oh-my-codex 0.21.3 → 0.21.5

package/Cargo.lock

@@ -32,7 +32,7 @@ checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
 
 [[package]]
 name = "omx-api"
-version = "0.20.5"
+version = "0.21.5"
 dependencies = [
  "serde",
  "serde_json",
@@ -40,14 +40,14 @@ dependencies = [
 
 [[package]]
 name = "omx-explore-harness"
-version = "0.20.5"
+version = "0.21.5"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "omx-mux"
-version = "0.20.5"
+version = "0.21.5"
 dependencies = [
  "serde",
  "serde_json",
@@ -55,7 +55,7 @@ dependencies = [
 
 [[package]]
 name = "omx-runtime"
-version = "0.20.5"
+version = "0.21.5"
 dependencies = [
  "fs2",
  "libc",
@@ -67,7 +67,7 @@ dependencies = [
 
 [[package]]
 name = "omx-runtime-core"
-version = "0.20.5"
+version = "0.21.5"
 dependencies = [
  "fs2",
  "serde",
@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "omx-sparkshell"
-version = "0.20.5"
+version = "0.21.5"
 dependencies = [
  "omx-mux",
 ]

package/Cargo.toml

@@ -11,7 +11,7 @@ resolver = "2"
 
 [workspace.package]
 
-version = "0.21.3"
+version = "0.21.5"
 
 edition = "2021"
 rust-version = "1.73"

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yeachan-Heo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -375,12 +375,16 @@ These are operator/support surfaces:
   - `omx uninstall` removes OMX-managed wrappers from `.codex/hooks.json` but keeps the file when user hooks remain
 - `omx update` checks npm immediately, installs the newest global OMX build, then reruns the same interactive setup refresh path
 - launch-time update checks are throttled and prompt by default; use `OMX_AUTO_UPDATE=0` to disable them or `OMX_AUTO_UPDATE=defer` to schedule deferred updates without a prompt
-- fresh OMX-managed `gpt-5.6-sol` config seeding now recommends `model_context_window = 250000` and `model_auto_compact_token_limit = 200000`, but only when those keys are missing
+- fresh OMX setup defaults to `gpt-6-astra` across frontier, standard, and spark/fast agents, with the same role reasoning defaults; existing user model configuration and explicit overrides are preserved
 - `.omx-config.json` model/env routing is documented in [the model/env routing reference](./docs/reference/omx-config-schema-routing.md); only edit keys supported by your installed OMX version
 - `omx doctor` verifies the install when something seems wrong; it does not prove that the active Codex profile can make an authenticated model call
 - `omx hud --watch` is a monitoring/status surface, not the primary user workflow
+- Active session teams show their name and worker count beside the OMX version (for example, `[OMX#0.21.4] team:checkout (3 workers) | repo/branch`) in every HUD preset, before long repository labels. When ultragoal is active, the combined ultragoal/team summary also takes priority over repository labels and other modes. Team discovery remains session-scoped; this does not show teams from other sessions or change when team startup publishes active state.
+- Below the summary, each team agent gets a live-refreshing row with its name, last reported state (`working`, `idle`, `blocked`, `done`, `failed`, `draining`, or `unknown`), current task ID, role, tmux pane ID, and update age when available. Columns stay aligned across different name lengths and missing fields; `working` and `done` are green, while `blocked` and `failed` are yellow. The HUD grows to fit the roster and shrinks after the team stops. Missing or malformed status files display `unknown`; a reported `working` state is not a process-liveness check. Membership and status are read without modifying team files.
 - GitGuardex finish progress is opt-in. Add `"guardex": { "enabled": true }` to the project-local `.omx/hud-config.json` to show `gx:<step>/<total> <phase>`; running review/autofix phases animate in the HUD. OMX does not read Guardex state when this flag is absent or false.
 
+Tmux roster height is bounded by live window and leader/HUD geometry, reserving at least half of their shared rows for the leader. Workers that do not fit are represented by a `+N workers` overflow row. The watch loop remeasures after resizing; unknown geometry keeps the HUD compact rather than expanding it unchecked.
+
 For non-team sessions, native Codex hooks are now the canonical lifecycle surface:
 - `plugins/oh-my-codex/hooks/hooks.json` = official plugin-scoped hook registrations for plugin installs
 - `.codex/hooks.json` = legacy/fallback native Codex hook registrations preserved for legacy installs and older Codex versions
@@ -413,6 +417,7 @@ If `Shift+Enter` still submits instead of inserting a newline inside an OMX-mana
 
 - `omx sparkshell <command>` is for shell-native inspection and bounded verification
 - for read-only repository lookups, use normal Codex repository inspection tools/subagents (the deprecated `omx explore` command has been removed)
+- primary and fallback Sparkshell summary models both default to `gpt-6-astra`; set `OMX_SPARKSHELL_FALLBACK_MODEL` to a different model to enable a distinct fallback
 - sparkshell env overrides are intentionally narrow: `OMX_SPARKSHELL_BIN` selects a native sidecar path, `OMX_SPARKSHELL_MODEL` selects the primary summary model, `OMX_SPARKSHELL_FALLBACK_MODEL` selects the retry model, `OMX_SPARKSHELL_MODEL_INSTRUCTIONS_FILE` selects summary instructions, and `OMX_SPARKSHELL_SUMMARY_TIMEOUT_MS` controls the local API summary timeout
 
 Examples:

package/crates/omx-runtime/src/lease_mutex.rs

@@ -0,0 +1,379 @@
+use fs2::FileExt;
+use serde_json::Value;
+use std::io::{self, BufRead, Write};
+#[cfg(unix)]
+use std::os::unix::ffi::OsStrExt;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+const LOCK_TIMEOUT: Duration = Duration::from_secs(34);
+const SAFE_LEAF_SUFFIX: &str = ".mutex";
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    if args.len() != 4 {
+        return Err("lease-mutex requires exactly <absolute-canonical-dir> <expected-dev> <expected-ino> <safe-leaf>".to_string());
+    }
+    let leaf = validate_safe_leaf(&args[3])?;
+    #[cfg(unix)]
+    {
+        let dir = PathBuf::from(&args[0]);
+        if !dir.is_absolute() {
+            return emit_startup_error("lease-mutex directory must be absolute".to_string());
+        }
+        let expected_dev = match parse_identity(&args[1], "expected-dev") {
+            Ok(value) => value,
+            Err(error) => return emit_startup_error(error),
+        };
+        let expected_ino = match parse_identity(&args[2], "expected-ino") {
+            Ok(value) => value,
+            Err(error) => return emit_startup_error(error),
+        };
+        let lease = match UnixLease::open(&dir, expected_dev, expected_ino, leaf) {
+            Ok(lease) => lease,
+            Err(error) => return emit_startup_error(error),
+        };
+        run_protocol(lease)
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = args;
+        Err("lease-mutex unsupported on this platform; native no-follow identity semantics are unavailable".to_string())
+    }
+}
+
+fn validate_safe_leaf(raw: &str) -> Result<String, String> {
+    let valid_hex = raw.strip_suffix(SAFE_LEAF_SUFFIX).is_some_and(|key| {
+        key.len() == 64
+            && key
+                .bytes()
+                .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+    });
+    if !valid_hex {
+        return Err("lease-mutex safe-leaf must match ^[a-f0-9]{64}\\.mutex$".to_string());
+    }
+    Ok(raw.to_string())
+}
+
+fn parse_identity(raw: &str, name: &str) -> Result<u64, String> {
+    raw.parse::<u64>()
+        .map_err(|_| format!("{name} must be a non-negative decimal integer"))
+}
+
+fn run_protocol<L: Lease>(mut lease: L) -> Result<(), String> {
+    let mut stdout = io::BufWriter::new(io::stdout().lock());
+    write_json(
+        &mut stdout,
+        serde_json::json!({"id":0,"ok":true,"ready":true}),
+    )?;
+    let stdin = io::stdin();
+    for line in stdin.lock().lines() {
+        let line = line.map_err(|e| format!("stdin read failed: {e}"))?;
+        if line.trim().is_empty() {
+            continue;
+        }
+        let request: Value = match serde_json::from_str(&line) {
+            Ok(value) => value,
+            Err(error) => {
+                write_json(
+                    &mut stdout,
+                    serde_json::json!({"id":null,"ok":false,"error":format!("invalid JSON request: {error}")}),
+                )?;
+                continue;
+            }
+        };
+        let id = request.get("id").cloned().unwrap_or(Value::Null);
+        let op = request.get("op").and_then(Value::as_str);
+        match op {
+            Some("assert") => match lease.verify() {
+                Ok(()) => write_json(&mut stdout, serde_json::json!({"id":id,"ok":true}))?,
+                Err(error) => write_json(
+                    &mut stdout,
+                    serde_json::json!({"id":id,"ok":false,"error":error}),
+                )?,
+            },
+            Some("close") => match lease.verify() {
+                Ok(()) => {
+                    lease.release()?;
+                    write_json(&mut stdout, serde_json::json!({"id":id,"ok":true}))?;
+                    return Ok(());
+                }
+                Err(error) => {
+                    let release_error = lease.release().err();
+                    let message = match release_error {
+                        Some(release_error) => format!("{error}; {release_error}"),
+                        None => error,
+                    };
+                    write_json(
+                        &mut stdout,
+                        serde_json::json!({"id":id,"ok":false,"error":message}),
+                    )?;
+                    return Ok(());
+                }
+            },
+            Some(other) => write_json(
+                &mut stdout,
+                serde_json::json!({"id":id,"ok":false,"error":format!("unsupported lease-mutex operation: {other}")}),
+            )?,
+            None => write_json(
+                &mut stdout,
+                serde_json::json!({"id":id,"ok":false,"error":"request op must be assert or close"}),
+            )?,
+        }
+    }
+    Ok(())
+}
+
+fn write_json(out: &mut impl Write, value: Value) -> Result<(), String> {
+    serde_json::to_writer(&mut *out, &value)
+        .map_err(|e| format!("stdout JSON write failed: {e}"))?;
+    out.write_all(b"\n")
+        .map_err(|e| format!("stdout write failed: {e}"))?;
+    out.flush().map_err(|e| format!("stdout flush failed: {e}"))
+}
+
+fn emit_startup_error(error: String) -> Result<(), String> {
+    let mut stdout = io::stdout().lock();
+    let _ = write_json(
+        &mut stdout,
+        serde_json::json!({"id":0,"ok":false,"error":error}),
+    );
+    Err(error)
+}
+
+trait Lease {
+    fn verify(&self) -> Result<(), String>;
+    fn release(&mut self) -> Result<(), String>;
+}
+
+#[cfg(unix)]
+struct UnixLease {
+    dir: std::fs::File,
+    mutex: std::fs::File,
+    dir_path: PathBuf,
+    expected_dev: u64,
+    expected_ino: u64,
+    mutex_dev: u64,
+    mutex_ino: u64,
+    leaf: String,
+    held: bool,
+}
+
+#[cfg(unix)]
+impl UnixLease {
+    fn open(
+        path: &Path,
+        expected_dev: u64,
+        expected_ino: u64,
+        leaf: String,
+    ) -> Result<Self, String> {
+        std::fs::canonicalize(path)
+            .map_err(|e| format!("lease-mutex cannot canonicalize directory: {e}"))?;
+        let dir = open_directory(path)?;
+        let dir_identity = stat_fd(dir.as_raw_fd(), "pinned directory")?;
+        if !dir_identity.is_dir {
+            return Err("lease-mutex path is not a directory".to_string());
+        }
+        if dir_identity.dev != expected_dev || dir_identity.ino != expected_ino {
+            return Err(format!("lease-mutex directory identity mismatch: expected dev={expected_dev} ino={expected_ino}, got dev={} ino={}", dir_identity.dev, dir_identity.ino));
+        }
+        let mutex = open_mutex(dir.as_raw_fd(), &leaf)?;
+        let mutex_identity = stat_fd(mutex.as_raw_fd(), "mutex file")?;
+        if !mutex_identity.is_regular || mutex_identity.nlink != 1 {
+            return Err(
+                "lease-mutex mutex leaf must be a regular file with link count 1".to_string(),
+            );
+        }
+        try_lock(&mutex)?;
+        let lease = Self {
+            dir,
+            mutex,
+            dir_path: path.to_path_buf(),
+            expected_dev,
+            expected_ino,
+            mutex_dev: mutex_identity.dev,
+            mutex_ino: mutex_identity.ino,
+            leaf,
+            held: true,
+        };
+        lease.verify()?;
+        Ok(lease)
+    }
+}
+
+#[cfg(unix)]
+impl Lease for UnixLease {
+    fn verify(&self) -> Result<(), String> {
+        if !self.held {
+            return Err("lease-mutex lock is no longer held".to_string());
+        }
+        let pinned = stat_fd(self.dir.as_raw_fd(), "pinned directory")?;
+        if !pinned.is_dir || pinned.dev != self.expected_dev || pinned.ino != self.expected_ino {
+            return Err("lease-mutex pinned directory identity changed".to_string());
+        }
+        let visible = stat_at(self.dir.as_raw_fd(), &self.leaf)?;
+        if !visible.is_regular || visible.nlink != 1 {
+            return Err("lease-mutex visible mutex leaf is not a regular nlink-1 file".to_string());
+        }
+        if visible.dev != self.mutex_dev || visible.ino != self.mutex_ino {
+            return Err("lease-mutex visible mutex identity changed".to_string());
+        }
+        let opened = stat_fd(self.mutex.as_raw_fd(), "opened mutex")?;
+        if !opened.is_regular
+            || opened.nlink != 1
+            || opened.dev != self.mutex_dev
+            || opened.ino != self.mutex_ino
+        {
+            return Err("lease-mutex opened mutex identity changed".to_string());
+        }
+        let path_identity = stat_path(&self.dir_path)?;
+        if path_identity.dev != self.expected_dev || path_identity.ino != self.expected_ino {
+            return Err("lease-mutex directory path identity changed".to_string());
+        }
+        Ok(())
+    }
+
+    fn release(&mut self) -> Result<(), String> {
+        if self.held {
+            FileExt::unlock(&self.mutex).map_err(|e| format!("lease-mutex unlock failed: {e}"))?;
+            self.held = false;
+        }
+        Ok(())
+    }
+}
+
+#[cfg(unix)]
+use std::os::fd::{AsRawFd, FromRawFd};
+
+#[cfg(unix)]
+#[derive(Clone, Copy)]
+struct Identity {
+    dev: u64,
+    ino: u64,
+    nlink: u64,
+    is_dir: bool,
+    is_regular: bool,
+}
+
+#[cfg(unix)]
+fn open_directory(path: &Path) -> Result<std::fs::File, String> {
+    let c = cstring(path, "directory")?;
+    let fd = unsafe {
+        libc::open(
+            c.as_ptr(),
+            libc::O_RDONLY | libc::O_DIRECTORY | libc::O_CLOEXEC | libc::O_NOFOLLOW,
+        )
+    };
+    if fd < 0 {
+        return Err(format!(
+            "lease-mutex cannot open directory without following symlinks: {}",
+            io::Error::last_os_error()
+        ));
+    }
+    Ok(unsafe { std::fs::File::from_raw_fd(fd) })
+}
+
+#[cfg(unix)]
+fn open_mutex(dir_fd: i32, leaf_name: &str) -> Result<std::fs::File, String> {
+    let leaf = std::ffi::CString::new(leaf_name)
+        .map_err(|_| "lease-mutex safe-leaf contains NUL".to_string())?;
+    let flags = libc::O_RDWR | libc::O_CLOEXEC | libc::O_NOFOLLOW;
+    let mut fd = unsafe { libc::openat(dir_fd, leaf.as_ptr(), flags) };
+    if fd < 0 && io::Error::last_os_error().raw_os_error() == Some(libc::ENOENT) {
+        fd = unsafe {
+            libc::openat(
+                dir_fd,
+                leaf.as_ptr(),
+                flags | libc::O_CREAT | libc::O_EXCL,
+                0o600,
+            )
+        };
+        if fd < 0 && io::Error::last_os_error().raw_os_error() == Some(libc::EEXIST) {
+            fd = unsafe { libc::openat(dir_fd, leaf.as_ptr(), flags) };
+        }
+    }
+    if fd < 0 {
+        return Err(format!(
+            "lease-mutex cannot open permanent mutex leaf without following symlinks: {}",
+            io::Error::last_os_error()
+        ));
+    }
+    Ok(unsafe { std::fs::File::from_raw_fd(fd) })
+}
+
+#[cfg(unix)]
+fn try_lock(file: &std::fs::File) -> Result<(), String> {
+    let start = Instant::now();
+    loop {
+        match file.try_lock_exclusive() {
+            Ok(()) => return Ok(()),
+            Err(error)
+                if error.kind() == io::ErrorKind::WouldBlock && start.elapsed() < LOCK_TIMEOUT =>
+            {
+                std::thread::sleep(Duration::from_millis(20))
+            }
+            Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
+                return Err(format!(
+                    "lease-mutex lock acquisition timed out after {} ms",
+                    LOCK_TIMEOUT.as_millis()
+                ))
+            }
+            Err(error) => return Err(format!("lease-mutex lock acquisition failed: {error}")),
+        }
+    }
+}
+
+#[cfg(unix)]
+fn cstring(path: &Path, label: &str) -> Result<std::ffi::CString, String> {
+    std::ffi::CString::new(path.as_os_str().as_bytes())
+        .map_err(|_| format!("lease-mutex {label} path contains an embedded NUL byte"))
+}
+
+#[cfg(unix)]
+fn stat_path(path: &Path) -> Result<Identity, String> {
+    let c = cstring(path, "directory")?;
+    let mut st = unsafe { std::mem::zeroed() };
+    if unsafe { libc::lstat(c.as_ptr(), &mut st) } != 0 {
+        return Err(format!(
+            "lease-mutex cannot verify directory path: {}",
+            io::Error::last_os_error()
+        ));
+    }
+    Ok(identity_from_stat(&st))
+}
+
+#[cfg(unix)]
+fn stat_at(dir_fd: i32, leaf: &str) -> Result<Identity, String> {
+    let c = std::ffi::CString::new(leaf).unwrap();
+    let mut st = unsafe { std::mem::zeroed() };
+    if unsafe { libc::fstatat(dir_fd, c.as_ptr(), &mut st, libc::AT_SYMLINK_NOFOLLOW) } != 0 {
+        return Err(format!(
+            "lease-mutex cannot verify visible mutex leaf: {}",
+            io::Error::last_os_error()
+        ));
+    }
+    Ok(identity_from_stat(&st))
+}
+
+#[cfg(unix)]
+fn stat_fd(fd: i32, label: &str) -> Result<Identity, String> {
+    let mut st = unsafe { std::mem::zeroed() };
+    if unsafe { libc::fstat(fd, &mut st) } != 0 {
+        return Err(format!(
+            "lease-mutex cannot stat {label}: {}",
+            io::Error::last_os_error()
+        ));
+    }
+    Ok(identity_from_stat(&st))
+}
+
+#[cfg(unix)]
+#[allow(clippy::unnecessary_cast)]
+fn identity_from_stat(st: &libc::stat) -> Identity {
+    Identity {
+        dev: st.st_dev as u64,
+        ino: st.st_ino as u64,
+        nlink: st.st_nlink as u64,
+        is_dir: (st.st_mode & libc::S_IFMT) == libc::S_IFDIR,
+        is_regular: (st.st_mode & libc::S_IFMT) == libc::S_IFREG,
+    }
+}

package/crates/omx-runtime/src/main.rs

@@ -1,3 +1,5 @@
+mod lease_mutex;
+
 use fs2::FileExt;
 use omx_mux::{canonical_contract_summary, MuxAdapter, MuxOperation, MuxTarget, TmuxAdapter};
 use omx_runtime_core::{runtime_contract_summary, RuntimeCommand, RuntimeEngine};
@@ -123,6 +125,7 @@ fn run() -> Result<(), String> {
             );
             Ok(())
         }
+        Some("lease-mutex") => lease_mutex::run(&args[1..]),
         Some("fs-rename-no-replace") => run_fs_rename_no_replace(&args[1..]),
         Some("process-identity") => run_process_identity(&args[1..]),
         Some("init") => {
@@ -533,6 +536,7 @@ fn print_usage() {
         "  snapshot [--json] [--state-dir=DIR]  print a runtime snapshot\n",
         "  mux-contract                        print the mux boundary summary\n",
         "  exec <json> [--state-dir=DIR]       process a runtime command from JSON\n",
+        "  lease-mutex <absolute-canonical-dir> <expected-dev> <expected-ino> <safe-leaf>  hold native lease mutex over stdin JSON protocol\n",
         "  init <state-dir>                    initialize a fresh state directory\n",
     ));
 }

package/crates/omx-runtime/tests/execution.rs

@@ -1,3 +1,154 @@
+#[cfg(unix)]
+mod lease_mutex_tests {
+    use super::*;
+    use std::io::{BufRead, BufReader, Write};
+    use std::os::unix::fs::MetadataExt;
+    use std::process::{Child, ChildStdout, Stdio};
+    use std::sync::mpsc;
+    use std::thread;
+    use std::time::{Duration, SystemTime, UNIX_EPOCH};
+    const MUTEX_LEAF: &str =
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.mutex";
+
+    fn temp_dir() -> std::path::PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "omx-lease-mutex-{}-{}",
+            std::process::id(),
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    fn spawn_lease(dir: &std::path::Path) -> (Child, BufReader<ChildStdout>) {
+        let metadata = std::fs::metadata(dir).unwrap();
+        let mut child = Command::new(env!("CARGO_BIN_EXE_omx-runtime"))
+            .args([
+                "lease-mutex",
+                dir.to_str().unwrap(),
+                &metadata.dev().to_string(),
+                &metadata.ino().to_string(),
+                MUTEX_LEAF,
+            ])
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        let stdout = BufReader::new(child.stdout.take().unwrap());
+        (child, stdout)
+    }
+
+    fn read_line(reader: &mut BufReader<ChildStdout>) -> serde_json::Value {
+        let mut line = String::new();
+        reader.read_line(&mut line).unwrap();
+        serde_json::from_str(&line).unwrap()
+    }
+
+    #[test]
+    fn lease_mutex_serializes_contenders() {
+        let dir = temp_dir();
+        let (mut first, mut first_out) = spawn_lease(&dir);
+        assert_eq!(read_line(&mut first_out)["ready"], true);
+        let (mut second, second_out) = spawn_lease(&dir);
+        let (tx, rx) = mpsc::channel();
+        thread::spawn(move || {
+            let mut reader = second_out;
+            let mut line = String::new();
+            let result = reader.read_line(&mut line).map(|_| line);
+            let _ = tx.send(result);
+        });
+        assert!(rx.recv_timeout(Duration::from_millis(150)).is_err());
+        first
+            .stdin
+            .as_mut()
+            .unwrap()
+            .write_all(b"{\"id\":1,\"op\":\"close\"}\n")
+            .unwrap();
+        assert!(first.wait().unwrap().success());
+        let line = rx.recv_timeout(Duration::from_secs(3)).unwrap().unwrap();
+        assert_eq!(
+            serde_json::from_str::<serde_json::Value>(&line).unwrap()["ready"],
+            true
+        );
+        let _ = second.kill();
+        let _ = second.wait();
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn lease_mutex_releases_on_process_death() {
+        let dir = temp_dir();
+        let (mut first, mut first_out) = spawn_lease(&dir);
+        assert_eq!(read_line(&mut first_out)["ready"], true);
+        first.kill().unwrap();
+        first.wait().unwrap();
+        let (mut second, mut second_out) = spawn_lease(&dir);
+        assert_eq!(read_line(&mut second_out)["ready"], true);
+        second.kill().unwrap();
+        second.wait().unwrap();
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn lease_mutex_rejects_symlink_and_directory_identity_mismatch() {
+        use std::os::unix::fs::symlink;
+        let dir = temp_dir();
+        let target = dir.join("target");
+        std::fs::create_dir(&target).unwrap();
+        symlink(&target, dir.join("link")).unwrap();
+        let output = Command::new(env!("CARGO_BIN_EXE_omx-runtime"))
+            .args([
+                "lease-mutex",
+                dir.join("link").to_str().unwrap(),
+                "0",
+                "0",
+                MUTEX_LEAF,
+            ])
+            .output()
+            .unwrap();
+        assert!(!output.status.success());
+        let metadata = std::fs::metadata(&dir).unwrap();
+        let output = Command::new(env!("CARGO_BIN_EXE_omx-runtime"))
+            .args([
+                "lease-mutex",
+                target.to_str().unwrap(),
+                &metadata.dev().to_string(),
+                &metadata.ino().to_string(),
+                MUTEX_LEAF,
+            ])
+            .output()
+            .unwrap();
+        assert!(!output.status.success());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn lease_mutex_assert_fails_after_directory_path_replacement() {
+        let dir = temp_dir();
+        let replacement = dir.with_extension("replacement");
+        let (mut child, mut output) = spawn_lease(&dir);
+        assert_eq!(read_line(&mut output)["ready"], true);
+        std::fs::rename(&dir, &replacement).unwrap();
+        std::fs::create_dir(&dir).unwrap();
+        child
+            .stdin
+            .as_mut()
+            .unwrap()
+            .write_all(b"{\"id\":7,\"op\":\"assert\"}\n")
+            .unwrap();
+        let response = read_line(&mut output);
+        assert_eq!(response["ok"], false);
+        assert!(response["error"].as_str().unwrap().contains("identity"));
+        let _ = child.kill();
+        let _ = child.wait();
+        let _ = std::fs::remove_dir_all(dir);
+        let _ = std::fs::remove_dir_all(replacement);
+    }
+}
 use std::process::Command;
 
 #[test]
@@ -439,6 +590,7 @@ fn concurrent_exec_queue_accepts_exactly_one_request_id() {
 // ---------------------------------------------------------------------------
 
 /// Helper: run `fs-rename-no-replace <from> <to>` and return (exit_ok, stdout, stderr).
+#[cfg(target_os = "linux")]
 fn run_rename_no_replace(from: &str, to: &str) -> (bool, String, String) {
     let output = Command::new(env!("CARGO_BIN_EXE_omx-runtime"))
         .args(["fs-rename-no-replace", from, to])

package/crates/omx-sparkshell/src/codex_bridge.rs

@@ -9,8 +9,8 @@ use std::time::Duration;
 
 pub const DEFAULT_SUMMARY_TIMEOUT_MS: u64 = 60_000;
 pub const DEFAULT_API_BASE_URL: &str = "http://127.0.0.1:14510";
-pub const DEFAULT_SPARK_MODEL: &str = "gpt-5.6-luna";
-pub const DEFAULT_STANDARD_MODEL: &str = "gpt-5.6-terra";
+pub const DEFAULT_SPARK_MODEL: &str = "gpt-6-astra";
+pub const DEFAULT_STANDARD_MODEL: &str = "gpt-6-astra";
 
 pub fn resolve_model() -> String {
     env::var("OMX_SPARKSHELL_MODEL")