oh-my-codex 0.20.2 → 0.20.5

package/dist/hooks/__tests__/notify-hook-auto-nudge.test.js

@@ -93,6 +93,12 @@ async function writeWorkerIdentityFixture(stateRoot, cwd, teamName, workerName)
         worktree_path: cwd,
         team_state_root: stateRoot,
     });
+    await writeJson(join(stateRoot, 'team', teamName, 'config.json'), {
+        name: teamName,
+        tmux_pane_owner_id: `team:${teamName}`,
+        hud_pane_id: null,
+        workers: [{ name: workerName, pane_id: '%99', pid: 9999 }],
+    });
 }
 function escapeRegex(value) {
     return value.replace(/[-/\\^$*+?.()|[\]{}]/g, '\\$&');
@@ -144,6 +150,15 @@ fi
 if [[ "\$cmd" == "send-keys" ]]; then
   exit 0
 fi
+if [[ "$cmd" == "show-option" ]]; then
+  option="\${@: -1}"
+  case "$option" in
+    @omx_team_pane_owner_id) echo "\${OMX_TEST_TMUX_OWNER:-team:auto-nudge}" ;;
+    @omx_pane_instance_id) echo "\${OMX_TEST_TMUX_PANE_INSTANCE_ID:-}" ;;
+    @omx_instance_id) echo "\${OMX_TEST_TMUX_INSTANCE_ID:-}" ;;
+  esac
+  exit 0
+fi
 if [[ "\$cmd" == "display-message" ]]; then
   target=""
   format=""
@@ -184,7 +199,7 @@ if [[ "\$cmd" == "list-panes" ]]; then
     printf '%%99\t1\tnode\tcodex --model gpt-5\n'
     exit 0
   fi
-  echo "%1 12345"
+  printf '%%99\t0\t%s\n%%100\t0\t10000\n' "\${OMX_TEST_TMUX_PANE_PID:-9999}"
   exit 0
 fi
 exit 0
@@ -230,6 +245,7 @@ function runNotifyHook(cwd, fakeBinDir, codexHome, payloadOverrides = {}, extraE
             OMX_TEAM_WORKER: '',
             OMX_TEAM_LEADER_NUDGE_MS: '9999999',
             OMX_TEAM_LEADER_STALE_MS: '9999999',
+            ...(extraEnv.OMX_TEAM_WORKER ? { OMX_TEAM_INTERNAL_WORKER: extraEnv.OMX_TEAM_WORKER } : {}),
             ...extraEnv,
         },
     });
@@ -637,7 +653,7 @@ if [[ "$cmd" == "list-panes" ]]; then
     printf "%%99\t0\tsh\tbash\n%%100\t1\tnode\tcodex --model gpt-5\n"
     exit 0
   fi
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 if [[ "$cmd" == "capture-pane" ]]; then
@@ -754,7 +770,7 @@ if [[ "$cmd" == "list-panes" ]]; then
     printf "%%99\t0\tcodex\tcodex\\n%%100\t1\tcodex\tcodex\\n"
     exit 0
   fi
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 if [[ "$cmd" == "capture-pane" ]]; then
@@ -872,7 +888,7 @@ if [[ "$cmd" == "list-panes" ]]; then
     printf "%%99\t0\tnode\tbash\\n%%100\t1\tnode\tcodex --model gpt-5\\n"
     exit 0
   fi
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 if [[ "$cmd" == "capture-pane" ]]; then
@@ -990,7 +1006,7 @@ if [[ "$cmd" == "list-panes" ]]; then
     printf "%%99\t1\tbash\tcodex --model gpt-5\\n%%100\t0\tnode\tcodex --model gpt-5\\n"
     exit 0
   fi
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 if [[ "$cmd" == "capture-pane" ]]; then
@@ -1104,7 +1120,7 @@ if [[ "$cmd" == "list-panes" ]]; then
     printf "%%99\t1\tbash\tcodex --model gpt-5\\n%%100\t0\tbash\tbash\\n"
     exit 0
   fi
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 if [[ "$cmd" == "capture-pane" ]]; then
@@ -1185,6 +1201,74 @@ exit 0
             assert.ok(existsSync(nudgeStatePath), 'worker state root should receive auto-nudge state');
         });
     });
+    it('does not capture or send in team-worker context without a persisted string owner token', async () => {
+        for (const owner of [undefined, 17]) {
+            await withTempWorkingDir(async (cwd) => {
+                const workerStateRoot = join(cwd, 'leader-state-root');
+                const codexHome = join(cwd, 'codex-home');
+                const fakeBinDir = join(cwd, 'fake-bin');
+                const tmuxLogPath = join(cwd, 'tmux.log');
+                await mkdir(workerStateRoot, { recursive: true });
+                await mkdir(codexHome, { recursive: true });
+                await mkdir(fakeBinDir, { recursive: true });
+                await writeWorkerIdentityFixture(workerStateRoot, cwd, 'auto-nudge', 'worker-1');
+                const configPath = join(workerStateRoot, 'team', 'auto-nudge', 'config.json');
+                const config = JSON.parse(await readFile(configPath, 'utf-8'));
+                if (owner === undefined)
+                    delete config.tmux_pane_owner_id;
+                else
+                    config.tmux_pane_owner_id = owner;
+                await writeJson(configPath, config);
+                await writeJson(join(codexHome, '.omx-config.json'), { autoNudge: { enabled: true, delaySec: 0, stallMs: 0 } });
+                await writeFile(join(fakeBinDir, 'tmux'), buildFakeTmux(tmuxLogPath));
+                await chmod(join(fakeBinDir, 'tmux'), 0o755);
+                const result = runNotifyHook(cwd, fakeBinDir, codexHome, {
+                    'last-assistant-message': 'I can continue with the worker follow-up from here.',
+                }, {
+                    OMX_TEAM_WORKER: 'auto-nudge/worker-1',
+                    OMX_TEAM_STATE_ROOT: workerStateRoot,
+                });
+                assert.equal(result.status, 0, `hook failed: ${result.stderr || result.stdout}`);
+                const tmuxLog = await readFile(tmuxLogPath, 'utf-8').catch(() => '');
+                assert.doesNotMatch(tmuxLog, /capture-pane|send-keys/, 'missing or malformed persisted owner must not capture or send tmux input');
+            });
+        }
+    });
+    it('fails closed for Team-worker owner takeover, recycled panes, and HUD targets', async () => {
+        for (const scenario of [
+            { name: 'owner takeover', env: { OMX_TEST_TMUX_OWNER: 'team:foreign' }, hudPaneId: null },
+            { name: 'recycled pane', env: { OMX_TEST_TMUX_PANE_PID: '10001' }, hudPaneId: null },
+            { name: 'HUD target', env: {}, hudPaneId: '%99' },
+        ]) {
+            await withTempWorkingDir(async (cwd) => {
+                const workerStateRoot = join(cwd, 'leader-state-root');
+                const codexHome = join(cwd, 'codex-home');
+                const fakeBinDir = join(cwd, 'fake-bin');
+                const tmuxLogPath = join(cwd, 'tmux.log');
+                await mkdir(workerStateRoot, { recursive: true });
+                await mkdir(codexHome, { recursive: true });
+                await mkdir(fakeBinDir, { recursive: true });
+                await writeWorkerIdentityFixture(workerStateRoot, cwd, 'auto-nudge', 'worker-1');
+                const configPath = join(workerStateRoot, 'team', 'auto-nudge', 'config.json');
+                const config = JSON.parse(await readFile(configPath, 'utf-8'));
+                config.hud_pane_id = scenario.hudPaneId;
+                await writeJson(configPath, config);
+                await writeJson(join(codexHome, '.omx-config.json'), { autoNudge: { enabled: true, delaySec: 0, stallMs: 0 } });
+                await writeFile(join(fakeBinDir, 'tmux'), buildFakeTmux(tmuxLogPath));
+                await chmod(join(fakeBinDir, 'tmux'), 0o755);
+                const result = runNotifyHook(cwd, fakeBinDir, codexHome, {
+                    'last-assistant-message': 'I can continue with the worker follow-up from here.',
+                }, {
+                    OMX_TEAM_WORKER: 'auto-nudge/worker-1',
+                    OMX_TEAM_STATE_ROOT: workerStateRoot,
+                    ...scenario.env,
+                });
+                assert.equal(result.status, 0, `${scenario.name}: hook failed: ${result.stderr || result.stdout}`);
+                const tmuxLog = await readFile(tmuxLogPath, 'utf-8');
+                assert.doesNotMatch(tmuxLog, defaultAutoNudgePattern('%99'), `${scenario.name} must not inject Team input`);
+            });
+        }
+    });
     it('fails closed in team-worker context when the worker state root lacks a valid identity', async () => {
         await withTempWorkingDir(async (cwd) => {
             const localStateRoot = join(cwd, '.omx', 'state');
@@ -1294,8 +1378,12 @@ fi
 if [[ "$cmd" == "send-keys" ]]; then
   exit 0
 fi
+if [[ "$cmd" == "show-option" ]]; then
+  echo "team:auto-nudge"
+  exit 0
+fi
 if [[ "$cmd" == "list-panes" ]]; then
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 exit 0
@@ -1414,7 +1502,7 @@ if [[ "$cmd" == "send-keys" ]]; then
   exit 0
 fi
 if [[ "$cmd" == "list-panes" ]]; then
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 exit 0
@@ -1531,7 +1619,7 @@ if [[ "$cmd" == "list-panes" ]]; then
     printf "%%99\t1\tsh\tbash\\n%%100\t0\tnode\tcodex --model gpt-5\\n"
     exit 0
   fi
-  echo "%1 12345"
+  printf '%%99\t0\t9999\n%%100\t0\t10000\n'
   exit 0
 fi
 exit 0
@@ -2021,7 +2109,7 @@ exit 0
             assert.equal(autopilotState.completed_at, terminalCompletedAt);
         });
     });
-    it('allows a later autopilot prompt after completed autopilot state', async () => {
+    it('fails a later fresh autopilot prompt after completed autopilot state when receipt verification is unavailable', async () => {
         await withTempWorkingDir(async (cwd) => {
             const omxDir = join(cwd, '.omx');
             const stateDir = join(omxDir, 'state');
@@ -2056,10 +2144,16 @@ exit 0
             });
             assert.equal(result.status, 0, `hook failed: ${result.stderr || result.stdout}`);
             const autopilotState = JSON.parse(await readFile(join(sessionStateDir, 'autopilot-state.json'), 'utf-8'));
-            assert.equal(autopilotState.active, true);
-            assert.equal(autopilotState.current_phase, 'deep-interview');
-            assert.equal(autopilotState.completed_at, undefined);
-            assert.equal(autopilotState.turn_id, 'turn-later-autopilot-start');
+            assert.equal(autopilotState.active, false);
+            assert.equal(autopilotState.current_phase, 'failed');
+            assert.equal(autopilotState.error, 'documented_host_consensus_receipt_unavailable');
+            const skillState = JSON.parse(await readFile(join(sessionStateDir, 'skill-active-state.json'), 'utf-8'));
+            assert.equal(skillState.active, false);
+            assert.equal(skillState.phase, 'failed');
+            assert.equal(skillState.error, 'documented_host_consensus_receipt_unavailable');
+            assert.deepEqual(skillState.active_skills, []);
+            assert.equal(existsSync(join(sessionStateDir, 'deep-interview-state.json')), false);
+            assert.equal(existsSync(join(sessionStateDir, 'ultragoal-state.json')), false);
         });
     });
     it('shares immutable classification across the terminal replay activation matrix', async () => {
@@ -2319,10 +2413,21 @@ exit 0
             assert.strictEqual(writerClassification, restartClassification, 'writer must receive the classifier object by identity');
             assert.strictEqual(restartResult, writerResult, 'notify must return the writer result unchanged');
             assert.deepEqual(Buffer.from(writerText, 'utf8'), restartBytes, 'writer must receive the original input bytes');
+            assert.equal(restartResult?.active, false);
+            assert.equal(restartResult?.phase, 'failed');
+            assert.equal(restartResult?.error, 'documented_host_consensus_receipt_unavailable');
+            assert.deepEqual(restartResult?.active_skills, []);
             const reactivatedAutopilot = JSON.parse(await readFile(join(sessionStateDir, 'autopilot-state.json'), 'utf-8'));
-            assert.equal(reactivatedAutopilot.active, true);
-            assert.equal(reactivatedAutopilot.current_phase, 'deep-interview');
-            assert.equal(reactivatedAutopilot.turn_id, 'turn-autopilot-restart');
+            assert.equal(reactivatedAutopilot.active, false);
+            assert.equal(reactivatedAutopilot.current_phase, 'failed');
+            assert.equal(reactivatedAutopilot.error, 'documented_host_consensus_receipt_unavailable');
+            const restartedSkillState = JSON.parse(await readFile(join(sessionStateDir, 'skill-active-state.json'), 'utf-8'));
+            assert.equal(restartedSkillState.active, false);
+            assert.equal(restartedSkillState.phase, 'failed');
+            assert.equal(restartedSkillState.error, 'documented_host_consensus_receipt_unavailable');
+            assert.deepEqual(restartedSkillState.active_skills, []);
+            assert.equal(existsSync(join(sessionStateDir, 'deep-interview-state.json')), false);
+            assert.equal(existsSync(join(sessionStateDir, 'ultragoal-state.json')), false);
             const sessionSkillStatePath = join(sessionStateDir, 'skill-active-state.json');
             const autopilotStatePath = join(sessionStateDir, 'autopilot-state.json');
             const rootSkillStatePath = join(stateDir, 'skill-active-state.json');
@@ -2424,7 +2529,7 @@ exit 0
             }
         });
     });
-    it('G1c-N deduplicates exact canonical and alias Autopilot invocations across classifier, writer, canonical state, and detail state', async () => {
+    it('G1c-N deduplicates exact canonical and alias Autopilot invocations before terminal receipt-preflight denial', async () => {
         await withTempWorkingDir(async (cwd) => {
             const stateDir = join(cwd, '.omx', 'state');
             const sessionId = 'sess-g1c-notify-duplicate';
@@ -2458,11 +2563,22 @@ exit 0
             assert.strictEqual(writerClassification, classification, 'writer must receive the deduplicated classifier output');
             assert.deepEqual(classification?.matches.map((match) => match.skill), ['autopilot']);
             assert.equal(result?.skill, 'autopilot');
+            assert.equal(result?.active, false);
+            assert.equal(result?.phase, 'failed');
+            assert.equal(result?.error, 'documented_host_consensus_receipt_unavailable');
             assert.deepEqual(result?.deferred_skills ?? [], []);
-            assert.deepEqual(result?.active_skills?.map((entry) => entry.skill), ['autopilot']);
+            assert.deepEqual(result?.active_skills, []);
             const canonical = JSON.parse(await readFile(join(sessionDir, 'skill-active-state.json'), 'utf8'));
-            assert.deepEqual(canonical.active_skills?.map((entry) => entry.skill), ['autopilot']);
-            assert.equal(existsSync(join(sessionDir, 'autopilot-state.json')), true);
+            assert.equal(canonical.active, false);
+            assert.equal(canonical.phase, 'failed');
+            assert.equal(canonical.error, 'documented_host_consensus_receipt_unavailable');
+            assert.deepEqual(canonical.active_skills, []);
+            const autopilot = JSON.parse(await readFile(join(sessionDir, 'autopilot-state.json'), 'utf8'));
+            assert.equal(autopilot.active, false);
+            assert.equal(autopilot.current_phase, 'failed');
+            assert.equal(autopilot.error, 'documented_host_consensus_receipt_unavailable');
+            assert.equal(existsSync(join(sessionDir, 'deep-interview-state.json')), false);
+            assert.equal(existsSync(join(sessionDir, 'ultragoal-state.json')), false);
         });
     });
     // Notify Stop is N/A: it has no user-prompt activation transport to replay.
@@ -2712,27 +2828,34 @@ exit 0
             assert.equal(Number.isNaN(Date.parse(String(failure.timestamp))), false);
         });
     });
-    it('writes skill-active-state.json when keyword activation is detected', async () => {
+    it('writes failed inactive skill state when fresh Autopilot preflight is unavailable', async () => {
         await withTempWorkingDir(async (cwd) => {
             const omxDir = join(cwd, '.omx');
             const stateDir = join(omxDir, 'state');
             const logsDir = join(omxDir, 'logs');
             const codexHome = join(cwd, 'codex-home');
             const fakeBinDir = join(cwd, 'fake-bin');
+            const hookEventsPath = join(cwd, 'hook-events.jsonl');
+            const tmuxLogPath = join(cwd, 'tmux.log');
             await mkdir(logsDir, { recursive: true });
             await mkdir(stateDir, { recursive: true });
             await mkdir(codexHome, { recursive: true });
             await mkdir(fakeBinDir, { recursive: true });
+            await mkdir(join(omxDir, 'hooks'), { recursive: true });
+            await writeFile(join(omxDir, 'hooks', 'capture.mjs'), [
+                "import { appendFileSync } from 'node:fs';",
+                `export function onHookEvent(event) { appendFileSync(${JSON.stringify(hookEventsPath)}, JSON.stringify(event) + '\\n'); }`,
+            ].join('\n'));
             await writeJson(join(codexHome, '.omx-config.json'), {
                 autoNudge: { enabled: true, delaySec: 0, stallMs: 0 },
             });
             await writeManagedSessionState(stateDir, cwd);
             const sessionStateDir = join(stateDir, 'sessions', 'sess-managed');
-            await writeFile(join(fakeBinDir, 'tmux'), buildFakeTmux(join(cwd, 'tmux.log')));
+            await writeFile(join(fakeBinDir, 'tmux'), buildFakeTmux(tmuxLogPath));
             await chmod(join(fakeBinDir, 'tmux'), 0o755);
             const result = runNotifyHook(cwd, fakeBinDir, codexHome, {
                 'input-messages': ['$autopilot handle this task'],
-                'last-assistant-message': 'Here is the plan I will follow.',
+                'last-assistant-message': 'A handoff is required.',
             });
             assert.equal(result.status, 0, `hook failed: ${result.stderr || result.stdout}`);
             const rootSkillStatePath = join(stateDir, 'skill-active-state.json');
@@ -2741,8 +2864,20 @@ exit 0
             assert.ok(existsSync(skillStatePath), 'session skill-active-state.json should be created');
             const skillState = JSON.parse(await readFile(skillStatePath, 'utf-8'));
             assert.equal(skillState.skill, 'autopilot');
-            assert.equal(skillState.phase, 'planning');
-            assert.equal(skillState.active, true);
+            assert.equal(skillState.phase, 'failed');
+            assert.equal(skillState.active, false);
+            assert.equal(skillState.error, 'documented_host_consensus_receipt_unavailable');
+            assert.deepEqual(skillState.active_skills, []);
+            const hookEvents = (await readFile(hookEventsPath, 'utf-8')).trim().split('\n')
+                .map((line) => JSON.parse(line));
+            assert.deepEqual(hookEvents.map(({ event, source }) => ({ event, source })), [
+                { event: 'turn-complete', source: 'native' },
+                { event: 'handoff-needed', source: 'derived' },
+            ], 'denied fresh Autopilot must dispatch each required terminal lifecycle event exactly once');
+            assert.doesNotMatch(await readFile(tmuxLogPath, 'utf-8').catch(() => ''), /(?:send-keys|capture-pane|set-buffer|paste-buffer)/, 'denied fresh Autopilot must not inject or continue');
+            assert.equal(existsSync(join(sessionStateDir, 'ralplan-state.json')), false);
+            assert.equal(existsSync(join(sessionStateDir, 'deep-interview-state.json')), false);
+            assert.equal(existsSync(join(sessionStateDir, 'ultragoal-state.json')), false);
         });
     });
     it('disables auto-nudge entirely when deep-interview mode state is active', async () => {