oh-my-codex 0.20.1 → 0.20.3

package/src/scripts/notify-hook/team-worker-stop.ts

@@ -14,8 +14,7 @@ import { appendTeamDeliveryLog } from '../../team/delivery-log.js';
 import { safeString, asNumber, isTerminalPhase } from './utils.js';
 import { readJsonIfExists } from './state-io.js';
 import { logTmuxHookEvent } from './log.js';
-import { evaluatePaneInjectionReadiness, sendPaneInput } from './team-tmux-guard.js';
-import { resolvePaneTarget } from './tmux-injection.js';
+import { evaluatePaneInjectionReadiness, normalizeExactPaneId, sendPaneInput } from './team-tmux-guard.js';
 import { readTeamWorkersForIdleCheck } from './team-worker.js';
 
 const STOP_NUDGE_COOLDOWN_MS = 30_000;
@@ -134,17 +133,8 @@ function resolveWorkerStopCooldownMs() {
   return STOP_NUDGE_COOLDOWN_MS;
 }
 
-async function resolveCanonicalLeaderPaneId(leaderPaneId) {
-  const normalizedLeaderPaneId = safeString(leaderPaneId).trim();
-  if (!normalizedLeaderPaneId) return '';
-  try {
-    const resolved = await resolvePaneTarget({ type: 'pane', value: normalizedLeaderPaneId }, '', '', '', {});
-    const paneTarget = safeString(resolved?.paneTarget).trim();
-    if (paneTarget) return paneTarget;
-  } catch {
-    // Fall back to the recorded pane id; readiness guard remains authoritative.
-  }
-  return normalizedLeaderPaneId;
+function resolveCanonicalLeaderPaneId(leaderPaneId) {
+  return normalizeExactPaneId(leaderPaneId);
 }
 
 async function recordSuppressedWorkerStopNudge({
@@ -304,9 +294,16 @@ export async function maybeNudgeLeaderForAllowedWorkerStop({
   const teamInfo = await readTeamWorkersForIdleCheck(stateDir, teamName);
   if (!teamInfo) return { ok: false, result: 'unresolved' };
   ({ tmuxSession, leaderPaneId } = teamInfo);
-  const tmuxTarget = await resolveCanonicalLeaderPaneId(leaderPaneId);
-
-  if (!tmuxTarget) {
+  const leaderPanePid = Number.isInteger(teamInfo.leaderPanePid) && Number(teamInfo.leaderPanePid) > 0
+    ? Number(teamInfo.leaderPanePid)
+    : undefined;
+  const leaderPaneOwnerId = safeString(teamInfo.tmuxPaneOwnerId).trim();
+  const resolvedLeaderPaneId = await resolveCanonicalLeaderPaneId(leaderPaneId);
+  const tmuxTarget = resolvedLeaderPaneId && resolvedLeaderPaneId !== normalizeExactPaneId(teamInfo.hudPaneId)
+    ? resolvedLeaderPaneId
+    : '';
+
+  if (!tmuxTarget || !leaderPanePid || !leaderPaneOwnerId) {
     if (!(await teamStateAllowsWorkerStopNudge(stateDir, teamName))) {
       await recordShutdownSuppressionOnce();
       return { ok: true, result: TEAM_SHUTDOWN_NO_INJECTION_REASON };
@@ -330,6 +327,9 @@ export async function maybeNudgeLeaderForAllowedWorkerStop({
     requireRunningAgent: true,
     requireReady: false,
     requireIdle: false,
+    exactPaneId: tmuxTarget,
+    expectedPanePid: leaderPanePid,
+    expectedPaneOwnerId: leaderPaneOwnerId,
   });
   if (!paneGuard.ok) {
     if (!(await teamStateAllowsWorkerStopNudge(stateDir, teamName))) {
@@ -367,6 +367,10 @@ export async function maybeNudgeLeaderForAllowedWorkerStop({
       prompt,
       submitKeyPresses: 2,
       submitDelayMs: 100,
+      exactPaneId: tmuxTarget,
+      expectedPanePid: leaderPanePid,
+      expectedPaneOwnerId: leaderPaneOwnerId,
+      expectedHudPaneId: teamInfo.hudPaneId,
     });
     if (!sendResult.ok) throw new Error(sendResult.error || sendResult.reason || 'send_failed');
     const deliveryMode = leaderHasActiveTask ? 'steered' : 'sent';

package/src/scripts/notify-hook/team-worker.ts

@@ -10,8 +10,7 @@ import { resolveWorkerNotifyTeamStateRootPath } from '../../team/state-root.js';
 import { asNumber, safeString, isTerminalPhase } from './utils.js';
 import { readJsonIfExists } from './state-io.js';
 import { logTmuxHookEvent } from './log.js';
-import { evaluatePaneInjectionReadiness, sendPaneInput } from './team-tmux-guard.js';
-import { resolvePaneTarget } from './tmux-injection.js';
+import { evaluatePaneInjectionReadiness, normalizeExactPaneId, sendPaneInput } from './team-tmux-guard.js';
 import {
   classifyLeaderActionState,
   resolveAllWorkersIdleIntent,
@@ -20,6 +19,11 @@ import {
 import { DEFAULT_MARKER } from '../tmux-hook-engine.js';
 const LEADER_PANE_SHELL_NO_INJECTION_REASON = 'leader_pane_shell_no_injection';
 
+function positivePanePid(value) {
+  return Number.isInteger(value) && Number(value) > 0 ? Number(value) : undefined;
+}
+
+
 export async function resolveTeamStateDirForWorker(cwd, parsedTeamWorker) {
   return resolveWorkerNotifyTeamStateRootPath(cwd, parsedTeamWorker, process.env);
 }
@@ -216,8 +220,11 @@ export async function readTeamWorkersForIdleCheck(stateDir, teamName) {
       if (!Array.isArray(workers) || workers.length === 0) continue;
       const tmuxSession = safeString(parsed.tmux_session || '').trim();
       const leaderPaneId = safeString(parsed.leader_pane_id || '').trim();
-      const result = { workers, tmuxSession, leaderPaneId };
-      if (leaderPaneId) return result;
+      const hudPaneId = safeString(parsed.hud_pane_id || '').trim();
+      const leaderPanePid = positivePanePid(parsed.leader_pane_pid);
+      const tmuxPaneOwnerId = safeString(parsed.tmux_pane_owner_id || '').trim();
+      const result = { workers, tmuxSession, leaderPaneId, leaderPanePid, tmuxPaneOwnerId, hudPaneId };
+      if (leaderPaneId && leaderPanePid && tmuxPaneOwnerId) return result;
       if (!fallback) fallback = result;
     } catch {
       // Try the next state source.
@@ -253,22 +260,11 @@ async function readTeamTaskCounts(stateDir, teamName) {
   return taskCounts;
 }
 
-async function resolveCanonicalLeaderPaneId(_tmuxSession, leaderPaneId) {
-  const normalizedLeaderPaneId = safeString(leaderPaneId).trim();
-  if (normalizedLeaderPaneId) {
-    try {
-      const resolved = await resolvePaneTarget({ type: 'pane', value: normalizedLeaderPaneId }, '', '', '', {});
-      const paneTarget = safeString(resolved?.paneTarget).trim();
-      if (paneTarget) return paneTarget;
-    } catch {
-      // fall through to tmux session scan
-    }
-    return normalizedLeaderPaneId;
-  }
-  return '';
+function resolveCanonicalLeaderPaneId(_tmuxSession, leaderPaneId) {
+  return normalizeExactPaneId(leaderPaneId);
 }
 
-async function checkLeaderPaneReadyForWorkerStateReminder(paneTarget) {
+async function checkLeaderPaneReadyForWorkerStateReminder(paneTarget, exactPaneId, expectedPanePid, expectedPaneOwnerId) {
   return evaluatePaneInjectionReadiness(paneTarget, {
     skipIfScrolling: true,
     // Worker-state reminders are their own trigger path. They should still
@@ -277,6 +273,9 @@ async function checkLeaderPaneReadyForWorkerStateReminder(paneTarget) {
     requireRunningAgent: true,
     requireReady: false,
     requireIdle: false,
+    exactPaneId,
+    expectedPanePid,
+    expectedPaneOwnerId,
   });
 }
 
@@ -367,8 +366,11 @@ export async function maybeNotifyLeaderAllWorkersIdle({ cwd, stateDir, logsDir,
   // Read team config to get worker list and leader tmux target
   const teamInfo = await readTeamWorkersForIdleCheck(stateDir, teamName);
   if (!teamInfo) return;
-  const { workers, tmuxSession, leaderPaneId } = teamInfo;
-  const canonicalLeaderPaneId = await resolveCanonicalLeaderPaneId(tmuxSession, leaderPaneId);
+  const { workers, tmuxSession, leaderPaneId, leaderPanePid, tmuxPaneOwnerId, hudPaneId } = teamInfo;
+  const resolvedLeaderPaneId = await resolveCanonicalLeaderPaneId(tmuxSession, leaderPaneId);
+  const canonicalLeaderPaneId = resolvedLeaderPaneId && resolvedLeaderPaneId !== normalizeExactPaneId(hudPaneId)
+    ? resolvedLeaderPaneId
+    : '';
 
   // Check cooldown to prevent notification spam
   const idleStatePath = join(stateDir, 'team', teamName, 'all-workers-idle.json');
@@ -399,7 +401,7 @@ export async function maybeNotifyLeaderAllWorkersIdle({ cwd, stateDir, logsDir,
   });
   const orchestrationIntent = resolveAllWorkersIdleIntent(leaderActionState);
 
-  if (!canonicalLeaderPaneId) {
+  if (!canonicalLeaderPaneId || !positivePanePid(leaderPanePid) || !tmuxPaneOwnerId) {
     const nextIdleState = {
       ...idleState,
       last_notified_at_ms: nowMs,
@@ -426,7 +428,7 @@ export async function maybeNotifyLeaderAllWorkersIdle({ cwd, stateDir, logsDir,
   const nextAction = `Run \`omx team status ${teamName}\` now, read unread worker messages, then assign the next concrete task, reconcile results, or shut the team down.`;
   const message = `[OMX] All ${N} worker${N === 1 ? '' : 's'} idle. ${nextAction} ${DEFAULT_MARKER}`;
   const tmuxTarget = canonicalLeaderPaneId;
-  const paneGuard = await checkLeaderPaneReadyForWorkerStateReminder(tmuxTarget);
+  const paneGuard = await checkLeaderPaneReadyForWorkerStateReminder(tmuxTarget, canonicalLeaderPaneId, leaderPanePid, tmuxPaneOwnerId);
   if (!paneGuard.ok) {
     const nextIdleState = {
       ...idleState,
@@ -459,6 +461,10 @@ export async function maybeNotifyLeaderAllWorkersIdle({ cwd, stateDir, logsDir,
       prompt: message,
       submitKeyPresses: 2,
       submitDelayMs: 100,
+      exactPaneId: canonicalLeaderPaneId,
+      expectedPanePid: leaderPanePid,
+      expectedPaneOwnerId: tmuxPaneOwnerId,
+      expectedHudPaneId: hudPaneId,
     });
     if (!sendResult.ok) throw new Error(sendResult.error || sendResult.reason || 'send_failed');
 
@@ -591,10 +597,13 @@ export async function maybeNotifyLeaderWorkerIdle({ cwd, stateDir, logsDir, pars
   // Read team config for tmux target
   const teamInfo = await readTeamWorkersForIdleCheck(stateDir, teamName);
   if (!teamInfo) return;
-  const { tmuxSession, leaderPaneId } = teamInfo;
-  const canonicalLeaderPaneId = await resolveCanonicalLeaderPaneId(tmuxSession, leaderPaneId);
+  const { tmuxSession, leaderPaneId, leaderPanePid, tmuxPaneOwnerId, hudPaneId } = teamInfo;
+  const resolvedLeaderPaneId = await resolveCanonicalLeaderPaneId(tmuxSession, leaderPaneId);
+  const canonicalLeaderPaneId = resolvedLeaderPaneId && resolvedLeaderPaneId !== normalizeExactPaneId(hudPaneId)
+    ? resolvedLeaderPaneId
+    : '';
 
-  if (!canonicalLeaderPaneId) {
+  if (!canonicalLeaderPaneId || !positivePanePid(leaderPanePid) || !tmuxPaneOwnerId) {
     await emitLeaderPaneMissingDeferred({
       stateDir,
       logsDir,
@@ -608,7 +617,7 @@ export async function maybeNotifyLeaderWorkerIdle({ cwd, stateDir, logsDir, pars
     return;
   }
   const tmuxTarget = canonicalLeaderPaneId;
-  const paneGuard = await checkLeaderPaneReadyForWorkerStateReminder(tmuxTarget);
+  const paneGuard = await checkLeaderPaneReadyForWorkerStateReminder(tmuxTarget, canonicalLeaderPaneId, leaderPanePid, tmuxPaneOwnerId);
   if (!paneGuard.ok) {
     try {
       const tmpPath = cooldownPath + '.tmp.' + process.pid;
@@ -651,6 +660,10 @@ export async function maybeNotifyLeaderWorkerIdle({ cwd, stateDir, logsDir, pars
       prompt: message,
       submitKeyPresses: 2,
       submitDelayMs: 100,
+      exactPaneId: canonicalLeaderPaneId,
+      expectedPanePid: leaderPanePid,
+      expectedPaneOwnerId: tmuxPaneOwnerId,
+      expectedHudPaneId: hudPaneId,
     });
     if (!sendResult.ok) throw new Error(sendResult.error || sendResult.reason || 'send_failed');
 

package/src/scripts/notify-hook/tmux-injection.ts

@@ -19,7 +19,14 @@ import {
 } from './state-io.js';
 import { runProcess } from './process-runner.js';
 import { logTmuxHookEvent } from './log.js';
-import { resolveInvocationSessionId, resolveManagedCurrentPane, resolveManagedSessionContext, verifyManagedPaneTarget } from './managed-tmux.js';
+import {
+  resolveInvocationSessionId,
+  resolveManagedCurrentPane,
+  resolveManagedCurrentPaneAtPromptContext,
+  resolveManagedSessionContext,
+  verifyManagedPaneTarget,
+  verifyManagedPaneTargetAtPromptContext,
+} from './managed-tmux.js';
 import { evaluatePaneInjectionReadiness, mapPaneInjectionReadinessReason, sendPaneInput } from './team-tmux-guard.js';
 import { listActiveSkills, readVisibleSkillActiveStateForStateDir } from '../../state/skill-active.js';
 import {
@@ -28,6 +35,7 @@ import {
   evaluateInjectionGuards,
   buildSendKeysArgv,
 } from '../tmux-hook-engine.js';
+import type { ResolvedPromptTurnContext } from '../../hooks/prompt-session-provenance.js';
 
 function isHudPaneStartCommand(startCommand: any): boolean {
   return /\bomx\b.*\bhud\b.*--watch/i.test(safeString(startCommand));
@@ -404,16 +412,21 @@ export async function resolvePaneTarget(target: any, expectedCwd: any, modePane:
   }
 }
 
-export async function handleTmuxInjection({
-  payload,
-  cwd,
-  stateDir,
-  logsDir,
-}: any): Promise<void> {
+export async function handleTmuxInjection({ payload, cwd, stateDir, logsDir, context = null }: {
+  payload: any;
+  cwd: string;
+  stateDir: string;
+  logsDir: string;
+  context?: ResolvedPromptTurnContext | null;
+}): Promise<void> {
   const omxDir = join(cwd, '.omx');
   const configPath = join(omxDir, 'tmux-hook.json');
   const hookStatePath = join(stateDir, 'tmux-hook-state.json');
   const nowIso = new Date().toISOString();
+  if (context && context.status !== 'authorized') return;
+  const ownershipPayload = context?.status === 'authorized'
+    ? { ...payload, session_id: context.authorization.ownerCodexSessionId, 'session-id': context.authorization.ownerCodexSessionId }
+    : payload;
   const now = Date.now();
 
   const rawConfig = await readJsonIfExists(configPath, null);
@@ -429,7 +442,7 @@ export async function handleTmuxInjection({
   const sourceText = inputMessages.join('\n');
   const state = normalizeTmuxState(await readJsonIfExists(hookStatePath, null));
   state.recent_keys = pruneRecentKeys(state.recent_keys, now);
-  const canonicalModeState = await readVisibleAllowedModes(cwd, stateDir, payload, config.allowed_modes).catch(() => ({
+  const canonicalModeState = await readVisibleAllowedModes(cwd, stateDir, ownershipPayload, config.allowed_modes).catch(() => ({
     canonicalPresent: false,
     activeSkillCount: 0,
     allowedSet: null,
@@ -547,7 +560,9 @@ export async function handleTmuxInjection({
     turnId,
     timestamp: nowIso,
   }), sourceText);
-  const managedCurrentPane = await resolveManagedCurrentPane(cwd, payload, { allowTeamWorker: false });
+  const managedCurrentPane = context
+    ? await resolveManagedCurrentPaneAtPromptContext(cwd, context)
+    : await resolveManagedCurrentPane(cwd, payload, { allowTeamWorker: false });
   if (modePane && managedCurrentPane && modePane !== managedCurrentPane) {
     state.last_reason = 'mode_pane_current_pane_mismatch';
     state.last_event_at = nowIso;
@@ -564,12 +579,12 @@ export async function handleTmuxInjection({
 
   const preferredPaneTarget = modePane || managedCurrentPane;
   let resolution = preferredModePane
-    ? await resolvePaneTarget({ type: 'pane', value: preferredModePane.pane }, cwd, preferredModePane.pane, cwd, payload)
+    ? await resolvePaneTarget({ type: 'pane', value: preferredModePane.pane }, cwd, preferredModePane.pane, cwd, ownershipPayload)
     : preferredPaneTarget
-      ? await resolvePaneTarget({ type: 'pane', value: preferredPaneTarget }, cwd, '', cwd, payload)
-      : await resolvePaneTarget(config.target, cwd, modePane, cwd, payload);
+      ? await resolvePaneTarget({ type: 'pane', value: preferredPaneTarget }, cwd, '', cwd, ownershipPayload)
+      : await resolvePaneTarget(config.target, cwd, modePane, cwd, ownershipPayload);
   if (!resolution.paneTarget && preferredPaneTarget) {
-    resolution = await resolvePaneTarget(config.target, cwd, modePane, cwd, payload);
+    resolution = await resolvePaneTarget(config.target, cwd, modePane, cwd, ownershipPayload);
   }
   if (!resolution.paneTarget) {
     state.last_reason = resolution.reason;
@@ -586,14 +601,16 @@ export async function handleTmuxInjection({
   }
   const paneTarget = resolution.paneTarget;
 
-  const ownership = await validateResolvedInjectionOwnership({
-    paneTarget,
-    cwd,
-    payload,
-    modeState,
-    modePane,
-    managedCurrentPane,
-  });
+  const ownership = context
+    ? await verifyManagedPaneTargetAtPromptContext(paneTarget, cwd, context)
+    : await validateResolvedInjectionOwnership({
+      paneTarget,
+      cwd,
+      payload,
+      modeState,
+      modePane,
+      managedCurrentPane,
+    });
   if (!ownership.ok) {
     state.last_reason = ownership.reason;
     state.last_event_at = nowIso;
@@ -670,9 +687,11 @@ export async function handleTmuxInjection({
 
   // Shared pane-state guard: skip injection when the target pane is scrolling,
   // has returned to a shell, is still bootstrapping, or is visibly busy.
+  let readinessPanePid: number | undefined;
   try {
     const paneGuard = await evaluatePaneInjectionReadiness(paneTarget, {
       skipIfScrolling: config.skip_if_scrolling,
+      exactPaneId: paneTarget,
     });
     if (!paneGuard.ok) {
       const reason = mapPaneInjectionReadinessReason(paneGuard.reason);
@@ -689,8 +708,30 @@ export async function handleTmuxInjection({
       });
       return;
     }
-  } catch {
-    // Non-fatal: if querying pane state fails, proceed with injection.
+    readinessPanePid = asNumber(paneGuard.exactPaneProof?.pid);
+    if (!Number.isInteger(readinessPanePid) || readinessPanePid <= 0) {
+      state.last_reason = 'pane_readiness_unverified';
+      state.last_event_at = nowIso;
+      await writeFile(hookStatePath, JSON.stringify(state, null, 2)).catch(() => {});
+      await logTmuxHookEvent(logsDir, {
+        ...baseLog,
+        event: 'injection_skipped',
+        reason: 'pane_readiness_unverified',
+        pane_target: paneTarget,
+      });
+      return;
+    }
+  } catch (error) {
+    const reason = `pane_proof_unavailable:${error instanceof Error ? error.message : String(error)}`;
+    updateStateForAttempt(false, reason);
+    await writeFile(hookStatePath, JSON.stringify(state, null, 2)).catch(() => {});
+    await logTmuxHookEvent(logsDir, {
+      ...baseLog,
+      event: 'injection_skipped',
+      reason,
+      pane_target: paneTarget,
+    });
+    return;
   }
 
   if (config.dry_run) {
@@ -710,6 +751,8 @@ export async function handleTmuxInjection({
     const sendResult = await sendPaneInput({
       paneTarget,
       prompt,
+      exactPaneId: paneTarget,
+      expectedPanePid: readinessPanePid,
       submitKeyPresses: argv.submitArgv.length,
       submitDelayMs: 25,
     });

package/src/scripts/notify-hook/visual-verdict.ts

@@ -84,7 +84,15 @@ export function parseVisualVerdict(text: any): { verdict: string; raw: string }
  *
  * Module import failure is handled by the caller in notify-hook.ts.
  */
-export async function maybePersistVisualVerdict({ cwd, payload, stateDir, logsDir, sessionId, turnId }: any): Promise<void> {
+export async function maybePersistVisualVerdict({
+  cwd,
+  payload,
+  stateDir,
+  logsDir,
+  sessionId,
+  turnId,
+  persistRuntimeFeedback = true,
+}: any): Promise<void> {
   const output = safeString(
     payload?.['last-assistant-message'] || payload?.last_assistant_message || '',
   );
@@ -92,17 +100,19 @@ export async function maybePersistVisualVerdict({ cwd, payload, stateDir, logsDi
 
   // Runtime visual feedback (JSON/fenced JSON) for ralph-progress persistence.
   // Non-fatal and observable via warn-level structured logging.
-  try {
-    await maybePersistRuntimeVisualFeedback({ cwd, output, sessionId, stateDir });
-  } catch (err: any) {
-    await logNotifyHookEvent(logsDir, {
-      timestamp: new Date().toISOString(),
-      level: 'warn',
-      type: 'visual_runtime_feedback_persist_failure',
-      error: err?.message || String(err),
-      session_id: sessionId,
-      turn_id: turnId,
-    });
+  if (persistRuntimeFeedback) {
+    try {
+      await maybePersistRuntimeVisualFeedback({ cwd, output, sessionId, stateDir });
+    } catch (err: any) {
+      await logNotifyHookEvent(logsDir, {
+        timestamp: new Date().toISOString(),
+        level: 'warn',
+        type: 'visual_runtime_feedback_persist_failure',
+        error: err?.message || String(err),
+        session_id: sessionId,
+        turn_id: turnId,
+      });
+    }
   }
 
   const parsed = parseVisualVerdict(output);