oh-my-codex 0.20.3 → 0.21.0

package/dist/cli/__tests__/setup-install-mode.test.js

@@ -1,11 +1,11 @@
 import { after, before, describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { existsSync, lstatSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, symlink, writeFile, stat, } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { parse as parseToml } from "@iarna/toml";
-import { decideWindowsNativeHookShimReference, setNativeHookTransactionFailureInjectorForTest, setSetupLatePhaseFailureInjectorForTest, setNativeHookTransactionPlatformForTest, setNativeHookTransactionRegularFileSyncForTest, setNativeHookTransactionTemporaryPathForTest, setup, } from "../setup.js";
+import { decideWindowsNativeHookShimReference, setNativeHookClaimJournalDurabilityForTest, setNativeHookTransactionArtifactLstatForTest, setNativeHookTransactionFailureInjectorForTest, setSetupLatePhaseFailureInjectorForTest, setNativeHookTransactionPlatformForTest, setNativeHookTransactionRegularFileSyncForTest, setNativeHookTransactionTemporaryPathForTest, setup, } from "../setup.js";
 import { resolveSetupRefreshArgs } from "../update.js";
 import { uninstall } from "../uninstall.js";
 import { OMX_DEVELOPER_INSTRUCTIONS, OMX_PLUGIN_DEVELOPER_INSTRUCTIONS, } from "../../config/generator.js";
@@ -680,7 +680,7 @@ describe("omx setup install mode behavior", () => {
                 assert.match(output, /Next steps:/);
                 assert.match(output, /Registered Codex marketplace oh-my-codex-local supplies OMX skills and workflow surfaces/);
                 assert.match(output, /Native agent role TOML files written to \.codex\/agents\//);
-                for (const role of ["architect", "critic", "scholastic"]) {
+                for (const role of ["architect", "critic"]) {
                     const tomlPath = join(codexHomeDir, "agents", `${role}.toml`);
                     assert.equal(existsSync(tomlPath), true, `${role}.toml should exist`);
                     const toml = await readFile(tomlPath, "utf-8");
@@ -707,7 +707,8 @@ describe("omx setup install mode behavior", () => {
                 const cacheSkillsDir = join(codexHomeDir, "plugins", "cache", "oh-my-codex-local", "oh-my-codex", pkg.version, "skills");
                 assert.equal(existsSync(join(cacheSkillsDir, "team", "SKILL.md")), false);
                 assert.equal(existsSync(join(cacheSkillsDir, "worker", "SKILL.md")), false);
-                assert.equal(existsSync(join(cacheSkillsDir, "ralph", "SKILL.md")), true);
+                assert.equal(existsSync(join(cacheSkillsDir, "ralph", "SKILL.md")), false, "ralph is a sunset stub; not installable in plugin cache");
+                assert.equal(existsSync(join(cacheSkillsDir, "ultragoal", "SKILL.md")), true, "ultragoal remains installable");
                 assert.equal(existsSync(join(codexHomeDir, "agents", "team-executor.toml")), false);
                 assert.equal(existsSync(join(codexHomeDir, "agents", "executor.toml")), true);
             });
@@ -910,7 +911,7 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
-    it("invalidates stale plugin discovery caches so updated plugin skills refresh", async () => {
+    it("preserves stale plugin snapshots while publishing the current complete snapshot", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
             await withIsolatedUserHome(wd, async (codexHomeDir) => {
@@ -919,9 +920,9 @@ describe("omx setup install mode behavior", () => {
                     const output = await captureConsoleOutput(async () => {
                         await setup({ scope: "user", installMode: "plugin" });
                     });
-                    assert.equal(existsSync(join(cacheDir, "skills", "old-only", "SKILL.md")), false);
+                    assert.equal(existsSync(join(cacheDir, "skills", "old-only", "SKILL.md")), true);
                     assert.equal(existsSync(join(await packagedPluginCacheDir(codexHomeDir), "skills", "ask", "SKILL.md")), true);
-                    assert.match(output, /Invalidated 1 stale Codex plugin discovery cache entry/);
+                    assert.doesNotMatch(output, /Invalidated .* stale Codex plugin discovery cache/);
                     assert.equal(existsSync(join(codexHomeDir, "skills", "old-only", "SKILL.md")), false);
                 });
             });
@@ -930,7 +931,7 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
-    it("invalidates old versioned plugin cache dirs while materializing the current cache", async () => {
+    it("retains old versioned plugin cache dirs while materializing the current cache", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
             await withIsolatedUserHome(wd, async (codexHomeDir) => {
@@ -940,13 +941,13 @@ describe("omx setup install mode behavior", () => {
                         await setup({ scope: "user", installMode: "plugin" });
                     });
                     const currentCacheDir = await packagedPluginCacheDir(codexHomeDir);
-                    assert.equal(existsSync(oldCacheDir), false);
+                    assert.equal(existsSync(oldCacheDir), true);
                     assert.equal(existsSync(join(currentCacheDir, ".codex-plugin", "plugin.json")), true);
                     assert.equal(existsSync(join(currentCacheDir, "hooks", "hooks.json")), true);
                     assert.equal(existsSync(join(currentCacheDir, "hooks", "codex-native-hook.mjs")), true);
                     assert.equal(existsSync(join(currentCacheDir, "hooks", "omx-command.json")), true);
                     assert.equal(existsSync(join(currentCacheDir, "skills", "ask", "SKILL.md")), true);
-                    assert.match(output, /Invalidated 1 stale Codex plugin discovery cache entry/);
+                    assert.doesNotMatch(output, /Invalidated .* stale Codex plugin discovery cache/);
                     assert.match(output, /Installed local Codex plugin cache/);
                     assert.doesNotMatch(output, /Retained .* old versioned Codex plugin cache/);
                 });
@@ -956,7 +957,42 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
-    it("invalidates same-version plugin caches when hook file contents drift", async () => {
+    it("retains current, previous, and pinned snapshots while retiring older unpinned managed roots", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-plugin-cache-bounded-"));
+        try {
+            const codexHomeDir = join(wd, ".codex");
+            const cacheBase = join(codexHomeDir, "plugins", "cache", "oh-my-codex-local", "oh-my-codex");
+            const seed = async (version, pinned = false) => {
+                const dir = join(cacheBase, version);
+                await mkdir(join(dir, ".codex-plugin"), { recursive: true });
+                await mkdir(join(dir, "hooks"), { recursive: true });
+                await mkdir(join(dir, "skills"), { recursive: true });
+                await writeFile(join(dir, ".codex-plugin", "plugin.json"), JSON.stringify({ name: "oh-my-codex", version, skills: "./skills/", hooks: "./hooks/hooks.json" }));
+                if (pinned)
+                    await writeFile(join(dir, ".omx-live-pin"), "pinned\n");
+                return dir;
+            };
+            const previous = await seed("0.20.4");
+            const older = await seed("0.20.3");
+            const pinned = await seed("0.20.2", true);
+            const foreign = join(cacheBase, "foreign");
+            await mkdir(join(foreign, ".codex-plugin"), { recursive: true });
+            await writeFile(join(foreign, ".codex-plugin", "plugin.json"), JSON.stringify({ name: "foreign-plugin", version: "foreign" }));
+            const packagedMarketplace = await resolvePackagedOmxMarketplace(packageRoot);
+            assert.ok(packagedMarketplace);
+            const result = await materializePackagedOmxPluginCache(codexHomeDir, packagedMarketplace);
+            assert.equal(result.status, "materialized");
+            assert.equal(existsSync(previous), true);
+            assert.equal(existsSync(older), false);
+            assert.equal(existsSync(pinned), true);
+            assert.equal(existsSync(foreign), true);
+            assert.deepEqual(result.retiredDirs, [older]);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("does not rewrite a published same-version plugin snapshot when hook contents drift", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
             await withIsolatedUserHome(wd, async (codexHomeDir) => {
@@ -966,9 +1002,9 @@ describe("omx setup install mode behavior", () => {
                         await setup({ scope: "user", installMode: "plugin" });
                     });
                     const refreshedHooks = JSON.parse(await readFile(join(cacheDir, "hooks", "hooks.json"), "utf-8"));
-                    assert.equal(refreshedHooks.hooks?.PreToolUse?.[0]?.matcher, undefined);
-                    assert.match(output, /Invalidated 1 stale Codex plugin discovery cache entry/);
-                    assert.match(output, /Installed local Codex plugin cache/);
+                    assert.equal(refreshedHooks.hooks?.PreToolUse?.[0]?.matcher, "Bash");
+                    assert.doesNotMatch(output, /Invalidated .* stale Codex plugin discovery cache/);
+                    assert.match(output, /Local Codex plugin cache already exposes packaged OMX skills/);
                 });
             });
         }
@@ -976,7 +1012,7 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
-    it("invalidates same-version plugin caches when the pinned hook launcher drifts", async () => {
+    it("does not rewrite a published same-version plugin snapshot when its launcher drifts", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
             await withIsolatedUserHome(wd, async (codexHomeDir) => {
@@ -986,10 +1022,10 @@ describe("omx setup install mode behavior", () => {
                         await setup({ scope: "user", installMode: "plugin" });
                     });
                     const launcher = JSON.parse(await readFile(join(cacheDir, "hooks", "omx-command.json"), "utf-8"));
-                    assert.equal(launcher.command, process.execPath);
-                    assert.deepEqual(launcher.argsPrefix, [join(packageRoot, "dist", "cli", "omx.js")]);
-                    assert.match(output, /Invalidated 1 stale Codex plugin discovery cache entry/);
-                    assert.match(output, /Installed local Codex plugin cache/);
+                    assert.equal(launcher.command, "/stale/node");
+                    assert.deepEqual(launcher.argsPrefix, ["/stale/omx.js"]);
+                    assert.doesNotMatch(output, /Invalidated .* stale Codex plugin discovery cache/);
+                    assert.match(output, /Local Codex plugin cache already exposes packaged OMX skills/);
                 });
             });
         }
@@ -997,7 +1033,7 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
-    it("materializes replacement plugin caches without removing the existing cache root", async () => {
+    it("refuses to replace an already published plugin cache root", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
             await withIsolatedUserHome(wd, async (codexHomeDir) => {
@@ -1017,19 +1053,19 @@ describe("omx setup install mode behavior", () => {
                         assert.equal(existsSync(join(cacheDir, "hooks", "codex-native-hook.mjs")), true);
                     },
                 });
-                assert.equal(observedPreparedCache, true, "test hook should observe cache root during replacement");
+                assert.equal(observedPreparedCache, false, "published cache roots are immutable");
                 assert.equal(existsSync(cacheDir), true);
                 assert.equal(existsSync(join(cacheDir, ".codex-plugin", "plugin.json")), true);
                 assert.equal(existsSync(join(cacheDir, "hooks", "codex-native-hook.mjs")), true);
                 assert.equal(existsSync(join(cacheDir, "hooks", "omx-command.json")), true);
-                assert.equal(existsSync(staleOnlyPath), false, "overlay cleanup should remove stale files after refreshed files are present");
+                assert.equal(existsSync(staleOnlyPath), true, "published cache roots must remain byte-compatible for pinned readers");
             });
         }
         finally {
             await rm(wd, { recursive: true, force: true });
         }
     });
-    it("reports stale plugin discovery cache invalidation during dry-run without deleting it", async () => {
+    it("leaves stale plugin snapshots untouched during dry-run", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         try {
             await withIsolatedUserHome(wd, async (codexHomeDir) => {
@@ -1039,7 +1075,7 @@ describe("omx setup install mode behavior", () => {
                         await setup({ scope: "user", installMode: "plugin", dryRun: true });
                     });
                     assert.equal(existsSync(cacheDir), true);
-                    assert.match(output, /Would invalidate 1 stale Codex plugin discovery cache entry/);
+                    assert.doesNotMatch(output, /Would invalidate .* stale Codex plugin discovery cache/);
                 });
             });
         }
@@ -1065,6 +1101,23 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("rejects symlinked plugin cache namespace components", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-plugin-cache-symlink-"));
+        try {
+            const codexHomeDir = join(wd, "codex-home");
+            const foreignPlugins = join(wd, "foreign-plugins");
+            await mkdir(codexHomeDir, { recursive: true });
+            await mkdir(foreignPlugins, { recursive: true });
+            await symlink(foreignPlugins, join(codexHomeDir, "plugins"));
+            const packagedMarketplace = await resolvePackagedOmxMarketplace(packageRoot);
+            assert.ok(packagedMarketplace);
+            await assert.rejects(materializePackagedOmxPluginCache(codexHomeDir, packagedMarketplace), /symbolic link|non-directory namespace component/);
+            assert.deepEqual(await readdir(foreignPlugins), []);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("does not prompt for install mode during project-scoped setup", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-install-mode-"));
         let promptCalls = 0;
@@ -1386,11 +1439,13 @@ describe("omx setup install mode behavior", () => {
                     assert.match(config, /User-installed skills may still live under ~\/.codex\/skills/);
                     assert.match(config, /native agent roles are installed as setup-owned Codex agent TOML files in plugin mode so agent_type routing works/i);
                     assert.match(config, /When the native surface exposes `agent_type` role routing, set `agent_type` to an installed role and never omit it for OMX work/i);
-                    assert.match(config, /role_routing_unavailable/i);
+                    assert.match(config, /When it reports `role_routing_unavailable` and adapted Ralplan authority is requested/i);
                     assert.match(config, /do not fabricate `agent_type`/i);
                     assert.match(config, /omx ralplan preflight --json/i);
                     assert.match(config, /unsupported_documented_leader_proof/i);
+                    assert.match(config, /Ordinary work remains under its own workflow gates/i);
                     assert.match(config, /never fake the role via a prompt label/i);
+                    assert.doesNotMatch(config, /before Ralplan planning, state, HUD, runtime, or delegation work, run `omx ralplan preflight --json`/i);
                     assert.doesNotMatch(config, /Native subagents live in \.codex\/agents/);
                     assert.doesNotMatch(config, /Treat installed prompts as narrower execution surfaces/);
                     assert.match(config, /^plugin_hooks = true$/m);
@@ -1518,8 +1573,11 @@ describe("omx setup install mode behavior", () => {
                     const config = await readFile(configPath, "utf-8");
                     assert.match(config, /<omx version=\\"1\\">You have oh-my-codex installed through Codex plugin mode/);
                     assert.match(config, /When the native surface exposes `agent_type` role routing, set `agent_type` to an installed role and never omit it for OMX work/i);
-                    assert.match(config, /role_routing_unavailable/i);
+                    assert.match(config, /When it reports `role_routing_unavailable` and adapted Ralplan authority is requested/i);
+                    assert.match(config, /Ordinary work remains under its own workflow gates/i);
                     assert.match(config, /omx ralplan preflight --json/i);
+                    assert.match(config, /unsupported_documented_leader_proof/i);
+                    assert.doesNotMatch(config, /before Ralplan planning, state, HUD, runtime, or delegation work, run `omx ralplan preflight --json`/i);
                     assert.equal((config.match(/^developer_instructions\s*=/gm) ?? []).length, 1);
                 });
             });
@@ -2409,6 +2467,180 @@ describe("omx setup install mode behavior", () => {
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("completes Windows native-hook transactions with one directory fsync EPERM warning", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-windows-directory-fsync-eperm-"));
+        const resetPlatform = setNativeHookTransactionPlatformForTest("win32");
+        const resetRegularSync = setNativeHookTransactionRegularFileSyncForTest(async () => undefined);
+        let directorySyncCalls = 0;
+        const stderr = [];
+        const originalStderrWrite = process.stderr.write;
+        process.stderr.write = ((chunk) => {
+            stderr.push(String(chunk));
+            return true;
+        });
+        const resetDurability = setNativeHookClaimJournalDurabilityForTest({
+            platform: "win32",
+            syncRegularFile: async () => "synced",
+            syncDirectory: async () => {
+                directorySyncCalls += 1;
+                return "unsupported-windows-eperm";
+            },
+        });
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    await writeFile(join(codexHomeDir, "config.toml"), 'notify = ["node", "/tmp/user-notify.js"]\n');
+                    await setup({ scope: "user", installMode: "legacy", skipNativeAgentRefresh: true });
+                    assert.ok(directorySyncCalls > 0);
+                    assert.equal(existsSync(join(codexHomeDir, "hooks.json")), true);
+                    assert.equal(existsSync(buildManagedCodexNativeHookWindowsShimPath(codexHomeDir)), true);
+                    assert.equal(existsSync(join(codexHomeDir, "config.toml")), true);
+                });
+                assert.deepEqual(stderr.filter((line) => line.includes("native-hook setup")), ["[omx] warning: Windows EPERM directory fsync unsupported in native-hook setup; operation succeeded with degraded durability.\n"]);
+            });
+        }
+        finally {
+            process.stderr.write = originalStderrWrite;
+            resetDurability();
+            resetRegularSync();
+            resetPlatform();
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    for (const fixture of [
+        { platform: "win32", code: "EACCES" },
+        { platform: "linux", code: "EPERM" },
+    ]) {
+        it(`fails native-hook setup for ${fixture.platform} directory fsync ${fixture.code}`, async () => {
+            const wd = await mkdtemp(join(tmpdir(), "omx-setup-directory-fsync-fatal-"));
+            const resetPlatform = setNativeHookTransactionPlatformForTest("win32");
+            const resetDurability = setNativeHookClaimJournalDurabilityForTest({
+                platform: fixture.platform,
+                syncRegularFile: async () => "synced",
+                syncDirectory: async () => {
+                    throw Object.assign(new Error(`${fixture.code}: fsync`), { code: fixture.code });
+                },
+            });
+            try {
+                await withIsolatedUserHome(wd, async () => {
+                    await withTempCwd(wd, async () => {
+                        await assert.rejects(setup({ scope: "user", installMode: "legacy", skipNativeAgentRefresh: true }), new RegExp(fixture.code));
+                    });
+                });
+            }
+            finally {
+                resetDurability();
+                resetPlatform();
+                await rm(wd, { recursive: true, force: true });
+            }
+        });
+    }
+    it("accepts Windows mode synthesis during a newly created hook read-back", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-windows-mode-readback-"));
+        const resetPlatform = setNativeHookTransactionPlatformForTest("win32");
+        const successfulStatsByPath = new Map();
+        const synthesizedPaths = new Set();
+        const resetArtifactLstat = setNativeHookTransactionArtifactLstatForTest(async (path) => {
+            const status = await lstat(path);
+            if (!basename(path).includes("hooks.json"))
+                return status;
+            const successfulStats = successfulStatsByPath.get(path) ?? 0;
+            successfulStatsByPath.set(path, successfulStats + 1);
+            const mode = successfulStats === 0 ? 0o600 : 0o666;
+            if (successfulStats === 1)
+                synthesizedPaths.add(path);
+            return new Proxy(status, {
+                get(target, property, receiver) {
+                    if (property === "mode")
+                        return (target.mode & ~0o7777) | mode;
+                    return Reflect.get(target, property, receiver);
+                },
+            });
+        });
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    await setup({ scope: "user", installMode: "legacy", skipNativeAgentRefresh: true });
+                    assert.equal(existsSync(join(codexHomeDir, "hooks.json")), true);
+                });
+            });
+            assert.ok(synthesizedPaths.size >= 2);
+        }
+        finally {
+            resetArtifactLstat();
+            resetPlatform();
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("rejects Windows mode drift after a stable hook read-back", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-windows-post-read-mode-drift-"));
+        const resetPlatform = setNativeHookTransactionPlatformForTest("win32");
+        const tempPath = (path, purpose) => join(dirname(path), `.${basename(path)}.post-read-${purpose}.tmp`);
+        const resetTemporaryPath = setNativeHookTransactionTemporaryPathForTest(tempPath);
+        let injected = false;
+        const resetFailureInjector = setNativeHookTransactionFailureInjectorForTest((stage, artifact) => {
+            if (stage !== "before_rename" || artifact.kind !== "hooks" || injected)
+                return;
+            injected = true;
+            chmodSync(tempPath(artifact.path, "write"), 0o666);
+        });
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    await assert.rejects(setup({ scope: "user", installMode: "legacy", skipNativeAgentRefresh: true }), /read-back changed/);
+                    assert.equal(existsSync(join(codexHomeDir, "hooks.json")), false);
+                });
+            });
+            assert.equal(injected, true);
+        }
+        finally {
+            resetFailureInjector();
+            resetTemporaryPath();
+            resetPlatform();
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+    it("rejects Windows writable-bit drift with unchanged bytes and file identity", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-setup-windows-readonly-drift-"));
+        const resetPlatform = setNativeHookTransactionPlatformForTest("win32");
+        const tempPath = (path, purpose) => join(dirname(path), `.${basename(path)}.readonly-${purpose}.tmp`);
+        const resetTemporaryPath = setNativeHookTransactionTemporaryPathForTest(tempPath);
+        let checkedIdentity = 0;
+        const resetFailureInjector = setNativeHookTransactionFailureInjectorForTest((stage, artifact) => {
+            if (stage !== "before_rename")
+                return;
+            const temporaryPath = tempPath(artifact.path, "write");
+            const before = lstatSync(temporaryPath);
+            const beforeBytes = readFileSync(temporaryPath);
+            chmodSync(temporaryPath, 0o444);
+            const after = lstatSync(temporaryPath);
+            assert.deepEqual(readFileSync(temporaryPath), beforeBytes);
+            assert.equal(after.dev, before.dev);
+            assert.equal(after.ino, before.ino);
+            assert.equal(after.nlink, before.nlink);
+            assert.notEqual(after.mode & 0o200, before.mode & 0o200);
+            checkedIdentity += 1;
+        });
+        try {
+            await withIsolatedUserHome(wd, async (codexHomeDir) => {
+                await withTempCwd(wd, async () => {
+                    const configPath = join(codexHomeDir, "config.toml");
+                    const original = 'notify = ["node", "/tmp/user-notify.js"]\n';
+                    await writeFile(configPath, original);
+                    chmodSync(configPath, 0o600);
+                    await assert.rejects(setup({ scope: "user", installMode: "legacy", skipNativeAgentRefresh: true }), /read-back changed/);
+                    assert.equal(await readFile(configPath, "utf-8"), original);
+                });
+            });
+            assert.equal(checkedIdentity, 1);
+        }
+        finally {
+            resetFailureInjector();
+            resetTemporaryPath();
+            resetPlatform();
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("orders Windows plugin-transition mutations as hooks, shim, then config", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-setup-windows-hook-removal-"));
         const forwardOrder = [];