oh-my-codex 0.20.0 → 0.20.2

package/dist/hooks/__tests__/session.test.js

@@ -1,10 +1,10 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readFile, readdir, rename, rm, symlink, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { resetSessionMetrics, reconcileNativeSessionStart, writeSessionStart, writeSessionEnd, readSessionState, readUsableSessionState, isSessionStale, } from '../session.js';
+import { __createDefaultPidProbeForTests, appendPromptSessionProvenanceRejection, __resetSessionPointerTransactionDependenciesForTests, __setSessionPointerTransactionDependenciesForTests, isSessionPointerLaunchAbort, isSessionStale, readSessionPointer, readSessionState, readUsableSessionState, reconcileNativeSessionStart, resetSessionMetrics, resolveSessionPointerContext, writeSessionEnd, writeSessionStart, } from '../session.js';
 function todayIsoDate() {
     return new Date().toISOString().slice(0, 10);
 }
@@ -17,6 +17,57 @@ function makeState(overrides = {}) {
         ...overrides,
     };
 }
+const TEST_TOKEN = 'transaction_token_123456';
+const FOREIGN_TOKEN = 'foreign_token_123456789';
+const SUCCESSOR_TOKEN = 'successor_token_123456789';
+function codedError(code) {
+    return Object.assign(new Error(code), { code });
+}
+async function withPointerDependencies(overrides, run) {
+    __setSessionPointerTransactionDependenciesForTests(overrides);
+    try {
+        await run();
+    }
+    finally {
+        __resetSessionPointerTransactionDependenciesForTests();
+    }
+}
+async function withOwnerEnvironment(sessionId, run) {
+    const previous = process.env.OMX_SESSION_ID;
+    if (sessionId === undefined)
+        delete process.env.OMX_SESSION_ID;
+    else
+        process.env.OMX_SESSION_ID = sessionId;
+    try {
+        await run();
+    }
+    finally {
+        if (previous === undefined)
+            delete process.env.OMX_SESSION_ID;
+        else
+            process.env.OMX_SESSION_ID = previous;
+    }
+}
+function matchingProcessIdentity() {
+    return { status: 'matching', startTicks: 1 };
+}
+async function writeLockOwner(cwd, owner) {
+    const context = resolveSessionPointerContext(cwd);
+    await mkdir(context.lockPath, { recursive: true });
+    await writeFile(join(context.lockPath, 'owner.json'), JSON.stringify(owner), 'utf-8');
+    return context.lockPath;
+}
+function validLockOwner(overrides = {}) {
+    return {
+        version: 1,
+        token: TEST_TOKEN,
+        pid: process.pid,
+        platform: 'linux',
+        pid_start_ticks: 1,
+        created_at: '2026-07-14T00:00:00.000Z',
+        ...overrides,
+    };
+}
 describe('session lifecycle manager', () => {
     it('resets session metrics files with zeroed counters', async () => {
         const cwd = await mkdtemp(join(tmpdir(), 'omx-session-metrics-'));
@@ -249,7 +300,7 @@ describe('session lifecycle manager', () => {
                 nativeSessionId: 'codex-native-old',
             });
             await reconcileNativeSessionStart(cwd, 'codex-native-new', {
-                pid: 54321,
+                pid: process.pid,
                 platform: 'win32',
             });
             await writeSessionEnd(cwd, 'omx-owner-session');
@@ -356,22 +407,26 @@ describe('session lifecycle manager', () => {
             await rm(cwd, { recursive: true, force: true });
         }
     });
-    it('falls back to a fresh canonical session when reconciling without authoritative launch state', async () => {
-        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-native-fallback-'));
+    it('preserves foreign selected-pointer evidence instead of replacing it during native reconciliation', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-native-foreign-'));
         try {
             const statePath = join(cwd, '.omx', 'state', 'session.json');
             await resetSessionMetrics(cwd);
             await writeFile(statePath, JSON.stringify({
                 session_id: 'sess-other-worktree',
                 cwd: join(cwd, '..', 'different-worktree'),
+                pid: process.pid,
+                platform: 'win32',
             }), 'utf-8');
-            const reconciled = await reconcileNativeSessionStart(cwd, 'codex-fallback-1', {
-                pid: 67890,
+            await assert.rejects(reconcileNativeSessionStart(cwd, 'codex-fallback-1', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                && error.code === 'session_pointer_unusable'
+                && error.pointerStatus === 'foreign-cwd');
+            assert.equal(await readFile(statePath, 'utf-8'), JSON.stringify({
+                session_id: 'sess-other-worktree',
+                cwd: join(cwd, '..', 'different-worktree'),
+                pid: process.pid,
                 platform: 'win32',
-            });
-            assert.equal(reconciled.session_id, 'codex-fallback-1');
-            assert.equal(reconciled.native_session_id, 'codex-fallback-1');
-            assert.equal(reconciled.pid, 67890);
+            }));
         }
         finally {
             await rm(cwd, { recursive: true, force: true });
@@ -501,4 +556,470 @@ describe('isSessionStale', () => {
         assert.equal(stale, false);
     });
 });
+describe('session pointer transaction', () => {
+    it('makes root resolution failures pathless typed launch aborts', async () => {
+        await assert.rejects(writeSessionStart('bad\0cwd', 'sess-context'), (error) => isSessionPointerLaunchAbort(error)
+            && error.code === 'session_pointer_context_failure'
+            && error.operation === 'pointer-context-resolve'
+            && !('pointerPath' in error));
+    });
+    it('classifies only the exact selected pointer as absent, usable, stale, indeterminate, malformed, or foreign', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-pointer-status-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await withPointerDependencies({
+                probePid: () => 'alive',
+                readProcessIdentity: () => matchingProcessIdentity(),
+            }, async () => {
+                assert.equal((await readSessionPointer(context)).status, 'absent');
+                await mkdir(context.baseStateDir, { recursive: true });
+                await writeFile(context.sessionPath, JSON.stringify({
+                    session_id: 'sess-usable',
+                    started_at: '2026-07-14T00:00:00.000Z',
+                    cwd,
+                    pid: process.pid,
+                    platform: 'linux',
+                    pid_start_ticks: 1,
+                }), 'utf-8');
+                assert.equal((await readSessionPointer(context)).status, 'usable');
+                __setSessionPointerTransactionDependenciesForTests({
+                    probePid: () => 'dead',
+                    readProcessIdentity: () => matchingProcessIdentity(),
+                });
+                assert.equal((await readSessionPointer(context)).status, 'stale-dead');
+                __setSessionPointerTransactionDependenciesForTests({
+                    probePid: () => 'indeterminate',
+                    readProcessIdentity: () => matchingProcessIdentity(),
+                });
+                assert.equal((await readSessionPointer(context)).status, 'identity-indeterminate');
+                await writeFile(context.sessionPath, '{ not-json', 'utf-8');
+                assert.equal((await readSessionPointer(context)).status, 'malformed');
+                await writeFile(context.sessionPath, JSON.stringify({
+                    session_id: 'sess-foreign',
+                    started_at: '2026-07-14T00:00:00.000Z',
+                    cwd: join(cwd, '..', 'foreign-worktree'),
+                    pid: process.pid,
+                    platform: 'win32',
+                }), 'utf-8');
+                assert.equal((await readSessionPointer(context)).status, 'foreign-cwd');
+            });
+        }
+        finally {
+            __resetSessionPointerTransactionDependenciesForTests();
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('maps only ESRCH to a definitely dead default PID probe', () => {
+        const alive = __createDefaultPidProbeForTests(() => { });
+        const esrch = __createDefaultPidProbeForTests(() => { throw codedError('ESRCH'); });
+        const eperm = __createDefaultPidProbeForTests(() => { throw codedError('EPERM'); });
+        const unknown = __createDefaultPidProbeForTests(() => { throw codedError('EACCES'); });
+        const noCode = __createDefaultPidProbeForTests(() => { throw new Error('unknown'); });
+        const primitive = __createDefaultPidProbeForTests(() => { throw 'unknown'; });
+        assert.equal(alive(1), 'alive');
+        assert.equal(esrch(1), 'dead');
+        assert.equal(eperm(1), 'indeterminate');
+        assert.equal(unknown(1), 'indeterminate');
+        assert.equal(noCode(1), 'indeterminate');
+        assert.equal(primitive(1), 'indeterminate');
+    });
+    it('never reaps dead, reused, indeterminate, missing, or malformed lock evidence', async () => {
+        const cases = [
+            { name: 'dead', owner: validLockOwner(), probePid: 'dead', expected: 'dead' },
+            { name: 'reused', owner: validLockOwner(), probePid: 'alive', identity: { status: 'reused', startTicks: 2 }, expected: 'reused' },
+            { name: 'indeterminate-probe', owner: validLockOwner(), probePid: 'indeterminate', expected: 'identity-indeterminate' },
+            { name: 'indeterminate-identity', owner: validLockOwner(), probePid: 'alive', identity: { status: 'indeterminate' }, expected: 'identity-indeterminate' },
+            { name: 'unsubstantiated-reuse', owner: validLockOwner(), probePid: 'alive', identity: { status: 'reused', startTicks: 1 }, expected: 'identity-indeterminate' },
+            { name: 'missing-required-hash', owner: validLockOwner({ pid_cmdline_hash: 'a'.repeat(64) }), probePid: 'alive', identity: matchingProcessIdentity(), expected: 'identity-indeterminate' },
+            { name: 'missing', probePid: 'alive', expected: 'missing' },
+            { name: 'malformed', owner: { version: 1 }, probePid: 'alive', expected: 'malformed' },
+        ];
+        for (const testCase of cases) {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-session-lock-${testCase.name}-`));
+            try {
+                const context = resolveSessionPointerContext(cwd);
+                await mkdir(context.lockPath, { recursive: true });
+                if (testCase.owner) {
+                    await writeFile(join(context.lockPath, 'owner.json'), JSON.stringify(testCase.owner), 'utf-8');
+                }
+                const before = await readdir(context.lockPath);
+                await withPointerDependencies({
+                    token: () => TEST_TOKEN,
+                    probePid: () => testCase.probePid,
+                    readProcessIdentity: () => testCase.identity ?? matchingProcessIdentity(),
+                }, async () => {
+                    await assert.rejects(writeSessionStart(cwd, 'sess-lock', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                        && error.code === 'session_pointer_lock_recovery_required'
+                        && error.lockOwnerStatus === testCase.expected);
+                });
+                assert.deepEqual(await readdir(context.lockPath), before);
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        }
+    });
+    it('retries a positively matching live owner with the bounded 25/50/100 schedule before timing out', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-lock-timeout-'));
+        try {
+            await writeLockOwner(cwd, validLockOwner());
+            const delays = [];
+            let now = 0;
+            await withPointerDependencies({
+                nowMs: () => now,
+                sleep: async (ms) => { delays.push(ms); now += ms; },
+                token: () => TEST_TOKEN,
+                probePid: () => 'alive',
+                readProcessIdentity: () => matchingProcessIdentity(),
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-timeout', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_lock_timeout'
+                    && error.lockOwnerStatus === 'live');
+            });
+            assert.deepEqual(delays.slice(0, 3), [25, 50, 100]);
+            assert.equal(delays.at(-1), 25);
+            assert.equal(existsSync(resolveSessionPointerContext(cwd).lockPath), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('rolls back only its unpublished owner artifacts and reports rollback ambiguity', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-owner-publish-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        if (path.endsWith(`owner.${TEST_TOKEN}.tmp`))
+                            throw new Error('owner write failure');
+                        await writeFile(path, data, options);
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-owner-publish', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_io_failure'
+                    && error.operation === 'lock-owner-publish');
+            });
+            assert.equal(existsSync(context.lockPath), false);
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        if (path.endsWith(`owner.${TEST_TOKEN}.tmp`))
+                            throw new Error('owner write failure');
+                        await writeFile(path, data, options);
+                    },
+                    rmdir: async (path) => {
+                        if (path === context.lockPath)
+                            throw new Error('keep lock evidence');
+                        await rm(path, { recursive: false });
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-owner-residue', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_lock_recovery_required'
+                    && error.primaryOperation === 'lock-owner-publish'
+                    && error.secondaryFailures?.[0]?.phase === 'remove-unpublished-lock');
+            });
+            assert.equal(existsSync(context.lockPath), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('types state-directory, pointer-read, owner-sync, owner-rename, and invalid-token failures before commit', async () => {
+        const failures = [
+            {
+                name: 'state-dir',
+                operation: 'state-dir-create',
+                dependencies: (context) => ({
+                    fs: {
+                        mkdir: async (path, options) => {
+                            if (path === context.baseStateDir)
+                                throw new Error('state directory failure');
+                            await mkdir(path, options);
+                        },
+                    },
+                }),
+            },
+            {
+                name: 'pointer-read',
+                operation: 'pointer-read',
+                dependencies: (context) => ({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        readFile: async (path, encoding) => {
+                            if (path === context.sessionPath)
+                                throw new Error('pointer read failure');
+                            return await readFile(path, encoding);
+                        },
+                    },
+                }),
+            },
+            {
+                name: 'owner-sync',
+                operation: 'lock-owner-publish',
+                dependencies: (context) => ({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        openAndSync: async (path) => {
+                            if (path === join(context.lockPath, `owner.${TEST_TOKEN}.tmp`))
+                                throw new Error('owner sync failure');
+                        },
+                    },
+                }),
+            },
+            {
+                name: 'owner-rename',
+                operation: 'lock-owner-publish',
+                dependencies: (context) => ({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        rename: async (from, to) => {
+                            if (from === join(context.lockPath, `owner.${TEST_TOKEN}.tmp`))
+                                throw new Error('owner rename failure');
+                            await rename(from, to);
+                        },
+                    },
+                }),
+            },
+        ];
+        for (const failure of failures) {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-session-${failure.name}-`));
+            try {
+                const context = resolveSessionPointerContext(cwd);
+                await withPointerDependencies(failure.dependencies(context), async () => {
+                    await assert.rejects(writeSessionStart(cwd, 'sess-precommit', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                        && error.code === 'session_pointer_io_failure'
+                        && error.operation === failure.operation);
+                });
+                assert.equal(existsSync(context.lockPath), false);
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        }
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-invalid-token-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await withPointerDependencies({ token: () => 'bad' }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-invalid-token', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_io_failure'
+                    && error.operation === 'lock-owner-publish');
+            });
+            assert.equal(existsSync(context.lockPath), false);
+            assert.equal(existsSync(`${context.sessionPath}.tmp-bad`), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('types pointer write, sync, and rename failures and removes only the owned temporary file', async () => {
+        const phases = [
+            { operation: 'pointer-temp-write', fail: 'write' },
+            { operation: 'pointer-fsync', fail: 'sync' },
+            { operation: 'pointer-rename', fail: 'rename' },
+        ];
+        for (const phase of phases) {
+            const cwd = await mkdtemp(join(tmpdir(), `omx-session-${phase.fail}-`));
+            try {
+                const context = resolveSessionPointerContext(cwd);
+                const tempPath = `${context.sessionPath}.tmp-${TEST_TOKEN}`;
+                await withPointerDependencies({
+                    token: () => TEST_TOKEN,
+                    fs: {
+                        writeFile: async (path, data, options) => {
+                            await writeFile(path, data, options);
+                            if (phase.fail === 'write' && path === tempPath)
+                                throw new Error('pointer write failure');
+                        },
+                        openAndSync: async (path) => {
+                            if (phase.fail === 'sync' && path === tempPath)
+                                throw new Error('pointer sync failure');
+                        },
+                        rename: async (from, to) => {
+                            if (phase.fail === 'rename' && from === tempPath && to === context.sessionPath) {
+                                throw new Error('pointer rename failure');
+                            }
+                            await rename(from, to);
+                        },
+                    },
+                }, async () => {
+                    await assert.rejects(writeSessionStart(cwd, 'sess-failure', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                        && error.code === 'session_pointer_io_failure'
+                        && error.operation === phase.operation);
+                });
+                assert.equal(existsSync(tempPath), false);
+                assert.equal(existsSync(context.lockPath), false);
+            }
+            finally {
+                await rm(cwd, { recursive: true, force: true });
+            }
+        }
+    });
+    it('preserves owned pointer residue and ordered cleanup evidence when cleanup or release cannot complete', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-pointer-residue-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            const tempPath = `${context.sessionPath}.tmp-${TEST_TOKEN}`;
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        await writeFile(path, data, options);
+                        if (path === tempPath)
+                            throw new Error('pointer write failure');
+                    },
+                    unlink: async (path) => {
+                        if (path === tempPath)
+                            throw new Error('pointer temp cleanup failure');
+                        await rm(path, { force: false });
+                    },
+                    rmdir: async (path) => {
+                        if (path.endsWith(`.release-${TEST_TOKEN}`))
+                            throw new Error('release cleanup failure');
+                        await rm(path, { recursive: false });
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-residue', { platform: 'win32' }), (error) => isSessionPointerLaunchAbort(error)
+                    && error.code === 'session_pointer_lock_recovery_required'
+                    && error.primaryOperation === 'pointer-temp-write'
+                    && error.secondaryFailures?.map((failure) => failure.phase).join(',') === 'remove-pointer-temp,remove-release-dir'
+                    && error.secondaryFailures?.[0]?.evidencePath === tempPath);
+            });
+            assert.equal(existsSync(tempPath), true);
+            assert.equal(existsSync(`${context.lockPath}.release-${TEST_TOKEN}`), true);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('leaves foreign pointer temps inert and a successor commits after explicit lock recovery', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-pointer-successor-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            const ownTempPath = `${context.sessionPath}.tmp-${TEST_TOKEN}`;
+            const foreignTempPath = `${context.sessionPath}.tmp-${FOREIGN_TOKEN}`;
+            await mkdir(context.baseStateDir, { recursive: true });
+            await writeFile(foreignTempPath, 'foreign transaction evidence', 'utf-8');
+            await withPointerDependencies({
+                token: () => TEST_TOKEN,
+                fs: {
+                    writeFile: async (path, data, options) => {
+                        await writeFile(path, data, options);
+                        if (path === ownTempPath)
+                            throw new Error('pointer write failure');
+                    },
+                    unlink: async (path) => {
+                        if (path === ownTempPath)
+                            throw new Error('keep own residue');
+                        await rm(path, { force: false });
+                    },
+                    rename: async (from, to) => {
+                        if (from === context.lockPath)
+                            throw new Error('preserve canonical lock');
+                        await rename(from, to);
+                    },
+                },
+            }, async () => {
+                await assert.rejects(writeSessionStart(cwd, 'sess-first', { platform: 'win32' }), isSessionPointerLaunchAbort);
+            });
+            assert.equal(existsSync(foreignTempPath), true);
+            assert.equal(existsSync(context.lockPath), true);
+            // This is documented stopped-session operator recovery, deliberately not
+            // product transaction behavior.
+            await rm(context.lockPath, { recursive: true, force: true });
+            await withPointerDependencies({ token: () => SUCCESSOR_TOKEN }, async () => {
+                await writeSessionStart(cwd, 'sess-successor', { platform: 'win32' });
+            });
+            assert.equal((await readSessionState(cwd))?.session_id, 'sess-successor');
+            assert.equal(existsSync(ownTempPath), true);
+            assert.equal(existsSync(foreignTempPath), true);
+            assert.equal(existsSync(context.lockPath), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('binds an owner alias only on a verified same-native/absent transition and never during replacement', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-owner-alias-'));
+        try {
+            const nativeOnly = await reconcileNativeSessionStart(cwd, 'native-first', {
+                platform: 'win32',
+                ownerOmxSessionId: 'omx-owner',
+            });
+            assert.equal(nativeOnly.owner_omx_session_id, undefined);
+            await withOwnerEnvironment('omx-owner', async () => {
+                const bound = await reconcileNativeSessionStart(cwd, 'native-first', {
+                    platform: 'win32',
+                    ownerAliasVerified: true,
+                });
+                assert.equal(bound.session_id, 'native-first');
+                assert.equal(bound.owner_omx_session_id, 'omx-owner');
+                const replacement = await reconcileNativeSessionStart(cwd, 'native-second', {
+                    platform: 'win32',
+                    ownerAliasVerified: true,
+                });
+                assert.equal(replacement.session_id, 'native-second');
+                assert.equal(replacement.owner_omx_session_id, 'omx-owner');
+            });
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+    it('preserves pointer evidence when history cannot be appended and rejects unusable end states before history or HUD cleanup', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-session-end-preserve-'));
+        try {
+            const context = resolveSessionPointerContext(cwd);
+            await writeSessionStart(cwd, 'sess-history', { platform: 'win32' });
+            await mkdir(join(cwd, '.omx', 'logs'), { recursive: true });
+            await rm(join(cwd, '.omx', 'logs'), { recursive: true, force: true });
+            await writeFile(join(cwd, '.omx', 'logs'), 'not-a-directory', 'utf-8');
+            await assert.rejects(writeSessionEnd(cwd, 'sess-history'));
+            assert.equal((await readSessionState(cwd))?.session_id, 'sess-history');
+            await rm(join(cwd, '.omx', 'logs'), { force: true });
+            await writeFile(context.sessionPath, '{ malformed', 'utf-8');
+            await assert.rejects(writeSessionEnd(cwd, 'sess-history'), (error) => isSessionPointerLaunchAbort(error)
+                && error.code === 'session_pointer_unusable'
+                && error.pointerStatus === 'malformed');
+            assert.equal(await readFile(context.sessionPath, 'utf-8'), '{ malformed');
+            assert.equal(existsSync(join(cwd, '.omx', 'logs', 'session-history.jsonl')), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+});
+describe('prompt provenance diagnostics', () => {
+    it('writes exactly one redacted record at the supplied selected root', async () => {
+        const cwd = await mkdtemp(join(tmpdir(), 'omx-provenance-log-'));
+        try {
+            const stateDir = join(cwd, 'selected', '.omx', 'state');
+            await appendPromptSessionProvenanceRejection({
+                cwd,
+                baseStateDir: stateDir,
+                rootSource: 'cwd-default',
+                sessionPath: join(stateDir, 'session.json'),
+                lockPath: join(stateDir, 'session.json.lock'),
+            }, {
+                reason: 'payload_session_invalid',
+                producer: 'native',
+                selectedRootStatus: 'malformed',
+                timestamp: '2026-07-14T00:00:00.000Z',
+            });
+            const log = await readFile(join(cwd, 'selected', '.omx', 'logs', `omx-${todayIsoDate()}.jsonl`), 'utf-8');
+            assert.equal(log.trim().split('\n').length, 1);
+            assert.match(log, /"event":"prompt_session_provenance_rejected"/);
+            assert.equal(log.includes(cwd), false);
+            assert.equal(existsSync(join(cwd, '.omx', 'logs', `omx-${todayIsoDate()}.jsonl`)), false);
+        }
+        finally {
+            await rm(cwd, { recursive: true, force: true });
+        }
+    });
+});
 //# sourceMappingURL=session.test.js.map