npm - oh-my-opencode - Versions diffs - 4.11.0 → 4.12.0 - Mend

oh-my-opencode 4.11.0 → 4.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (177) hide show

package/packages/omo-codex/plugin/test/component-bundled-cli.test.mjs CHANGED Viewed

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import test from "node:test";
-import { readJson, root } from "./aggregate-plugin-fixture.mjs";
+import { readAggregateHookManifests, readJson, root } from "./aggregate-plugin-fixture.mjs";
 import { componentHookContractCases } from "./component-hook-contract-cases.mjs";
 const HOOK_EVENTS_BY_COMPONENT = {
@@ -142,8 +142,8 @@ test("#given malformed comment-checker stdin #when executed through dist CLI con
 test("#given aggregate hook manifest #when command hooks are inspected #then component CLI invocation contract is unchanged", async () => {
 	// given
-	const hooks = await readJson("hooks/hooks.json");
-	const commands = collectHookCommands(hooks.hooks);
+	const manifests = await readAggregateHookManifests();
+	const commands = manifests.flatMap(({ hooks }) => collectHookCommands(hooks.hooks));
 	const components = await workspaceComponents();
 	// when

package/packages/omo-codex/plugin/test/display-metadata.test.mjs ADDED Viewed

@@ -0,0 +1,83 @@
+import assert from "node:assert/strict";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import test from "node:test";
+import { readJson, root } from "./aggregate-plugin-fixture.mjs";
+const hookSlugPattern = /^\.\/hooks\/[a-z0-9]+(?:-[a-z0-9]+)*\.json$/;
+const displayNamePrefix = "(OmO) ";
+async function exists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function readSkillName(skillPath) {
+	const content = await readFile(skillPath, "utf8");
+	const frontmatter = content.match(/^---\n(?<body>[\s\S]*?)\n---\n/);
+	assert(frontmatter?.groups?.body, `${skillPath} must have YAML frontmatter`);
+	const name = frontmatter.groups.body.match(/^name:\s*"?([^"\n]+)"?\s*$/m)?.[1]?.trim();
+	assert(name, `${skillPath} must have a frontmatter name`);
+	return name;
+}
+async function readOpenAiDisplayName(skillDir) {
+	const metadataPath = join(skillDir, "agents", "openai.yaml");
+	assert(await exists(metadataPath), `${basename(skillDir)} must include agents/openai.yaml`);
+	const content = await readFile(metadataPath, "utf8");
+	const displayName = content.match(/^\s*display_name:\s*"?([^"\n]+)"?\s*$/m)?.[1]?.trim();
+	assert(displayName, `${metadataPath} must define interface.display_name`);
+	return displayName;
+}
+test("#given Codex plugin hooks #when plugin metadata is inspected #then hook keys contain human-readable hook slugs", async () => {
+	// given
+	const manifest = await readJson(".codex-plugin/plugin.json");
+	// when
+	const hookPaths = manifest.hooks;
+	// then
+	assert(Array.isArray(hookPaths), "plugin manifest hooks must list per-hook metadata files");
+	assert(hookPaths.length > 0, "plugin manifest must expose at least one hook file");
+	for (const hookPath of hookPaths) {
+		assert.equal(typeof hookPath, "string");
+		assert.match(hookPath, hookSlugPattern);
+		assert.notEqual(hookPath, "./hooks/hooks.json");
+		const hooksJson = await readJson(hookPath.replace(/^\.\//, ""));
+		const commandHookCount = Object.values(hooksJson.hooks)
+			.flat()
+			.flatMap((group) => group.hooks)
+			.filter((hook) => hook.type === "command").length;
+		assert.equal(commandHookCount, 1, `${hookPath} should describe exactly one displayed hook`);
+	}
+});
+test("#given Codex plugin skills #when skill metadata is inspected #then every skill has an OmO display name", async () => {
+	// given
+	const skillsDir = join(root, "skills");
+	const skillEntries = await readdir(skillsDir, { withFileTypes: true });
+	const skillDirs = skillEntries.filter((entry) => entry.isDirectory()).map((entry) => join(skillsDir, entry.name));
+	// when
+	const invalidDisplayNames = [];
+	for (const skillDir of skillDirs) {
+		const skillPath = join(skillDir, "SKILL.md");
+		if (!(await exists(skillPath))) continue;
+		const skillName = await readSkillName(skillPath);
+		const displayName = await readOpenAiDisplayName(dirname(skillPath));
+		const expected = `${displayNamePrefix}${skillName}`;
+		if (displayName !== expected) {
+			invalidDisplayNames.push(`${basename(skillDir)}: expected ${expected}, got ${displayName}`);
+		}
+	}
+	// then
+	assert.deepEqual(invalidDisplayNames, []);
+});

package/packages/omo-codex/plugin/test/hook-status-message.test.mjs CHANGED Viewed

@@ -68,6 +68,19 @@ async function readPluginVersion() {
 	return (await readJson(".codex-plugin/plugin.json")).version;
 }
+async function readAggregateHookManifests() {
+	const manifest = await readJson(".codex-plugin/plugin.json");
+	const hookPaths = Array.isArray(manifest.hooks) ? manifest.hooks : [manifest.hooks];
+	return Promise.all(
+		hookPaths
+			.filter((hookPath) => typeof hookPath === "string")
+			.map(async (hookPath) => {
+				const source = hookPath.replace(/^\.\//, "");
+				return { source, version: await readPluginVersion(), hooks: await readJson(source) };
+			}),
+	);
+}
 async function readComponentVersion(componentName) {
 	return (await readJson(join("components", componentName, "package.json"))).version;
 }
@@ -114,7 +127,7 @@ function collectCommandHooks(hooks, source, version) {
 	return commandHooks;
 }
-test("#given hook status label #when formatting #then prefixes LazyCodex with current version", async () => {
+test("#given hook status label #when formatting #then prefixes OmO display namespace", async () => {
 	// given
 	const version = (await readRepoJson("package.json")).version;
 	const label = "Checking Comments";
@@ -123,10 +136,10 @@ test("#given hook status label #when formatting #then prefixes LazyCodex with cu
 	const message = formatLazyCodexHookStatusMessage(version, label);
 	// then
-	assert.equal(message, `LazyCodex(${version}): Checking Comments`);
+	assert.equal(message, "(OmO) Checking Comments");
 });
-test("#given hook status label with blank version #when formatting #then prefixes LazyCodex with local version", () => {
+test("#given hook status label with blank version #when formatting #then still prefixes OmO display namespace", () => {
 	// given
 	const version = "  ";
 	const label = "Checking Comments";
@@ -135,7 +148,7 @@ test("#given hook status label with blank version #when formatting #then prefixe
 	const message = formatLazyCodexHookStatusMessage(version, label);
 	// then
-	assert.equal(message, "LazyCodex(local): Checking Comments");
+	assert.equal(message, "(OmO) Checking Comments");
 });
 test("#given loose legacy status label #when normalizing #then removes OMO wording and title-cases label", async () => {
@@ -149,7 +162,7 @@ test("#given loose legacy status label #when normalizing #then removes OMO wordi
 	// then
 	assert.equal(normalized, "Checking Comments");
-	assert.equal(message, `LazyCodex(${version}): Checking Comments`);
+	assert.equal(message, "(OmO) Checking Comments");
 });
 test("#given LazyCodex appears inside hook label #when normalizing #then product casing is preserved", async () => {
@@ -163,7 +176,7 @@ test("#given LazyCodex appears inside hook label #when normalizing #then product
 	// then
 	assert.equal(normalized, "Verifying LazyCodex Executor Evidence");
-	assert.equal(message, `LazyCodex(${version}): Verifying LazyCodex Executor Evidence`);
+	assert.equal(message, "(OmO) Verifying LazyCodex Executor Evidence");
 });
 test("#given MCP appears inside hook label #when normalizing #then protocol casing is preserved", () => {
@@ -176,31 +189,29 @@ test("#given MCP appears inside hook label #when normalizing #then protocol casi
 	// then
 	assert.equal(normalized, "Recommending Git Bash MCP");
-	assert.equal(message, "LazyCodex(4.10.0): Recommending Git Bash MCP");
+	assert.equal(message, "(OmO) Recommending Git Bash MCP");
 });
-test("#given aggregate comment-checker hook #when status is inspected #then it uses LazyCodex comments label", async () => {
+test("#given aggregate comment-checker hook #when status is inspected #then it uses OmO comments label", async () => {
 	// given
-	const aggregateVersion = await readPluginVersion();
-	const aggregateHooks = await readJson("hooks/hooks.json");
+	const aggregateManifests = await readAggregateHookManifests();
 	// when
-	const hooks = collectCommandHooks(aggregateHooks, "hooks/hooks.json", aggregateVersion);
-	const commentCheckerHook = hooks.find((hook) => hook.id === "hooks/hooks.json:PostToolUse:0:0");
+	const hooks = aggregateManifests.flatMap((manifest) => collectCommandHooks(manifest.hooks, manifest.source, manifest.version));
+	const commentCheckerHook = hooks.find((hook) => hook.command.includes("components/comment-checker/dist/cli.js"));
 	// then
-	assert.equal(commentCheckerHook?.statusMessage, formatLazyCodexHookStatusMessage(aggregateVersion, "Checking Comments"));
-	assert.doesNotMatch(JSON.stringify(aggregateHooks), /checking\s+OMO\s+comments/i);
+	assert.equal(commentCheckerHook?.statusMessage, formatLazyCodexHookStatusMessage("", "Checking Comments"));
+	assert.doesNotMatch(JSON.stringify(aggregateManifests), /checking\s+OMO\s+comments/i);
 });
-test("#given aggregate and component hooks #when status messages are inspected #then all use the LazyCodex formatter", async () => {
+test("#given aggregate and component hooks #when status messages are inspected #then all use the OmO formatter", async () => {
 	// given
-	const aggregateVersion = await readPluginVersion();
-	const aggregateHooks = await readJson("hooks/hooks.json");
+	const aggregateManifests = await readAggregateHookManifests();
 	const componentManifests = await readComponentHookManifests();
 	// when
 	const commandHooks = [
-		...collectCommandHooks(aggregateHooks, "hooks/hooks.json", aggregateVersion),
+		...aggregateManifests.flatMap((manifest) => collectCommandHooks(manifest.hooks, manifest.source, manifest.version)),
 		...componentManifests.flatMap((manifest) => collectCommandHooks(manifest.hooks, manifest.source, manifest.version)),
 	];
 	const expectedLabels = new Map([...AGGREGATE_EXPECTED_LABELS, ...COMPONENT_EXPECTED_LABELS]);
@@ -219,6 +230,6 @@ test("#given aggregate and component hooks #when status messages are inspected #
 	const actualLabels = new Set(commandHooks.map((hook) => parseLazyCodexHookStatusMessage(hook.statusMessage)?.label));
 	assert.deepEqual([...expectedLabels.values()].filter((label) => !actualLabels.has(label)), []);
 	for (const hook of commandHooks) {
-		assert.doesNotMatch(hook.statusMessage, /\bOMO\b/i);
+		assert.match(hook.statusMessage, /^\(OmO\) /);
 	}
 });

package/packages/omo-codex/plugin/test/lcx-bug-skills.test.mjs CHANGED Viewed

@@ -20,7 +20,7 @@ test("#given synced lcx-report-bug skill #when inspected #then it files LazyCode
 	assert.match(skill, /gh pr create --repo openai\/codex/);
 	assert.doesNotMatch(skill, /gh pr create --repo "\$TARGET_REPO"/);
 	assert.doesNotMatch(skill, /gh pr create --repo code-yeongyu\/lazycodex/);
-	assert.match(interfaceMetadata, /display_name: "lcx-report-bug \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) lcx-report-bug"/);
 	assert.match(interfaceMetadata, /- "lazycodex bug"/);
 	assert.match(interfaceMetadata, /- "openai codex bug"/);
 });
@@ -40,7 +40,7 @@ test("#given synced lcx-contribute-bug-fix skill #when inspected #then it delive
 	assert.match(skill, /gh pr create --repo openai\/codex/);
 	assert.doesNotMatch(skill, /gh pr create --repo "\$TARGET_REPO"/);
 	assert.doesNotMatch(skill, /gh pr create --repo code-yeongyu\/lazycodex/);
-	assert.match(interfaceMetadata, /display_name: "lcx-contribute-bug-fix \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) lcx-contribute-bug-fix"/);
 	assert.match(interfaceMetadata, /- "contribute a bug fix"/);
 	assert.match(interfaceMetadata, /- "fix bug pr"/);
 });
@@ -55,7 +55,7 @@ test("#given synced lcx-doctor skill #when inspected #then it diagnoses installs
 	// then
 	assert.match(skill, /^---\r?\nname: lcx-doctor\r?\n/m);
-	assert.match(interfaceMetadata, /display_name: "lcx-doctor \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) lcx-doctor"/);
 	assert.match(interfaceMetadata, /- "lazycodex doctor"/);
 	assert.match(interfaceMetadata, /- "lazycodex health check"/);
 });

package/packages/omo-codex/plugin/test/sync-hook-status-messages.test.mjs CHANGED Viewed

@@ -88,10 +88,10 @@ test("#given source package versions and component without hooks #when hook stat
 	const aggregateHooks = await readJson(join(root, "hooks", "hooks.json"));
 	const componentHooks = await readJson(join(root, "components", "comment-checker", "hooks", "hooks.json"));
 	const lspHooks = await readJson(join(root, "components", "lsp", "hooks", "hooks.json"));
-	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(0.1.0): Checking Comments");
-	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[1].statusMessage, "LazyCodex(0.1.0): Checking LSP Diagnostics");
-	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(0.1.1): Checking Comments");
-	assert.equal(lspHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(0.2.0): Checking LSP Diagnostics");
+	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
+	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[1].statusMessage, "(OmO) Checking LSP Diagnostics");
+	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
+	assert.equal(lspHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking LSP Diagnostics");
 });
 test("#given release version override #when hook status messages sync #then aggregate hooks use release version", async () => {
@@ -139,6 +139,6 @@ test("#given release version override #when hook status messages sync #then aggr
 	// then
 	const aggregateHooks = await readJson(join(root, "hooks", "hooks.json"));
 	const componentHooks = await readJson(join(root, "components", "comment-checker", "hooks", "hooks.json"));
-	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(4.8.0): Checking Comments");
-	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(4.8.0): Checking Comments");
+	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
+	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
 });

package/packages/omo-codex/plugin/test/sync-skills-test-support.mjs CHANGED Viewed

@@ -22,6 +22,7 @@ export const expectedSkills = [
 	"review-work",
 	"rules",
 	"start-work",
+	"teammode",
 	"ultraresearch",
 	"ulw-loop",
 	"ulw-plan",
@@ -32,6 +33,7 @@ export const componentSkillSources = [
 	["comment-checker", "components/comment-checker/skills/comment-checker"],
 	["lsp", "components/lsp/skills/lsp"],
 	["rules", "components/rules/skills/rules"],
+	["teammode", "components/teammode/skills/teammode"],
 	["ulw-loop", "components/ulw-loop/skills/ulw-loop"],
 	["ulw-plan", "components/ultrawork/skills/ulw-plan"],
 ];

package/packages/omo-codex/plugin/test/sync-skills.test.mjs CHANGED Viewed

@@ -17,6 +17,7 @@ import {
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const repoRoot = join(root, "..", "..", "..");
 const opencodeOnlyToolPattern = /\b(?:call_omo_agent|background_output|team_[a-z_]+|task)\s*\(/;
+const generatedSkillMetadataFiles = new Set(["agents/openai.yaml"]);
 async function readPackagedSkillFile(...segments) {
 	const path = join(root, "skills", ...segments);
@@ -24,6 +25,10 @@ async function readPackagedSkillFile(...segments) {
 	return { path, content };
 }
+function excludeGeneratedSkillMetadata(files) {
+	return files.filter((file) => !generatedSkillMetadataFiles.has(file.replaceAll("\\", "/")));
+}
 test("#given synced aggregate Codex skills #when inspected #then component and shared skills are present", async () => {
 	// given
 	const skillsRoot = join(root, "skills");
@@ -121,8 +126,8 @@ test("#given component skill sources #when aggregate Codex component skills are
 	for (const [skillName, sourcePath] of componentSkillSources) {
 		const sourceDir = join(root, sourcePath);
 		const aggregateDir = join(aggregateSkillsRoot, skillName);
-		const sourceFiles = await listSkillFiles(sourceDir);
-		const aggregateFiles = await listSkillFiles(aggregateDir);
+		const sourceFiles = excludeGeneratedSkillMetadata(await listSkillFiles(sourceDir));
+		const aggregateFiles = excludeGeneratedSkillMetadata(await listSkillFiles(aggregateDir));
 		assert.deepEqual(aggregateFiles, sourceFiles, `${skillName} resource set drifted from its component skill source`);
 		for (const relativePath of sourceFiles) {
 			const sourceContent = await readFile(join(sourceDir, relativePath), "utf8");
@@ -146,7 +151,7 @@ test("#given synced ulw-loop skill #when Codex hint metadata is inspected #then
 	// then
 	assert.match(skill, /^---\r?\nname: ulw-loop\r?\n/m);
-	assert.match(interfaceMetadata, /display_name: "ulw-loop \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) ulw-loop"/);
 	assert.doesNotMatch(interfaceMetadata, /ulw-loop \/ ulw-loop/);
 	assert.match(interfaceMetadata, /short_description: "Goal-like ultrawork loop for systematic decomposition"/);
 	assert.match(interfaceMetadata, /default_prompt: "Use \$ulw-loop/);
@@ -179,7 +184,7 @@ test("#given synced git-master skill #when inspected #then commits and git histo
 	assert.match(skill, /Choose the Git tool by the question/);
 	assert.match(skill, /git log -S "text"/);
 	assert.match(skill, /git blame -L start,end -- file/);
-	assert.match(interfaceMetadata, /display_name: "git-master \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) git-master"/);
 	assert.match(interfaceMetadata, /- "git commit"/);
 	assert.match(interfaceMetadata, /- "history search"/);
 });

package/packages/omo-codex/plugin/test/teammode-safety-fixture.mjs ADDED Viewed

@@ -0,0 +1,88 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { root } from "./aggregate-plugin-fixture.mjs";
+const teamScript = join(root, "components", "teammode", "skills", "teammode", "scripts", "team.mjs");
+export function createTeamRoot(prefix) {
+	return mkdtempSync(join(tmpdir(), prefix));
+}
+export function cleanupTeamRoot(tempRoot) {
+	rmSync(tempRoot, { recursive: true, force: true });
+}
+export function teamDir(tempRoot, sessionId) {
+	return join(tempRoot, ".omo", "teams", sessionId);
+}
+export function teamJsonPath(tempRoot, sessionId) {
+	return join(teamDir(tempRoot, sessionId), "team.json");
+}
+export function readTeamJson(tempRoot, sessionId) {
+	return JSON.parse(readFileSync(teamJsonPath(tempRoot, sessionId), "utf8"));
+}
+export function runTeam(cwd, ...args) {
+	const result = runTeamRaw(cwd, ...args);
+	assert.equal(result.status, 0, `team.mjs ${args.join(" ")} failed: ${result.stderr}`);
+	return result;
+}
+export function runTeamRaw(cwd, ...args) {
+	return spawnSync(process.execPath, [teamScript, ...args], {
+		cwd,
+		encoding: "utf8",
+		timeout: 10_000,
+	});
+}
+export function symlinkOrSkip(t, target, path, type) {
+	try {
+		symlinkSync(target, path, type);
+		return true;
+	} catch (error) {
+		if (isUnavailableSymlinkError(error)) {
+			t.skip(`symlink unavailable on this filesystem: ${error.code}`);
+			return false;
+		}
+		throw error;
+	}
+}
+function isUnavailableSymlinkError(error) {
+	return error?.code === "EPERM" || error?.code === "EACCES" || error?.code === "EINVAL";
+}
+export function createArchivedOutsideTeam(tempRoot, sessionId) {
+	const outsideTeams = join(tempRoot, "outside-teams");
+	const outsideTeamDir = join(outsideTeams, sessionId);
+	mkdirSync(outsideTeamDir, { recursive: true });
+	writeFileSync(
+		join(outsideTeamDir, "team.json"),
+		`${JSON.stringify(
+			{
+				schemaVersion: 2,
+				teamId: "outside-team",
+				teamName: "Outside",
+				sessionName: "Escape",
+				leader: { kind: "main-session", sessionId },
+				status: "archived",
+				members: [],
+			},
+			null,
+			2,
+		)}\n`,
+	);
+	return { outsideTeams, outsideTeamDir };
+}
+export function assertOutsideTeamIntact(outsideTeamDir) {
+	assert.equal(existsSync(outsideTeamDir), true);
+	assert.equal(JSON.parse(readFileSync(join(outsideTeamDir, "team.json"), "utf8")).teamId, "outside-team");
+}

package/packages/omo-codex/plugin/test/teammode-safety.test.mjs ADDED Viewed

@@ -0,0 +1,240 @@
+import assert from "node:assert/strict";
+import { mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+import {
+	assertOutsideTeamIntact,
+	cleanupTeamRoot,
+	createArchivedOutsideTeam,
+	createTeamRoot,
+	readTeamJson,
+	runTeam,
+	runTeamRaw,
+	symlinkOrSkip,
+	teamDir,
+	teamJsonPath,
+} from "./teammode-safety-fixture.mjs";
+test("#given guide.md is a symlink #when guide is regenerated #then the outside target stays untouched", (t) => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-guide-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Symlink", "--session-name", "Escape", "--session", "safe-guide");
+		const guidePath = join(teamDir(tempRoot, "safe-guide"), "guide.md");
+		const outsidePath = join(tempRoot, "outside-guide-target.md");
+		writeFileSync(outsidePath, "ORIGINAL_OUTSIDE\n");
+		unlinkSync(guidePath);
+		if (!symlinkOrSkip(t, outsidePath, guidePath)) return;
+		const result = runTeamRaw(tempRoot, "guide", "--team", "safe-guide");
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /guide\.md is a symlink|persist target escapes/);
+		assert.equal(readFileSync(outsidePath, "utf8"), "ORIGINAL_OUTSIDE\n");
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+test("#given member A exists #when add-member receives A with trailing space #then state is not partially mutated", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-duplicate-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Duplicate", "--session-name", "Members", "--session", "safe-duplicate");
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate",
+			"--id",
+			"A",
+			"--focus",
+			"alpha",
+			"--lens",
+			"area",
+			"--deliverable",
+			"first",
+		);
+		const result = runTeamRaw(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate",
+			"--id",
+			"A ",
+			"--focus",
+			"beta",
+			"--lens",
+			"ownership",
+			"--deliverable",
+			"second",
+		);
+		const team = readTeamJson(tempRoot, "safe-duplicate");
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /member id "A" already exists/);
+		assert.deepEqual(
+			team.members.map((member) => member.id),
+			["A"],
+		);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+test("#given member focus already exists #when add-member receives same focus with different spacing and case #then state is not partially mutated", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-duplicate-focus-");
+	try {
+		runTeam(tempRoot, "init", "--name", "DuplicateFocus", "--session-name", "Members", "--session", "safe-duplicate-focus");
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate-focus",
+			"--id",
+			"A",
+			"--focus",
+			"Plugin Hook Packaging",
+			"--lens",
+			"ownership",
+			"--deliverable",
+			"first",
+		);
+		const result = runTeamRaw(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate-focus",
+			"--id",
+			"B",
+			"--focus",
+			" plugin   hook packaging ",
+			"--lens",
+			"area",
+			"--deliverable",
+			"second",
+		);
+		const team = readTeamJson(tempRoot, "safe-duplicate-focus");
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /member focus "plugin   hook packaging" duplicates "Plugin Hook Packaging"/);
+		assert.deepEqual(
+			team.members.map((member) => member.id),
+			["A"],
+		);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+test("#given only one member exists #when bind-thread runs #then member is not activated", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-understaffed-bind-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Understaffed", "--session-name", "Members", "--session", "safe-understaffed");
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-understaffed",
+			"--id",
+			"A",
+			"--focus",
+			"installer",
+			"--lens",
+			"area",
+			"--deliverable",
+			"first",
+		);
+		const result = runTeamRaw(tempRoot, "bind-thread", "--team", "safe-understaffed", "--id", "A", "--thread", "thread-a");
+		let team = readTeamJson(tempRoot, "safe-understaffed");
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /at least 2 distinct members/);
+		assert.equal(team.members[0].threadId, null);
+		assert.equal(team.members[0].status, "pending");
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-understaffed",
+			"--id",
+			"B",
+			"--focus",
+			"runtime qa",
+			"--lens",
+			"perspective",
+			"--deliverable",
+			"second",
+		);
+		runTeam(tempRoot, "bind-thread", "--team", "safe-understaffed", "--id", "A", "--thread", "thread-a");
+		team = readTeamJson(tempRoot, "safe-understaffed");
+		assert.equal(team.members[0].threadId, "thread-a");
+		assert.equal(team.members[0].status, "active");
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+test("#given persisted paths are mutated outside trusted team dir #when guide is regenerated #then outside file stays untouched", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-mutated-paths-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Mutated", "--session-name", "Paths", "--session", "safe-mutated");
+		const teamPath = teamJsonPath(tempRoot, "safe-mutated");
+		const outsideDir = join(tempRoot, "outside");
+		const outsideGuide = join(outsideDir, "guide.md");
+		mkdirSync(outsideDir);
+		writeFileSync(outsideGuide, "ORIGINAL_OUTSIDE\n");
+		const team = JSON.parse(readFileSync(teamPath, "utf8"));
+		team.paths.dir = outsideDir;
+		team.paths.guide = outsideGuide;
+		writeFileSync(teamPath, `${JSON.stringify(team, null, 2)}\n`);
+		const result = runTeamRaw(tempRoot, "guide", "--team", "safe-mutated");
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /persisted team dir does not match trusted team dir/);
+		assert.equal(readFileSync(outsideGuide, "utf8"), "ORIGINAL_OUTSIDE\n");
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+test("#given team dir is swapped to a symlink #when status reads team state #then command refuses the symlink", (t) => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-dir-symlink-");
+	try {
+		runTeam(tempRoot, "init", "--name", "SymlinkDir", "--session-name", "Paths", "--session", "safe-dir");
+		const targetTeamDir = teamDir(tempRoot, "safe-dir");
+		const outsideDir = join(tempRoot, "outside-team-dir");
+		mkdirSync(outsideDir);
+		rmSync(targetTeamDir, { recursive: true, force: true });
+		if (!symlinkOrSkip(t, outsideDir, targetTeamDir, "dir")) return;
+		const result = runTeamRaw(tempRoot, "status", "--team", "safe-dir");
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /path component is a symlink|team dir is a symlink/);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+test("#given teams root is a symlink #when delete runs #then outside team state stays untouched", (t) => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-delete-root-symlink-");
+	try {
+		const { outsideTeams, outsideTeamDir } = createArchivedOutsideTeam(tempRoot, "escape");
+		mkdirSync(join(tempRoot, ".omo"), { recursive: true });
+		if (!symlinkOrSkip(t, outsideTeams, join(tempRoot, ".omo", "teams"), "dir")) return;
+		const result = runTeamRaw(tempRoot, "delete", "--team", "escape", "--force");
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /path component is a symlink/);
+		assertOutsideTeamIntact(outsideTeamDir);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});