oh-my-codex 0.20.2 → 0.20.5

package/src/scripts/__tests__/issue-3293-callsite-parity.test.ts

@@ -0,0 +1,187 @@
+// Characterization baseline for issue #3293 direct-cancel callsite parity.
+// Issue #3358 extends hook-owned exact-session cancellation to Ultragoal only.
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { describe, it } from "node:test";
+import { dispatchCodexNativeHook } from "../codex-native-hook.js";
+
+async function writeJson(path: string, value: unknown): Promise<void> {
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, JSON.stringify(value, null, 2));
+}
+
+type Mode = "deep-interview" | "ralplan" | "conductor";
+
+async function fixture(mode: Mode, suffix: string) {
+	const cwd = await mkdtemp(join(tmpdir(), `omx-3293-parity-${suffix}-`));
+	const stateDir = join(cwd, ".omx", "state");
+	const sessionId = `session-${suffix}`;
+	const threadId = `thread-${suffix}`;
+	const sessionDir = join(stateDir, "sessions", sessionId);
+	const skill = mode === "conductor" ? "ultragoal" : mode === "deep-interview" ? "autopilot" : "ralplan";
+	const phase = mode === "deep-interview" ? "deep-interview" : "planning";
+	await writeJson(join(stateDir, "session.json"), { session_id: sessionId, cwd, leader_thread_id: threadId });
+	await writeJson(join(stateDir, "subagent-tracking.json"), {
+		schemaVersion: 1,
+		sessions: { [sessionId]: { session_id: sessionId, leader_thread_id: threadId, threads: { [threadId]: { thread_id: threadId, kind: "leader" } } } },
+	});
+	await writeJson(join(sessionDir, "skill-active-state.json"), {
+		active: true, skill, phase, session_id: sessionId, thread_id: threadId,
+		active_skills: [{ active: true, skill, phase, session_id: sessionId, thread_id: threadId }],
+	});
+	if (mode === "deep-interview") {
+		await writeJson(join(sessionDir, "autopilot-state.json"), { active: true, mode: "autopilot", current_phase: phase, session_id: sessionId, thread_id: threadId, workingDirectory: cwd });
+	} else if (mode === "ralplan") {
+		await writeJson(join(sessionDir, "ralplan-state.json"), { active: true, mode: "ralplan", current_phase: phase, session_id: sessionId, thread_id: threadId, workingDirectory: cwd });
+	} else {
+		await writeJson(join(sessionDir, "ultragoal-state.json"), { active: true, mode: "ultragoal", current_phase: phase, session_id: sessionId, thread_id: threadId, workingDirectory: cwd });
+	}
+	return { cwd, stateDir, sessionId, threadId };
+}
+
+async function preToolUse(f: Awaited<ReturnType<typeof fixture>>, command: string, toolInput: Record<string, unknown> = { command }) {
+	return dispatchCodexNativeHook({
+		hook_event_name: "PreToolUse", cwd: f.cwd, session_id: f.sessionId, thread_id: f.threadId,
+		agent_id: f.threadId, tool_name: "Bash", tool_use_id: `tool-${Math.random()}`, tool_input: toolInput,
+	}, { cwd: f.cwd });
+}
+
+function assertBlocked(result: Awaited<ReturnType<typeof dispatchCodexNativeHook>>, pattern?: RegExp): void {
+	assert.equal(result.omxEventName, "pre-tool-use");
+	assert.equal(result.outputJson?.decision, "block");
+	if (pattern) assert.match(JSON.stringify(result.outputJson), pattern);
+}
+
+async function withTrustedOmx<T>(cwd: string, action: () => Promise<T>): Promise<T> {
+	const binDir = join(cwd, "trusted-bin");
+	const priorPath = process.env.PATH;
+	const unsafeRuntimeEnvNames = [
+		"NODE_OPTIONS",
+		"OPENSSL_CONF",
+		"NODE_V8_COVERAGE",
+		"NODE_COMPILE_CACHE",
+		"NODE_REDIRECT_WARNINGS",
+		"NODE_REPORT_DIRECTORY",
+		"NODE_REPORT_FILENAME",
+	] as const;
+	const priorRuntimeEnv = Object.fromEntries(unsafeRuntimeEnvNames.map((name) => [name, process.env[name]]));
+	await mkdir(binDir, { recursive: true });
+	await symlink(resolve(process.cwd(), "dist", "cli", "omx.js"), join(binDir, "omx"));
+	process.env.PATH = `${binDir}:${dirname(process.execPath)}`;
+	for (const name of unsafeRuntimeEnvNames) delete process.env[name];
+	try { return await action(); }
+	finally {
+		if (priorPath === undefined) delete process.env.PATH;
+		else process.env.PATH = priorPath;
+		for (const name of unsafeRuntimeEnvNames) {
+			if (priorRuntimeEnv[name] === undefined) delete process.env[name];
+			else process.env[name] = priorRuntimeEnv[name];
+		}
+	}
+}
+
+
+describe("issue #3293 callsite parity baseline", () => {
+	it("deep-interview ~9541: payload-absent implementation-write path remains fail-closed by provenance", async () => {
+		const f = await fixture("deep-interview", "payload-absent");
+		try {
+			// blocksDeepInterviewImplementationWrite is private; this public root-conflict
+			// boundary reaches its payload-absent invocation with a cancel-shaped Bash command.
+			const result = await dispatchCodexNativeHook({
+				hook_event_name: "PreToolUse", cwd: f.cwd, session_id: "foreign-native", tool_name: "Bash",
+				tool_input: { command: "omx cancel" },
+			}, { cwd: f.cwd });
+			assertBlocked(result, /payload session identity is foreign or cannot be mapped to the active session/);
+
+		} finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	it("deep-interview ~9498: non-cancel read-only OMX command is allowed", async () => {
+		const f = await fixture("deep-interview", "readonly");
+		try { await withTrustedOmx(f.cwd, async () => assert.equal((await preToolUse(f, "omx state read --json")).outputJson, null)); }
+		finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	it("deep-interview ~9498: permitted planning artifact write is allowed", async () => {
+		const f = await fixture("deep-interview", "artifact");
+		try { assert.equal((await preToolUse(f, "printf spec > .omx/specs/issue.md")).outputJson, null); }
+		finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	it("deep-interview ~9498: forbidden implementation write is blocked", async () => {
+		const f = await fixture("deep-interview", "implementation");
+		try { assertBlocked(await preToolUse(f, "printf code > src/product.ts"), /src\/product\.ts/); }
+		finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	it("deep-interview ~8863: bare omx cancel is handled by the hook", async () => {
+		const f = await fixture("deep-interview", "deep-bare");
+		try { await withTrustedOmx(f.cwd, async () => assertBlocked(await preToolUse(f, "omx cancel"), /cancelled_exact_session/)); }
+		finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	it("deep-interview ~8863: omx cancel --force remains blocked by bare-only grammar", async () => {
+		const f = await fixture("deep-interview", "deep-force");
+		try { assertBlocked(await preToolUse(f, "omx cancel --force"), /invalid_command/); }
+		finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	for (const mode of ["deep-interview", "ralplan", "conductor"] as const) {
+		it(`${mode} direct-cancel callsite: raw/analyzed command mismatch remains blocked`, async () => {
+			const f = await fixture(mode, `${mode}-raw-mismatch`);
+			try { assertBlocked(await preToolUse(f, " omx cancel ")); }
+			finally { await rm(f.cwd, { recursive: true, force: true }); }
+		});
+	}
+
+	for (const command of ["omx cancel", "omx cancel --force"]) {
+		it(`ralplan ~9114: ${command} falls through to the pre-#3293 executable-trust path`, async () => {
+			const f = await fixture("ralplan", `ralplan-${command.endsWith("force") ? "force" : "bare"}`);
+			try { await withTrustedOmx(f.cwd, async () => assert.equal((await preToolUse(f, command)).outputJson, null)); }
+			finally { await rm(f.cwd, { recursive: true, force: true }); }
+		});
+		it(`conductor ~18227: ${command} is hook-owned for the exact Ultragoal session`, async () => {
+			const f = await fixture("conductor", `conductor-${command.endsWith("force") ? "force" : "bare"}`);
+			try { assertBlocked(await preToolUse(f, command), /cancelled_exact_session/); }
+			finally { await rm(f.cwd, { recursive: true, force: true }); }
+		});
+	}
+
+
+	it("deep-interview ~9616: foreign payload remains fail-closed by provenance", async () => {
+		const f = await fixture("deep-interview", "deep-root-conflict");
+		try {
+			await writeJson(join(f.stateDir, "session.json"), { session_id: f.sessionId, cwd: f.cwd });
+			const result = await dispatchCodexNativeHook({ hook_event_name: "PreToolUse", cwd: f.cwd, session_id: "foreign-native", tool_name: "Edit", tool_input: { file_path: "src/product.ts" } }, { cwd: f.cwd });
+			assertBlocked(result, /payload session identity is foreign or cannot be mapped to the active session/);
+		} finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	it("ralplan ~9645: foreign payload remains fail-closed by provenance", async () => {
+		const f = await fixture("ralplan", "ralplan-root-conflict");
+		try {
+			const result = await dispatchCodexNativeHook({ hook_event_name: "PreToolUse", cwd: f.cwd, session_id: "foreign-native", tool_name: "Edit", tool_input: { file_path: "src/product.ts" } }, { cwd: f.cwd });
+			assertBlocked(result, /payload session identity is foreign or cannot be mapped to the active session/);
+		} finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+
+	for (const command of [
+		"FOO=bar omx cancel", "PATH=/tmp omx cancel", "omx cancel; ls", "omx cancel | cat",
+		"omx cancel > /tmp/x", "omx cancel $(id)", "omx cancel `id`", "/tmp/omx cancel",
+		"omx cancel extra", "omx cancel --unknown", "omx cancel;",
+	]) {
+		it(`deep-interview ~8863: invalid direct-cancel grammar ${JSON.stringify(command)} is blocked`, async () => {
+			const f = await fixture("deep-interview", `grammar-${command.length}`);
+			try { assertBlocked(await preToolUse(f, command)); }
+			finally { await rm(f.cwd, { recursive: true, force: true }); }
+		});
+	}
+
+	it("Conductor ~18419: exact cancellation remains reachable when executable trust is absent", async () => {
+		const f = await fixture("conductor", "conductor-detail");
+		try { assertBlocked(await preToolUse(f, "omx cancel"), /cancelled_exact_session/); }
+		finally { await rm(f.cwd, { recursive: true, force: true }); }
+	});
+});

package/src/scripts/__tests__/issue-3293-cancel-transaction.test.ts

@@ -0,0 +1,189 @@
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { mkdtemp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import {
+  readHookCancelTransactionRecoveryState,
+  terminalizeExactAutopilotSessionForHookCancel,
+} from "../codex-native-hook.js";
+
+const NOW = "2026-07-25T00:00:00.000Z";
+
+type Fixture = {
+  cwd: string;
+  stateDir: string;
+  sessionId: string;
+  sessionDir: string;
+  autopilotPath: string;
+  skillPath: string;
+};
+
+async function writeJson(path: string, value: unknown): Promise<void> {
+  await mkdir(join(path, ".."), { recursive: true });
+  await writeFile(path, JSON.stringify(value, null, 2));
+}
+
+async function fixture(): Promise<Fixture> {
+  const cwd = await mkdtemp(join(tmpdir(), "omx-3293-cancel-"));
+  const stateDir = join(cwd, ".omx", "state");
+  const sessionId = "session-3293";
+  const sessionDir = join(stateDir, "sessions", sessionId);
+  const autopilotPath = join(sessionDir, "autopilot-state.json");
+  const skillPath = join(sessionDir, "skill-active-state.json");
+  await writeJson(autopilotPath, {
+    active: true, mode: "autopilot", current_phase: "deep-interview", session_id: sessionId, cwd,
+    handoff_artifacts: { interview: "preserve" }, unrelated: { preserved: true },
+  });
+  await writeJson(skillPath, {
+    version: 1, active: true, skill: "autopilot", phase: "deep-interview", session_id: sessionId, cwd,
+    active_skills: [
+      { skill: "autopilot", active: true, phase: "deep-interview", session_id: sessionId, cwd, marker: "cancel" },
+      { skill: "ralph", active: true, phase: "execution", session_id: sessionId, cwd, marker: "keep" },
+    ],
+  });
+  return { cwd, stateDir, sessionId, sessionDir, autopilotPath, skillPath };
+}
+
+async function terminalize(f: Fixture) {
+  return terminalizeExactAutopilotSessionForHookCancel({ stateDir: f.stateDir, canonicalSessionId: f.sessionId, cwd: f.cwd, nowIso: NOW });
+}
+
+async function withFixture(run: (f: Fixture) => Promise<void>): Promise<void> {
+  const f = await fixture();
+  try { await run(f); } finally { await rm(f.cwd, { recursive: true, force: true }); }
+}
+
+test("terminalizes the exact active deep-interview session while preserving handoff and unrelated skill entries", async () => {
+  await withFixture(async (f) => {
+    assert.deepEqual(await terminalize(f), { ok: true });
+    const autopilot = JSON.parse(await readFile(f.autopilotPath, "utf8"));
+    const skill = JSON.parse(await readFile(f.skillPath, "utf8"));
+    assert.deepEqual(autopilot.handoff_artifacts, { interview: "preserve" });
+    assert.deepEqual(autopilot.unrelated, { preserved: true });
+    assert.equal(autopilot.active, false); assert.equal(autopilot.current_phase, "cancelled");
+    assert.equal(autopilot.completed_at, NOW); assert.equal(autopilot.last_turn_at, NOW);
+    assert.equal(skill.active, true); assert.equal(skill.skill, "ralph"); assert.equal(skill.phase, "execution");
+    assert.deepEqual(skill.active_skills[0], { skill: "autopilot", active: false, phase: "cancelled", session_id: f.sessionId, cwd: f.cwd, marker: "cancel", updated_at: NOW });
+    assert.deepEqual(skill.active_skills[1], { skill: "ralph", active: true, phase: "execution", session_id: f.sessionId, cwd: f.cwd, marker: "keep" });
+    assert.equal(existsSync(join(f.sessionDir, ".hook-cancel-transaction.json")), false);
+    assert.equal(existsSync(join(f.sessionDir, ".hook-cancel.lock")), false);
+  });
+});
+
+test("preserves a second session byte-for-byte", async () => {
+  await withFixture(async (f) => {
+    const other = join(f.stateDir, "sessions", "other-session", "autopilot-state.json");
+    await writeJson(other, { active: true, mode: "autopilot", current_phase: "deep-interview", sentinel: "other" });
+    const before = await readFile(other);
+    assert.equal((await terminalize(f)).ok, true);
+    assert.deepEqual(await readFile(other), before);
+  });
+});
+
+test("denies a pre-existing exact-session lock without mutation", async () => {
+  await withFixture(async (f) => {
+    const before = await readFile(f.autopilotPath); await writeFile(join(f.sessionDir, ".hook-cancel.lock"), "held");
+    assert.deepEqual(await terminalize(f), { ok: false, reason: "lock_held" });
+    assert.deepEqual(await readFile(f.autopilotPath), before);
+  });
+});
+
+test("denies a pre-existing prepared journal with a value-free recovery reason", async () => {
+  await withFixture(async (f) => {
+    await writeFile(join(f.sessionDir, ".hook-cancel-transaction.json"), JSON.stringify({ version: 1, phase: "prepared" }));
+    assert.deepEqual(await terminalize(f), { ok: false, reason: "recovery_required" });
+    assert.equal(await readHookCancelTransactionRecoveryState({ stateDir: f.stateDir, canonicalSessionId: f.sessionId }), "recovery_required");
+  });
+});
+
+for (const sessionId of [".", "..", "../escape"]) {
+  test(`denies unsafe session id ${JSON.stringify(sessionId)} without mutation`, async () => {
+    await withFixture(async (f) => {
+      const before = [await readFile(f.autopilotPath), await readFile(f.skillPath)];
+      assert.deepEqual(await terminalizeExactAutopilotSessionForHookCancel({ stateDir: f.stateDir, canonicalSessionId: sessionId, cwd: f.cwd, nowIso: NOW }), { ok: false, reason: "invalid_target" });
+      assert.equal(await readHookCancelTransactionRecoveryState({ stateDir: f.stateDir, canonicalSessionId: sessionId }), "invalid_target");
+      assert.deepEqual([await readFile(f.autopilotPath), await readFile(f.skillPath)], before);
+    });
+  });
+}
+
+test("denies a symlinked session directory component", async () => {
+  await withFixture(async (f) => {
+    const linked = join(f.stateDir, "sessions", "linked-session"); await symlink(f.sessionDir, linked);
+    assert.deepEqual(await terminalizeExactAutopilotSessionForHookCancel({ stateDir: f.stateDir, canonicalSessionId: "linked-session", cwd: f.cwd, nowIso: NOW }), { ok: false, reason: "invalid_target" });
+  });
+});
+
+test("denies a symlinked or non-regular target file", async () => {
+  await withFixture(async (f) => {
+    await rm(f.autopilotPath); await symlink(f.skillPath, f.autopilotPath);
+    assert.equal((await terminalize(f)).ok, false);
+  });
+  await withFixture(async (f) => {
+    await rm(f.autopilotPath); await mkdir(f.autopilotPath);
+    assert.equal((await terminalize(f)).ok, false);
+  });
+});
+
+test("denies state changed during preflight without mutation", async () => {
+  await withFixture(async (f) => {
+    const before = await readFile(f.autopilotPath);
+    const prior = process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER;
+    process.env.NODE_ENV = "test";
+    process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER = "preflight-instability";
+    try {
+      assert.deepEqual(await terminalize(f), { ok: false, reason: "preflight_failed" });
+    } finally {
+      if (prior === undefined) delete process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER;
+      else process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER = prior;
+    }
+    assert.deepEqual(await readFile(f.autopilotPath), before);
+  });
+});
+
+test("denies malformed or oversized JSON without mutation", async () => {
+  await withFixture(async (f) => { await writeFile(f.autopilotPath, "{"); const before = await readFile(f.autopilotPath); assert.equal((await terminalize(f)).ok, false); assert.deepEqual(await readFile(f.autopilotPath), before); });
+  await withFixture(async (f) => { const bytes = Buffer.alloc(1024 * 1024 + 1, 0x20); await writeFile(f.autopilotPath, bytes); assert.equal((await terminalize(f)).ok, false); assert.deepEqual(await readFile(f.autopilotPath), bytes); });
+});
+
+test("denies contradictory owner session or cwd fields without mutation", async () => {
+  await withFixture(async (f) => { await writeJson(f.skillPath, { active: true, skill: "autopilot", phase: "deep-interview", session_id: "other", cwd: f.cwd }); assert.deepEqual(await terminalize(f), { ok: false, reason: "state_mismatch" }); });
+  await withFixture(async (f) => { await writeJson(f.autopilotPath, { active: true, mode: "autopilot", current_phase: "deep-interview", session_id: f.sessionId, cwd: join(f.cwd, "other") }); assert.deepEqual(await terminalize(f), { ok: false, reason: "state_mismatch" }); });
+});
+
+test("denies a missing paired skill-active state without mutation", async () => {
+  await withFixture(async (f) => { const before = await readFile(f.autopilotPath); await rm(f.skillPath); assert.deepEqual(await terminalize(f), { ok: false, reason: "preflight_failed" }); assert.deepEqual(await readFile(f.autopilotPath), before); });
+});
+
+test("cleans a lock whose initialization fails before the transaction starts", async () => {
+  await withFixture(async (f) => {
+    const original = [await readFile(f.autopilotPath), await readFile(f.skillPath)];
+    const prior = process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER;
+    process.env.NODE_ENV = "test";
+    process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER = "lock-acquire";
+    try {
+      assert.deepEqual(await terminalize(f), { ok: false, reason: "lock_held" });
+    } finally {
+      if (prior === undefined) delete process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER;
+      else process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER = prior;
+    }
+    assert.equal(existsSync(join(f.sessionDir, ".hook-cancel.lock")), false);
+    assert.deepEqual([await readFile(f.autopilotPath), await readFile(f.skillPath)], original);
+  });
+});
+
+for (const boundary of ["journal-fsync", "partial-first-data-write", "first-data-write", "partial-second-data-write", "second-data-write", "verification", "journal-commit", "unlink", "lock-release"]) {
+  test(`fault injection after ${boundary} never leaves a torn two-file state`, async () => {
+    await withFixture(async (f) => {
+      const original = [await readFile(f.autopilotPath), await readFile(f.skillPath)];
+      const prior = process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER;
+      process.env.NODE_ENV = "test"; process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER = boundary;
+      try { await terminalize(f); } finally { if (prior === undefined) delete process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER; else process.env.OMX_NATIVE_HOOK_TEST_CANCEL_TRANSACTION_FAIL_AFTER = prior; }
+      const now = [await readFile(f.autopilotPath), await readFile(f.skillPath)];
+      const journal = existsSync(join(f.sessionDir, ".hook-cancel-transaction.json"));
+      assert.ok((now[0].equals(original[0]) && now[1].equals(original[1])) || (!now[0].equals(original[0]) && !now[1].equals(original[1])) || journal, boundary);
+    });
+  });
+}

package/src/scripts/__tests__/issue-3293-hook-owned-cancel.test.ts

@@ -0,0 +1,187 @@
+import assert from "node:assert/strict";
+import { chmod, mkdtemp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { describe, it } from "node:test";
+import { dispatchCodexNativeHook } from "../codex-native-hook.js";
+
+async function json(path: string, value: unknown): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(value, null, 2));
+}
+
+async function fixture(sessionId = "session-hook-cancel") {
+  const cwd = await mkdtemp(join(tmpdir(), "omx-3293-hook-cancel-"));
+  const stateDir = join(cwd, ".omx", "state");
+  const threadId = `thread-${sessionId}`;
+  const sessionDir = join(stateDir, "sessions", sessionId);
+  await json(join(stateDir, "session.json"), { session_id: sessionId, cwd, leader_thread_id: threadId });
+  await json(join(stateDir, "subagent-tracking.json"), { schemaVersion: 1, sessions: { [sessionId]: { session_id: sessionId, leader_thread_id: threadId, threads: { [threadId]: { thread_id: threadId, kind: "leader" } } } } });
+  await json(join(sessionDir, "autopilot-state.json"), { active: true, mode: "autopilot", current_phase: "deep-interview", session_id: sessionId, thread_id: threadId, workingDirectory: cwd });
+  await json(join(sessionDir, "skill-active-state.json"), { active: true, skill: "autopilot", phase: "deep-interview", session_id: sessionId, thread_id: threadId, active_skills: [{ active: true, skill: "autopilot", phase: "deep-interview", session_id: sessionId, thread_id: threadId }] });
+  return { cwd, stateDir, sessionDir, sessionId, threadId };
+}
+
+type Fixture = Awaited<ReturnType<typeof fixture>>;
+
+function preTool(f: Fixture, command: string, overrides: Record<string, unknown> = {}) {
+  return dispatchCodexNativeHook({ hook_event_name: "PreToolUse", cwd: f.cwd, session_id: f.sessionId, thread_id: f.threadId, agent_id: f.threadId, tool_name: "Bash", tool_input: { command }, ...overrides }, { cwd: f.cwd });
+}
+
+function stop(f: Fixture) {
+  return dispatchCodexNativeHook({ hook_event_name: "Stop", cwd: f.cwd, session_id: f.sessionId, thread_id: f.threadId }, { cwd: f.cwd });
+}
+
+function assertValueFreeDenial(result: Awaited<ReturnType<typeof preTool>>, f: Fixture, stateContent: string, label: string): void {
+  assert.equal(result.outputJson?.decision, "block", label);
+  const rendered = JSON.stringify(result.outputJson);
+  for (const secret of [f.cwd, f.sessionId, stateContent]) assert.equal(rendered.includes(secret), false, `${label}: diagnostic leaked a value`);
+}
+
+async function withEnv<T>(values: Record<string, string | undefined>, run: () => Promise<T>): Promise<T> {
+  const before = new Map(Object.keys(values).map((name) => [name, process.env[name]]));
+  try {
+    for (const [name, value] of Object.entries(values)) {
+      if (value === undefined) delete process.env[name]; else process.env[name] = value;
+    }
+    return await run();
+  } finally {
+    for (const [name, value] of before) {
+      if (value === undefined) delete process.env[name]; else process.env[name] = value;
+    }
+  }
+}
+
+async function denialFixture(command: string, mutate?: (f: Fixture) => Promise<void>, payload?: Record<string, unknown>) {
+  const f = await fixture();
+  try {
+    if (mutate) await mutate(f);
+    const stateContent = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+    const result = await preTool(f, command, payload);
+    assertValueFreeDenial(result, f, stateContent, command);
+  } finally { await rm(f.cwd, { recursive: true, force: true }); }
+}
+
+describe("issue #3293 hook-owned cancellation", () => {
+  it("handles bare deep-interview cancellation, terminalizes both files, and does not execute Bash", async () => {
+    const f = await fixture();
+    try {
+      const sentinel = join(f.cwd, "plugin-sentinel");
+      await mkdir(join(f.cwd, ".omx", "hooks"), { recursive: true });
+      await writeFile(join(f.cwd, ".omx", "hooks", "sentinel.mjs"), `import { writeFile } from 'node:fs/promises'; await writeFile(${JSON.stringify(sentinel)}, 'ran');`);
+      const result = await preTool(f, "omx cancel");
+      assert.equal(result.outputJson?.decision, "block");
+      assert.match(JSON.stringify(result.outputJson), /cancelled_exact_session/);
+      assert.equal(JSON.parse(await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8")).active, false);
+      assert.equal(JSON.parse(await readFile(join(f.sessionDir, "skill-active-state.json"), "utf8")).active, false);
+      await assert.rejects(readFile(sentinel));
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("stops repeatedly without continuation, reactivation, or terminal-byte changes", async () => {
+    const f = await fixture();
+    try {
+      await preTool(f, "omx cancel");
+      const paths = [join(f.sessionDir, "autopilot-state.json"), join(f.sessionDir, "skill-active-state.json")];
+      const terminal = await Promise.all(paths.map((path) => readFile(path)));
+      assert.equal((await stop(f)).outputJson, null);
+      assert.equal((await stop(f)).outputJson, null);
+      assert.deepEqual(await Promise.all(paths.map((path) => readFile(path))), terminal);
+      assert.equal(JSON.parse(terminal[0].toString()).active, false);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("terminalizes only the exact session", async () => {
+    const f = await fixture();
+    try {
+      const otherId = "session-other";
+      const otherDir = join(f.stateDir, "sessions", otherId);
+      const otherAutopilot = { active: true, mode: "autopilot", current_phase: "deep-interview", session_id: otherId, thread_id: "thread-other", workingDirectory: f.cwd };
+      const otherSkill = { active: true, skill: "autopilot", phase: "deep-interview", session_id: otherId, thread_id: "thread-other" };
+      await json(join(otherDir, "autopilot-state.json"), otherAutopilot);
+      await json(join(otherDir, "skill-active-state.json"), otherSkill);
+      const before = await Promise.all([readFile(join(otherDir, "autopilot-state.json")), readFile(join(otherDir, "skill-active-state.json"))]);
+      await preTool(f, "omx cancel");
+      assert.deepEqual(await Promise.all([readFile(join(otherDir, "autopilot-state.json")), readFile(join(otherDir, "skill-active-state.json"))]), before);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("fails closed for cancellation and Stop when a prepared journal exists", async () => {
+    const f = await fixture();
+    try {
+      await json(join(f.sessionDir, ".hook-cancel-transaction.json"), { phase: "prepared", session_id: f.sessionId });
+      const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+      assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "prepared cancellation");
+      const stopped = await stop(f);
+      assert.equal(stopped.outputJson?.decision, "block");
+      const rendered = JSON.stringify(stopped.outputJson);
+      for (const secret of [f.cwd, f.sessionId, content]) assert.equal(rendered.includes(secret), false);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("denies a fully forged public-hook caller because no executable trust can be forged", async () => {
+    const f = await fixture();
+    try {
+      const attacker = join(f.cwd, "attacker-bin");
+      await mkdir(attacker); await writeFile(join(attacker, "omx"), "#!/bin/sh\nexit 0\n"); await chmod(join(attacker, "omx"), 0o755);
+      await withEnv({ PATH: attacker }, async () => {
+        const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+        const result = await preTool(f, "omx cancel", { thread_id: "unbound-attacker", agent_id: "unbound-attacker" });
+        assertValueFreeDenial(result, f, content, "fully forged public hook");
+      });
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("denies hostile modified shim contents", async () => {
+    const f = await fixture();
+    try {
+      const bin = join(f.cwd, "modified-bin");
+      await mkdir(bin); await writeFile(join(bin, "omx"), "#!/bin/sh\necho attacker\n"); await chmod(join(bin, "omx"), 0o755);
+      const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+      await withEnv({ PATH: bin }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "modified shim"));
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("denies hostile shim symlink replacement", async () => {
+    const f = await fixture();
+    try {
+      const bin = join(f.cwd, "symlink-bin"); const target = join(f.cwd, "attacker-omx");
+      await mkdir(bin); await writeFile(target, "#!/bin/sh\necho attacker\n"); await chmod(target, 0o755); await symlink(target, join(bin, "omx"));
+      const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+      await withEnv({ PATH: bin }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "symlink shim"));
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  const commandCases = [
+    ["wrapper with extra commands", "env omx cancel"], ["wrapper with extra args", "omx cancel --force"],
+    ["unsafe leading assignment", "FOO=bar omx cancel"], ["semicolon operator", "omx cancel; true"], ["and operator", "omx cancel && true"], ["or operator", "omx cancel || true"], ["pipeline operator", "omx cancel | cat"], ["background operator", "omx cancel &"],
+    ["command substitution", "$(printf omx) cancel"], ["backtick substitution", "`printf omx` cancel"], ["input redirection", "omx cancel < /dev/null"], ["output redirection", "omx cancel > /dev/null"], ["path-qualified untrusted executable", "/tmp/omx cancel"],
+  ] as const;
+  for (const [name, command] of commandCases) it(`denies hostile ${name}`, async () => denialFixture(command));
+
+  const envCases = ["BASH_ENV", "BASH_FUNC_omx%%", "NODE_OPTIONS", "NODE_V8_COVERAGE", "NODE_COMPILE_CACHE", "NODE_REDIRECT_WARNINGS", "NODE_REPORT_DIRECTORY", "NODE_REPORT_FILENAME", "OPENSSL_CONF"] as const;
+  for (const name of envCases) it(`denies hostile inherited ${name}`, async () => {
+    const f = await fixture();
+    try {
+      const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+      await withEnv({ [name]: name === "BASH_FUNC_omx%%" ? "() { :; }" : join(f.cwd, "injected") }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, name));
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("denies hostile loader injection", async () => denialFixture("node --loader attacker.mjs omx cancel"));
+  it("denies hostile PATH-shadowed omx", async () => {
+    const f = await fixture(); try { const bin = join(f.cwd, "shadow"); await mkdir(bin); await writeFile(join(bin, "omx"), "#!/bin/sh\nexit 0\n"); await chmod(join(bin, "omx"), 0o755); const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8"); await withEnv({ PATH: bin }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "PATH shadow")); } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+  it("denies hostile repo-local lookalike executable", async () => denialFixture("./omx cancel", async (f) => { await writeFile(join(f.cwd, "omx"), "#!/bin/sh\nexit 0\n"); await chmod(join(f.cwd, "omx"), 0o755); }));
+  it("denies hostile cross-session selector", async () => denialFixture("omx cancel", undefined, { session_id: "other-session", sessionId: "other-session" }));
+  it("denies hostile cross-root selector", async () => denialFixture("OMX_ROOT=/tmp/other omx cancel"));
+  it("denies hostile unset PATH", async () => { const f = await fixture(); try { const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8"); await withEnv({ PATH: undefined }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "unset PATH")); } finally { await rm(f.cwd, { recursive: true, force: true }); } });
+  it("denies hostile unreadable PATH entry", async () => { const f = await fixture(); try { const path = join(f.cwd, "unreadable"); await mkdir(path); await chmod(path, 0o000); const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8"); await withEnv({ PATH: path }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "unreadable PATH")); await chmod(path, 0o755); } finally { await rm(f.cwd, { recursive: true, force: true }); } });
+  it("denies hostile non-directory PATH entry", async () => { const f = await fixture(); try { const path = join(f.cwd, "not-directory"); await writeFile(path, "x"); const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8"); await withEnv({ PATH: path }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "file PATH")); } finally { await rm(f.cwd, { recursive: true, force: true }); } });
+  it("denies hostile non-executable shim", async () => { const f = await fixture(); try { const bin = join(f.cwd, "bin"); await mkdir(bin); await writeFile(join(bin, "omx"), "#!/bin/sh\nexit 0\n"); const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8"); await withEnv({ PATH: bin }, async () => assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "non-executable shim")); } finally { await rm(f.cwd, { recursive: true, force: true }); } });
+
+  it("R-4 documents payload-bound identity and ambient same-euid target-root selection", async () => {
+    const source = await readFile(resolve(process.cwd(), "src/scripts/codex-native-hook.ts"), "utf8");
+    assert.match(source, /identity matching is payload-bound while target-root\s+\/\/ selection remains ambient and same-euid trusted/);
+  });
+});