oh-my-codex 0.19.1 → 0.20.1

package/dist/scripts/codex-native-hook.js

@@ -6,7 +6,7 @@ import { pathToFileURL } from "url";
 import { readModeStateForActiveDecision, readModeStateForSession, updateModeState } from "../modes/base.js";
 import { redactAuthSecrets } from "../auth/redact.js";
 import { SKILL_ACTIVE_STATE_FILE, extractSessionIdFromInitializedStatePath, getSkillActiveStatePathsForStateDir, listActiveSkills, readSkillActiveState, readVisibleSkillActiveStateForStateDir, } from "../state/skill-active.js";
-import { isTrustedSubagentThread, readSubagentSessionSummary, readSubagentTrackingState, recordSubagentTurnForSession, } from "../subagents/tracker.js";
+import { isTrustedSubagentThread, readSubagentSessionSummary, readSubagentSessionLedger, readSubagentTrackingState, recordSubagentTurnForSession, } from "../subagents/tracker.js";
 import { resolveCanonicalTeamStateRoot, resolveWorkerNotifyTeamStateRootPath } from "../team/state-root.js";
 import { inferTerminalLifecycleOutcome } from "../runtime/run-outcome.js";
 import { appendToLog, isSessionStale, isSessionStateUsable, readSessionState, readUsableSessionState, reconcileNativeSessionStart, } from "../hooks/session.js";
@@ -31,7 +31,7 @@ import { onPreCompact as buildWikiPreCompactContext, onSessionStart as buildWiki
 import { readAutoresearchCompletionStatus, readAutoresearchModeStateForActiveDecision } from "../autoresearch/skill-validation.js";
 import { AGENT_DEFINITIONS } from "../agents/definitions.js";
 import { deriveAutopilotChildPhase, normalizeAutopilotPhase } from "../autopilot/fsm.js";
-import { CONDUCTOR_ORCHESTRATION_METADATA_PREFIXES, LEADER_CONDUCTOR_BLOCK, LEADER_CONDUCTOR_REUSE_AND_LEDGER_GUIDANCE, actionKindForConductorArtifact, authorizeConductorAction, classifyConductorArtifactKind, } from "../leader/contract.js";
+import { CONDUCTOR_ORCHESTRATION_METADATA_PREFIXES, LEADER_CONDUCTOR_BLOCK, LEADER_CONDUCTOR_REUSE_AND_LEDGER_GUIDANCE, NATIVE_SUBAGENT_SUPPORT_BLOCKER_FILE, actionKindForConductorArtifact, authorizeConductorAction, buildUnsupportedNativeSubagentGuidance, classifyConductorArtifactKind, isUnsupportedNativeSubagentEvidence, resolveNativeSubagentSupportStatus, } from "../leader/contract.js";
 import { readRunState } from "../runtime/run-state.js";
 import { evaluateRalphCompletionAuditEvidence, isRalphCompletePhase } from "../ralph/completion-audit.js";
 import { buildCodexGoalTerminalCleanupNotice, } from "../goal-workflows/codex-goal-snapshot.js";
@@ -42,7 +42,7 @@ import { readTriageConfig } from "../hooks/triage-config.js";
 import { readTriageState, writeTriageState, shouldSuppressFollowup, promptSignature, } from "../hooks/triage-state.js";
 import { isPendingDeepInterviewQuestionEnforcement, reconcileDeepInterviewQuestionEnforcementFromAnsweredRecords, } from "../question/deep-interview.js";
 import { readAutopilotDeepInterviewQuestionWaitState } from "../question/autopilot-wait.js";
-import { buildDocumentRefreshAdvisoryOutput, evaluateFinalHandoffDocumentRefresh, isFinalHandoffDocumentRefreshCandidate, } from "../document-refresh/enforcer.js";
+import { evaluateFinalHandoffDocumentRefresh, isFinalHandoffDocumentRefreshCandidate, } from "../document-refresh/enforcer.js";
 import { buildExecFollowupStopOutput } from "../exec/followup.js";
 import { MAX_NATIVE_STDIN_JSON_BYTES, extractRawCodexHookEventName, } from "./hook-payload-guard.js";
 const TERMINAL_MODE_PHASES = new Set(["complete", "completed", "failed", "cancelled"]);
@@ -1463,6 +1463,76 @@ async function ensureOmxLocalIgnoreEntry(cwd) {
     await writeFile(excludePath, next);
     return { changed: true, excludePath };
 }
+function readSessionStartSource(payload) {
+    return safeString(payload?.source ?? payload?.session_start_source ?? payload?.sessionStartSource).trim().toLowerCase();
+}
+function shouldBuildSubagentReopenContext(options) {
+    if (options.hookEventName !== "SessionStart")
+        return false;
+    const source = readSessionStartSource(options.payload);
+    return source === "startup" || source === "resume";
+}
+function formatSubagentLedgerMetadata(entry) {
+    const metadata = [
+        entry.role ? `role: ${entry.role}` : null,
+        entry.laneId ? `lane: ${entry.laneId}` : null,
+        entry.scope ? `scope: ${entry.scope}` : null,
+        entry.status ? `status: ${entry.status}` : null,
+        entry.lastHandoffSummary ? `handoff: ${entry.lastHandoffSummary.slice(0, 120)}` : null,
+        entry.resumeFailureReason ? `last failure: ${entry.resumeFailureReason.slice(0, 120)}` : null,
+    ].filter((item) => Boolean(item));
+    return metadata.length > 0 ? ` (${metadata.join("; ")})` : "";
+}
+async function buildPersistedSubagentReopenContext(cwd, sessionId, options) {
+    if (!shouldBuildSubagentReopenContext(options))
+        return null;
+    const ledger = await readSubagentSessionLedger(cwd, sessionId).catch(() => null);
+    if (!ledger || ledger.savedSubagents.length === 0)
+        return null;
+    const source = readSessionStartSource(options.payload);
+    const reopenTargets = ledger.resumeTargets.filter((entry) => entry.status !== "unavailable");
+    const unavailableTargets = ledger.unavailableSubagents;
+    const failedTargets = ledger.savedSubagents.filter((entry) => entry.resumeFailedAt || entry.resumeFailureReason);
+    const nowIso = new Date().toISOString();
+    await Promise.all(reopenTargets.map((entry) => recordSubagentTurnForSession(cwd, {
+        sessionId,
+        threadId: entry.threadId,
+        kind: "subagent",
+        role: entry.role,
+        laneId: entry.laneId,
+        scope: entry.scope,
+        agentNickname: entry.agentNickname,
+        status: entry.status,
+        resumeRequestedAt: nowIso,
+        preserveCompletionEvidence: true,
+    }).catch(() => null)));
+    const lines = [
+        "[Persisted subagent reopen]",
+        `- SessionStart source: ${source}; saved subagent ids found: ${ledger.savedSubagents.length}.`,
+    ];
+    if (reopenTargets.length > 0) {
+        lines.push("- Reopen these persisted subagents by id before continuing work or spawning any same-role/same-lane replacement:");
+        for (const entry of reopenTargets.slice(0, 12)) {
+            lines.push(`  - resume_agent(${JSON.stringify(entry.agentId)})${formatSubagentLedgerMetadata(entry)}`);
+        }
+        if (reopenTargets.length > 12) {
+            lines.push(`  - ... ${reopenTargets.length - 12} more saved subagent id(s) omitted from this compact SessionStart context; consult .omx/state/subagent-tracking.json before spawning replacements.`);
+        }
+    }
+    else {
+        lines.push("- No compatible saved subagent id is currently marked reopenable; do not spawn a replacement merely because reopen was unavailable.");
+    }
+    lines.push("- Silver rule: when follow-up work targets an existing role/lane, reuse the matching reopened id; avoid duplicate same-type subagent spawns.");
+    lines.push("- If resume_agent fails, surface a clear warning with the id and reason, then continue in the root or another compatible existing lane; do not spawn a new agent solely because reopen failed.");
+    const warningEntries = [...new Map([...unavailableTargets, ...failedTargets].map((entry) => [entry.agentId, entry])).values()];
+    if (warningEntries.length > 0) {
+        lines.push("- Reopen warnings:");
+        for (const entry of warningEntries.slice(0, 8)) {
+            lines.push(`  - ${entry.agentId}${formatSubagentLedgerMetadata(entry)}`);
+        }
+    }
+    return lines.join("\n");
+}
 async function buildSessionStartContext(cwd, sessionId, options = {}) {
     const sections = [];
     sections.push(buildExecutionEnvironmentSection(cwd, {
@@ -1560,6 +1630,13 @@ async function buildSessionStartContext(cwd, sessionId, options = {}) {
     if (subagentSummary && subagentSummary.activeSubagentThreadIds.length > 0) {
         sections.push(`[Subagents]\n- active subagent threads: ${subagentSummary.activeSubagentThreadIds.length}`);
     }
+    const persistedSubagentReopenContext = await buildPersistedSubagentReopenContext(cwd, sessionId, {
+        hookEventName: options.hookEventName,
+        payload: options.payload,
+    });
+    if (persistedSubagentReopenContext) {
+        sections.push(persistedSubagentReopenContext);
+    }
     return sections.length > 0 ? sections.join("\n\n") : null;
 }
 function resolveExecutionEnvironment(cwd, options = {}) {
@@ -1722,6 +1799,17 @@ function buildAutopilotPromptActivationNote(skillState, options = {}) {
     const teamHandoff = readTeamModeConfig(options.cwd).enabled
         ? " (+ $team if needed)"
         : "";
+    const stateDir = getBaseStateDir(options.cwd);
+    const nativeSubagentSupport = resolveNativeSubagentSupportStatus({
+        payload: options.payload,
+        persistedSupportBlocker: readJsonSyncIfExists(nativeSubagentSupportBlockerPath(stateDir)),
+        persistedCapacityBlocker: readJsonSyncIfExists(nativeSubagentCapacityBlockerPath(stateDir)),
+        cwd: options.cwd,
+        sessionId: options.sessionId,
+    });
+    const conductorGuidance = nativeSubagentSupport.status === "unsupported"
+        ? buildUnsupportedNativeSubagentGuidance(nativeSubagentSupport)
+        : `${LEADER_CONDUCTOR_BLOCK} ${LEADER_CONDUCTOR_REUSE_AND_LEDGER_GUIDANCE}`;
     return [
         `Autopilot protocol: the durable default chain is $deep-interview -> $ralplan -> $ultragoal${teamHandoff} -> $code-review -> $ultraqa (deep-interview -> ralplan -> ultragoal -> code-review -> ultraqa).`,
         "Start/resume at current_phase=deep-interview unless the task is clear and bounded; if deep-interview is intentionally skipped, persist and state an explicit deep_interview_gate.skip_reason before moving to ralplan.",
@@ -1733,8 +1821,7 @@ function buildAutopilotPromptActivationNote(skillState, options = {}) {
         "The ralplan phase is not complete until Planner output has been reviewed sequentially by Architect and then Critic; do not hand off to Ultragoal or implementation until the ralplan state/artifact records both ralplan_architect_review and ralplan_critic_review with approval or an explicit blocker.",
         "Do not silently fall back to ordinary $plan/ralplan-only handling; keep autopilot-state.json, skill-active-state.json, HUD/statusline, and Codex goal-mode handoff guidance visible while the workflow is active.",
         "When Codex goal tools are available, call get_goal/create_goal only from the active thread handoff and treat the active goal as the completion contract until code-review and ultraqa are clean.",
-        LEADER_CONDUCTOR_BLOCK,
-        LEADER_CONDUCTOR_REUSE_AND_LEDGER_GUIDANCE,
+        conductorGuidance,
     ].filter(Boolean).join(" ");
 }
 function formatExecutionHandoffList(cwd) {
@@ -1761,7 +1848,7 @@ function buildAdditionalContextMessage(prompt, skillState, cwd = process.cwd(),
             : null;
         const deepInterviewConfigPromptActivationNote = buildDeepInterviewConfigInstruction(cwd, skillState);
         const markedQuestionAnswer = /^\s*\[omx question answered\]/i.test(prompt);
-        const autopilotPromptActivationNote = buildAutopilotPromptActivationNote(skillState, { markedQuestionAnswer, cwd });
+        const autopilotPromptActivationNote = buildAutopilotPromptActivationNote(skillState, { markedQuestionAnswer, cwd, payload, sessionId: safeString(skillState?.session_id).trim() });
         return [
             `OMX native UserPromptSubmit continued active workflow skill "${continuedSkill}".`,
             promptPriorityMessage,
@@ -1785,7 +1872,7 @@ function buildAdditionalContextMessage(prompt, skillState, cwd = process.cwd(),
             ? buildDeepInterviewQuestionBridgeInstruction(cwd, payload)
             : null;
         const deepInterviewConfigPromptActivationNote = buildDeepInterviewConfigInstruction(cwd, skillState);
-        const autopilotPromptActivationNote = buildAutopilotPromptActivationNote(skillState, { markedQuestionAnswer: true, cwd });
+        const autopilotPromptActivationNote = buildAutopilotPromptActivationNote(skillState, { markedQuestionAnswer: true, cwd, payload, sessionId: safeString(skillState?.session_id).trim() });
         return [
             `OMX native UserPromptSubmit continued active workflow skill "${continuedSkill}"; workflow-like tokens inside the marked omx question answer are treated as answer text, not a new workflow activation.`,
             promptPriorityMessage,
@@ -1818,7 +1905,7 @@ function buildAdditionalContextMessage(prompt, skillState, cwd = process.cwd(),
     const ultragoalPromptActivationNote = match.skill === "ultragoal"
         ? "Ultragoal protocol: use `omx ultragoal create-goals` / `complete-goals` / `checkpoint` for `.omx/ultragoal` artifacts, then use Codex goal model tools only from the active agent handoff (`get_goal`, `create_goal`, `update_goal`) and never overwrite a different active Codex goal. Ultragoal does not call `/goal clear`; for multiple sequential ultragoal runs in one Codex session/thread, manually clear the completed Codex goal in the UI before creating the next aggregate goal."
         : null;
-    const autopilotPromptActivationNote = buildAutopilotPromptActivationNote(skillState, { cwd });
+    const autopilotPromptActivationNote = buildAutopilotPromptActivationNote(skillState, { cwd, payload, sessionId: safeString(skillState?.session_id).trim() });
     const combinedTransitionMessage = (() => {
         if (!skillState?.transition_message)
             return null;
@@ -2165,8 +2252,6 @@ async function buildModeBasedStopOutput(mode, cwd, sessionId) {
         reason: `OMX ${mode} is still active (phase: ${phase}; ${diagnostic}); continue the task and gather fresh verification evidence before stopping.`,
         stopReason: `${mode}_${phase}`,
         systemMessage,
-        statePath,
-        canonicalDisagreement,
     };
 }
 export function looksLikeGoalCompletionPrompt(text) {
@@ -2574,6 +2659,17 @@ function readPayloadTurnId(payload) {
 function nativeSubagentCapacityBlockerPath(stateDir) {
     return join(stateDir, NATIVE_SUBAGENT_CAPACITY_BLOCKER_FILE);
 }
+function nativeSubagentSupportBlockerPath(stateDir) {
+    return join(stateDir, NATIVE_SUBAGENT_SUPPORT_BLOCKER_FILE);
+}
+function readJsonSyncIfExists(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
 function stringifyUnknown(value) {
     if (typeof value === "string")
         return value;
@@ -2602,6 +2698,44 @@ function isNativeSubagentCapacityFailure(payload) {
     const toolName = safeString(payload.tool_name).trim();
     return !toolName || /(?:spawn_agent|multi_agent|subagent|collab|agent)/i.test(toolName);
 }
+function nativeSubagentFailureReason(payload) {
+    const evidence = payloadEvidenceText(payload);
+    const toolName = safeString(payload.tool_name).trim();
+    if (toolName && !/(?:spawn_agent|multi_agent|subagent|collab|agent)/i.test(toolName))
+        return null;
+    if (/\bagent thread limit reached\b/i.test(evidence))
+        return null;
+    if (/\bnative subagents? (?:unsupported|disabled|not enabled|unavailable|not found)\b/i.test(evidence))
+        return "native_subagents_unsupported";
+    if (/\bmulti_agent_v1\b/i.test(evidence) && /\b(?:unavailable|unknown tool|disabled|not enabled|not found|unsupported)\b/i.test(evidence))
+        return "multi_agent_v1_unavailable";
+    if (/\b(?:unknown tool|tool not found|not enabled|disabled|unavailable|unsupported)\b/i.test(evidence))
+        return "multi_agent_v1_unavailable";
+    return null;
+}
+function summarizeNativeSubagentSupportFailure(text) {
+    const normalized = text.replace(/\s+/g, " ").trim();
+    return (normalized || "native subagent support unavailable").slice(0, 500);
+}
+async function recordNativeSubagentSupportBlocker(cwd, stateDir, payload) {
+    const reason = nativeSubagentFailureReason(payload);
+    if (!reason)
+        return;
+    const nowIso = new Date().toISOString();
+    await mkdir(stateDir, { recursive: true });
+    await writeFile(nativeSubagentSupportBlockerPath(stateDir), JSON.stringify({
+        schema_version: 1,
+        status: "unsupported",
+        reason,
+        ...(readPayloadSessionId(payload) ? { session_id: readPayloadSessionId(payload) } : {}),
+        ...(readPayloadThreadId(payload) ? { thread_id: readPayloadThreadId(payload) } : {}),
+        ...(readPayloadTurnId(payload) ? { turn_id: readPayloadTurnId(payload) } : {}),
+        ...(safeString(payload.tool_name).trim() ? { tool_name: safeString(payload.tool_name).trim() } : {}),
+        evidence: summarizeNativeSubagentSupportFailure(payloadEvidenceText(payload)),
+        observed_at: nowIso,
+        cwd,
+    }, null, 2));
+}
 function summarizeCapacityFailure(text) {
     const normalized = text.replace(/\s+/g, " ").trim();
     if (!normalized)
@@ -2791,6 +2925,7 @@ const PROTECTED_PLANNING_STATE_FILE_NAMES = new Set([
     "ralplan-state.json",
     "skill-active-state.json",
 ]);
+const RUNTIME_SESSION_ID_SEGMENT_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 const PLANNING_MODE_IMPLEMENTATION_TOOL_NAMES = new Set([
     "Write",
     "Edit",
@@ -2875,6 +3010,33 @@ function isProtectedPlanningStatePath(relativePath) {
     const fileName = relativePath.split("/").pop() ?? "";
     return PROTECTED_PLANNING_STATE_FILE_NAMES.has(fileName);
 }
+function isAllowedAuthoritativeRuntimePlanningStatePath(cwd, rawPath) {
+    const trimmed = rawPath.trim().replace(/^['"]|['"]$/g, "");
+    if (!trimmed || trimmed.includes("\0"))
+        return false;
+    let targetPath;
+    let baseStateDir;
+    try {
+        targetPath = resolve(cwd, trimmed);
+        baseStateDir = resolve(getBaseStateDir(cwd));
+    }
+    catch {
+        return false;
+    }
+    const localStateDir = resolve(cwd, ".omx", "state");
+    if (baseStateDir === localStateDir)
+        return false;
+    const relativeToBase = relative(baseStateDir, targetPath).replace(/\\/g, "/");
+    if (!relativeToBase || relativeToBase.startsWith("..") || relativeToBase.startsWith("/"))
+        return false;
+    const segments = relativeToBase.split("/");
+    if (segments.length !== 3 || segments[0] !== "sessions")
+        return false;
+    const sessionId = segments[1] ?? "";
+    const fileName = segments[2] ?? "";
+    return RUNTIME_SESSION_ID_SEGMENT_PATTERN.test(sessionId)
+        && PROTECTED_PLANNING_STATE_FILE_NAMES.has(fileName);
+}
 function isPlanningTmpRelativePath(relativePath) {
     return relativePath === ".omx/tmp" || relativePath.startsWith(".omx/tmp/");
 }
@@ -2890,9 +3052,9 @@ function isAllowedPlanningTmpScratchPath(relativePath) {
 function isAllowedPlanningArtifactPath(cwd, rawPath, allowedPrefixes) {
     const relativePath = normalizePlanningArtifactRelativePath(cwd, rawPath);
     if (!relativePath)
-        return false;
+        return isAllowedAuthoritativeRuntimePlanningStatePath(cwd, rawPath);
     if (isProtectedPlanningStatePath(relativePath))
-        return false;
+        return isAllowedAuthoritativeRuntimePlanningStatePath(cwd, rawPath);
     if (isPlanningTmpRelativePath(relativePath)) {
         return allowedPrefixes.includes(".omx/tmp") && isAllowedPlanningTmpScratchPath(relativePath);
     }
@@ -2901,8 +3063,13 @@ function isAllowedPlanningArtifactPath(cwd, rawPath, allowedPrefixes) {
 function isAllowedDeepInterviewArtifactPath(cwd, rawPath) {
     return isAllowedPlanningArtifactPath(cwd, rawPath, DEEP_INTERVIEW_ALLOWED_WRITE_PREFIXES);
 }
+function isAllowedRalplanDraftPath(cwd, rawPath) {
+    const relativePath = normalizePlanningArtifactRelativePath(cwd, rawPath);
+    return relativePath !== null && /^\.omx\/drafts\/[^/]+\.md$/.test(relativePath);
+}
 function isAllowedRalplanArtifactPath(cwd, rawPath) {
-    return isAllowedPlanningArtifactPath(cwd, rawPath, RALPLAN_ALLOWED_WRITE_PREFIXES);
+    return isAllowedRalplanDraftPath(cwd, rawPath)
+        || isAllowedPlanningArtifactPath(cwd, rawPath, RALPLAN_ALLOWED_WRITE_PREFIXES);
 }
 function shellTokenizeLiteralCommand(command) {
     const tokens = [];
@@ -3110,9 +3277,73 @@ function resolveCommandRedirectTarget(target, assignments) {
     const resolved = assignments.get(safeString(variableMatch[1]));
     return resolved !== undefined ? resolved : target;
 }
+// Masks redirect metacharacters (`<`/`>`) that appear INSIDE shell quotes so a
+// quoted regex/source value (e.g. `gh issue create --body '...>{1,2}...'` or
+// `omx state write --input '{"reason":"a>b"}'`) is not misread as a redirect
+// write target. Escaped quotes at the top level (`\'`, `\"`) are literal
+// characters and must NOT open a span, and `$'...'` ANSI-C quoting processes
+// backslash escapes (so `\'` does not close it) — otherwise a genuine `>`
+// redirect could be masked behind a false span and its write missed. Only
+// characters inside a real quoted span are masked; unquoted redirect operators
+// survive intact. Unterminated/ambiguous quoting fails closed: the original
+// command is returned unmasked so genuine redirects stay visible to the scan.
+function maskQuotedRedirectMetacharsForCommandScan(command) {
+    let masked = "";
+    // null = unquoted; "'" = single quotes (no escapes); '"' = double quotes
+    // (backslash escapes); "$'" = ANSI-C $'...' (backslash escapes, incl. \').
+    let quote = null;
+    for (let index = 0; index < command.length; index += 1) {
+        const char = command[index] ?? "";
+        if (quote === null) {
+            // A backslash escapes the next character at the top level, so an escaped
+            // quote is a literal char and must not open a quoted span.
+            if (char === "\\") {
+                masked += char;
+                const next = command[index + 1];
+                if (next !== undefined) {
+                    masked += next;
+                    index += 1;
+                }
+                continue;
+            }
+            if (char === "$" && command[index + 1] === "'") {
+                quote = "$'";
+                masked += "$'";
+                index += 1;
+                continue;
+            }
+            if (char === "'" || char === "\"")
+                quote = char;
+            masked += char;
+            continue;
+        }
+        if ((quote === "\"" || quote === "$'") && char === "\\") {
+            // Escapes inside double/ANSI-C spans keep the backslash and its escaped
+            // char (masking a redirect metachar so quoted data cannot be a false
+            // target); the escaped char never closes the span.
+            masked += char;
+            const next = command[index + 1];
+            if (next !== undefined) {
+                masked += next === "<" || next === ">" ? "_" : next;
+                index += 1;
+            }
+            continue;
+        }
+        const closesSpan = quote === "$'" ? char === "'" : char === quote;
+        if (closesSpan) {
+            quote = null;
+            masked += char;
+            continue;
+        }
+        masked += char === "<" || char === ">" ? "_" : char;
+    }
+    if (quote !== null)
+        return command;
+    return masked;
+}
 function extractDeepInterviewCommandRedirectTargets(command) {
     const targets = [];
-    const commandOutsideHeredocBodies = stripHeredocBodiesForCommandScan(command);
+    const commandOutsideHeredocBodies = maskQuotedRedirectMetacharsForCommandScan(stripHeredocBodiesForCommandScan(command));
     for (const match of commandOutsideHeredocBodies.matchAll(/(?:^|[^>])>{1,2}\s*(["']?)([^\s&|;<>]+)\1/g)) {
         const candidate = safeString(match[2]).trim();
         if (candidate && !isNullDeviceRedirectTarget(candidate))
@@ -3224,7 +3455,7 @@ function findGitSubcommandIndex(words, startIndex) {
     }
     return null;
 }
-function commandHasDeepInterviewWriteIntent(command) {
+function commandHasDeepInterviewWriteIntent(command, depth = 0) {
     return commandInvokesApplyPatch(command)
         || extractDeepInterviewCommandRedirectTargets(command).length > 0
         || /\btee\s+(?:-a\s+)?[^\s&|;]+/.test(command)
@@ -3235,7 +3466,17 @@ function commandHasDeepInterviewWriteIntent(command) {
         || extractConductorBashMutations(command).length > 0
         || extractConductorInterpreterWrites(command).length > 0
         || commandHasDestructiveGitSubcommand(command)
-        || commandHasPackageInstallIntent(command);
+        || commandHasPackageInstallIntent(command)
+        // Recurse into wrapped shells (`bash -lc "cat > f"`, `eval`, `env`) and
+        // command substitutions so a real redirect INSIDE a nested command string
+        // is still classified as write intent. This is required because quoted
+        // redirect metacharacters are now masked at the outer scan (#3119): the
+        // mask removes false positives from quoted DATA values while nested-command
+        // recursion re-detects genuine redirects, preserving fail-closed blocking.
+        // The depth guard mirrors evaluateConductorBashWrite's nesting bound;
+        // extractors return strict substrings, so recursion always terminates.
+        || (depth < CONDUCTOR_BASH_MAX_NESTING_DEPTH && (extractNestedShellCommandStringsForStateScan(command).some((nested) => commandHasDeepInterviewWriteIntent(nested, depth + 1))
+            || extractNestedCommandSubstitutionStringsForStateScan(command).some((nested) => commandHasDeepInterviewWriteIntent(nested, depth + 1))));
 }
 function extractDeepInterviewCommandWriteTargets(command) {
     const assignments = extractCommandLiteralAssignments(command);
@@ -5271,6 +5512,56 @@ function isPackageManagerCommandWord(word) {
     const base = shellWordBaseName(word);
     return base === "npm" || base === "pnpm" || base === "yarn" || base === "npx" || base === "pnpx";
 }
+function isStructuredUltragoalSteeringShellCommand(command) {
+    const segments = splitShellCommandSegments(stripHeredocBodiesForCommandScan(command));
+    let sawStructuredSteer = false;
+    for (const segment of segments) {
+        const words = tokenizeShellWords(segment);
+        let commandStart = true;
+        let inForHeader = false;
+        for (let index = 0; index < words.length; index += 1) {
+            const word = words[index] ?? "";
+            if (!word)
+                continue;
+            if (isShellCommandSeparator(word)) {
+                commandStart = true;
+                continue;
+            }
+            if (inForHeader) {
+                if (word === "do") {
+                    inForHeader = false;
+                    commandStart = true;
+                }
+                continue;
+            }
+            if (isShellGroupingSyntaxWord(word))
+                continue;
+            if (commandStart && isEnvironmentAssignmentWord(word))
+                continue;
+            if (commandStart && CONDUCTOR_BASH_COMPOUND_SYNTAX_WORDS.has(word)) {
+                if (word === "for")
+                    inForHeader = true;
+                continue;
+            }
+            if (commandStart && word.startsWith("-"))
+                continue;
+            if (!commandStart)
+                continue;
+            const commandName = commandNameFromShellWord(word);
+            if (commandName === "read" || commandName === "true" || commandName === ":") {
+                commandStart = false;
+                continue;
+            }
+            if (commandName === "omx" && words[index + 1] === "ultragoal" && words[index + 2] === "steer") {
+                sawStructuredSteer = true;
+                commandStart = false;
+                continue;
+            }
+            return false;
+        }
+    }
+    return sawStructuredSteer;
+}
 function hasDynamicNestedShellExecution(command) {
     const commands = splitShellCommandSegments(stripHeredocBodiesForCommandScan(command));
     for (const segment of commands) {
@@ -5298,13 +5589,13 @@ function hasDynamicNestedShellExecution(command) {
                     return true;
                 if (commandStringIndex !== null) {
                     const nestedCommand = words[commandStringIndex] ?? "";
-                    if (isDynamicNestedCommandString(nestedCommand))
+                    if (isDynamicNestedCommandString(nestedCommand) && !isStructuredUltragoalSteeringShellCommand(nestedCommand))
                         return true;
                 }
             }
             if (word === "eval") {
                 const nestedCommand = words.slice(index + 1).join(" ");
-                if (isDynamicNestedCommandString(nestedCommand))
+                if (isDynamicNestedCommandString(nestedCommand) && !isStructuredUltragoalSteeringShellCommand(nestedCommand))
                     return true;
             }
         }
@@ -6185,7 +6476,7 @@ function buildDeepInterviewBashBlockedDetail(cwd, command) {
 }
 async function buildRalplanPreToolUseBoundaryOutput(payload, cwd, stateDir, resolvedSessionId) {
     const sessionId = safeString(resolvedSessionId ?? readPayloadSessionId(payload)).trim();
-    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId))
+    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId))
         return null;
     const threadId = readPayloadThreadId(payload);
     const activeState = await readActiveRalplanStateForPreToolUse(cwd, stateDir, sessionId, threadId);
@@ -6236,7 +6527,7 @@ async function buildRalplanPreToolUseBoundaryOutput(payload, cwd, stateDir, reso
         hookSpecificOutput: {
             hookEventName: "PreToolUse",
             additionalContext: `${planningModeDescription}. `
-                + "Write only planning artifacts under `.omx/context/`, `.omx/plans/`, `.omx/specs/`, `.omx/tmp/`, required `.omx/state/` files, or tracker metadata under `.beads/`. "
+                + "Write only planning artifacts under `.omx/context/`, `.omx/plans/`, `.omx/specs/`, `.omx/tmp/`, required `.omx/state/` files, Markdown drafts under `.omx/drafts/*.md`, or tracker metadata under `.beads/`. "
                 + "Do not edit implementation files or run implementation-focused writes from planning phases. "
                 + `To execute, first process an explicit handoff such as ${formatExecutionHandoffList(cwd)}, which must emit terminal planning state before implementation begins.`,
         },
@@ -6244,7 +6535,7 @@ async function buildRalplanPreToolUseBoundaryOutput(payload, cwd, stateDir, reso
 }
 async function buildDeepInterviewPreToolUseBoundaryOutput(payload, cwd, stateDir, resolvedSessionId) {
     const sessionId = safeString(resolvedSessionId ?? readPayloadSessionId(payload)).trim();
-    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId))
+    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId))
         return null;
     const threadId = readPayloadThreadId(payload);
     const activeState = await readActiveDeepInterviewStateForPreToolUse(cwd, stateDir, sessionId, threadId);
@@ -6362,18 +6653,64 @@ async function buildPlanningRootPointerConflictPreToolUseOutput(payload, cwd, st
     }
     return blocked ? buildRalplanRootPointerConflictBlock(ralplanState) : null;
 }
-async function hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId) {
+async function hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId, options = {}) {
     if (hasTeamWorkerEnvironment())
         return true;
-    if (!isTypedAgentRolePayload(payload))
-        return false;
     const trackingState = await readSubagentTrackingState(cwd).catch(() => null);
     const session = trackingState?.sessions?.[sessionId];
     if (!session)
         return false;
     const payloadThreadId = readPayloadThreadId(payload);
+    // Resolve the Main-root leader THREAD identity from the tracker's leader_thread_id
+    // plus the canonical session's native_session_id (the leader's native thread). Only
+    // genuine leader-thread identifiers may anchor the leader: owner_*_session_id are
+    // session-level ids, not thread anchors, so they must NOT populate this set — their
+    // mere presence would make it non-empty and suppress the fail-closed guard below
+    // without ever excluding the leader thread (#3117 P4). The native_session_id anchor is
+    // honored only when the root session pointer provably maps to the sessionId under
+    // evaluation, so a stale/foreign session.json cannot supply another session's leader
+    // anchor (#3117 P3); the tracker alone is insufficient because it can omit
+    // leader_thread_id or corruptly label the leader kind:"subagent" (#3117 P2).
+    const sessionState = await readRootSessionStateFromStateDir(stateDir).catch(() => null);
+    const trackerLeaderThreadId = safeString(session.leader_thread_id).trim();
+    const leaderIdentityAnchors = new Set();
+    if (trackerLeaderThreadId)
+        leaderIdentityAnchors.add(trackerLeaderThreadId);
+    if (sessionState && sessionId && payloadMatchesSessionPointer(sessionId, sessionState)) {
+        const nativeSessionId = safeString(sessionState.native_session_id).trim();
+        if (nativeSessionId)
+            leaderIdentityAnchors.add(nativeSessionId);
+    }
+    // Leader self-guard: the Main-root Conductor is never a delegated executor. Block it
+    // ahead of every trust path, even when tracker or payload provenance is (possibly
+    // corruptly) attached to the leader thread.
+    if (payloadThreadId && leaderIdentityAnchors.has(payloadThreadId))
+        return false;
+    // Fail closed: without an authoritative leader anchor we cannot affirm the payload is
+    // a non-leader delegated performer rather than a mislabeled leader, so we refuse trust
+    // instead of inferring it from a corrupt tracker kind:"subagent" alone (#3117 P2).
+    if (leaderIdentityAnchors.size === 0)
+        return false;
+    // Planning boundary guards (ralplan, deep-interview) still require a recognized typed
+    // agent role, so an untyped collaboration.spawn_agent child cannot write before an
+    // execution handoff/approval. Only the Main-root Conductor/Ralph executing guard opts
+    // into untyped tracker/runtime provenance (#3116, #3117).
+    if (options.allowUntypedProvenance !== true && !isTypedAgentRolePayload(payload)) {
+        return false;
+    }
+    // Tracker-backed provenance: the payload's own thread is a recorded, non-leader
+    // subagent for this session — the non-spoofable anchor that lets native
+    // collaboration.spawn_agent children/descendants edit under the Conductor guard even
+    // without a recognized typed role (#3116). subagent-tracking.json is derived from
+    // child SessionStart transcript metadata, not the live tool-call payload.
     if (payloadThreadId && isTrustedSubagentThread(session, payloadThreadId))
         return true;
+    // Runtime-attached spawn provenance: trust a genuine spawned subagent turn whose
+    // declared parent maps to this session's leader or a tracked thread. parentThreadId
+    // comes from the runtime-set source.subagent.thread_spawn (not agent-controlled tool
+    // arguments); an absent parent is rejected, the leader self-guard above blocks the
+    // main root, and cross-session parents fail because they are not in this session's
+    // tracked threads (#3116).
     const source = safeObject(payload.source);
     const subagent = safeObject(source.subagent);
     const threadSpawn = safeObject(subagent.thread_spawn);
@@ -6383,10 +6720,7 @@ async function hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sess
         ?? threadSpawn.leaderThreadId).trim();
     if (!parentThreadId)
         return false;
-    const leaderThreadId = safeString(session.leader_thread_id).trim();
-    if (payloadThreadId && leaderThreadId && payloadThreadId === leaderThreadId)
-        return false;
-    return leaderThreadId === parentThreadId || parentThreadId in session.threads;
+    return leaderIdentityAnchors.has(parentThreadId) || parentThreadId in session.threads;
 }
 function isActiveConductorModeState(state, mode, sessionId) {
     if (!state || state.active !== true)
@@ -6413,7 +6747,7 @@ async function readActiveMainRootConductorStateForPreToolUse(payload, cwd, state
     const threadId = readPayloadThreadId(payload);
     if (!sessionId)
         return null;
-    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId))
+    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId, { allowUntypedProvenance: true }))
         return null;
     const canonicalState = await readVisibleSkillActiveStateForStateDir(stateDir, sessionId);
     if (!canonicalState)
@@ -7228,6 +7562,13 @@ export async function buildConductorPreToolUseWriteGuardOutput(payload, cwd, sta
     const activeState = await readActiveMainRootConductorStateForPreToolUse(payload, cwd, stateDir, resolvedSessionId);
     if (!activeState)
         return null;
+    const nativeSubagentSupport = resolveNativeSubagentSupportStatus({
+        payload,
+        persistedSupportBlocker: await readJsonIfExists(nativeSubagentSupportBlockerPath(stateDir)),
+        persistedCapacityBlocker: await readJsonIfExists(nativeSubagentCapacityBlockerPath(stateDir)),
+        cwd,
+        sessionId: resolvedSessionId || readPayloadSessionId(payload),
+    });
     const toolName = safeString(payload.tool_name).trim();
     const command = readPreToolUseCommand(payload);
     const pathCandidates = readPreToolUsePathCandidates(payload);
@@ -7254,6 +7595,9 @@ export async function buildConductorPreToolUseWriteGuardOutput(payload, cwd, sta
     }
     if (!blocked)
         return null;
+    const unsupportedNativeGuidance = isUnsupportedNativeSubagentEvidence(nativeSubagentSupport)
+        ? ` ${buildUnsupportedNativeSubagentGuidance(nativeSubagentSupport)} Treat the active conductor workflow as blocked/cancelled for native delegation recovery; do not call multi_agent_v1.close_agent.`
+        : "";
     return {
         decision: "block",
         reason: `Main-root Conductor mode is active (${activeState.mode} phase: ${formatPhase(activeState.phase, "active")}); direct plan/code writes are blocked and must be delegated; ${blockedDetail}.`,
@@ -7262,7 +7606,8 @@ export async function buildConductorPreToolUseWriteGuardOutput(payload, cwd, sta
             additionalContext: `${LEADER_CONDUCTOR_GOLDEN_RULE} `
                 + "Use specialized agents for source edits and plan/spec authorship. "
                 + `Main-root Conductor may write only orchestration metadata/transport/ledger artifacts under ${CONDUCTOR_ORCHESTRATION_METADATA_PREFIXES.join(", ")}; path location alone is not authorization for substantive deliverables. `
-                + "Autopilot rework and typed subagent/worker lanes are exempt from this guard.",
+                + unsupportedNativeGuidance
+                + " Autopilot rework and typed subagent/worker lanes are exempt from this guard.",
         },
     };
 }
@@ -8222,7 +8567,7 @@ async function buildStopHookOutput(payload, cwd, stateDir, options = {}) {
         if (isFinalHandoffDocumentRefreshCandidate(lastAssistantMessage)) {
             const documentRefreshWarning = evaluateFinalHandoffDocumentRefresh(cwd, lastAssistantMessage);
             if (documentRefreshWarning) {
-                return await maybeReturnRepeatableStopOutput(payload, stateDir, buildRepeatableStopSignature(payload, "document-refresh-stop", documentRefreshWarning.triggeringPaths.join("|"), canonicalSessionId), buildDocumentRefreshAdvisoryOutput(documentRefreshWarning, "Stop"), canonicalSessionId, { allowRepeatDuringStopHook: false });
+                return await maybeReturnRepeatableStopOutput(payload, stateDir, buildRepeatableStopSignature(payload, "document-refresh-stop", documentRefreshWarning.triggeringPaths.join("|"), canonicalSessionId), { systemMessage: documentRefreshWarning.message }, canonicalSessionId, { allowRepeatDuringStopHook: false });
             }
         }
         return null;
@@ -8512,6 +8857,7 @@ export async function dispatchCodexNativeHook(payload, options = {}) {
     }
     else if (hookEventName === "PostToolUse") {
         await recordNativeSubagentCapacityBlocker(cwd, stateDir, payload).catch(() => { });
+        await recordNativeSubagentSupportBlocker(cwd, stateDir, payload).catch(() => { });
         if (detectMcpTransportFailure(payload)) {
             await markTeamTransportFailure(cwd, payload);
         }