oh-my-codex 0.21.36 → 0.21.38

package/Cargo.lock

@@ -32,7 +32,7 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "omx-api"
-version = "0.21.36"
+version = "0.21.38"
 dependencies = [
  "serde",
  "serde_json",
@@ -40,14 +40,14 @@ dependencies = [
 
 [[package]]
 name = "omx-explore-harness"
-version = "0.21.36"
+version = "0.21.38"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "omx-mux"
-version = "0.21.36"
+version = "0.21.38"
 dependencies = [
  "serde",
  "serde_json",
@@ -55,7 +55,7 @@ dependencies = [
 
 [[package]]
 name = "omx-runtime"
-version = "0.21.36"
+version = "0.21.38"
 dependencies = [
  "fs2",
  "libc",
@@ -67,7 +67,7 @@ dependencies = [
 
 [[package]]
 name = "omx-runtime-core"
-version = "0.21.36"
+version = "0.21.38"
 dependencies = [
  "fs2",
  "serde",
@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "omx-sparkshell"
-version = "0.21.36"
+version = "0.21.38"
 dependencies = [
  "omx-mux",
 ]

package/Cargo.toml

@@ -11,7 +11,7 @@ resolver = "2"
 
 [workspace.package]
 
-version = "0.21.36"
+version = "0.21.38"
 
 edition = "2021"
 rust-version = "1.73"

package/dist/cli/__tests__/doctor-warning-copy.test.js

@@ -574,6 +574,41 @@ command = "node"
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("reports claim-digest mismatches in setup and doctor", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-doctor-plugin-cache-claim-digest-"));
+        try {
+            const home = join(wd, "home");
+            const codexDir = join(home, ".codex");
+            await mkdir(codexDir, { recursive: true });
+            const setupRes = runOmx(wd, ["setup", "--scope", "user", "--plugin", "--force"], { HOME: home, CODEX_HOME: codexDir });
+            if (shouldSkipForSpawnPermissions(setupRes.error))
+                return;
+            assert.equal(setupRes.status, 0, setupRes.stderr || setupRes.stdout);
+            const version = await packagedPluginVersion();
+            const cacheDir = join(codexDir, "plugins", "cache", "oh-my-codex-local", "oh-my-codex", version);
+            const completePath = join(cacheDir, ".omx-complete");
+            const completion = JSON.parse(await readFile(completePath, "utf-8"));
+            const wrongDigest = `${completion.claimDigest[0] === "0" ? "1" : "0"}${completion.claimDigest.slice(1)}`;
+            await writeFile(completePath, `${JSON.stringify({ ...completion, claimDigest: wrongDigest })}\n`);
+            const setupWithDrift = runOmx(wd, ["setup", "--scope", "user", "--plugin"], {
+                HOME: home,
+                CODEX_HOME: codexDir,
+            });
+            if (shouldSkipForSpawnPermissions(setupWithDrift.error))
+                return;
+            assert.equal(setupWithDrift.status, 0, setupWithDrift.stderr || setupWithDrift.stdout);
+            assert.match(setupWithDrift.stdout, /claim digest mismatch/);
+            const doctorRes = runOmx(wd, ["doctor"], { HOME: home, CODEX_HOME: codexDir });
+            if (shouldSkipForSpawnPermissions(doctorRes.error))
+                return;
+            assert.equal(doctorRes.status, 0, doctorRes.stderr || doctorRes.stdout);
+            assert.match(doctorRes.stdout, /Skills: plugin marketplace oh-my-codex-local cache provenance is invalid: cache snapshot claim digest mismatch/);
+            assert.match(doctorRes.stdout, /Plugin versions: expected cache directory .* has invalid plugin cache provenance: cache snapshot claim digest mismatch/);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("warns with pointer-specific diagnostics when the cached manifest drifts", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-doctor-plugin-cache-pointer-drift-"));
         try {
@@ -1719,6 +1754,59 @@ command = "node"
             await rm(wd, { recursive: true, force: true });
         }
     });
+    it("doctor and its plugin-cache repair command handle stale OMX plugin hook trust (#3918)", async () => {
+        const wd = await mkdtemp(join(tmpdir(), "omx-doctor-plugin-hook-trust-3918-"));
+        try {
+            const home = join(wd, "home");
+            const codexDir = join(home, ".codex");
+            const configPath = join(codexDir, "config.toml");
+            await mkdir(codexDir, { recursive: true });
+            const initialSetup = runOmx(wd, ["setup", "--scope", "user", "--plugin"], {
+                HOME: home,
+                CODEX_HOME: codexDir,
+            });
+            if (shouldSkipForSpawnPermissions(initialSetup.error))
+                return;
+            assert.equal(initialSetup.status, 0, initialSetup.stderr || initialSetup.stdout);
+            const pluginManifest = JSON.parse(await readFile(join(repoRoot(), "plugins", "oh-my-codex", ".codex-plugin", "plugin.json"), "utf-8"));
+            const pluginHooksPath = join(codexDir, "plugins", "cache", "oh-my-codex-local", "oh-my-codex", pluginManifest.version, "hooks", "hooks.json");
+            const initialPluginHooks = await readFile(pluginHooksPath, "utf-8");
+            const mutatedHooks = JSON.parse(initialPluginHooks);
+            mutatedHooks.hooks.PostCompact[0].hooks[0].command += " --cache-rebuild-probe";
+            await writeFile(pluginHooksPath, `${JSON.stringify(mutatedHooks, null, 2)}\n`);
+            const pluginKey = "oh-my-codex@oh-my-codex-local:hooks/hooks.json:post_compact:0:0";
+            const staleHash = `sha256:${"1".repeat(64)}`;
+            const configWithStalePluginTrust = [
+                (await readFile(configPath, "utf-8")).trimEnd(),
+                "",
+                "# OMX-owned Codex hook trust state",
+                `[hooks.state.${JSON.stringify(pluginKey)}]`,
+                `trusted_hash = ${JSON.stringify(staleHash)}`,
+                "# End OMX-owned Codex hook trust state",
+                "",
+            ].join("\n");
+            await writeFile(configPath, configWithStalePluginTrust, "utf-8");
+            const doctorResult = runOmx(wd, ["doctor"], { HOME: home, CODEX_HOME: codexDir });
+            if (shouldSkipForSpawnPermissions(doctorResult.error))
+                return;
+            assert.equal(doctorResult.status, 0, doctorResult.stderr || doctorResult.stdout);
+            assert.match(doctorResult.stdout, /Native hooks: plugin-scoped hooks are enabled, but cached plugin hook files or pinned hook launcher/);
+            assert.match(doctorResult.stdout, /run `omx setup --plugin --repair-plugin-cache` to refresh the plugin cache/);
+            assert.doesNotMatch(doctorResult.stdout, /managed_trust_key_conflict/);
+            const setupResult = runOmx(wd, ["setup", "--scope", "user", "--plugin", "--repair-plugin-cache"], {
+                HOME: home,
+                CODEX_HOME: codexDir,
+            });
+            if (shouldSkipForSpawnPermissions(setupResult.error))
+                return;
+            assert.equal(setupResult.status, 0, setupResult.stderr || setupResult.stdout);
+            assert.doesNotMatch(await readFile(configPath, "utf-8"), /oh-my-codex@oh-my-codex-local:hooks\/hooks\.json:/);
+            assert.equal(await readFile(pluginHooksPath, "utf-8"), initialPluginHooks);
+        }
+        finally {
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
     it("still rejects stale foreign trust at a managed-first migration destination", async () => {
         const wd = await mkdtemp(join(tmpdir(), "omx-doctor-hooks-stale-destination-trust-"));
         try {