oh-my-codex 0.20.2 → 0.20.3

package/src/scripts/__tests__/reasoning-artifact-contract.test.ts

@@ -0,0 +1,129 @@
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parse as parseToml } from '@iarna/toml';
+import { test } from 'node:test';
+import {
+  assertInstalledReasoningDeclarationContract,
+  assertInstalledRootReasoningHelp,
+  assertInstalledRootReasoningRejection,
+  assertInstalledTeamSkillContract,
+} from '../smoke-packed-install.js';
+
+const root = process.cwd();
+const dist = join(root, 'dist');
+
+function read(relativePath: string): string {
+  return readFileSync(join(root, relativePath), 'utf-8');
+}
+
+test('compiled reasoning artifacts preserve exact surface-specific max contracts', async () => {
+  const requiredArtifacts = [
+    'dist/config/models.js',
+    'dist/config/models.d.ts',
+    'dist/agents/definitions.js',
+    'dist/agents/definitions.d.ts',
+    'dist/agents/native-config.js',
+    'dist/agents/native-config.d.ts',
+    'dist/team/model-contract.js',
+    'dist/team/model-contract.d.ts',
+    'dist/cli/index.js',
+    'dist/cli/index.d.ts',
+    'dist/cli/omx.js',
+    'dist/cli/omx.d.ts',
+  ];
+  for (const relativePath of requiredArtifacts) {
+    assert.equal(existsSync(join(root, relativePath)), true, `missing compiled artifact: ${relativePath}`);
+  }
+
+  const modelsDeclaration = read('dist/config/models.d.ts');
+  const definitionsDeclaration = read('dist/agents/definitions.d.ts');
+  const nativeDeclaration = read('dist/agents/native-config.d.ts');
+  const teamDeclaration = read('dist/team/model-contract.d.ts');
+  assertInstalledReasoningDeclarationContract({
+    models: modelsDeclaration,
+    definitions: definitionsDeclaration,
+    nativeConfig: nativeDeclaration,
+    team: teamDeclaration,
+  });
+
+  const models = await import(pathToFileURL(join(dist, 'config/models.js')).href);
+  assert.deepEqual(models.CANONICAL_REASONING_EFFORTS, ['low', 'medium', 'high', 'xhigh']);
+  assert.deepEqual(models.AMBIGUOUS_UNSUPPORTED_REASONING_EFFORTS, ['max', 'ultra']);
+  assert.deepEqual(models.PER_AGENT_REASONING_EFFORTS, ['low', 'medium', 'high', 'xhigh', 'max']);
+  assert.deepEqual(models.ROOT_REASONING_EFFORTS, ['low', 'medium', 'high', 'xhigh']);
+  assert.deepEqual(models.ROOT_UNSUPPORTED_REASONING_EFFORTS, ['max', 'ultra']);
+  assert.equal(models.isAmbiguousUnsupportedReasoningEffort('MAX'), true);
+  assert.equal(models.isUnsupportedRootReasoningEffort('MAX'), true);
+  assert.equal(models.isUnsupportedRootReasoningEffort('ultra'), true);
+  assert.equal(models.isUnsupportedRootReasoningEffort('xhigh'), false);
+  assert.equal(models.normalizeUnsupportedRootReasoningEffort(' MAX '), 'max');
+  assert.equal(models.normalizeUnsupportedRootReasoningEffort('Ultra'), 'ultra');
+  assert.equal(models.normalizeUnsupportedRootReasoningEffort('xhigh'), undefined);
+
+  const nativeConfig = await import(pathToFileURL(join(dist, 'agents/native-config.js')).href);
+  const definitions = await import(pathToFileURL(join(dist, 'agents/definitions.js')).href);
+  const codexHome = mkdtempSync(join(tmpdir(), 'omx-artifact-max-native-'));
+  try {
+    writeFileSync(join(codexHome, '.omx-config.json'), JSON.stringify({
+      agentReasoning: { architect: ' MAX ', critic: 'ultra' },
+    }));
+    const maxToml = nativeConfig.generateAgentToml(
+      definitions.AGENT_DEFINITIONS.architect,
+      'compiled native max contract',
+      { codexHomeOverride: codexHome },
+    );
+    assert.match(maxToml, /model_reasoning_effort = "max"/);
+    assert.doesNotMatch(maxToml, /model_reasoning_effort = "xhigh"/);
+    assert.equal((parseToml(maxToml) as { model_reasoning_effort?: unknown }).model_reasoning_effort, 'max');
+
+    const fallbackToml = nativeConfig.generateAgentToml(
+      definitions.AGENT_DEFINITIONS.critic,
+      'compiled native ultra fallback contract',
+      { codexHomeOverride: codexHome },
+    );
+    assert.match(fallbackToml, /model_reasoning_effort = "high"/);
+    assert.doesNotMatch(fallbackToml, /model_reasoning_effort = "ultra"/);
+  } finally {
+    rmSync(codexHome, { recursive: true, force: true });
+  }
+
+  const team = await import(pathToFileURL(join(dist, 'team/model-contract.js')).href);
+  const maxArgs = team.resolveTeamWorkerLaunchArgs({ preferredReasoning: 'max' });
+  assert.deepEqual(maxArgs, ['-c', 'model_reasoning_effort="max"']);
+  assert.equal(maxArgs.includes('model_reasoning_effort="xhigh"'), false);
+  const opaqueUltra = team.resolveTeamWorkerLaunchDiagnostics({
+    existingRaw: '-c model_reasoning_effort="ultra"',
+    preferredReasoning: 'max',
+  });
+  assert.equal(opaqueUltra.reasoningSource, 'explicit');
+  assert.equal(opaqueUltra.actualReasoning, undefined);
+
+  const canonicalSkill = readFileSync(join(root, 'skills/team/SKILL.md'));
+  const pluginSkill = readFileSync(join(root, 'plugins/oh-my-codex/skills/team/SKILL.md'));
+  assertInstalledTeamSkillContract(canonicalSkill, pluginSkill);
+});
+
+test('compiled root reasoning keeps four-value help and rejects max/ultra without mutation', () => {
+  const omxPath = join(dist, 'cli/omx.js');
+  const codexHome = mkdtempSync(join(tmpdir(), 'omx-artifact-root-reasoning-'));
+  try {
+    const env = { ...process.env, CODEX_HOME: codexHome };
+    const configPath = join(codexHome, 'config.toml');
+    const help = spawnSync(process.execPath, [omxPath, 'reasoning'], { encoding: 'utf-8', env });
+    assert.equal(help.status, 0, help.stderr);
+    assertInstalledRootReasoningHelp(help.stdout);
+    const max = spawnSync(process.execPath, [omxPath, 'reasoning', 'max'], { encoding: 'utf-8', env });
+    assertInstalledRootReasoningRejection('max', max, undefined, existsSync(configPath) ? readFileSync(configPath, 'utf-8') : undefined);
+
+    const originalConfig = 'model = "preserve-root-config"\n';
+    writeFileSync(configPath, originalConfig);
+    const ultra = spawnSync(process.execPath, [omxPath, 'reasoning', 'ultra'], { encoding: 'utf-8', env });
+    assertInstalledRootReasoningRejection('ultra', ultra, originalConfig, readFileSync(configPath, 'utf-8'));
+  } finally {
+    rmSync(codexHome, { recursive: true, force: true });
+  }
+});

package/src/scripts/__tests__/role-intent-bootstrap-e2e-3181.test.ts

@@ -1,214 +1,77 @@
 import assert from 'node:assert/strict';
-import { mkdtemp, rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, it } from 'node:test';
 
-import { ralplanCommand } from '../../cli/ralplan.js';
-import { readSubagentTrackingState, recordSubagentTurnForSession } from '../../subagents/tracker.js';
+import { recordSubagentTurnForSession, readSubagentTrackingState } from '../../subagents/tracker.js';
 import { dispatchCodexNativeHook } from '../codex-native-hook.js';
 
-async function invokeRoleIntent(cwd: string, args: string[]) {
-  const stdout: string[] = [];
-  const stderr: string[] = [];
-  const previous = process.exitCode;
-  try {
-    process.exitCode = undefined;
-    await ralplanCommand(args, { cwd: () => cwd, stdout: (l) => stdout.push(l), stderr: (l) => stderr.push(l) });
-    return { stdout, stderr, exitCode: process.exitCode };
-  } finally {
-    process.exitCode = previous;
-  }
-}
-
-describe('#3181 end-to-end fresh App turn bootstrap', () => {
-  it('SessionStart reconcile alone neither attests nor authorizes a role intent (fail-closed; positive provenance required)', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
-    try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const nativeSessionId = 'codex-native-fresh-app';
-
-      // 1. Fresh App/outside-tmux turn start: no session.json, no tracker yet.
-      await dispatchCodexNativeHook(
-        { hook_event_name: 'SessionStart', cwd, session_id: nativeSessionId },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-
-      // 2. SessionStart reconciles the canonical pointer but does NOT attest a leader
-      //    (a null transcript cannot positively classify a root vs a malformed child) and
-      //    writes no positively-provenanced tracker leader.
-      const afterStart = await readSubagentTrackingState(cwd);
-      assert.equal(afterStart.sessions[nativeSessionId]?.leader_attested_at, undefined, 'SessionStart must not attest a leader');
-
-      // 3. A role-intent write on the reconciled-pointer-only session FAILS CLOSED: the bare
-      //    session.json native_session_id is not a trusted leader anchor (an ambiguous /
-      //    malformed-child SessionStart could set it). Authorization requires positive
-      //    provenance — a PreToolUse attestation (next test) or a recorded tracker leader.
-      const res = await invokeRoleIntent(cwd, ['role-intent', 'write', '--role', 'architect', '--parent-thread', nativeSessionId, '--json']);
-      assert.equal(res.exitCode, 1);
-      assert.deepEqual(JSON.parse(res.stdout.join('\n')), { ok: false, reason: 'parent_not_active_leader' });
-
-      const finalState = await readSubagentTrackingState(cwd);
-      assert.deepEqual(finalState.pending_role_intents, []);
-    } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-
-  it('PreToolUse (leader turn) bootstraps the pointer + attestation when SessionStart did not, so the first role-intent write succeeds', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-pretool-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
+describe('#3194 role-intent native-hook e2e', () => {
+  it('does not treat legacy thread_id as leader authority and preserves a child record', async () => {
+    const cwd = await mkdtemp(join(tmpdir(), 'omx-3194-'));
     try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const nativeSessionId = 'codex-native-exec-leader';
-
-      // Fresh exec turn where the first event reaching OMX is a leader PreToolUse (no
-      // prior SessionStart pointer). The leader turn carries thread_id == session_id.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: nativeSessionId,
-          thread_id: nativeSessionId,
-          tool_name: 'Bash',
-          tool_use_id: 'tool-exec-first',
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
-        },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-
-      const afterPreTool = await readSubagentTrackingState(cwd);
-      const attested = afterPreTool.sessions[nativeSessionId];
-      assert.equal(attested?.leader_thread_id, nativeSessionId);
-      assert.equal(attested?.leader_attest_source, 'native-pretooluse');
-
-      const res = await invokeRoleIntent(cwd, ['role-intent', 'write', '--role', 'architect', '--parent-thread', nativeSessionId, '--json']);
-      assert.equal(res.exitCode, undefined);
-      const receipt = JSON.parse(res.stdout.join('\n')) as { ok: boolean; intent: { role: string } };
-      assert.equal(receipt.ok, true);
-      assert.equal(receipt.intent.role, 'architect');
-      assert.equal((await readSubagentTrackingState(cwd)).pending_role_intents.length, 1);
-    } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-
-  it('never attests a thread durably tracked as a subagent, even via a source-less leader-shaped PreToolUse', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-child-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
-    try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const childThreadId = 'codex-native-child-thread';
-
-      // A child is durably recorded as a subagent (e.g. at its own SessionStart).
       await recordSubagentTurnForSession(cwd, {
-        sessionId: 'leader-session',
-        threadId: childThreadId,
-        kind: 'subagent',
-        leaderThreadId: 'leader-session',
-        timestamp: new Date().toISOString(),
+        sessionId: 'synthetic-leader-session', threadId: 'synthetic-child-thread', kind: 'subagent',
+        leaderThreadId: 'synthetic-leader-thread', timestamp: new Date(0).toISOString(),
       });
-
-      // The child then emits a source-less, untyped, leader-shaped PreToolUse
-      // (thread_id === session_id). It must NOT be promoted to leader.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: childThreadId,
-          thread_id: childThreadId,
-          tool_name: 'Bash',
-          tool_use_id: 'tool-child-selfpromote',
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      const before = await readSubagentTrackingState(cwd);
+      const result = await dispatchCodexNativeHook({
+        hook_event_name: 'PreToolUse', cwd, session_id: 'synthetic-child-thread', thread_id: 'synthetic-child-thread',
+        tool_name: 'Bash', tool_use_id: 'synthetic-tool-use', tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      }, { cwd, sessionOwnerPid: process.pid });
+      assert.deepEqual(result.outputJson, {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse', permissionDecision: 'deny',
+          permissionDecisionReason: 'unsupported_documented_leader_proof: Codex 0.144.5 hooks do not expose documented root identity required for adapted Ralplan.',
         },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-
-      const state = await readSubagentTrackingState(cwd);
-      assert.equal(state.sessions[childThreadId]?.leader_attested_at, undefined, 'child thread must not be attested as leader');
+      });
+      assert.deepEqual(await readSubagentTrackingState(cwd), before);
     } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
       await rm(cwd, { recursive: true, force: true });
     }
   });
 
-  it('never bootstraps a leader from a PreToolUse carrying a malformed/blank thread_spawn carrier', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-malformed-spawn-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
+  it('does not create session state for a fresh documented payload without thread_id', async () => {
+    const cwd = await mkdtemp(join(tmpdir(), 'omx-3194-'));
     try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const childThreadId = 'codex-native-malformed-spawn';
-      // Present-but-malformed thread_spawn carrier (blank parent id) is still child
-      // provenance and must veto leader bootstrap: no pointer, no attestation.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: childThreadId,
-          thread_id: childThreadId,
-          tool_name: 'Bash',
-          tool_use_id: 'tool-malformed-spawn',
-          source: { subagent: { thread_spawn: { parent_thread_id: '' } } },
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      const result = await dispatchCodexNativeHook({
+        hook_event_name: 'PreToolUse', cwd, session_id: 'synthetic-session', tool_name: 'Bash', tool_use_id: 'synthetic-tool-use',
+        tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      }, { cwd, sessionOwnerPid: process.pid });
+      assert.deepEqual(result.outputJson, {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse', permissionDecision: 'deny',
+          permissionDecisionReason: 'unsupported_documented_leader_proof: Codex 0.144.5 hooks do not expose documented root identity required for adapted Ralplan.',
         },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-      const state = await readSubagentTrackingState(cwd);
-      assert.equal(state.sessions[childThreadId]?.leader_attested_at, undefined, 'malformed thread_spawn must not attest as leader');
+      });
+      assert.equal(existsSync(join(cwd, '.omx', 'state')), false);
     } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
       await rm(cwd, { recursive: true, force: true });
     }
   });
 
-  it('never bootstraps a leader from a PreToolUse carrying an explicit non-installed agent_role', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-e2e-unknown-role-'));
-    const priorEnv = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
+  it('does not mutate a foreign or stale pointer before denying the documented payload', async () => {
+    const cwd = await mkdtemp(join(tmpdir(), 'omx-3194-'));
     try {
-      delete process.env.OMX_SESSION_ID;
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      const childThreadId = 'codex-native-unknown-role';
-      // An explicit but non-installed agent role is still role provenance and must veto
-      // leader bootstrap even though it does not resolve to an installed OMX agent.
-      await dispatchCodexNativeHook(
-        {
-          hook_event_name: 'PreToolUse',
-          cwd,
-          session_id: childThreadId,
-          thread_id: childThreadId,
-          agent_role: 'collaboration-child',
-          tool_name: 'Bash',
-          tool_use_id: 'tool-unknown-role',
-          tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      const stateDir = join(cwd, '.omx', 'state');
+      const pointerPath = join(stateDir, 'session.json');
+      const pointer = '{"session_id":"synthetic-foreign","native_session_id":"synthetic-foreign","started_at":"1970-01-01T00:00:00.000Z"}\n';
+      await mkdir(stateDir, { recursive: true });
+      await writeFile(pointerPath, pointer);
+      const result = await dispatchCodexNativeHook({
+        hook_event_name: 'PreToolUse', cwd, session_id: 'synthetic-current', tool_name: 'Bash', tool_use_id: 'synthetic-tool-use',
+        tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
+      }, { cwd, sessionOwnerPid: process.pid });
+      assert.deepEqual(result.outputJson, {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse', permissionDecision: 'deny',
+          permissionDecisionReason: 'unsupported_documented_leader_proof: Codex 0.144.5 hooks do not expose documented root identity required for adapted Ralplan.',
         },
-        { cwd, sessionOwnerPid: process.pid },
-      );
-      const state = await readSubagentTrackingState(cwd);
-      assert.equal(state.sessions[childThreadId]?.leader_attested_at, undefined, 'explicit non-installed agent_role must not attest as leader');
+      });
+      assert.equal(await readFile(pointerPath, 'utf8'), pointer);
     } finally {
-      if (priorEnv.OMX_SESSION_ID !== undefined) process.env.OMX_SESSION_ID = priorEnv.OMX_SESSION_ID;
-      if (priorEnv.CODEX_SESSION_ID !== undefined) process.env.CODEX_SESSION_ID = priorEnv.CODEX_SESSION_ID;
-      if (priorEnv.SESSION_ID !== undefined) process.env.SESSION_ID = priorEnv.SESSION_ID;
       await rm(cwd, { recursive: true, force: true });
     }
   });

package/src/scripts/__tests__/role-intent-durable-recovery-3181.test.ts

@@ -1,193 +1,60 @@
 import assert from 'node:assert/strict';
 import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { describe, it } from 'node:test';
 
-import { ralplanCommand } from '../../cli/ralplan.js';
-import { readSubagentTrackingState, subagentTrackingPath } from '../../subagents/tracker.js';
-import { dispatchCodexNativeHook } from '../codex-native-hook.js';
+import {
+  bindPendingRoleIntentUnderLock,
+  readSubagentTrackingState,
+  readSubagentTrackingStateStrict,
+  recordPendingRoleIntent,
+  subagentTrackingPath,
+} from '../../subagents/tracker.js';
 
-// #3181 durable bootstrap-order recovery: a crash/restart AFTER the authenticated adapted
-// Architect role intent is durably recorded but BEFORE the first worker spawn must, on the
-// SAME canonical session, recover the EXACT pending intent/receipt/spawn_task_name before
-// any leader action. This is durable-ordering behavior, not initial-run field presence.
+const ARCHITECT_TOKEN = 'abcdef0123456789abcdef0123456789';
+const CRITIC_TOKEN = '00112233445566778899aabbccddeeff';
 
-interface Receipt {
-  ok: boolean;
-  intent: { role: string; session_id: string; parent_thread_id: string; correlation_token: string };
-  spawn_task_name: string;
+async function withCwd(fn: (cwd: string) => Promise<void>): Promise<void> {
+  const cwd = await mkdtemp(join(tmpdir(), 'omx-3194-'));
+  try { await fn(cwd); } finally { await rm(cwd, { recursive: true, force: true }); }
 }
 
-async function invoke(cwd: string, args: string[]): Promise<{ json: unknown; exitCode: number | undefined }> {
-  const stdout: string[] = [];
-  const stderr: string[] = [];
-  const previous = process.exitCode;
-  try {
-    process.exitCode = undefined;
-    await ralplanCommand(args, { cwd: () => cwd, stdout: (l) => stdout.push(l), stderr: (l) => stderr.push(l) });
-    return { json: JSON.parse(stdout.join('\n')), exitCode: process.exitCode };
-  } finally {
-    process.exitCode = previous;
-  }
-}
-
-function roleIntentArgs(role: string, parentThread: string): string[] {
-  return ['role-intent', 'write', '--role', role, '--parent-thread', parentThread, '--json'];
-}
-
-async function withFreshEnv(fn: () => Promise<void>): Promise<void> {
-  const prior = { OMX_SESSION_ID: process.env.OMX_SESSION_ID, CODEX_SESSION_ID: process.env.CODEX_SESSION_ID, SESSION_ID: process.env.SESSION_ID };
-  delete process.env.OMX_SESSION_ID;
-  delete process.env.CODEX_SESSION_ID;
-  delete process.env.SESSION_ID;
-  try {
-    await fn();
-  } finally {
-    for (const key of ['OMX_SESSION_ID', 'CODEX_SESSION_ID', 'SESSION_ID'] as const) {
-      if (prior[key] === undefined) delete process.env[key];
-      else process.env[key] = prior[key];
-    }
-  }
-}
-
-// Both plugin and legacy delivery drive the same native hook + CLI + tracker recovery path.
-// Leader attestation is established only on the strictly-gated fresh leader PreToolUse
-// entry point (the role-intent command's own PreToolUse fires before it executes); both
-// deliveries route through it, so durable recovery is proven identically for each.
-const DELIVERIES: Array<{ label: string; event: 'SessionStart' | 'PreToolUse' }> = [
-  { label: 'plugin (PreToolUse-seeded)', event: 'PreToolUse' },
-  { label: 'legacy (PreToolUse-seeded)', event: 'PreToolUse' },
-];
-
-async function seedAuthenticatedLeader(cwd: string, sessionId: string, event: 'SessionStart' | 'PreToolUse'): Promise<void> {
-  if (event === 'SessionStart') {
-    await dispatchCodexNativeHook({ hook_event_name: 'SessionStart', cwd, session_id: sessionId }, { cwd, sessionOwnerPid: process.pid });
-  } else {
-    await dispatchCodexNativeHook(
-      {
-        hook_event_name: 'PreToolUse',
-        cwd,
-        session_id: sessionId,
-        thread_id: sessionId,
-        tool_name: 'Bash',
-        tool_use_id: 'tool-first',
-        tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
-      },
-      { cwd, sessionOwnerPid: process.pid },
-    );
-  }
-}
-
-describe('#3181 durable bootstrap-order recovery', () => {
-  for (const { label, event } of DELIVERIES) {
-    it(`${label}: same-session resume recovers the exact adapted Architect intent/receipt/spawn_task_name before any spawn`, async () => {
-      const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-'));
-      await withFreshEnv(async () => {
-        try {
-          const sessionId = `codex-native-${event}`;
-          await seedAuthenticatedLeader(cwd, sessionId, event);
-
-          // Durably record the Architect intent (before any worker spawn).
-          const first = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-          assert.equal(first.ok, true);
-          assert.equal(first.intent.role, 'architect');
-          const token = first.intent.correlation_token;
-          const spawnTaskName = first.spawn_task_name;
-
-          // Crash/restart-before-first-spawn: durable state persists on disk. On the SAME
-          // canonical session, the resumed leader re-runs role-intent and MUST recover the
-          // exact intent/receipt/spawn_task_name — never a fresh unrelated intent.
-          const resumed = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-          assert.equal(resumed.intent.correlation_token, token, 'exact correlation token must be recovered');
-          assert.equal(resumed.spawn_task_name, spawnTaskName, 'exact spawn_task_name must be recovered');
-
-          const state = await readSubagentTrackingState(cwd);
-          assert.equal(state.pending_role_intents.length, 1, 'no unrelated replacement intent may be created');
-          assert.equal(state.pending_role_intents[0]?.role, 'architect');
-
-          // Ordering invariant: while the Architect intent is still live (pre-spawn), a Critic
-          // request for the same leader must NOT reorder/replace it — single_flight_conflict.
-          const critic = (await invoke(cwd, roleIntentArgs('critic', sessionId))).json as { ok: boolean; reason?: string };
-          assert.deepEqual(critic, { ok: false, reason: 'single_flight_conflict' });
-          assert.equal((await readSubagentTrackingState(cwd)).pending_role_intents.length, 1);
-        } finally {
-          await rm(cwd, { recursive: true, force: true });
-        }
+describe('#3194 pending role-intent durability', () => {
+  it('keeps Architect before Critic as distinct single-flight intents and preserves binding integrity', async () => {
+    await withCwd(async (cwd) => {
+      const architect = recordPendingRoleIntent(cwd, {
+        role: 'architect', sessionId: 'synthetic-session', parentThreadId: 'synthetic-parent', correlationToken: ARCHITECT_TOKEN, nowMs: 0,
       });
-    });
-  }
-
-  it('idempotent retry after crash-during-recovery converges to one intent/receipt', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-retry-'));
-    await withFreshEnv(async () => {
-      try {
-        const sessionId = 'codex-native-retry';
-        await seedAuthenticatedLeader(cwd, sessionId, 'PreToolUse');
-        const receipts: string[] = [];
-        for (let i = 0; i < 3; i += 1) {
-          const r = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-          receipts.push(r.intent.correlation_token);
-        }
-        assert.equal(new Set(receipts).size, 1, 'every retry recovers the same receipt');
-        assert.equal((await readSubagentTrackingState(cwd)).pending_role_intents.length, 1);
-      } finally {
-        await rm(cwd, { recursive: true, force: true });
-      }
-    });
-  });
-
-  it('foreign-session resume fails closed and never adopts the foreign leader', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-foreign-'));
-    const prior = process.env.OMX_SESSION_ID;
-    try {
-      delete process.env.CODEX_SESSION_ID;
-      delete process.env.SESSION_ID;
-      // Real leader session A is authenticated and has a durable intent.
-      await withFreshEnv(async () => {
-        await seedAuthenticatedLeader(cwd, 'codex-native-A', 'PreToolUse');
-        const r = (await invoke(cwd, roleIntentArgs('architect', 'codex-native-A'))).json as Receipt;
-        assert.equal(r.ok, true);
+      assert.equal(architect.ok, true);
+      const critic = recordPendingRoleIntent(cwd, {
+        role: 'critic', sessionId: 'synthetic-session', parentThreadId: 'synthetic-parent', correlationToken: CRITIC_TOKEN, nowMs: 0,
       });
-      // A foreign process selects session A by environment while the usable pointer is A's
-      // session.json — but resumes from a DIFFERENT workspace is simulated by pointing the
-      // env at A while attempting to bind a foreign leader thread.
-      process.env.OMX_SESSION_ID = 'codex-native-A';
-      const foreign = (await invoke(cwd, roleIntentArgs('architect', 'attacker-thread'))).json as { ok: boolean; reason?: string };
-      assert.equal(foreign.ok, false);
-      assert.equal(foreign.reason, 'native_anchor_mismatch');
-    } finally {
-      if (prior === undefined) delete process.env.OMX_SESSION_ID;
-      else process.env.OMX_SESSION_ID = prior;
-      await rm(cwd, { recursive: true, force: true });
-    }
+      assert.deepEqual(critic, { ok: false, reason: 'single_flight_conflict' });
+      const binding = bindPendingRoleIntentUnderLock(cwd, {
+        sessionId: 'synthetic-session', parentThreadId: 'synthetic-parent', correlationToken: ARCHITECT_TOKEN, nowMs: 1,
+      }, (state) => state);
+      assert.equal(binding?.role, 'architect');
+      assert.equal(binding?.alreadyBound, false);
+      const retry = bindPendingRoleIntentUnderLock(cwd, {
+        sessionId: 'synthetic-session', parentThreadId: 'synthetic-parent', correlationToken: ARCHITECT_TOKEN, nowMs: 2,
+      }, () => { throw new Error('an existing binding must not invoke the callback'); });
+      assert.equal(retry?.alreadyBound, true);
+      const state = await readSubagentTrackingState(cwd);
+      assert.equal(state.pending_role_intents.length, 1);
+      assert.equal(state.pending_role_intents[0]?.binding_state, 'bound');
+      assert.equal(state.pending_role_intents[0]?.correlation_token, ARCHITECT_TOKEN);
+    });
   });
 
-  it('malformed/corrupt durable tracker on resume fails closed (native_anchor_unavailable) and never overwrites the evidence', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'omx-3181-recover-malformed-'));
-    await withFreshEnv(async () => {
-      try {
-        const sessionId = 'codex-native-malformed';
-        await seedAuthenticatedLeader(cwd, sessionId, 'PreToolUse');
-        (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as Receipt;
-        // Corrupt the durable tracker. Per FR-20 the malformed evidence must not be trusted:
-        // the CLI strict-reads it and fails closed rather than reading it as empty and
-        // overwriting it via the legacy path (which would erase leader/subagent evidence).
-        const corrupt = '{ corrupt tracker not valid json';
-        await mkdir(join(cwd, '.omx', 'state'), { recursive: true });
-        await writeFile(subagentTrackingPath(cwd), corrupt);
-
-        // A spoofed parent AND the real native leader both fail closed on a corrupt tracker.
-        const spoofed = (await invoke(cwd, roleIntentArgs('architect', 'attacker-thread'))).json as { ok: boolean; reason?: string };
-        assert.deepEqual(spoofed, { ok: false, reason: 'native_anchor_unavailable' }, 'spoof on a corrupt tracker fails closed');
-        const nativeLeader = (await invoke(cwd, roleIntentArgs('architect', sessionId))).json as { ok: boolean; reason?: string };
-        assert.deepEqual(nativeLeader, { ok: false, reason: 'native_anchor_unavailable' }, 'even the native leader fails closed on a corrupt tracker');
-
-        // The corrupt tracker is never overwritten (evidence preserved, not silently reset).
-        assert.equal(await readFile(subagentTrackingPath(cwd), 'utf-8'), corrupt, 'corrupt tracker must not be overwritten');
-      } finally {
-        await rm(cwd, { recursive: true, force: true });
-      }
+  it('strictly rejects corrupt durable tracker bytes without mutation', async () => {
+    await withCwd(async (cwd) => {
+      const path = subagentTrackingPath(cwd);
+      const corrupt = '{ synthetic corrupt tracker';
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, corrupt);
+      assert.deepEqual(await readSubagentTrackingStateStrict(cwd), { ok: false });
+      assert.equal(await readFile(path, 'utf8'), corrupt);
     });
   });
 });