oh-my-codex 0.20.3 → 0.20.5

package/dist/scripts/smoke-packed-install.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict';
 import { chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { delimiter, dirname, join, resolve } from 'node:path';
+import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { TextDecoder } from 'node:util';
@@ -10,6 +10,7 @@ import { isManagedCodexHookCommand, planManagedCodexHooksRemoval } from '../conf
 import { spawnPlatformCommand, spawnPlatformCommandSync, } from '../utils/platform-command.js';
 import { ensureReusableNodeModules, } from '../utils/repo-deps.js';
 import { escapeTomlString } from '../utils/toml.js';
+import { sameFilePath } from '../utils/paths.js';
 export { hasUsableNodeModules, resolveGitCommonDir, resolveReusableNodeModulesSource, } from '../utils/repo-deps.js';
 export const PACKED_INSTALL_SMOKE_CORE_COMMANDS = [
     ['--help'],
@@ -135,13 +136,13 @@ export const PACKED_INSTALL_NATIVE_HOOK_REGRESSION_PROMPTS = [
     { name: 'doc-preserves-earlier', prompt: 'Use autopilot mode; "note"; use $ralplan is the workflow command.', expectedSkill: 'autopilot', expectedStopBlock: true },
     { name: 'doc-colon-followup', prompt: 'use $ralplan is the workflow command: use $autopilot build it', expectedSkill: 'autopilot', expectedStopBlock: true },
     { name: 'table-followup', prompt: 'Mode | Meaning\n--- | ---\nmanual | documentation\n$ralplan plan it', expectedSkill: 'ralplan', expectedStopBlock: true },
-    { name: 'neg-advance-reopen', prompt: 'Do not run $ralplan but advance to $ultragoal', expectedSkill: 'ultragoal', expectedStopBlock: false },
-    { name: 'neg-jump-reopen', prompt: 'Do not run $ralplan but jump straight to $ultragoal', expectedSkill: 'ultragoal', expectedStopBlock: false },
+    { name: 'neg-advance-reopen', prompt: 'Do not run $ralplan but advance to $ultragoal', expectedSkill: 'ultragoal', expectedStopBlock: false, insideTmux: true },
+    { name: 'neg-jump-reopen', prompt: 'Do not run $ralplan but jump straight to $ultragoal', expectedSkill: 'ultragoal', expectedStopBlock: false, insideTmux: true },
     { name: 'reference-plain-title', prompt: '[docs]: /target "title\nplain text"\n$ralplan plan it', expectedSkill: 'ralplan', expectedStopBlock: true },
     { name: 'reference-plain-destination', prompt: '[docs]: ./target\n$ralplan plan it', expectedSkill: 'ralplan', expectedStopBlock: true },
     { name: 'directive-use-the', prompt: 'Do not run $ralplan; use the $autopilot build it', expectedSkill: 'autopilot', expectedStopBlock: true },
     { name: 'directive-continue-after-quote', prompt: '"quoted"\ncontinue with $ralplan', expectedSkill: 'ralplan', expectedStopBlock: true },
-    { name: 'doc-advance-followup', prompt: 'use $ralplan is the workflow command; advance to $ultragoal', expectedSkill: 'ultragoal', expectedStopBlock: false },
+    { name: 'doc-advance-followup', prompt: 'use $ralplan is the workflow command; advance to $ultragoal', expectedSkill: 'ultragoal', expectedStopBlock: false, insideTmux: true },
     { name: 'directive-run-code-review', prompt: 'run $code-review', expectedSkill: 'code-review', expectedStopBlock: false },
     { name: 'directive-documentation', prompt: 'use $ralplan is the consensus-planning command', expectedSkill: null, expectedStopBlock: false },
     { name: 'nested-bounded-child-unbounded-parent', prompt: '"`x`\n$ralplan plan it', expectedSkill: null, expectedStopBlock: false },
@@ -173,11 +174,26 @@ export const PACKED_INSTALL_NATIVE_HOOK_REGRESSION_PROMPTS = [
     { name: 'percent-suffix', prompt: '$ralplan%docs', expectedSkill: null, expectedStopBlock: false },
     { name: 'fullwidth-percent-suffix', prompt: '$ralplan％docs', expectedSkill: null, expectedStopBlock: false },
     { name: 'g1a-ordered-multi-skill', prompt: '$ralplan, $autopilot; $team', expectedSkill: 'ralplan', expectedStopBlock: true, expectedDeferredSkills: ['autopilot', 'team'], expectedActiveSkills: ['ralplan'], insideTmux: true },
-    { name: 'g1c-duplicate-alias', prompt: '$autopilot $oh-my-codex:autopilot build it', expectedSkill: 'autopilot', expectedStopBlock: true, expectedDeferredSkills: [], expectedActiveSkills: ['autopilot'] },
+    { name: 'g1c-duplicate-alias', prompt: '$autopilot $oh-my-codex:autopilot build it', expectedSkill: 'autopilot', expectedStopBlock: true, expectedDeferredSkills: [], expectedActiveSkills: [] },
     { name: 'b3-longer-valid-fence', prompt: '```text\n$autopilot build it\n````\n$ralplan plan it', expectedSkill: 'ralplan', expectedStopBlock: true },
     { name: 'b4-shorter-invalid-fence', prompt: '````text\n$autopilot build it\n```\n$ralplan plan it', expectedSkill: null, expectedStopBlock: false },
     { name: 'b5-different-marker-invalid-fence', prompt: '```text\n$autopilot build it\n~~~\n$ralplan plan it', expectedSkill: null, expectedStopBlock: false },
 ];
+export function assertPackedRegressionWorkflowState(testCase, skillState) {
+    const matchesExpectedState = testCase.expectedSkill === 'autopilot'
+        ? skillState.active === false
+            && skillState.skill === 'autopilot'
+            && skillState.phase === 'failed'
+            && skillState.error === 'documented_host_consensus_receipt_unavailable'
+            && skillState.active_skills?.length === 0
+        : skillState.active === true && skillState.skill === testCase.expectedSkill;
+    if (!matchesExpectedState) {
+        throw new Error(`packed regression ${testCase.name} persisted unexpected workflow state`);
+    }
+}
+export function shouldPackedRegressionStopBlock(testCase) {
+    return testCase.expectedSkill === 'autopilot' ? false : testCase.expectedStopBlock;
+}
 export function buildPackedRegressionEnvironment(testCase, baseEnv = process.env) {
     const insideTmux = testCase.insideTmux === true;
     return {
@@ -1017,15 +1033,74 @@ export const PACKED_INSTALL_PLUGIN_MCP_TARGETS = [
     ['omx_hermes', 'hermes', 'omx-hermes'],
 ];
 const PACKED_INSTALL_OPERATIONAL_PROBE_TIMEOUT_MS = 5_000;
-function buildPackedProbeEnv(overrides = {}) {
+const PACKED_INSTALL_COMMAND_TIMEOUT_MS = 120_000;
+function runtimeBinaryName(platform) {
+    return platform === 'win32' ? 'omx-runtime.exe' : 'omx-runtime';
+}
+function validatePackedSmokeRuntimeBinary(candidate, platform) {
+    if (!isAbsolute(candidate)) {
+        throw new Error(`packed smoke runtime override must be absolute: ${candidate}`);
+    }
+    let stats;
+    try {
+        stats = statSync(candidate);
+    }
+    catch {
+        throw new Error(`packed smoke requires omx-runtime at "${candidate}"; run "npm run build:runtime"`);
+    }
+    if (!stats.isFile() || (platform !== 'win32' && (stats.mode & 0o111) === 0)) {
+        throw new Error(`packed smoke runtime must be an executable regular file: ${candidate}`);
+    }
+    return candidate;
+}
+export function resolvePackedSmokeRuntimeBinary(repoRoot = process.cwd(), options = {}) {
+    const platform = options.platform ?? process.platform;
+    const candidate = options.candidate ?? resolve(join(repoRoot, 'target', 'debug', runtimeBinaryName(platform)));
+    return validatePackedSmokeRuntimeBinary(candidate, platform);
+}
+export function buildPackedProbeEnv(overrides = {}, options = {}) {
     const env = { ...process.env };
     for (const key of Object.keys(env)) {
         const upper = key.toUpperCase();
-        if (upper === 'NODE_OPTIONS' || upper.startsWith('OMX_') || upper.startsWith('CODEX_')) {
+        if (upper === 'NODE_OPTIONS'
+            || upper === 'BASH_ENV'
+            || upper === 'ENV'
+            || upper === 'ZDOTDIR'
+            || upper.startsWith('OMX_')
+            || upper.startsWith('CODEX_')
+            || upper.startsWith('GJC_')
+            || upper === 'TMUX'
+            || upper === 'TMUX_PANE') {
             delete env[key];
         }
     }
-    return { ...env, ...overrides };
+    for (const [key, value] of Object.entries(overrides)) {
+        if (value === undefined)
+            delete env[key];
+        else
+            env[key] = value;
+    }
+    if (options.runtimeBinary === null) {
+        delete env.OMX_RUNTIME_BINARY;
+    }
+    else {
+        env.OMX_RUNTIME_BINARY = options.runtimeBinary === undefined
+            ? resolvePackedSmokeRuntimeBinary(options.repoRoot)
+            : validatePackedSmokeRuntimeBinary(options.runtimeBinary, process.platform);
+    }
+    return env;
+}
+export function replacePathKeyCaseInsensitive(env, value) {
+    const result = { ...env };
+    let pathKey;
+    for (const key of Object.keys(result)) {
+        if (key.toUpperCase() !== 'PATH')
+            continue;
+        pathKey ??= key;
+        delete result[key];
+    }
+    result[pathKey ?? 'PATH'] = value;
+    return result;
 }
 export const PACKED_INSTALL_REQUIRED_ARTIFACT_PATHS = [
     'dist/config/models.js',
@@ -1241,12 +1316,29 @@ function assertInstalledPluginHookLauncherContract(hookSource) {
             /\.stdin\s*\.end\s*\(\s*input\s*\)/,
             'forward the hook input to the delegate stdin',
         ],
+        [
+            /['"]omx-plugin-hook-routing-only:v1['"]/,
+            'declare the routing-only discriminator contract',
+        ],
     ];
     for (const [pattern, requirement] of requiredShape) {
         if (!pattern.test(hookSource)) {
             throw new Error(`installed plugin native hook launcher must ${requirement}`);
         }
     }
+    for (const forbidden of [
+        /native-anchor-auth\.key/,
+        /\bcreateHmac\b/,
+        /\brandomBytes\b/,
+        /\bsignLaunchClaim\b/,
+        /\bplugin-hook-launches\b/,
+        /\bHMAC\b/i,
+        /signed.?claim/i,
+    ]) {
+        if (forbidden.test(hookSource)) {
+            throw new Error(`installed plugin native hook launcher retains forbidden authority path: ${forbidden.source}`);
+        }
+    }
 }
 export function assertInstalledPluginSurface(packageRoot) {
     const pluginManifest = readInstalledPluginManifest(packageRoot, 'plugins/oh-my-codex/.codex-plugin/plugin.json');
@@ -1392,7 +1484,7 @@ async function assertInstalledReasoningArtifacts(packageRoot) {
 function smokeInstalledRootReasoningRejections(omxPath, cwd) {
     const codexHome = mkdtempSync(join(tmpdir(), 'omx-packed-root-reasoning-'));
     try {
-        const env = buildPackedProbeEnv({ CODEX_HOME: codexHome });
+        const env = buildPackedProbeEnv({ CODEX_HOME: codexHome }, { runtimeBinary: null });
         const configPath = join(codexHome, 'config.toml');
         const usageResult = spawnSync(omxPath, ['reasoning'], { cwd, encoding: 'utf-8', env });
         if (usageResult.status !== 0) {
@@ -1439,7 +1531,12 @@ function readFakeCodexLaunches(capturePath) {
         return [];
     return parseFakeCodexLaunches(readFileSync(capturePath, 'utf-8'));
 }
-function smokeInstalledLaunchArgumentBoundary(omxPath) {
+export function assertPackedLaunchCwdPreserved(expectedCwd, receivedCwd, message) {
+    if (!sameFilePath(expectedCwd, receivedCwd)) {
+        throw new Error(`${message}: expected ${expectedCwd}, received ${receivedCwd}`);
+    }
+}
+function smokeInstalledLaunchArgumentBoundary(omxPath, runtimeBinary) {
     const smokeRoot = mkdtempSync(join(tmpdir(), 'omx-packed-launch-boundary-'));
     const modelInstructionsPath = join(smokeRoot, 'model-instructions.md');
     try {
@@ -1495,7 +1592,7 @@ function smokeInstalledLaunchArgumentBoundary(omxPath) {
             OMX_MODEL_INSTRUCTIONS_FILE: modelInstructionsPath,
             OMX_LAUNCH_POLICY: 'direct',
             OMX_PACKED_FAKE_CODEX_CAPTURE_PATH: capturePath,
-        });
+        }, { runtimeBinary });
         delete env.OMX_NOTIFY_TEMP_CONTRACT;
         delete env.OMX_TEAM_WORKER_LAUNCH_ARGS;
         writeFileSync(modelInstructionsPath, '# Packed launch boundary instructions\n');
@@ -1542,9 +1639,7 @@ function smokeInstalledLaunchArgumentBoundary(omxPath) {
                 throw new Error(`omx must launch exactly one fake Codex process: ${JSON.stringify(launches)}`);
             }
             assert.deepStrictEqual(launch.argv, expectedCodexArgs, 'omx must inject model instructions before -- and preserve exact post-marker argument boundaries');
-            if (launch.cwd !== launchCwd) {
-                throw new Error(`omx must not change cwd for post-marker arguments: expected ${launchCwd}, received ${launch.cwd}`);
-            }
+            assertPackedLaunchCwdPreserved(launchCwd, launch.cwd, 'omx must not change cwd for post-marker arguments');
             if (launch.OMX_NOTIFY_TEMP_CONTRACT !== null) {
                 throw new Error(`omx must not activate temporary notification routing for post-marker arguments: ${JSON.stringify(launch)}`);
             }
@@ -1674,9 +1769,7 @@ function smokeInstalledLaunchArgumentBoundary(omxPath) {
             `model_instructions_file="${escapeTomlString(modelInstructionsPath)}"`,
             ...twoMarkerArgs.slice(1),
         ], 'the first literal -- must terminate OMX parsing and preserve every later argv element');
-        if (twoMarkerLaunch.cwd !== launchCwd) {
-            throw new Error(`the first literal -- must preserve launch cwd: expected ${launchCwd}, received ${twoMarkerLaunch.cwd}`);
-        }
+        assertPackedLaunchCwdPreserved(launchCwd, twoMarkerLaunch.cwd, 'the first literal -- must preserve launch cwd');
         if (twoMarkerLaunch.OMX_NOTIFY_TEMP_CONTRACT !== null) {
             throw new Error(`the first literal -- must not activate notification routing: ${JSON.stringify(twoMarkerLaunch)}`);
         }
@@ -1692,6 +1785,7 @@ function usage() {
     return [
         'Usage: node scripts/smoke-packed-install.mjs',
         '',
+        '  --fail-closed-probe  install the package, assert the runtime-absent fail-closed denial, and exit',
         'Creates an npm tarball, installs it into an isolated prefix, and smoke tests the installed omx CLI.',
         'Release smoke validates installed CLI boot, native-hook dispatch, packaged artifacts, installed reasoning boundaries, and the isolated setup/rerun/uninstall lifecycle; Codex trust checks run when the pinned CLI is present.',
     ].join('\n');
@@ -1729,21 +1823,32 @@ export function ensureRepoDependencies(repoRoot, options = {}) {
         nodeModulesPath: join(repoRoot, 'node_modules'),
     };
 }
-function parseArgs(argv) {
+export function parseArgs(argv) {
+    let failClosedProbe = false;
     for (const token of argv) {
         if (token === '--help' || token === '-h') {
             console.log(usage());
             process.exit(0);
         }
+        if (token === '--fail-closed-probe') {
+            failClosedProbe = true;
+            continue;
+        }
         throw new Error(`Unknown argument: ${token}\n${usage()}`);
     }
+    return { failClosedProbe };
 }
 function run(cmd, args, options = {}) {
     const result = spawnSync(cmd, [...args], {
         encoding: 'utf-8',
         stdio: 'pipe',
+        timeout: PACKED_INSTALL_COMMAND_TIMEOUT_MS,
+        killSignal: 'SIGKILL',
         ...options,
     });
+    if (result.error?.code === 'ETIMEDOUT') {
+        throw new Error(`${cmd} ${args.join(' ')} exceeded ${PACKED_INSTALL_COMMAND_TIMEOUT_MS}ms`);
+    }
     if (result.status !== 0) {
         throw new Error(formatCommandFailure(cmd, [...args], result));
     }
@@ -1845,7 +1950,7 @@ function requireNativeHookPermissionDeny(probe, output, reason) {
         throw new Error(`native hook ${probe} denial did not match ${reason.source}`);
     }
 }
-function smokeInstalledNativeHookDist(prefixDir) {
+function smokeInstalledNativeHookDist(prefixDir, runtimeBinary) {
     function runPackedTransportRegressions(hookScript, smokeCwd) {
         const invoke = (cwd, environment, payload) => run(process.execPath, [realpathSync(hookScript)], {
             cwd, env: environment, input: JSON.stringify(payload),
@@ -1932,7 +2037,7 @@ function smokeInstalledNativeHookDist(prefixDir) {
         const g2cPayload = { ...PACKED_CODEX_01445_NO_POINTER_NO_TRACKER_FIXTURE, cwd: g2cCwd };
         const g2cResult = invoke(g2cCwd, buildPackedRegressionEnvironment({ name: 'g2c-01445' }), g2cPayload);
         const g2cStdout = String(g2cResult.stdout || '');
-        const g2cExpected = '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"unsupported_documented_leader_proof: Codex 0.144.5 hooks do not expose documented root identity required for adapted Ralplan."}}\n';
+        const g2cExpected = '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"unsupported_documented_leader_proof: Codex hooks do not expose a documented, non-user-mintable root identity required for adapted Ralplan."}}\n';
         if (g2cStdout !== g2cExpected)
             throw new Error('packed Codex 0.144.5 fixture returned unexpected PreToolUse bytes');
         if (existsSync(join(g2cCwd, '.omx', 'state')))
@@ -1953,11 +2058,49 @@ function smokeInstalledNativeHookDist(prefixDir) {
                     OMX_SESSION_ID: `packed-install-smoke-${eventName}`,
                     OMX_SOURCE_CWD: smokeCwd,
                     OMX_STARTUP_CWD: smokeCwd,
-                }),
+                }, { runtimeBinary: null }),
                 input: JSON.stringify(payload),
             });
             validateHookStdout(eventName, result.stdout);
         }
+        const collaborationCwd = join(smokeCwd, 'flattened-collaboration-nested-lifecycle');
+        mkdirSync(collaborationCwd, { recursive: true });
+        const collaborationResult = run(process.execPath, [realpathSync(hookScript)], {
+            cwd: collaborationCwd,
+            env: buildPackedProbeEnv({
+                OMX_SOURCE_CWD: collaborationCwd,
+                OMX_STARTUP_CWD: collaborationCwd,
+            }, { runtimeBinary: null }),
+            input: JSON.stringify({
+                hook_event_name: 'PostToolUse',
+                cwd: collaborationCwd,
+                session_id: 'packed-flattened-collaboration-nested-lifecycle',
+                thread_id: 'packed-flattened-collaboration-nested-lifecycle-thread',
+                tool_name: 'collaborationlist_agents',
+                tool_response: {
+                    agents: [
+                        { agent_name: '/root', agent_status: 'running' },
+                        {
+                            agent_name: '/root/reviewer',
+                            agent_status: {
+                                completed: 'Child report discusses an unavailable and unsupported optional adapter.',
+                            },
+                        },
+                    ],
+                },
+            }),
+        });
+        if (collaborationResult.status !== 0 || String(collaborationResult.stderr) !== '') {
+            throw new Error('packed flattened collaboration nested lifecycle hook invocation failed');
+        }
+        validateHookStdout('PostToolUse', String(collaborationResult.stdout));
+        const collaborationStateDir = join(collaborationCwd, '.omx', 'state');
+        if (existsSync(join(collaborationStateDir, 'native-subagent-support.json'))) {
+            throw new Error('packed flattened collaboration nested lifecycle persisted a native support blocker');
+        }
+        if (existsSync(join(collaborationStateDir, 'native-subagent-capacity-blocker.json'))) {
+            throw new Error('packed flattened collaboration nested lifecycle persisted a capacity blocker');
+        }
         const pluginHookScript = join(packageRoot, 'plugins', 'oh-my-codex', 'hooks', 'codex-native-hook.mjs');
         const pluginChildScript = join(smokeCwd, 'packed-plugin-oversized-child.mjs');
         const pluginLauncher = join(smokeCwd, process.platform === 'win32' ? 'packed-plugin-oversized.cmd' : 'packed-plugin-oversized.sh');
@@ -2086,13 +2229,15 @@ function smokeInstalledNativeHookDist(prefixDir) {
             worktree_path: smokeCwd,
         }));
         const invokeAuthorizationProbe = (payload, env) => run(process.execPath, [realpathSync(hookScript)], { cwd: smokeCwd, env, input: JSON.stringify(payload) });
-        const hookEnv = {
-            ...process.env,
+        const hookEnv = buildPackedProbeEnv({
+            BASH_ENV: undefined,
+            ENV: undefined,
+            ZDOTDIR: undefined,
             OMX_NATIVE_HOOK_DOCTOR_SMOKE: '1',
             OMX_ROOT: hookRoot,
             OMX_SOURCE_CWD: smokeCwd,
             OMX_STARTUP_CWD: smokeCwd,
-        };
+        }, { runtimeBinary: null });
         const officialTeamRootPayload = {
             hook_event_name: 'PreToolUse',
             cwd: smokeCwd,
@@ -2128,6 +2273,11 @@ function smokeInstalledNativeHookDist(prefixDir) {
             OMX_TEAM_STATE_ROOT: '',
         };
         const runActorProbeResult = (actor, probe, toolName, toolInput, inheritedEnv = {}) => {
+            const probeEnv = { ...childEnv, ...inheritedEnv };
+            for (const [key, value] of Object.entries(probeEnv)) {
+                if (value === undefined)
+                    delete probeEnv[key];
+            }
             const result = invokeAuthorizationProbe({
                 hook_event_name: 'PreToolUse',
                 cwd: smokeCwd,
@@ -2138,7 +2288,7 @@ function smokeInstalledNativeHookDist(prefixDir) {
                 tool_name: toolName,
                 tool_use_id: `packed-install-${actor}-${probe.replace(/\W+/g, '-')}`,
                 tool_input: toolInput,
-            }, { ...childEnv, ...inheritedEnv });
+            }, probeEnv);
             const stdout = String(result.stdout);
             return { output: parseNativeHookSmokeOutput(`PreToolUse ${actor} ${probe}`, stdout), stdout };
         };
@@ -2305,10 +2455,10 @@ function smokeInstalledNativeHookDist(prefixDir) {
             hook_event_name: 'PreToolUse',
             cwd: smokeCwd,
             session_id: leaderAgentId,
-            tool_name: 'Bash',
+            tool_name: 'mcp__omx_wiki__wiki_delete',
             tool_use_id: 'packed-install-identityless-native-session-remote-mutation',
-            tool_input: { command: 'PATH=/usr/bin:/bin gh issue create --title x --body y' },
-        }, childEnv).stdout)), /Main-root Conductor mode is active/);
+            tool_input: { path: 'src/session-bypass.ts' },
+        }, childEnv).stdout)), /OWNER_CONFIRMATION_REQUIRED|Main-root Conductor mode is active/);
         if (Object.keys(runActorProbe('main-root', 'finite cp metadata leaf control', 'Bash', {
             command: 'cp .omx/state/payload .omx/handoffs/run-1/payload',
         })).length !== 0) {
@@ -2331,9 +2481,18 @@ function smokeInstalledNativeHookDist(prefixDir) {
         }
         if (Object.keys(runActorProbe('main-root', 'zsh fast startup control', 'Bash', {
             command: `zsh -f -c ':'`,
-        })).length !== 0) {
+        }, { OMX_RUNTIME_BINARY: runtimeBinary })).length !== 0) {
             throw new Error('packed main-root zsh fast startup control should be allowed');
         }
+        if (Object.keys(runActorProbe('main-root', 'zsh fast startup control ambient startup environment', 'Bash', {
+            command: `zsh -f -c ':'`,
+        }, {
+            OMX_RUNTIME_BINARY: runtimeBinary,
+            ENV: '/dev/null',
+            ZDOTDIR: join(smokeCwd, '.omx', 'state', 'zsh-home'),
+        })).length !== 0) {
+            throw new Error('packed main-root zsh fast startup control should remain allowed with ambient shell-startup environment');
+        }
         const boxedPlanningRoot = join(smokeCwd, 'boxed-planning-root');
         const boxedPlanningStateDir = join(boxedPlanningRoot, '.omx', 'state');
         const boxedPlanningStatePath = join(boxedPlanningStateDir, 'sessions', leaderAgentId, 'ralplan-state.json');
@@ -3093,6 +3252,81 @@ PY`],
         symlinkSync(workspacePackageCli, packedNpmOmxShim);
         const packedNpmPath = `${packedNpmBinDir}:${process.env.PATH || '/usr/bin:/bin'}`;
         const packedNpmCommandPrefix = `PATH="${packedNpmBinDir}:/usr/bin:/bin"`;
+        const packedCancelCwd = join(smokeCwd, 'issue-3280-packed-cancel');
+        const packedCancelStateDir = join(packedCancelCwd, '.omx', 'state');
+        const packedCancelSessionId = 'issue-3280-current';
+        const packedCancelNativeId = 'issue-3280-native';
+        const packedCancelStaleOwner = 'issue-3280-stale';
+        const packedCancelSessionDir = join(packedCancelStateDir, 'sessions', packedCancelSessionId);
+        mkdirSync(packedCancelSessionDir, { recursive: true });
+        writeFileSync(join(packedCancelStateDir, 'session.json'), JSON.stringify({
+            session_id: packedCancelSessionId,
+            native_session_id: packedCancelNativeId,
+            cwd: packedCancelCwd,
+            state_root: packedCancelStateDir,
+        }));
+        const packedCancelOwnerDir = join(packedCancelStateDir, 'sessions', packedCancelNativeId);
+        mkdirSync(packedCancelOwnerDir, { recursive: true });
+        writeFileSync(join(packedCancelOwnerDir, 'session-owner.json'), JSON.stringify({
+            session_id: packedCancelNativeId,
+            native_session_id: packedCancelNativeId,
+            cwd: packedCancelCwd,
+            platform: process.platform,
+        }));
+        writeFileSync(join(packedCancelSessionDir, 'skill-active-state.json'), JSON.stringify({
+            active: true,
+            skill: 'ultragoal',
+            session_id: packedCancelSessionId,
+            owner_codex_session_id: packedCancelStaleOwner,
+            active_skills: [{
+                    skill: 'ultragoal',
+                    active: true,
+                    session_id: packedCancelSessionId,
+                    owner_codex_session_id: packedCancelNativeId,
+                }],
+        }, null, 2));
+        writeFileSync(join(packedCancelSessionDir, 'ultragoal-state.json'), JSON.stringify({
+            active: true,
+            mode: 'ultragoal',
+            session_id: packedCancelSessionId,
+        }, null, 2));
+        const packedCancelHookResult = invokeAuthorizationProbe({
+            hook_event_name: 'PreToolUse',
+            cwd: packedCancelCwd,
+            session_id: packedCancelSessionId,
+            agent_id: packedCancelNativeId,
+            thread_id: packedCancelNativeId,
+            tool_name: 'Bash',
+            tool_use_id: 'packed-install-issue-3280-cancel',
+            tool_input: { command: 'omx cancel --force' },
+        }, {
+            ...childEnv,
+            OMX_ROOT: packedCancelCwd,
+            OMX_SOURCE_CWD: packedCancelCwd,
+            OMX_STARTUP_CWD: packedCancelCwd,
+            PATH: packedNpmPath,
+            NODE_EXTRA_CA_CERTS: '/nonexistent/enterprise-ca.pem',
+        });
+        if (Object.keys(parseNativeHookSmokeOutput('PreToolUse packed issue 3280 cancel', String(packedCancelHookResult.stdout))).length !== 0) {
+            throw new Error('packed native hook blocked exact canonical cancel with inherited NODE_EXTRA_CA_CERTS');
+        }
+        const packedCancelResult = spawnSync(process.execPath, [workspacePackageCli, 'cancel', '--force'], {
+            cwd: packedCancelCwd,
+            encoding: 'utf-8',
+            env: {
+                ...process.env,
+                PATH: packedNpmPath,
+                NODE_EXTRA_CA_CERTS: '/nonexistent/enterprise-ca.pem',
+            },
+        });
+        assertBoundedProbeExit('packed issue 3280 exact-session cancel', packedCancelResult, 0);
+        const packedCancelledSkill = JSON.parse(readFileSync(join(packedCancelSessionDir, 'skill-active-state.json'), 'utf-8'));
+        if (packedCancelledSkill.active !== false || packedCancelledSkill.owner_codex_session_id !== packedCancelNativeId) {
+            throw new Error('packed issue 3280 cancellation did not reconcile and terminalize the exact skill state');
+        }
+        if (existsSync(join(packedCancelStateDir, 'skill-active-state.json'))) {
+            throw new Error('packed issue 3280 cancellation mutated root compatibility state');
+        }
         requireNativeHookPermissionDeny('main-root boxed planning CLI poisoned state root', runActorProbe('main-root', 'boxed planning CLI poisoned state root', 'Bash', { command: `OMX_STATE_ROOT=${join(smokeCwd, 'src', 'state')} ${packedNpmCommandPrefix} omx state write --input '{"mode":"ralplan","active":true}' --json` }, { OMX_ROOT: boxedPlanningRoot, OMX_TEAM_STATE_ROOT: '' }), /(?:Ralplan is active|Main-root Conductor mode is active)/);
         const npmBinPathShadow = join(smokeCwd, '.omx', 'state', 'inbox', 'cat');
         symlinkSync('/usr/bin/touch', npmBinPathShadow);
@@ -3706,9 +3940,9 @@ PY`],
         if (Object.keys(childReadOutput).length !== 0) {
             throw new Error('native hook blocked a positively classified native-child read-only operation');
         }
-        // #3194: the installed Codex 0.144.5 documented surface fails closed before
-        // authority state or an adapted role intent can be created.
-        const roleIntentCwd = join(smokeCwd, 'issue-3194-role-intent');
+        // #3194/#3212: the installed documented surface fails closed before any
+        // same-user-mintable authority state or adapted role intent can be created.
+        const roleIntentCwd = join(smokeCwd, 'issue-3212-role-intent');
         const roleIntentHome = join(roleIntentCwd, 'home');
         const roleIntentCodexHome = join(roleIntentCwd, 'codex-home');
         const roleIntentNativeSessionId = 'synthetic-3194-session';
@@ -3719,15 +3953,6 @@ PY`],
             HOME: roleIntentHome,
             CODEX_HOME: roleIntentCodexHome,
         };
-        const sessionStartResult = run(process.execPath, [realpathSync(hookScript)], {
-            cwd: roleIntentCwd,
-            env: roleIntentEnvironment,
-            input: JSON.stringify({ hook_event_name: 'SessionStart', cwd: roleIntentCwd, session_id: roleIntentNativeSessionId }),
-        });
-        validateHookStdout('SessionStart', String(sessionStartResult.stdout || ''));
-        const trackingPath = join(roleIntentCwd, '.omx', 'state', 'subagent-tracking.json');
-        if (existsSync(trackingPath))
-            throw new Error('installed #3194 SessionStart unexpectedly created tracker authority');
         const preToolUseResult = run(process.execPath, [realpathSync(hookScript)], {
             cwd: roleIntentCwd,
             env: roleIntentEnvironment,
@@ -3741,12 +3966,13 @@ PY`],
                 tool_input: { command: 'omx ralplan role-intent write --role architect --parent-thread "$CODEX_THREAD_ID" --json' },
             }),
         });
-        const preToolUseExpected = '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"unsupported_documented_leader_proof: Codex 0.144.5 hooks do not expose documented root identity required for adapted Ralplan."}}\n';
+        const preToolUseExpected = '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"unsupported_documented_leader_proof: Codex hooks do not expose a documented, non-user-mintable root identity required for adapted Ralplan."}}\n';
         if (String(preToolUseResult.stdout || '') !== preToolUseExpected) {
-            throw new Error('installed #3194 PreToolUse did not emit the exact unsupported denial');
+            throw new Error('installed #3212 PreToolUse did not emit the exact unsupported denial');
         }
-        if (existsSync(trackingPath))
-            throw new Error('installed #3194 PreToolUse unexpectedly created tracker authority');
+        const authorityStateRoot = join(roleIntentCwd, '.omx', 'state');
+        if (existsSync(authorityStateRoot))
+            throw new Error('installed #3212 PreToolUse created authority-sensitive state');
         const roleIntentCliResult = spawnSync(process.execPath, [realpathSync(join(packageRoot, 'dist', 'cli', 'omx.js')), 'ralplan', 'role-intent', 'write', '--role', 'architect', '--parent-thread', roleIntentNativeSessionId, '--json'], {
             cwd: roleIntentCwd,
             env: roleIntentEnvironment,
@@ -3754,12 +3980,12 @@ PY`],
             stdio: 'pipe',
         });
         if (roleIntentCliResult.status === 0)
-            throw new Error('installed #3194 role-intent CLI unexpectedly authorized an Architect receipt');
+            throw new Error('installed #3212 role-intent CLI unexpectedly authorized an Architect request');
         if (String(roleIntentCliResult.stdout || '') !== '{"ok":false,"reason":"unsupported_documented_leader_proof"}\n') {
-            throw new Error('installed #3194 role-intent CLI returned an unexpected denial');
+            throw new Error('installed #3212 role-intent CLI returned an unexpected fail-closed denial');
         }
-        if (existsSync(trackingPath))
-            throw new Error('installed #3194 role-intent CLI unexpectedly created tracker authority');
+        if (existsSync(authorityStateRoot))
+            throw new Error('installed #3212 role-intent CLI created authority-sensitive state');
         for (const [caseIndex, testCase] of PACKED_INSTALL_NATIVE_HOOK_REGRESSION_PROMPTS.entries()) {
             const caseCwd = join(smokeCwd, testCase.name);
             const sessionId = `packed-regression-${caseIndex}`;
@@ -3789,9 +4015,7 @@ PY`],
                 if (!existsSync(skillStatePath))
                     throw new Error(`packed regression ${testCase.name} did not create workflow state`);
                 const skillState = JSON.parse(readFileSync(skillStatePath, 'utf-8'));
-                if (!skillState.active || skillState.skill !== testCase.expectedSkill) {
-                    throw new Error(`packed regression ${testCase.name} persisted unexpected workflow state`);
-                }
+                assertPackedRegressionWorkflowState(testCase, skillState);
                 if ('expectedDeferredSkills' in testCase && JSON.stringify(skillState.deferred_skills ?? []) !== JSON.stringify(testCase.expectedDeferredSkills)) {
                     throw new Error(`packed regression ${testCase.name} persisted unexpected deferred workflows`);
                 }
@@ -3805,10 +4029,11 @@ PY`],
                 input: JSON.stringify({ ...promptPayload, hook_event_name: 'Stop', turn_id: `stop-${caseIndex}` }),
             });
             const stopOutput = JSON.parse(String(stopResult.stdout || '{}'));
-            if (testCase.expectedStopBlock && stopOutput.decision !== 'block') {
+            const expectedStopBlock = shouldPackedRegressionStopBlock(testCase);
+            if (expectedStopBlock && stopOutput.decision !== 'block') {
                 throw new Error(`packed regression ${testCase.name} did not block Stop`);
             }
-            if (!testCase.expectedStopBlock && stopOutput.decision === 'block') {
+            if (!expectedStopBlock && stopOutput.decision === 'block') {
                 throw new Error(`packed regression ${testCase.name} blocked Stop: ${JSON.stringify(stopOutput)}`);
             }
         }
@@ -4299,7 +4524,7 @@ function smokeInstalledPluginHookLauncher(packageRoot, omxPath) {
             OMX_ENTRY_PATH: omxPath,
             OMX_CODEX_LAUNCH_ID: 'packed-plugin-hook-launch',
             OMX_PACKED_PLUGIN_HOOK_CAPTURE_PATH: capturePath,
-        });
+        }, { runtimeBinary: null });
         const runProbe = (name, payload, expectedStatus, expectedStdout) => {
             writeFileSync(capturePath, '');
             const stdin = JSON.stringify(payload);
@@ -4327,6 +4552,35 @@ function smokeInstalledPluginHookLauncher(packageRoot, omxPath) {
             cwd: hookCwd,
             prompt: 'packed plugin non-Stop probe',
         }, 0, '{"hookSpecificOutput":{"additionalContext":"pinned non-stop delegate"}}\n');
+        const childSessionId = `${sessionId}-child`;
+        const childTranscriptPath = join(hookCwd, 'packed-child-transcript.jsonl');
+        writeFileSync(childTranscriptPath, `${JSON.stringify({
+            type: 'session_meta',
+            payload: {
+                id: childSessionId,
+                source: { subagent: { thread_spawn: { parent_thread_id: sessionId, task_name: 'omx_role_intent_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' } } },
+            },
+        })}\n`);
+        runProbe('claimed child SessionStart', {
+            hookEventName: 'SessionStart',
+            sessionId: childSessionId,
+            transcriptPath: childTranscriptPath,
+            cwd: hookCwd,
+        }, 0, '{"hookSpecificOutput":{"additionalContext":"pinned non-stop delegate"}}\n');
+        const routingPath = join(smokeRoot, '.omx-root', 'state', 'plugin-hook-routing', 'packed-plugin-hook-launch.json');
+        if (!existsSync(routingPath))
+            throw new Error('installed plugin launcher did not create its routing-only record');
+        assert.deepStrictEqual(JSON.parse(readFileSync(routingPath, 'utf-8')), {
+            routing: 'omx-plugin-hook-routing-only:v1',
+            ownerSessionId: sessionId,
+        }, 'installed plugin launcher routing record changed shape');
+        for (const forbiddenPath of [
+            join(smokeRoot, '.omx-root', 'native-anchor-auth.key'),
+            join(smokeRoot, '.omx-root', 'state', 'plugin-hook-launches'),
+        ]) {
+            if (existsSync(forbiddenPath))
+                throw new Error(`installed plugin launcher created forbidden authority state: ${forbiddenPath}`);
+        }
         runProbe('Stop', {
             hook_event_name: 'Stop',
             session_id: sessionId,
@@ -4412,7 +4666,7 @@ function smokeInstalledMcpTargets(omxPath) {
             OMX_TEAM_WORKER: '',
             OMX_TEAM_WORKER_LAUNCH_ARGS: '',
             OMX_NOTIFY_TEMP_CONTRACT: '',
-        });
+        }, { runtimeBinary: null });
         for (const [serverName, target, expectedServerName] of PACKED_INSTALL_PLUGIN_MCP_TARGETS) {
             const result = spawnSync(omxPath, ['mcp-serve', target], {
                 cwd: smokeRoot,
@@ -4448,6 +4702,99 @@ function smokeInstalledMcpTargets(omxPath) {
         rmSync(smokeRoot, { recursive: true, force: true });
     }
 }
+function smokeInstalledFailClosedDenial(omxPath, packageRoot) {
+    if (process.platform === 'linux') {
+        console.log('fail-closed probe: skipped on linux');
+        return;
+    }
+    const smokeRoot = mkdtempSync(join(tmpdir(), 'omx-packed-fail-closed-'));
+    try {
+        const fakeBinDir = join(smokeRoot, 'bin');
+        const launchCwd = join(smokeRoot, 'cwd');
+        const codexHome = join(smokeRoot, 'codex-home');
+        const isolatedHome = join(smokeRoot, 'home');
+        const capturePath = join(smokeRoot, 'fake-codex-argv.jsonl');
+        const modelInstructionsPath = join(smokeRoot, 'model-instructions.md');
+        mkdirSync(fakeBinDir, { recursive: true });
+        mkdirSync(launchCwd, { recursive: true });
+        mkdirSync(codexHome, { recursive: true });
+        mkdirSync(isolatedHome, { recursive: true });
+        writeFileSync(modelInstructionsPath, '# Packed fail-closed probe instructions\n');
+        const fakeCodexSource = [
+            'const { appendFileSync, existsSync } = require("node:fs");',
+            'const path = require("node:path");',
+            'const capturePath = process.env.OMX_PACKED_FAKE_CODEX_CAPTURE_PATH;',
+            'if (!capturePath) process.exit(2);',
+            'appendFileSync(capturePath, `${JSON.stringify({',
+            '  argv: process.argv.slice(2),',
+            '  cwd: process.cwd(),',
+            '  hasResumeSqlite: existsSync(path.join(process.env.CODEX_HOME ?? "", "state_5.sqlite")),',
+            '  OMX_NOTIFY_TEMP_CONTRACT: process.env.OMX_NOTIFY_TEMP_CONTRACT ?? null,',
+            '  OMX_TEAM_WORKER_LAUNCH_ARGS: process.env.OMX_TEAM_WORKER_LAUNCH_ARGS ?? null,',
+            '})}\\n`);',
+        ].join('\n');
+        if (process.platform === 'win32') {
+            const fakeCodexScript = join(fakeBinDir, 'codex.cjs');
+            writeFileSync(fakeCodexScript, fakeCodexSource);
+            writeFileSync(join(fakeBinDir, 'codex.cmd'), [
+                '@echo off',
+                `"${process.execPath}" "${fakeCodexScript}" %*`,
+            ].join('\r\n'));
+        }
+        else {
+            const fakeCodexPath = join(fakeBinDir, 'codex');
+            writeFileSync(fakeCodexPath, `#!/usr/bin/env node\n${fakeCodexSource}\n`);
+            chmodSync(fakeCodexPath, 0o755);
+        }
+        const systemPathEntries = process.platform === 'win32'
+            ? [join(process.env.SystemRoot ?? 'C:\\Windows', 'System32')]
+            : ['/usr/bin', '/bin'];
+        const isolatedPathEntries = [fakeBinDir, dirname(process.execPath), ...systemPathEntries];
+        const runtimeName = runtimeBinaryName(process.platform);
+        for (const entry of isolatedPathEntries) {
+            if (existsSync(join(entry, runtimeName))) {
+                throw new Error(`fail-closed probe PATH unexpectedly contains ${runtimeName}: ${entry}`);
+            }
+        }
+        for (const profile of ['debug', 'release']) {
+            const workspaceCandidate = join(packageRoot, 'target', profile, runtimeName);
+            if (existsSync(workspaceCandidate)) {
+                throw new Error(`fail-closed probe installed package unexpectedly contains runtime candidate: ${workspaceCandidate}`);
+            }
+        }
+        let env = buildPackedProbeEnv({
+            CODEX_HOME: codexHome,
+            HOME: isolatedHome,
+            USERPROFILE: isolatedHome,
+            OMX_BYPASS_DEFAULT_SYSTEM_PROMPT: '1',
+            OMX_MODEL_INSTRUCTIONS_FILE: modelInstructionsPath,
+            OMX_LAUNCH_POLICY: 'direct',
+            OMX_PACKED_FAKE_CODEX_CAPTURE_PATH: capturePath,
+        }, { runtimeBinary: null });
+        env = replacePathKeyCaseInsensitive(env, isolatedPathEntries.join(delimiter));
+        console.log(`fail-closed probe PATH: ${isolatedPathEntries.join(delimiter)}`);
+        const result = spawnSync(omxPath, ['--', 'packed-fail-closed-probe'], {
+            cwd: launchCwd,
+            encoding: 'utf-8',
+            env,
+            timeout: PACKED_INSTALL_OPERATIONAL_PROBE_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+        });
+        const launches = readFakeCodexLaunches(capturePath);
+        if (launches.length !== 1) {
+            throw new Error(`fail-closed probe must launch fake Codex exactly once: ${JSON.stringify(launches)}`);
+        }
+        const stderr = String(result.stderr ?? '');
+        if (result.status === 0 || !stderr.includes('session_pointer_unusable')) {
+            throw new Error(`fail-closed probe expected session_pointer_unusable denial, received status ${String(result.status)}\n${stderr}`);
+        }
+        console.log(`fail-closed probe denial: ${stderr.trim()}`);
+        console.log('fail-closed probe: denial observed');
+    }
+    finally {
+        rmSync(smokeRoot, { recursive: true, force: true });
+    }
+}
 export function parseNpmPackJsonOutput(stdout) {
     const start = stdout.lastIndexOf('\n[');
     const jsonText = (start >= 0 ? stdout.slice(start + 1) : stdout).trim();
@@ -4457,7 +4804,7 @@ export function parseNpmPackJsonOutput(stdout) {
     return JSON.parse(jsonText);
 }
 async function main() {
-    parseArgs(process.argv.slice(2));
+    const { failClosedProbe } = parseArgs(process.argv.slice(2));
     const repoRoot = process.cwd();
     const tempRoot = mkdtempSync(join(tmpdir(), 'omx-packed-install-'));
     const prefixDir = join(tempRoot, 'prefix');
@@ -4474,7 +4821,7 @@ async function main() {
         CODEX_HOME: installCodexHome,
         npm_config_cache: installNpmCache,
         NPM_CONFIG_CACHE: installNpmCache,
-    });
+    }, { runtimeBinary: null });
     let tarballPath;
     try {
         ensureRepoDependencies(repoRoot, {
@@ -4496,14 +4843,20 @@ async function main() {
         assertInstalledRequiredArtifacts(packageRoot);
         await assertInstalledReasoningArtifacts(packageRoot);
         const omxPath = join(prefixDir, process.platform === 'win32' ? '' : 'bin', npmBinName('omx'));
+        if (failClosedProbe) {
+            smokeInstalledFailClosedDenial(omxPath, packageRoot);
+            return;
+        }
+        const runtimeBinary = resolvePackedSmokeRuntimeBinary(repoRoot);
+        console.log(`packed smoke runtime: ${runtimeBinary}`);
         smokeInstalledRootReasoningRejections(omxPath, repoRoot);
-        smokeInstalledLaunchArgumentBoundary(omxPath);
+        smokeInstalledLaunchArgumentBoundary(omxPath, runtimeBinary);
         smokeInstalledPluginHookLauncher(packageRoot, omxPath);
         smokeInstalledMcpTargets(omxPath);
         for (const argv of PACKED_INSTALL_SMOKE_CORE_COMMANDS) {
             run(omxPath, argv, { cwd: repoRoot, env: installEnv });
         }
-        smokeInstalledNativeHookDist(prefixDir);
+        smokeInstalledNativeHookDist(prefixDir, runtimeBinary);
         const lifecycle = await smokePackedHookTrustLifecycle(omxPath);
         console.log(lifecycle.codexVersion !== null
             ? `packed install smoke: installed Codex 0.142.5 lifecycle passed (${lifecycle.codexVersion})`