured steering cleanup keeps durable Ultragoal metadata auditable." --json; done'`,
+                },
+            }, { cwd });
+            assert.equal(result.outputJson, null);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it("blocks unsafe dynamic nested shell writes in conductor mode", async () => {
+        const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-dynamic-shell-write-block-"));
+        try {
+            const stateDir = join(cwd, ".omx", "state");
+            const sessionId = "sess-dynamic-shell-write-block";
+            await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+            await writeJson(join(stateDir, "session.json"), { session_id: sessionId });
+            await writeSessionSkillActiveState(stateDir, sessionId, "ultragoal", "planning");
+            await writeJson(join(stateDir, "sessions", sessionId, "ultragoal-state.json"), {
+                active: true,
+                mode: "ultragoal",
+                current_phase: "planning",
+                session_id: sessionId,
+            });
+            const result = await dispatchCodexNativeHook({
+                hook_event_name: "PreToolUse",
+                cwd,
+                session_id: sessionId,
+                thread_id: "thread-dynamic-shell-write-block",
+                tool_name: "Bash",
+                tool_input: { command: `bash -lc 'cp "$SOURCE_FILE" src/runtime.ts'` },
+            }, { cwd });
+            assert.equal(result.outputJson?.decision, "block");
+            assert.match(String(result.outputJson?.reason ?? ""), /Bash nested shell execution is dynamic and cannot be validated/);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
     it("blocks common Bash file mutations in Main-root conductor states unless they target workflow metadata", async () => {
         const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-conductor-bash-mutations-"));
         try {