oh-my-codex 0.20.2 → 0.20.5

package/dist/config/generator.js

@@ -16,7 +16,7 @@ import TOML from "@iarna/toml";
 import { DEFAULT_FRONTIER_MODEL } from "./models.js";
 import { DEFAULT_CODEX_HOOK_FEATURE_FLAG, CODEX_HOOK_FEATURE_FLAGS, CODEX_PLUGIN_SCOPED_HOOKS_FEATURE_FLAG, formatCodexHookFeatureFlagLine, normalizeCodexHookFeatureFlag, } from "./codex-feature-flags.js";
 import { OMX_FIRST_PARTY_MCP_SERVER_NAMES, getOmxFirstPartySetupMcpServers, } from "./omx-first-party-mcp.js";
-import { buildManagedCodexHookTrustState, escapeTomlBasicString, ManagedCodexHooksPlanError, scanManagedCodexHookTrustStateFromContent, } from "./codex-hooks.js";
+import { buildManagedCodexHookTrustState, escapeTomlBasicString, ManagedCodexHooksPlanError, } from "./codex-hooks.js";
 function escapeTomlString(value) {
     return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
@@ -37,8 +37,8 @@ const LEGACY_SEEDED_MODEL_CONTEXT_WINDOW = 250000;
 const LEGACY_SEEDED_MODEL_AUTO_COMPACT_TOKEN_LIMIT = 200000;
 const OMX_SEEDED_BEHAVIORAL_DEFAULTS_START_MARKER = "# oh-my-codex seeded behavioral defaults (uninstall removes unchanged defaults)";
 const OMX_SEEDED_BEHAVIORAL_DEFAULTS_END_MARKER = "# End oh-my-codex seeded behavioral defaults";
-export const OMX_DEVELOPER_INSTRUCTIONS = "You have oh-my-codex installed. AGENTS.md is the orchestration brain and main control surface. Follow AGENTS.md for skill/keyword routing, $name workflow invocation, and role-specialized subagents; when the native surface exposes `agent_type` role routing, set `agent_type` to an installed role and never omit it for OMX work. When it does not (`role_routing_unavailable`, for example a Codex App `spawn_agent` surface exposing only `task_name`, `message`, and `fork_turns`), do not fabricate `agent_type`; follow the OMX adapted role-pass protocol by recording a pre-validated role intent in the OMX subagent ledger, and never fake the role via a prompt label. Use outcome-first, concise progress updates: state the target result, constraints, validation evidence, and stop condition before adding process detail. Native subagents live in .codex/agents and may handle independent parallel subtasks within one Codex session or team pane. Skills load from .codex/skills, not native-agent TOMLs. Treat installed prompts as narrower execution surfaces under AGENTS.md authority.";
-export const OMX_PLUGIN_DEVELOPER_INSTRUCTIONS = '<omx version="1">You have oh-my-codex installed through Codex plugin mode. AGENTS.md is the orchestration brain and main control surface. Follow AGENTS.md for skill/keyword routing and $name workflow invocation. When the native surface exposes `agent_type` role routing, set `agent_type` to an installed role and never omit it for OMX work. When it does not (`role_routing_unavailable`, for example a Codex App `spawn_agent` surface exposing only `task_name`, `message`, and `fork_turns`), do not fabricate `agent_type`; follow the OMX adapted role-pass protocol by recording a pre-validated role intent in the OMX subagent ledger, and never fake the role via a prompt label. Registered Codex plugin marketplace surfaces supply OMX workflows and plugin-scoped companion resources when the plugin is installed; native agent roles are installed as setup-owned Codex agent TOML files in plugin mode so agent_type routing works. User-installed skills may still live under ~/.codex/skills. Use outcome-first, concise progress updates: state the target result, constraints, validation evidence, and stop condition before adding process detail.</omx>';
+export const OMX_DEVELOPER_INSTRUCTIONS = "You have oh-my-codex installed. AGENTS.md is the orchestration brain and main control surface. Follow AGENTS.md for skill/keyword routing, $name workflow invocation, and role-specialized subagents; when the native surface exposes `agent_type` role routing, set `agent_type` to an installed role and never omit it for OMX work. When it reports `role_routing_unavailable` and adapted Ralplan authority is requested, do not fabricate `agent_type`; run `omx ralplan preflight --json` and stop on `unsupported_documented_leader_proof`. Ordinary work remains under its own workflow gates. Never fake the role via a prompt label or infer authority from session/thread/pointer/transcript/cwd state. Use outcome-first, concise progress updates: state the target result, constraints, validation evidence, and stop condition before adding process detail. Native subagents live in .codex/agents and may handle independent parallel subtasks within one Codex session or team pane. Skills load from .codex/skills, not native-agent TOMLs. Treat installed prompts as narrower execution surfaces under AGENTS.md authority.";
+export const OMX_PLUGIN_DEVELOPER_INSTRUCTIONS = '<omx version="1">You have oh-my-codex installed through Codex plugin mode. AGENTS.md is the orchestration brain and main control surface. Follow AGENTS.md for skill/keyword routing and $name workflow invocation. When the native surface exposes `agent_type` role routing, set `agent_type` to an installed role and never omit it for OMX work. When it reports `role_routing_unavailable` and adapted Ralplan authority is requested, do not fabricate `agent_type`; run `omx ralplan preflight --json` and stop on `unsupported_documented_leader_proof`. Ordinary work remains under its own workflow gates. Never fake the role via a prompt label or infer authority from session/thread/pointer/transcript/cwd state. Registered Codex plugin marketplace surfaces supply OMX workflows and plugin-scoped companion resources when the plugin is installed; native agent roles are installed as setup-owned Codex agent TOML files in plugin mode so agent_type routing works. User-installed skills may still live under ~/.codex/skills. Use outcome-first, concise progress updates: state the target result, constraints, validation evidence, and stop condition before adding process detail.</omx>';
 const SHARED_MCP_REGISTRY_MARKER = "oh-my-codex (OMX) Shared MCP Registry Sync";
 const SHARED_MCP_REGISTRY_END_MARKER = "# End oh-my-codex shared MCP registry sync";
 const LEGACY_MULTI_AGENT_KEYS = [
@@ -171,6 +171,40 @@ export async function cleanCodexModelAvailabilityNuxIfNeeded(configPath) {
 export function hasLegacyOmxTeamRunTable(config) {
     return LEGACY_OMX_TEAM_RUN_TABLE_PATTERN.test(config);
 }
+function stripLegacyOmxTeamRunTable(config) {
+    const lines = config.split(/\r?\n/);
+    const result = [];
+    for (let i = 0; i < lines.length;) {
+        const line = lines[i];
+        if (!LEGACY_OMX_TEAM_RUN_TABLE_PATTERN.test(line)) {
+            result.push(line);
+            i += 1;
+            continue;
+        }
+        // Retired table found: drop any immediately preceding OMX comment or
+        // blank lines (mirrors stripOrphanedOmxSections), then the table header
+        // and its body up to the next [table] header.
+        while (result.length > 0) {
+            const last = result[result.length - 1];
+            if (last.trim() === "" || /^#\s*(OMX|oh-my-codex)/i.test(last)) {
+                result.pop();
+            }
+            else {
+                break;
+            }
+        }
+        i += 1;
+        // Consume the table body up to the next [table] header, but never past
+        // the OMX block footer — the end marker is a comment, not a header, and
+        // must survive a last-table removal (issue #3447).
+        while (i < lines.length && !/^\s*\[/.test(lines[i])) {
+            if (lines[i].trim() === OMX_CONFIG_END_MARKER)
+                break;
+            i += 1;
+        }
+    }
+    return result.join("\n");
+}
 function unwrapTomlString(value) {
     return value?.match(/^"(.*)"$/)?.[1];
 }
@@ -653,45 +687,8 @@ const OMX_HOOK_TRUST_START_MARKER = "# OMX-owned Codex hook trust state";
 const OMX_HOOK_TRUST_END_MARKER = "# End OMX-owned Codex hook trust state";
 const OMX_PROJECT_TRUST_START_MARKER = "# OMX-synced Codex project trust state (from runtime CODEX_HOME)";
 const OMX_PROJECT_TRUST_END_MARKER = "# End OMX-synced Codex project trust state";
-function extractMarkerBlockContent(config, startMarker, endMarker) {
-    const lines = config.split(/\r?\n/);
-    for (let i = 0; i < lines.length; i++) {
-        if (lines[i].trim() !== startMarker)
-            continue;
-        const nextEndIdx = lines.findIndex((line, index) => index > i && line.trim() === endMarker);
-        const nextStartIdx = lines.findIndex((line, index) => index > i && line.trim() === startMarker);
-        if (nextEndIdx === -1 || (nextStartIdx !== -1 && nextStartIdx < nextEndIdx)) {
-            return undefined;
-        }
-        return lines.slice(i + 1, nextEndIdx).join("\n").trim();
-    }
-    return undefined;
-}
-function stripMarkerBlock(config, startMarker, endMarker) {
-    const lines = config.split(/\r?\n/);
-    const kept = [];
-    for (let i = 0; i < lines.length;) {
-        if (lines[i].trim() !== startMarker) {
-            kept.push(lines[i]);
-            i += 1;
-            continue;
-        }
-        const nextEndIdx = lines.findIndex((line, index) => index > i && line.trim() === endMarker);
-        const nextStartIdx = lines.findIndex((line, index) => index > i && line.trim() === startMarker);
-        if (nextEndIdx === -1 || (nextStartIdx !== -1 && nextStartIdx < nextEndIdx)) {
-            kept.push(lines[i]);
-            i += 1;
-            continue;
-        }
-        i = nextEndIdx + 1;
-    }
-    return kept.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd();
-}
 function isPlainTomlRecord(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        Object.getPrototypeOf(value) === Object.prototype);
+    return typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
 }
 function safeParseToml(content) {
     try {
@@ -702,97 +699,514 @@ function safeParseToml(content) {
         return undefined;
     }
 }
-function collectProjectHookTrustStateKeys(config) {
-    const keys = new Set();
-    const parsed = safeParseToml(config);
-    const hooksTable = isPlainTomlRecord(parsed) ? parsed.hooks : undefined;
-    const hooksState = isPlainTomlRecord(hooksTable) ? hooksTable.state : undefined;
-    if (!isPlainTomlRecord(hooksState))
-        return keys;
-    for (const [key, entry] of Object.entries(hooksState)) {
-        if (!isPlainTomlRecord(entry))
-            continue;
-        keys.add(key);
+function projectHookTrustState(config) {
+    const hooks = safeParseToml(config)?.hooks;
+    const state = isPlainTomlRecord(hooks) ? hooks.state : undefined;
+    return isPlainTomlRecord(state) ? state : undefined;
+}
+function projectTrustSemanticView(config) {
+    const hasLeadingBom = config.startsWith("\uFEFF");
+    const source = hasLeadingBom ? config.slice(1) : config;
+    if (source.includes("\uFEFF"))
+        return undefined;
+    return { source, prefix: hasLeadingBom ? "\uFEFF" : "" };
+}
+function projectTrustMarkerRange(config) {
+    const lexical = analyzeTomlSource(config);
+    if (!lexical.isUnambiguous)
+        return undefined;
+    const lines = sourceLines(config);
+    const starts = lines.filter((line, index) => lexical.lineStartsOutsideMultiline[index] && line.content.trim() === OMX_PROJECT_TRUST_START_MARKER);
+    const ends = lines.filter((line, index) => lexical.lineStartsOutsideMultiline[index] && line.content.trim() === OMX_PROJECT_TRUST_END_MARKER);
+    if (starts.length === 0 && ends.length === 0)
+        return { start: config.length, end: config.length, payloadStart: config.length, payloadEnd: config.length };
+    if (starts.length !== 1 || ends.length !== 1 || starts[0].start >= ends[0].start)
+        return undefined;
+    const start = starts[0];
+    const end = ends[0];
+    return { start: start.start, end: end.end, payloadStart: start.end, payloadEnd: end.start };
+}
+function hasInlineProjectTrustMarkerComment(config) {
+    const lexical = analyzeTomlSource(config);
+    return sourceLines(config).some((line, index) => {
+        if (!lexical.lineStartsOutsideMultiline[index])
+            return false;
+        const trimmed = line.content.trim();
+        return (trimmed.startsWith(OMX_PROJECT_TRUST_START_MARKER) && trimmed !== OMX_PROJECT_TRUST_START_MARKER) ||
+            (trimmed.startsWith(OMX_PROJECT_TRUST_END_MARKER) && trimmed !== OMX_PROJECT_TRUST_END_MARKER);
+    });
+}
+function projectTrustHeaderPath(line) {
+    if (/^\s*\[\[/.test(line))
+        return undefined;
+    const header = parseTomlSourceTableHeader(line);
+    if (!header?.parsed)
+        return undefined;
+    const path = [];
+    let cursor = header.parsed;
+    while (isPlainTomlRecord(cursor)) {
+        const keys = Object.keys(cursor);
+        if (keys.length === 0)
+            return path;
+        if (keys.length !== 1)
+            return undefined;
+        const key = keys[0];
+        path.push(key);
+        cursor = cursor[key];
     }
-    return keys;
+    return path;
 }
-/**
- * Repairs project configs from the 0.18.3 relaunch regression where a
- * project-synced trust block could duplicate setup-owned hook trust tables and
- * make the next runtime CODEX_HOME config.toml invalid before Codex started.
- */
-export function repairProjectScopeTrustStateForLaunch(projectConfig, projectHooksPath) {
-    const syncedTrustBlock = extractMarkerBlockContent(projectConfig, OMX_PROJECT_TRUST_START_MARKER, OMX_PROJECT_TRUST_END_MARKER);
-    if (!syncedTrustBlock)
-        return projectConfig;
-    const stripped = stripMarkerBlock(projectConfig, OMX_PROJECT_TRUST_START_MARKER, OMX_PROJECT_TRUST_END_MARKER);
-    const repaired = syncProjectScopeTrustStateFromRuntime(stripped, syncedTrustBlock, projectHooksPath);
-    return repaired === stripped ? projectConfig : repaired;
+function dominantProjectTrustEol(source) {
+    const crlfCount = (source.match(/\r\n/g) ?? []).length;
+    const lfCount = (source.match(/(?<!\r)\n/g) ?? []).length;
+    return crlfCount > lfCount ? "\r\n" : "\n";
+}
+function projectTrustPayloadIsSemanticallyEmpty(payload) {
+    const parsed = safeParseToml(payload);
+    return parsed !== undefined && Object.keys(parsed).length === 0;
+}
+function projectTrustValueAtPath(source, path) {
+    let value = source;
+    for (const key of path) {
+        if (!isPlainTomlRecord(value))
+            return undefined;
+        value = value[key];
+    }
+    return value;
 }
 /**
- * Project-scope launches mirror the durable project config.toml into an
- * ephemeral runtime CODEX_HOME. Codex writes its workspace-trust ledger and
- * hook trust ledger into the runtime config.toml during the session. Without
- * persistence, those entries die with the runtime, so Codex prompts to trust
- * the workspace and hooks on every launch (issue #2470).
- *
- * This function extracts only trust-state tables (`[projects."<cwd>"]` and
- * `[hooks.state."<projectHooksPath>:..."]`) from the runtime config.toml and
- * upserts them into the durable project config.toml inside a marker-fenced
- * block, preserving any surrounding user-managed content and comments and
- * ignoring Codex's NUX counters or other ephemeral runtime-only writes.
+ * Marker contents are an ownership boundary, not general TOML. Reject every
+ * source form that OMX did not emit rather than rebuilding it and losing data.
  */
-export function syncProjectScopeTrustStateFromRuntime(projectConfig, runtimeConfig, projectHooksPath) {
-    const parsed = safeParseToml(runtimeConfig);
-    if (!parsed)
-        return projectConfig;
-    const stripped = stripMarkerBlock(projectConfig, OMX_PROJECT_TRUST_START_MARKER, OMX_PROJECT_TRUST_END_MARKER);
-    const existingHookTrustStateKeys = collectProjectHookTrustStateKeys(stripped);
-    const trustBlockLines = [];
-    const projectsTable = parsed.projects;
-    if (isPlainTomlRecord(projectsTable)) {
-        for (const [projectKey, entry] of Object.entries(projectsTable).sort(([a], [b]) => a.localeCompare(b))) {
-            if (!isPlainTomlRecord(entry))
-                continue;
-            const serialized = TOML.stringify({ [projectKey]: entry });
-            const renderedHeader = `[projects."${escapeTomlBasicString(projectKey)}"]`;
-            const body = serialized
-                .split(/\r?\n/)
-                .filter((line) => !/^\s*\[/.test(line) && line.trim() !== "")
-                .join("\n");
-            if (body.length === 0)
-                continue;
-            trustBlockLines.push(renderedHeader, body, "");
+function inventoryProjectTrustPayload(payload, projectHooksPath) {
+    const parsed = safeParseToml(payload);
+    const lexical = analyzeTomlSource(payload);
+    const headers = projectTrustHeaders(payload, { start: 0, end: payload.length });
+    if (!parsed || !lexical.isUnambiguous || !headers)
+        return undefined;
+    if (Object.keys(parsed).some((key) => key !== "projects" && key !== "hooks"))
+        return undefined;
+    const lines = sourceLines(payload);
+    const headerStarts = new Set(headers.map((header) => header.start));
+    for (const [index, line] of lines.entries()) {
+        if (!lexical.lineStartsOutsideMultiline[index])
+            return undefined;
+        const isHeader = headerStarts.has(line.start);
+        const isBlankOrComment = line.content.trim() === "" || /^\s*#/.test(line.content);
+        if (isHeader || isBlankOrComment) {
+            if (isHeader && lexical.lineHasTomlComment[index])
+                return undefined;
+            continue;
         }
+        if (lexical.lineHasTomlComment[index])
+            return undefined;
+        const priorHeader = headers.some((header) => header.start < line.start);
+        if (!priorHeader)
+            return undefined;
     }
-    const hooksTable = parsed.hooks;
-    const hooksState = isPlainTomlRecord(hooksTable) ? hooksTable.state : undefined;
-    if (isPlainTomlRecord(hooksState)) {
-        for (const [stateKey, entry] of Object.entries(hooksState).sort(([a], [b]) => a.localeCompare(b))) {
-            if (!isPlainTomlRecord(entry))
-                continue;
-            if (!stateKey.startsWith(`${projectHooksPath}:`))
-                continue;
-            if (existingHookTrustStateKeys.has(stateKey))
+    const managedHeaders = [];
+    for (const header of headers) {
+        if (header.path[0] === "projects" && header.path.length >= 2) {
+            if (!isPlainTomlRecord(projectTrustValueAtPath(parsed, header.path)))
+                return undefined;
+            managedHeaders.push({ ...header, kind: "project" });
+            continue;
+        }
+        if (header.path[0] === "hooks" &&
+            header.path[1] === "state" &&
+            header.path.length === 3 &&
+            header.path[2].startsWith(`${projectHooksPath}:`)) {
+            const value = projectTrustValueAtPath(parsed, header.path);
+            if (!isPlainTomlRecord(value) || typeof value.trusted_hash !== "string" || value.trusted_hash.length === 0 || Object.keys(value).some((key) => key !== "trusted_hash"))
+                return undefined;
+            managedHeaders.push({ ...header, kind: "hook" });
+            continue;
+        }
+        return undefined;
+    }
+    if (!projectTrustPayloadProjectFamiliesAreValid(managedHeaders))
+        return undefined;
+    if (!projectTrustPayloadNestedStructuresAreExplicit(parsed, managedHeaders))
+        return undefined;
+    return { parsed, headers: managedHeaders };
+}
+function projectTrustSourceNestedStructuresAreExplicit(parsed, headers) {
+    const projects = parsed.projects;
+    if (projects === undefined)
+        return true;
+    if (!isPlainTomlRecord(projects))
+        return false;
+    const hasHeader = (path) => headers.some((header) => projectTrustEqual(header.path, path));
+    const visit = (value, path) => {
+        for (const [key, child] of Object.entries(value)) {
+            if (!isPlainTomlRecord(child))
                 continue;
-            const trusted = entry.trusted_hash;
-            if (typeof trusted !== "string" || trusted.length === 0)
+            const childPath = [...path, key];
+            if (!hasHeader(childPath) || !visit(child, childPath))
+                return false;
+        }
+        return true;
+    };
+    return Object.entries(projects).every(([key, value]) => isPlainTomlRecord(value) && hasHeader(["projects", key]) && visit(value, ["projects", key]));
+}
+function projectTrustPayloadNestedStructuresAreExplicit(parsed, headers) {
+    const hasHeader = (path) => headers.some((header) => header.kind === "project" && projectTrustEqual(header.path, path));
+    const visit = (value, path) => {
+        for (const [key, child] of Object.entries(value)) {
+            if (!isPlainTomlRecord(child))
                 continue;
-            trustBlockLines.push(`[hooks.state."${escapeTomlBasicString(stateKey)}"]`, `trusted_hash = "${escapeTomlBasicString(trusted)}"`, "");
+            const childPath = [...path, key];
+            if (!hasHeader(childPath) || !visit(child, childPath))
+                return false;
         }
+        return true;
+    };
+    return headers
+        .filter((header) => header.kind === "project" && header.path.length === 2)
+        .every((header) => {
+        const value = projectTrustValueAtPath(parsed, header.path);
+        return isPlainTomlRecord(value) && visit(value, header.path);
+    });
+}
+function projectTrustPayloadTableSpan(source) {
+    const lines = sourceLines(source);
+    const lastBodyLine = lines
+        .slice(1)
+        .reverse()
+        .find((line) => line.content.trim() !== "" && !/^\s*#/.test(line.content));
+    if (!lastBodyLine)
+        return { source, gap: "" };
+    const bodyEnd = lastBodyLine.end;
+    return { source: source.slice(0, bodyEnd), gap: source.slice(bodyEnd) };
+}
+function projectTrustPayloadTableBodyHasCommentsOrBlanks(source) {
+    return sourceLines(source).some((line) => line.content.trim() === "" || /^\s*#/.test(line.content));
+}
+function reconcileProjectTrustPayload(payload, payloadInventory, externalProjects, runtimeProjects, runtimeHooksState, externalHookTrustState, projectHooksPath, eol) {
+    const { headers } = payloadInventory;
+    const payloadProjectKeys = new Set(headers.filter((header) => header.kind === "project").map((header) => header.path[1]));
+    const replacementByHeader = new Map();
+    for (const key of payloadProjectKeys) {
+        const projectHeaders = headers.filter((header) => header.kind === "project" && header.path[1] === key);
+        const parent = projectHeaders.find((header) => header.path.length === 2);
+        const payloadValue = projectTrustValueAtPath(payloadInventory.parsed, ["projects", key]);
+        const externalValue = externalProjects[key];
+        const runtimeValue = runtimeProjects[key];
+        if (externalValue !== undefined) {
+            if (!projectTrustEqual(payloadValue, externalValue) || (runtimeValue !== undefined && !projectTrustEqual(runtimeValue, externalValue)))
+                return undefined;
+            for (const header of projectHeaders)
+                replacementByHeader.set(header.start, undefined);
+            continue;
+        }
+        if (runtimeValue === undefined) {
+            for (const header of projectHeaders)
+                replacementByHeader.set(header.start, undefined);
+            continue;
+        }
+        if (!parent || projectHeaders.length !== 1 || !isPlainTomlRecord(runtimeValue))
+            return undefined;
+        const rendered = renderProjectTrust(key, runtimeValue);
+        if (!rendered)
+            return undefined;
+        replacementByHeader.set(parent.start, rendered.replaceAll("\n", eol));
+    }
+    for (const header of headers.filter((candidate) => candidate.kind === "hook")) {
+        const key = header.path[2];
+        const payloadValue = projectTrustValueAtPath(payloadInventory.parsed, header.path);
+        const runtimeValue = runtimeHooksState?.[key];
+        const externalValue = externalHookTrustState?.[key];
+        if (externalValue !== undefined) {
+            if (!projectTrustEqual(payloadValue, externalValue))
+                return undefined;
+            replacementByHeader.set(header.start, undefined);
+            continue;
+        }
+        if (!isPlainTomlRecord(runtimeValue) || typeof runtimeValue.trusted_hash !== "string" || runtimeValue.trusted_hash.length === 0) {
+            replacementByHeader.set(header.start, undefined);
+            continue;
+        }
+        replacementByHeader.set(header.start, `[hooks.state."${escapeTomlBasicString(key)}"]${eol}trusted_hash = "${escapeTomlBasicString(runtimeValue.trusted_hash)}"`);
+    }
+    const leadingGap = payload.slice(0, headers[0]?.start ?? payload.length);
+    const parts = headers.length === 0 ? [] : [leadingGap];
+    let trailingGap = headers.length === 0 ? leadingGap : "";
+    const appendPart = (part) => {
+        if (!part)
+            return;
+        const previous = parts.at(-1);
+        if (previous && !/(?:\r\n|\n)$/.test(previous) && !/^(?:\r\n|\n)/.test(part))
+            parts.push(eol);
+        parts.push(part);
+    };
+    for (const [index, header] of headers.entries()) {
+        const next = headers[index + 1];
+        const segmentEnd = next?.start ?? payload.length;
+        const replacement = replacementByHeader.get(header.start);
+        const span = projectTrustPayloadTableSpan(payload.slice(header.start, segmentEnd));
+        const tableBody = span.source.slice(header.end - header.start);
+        if (replacement !== undefined &&
+            replacement !== span.source &&
+            projectTrustPayloadTableBodyHasCommentsOrBlanks(tableBody)) {
+            return undefined;
+        }
+        if (!next) {
+            trailingGap = span.gap;
+            if (replacement !== undefined)
+                appendPart(replacement);
+            continue;
+        }
+        if (replacement !== undefined)
+            appendPart(replacement);
+        if (span.gap)
+            appendPart(span.gap);
     }
-    if (trustBlockLines.length === 0) {
-        return stripped.length === 0 ? "" : `${stripped}\n`;
+    const additions = [];
+    for (const [key, value] of Object.entries(runtimeProjects).sort(([left], [right]) => left.localeCompare(right))) {
+        if (externalProjects[key] !== undefined || payloadProjectKeys.has(key))
+            continue;
+        if (!isPlainTomlRecord(value))
+            return undefined;
+        const rendered = renderProjectTrust(key, value);
+        if (!rendered)
+            return undefined;
+        additions.push(`${rendered.replaceAll("\n", eol)}${eol}`);
     }
-    const block = [
-        OMX_PROJECT_TRUST_START_MARKER,
-        ...trustBlockLines,
-        OMX_PROJECT_TRUST_END_MARKER,
-        "",
-    ].join("\n");
-    if (stripped.length === 0)
-        return block;
-    return `${stripped}\n\n${block}`;
+    for (const [key, value] of Object.entries(runtimeHooksState ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
+        if (!key.startsWith(`${projectHooksPath}:`) || externalHookTrustState?.[key] !== undefined || headers.some((header) => header.kind === "hook" && header.path[2] === key))
+            continue;
+        if (!isPlainTomlRecord(value) || typeof value.trusted_hash !== "string" || value.trusted_hash.length === 0)
+            continue;
+        additions.push(`[hooks.state."${escapeTomlBasicString(key)}"]${eol}trusted_hash = "${escapeTomlBasicString(value.trusted_hash)}"${eol}`);
+    }
+    let reconciled = parts.join("");
+    if (additions.length > 0 && reconciled && !/(?:\r\n|\n)$/.test(reconciled))
+        reconciled += eol;
+    reconciled += additions.join("");
+    if (trailingGap && reconciled && !/(?:\r\n|\n)$/.test(reconciled) && !/^(?:\r\n|\n)/.test(trailingGap))
+        reconciled += eol;
+    reconciled += trailingGap;
+    reconciled = reconciled.replace(/(?:\r\n|\n)$/, "");
+    return Object.keys(safeParseToml(reconciled) ?? {}).length === 0 ? "" : reconciled;
+}
+function projectTrustHeaders(config, region) {
+    const lexical = analyzeTomlSource(config);
+    if (!lexical.isUnambiguous)
+        return undefined;
+    const lines = sourceLines(config);
+    const headers = [];
+    for (const [index, line] of lines.entries()) {
+        if (line.start < region.start || line.start >= region.end || !lexical.lineStartsOutsideMultiline[index])
+            continue;
+        if (!/^\s*\[/.test(line.content))
+            continue;
+        const path = projectTrustHeaderPath(line.content);
+        if (!path) {
+            if (/^\s*\[\[?\s*(?:projects|"projects"|'projects')/.test(line.content))
+                return undefined;
+            continue;
+        }
+        headers.push({ start: line.start, end: line.end, path });
+    }
+    return headers;
+}
+function inventoryProjectTrustSource(config) {
+    const parsed = safeParseToml(config);
+    if (!parsed)
+        return undefined;
+    const projects = parsed.projects;
+    if (projects !== undefined && !isPlainTomlRecord(projects))
+        return undefined;
+    const headers = projectTrustHeaders(config, { start: 0, end: config.length });
+    if (!headers)
+        return undefined;
+    const projectHeaders = headers.filter((header) => header.path[0] === "projects");
+    if (projectHeaders.some((header) => header.path.length < 2))
+        return undefined;
+    for (const key of Object.keys(projects ?? {})) {
+        if (projectHeaders.filter((header) => header.path.length === 2 && header.path[1] === key).length !== 1) {
+            return undefined;
+        }
+    }
+    if (!projectTrustSourceNestedStructuresAreExplicit(parsed, projectHeaders))
+        return undefined;
+    return { projects: projects ?? {}, headers };
+}
+function projectTrustCandidateIsSafe(candidate, external, runtimeProjects) {
+    const marker = projectTrustMarkerRange(candidate);
+    const inventory = inventoryProjectTrustSource(candidate);
+    const externalInventory = inventoryProjectTrustSource(external);
+    if (!inventory || !externalInventory)
+        return false;
+    const hasMarker = marker !== undefined && marker.start !== marker.end;
+    const hasEquivalentExternalBytes = (actual) => {
+        if (actual === external)
+            return true;
+        return splitProjectTrustTrailingEols(actual).body === splitProjectTrustTrailingEols(external).body;
+    };
+    if (hasMarker) {
+        const candidateExternal = `${candidate.slice(0, marker.start)}${candidate.slice(marker.end)}`;
+        if (!hasEquivalentExternalBytes(candidateExternal) && !(candidate.startsWith(external) && candidate.slice(marker.end).length === 0 && /^(?:\r\n|\n)+$/.test(candidate.slice(external.length, marker.start))))
+            return false;
+    }
+    else if (!hasEquivalentExternalBytes(candidate)) {
+        return false;
+    }
+    const expectedProjects = { ...externalInventory.projects, ...runtimeProjects };
+    if (!projectTrustEqual(inventory.projects, expectedProjects))
+        return false;
+    for (const [key, value] of Object.entries(expectedProjects)) {
+        if (!projectTrustEqual(inventory.projects[key], value))
+            return false;
+        if (inventory.headers.filter((header) => header.path[0] === "projects" && header.path.length === 2 && header.path[1] === key).length !== 1)
+            return false;
+    }
+    return true;
+}
+function projectTrustPayloadProjectFamiliesAreValid(headers) {
+    const projectKeys = new Set(headers.filter((header) => header.kind === "project").map((header) => header.path[1]));
+    for (const key of projectKeys) {
+        const family = headers.filter((header) => header.kind === "project" && header.path[1] === key);
+        const parents = family.filter((header) => header.path.length === 2);
+        if (parents.length !== 1 || !projectTrustFamilyIsContiguous(headers, parents[0]))
+            return false;
+    }
+    return true;
+}
+function projectTrustFamilyIsContiguous(headers, parent) {
+    const first = headers.indexOf(parent);
+    let ended = false;
+    for (let index = first + 1; index < headers.length; index += 1) {
+        const path = headers[index].path;
+        const belongsToFamily = path[0] === "projects" && path[1] === parent.path[1];
+        if (!belongsToFamily) {
+            ended = true;
+            continue;
+        }
+        if (ended || path.length < 3)
+            return false;
+    }
+    return true;
+}
+function projectTrustEqual(left, right) {
+    if (Object.is(left, right))
+        return true;
+    if (left instanceof Date || right instanceof Date) {
+        return left instanceof Date && right instanceof Date && left.constructor === right.constructor && String(left) === String(right);
+    }
+    if (Array.isArray(left) || Array.isArray(right)) {
+        return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((value, index) => projectTrustEqual(value, right[index]));
+    }
+    if (!isPlainTomlRecord(left) || !isPlainTomlRecord(right))
+        return false;
+    const leftKeys = Object.keys(left).sort();
+    const rightKeys = Object.keys(right).sort();
+    return leftKeys.length === rightKeys.length && leftKeys.every((key, index) => key === rightKeys[index] && projectTrustEqual(left[key], right[key]));
+}
+function canRenderFlatProjectTrust(entry) {
+    const isValue = (value) => {
+        if (Array.isArray(value))
+            return value.every(isValue);
+        return !isPlainTomlRecord(value);
+    };
+    return Object.values(entry).every(isValue);
+}
+function renderProjectTrust(projectKey, entry) {
+    if (!canRenderFlatProjectTrust(entry))
+        return undefined;
+    const serialized = TOML.stringify({ [projectKey]: entry });
+    const body = serialized.split(/\r?\n/).filter((line) => !/^\s*\[/.test(line) && line.trim() !== "").join("\n");
+    return body ? `[projects."${escapeTomlBasicString(projectKey)}"]\n${body}` : undefined;
+}
+function splitProjectTrustTrailingEols(source) {
+    const match = source.match(/(?:(?:\r\n|\n))*$/);
+    const trailingEols = match?.[0] ?? "";
+    return { body: source.slice(0, source.length - trailingEols.length), trailingEols };
+}
+function appendProjectTrustMarker(base, payload, eol, trailingEols) {
+    if (!payload)
+        return `${splitProjectTrustTrailingEols(base).body}${trailingEols}`;
+    const { body } = splitProjectTrustTrailingEols(base);
+    const separator = body ? `${eol}${eol}` : "";
+    const block = `${OMX_PROJECT_TRUST_START_MARKER}${eol}${payload}${eol}${OMX_PROJECT_TRUST_END_MARKER}`;
+    return `${body}${separator}${block}${trailingEols}`;
+}
+function reconcileProjectScopeTrustState(projectConfig, runtimeConfig, projectHooksPath, requireExistingPayload) {
+    const durable = projectTrustSemanticView(projectConfig);
+    const runtime = projectTrustSemanticView(runtimeConfig);
+    if (!durable || !runtime)
+        return projectConfig;
+    if (hasInlineProjectTrustMarkerComment(durable.source) || hasInlineProjectTrustMarkerComment(runtime.source))
+        return projectConfig;
+    const parsedRuntime = safeParseToml(runtime.source);
+    const runtimeInventory = inventoryProjectTrustSource(runtime.source);
+    if (!parsedRuntime || !runtimeInventory)
+        return projectConfig;
+    const marker = projectTrustMarkerRange(durable.source);
+    if (!marker)
+        return projectConfig;
+    const hasMarker = marker.start !== marker.end;
+    const payload = durable.source.slice(marker.payloadStart, marker.payloadEnd);
+    const payloadIsEmpty = projectTrustPayloadIsSemanticallyEmpty(payload);
+    const payloadInventory = hasMarker
+        ? inventoryProjectTrustPayload(payload, projectHooksPath)
+        : { parsed: {}, headers: [] };
+    if (!payloadInventory)
+        return projectConfig;
+    if (requireExistingPayload && (!hasMarker || payloadIsEmpty))
+        return projectConfig;
+    const external = hasMarker
+        ? `${durable.source.slice(0, marker.start)}${durable.source.slice(marker.end)}`
+        : durable.source;
+    const trailingEols = splitProjectTrustTrailingEols(durable.source).trailingEols;
+    const externalInventory = inventoryProjectTrustSource(external);
+    if (!externalInventory)
+        return projectConfig;
+    const projects = runtimeInventory.projects;
+    const externalProjects = externalInventory.projects;
+    const headersBeforeMarker = projectTrustHeaders(durable.source, { start: 0, end: marker.start });
+    const headersAfterMarker = projectTrustHeaders(durable.source, { start: marker.end, end: durable.source.length });
+    if (!headersBeforeMarker || !headersAfterMarker)
+        return projectConfig;
+    const headers = [...headersBeforeMarker, ...headersAfterMarker];
+    for (const key of Object.keys(externalProjects)) {
+        const family = headers.filter((header) => header.path[0] === "projects" && header.path[1] === key);
+        const parents = family.filter((header) => header.path.length === 2);
+        if (parents.length !== 1)
+            return projectConfig;
+        const parentIsBeforeMarker = parents[0].start < marker.start;
+        if (family.some((header) => (header.start < marker.start) !== parentIsBeforeMarker))
+            return projectConfig;
+        if (!projectTrustFamilyIsContiguous(headers, parents[0]))
+            return projectConfig;
+    }
+    const eol = dominantProjectTrustEol(durable.source);
+    const hooks = parsedRuntime.hooks;
+    const hooksState = isPlainTomlRecord(hooks) && isPlainTomlRecord(hooks.state) ? hooks.state : undefined;
+    const nextPayload = reconcileProjectTrustPayload(payload, payloadInventory, externalProjects, projects, hooksState, projectHookTrustState(external), projectHooksPath, eol);
+    if (nextPayload === undefined)
+        return projectConfig;
+    if (!inventoryProjectTrustPayload(nextPayload, projectHooksPath))
+        return projectConfig;
+    const candidate = appendProjectTrustMarker(external, nextPayload, eol, trailingEols);
+    if (!projectTrustCandidateIsSafe(candidate, external, projects))
+        return projectConfig;
+    return `${durable.prefix}${candidate}`;
+}
+/** Repairs only a uniquely parseable, nonempty project-sync payload before mirror creation. */
+export function repairProjectScopeTrustStateForLaunch(projectConfig, projectHooksPath) {
+    const durable = projectTrustSemanticView(projectConfig);
+    if (!durable)
+        return projectConfig;
+    const marker = projectTrustMarkerRange(durable.source);
+    if (!marker || marker.start === marker.end)
+        return projectConfig;
+    const payload = durable.source.slice(marker.payloadStart, marker.payloadEnd);
+    return reconcileProjectScopeTrustState(projectConfig, payload, projectHooksPath, true);
+}
+/** Conservatively persists runtime project and hook trust without rewriting external TOML. */
+export function syncProjectScopeTrustStateFromRuntime(projectConfig, runtimeConfig, projectHooksPath) {
+    return reconcileProjectScopeTrustState(projectConfig, runtimeConfig, projectHooksPath, false);
 }
 function isMultilineTomlString(mode) {
     return mode === "multiline-basic" || mode === "multiline-literal";
@@ -2243,6 +2657,49 @@ function upsertTuiStatusLine(config, preset = DEFAULT_STATUS_LINE_PRESET, option
         hadExistingTui: true,
     };
 }
+/**
+ * Collapse duplicate `[tui]` tables to a single verbatim first table.
+ *
+ * The launch repair uses this instead of `upsertTuiStatusLine` so the first
+ * table — including any surrounding OMX marker comments that precede the next
+ * [table] header — is preserved byte-for-byte and no status line is injected.
+ */
+function dedupeTuiTables(config) {
+    const lines = config.split(/\r?\n/);
+    const sections = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        if (!/^\s*\[tui\]\s*$/.test(lines[i]))
+            continue;
+        let end = lines.length;
+        for (let j = i + 1; j < lines.length; j += 1) {
+            if (/^\s*\[\[?[^\]]+\]?\]\s*$/.test(lines[j])) {
+                end = j;
+                break;
+            }
+            // The OMX block footer is comments, not a [table] header — stop before
+            // it so dropping a trailing duplicate never swallows the end marker.
+            if (lines[j].trim() === OMX_CONFIG_END_MARKER) {
+                end = j;
+                break;
+            }
+        }
+        sections.push({ start: i, end });
+        i = end - 1;
+    }
+    if (sections.length <= 1)
+        return config;
+    const droppedStarts = new Set(sections.slice(1).map((section) => section.start));
+    const rebuilt = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const dropped = sections.find((section) => section.start === i);
+        if (dropped && droppedStarts.has(i)) {
+            i = dropped.end - 1;
+            continue;
+        }
+        rebuilt.push(lines[i]);
+    }
+    return rebuilt.join("\n").replace(/\n{3,}/g, "\n\n");
+}
 // ---------------------------------------------------------------------------
 // OMX [table] sections block (appended at end of file)
 // ---------------------------------------------------------------------------
@@ -2655,36 +3112,20 @@ export function buildMergedConfig(existingConfig, pkgRoot, options = {}) {
  * OMX builds no longer ship the team MCP entrypoint, so we repair both before
  * the CLI is spawned.
  *
+ * The repair is surgical: only the detected targets are changed — missing
+ * launcher-backed MCP `startup_timeout_sec` entries are added, retired
+ * `[mcp_servers.omx_team_run]` tables are dropped, and duplicate `[tui]`
+ * tables are deduplicated. Everything else is preserved byte-for-byte,
+ * including user-owned `notify` and `model_reasoning_effort` values, managed
+ * hook trust state, and any existing OMX managed block; a config that never
+ * had an OMX block does not get one injected (see issue #3447).
+ *
+ * `pkgRoot` and `options` are retained for API compatibility; the surgical
+ * repair does not rebuild the managed block, so it never needs them.
+ *
  * Returns `true` if a repair was performed.
  */
-function managedHookTrustProofRequiredForRepair(config) {
-    const inventory = collectManagedHookTrustStateSourceRepresentations(config);
-    return managedMarkerTrustStateConflicts(inventory.source, inventory.representations, inventory.managedMarkerRanges, inventory.markerContainedHooksStateSpans, inventory.invalidMarkerContainedHooksStateSpans, inventory.parsedStatementSpans, inventory.parsedAssignmentSpans, managedHookTrustStateExpectations()).size > 0;
-}
-async function launchRepairOptionsWithManagedHookTrustProof(configPath, config, options) {
-    if (!managedHookTrustProofRequiredForRepair(config)) {
-        return options;
-    }
-    const hooksPath = options.codexHooksFile ?? resolve(configPath, "..", "hooks.json");
-    let hooksContent;
-    try {
-        hooksContent = await readFile(hooksPath, "utf-8");
-    }
-    catch (error) {
-        throw new ManagedCodexHooksPlanError("invalid_document", `Cannot safely repair config.toml because the current hooks artifact at ${hooksPath} could not be read.`, { cause: String(error), hooksPath });
-    }
-    const trustScan = scanManagedCodexHookTrustStateFromContent(hooksContent, hooksPath, managedCodexHookOptionsFromMergeOptions(options));
-    if (!trustScan.ok)
-        throw trustScan.error;
-    return {
-        ...options,
-        codexHooksFile: hooksPath,
-        codexHooksContent: hooksContent,
-        managedHookTrustState: trustScan.trustState,
-        priorManagedHookTrustState: trustScan.trustState,
-    };
-}
-export async function repairConfigIfNeeded(configPath, pkgRoot, options = {}) {
+export async function repairConfigIfNeeded(configPath, _pkgRoot, _options = {}) {
     if (!existsSync(configPath))
         return false;
     const content = await readFile(configPath, "utf-8");
@@ -2693,15 +3134,32 @@ export async function repairConfigIfNeeded(configPath, pkgRoot, options = {}) {
     const hasLauncherTimeoutGap = findLauncherTimeoutRepairTargets(content).length > 0;
     if (tuiCount <= 1 && !hasLegacyTeamRunTable && !hasLauncherTimeoutGap)
         return false;
-    // Managed config compatibility issue detected — derive proof from the current
-    // hooks artifact before any marker stripping can replace managed trust state.
-    const repairOptions = await launchRepairOptionsWithManagedHookTrustProof(configPath, content, options);
-    const repaired = buildMergedConfig(content, pkgRoot, repairOptions);
+    let repaired = content;
+    if (hasLauncherTimeoutGap) {
+        repaired = addDefaultLauncherMcpStartupTimeouts(repaired);
+    }
+    if (hasLegacyTeamRunTable) {
+        repaired = stripLegacyOmxTeamRunTable(repaired);
+    }
+    if (tuiCount > 1) {
+        repaired = dedupeTuiTables(repaired);
+    }
     if (repaired === content)
         return false;
+    // The surgical helpers normalize to LF internally; write back with the
+    // original file's dominant line ending so a CRLF config stays CRLF.
+    const newline = dominantNewline(content);
+    if (newline === "\r\n") {
+        repaired = repaired.replace(/\r?\n/g, "\r\n");
+    }
     await writeFile(configPath, repaired);
     return true;
 }
+function dominantNewline(text) {
+    const crlf = (text.match(/\r\n/g) ?? []).length;
+    const lf = (text.match(/\n/g) ?? []).length - crlf;
+    return crlf >= lf ? "\r\n" : "\n";
+}
 export async function mergeConfig(configPath, pkgRoot, options = {}) {
     let existing = "";
     if (existsSync(configPath)) {