oh-my-codex 0.20.0 → 0.20.1

package/dist/scripts/codex-native-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-native-hook.d.ts","sourceRoot":"","sources":["../../src/scripts/codex-native-hook.ts"],"names":[],"mappings":"AA+CA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,8BAA8B,CAAC;AAiCtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAyDlE,KAAK,kBAAkB,GACnB,cAAc,GACd,YAAY,GACZ,aAAa,GACb,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,MAAM,CAAC;AAEX,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,UAAU,yBAAyB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6BAA6B,CAAC,EAAE,OAAO,2BAA2B,CAAC;CACpE;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAmfD,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,kBAAkB,GAAG,IAAI,GACvC,MAAM,GAAG,IAAI,CAmBf;AAsxBD,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC,GACL,MAAM,GAAG,IAAI,CAuBf;AA4tCD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMnE;AA0uKD,wBAAsB,wCAAwC,CAC5D,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAqDzC;AA83CD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA6VnC;AA6BD,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAGT;AAyOD,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAyC3D"}
+{"version":3,"file":"codex-native-hook.d.ts","sourceRoot":"","sources":["../../src/scripts/codex-native-hook.ts"],"names":[],"mappings":"AA+CA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,8BAA8B,CAAC;AAiCtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAwDlE,KAAK,kBAAkB,GACnB,cAAc,GACd,YAAY,GACZ,aAAa,GACb,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,MAAM,CAAC;AAEX,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,UAAU,yBAAyB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6BAA6B,CAAC,EAAE,OAAO,2BAA2B,CAAC;CACpE;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAmfD,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,kBAAkB,GAAG,IAAI,GACvC,MAAM,GAAG,IAAI,CAmBf;AAsxBD,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC,GACL,MAAM,GAAG,IAAI,CAuBf;AA0tCD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMnE;AA22KD,wBAAsB,wCAAwC,CAC5D,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAqDzC;AA83CD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA6VnC;AA6BD,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAGT;AAyOD,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAyC3D"}

package/dist/scripts/codex-native-hook.js

@@ -42,7 +42,7 @@ import { readTriageConfig } from "../hooks/triage-config.js";
 import { readTriageState, writeTriageState, shouldSuppressFollowup, promptSignature, } from "../hooks/triage-state.js";
 import { isPendingDeepInterviewQuestionEnforcement, reconcileDeepInterviewQuestionEnforcementFromAnsweredRecords, } from "../question/deep-interview.js";
 import { readAutopilotDeepInterviewQuestionWaitState } from "../question/autopilot-wait.js";
-import { buildDocumentRefreshAdvisoryOutput, evaluateFinalHandoffDocumentRefresh, isFinalHandoffDocumentRefreshCandidate, } from "../document-refresh/enforcer.js";
+import { evaluateFinalHandoffDocumentRefresh, isFinalHandoffDocumentRefreshCandidate, } from "../document-refresh/enforcer.js";
 import { buildExecFollowupStopOutput } from "../exec/followup.js";
 import { MAX_NATIVE_STDIN_JSON_BYTES, extractRawCodexHookEventName, } from "./hook-payload-guard.js";
 const TERMINAL_MODE_PHASES = new Set(["complete", "completed", "failed", "cancelled"]);
@@ -2252,8 +2252,6 @@ async function buildModeBasedStopOutput(mode, cwd, sessionId) {
         reason: `OMX ${mode} is still active (phase: ${phase}; ${diagnostic}); continue the task and gather fresh verification evidence before stopping.`,
         stopReason: `${mode}_${phase}`,
         systemMessage,
-        statePath,
-        canonicalDisagreement,
     };
 }
 export function looksLikeGoalCompletionPrompt(text) {
@@ -3065,8 +3063,13 @@ function isAllowedPlanningArtifactPath(cwd, rawPath, allowedPrefixes) {
 function isAllowedDeepInterviewArtifactPath(cwd, rawPath) {
     return isAllowedPlanningArtifactPath(cwd, rawPath, DEEP_INTERVIEW_ALLOWED_WRITE_PREFIXES);
 }
+function isAllowedRalplanDraftPath(cwd, rawPath) {
+    const relativePath = normalizePlanningArtifactRelativePath(cwd, rawPath);
+    return relativePath !== null && /^\.omx\/drafts\/[^/]+\.md$/.test(relativePath);
+}
 function isAllowedRalplanArtifactPath(cwd, rawPath) {
-    return isAllowedPlanningArtifactPath(cwd, rawPath, RALPLAN_ALLOWED_WRITE_PREFIXES);
+    return isAllowedRalplanDraftPath(cwd, rawPath)
+        || isAllowedPlanningArtifactPath(cwd, rawPath, RALPLAN_ALLOWED_WRITE_PREFIXES);
 }
 function shellTokenizeLiteralCommand(command) {
     const tokens = [];
@@ -3274,9 +3277,73 @@ function resolveCommandRedirectTarget(target, assignments) {
     const resolved = assignments.get(safeString(variableMatch[1]));
     return resolved !== undefined ? resolved : target;
 }
+// Masks redirect metacharacters (`<`/`>`) that appear INSIDE shell quotes so a
+// quoted regex/source value (e.g. `gh issue create --body '...>{1,2}...'` or
+// `omx state write --input '{"reason":"a>b"}'`) is not misread as a redirect
+// write target. Escaped quotes at the top level (`\'`, `\"`) are literal
+// characters and must NOT open a span, and `$'...'` ANSI-C quoting processes
+// backslash escapes (so `\'` does not close it) — otherwise a genuine `>`
+// redirect could be masked behind a false span and its write missed. Only
+// characters inside a real quoted span are masked; unquoted redirect operators
+// survive intact. Unterminated/ambiguous quoting fails closed: the original
+// command is returned unmasked so genuine redirects stay visible to the scan.
+function maskQuotedRedirectMetacharsForCommandScan(command) {
+    let masked = "";
+    // null = unquoted; "'" = single quotes (no escapes); '"' = double quotes
+    // (backslash escapes); "$'" = ANSI-C $'...' (backslash escapes, incl. \').
+    let quote = null;
+    for (let index = 0; index < command.length; index += 1) {
+        const char = command[index] ?? "";
+        if (quote === null) {
+            // A backslash escapes the next character at the top level, so an escaped
+            // quote is a literal char and must not open a quoted span.
+            if (char === "\\") {
+                masked += char;
+                const next = command[index + 1];
+                if (next !== undefined) {
+                    masked += next;
+                    index += 1;
+                }
+                continue;
+            }
+            if (char === "$" && command[index + 1] === "'") {
+                quote = "$'";
+                masked += "$'";
+                index += 1;
+                continue;
+            }
+            if (char === "'" || char === "\"")
+                quote = char;
+            masked += char;
+            continue;
+        }
+        if ((quote === "\"" || quote === "$'") && char === "\\") {
+            // Escapes inside double/ANSI-C spans keep the backslash and its escaped
+            // char (masking a redirect metachar so quoted data cannot be a false
+            // target); the escaped char never closes the span.
+            masked += char;
+            const next = command[index + 1];
+            if (next !== undefined) {
+                masked += next === "<" || next === ">" ? "_" : next;
+                index += 1;
+            }
+            continue;
+        }
+        const closesSpan = quote === "$'" ? char === "'" : char === quote;
+        if (closesSpan) {
+            quote = null;
+            masked += char;
+            continue;
+        }
+        masked += char === "<" || char === ">" ? "_" : char;
+    }
+    if (quote !== null)
+        return command;
+    return masked;
+}
 function extractDeepInterviewCommandRedirectTargets(command) {
     const targets = [];
-    const commandOutsideHeredocBodies = stripHeredocBodiesForCommandScan(command);
+    const commandOutsideHeredocBodies = maskQuotedRedirectMetacharsForCommandScan(stripHeredocBodiesForCommandScan(command));
     for (const match of commandOutsideHeredocBodies.matchAll(/(?:^|[^>])>{1,2}\s*(["']?)([^\s&|;<>]+)\1/g)) {
         const candidate = safeString(match[2]).trim();
         if (candidate && !isNullDeviceRedirectTarget(candidate))
@@ -3388,7 +3455,7 @@ function findGitSubcommandIndex(words, startIndex) {
     }
     return null;
 }
-function commandHasDeepInterviewWriteIntent(command) {
+function commandHasDeepInterviewWriteIntent(command, depth = 0) {
     return commandInvokesApplyPatch(command)
         || extractDeepInterviewCommandRedirectTargets(command).length > 0
         || /\btee\s+(?:-a\s+)?[^\s&|;]+/.test(command)
@@ -3399,7 +3466,17 @@ function commandHasDeepInterviewWriteIntent(command) {
         || extractConductorBashMutations(command).length > 0
         || extractConductorInterpreterWrites(command).length > 0
         || commandHasDestructiveGitSubcommand(command)
-        || commandHasPackageInstallIntent(command);
+        || commandHasPackageInstallIntent(command)
+        // Recurse into wrapped shells (`bash -lc "cat > f"`, `eval`, `env`) and
+        // command substitutions so a real redirect INSIDE a nested command string
+        // is still classified as write intent. This is required because quoted
+        // redirect metacharacters are now masked at the outer scan (#3119): the
+        // mask removes false positives from quoted DATA values while nested-command
+        // recursion re-detects genuine redirects, preserving fail-closed blocking.
+        // The depth guard mirrors evaluateConductorBashWrite's nesting bound;
+        // extractors return strict substrings, so recursion always terminates.
+        || (depth < CONDUCTOR_BASH_MAX_NESTING_DEPTH && (extractNestedShellCommandStringsForStateScan(command).some((nested) => commandHasDeepInterviewWriteIntent(nested, depth + 1))
+            || extractNestedCommandSubstitutionStringsForStateScan(command).some((nested) => commandHasDeepInterviewWriteIntent(nested, depth + 1))));
 }
 function extractDeepInterviewCommandWriteTargets(command) {
     const assignments = extractCommandLiteralAssignments(command);
@@ -6399,7 +6476,7 @@ function buildDeepInterviewBashBlockedDetail(cwd, command) {
 }
 async function buildRalplanPreToolUseBoundaryOutput(payload, cwd, stateDir, resolvedSessionId) {
     const sessionId = safeString(resolvedSessionId ?? readPayloadSessionId(payload)).trim();
-    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId))
+    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId))
         return null;
     const threadId = readPayloadThreadId(payload);
     const activeState = await readActiveRalplanStateForPreToolUse(cwd, stateDir, sessionId, threadId);
@@ -6450,7 +6527,7 @@ async function buildRalplanPreToolUseBoundaryOutput(payload, cwd, stateDir, reso
         hookSpecificOutput: {
             hookEventName: "PreToolUse",
             additionalContext: `${planningModeDescription}. `
-                + "Write only planning artifacts under `.omx/context/`, `.omx/plans/`, `.omx/specs/`, `.omx/tmp/`, required `.omx/state/` files, or tracker metadata under `.beads/`. "
+                + "Write only planning artifacts under `.omx/context/`, `.omx/plans/`, `.omx/specs/`, `.omx/tmp/`, required `.omx/state/` files, Markdown drafts under `.omx/drafts/*.md`, or tracker metadata under `.beads/`. "
                 + "Do not edit implementation files or run implementation-focused writes from planning phases. "
                 + `To execute, first process an explicit handoff such as ${formatExecutionHandoffList(cwd)}, which must emit terminal planning state before implementation begins.`,
         },
@@ -6458,7 +6535,7 @@ async function buildRalplanPreToolUseBoundaryOutput(payload, cwd, stateDir, reso
 }
 async function buildDeepInterviewPreToolUseBoundaryOutput(payload, cwd, stateDir, resolvedSessionId) {
     const sessionId = safeString(resolvedSessionId ?? readPayloadSessionId(payload)).trim();
-    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId))
+    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId))
         return null;
     const threadId = readPayloadThreadId(payload);
     const activeState = await readActiveDeepInterviewStateForPreToolUse(cwd, stateDir, sessionId, threadId);
@@ -6576,18 +6653,64 @@ async function buildPlanningRootPointerConflictPreToolUseOutput(payload, cwd, st
     }
     return blocked ? buildRalplanRootPointerConflictBlock(ralplanState) : null;
 }
-async function hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId) {
+async function hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId, options = {}) {
     if (hasTeamWorkerEnvironment())
         return true;
-    if (!isTypedAgentRolePayload(payload))
-        return false;
     const trackingState = await readSubagentTrackingState(cwd).catch(() => null);
     const session = trackingState?.sessions?.[sessionId];
     if (!session)
         return false;
     const payloadThreadId = readPayloadThreadId(payload);
+    // Resolve the Main-root leader THREAD identity from the tracker's leader_thread_id
+    // plus the canonical session's native_session_id (the leader's native thread). Only
+    // genuine leader-thread identifiers may anchor the leader: owner_*_session_id are
+    // session-level ids, not thread anchors, so they must NOT populate this set — their
+    // mere presence would make it non-empty and suppress the fail-closed guard below
+    // without ever excluding the leader thread (#3117 P4). The native_session_id anchor is
+    // honored only when the root session pointer provably maps to the sessionId under
+    // evaluation, so a stale/foreign session.json cannot supply another session's leader
+    // anchor (#3117 P3); the tracker alone is insufficient because it can omit
+    // leader_thread_id or corruptly label the leader kind:"subagent" (#3117 P2).
+    const sessionState = await readRootSessionStateFromStateDir(stateDir).catch(() => null);
+    const trackerLeaderThreadId = safeString(session.leader_thread_id).trim();
+    const leaderIdentityAnchors = new Set();
+    if (trackerLeaderThreadId)
+        leaderIdentityAnchors.add(trackerLeaderThreadId);
+    if (sessionState && sessionId && payloadMatchesSessionPointer(sessionId, sessionState)) {
+        const nativeSessionId = safeString(sessionState.native_session_id).trim();
+        if (nativeSessionId)
+            leaderIdentityAnchors.add(nativeSessionId);
+    }
+    // Leader self-guard: the Main-root Conductor is never a delegated executor. Block it
+    // ahead of every trust path, even when tracker or payload provenance is (possibly
+    // corruptly) attached to the leader thread.
+    if (payloadThreadId && leaderIdentityAnchors.has(payloadThreadId))
+        return false;
+    // Fail closed: without an authoritative leader anchor we cannot affirm the payload is
+    // a non-leader delegated performer rather than a mislabeled leader, so we refuse trust
+    // instead of inferring it from a corrupt tracker kind:"subagent" alone (#3117 P2).
+    if (leaderIdentityAnchors.size === 0)
+        return false;
+    // Planning boundary guards (ralplan, deep-interview) still require a recognized typed
+    // agent role, so an untyped collaboration.spawn_agent child cannot write before an
+    // execution handoff/approval. Only the Main-root Conductor/Ralph executing guard opts
+    // into untyped tracker/runtime provenance (#3116, #3117).
+    if (options.allowUntypedProvenance !== true && !isTypedAgentRolePayload(payload)) {
+        return false;
+    }
+    // Tracker-backed provenance: the payload's own thread is a recorded, non-leader
+    // subagent for this session — the non-spoofable anchor that lets native
+    // collaboration.spawn_agent children/descendants edit under the Conductor guard even
+    // without a recognized typed role (#3116). subagent-tracking.json is derived from
+    // child SessionStart transcript metadata, not the live tool-call payload.
     if (payloadThreadId && isTrustedSubagentThread(session, payloadThreadId))
         return true;
+    // Runtime-attached spawn provenance: trust a genuine spawned subagent turn whose
+    // declared parent maps to this session's leader or a tracked thread. parentThreadId
+    // comes from the runtime-set source.subagent.thread_spawn (not agent-controlled tool
+    // arguments); an absent parent is rejected, the leader self-guard above blocks the
+    // main root, and cross-session parents fail because they are not in this session's
+    // tracked threads (#3116).
     const source = safeObject(payload.source);
     const subagent = safeObject(source.subagent);
     const threadSpawn = safeObject(subagent.thread_spawn);
@@ -6597,10 +6720,7 @@ async function hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sess
         ?? threadSpawn.leaderThreadId).trim();
     if (!parentThreadId)
         return false;
-    const leaderThreadId = safeString(session.leader_thread_id).trim();
-    if (payloadThreadId && leaderThreadId && payloadThreadId === leaderThreadId)
-        return false;
-    return leaderThreadId === parentThreadId || parentThreadId in session.threads;
+    return leaderIdentityAnchors.has(parentThreadId) || parentThreadId in session.threads;
 }
 function isActiveConductorModeState(state, mode, sessionId) {
     if (!state || state.active !== true)
@@ -6627,7 +6747,7 @@ async function readActiveMainRootConductorStateForPreToolUse(payload, cwd, state
     const threadId = readPayloadThreadId(payload);
     if (!sessionId)
         return null;
-    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, sessionId))
+    if (await hasTrustedTypedSubagentProvenanceForPreToolUse(payload, cwd, stateDir, sessionId, { allowUntypedProvenance: true }))
         return null;
     const canonicalState = await readVisibleSkillActiveStateForStateDir(stateDir, sessionId);
     if (!canonicalState)
@@ -8447,7 +8567,7 @@ async function buildStopHookOutput(payload, cwd, stateDir, options = {}) {
         if (isFinalHandoffDocumentRefreshCandidate(lastAssistantMessage)) {
             const documentRefreshWarning = evaluateFinalHandoffDocumentRefresh(cwd, lastAssistantMessage);
             if (documentRefreshWarning) {
-                return await maybeReturnRepeatableStopOutput(payload, stateDir, buildRepeatableStopSignature(payload, "document-refresh-stop", documentRefreshWarning.triggeringPaths.join("|"), canonicalSessionId), buildDocumentRefreshAdvisoryOutput(documentRefreshWarning, "Stop"), canonicalSessionId, { allowRepeatDuringStopHook: false });
+                return await maybeReturnRepeatableStopOutput(payload, stateDir, buildRepeatableStopSignature(payload, "document-refresh-stop", documentRefreshWarning.triggeringPaths.join("|"), canonicalSessionId), { systemMessage: documentRefreshWarning.message }, canonicalSessionId, { allowRepeatDuringStopHook: false });
             }
         }
         return null;