oh-my-codex 0.20.3 → 0.21.0

package/src/scripts/__tests__/issue-3293-hook-owned-cancel.test.ts

@@ -0,0 +1,186 @@
+import assert from "node:assert/strict";
+import { chmod, mkdtemp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { describe, it } from "node:test";
+import { dispatchCodexNativeHook } from "../codex-native-hook.js";
+
+async function json(path: string, value: unknown): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(value, null, 2));
+}
+
+async function fixture(sessionId = "session-hook-cancel") {
+  const cwd = await mkdtemp(join(tmpdir(), "omx-3293-hook-cancel-"));
+  const stateDir = join(cwd, ".omx", "state");
+  const threadId = `thread-${sessionId}`;
+  const sessionDir = join(stateDir, "sessions", sessionId);
+  await json(join(stateDir, "session.json"), { session_id: sessionId, cwd, leader_thread_id: threadId });
+  await json(join(stateDir, "subagent-tracking.json"), { schemaVersion: 1, sessions: { [sessionId]: { session_id: sessionId, leader_thread_id: threadId, threads: { [threadId]: { thread_id: threadId, kind: "leader" } } } } });
+  await json(join(sessionDir, "autopilot-state.json"), { active: true, mode: "autopilot", current_phase: "deep-interview", session_id: sessionId, thread_id: threadId, workingDirectory: cwd });
+  await json(join(sessionDir, "skill-active-state.json"), { active: true, skill: "autopilot", phase: "deep-interview", session_id: sessionId, thread_id: threadId, active_skills: [{ active: true, skill: "autopilot", phase: "deep-interview", session_id: sessionId, thread_id: threadId }] });
+  return { cwd, stateDir, sessionDir, sessionId, threadId };
+}
+
+type Fixture = Awaited<ReturnType<typeof fixture>>;
+
+function preTool(f: Fixture, command: string, overrides: Record<string, unknown> = {}) {
+  return dispatchCodexNativeHook({ hook_event_name: "PreToolUse", cwd: f.cwd, session_id: f.sessionId, thread_id: f.threadId, agent_id: f.threadId, tool_name: "Bash", tool_input: { command }, ...overrides }, { cwd: f.cwd });
+}
+
+function stop(f: Fixture) {
+  return dispatchCodexNativeHook({ hook_event_name: "Stop", cwd: f.cwd, session_id: f.sessionId, thread_id: f.threadId }, { cwd: f.cwd });
+}
+
+function assertValueFreeDenial(result: Awaited<ReturnType<typeof preTool>>, f: Fixture, stateContent: string, label: string): void {
+  assert.equal(result.outputJson?.decision, "block", label);
+  const rendered = JSON.stringify(result.outputJson);
+  for (const secret of [f.cwd, f.sessionId, stateContent]) assert.equal(rendered.includes(secret), false, `${label}: diagnostic leaked a value`);
+}
+
+async function withEnv<T>(values: Record<string, string | undefined>, run: () => Promise<T>): Promise<T> {
+  const before = new Map(Object.keys(values).map((name) => [name, process.env[name]]));
+  try {
+    for (const [name, value] of Object.entries(values)) {
+      if (value === undefined) delete process.env[name]; else process.env[name] = value;
+    }
+    return await run();
+  } finally {
+    for (const [name, value] of before) {
+      if (value === undefined) delete process.env[name]; else process.env[name] = value;
+    }
+  }
+}
+
+async function denialFixture(command: string, mutate?: (f: Fixture) => Promise<void>, payload?: Record<string, unknown>) {
+  const f = await fixture();
+  try {
+    if (mutate) await mutate(f);
+    const stateContent = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+    const result = await preTool(f, command, payload);
+    assertValueFreeDenial(result, f, stateContent, command);
+  } finally { await rm(f.cwd, { recursive: true, force: true }); }
+}
+
+describe("issue #3293 hook-owned cancellation", () => {
+  it("handles bare deep-interview cancellation, terminalizes both files, and does not execute Bash", async () => {
+    const f = await fixture();
+    try {
+      const sentinel = join(f.cwd, "plugin-sentinel");
+      await mkdir(join(f.cwd, ".omx", "hooks"), { recursive: true });
+      await writeFile(join(f.cwd, ".omx", "hooks", "sentinel.mjs"), `import { writeFile } from 'node:fs/promises'; await writeFile(${JSON.stringify(sentinel)}, 'ran');`);
+      const result = await preTool(f, "omx cancel");
+      assert.equal(result.outputJson?.decision, "block");
+      assert.match(JSON.stringify(result.outputJson), /cancelled_exact_session/);
+      assert.equal(JSON.parse(await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8")).active, false);
+      assert.equal(JSON.parse(await readFile(join(f.sessionDir, "skill-active-state.json"), "utf8")).active, false);
+      await assert.rejects(readFile(sentinel));
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("stops repeatedly without continuation, reactivation, or terminal-byte changes", async () => {
+    const f = await fixture();
+    try {
+      await preTool(f, "omx cancel");
+      const paths = [join(f.sessionDir, "autopilot-state.json"), join(f.sessionDir, "skill-active-state.json")];
+      const terminal = await Promise.all(paths.map((path) => readFile(path)));
+      assert.equal((await stop(f)).outputJson, null);
+      assert.equal((await stop(f)).outputJson, null);
+      assert.deepEqual(await Promise.all(paths.map((path) => readFile(path))), terminal);
+      assert.equal(JSON.parse(terminal[0].toString()).active, false);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("terminalizes only the exact session", async () => {
+    const f = await fixture();
+    try {
+      const otherId = "session-other";
+      const otherDir = join(f.stateDir, "sessions", otherId);
+      const otherAutopilot = { active: true, mode: "autopilot", current_phase: "deep-interview", session_id: otherId, thread_id: "thread-other", workingDirectory: f.cwd };
+      const otherSkill = { active: true, skill: "autopilot", phase: "deep-interview", session_id: otherId, thread_id: "thread-other" };
+      await json(join(otherDir, "autopilot-state.json"), otherAutopilot);
+      await json(join(otherDir, "skill-active-state.json"), otherSkill);
+      const before = await Promise.all([readFile(join(otherDir, "autopilot-state.json")), readFile(join(otherDir, "skill-active-state.json"))]);
+      await preTool(f, "omx cancel");
+      assert.deepEqual(await Promise.all([readFile(join(otherDir, "autopilot-state.json")), readFile(join(otherDir, "skill-active-state.json"))]), before);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("fails closed for cancellation and Stop when a prepared journal exists", async () => {
+    const f = await fixture();
+    try {
+      await json(join(f.sessionDir, ".hook-cancel-transaction.json"), { phase: "prepared", session_id: f.sessionId });
+      const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+      assertValueFreeDenial(await preTool(f, "omx cancel"), f, content, "prepared cancellation");
+      const stopped = await stop(f);
+      assert.equal(stopped.outputJson?.decision, "block");
+      const rendered = JSON.stringify(stopped.outputJson);
+      for (const secret of [f.cwd, f.sessionId, content]) assert.equal(rendered.includes(secret), false);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("denies a fully forged public-hook caller because no executable trust can be forged", async () => {
+    const f = await fixture();
+    try {
+      const attacker = join(f.cwd, "attacker-bin");
+      await mkdir(attacker); await writeFile(join(attacker, "omx"), "#!/bin/sh\nexit 0\n"); await chmod(join(attacker, "omx"), 0o755);
+      await withEnv({ PATH: attacker }, async () => {
+        const content = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+        const result = await preTool(f, "omx cancel", { thread_id: "unbound-attacker", agent_id: "unbound-attacker" });
+        assertValueFreeDenial(result, f, content, "fully forged public hook");
+      });
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+
+  // #3497: PreToolUse is advisory-only except exact authority-decreasing `omx cancel`.
+  // Former "hostile wrapper/lookalike" hard denies relied on deleted planning/conductor gates.
+  it("still intercepts exact omx cancel as authority-decreasing deny", async () => {
+    const f = await fixture();
+    try {
+      const result = await preTool(f, "omx cancel");
+      assert.equal(result.outputJson?.decision, "block");
+      assert.match(JSON.stringify(result.outputJson), /cancelled_exact_session/);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("does not hard-lock non-exact cancel wrappers after gate removal", async () => {
+    const f = await fixture();
+    try {
+      // Leading exact `omx cancel` still intercepts (and rejects non-exact grammar as invalid_command).
+      // Non-leading wrappers are ordinary Bash under advisory-only PreToolUse.
+      for (const command of [
+        "env omx cancel",
+        "FOO=1 omx cancel",
+        "$(omx) cancel",
+        "`omx` cancel",
+        "./omx cancel",
+        "node --loader attacker.mjs omx cancel",
+      ]) {
+        const result = await preTool(f, command);
+        assert.notEqual(result.outputJson?.decision, "block", command);
+      }
+      const exactHostile = await preTool(f, "omx cancel; rm -rf /");
+      assert.equal(exactHostile.outputJson?.decision, "block");
+      assert.match(JSON.stringify(exactHostile.outputJson), /invalid_command/);
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("denies exact omx cancel when payload session identity is foreign", async () => {
+    const f = await fixture();
+    try {
+      const stateContent = await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8");
+      const result = await preTool(f, "omx cancel", { session_id: "other-session", sessionId: "other-session" });
+      // May deny session_binding / active_state, or not match exact session — must not silently terminalize foreign id.
+      assert.equal(await readFile(join(f.sessionDir, "autopilot-state.json"), "utf8"), stateContent);
+      if (result.outputJson?.decision === "block") {
+        assert.match(JSON.stringify(result.outputJson), /session_binding|active_state|actor_authority|invalid_command|cancelled_exact_session/);
+      }
+    } finally { await rm(f.cwd, { recursive: true, force: true }); }
+  });
+
+  it("R-4 documents payload-bound identity and ambient same-euid target-root selection", async () => {
+    const source = await readFile(resolve(process.cwd(), "src/scripts/codex-native-hook.ts"), "utf8");
+    assert.match(source, /identity matching is payload-bound while target-root\s+\/\/ selection remains ambient and same-euid trusted/);
+  });
+});

package/src/scripts/__tests__/issue-3311-ultragoal-native-outside-tmux.test.ts

@@ -0,0 +1,177 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, before, describe, it } from "node:test";
+
+import { dispatchCodexNativeHook } from "../codex-native-hook.js";
+import { TEAM_TMUX_CAPABILITY_WARNING } from "../../hooks/native/capability-warnings.js";
+
+/**
+ * Issue #3311 originally hard-blocked standalone Ultragoal activation on Codex App
+ * (native outside-tmux) because owner/tmux provenance was unreachable.
+ *
+ * Issue #3497 / epic #3491 C6 deletes that hard gate: ordinary path (including
+ * ultragoal) must complete without PreToolUse locks on Codex App. Team remains a
+ * capability warning only.
+ */
+async function writeJson(path: string, value: unknown): Promise<void> {
+  await mkdir(join(path, ".."), { recursive: true }).catch(() => {});
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+async function writeLeaderSessionFixture(
+  stateDir: string,
+  sessionId: string,
+  leaderThreadId: string,
+  cwd: string,
+): Promise<void> {
+  await mkdir(join(stateDir, "sessions", sessionId), { recursive: true });
+  await writeJson(join(stateDir, "session.json"), {
+    session_id: sessionId,
+    native_session_id: leaderThreadId,
+    cwd,
+  });
+  await writeJson(join(stateDir, "subagent-tracking.json"), {
+    schemaVersion: 1,
+    sessions: {
+      [sessionId]: {
+        session_id: sessionId,
+        leader_thread_id: leaderThreadId,
+        threads: {
+          [leaderThreadId]: { thread_id: leaderThreadId, kind: "leader" },
+        },
+      },
+    },
+  });
+}
+
+function assertNotHardLocked(outputJson: Record<string, unknown> | null | undefined): void {
+  if (!outputJson) return;
+  assert.notEqual(outputJson.decision, "block");
+  const permission = (outputJson.hookSpecificOutput as { permissionDecision?: string } | undefined)
+    ?.permissionDecision;
+  assert.notEqual(permission, "deny");
+  assert.doesNotMatch(JSON.stringify(outputJson), /OMX-ULTRAGOAL-NO-OWNER/);
+}
+
+describe("issue #3311 / #3497 ultragoal native outside-tmux (ordinary path unlocked)", () => {
+  const previousTmux = process.env.TMUX;
+  const previousTmuxPane = process.env.TMUX_PANE;
+
+  before(() => {
+    delete process.env.TMUX;
+    delete process.env.TMUX_PANE;
+  });
+
+  after(() => {
+    if (previousTmux === undefined) delete process.env.TMUX;
+    else process.env.TMUX = previousTmux;
+    if (previousTmuxPane === undefined) delete process.env.TMUX_PANE;
+    else process.env.TMUX_PANE = previousTmuxPane;
+  });
+
+  it("allows primary '$ultragoal' UserPromptSubmit activation on native App outside tmux", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-3311-prompt-"));
+    try {
+      const result = await dispatchCodexNativeHook(
+        {
+          hook_event_name: "UserPromptSubmit",
+          prompt: "$ultragoal implement a tiny fix",
+          cwd,
+          session_id: "sess-3311-prompt",
+          source: "native",
+        },
+        { cwd },
+      );
+      assert.doesNotMatch(String(result.skillState?.transition_error ?? ""), /OMX-ULTRAGOAL-NO-OWNER/);
+      assertNotHardLocked(result.outputJson as Record<string, unknown> | null);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("does not hard-block standalone-ultragoal Conductor activation on native App outside tmux (Bash state write)", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-3311-bash-"));
+    try {
+      const stateDir = join(cwd, ".omx", "state");
+      const sessionId = "sess-3311-bash-no-owner";
+      const leaderThreadId = "thread-3311-bash-no-owner";
+      await writeLeaderSessionFixture(stateDir, sessionId, leaderThreadId, cwd);
+
+      const activation = JSON.stringify({
+        mode: "ultragoal",
+        active: true,
+        state: { current_phase: "planning" },
+      });
+      const result = await dispatchCodexNativeHook(
+        {
+          hook_event_name: "PreToolUse",
+          cwd,
+          session_id: sessionId,
+          thread_id: leaderThreadId,
+          agent_id: leaderThreadId,
+          source: "native",
+          tool_name: "Bash",
+          tool_input: { command: `omx state write --input '${activation}' --json` },
+        },
+        { cwd },
+      );
+      assertNotHardLocked(result.outputJson as Record<string, unknown> | null);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("does not hard-block standalone-ultragoal Conductor activation on native App outside tmux (structured state_write)", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-3311-mcp-"));
+    try {
+      const stateDir = join(cwd, ".omx", "state");
+      const sessionId = "sess-3311-mcp-no-owner";
+      const leaderThreadId = "thread-3311-mcp-no-owner";
+      await writeLeaderSessionFixture(stateDir, sessionId, leaderThreadId, cwd);
+
+      const result = await dispatchCodexNativeHook(
+        {
+          hook_event_name: "PreToolUse",
+          cwd,
+          session_id: sessionId,
+          thread_id: leaderThreadId,
+          agent_id: leaderThreadId,
+          source: "native",
+          tool_name: "mcp__omx_state__state_write",
+          tool_input: { mode: "ultragoal", active: true, state: { current_phase: "planning" } },
+        },
+        { cwd },
+      );
+      assertNotHardLocked(result.outputJson as Record<string, unknown> | null);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("ordinary Bash PreToolUse on Codex App outside tmux completes without deny", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "omx-native-hook-3311-ordinary-"));
+    try {
+      const result = await dispatchCodexNativeHook(
+        {
+          hook_event_name: "PreToolUse",
+          cwd,
+          session_id: "sess-3311-ordinary",
+          source: "native",
+          tool_name: "Bash",
+          tool_input: { command: "echo ordinary-path" },
+        },
+        { cwd },
+      );
+      assertNotHardLocked(result.outputJson as Record<string, unknown> | null);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("emits a team capability warning string for product docs / reuse", () => {
+    assert.match(TEAM_TMUX_CAPABILITY_WARNING, /tmux/i);
+    assert.match(TEAM_TMUX_CAPABILITY_WARNING, /Capability warning/i);
+  });
+});

package/src/scripts/__tests__/issue-3358-ultragoal-cancel-lifecycle.test.ts

@@ -0,0 +1,201 @@
+import assert from "node:assert/strict";
+import { realpathSync } from "node:fs";
+import { mkdtemp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { describe, it } from "node:test";
+
+import { dispatchCodexNativeHook } from "../codex-native-hook.js";
+import { normalizeSkillActiveState, syncSkillStateFromTurn } from "../notify-hook/auto-nudge.js";
+
+/**
+ * Issue #3358 Ultragoal cancellation lifecycle, updated for #3497:
+ * exact `omx cancel` remains an authority-decreasing PreToolUse deny path;
+ * non-exact wrappers are not hard-locked by deleted workflow gates.
+ */
+
+async function writeJson(path: string, value: unknown): Promise<void> {
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+async function withTrustedWorkspaceOmxCli<T>(cwd: string, run: () => Promise<T>): Promise<T> {
+  const binDir = join(cwd, "node_modules", ".bin");
+  await mkdir(binDir, { recursive: true });
+  await symlink(realpathSync(resolve(process.cwd(), "dist", "cli", "omx.js")), join(binDir, "omx"));
+  const inherited = Object.fromEntries(
+    ["PATH", "OMX_ROOT", "OMX_STATE_ROOT", "OMX_TEAM_STATE_ROOT", "OMX_SESSION_ID"]
+      .map((name) => [name, process.env[name]]),
+  );
+  process.env.PATH = `${binDir}:${dirname(process.execPath)}:/usr/bin:/bin`;
+  delete process.env.OMX_ROOT;
+  delete process.env.OMX_STATE_ROOT;
+  delete process.env.OMX_TEAM_STATE_ROOT;
+  delete process.env.OMX_SESSION_ID;
+  try {
+    return await run();
+  } finally {
+    for (const [name, value] of Object.entries(inherited)) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  }
+}
+
+async function fixture() {
+  const cwd = await mkdtemp(join(tmpdir(), "omx-3358-"));
+  const stateDir = join(cwd, ".omx", "state");
+  const sessionId = "sess-3358";
+  const threadId = "thread-3358";
+  const sessionDir = join(stateDir, "sessions", sessionId);
+  await mkdir(sessionDir, { recursive: true });
+  await writeJson(join(stateDir, "session.json"), {
+    session_id: sessionId,
+    native_session_id: threadId,
+    cwd,
+  });
+  await writeJson(join(stateDir, "subagent-tracking.json"), {
+    schemaVersion: 1,
+    sessions: {
+      [sessionId]: {
+        session_id: sessionId,
+        leader_thread_id: threadId,
+        threads: { [threadId]: { thread_id: threadId, kind: "leader" } },
+      },
+    },
+  });
+  await writeJson(join(sessionDir, "ultragoal-state.json"), {
+    active: true,
+    mode: "ultragoal",
+    current_phase: "executing",
+    session_id: sessionId,
+    thread_id: threadId,
+    workingDirectory: cwd,
+  });
+  await writeJson(join(sessionDir, "skill-active-state.json"), {
+    active: true,
+    skill: "ultragoal",
+    phase: "executing",
+    session_id: sessionId,
+    thread_id: threadId,
+    active_skills: [{
+      active: true,
+      skill: "ultragoal",
+      phase: "executing",
+      session_id: sessionId,
+      thread_id: threadId,
+    }],
+  });
+  return { cwd, stateDir, sessionDir, sessionId, threadId };
+}
+
+function preTool(f: Awaited<ReturnType<typeof fixture>>, command: string) {
+  return dispatchCodexNativeHook({
+    hook_event_name: "PreToolUse",
+    cwd: f.cwd,
+    session_id: f.threadId,
+    thread_id: f.threadId,
+    agent_id: f.threadId,
+    tool_name: "Bash",
+    tool_input: { command },
+  }, { cwd: f.cwd });
+}
+
+describe("issue #3358 Ultragoal cancellation lifecycle (#3497)", () => {
+  it("exact omx cancel remains a PreToolUse deny path for active ultragoal", async () => {
+    const f = await fixture();
+    try {
+      const result = await withTrustedWorkspaceOmxCli(f.cwd, () => preTool(f, "omx cancel --force"));
+      assert.equal(result.outputJson?.decision, "block");
+      assert.match(
+        JSON.stringify(result.outputJson),
+        /cancelled_exact_session|invalid_command|session_binding|actor_authority|active_state/,
+      );
+    } finally {
+      await rm(f.cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("cancels after notify preserves attached-tmux dual-session identity", async () => {
+    const f = await fixture();
+    try {
+      const skillPath = join(f.sessionDir, "skill-active-state.json");
+      await syncSkillStateFromTurn(f.stateDir, {
+        cwd: f.cwd,
+        "last-assistant-message": "Implementation continues.",
+      }, f.sessionId, {
+        targetSessionId: f.sessionId,
+        ownerCodexSessionId: f.sessionId,
+        allowedOwnerCodexSessionIds: [f.sessionId, f.threadId],
+        allowedStorageSessionIds: [f.sessionId, f.threadId],
+        targetRelation: "pointer-alias",
+        thread: { kind: "root-or-drift" },
+        legacyAdoption: "deny",
+        globalSideEffects: "allow",
+      });
+      const afterNotify = JSON.parse(await readFile(skillPath, "utf8"));
+      assert.equal(afterNotify.session_id, f.sessionId);
+      assert.equal(afterNotify.thread_id, f.threadId);
+      assert.equal(afterNotify.active_skills.length, 1);
+      assert.equal(afterNotify.owner_codex_session_id, f.sessionId);
+
+      const result = await withTrustedWorkspaceOmxCli(f.cwd, () => preTool(f, "omx cancel --force"));
+      assert.equal(result.outputJson?.decision, "block");
+      assert.match(JSON.stringify(result.outputJson), /cancelled_exact_session/);
+
+      const skill = JSON.parse(await readFile(skillPath, "utf8"));
+      const ultragoal = JSON.parse(await readFile(join(f.sessionDir, "ultragoal-state.json"), "utf8"));
+      assert.equal(skill.active, false);
+      assert.equal(ultragoal.active, false);
+    } finally {
+      await rm(f.cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps foreign notify owners denied without changing lifecycle state", async () => {
+    const f = await fixture();
+    try {
+      const skillPath = join(f.sessionDir, "skill-active-state.json");
+      const ultragoalPath = join(f.sessionDir, "ultragoal-state.json");
+      const stored = JSON.parse(await readFile(skillPath, "utf8"));
+      await writeJson(skillPath, normalizeSkillActiveState({
+        ...stored,
+        owner_codex_session_id: "foreign-owner",
+      }));
+      const beforeSkill = await readFile(skillPath, "utf8");
+      const beforeUltragoal = await readFile(ultragoalPath, "utf8");
+
+      const result = await withTrustedWorkspaceOmxCli(f.cwd, () => preTool(f, "omx cancel --force"));
+      assert.equal(result.outputJson?.decision, "block");
+      assert.match(JSON.stringify(result.outputJson), /active_state/);
+      assert.equal(await readFile(skillPath, "utf8"), beforeSkill);
+      assert.equal(await readFile(ultragoalPath, "utf8"), beforeUltragoal);
+    } finally {
+      await rm(f.cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("does not hard-lock non-leading cancel wrappers after gate removal", async () => {
+    const f = await fixture();
+    try {
+      const before = await readFile(join(f.sessionDir, "skill-active-state.json"), "utf8");
+      const result = await preTool(f, "env omx cancel --force");
+      assert.notEqual(result.outputJson?.decision, "block");
+      assert.equal(await readFile(join(f.sessionDir, "skill-active-state.json"), "utf8"), before);
+    } finally {
+      await rm(f.cwd, { recursive: true, force: true });
+    }
+  });
+
+  it("rejects invalid exact cancel grammar without terminalizing", async () => {
+    const f = await fixture();
+    try {
+      const before = await readFile(join(f.sessionDir, "skill-active-state.json"), "utf8");
+      const result = await withTrustedWorkspaceOmxCli(f.cwd, () => preTool(f, "omx cancel --please"));
+      assert.equal(result.outputJson?.decision, "block");
+      assert.match(JSON.stringify(result.outputJson), /invalid_command|actor_authority|active_state|session_binding/);
+      assert.equal(await readFile(join(f.sessionDir, "skill-active-state.json"), "utf8"), before);
+    } finally {
+      await rm(f.cwd, { recursive: true, force: true });
+    }
+  });
+});

package/src/scripts/__tests__/issue-3369-autopilot-ralplan-state-machine.test.ts

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { dispatchCodexNativeHook } from "../codex-native-hook.js";
+import { executeStateOperation } from "../../state/operations.js";
+
+const omxBin = fileURLToPath(new URL("../../cli/omx.js", import.meta.url));
+
+async function writeJson(path: string, value: unknown): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(value, null, 2));
+}
+
+function runOmx(cwd: string, env: NodeJS.ProcessEnv, ...args: string[]) {
+  return spawnSync(process.execPath, [omxBin, ...args], {
+    cwd,
+    encoding: "utf-8",
+    env: { ...process.env, ...env },
+  });
+}
+
+async function withEnv<T>(values: Record<string, string | undefined>, run: () => Promise<T>): Promise<T> {
+  const before = new Map(Object.keys(values).map((name) => [name, process.env[name]]));
+  try {
+    for (const [name, value] of Object.entries(values)) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+    return await run();
+  } finally {
+    for (const [name, value] of before) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  }
+}
+
+describe("issue #3369 Autopilot Ralplan state-machine self-lock", () => {
+});