oh-my-opencode 4.11.1 → 4.12.1

package/packages/omo-codex/plugin/test/hook-status-message.test.mjs

@@ -25,6 +25,7 @@ const AGGREGATE_EXPECTED_LABELS = new Map([
 	["hooks/hooks.json:PreToolUse:1:0", "Enforcing Unlimited Goal Budget"],
 	["hooks/hooks.json:PostToolUse:0:0", "Checking Comments"],
 	["hooks/hooks.json:PostToolUse:0:1", "Checking LSP Diagnostics"],
+	["hooks/hooks.json:PostToolUse:0:2", "Checking CodeGraph Init Guidance"],
 	["hooks/hooks.json:PostToolUse:1:0", "Matching Project Rules"],
 	["hooks/hooks.json:PostCompact:0:0", "Resetting Git Bash MCP Reminder"],
 	["hooks/hooks.json:PostCompact:1:0", "Resetting Project Rule Cache"],
@@ -68,6 +69,19 @@ async function readPluginVersion() {
 	return (await readJson(".codex-plugin/plugin.json")).version;
 }
 
+async function readAggregateHookManifests() {
+	const manifest = await readJson(".codex-plugin/plugin.json");
+	const hookPaths = Array.isArray(manifest.hooks) ? manifest.hooks : [manifest.hooks];
+	return Promise.all(
+		hookPaths
+			.filter((hookPath) => typeof hookPath === "string")
+			.map(async (hookPath) => {
+				const source = hookPath.replace(/^\.\//, "");
+				return { source, version: await readPluginVersion(), hooks: await readJson(source) };
+			}),
+	);
+}
+
 async function readComponentVersion(componentName) {
 	return (await readJson(join("components", componentName, "package.json"))).version;
 }
@@ -114,7 +128,7 @@ function collectCommandHooks(hooks, source, version) {
 	return commandHooks;
 }
 
-test("#given hook status label #when formatting #then prefixes LazyCodex with current version", async () => {
+test("#given hook status label #when formatting #then prefixes OmO display namespace", async () => {
 	// given
 	const version = (await readRepoJson("package.json")).version;
 	const label = "Checking Comments";
@@ -123,10 +137,10 @@ test("#given hook status label #when formatting #then prefixes LazyCodex with cu
 	const message = formatLazyCodexHookStatusMessage(version, label);
 
 	// then
-	assert.equal(message, `LazyCodex(${version}): Checking Comments`);
+	assert.equal(message, "(OmO) Checking Comments");
 });
 
-test("#given hook status label with blank version #when formatting #then prefixes LazyCodex with local version", () => {
+test("#given hook status label with blank version #when formatting #then still prefixes OmO display namespace", () => {
 	// given
 	const version = "  ";
 	const label = "Checking Comments";
@@ -135,7 +149,7 @@ test("#given hook status label with blank version #when formatting #then prefixe
 	const message = formatLazyCodexHookStatusMessage(version, label);
 
 	// then
-	assert.equal(message, "LazyCodex(local): Checking Comments");
+	assert.equal(message, "(OmO) Checking Comments");
 });
 
 test("#given loose legacy status label #when normalizing #then removes OMO wording and title-cases label", async () => {
@@ -149,7 +163,7 @@ test("#given loose legacy status label #when normalizing #then removes OMO wordi
 
 	// then
 	assert.equal(normalized, "Checking Comments");
-	assert.equal(message, `LazyCodex(${version}): Checking Comments`);
+	assert.equal(message, "(OmO) Checking Comments");
 });
 
 test("#given LazyCodex appears inside hook label #when normalizing #then product casing is preserved", async () => {
@@ -163,7 +177,7 @@ test("#given LazyCodex appears inside hook label #when normalizing #then product
 
 	// then
 	assert.equal(normalized, "Verifying LazyCodex Executor Evidence");
-	assert.equal(message, `LazyCodex(${version}): Verifying LazyCodex Executor Evidence`);
+	assert.equal(message, "(OmO) Verifying LazyCodex Executor Evidence");
 });
 
 test("#given MCP appears inside hook label #when normalizing #then protocol casing is preserved", () => {
@@ -176,31 +190,29 @@ test("#given MCP appears inside hook label #when normalizing #then protocol casi
 
 	// then
 	assert.equal(normalized, "Recommending Git Bash MCP");
-	assert.equal(message, "LazyCodex(4.10.0): Recommending Git Bash MCP");
+	assert.equal(message, "(OmO) Recommending Git Bash MCP");
 });
-test("#given aggregate comment-checker hook #when status is inspected #then it uses LazyCodex comments label", async () => {
+test("#given aggregate comment-checker hook #when status is inspected #then it uses OmO comments label", async () => {
 	// given
-	const aggregateVersion = await readPluginVersion();
-	const aggregateHooks = await readJson("hooks/hooks.json");
+	const aggregateManifests = await readAggregateHookManifests();
 
 	// when
-	const hooks = collectCommandHooks(aggregateHooks, "hooks/hooks.json", aggregateVersion);
-	const commentCheckerHook = hooks.find((hook) => hook.id === "hooks/hooks.json:PostToolUse:0:0");
+	const hooks = aggregateManifests.flatMap((manifest) => collectCommandHooks(manifest.hooks, manifest.source, manifest.version));
+	const commentCheckerHook = hooks.find((hook) => hook.command.includes("components/comment-checker/dist/cli.js"));
 
 	// then
-	assert.equal(commentCheckerHook?.statusMessage, formatLazyCodexHookStatusMessage(aggregateVersion, "Checking Comments"));
-	assert.doesNotMatch(JSON.stringify(aggregateHooks), /checking\s+OMO\s+comments/i);
+	assert.equal(commentCheckerHook?.statusMessage, formatLazyCodexHookStatusMessage("", "Checking Comments"));
+	assert.doesNotMatch(JSON.stringify(aggregateManifests), /checking\s+OMO\s+comments/i);
 });
 
-test("#given aggregate and component hooks #when status messages are inspected #then all use the LazyCodex formatter", async () => {
+test("#given aggregate and component hooks #when status messages are inspected #then all use the OmO formatter", async () => {
 	// given
-	const aggregateVersion = await readPluginVersion();
-	const aggregateHooks = await readJson("hooks/hooks.json");
+	const aggregateManifests = await readAggregateHookManifests();
 	const componentManifests = await readComponentHookManifests();
 
 	// when
 	const commandHooks = [
-		...collectCommandHooks(aggregateHooks, "hooks/hooks.json", aggregateVersion),
+		...aggregateManifests.flatMap((manifest) => collectCommandHooks(manifest.hooks, manifest.source, manifest.version)),
 		...componentManifests.flatMap((manifest) => collectCommandHooks(manifest.hooks, manifest.source, manifest.version)),
 	];
 	const expectedLabels = new Map([...AGGREGATE_EXPECTED_LABELS, ...COMPONENT_EXPECTED_LABELS]);
@@ -219,6 +231,6 @@ test("#given aggregate and component hooks #when status messages are inspected #
 	const actualLabels = new Set(commandHooks.map((hook) => parseLazyCodexHookStatusMessage(hook.statusMessage)?.label));
 	assert.deepEqual([...expectedLabels.values()].filter((label) => !actualLabels.has(label)), []);
 	for (const hook of commandHooks) {
-		assert.doesNotMatch(hook.statusMessage, /\bOMO\b/i);
+		assert.match(hook.statusMessage, /^\(OmO\) /);
 	}
 });

package/packages/omo-codex/plugin/test/lcx-bug-skills.test.mjs

@@ -20,7 +20,7 @@ test("#given synced lcx-report-bug skill #when inspected #then it files LazyCode
 	assert.match(skill, /gh pr create --repo openai\/codex/);
 	assert.doesNotMatch(skill, /gh pr create --repo "\$TARGET_REPO"/);
 	assert.doesNotMatch(skill, /gh pr create --repo code-yeongyu\/lazycodex/);
-	assert.match(interfaceMetadata, /display_name: "lcx-report-bug \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) lcx-report-bug"/);
 	assert.match(interfaceMetadata, /- "lazycodex bug"/);
 	assert.match(interfaceMetadata, /- "openai codex bug"/);
 });
@@ -40,7 +40,7 @@ test("#given synced lcx-contribute-bug-fix skill #when inspected #then it delive
 	assert.match(skill, /gh pr create --repo openai\/codex/);
 	assert.doesNotMatch(skill, /gh pr create --repo "\$TARGET_REPO"/);
 	assert.doesNotMatch(skill, /gh pr create --repo code-yeongyu\/lazycodex/);
-	assert.match(interfaceMetadata, /display_name: "lcx-contribute-bug-fix \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) lcx-contribute-bug-fix"/);
 	assert.match(interfaceMetadata, /- "contribute a bug fix"/);
 	assert.match(interfaceMetadata, /- "fix bug pr"/);
 });
@@ -55,7 +55,7 @@ test("#given synced lcx-doctor skill #when inspected #then it diagnoses installs
 
 	// then
 	assert.match(skill, /^---\r?\nname: lcx-doctor\r?\n/m);
-	assert.match(interfaceMetadata, /display_name: "lcx-doctor \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) lcx-doctor"/);
 	assert.match(interfaceMetadata, /- "lazycodex doctor"/);
 	assert.match(interfaceMetadata, /- "lazycodex health check"/);
 });

package/packages/omo-codex/plugin/test/sync-hook-status-messages.test.mjs

@@ -88,10 +88,10 @@ test("#given source package versions and component without hooks #when hook stat
 	const aggregateHooks = await readJson(join(root, "hooks", "hooks.json"));
 	const componentHooks = await readJson(join(root, "components", "comment-checker", "hooks", "hooks.json"));
 	const lspHooks = await readJson(join(root, "components", "lsp", "hooks", "hooks.json"));
-	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(0.1.0): Checking Comments");
-	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[1].statusMessage, "LazyCodex(0.1.0): Checking LSP Diagnostics");
-	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(0.1.1): Checking Comments");
-	assert.equal(lspHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(0.2.0): Checking LSP Diagnostics");
+	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
+	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[1].statusMessage, "(OmO) Checking LSP Diagnostics");
+	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
+	assert.equal(lspHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking LSP Diagnostics");
 });
 
 test("#given release version override #when hook status messages sync #then aggregate hooks use release version", async () => {
@@ -139,6 +139,6 @@ test("#given release version override #when hook status messages sync #then aggr
 	// then
 	const aggregateHooks = await readJson(join(root, "hooks", "hooks.json"));
 	const componentHooks = await readJson(join(root, "components", "comment-checker", "hooks", "hooks.json"));
-	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(4.8.0): Checking Comments");
-	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "LazyCodex(4.8.0): Checking Comments");
+	assert.equal(aggregateHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
+	assert.equal(componentHooks.hooks.PostToolUse[0].hooks[0].statusMessage, "(OmO) Checking Comments");
 });

package/packages/omo-codex/plugin/test/sync-skills-test-support.mjs

@@ -22,6 +22,7 @@ export const expectedSkills = [
 	"review-work",
 	"rules",
 	"start-work",
+	"teammode",
 	"ultraresearch",
 	"ulw-loop",
 	"ulw-plan",
@@ -32,6 +33,7 @@ export const componentSkillSources = [
 	["comment-checker", "components/comment-checker/skills/comment-checker"],
 	["lsp", "components/lsp/skills/lsp"],
 	["rules", "components/rules/skills/rules"],
+	["teammode", "components/teammode/skills/teammode"],
 	["ulw-loop", "components/ulw-loop/skills/ulw-loop"],
 	["ulw-plan", "components/ultrawork/skills/ulw-plan"],
 ];

package/packages/omo-codex/plugin/test/sync-skills.test.mjs

@@ -17,6 +17,7 @@ import {
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const repoRoot = join(root, "..", "..", "..");
 const opencodeOnlyToolPattern = /\b(?:call_omo_agent|background_output|team_[a-z_]+|task)\s*\(/;
+const generatedSkillMetadataFiles = new Set(["agents/openai.yaml"]);
 
 async function readPackagedSkillFile(...segments) {
 	const path = join(root, "skills", ...segments);
@@ -24,6 +25,10 @@ async function readPackagedSkillFile(...segments) {
 	return { path, content };
 }
 
+function excludeGeneratedSkillMetadata(files) {
+	return files.filter((file) => !generatedSkillMetadataFiles.has(file.replaceAll("\\", "/")));
+}
+
 test("#given synced aggregate Codex skills #when inspected #then component and shared skills are present", async () => {
 	// given
 	const skillsRoot = join(root, "skills");
@@ -121,8 +126,8 @@ test("#given component skill sources #when aggregate Codex component skills are
 	for (const [skillName, sourcePath] of componentSkillSources) {
 		const sourceDir = join(root, sourcePath);
 		const aggregateDir = join(aggregateSkillsRoot, skillName);
-		const sourceFiles = await listSkillFiles(sourceDir);
-		const aggregateFiles = await listSkillFiles(aggregateDir);
+		const sourceFiles = excludeGeneratedSkillMetadata(await listSkillFiles(sourceDir));
+		const aggregateFiles = excludeGeneratedSkillMetadata(await listSkillFiles(aggregateDir));
 		assert.deepEqual(aggregateFiles, sourceFiles, `${skillName} resource set drifted from its component skill source`);
 		for (const relativePath of sourceFiles) {
 			const sourceContent = await readFile(join(sourceDir, relativePath), "utf8");
@@ -146,7 +151,7 @@ test("#given synced ulw-loop skill #when Codex hint metadata is inspected #then
 
 	// then
 	assert.match(skill, /^---\r?\nname: ulw-loop\r?\n/m);
-	assert.match(interfaceMetadata, /display_name: "ulw-loop \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) ulw-loop"/);
 	assert.doesNotMatch(interfaceMetadata, /ulw-loop \/ ulw-loop/);
 	assert.match(interfaceMetadata, /short_description: "Goal-like ultrawork loop for systematic decomposition"/);
 	assert.match(interfaceMetadata, /default_prompt: "Use \$ulw-loop/);
@@ -179,7 +184,7 @@ test("#given synced git-master skill #when inspected #then commits and git histo
 	assert.match(skill, /Choose the Git tool by the question/);
 	assert.match(skill, /git log -S "text"/);
 	assert.match(skill, /git blame -L start,end -- file/);
-	assert.match(interfaceMetadata, /display_name: "git-master \(omo\)"/);
+	assert.match(interfaceMetadata, /display_name: "\(OmO\) git-master"/);
 	assert.match(interfaceMetadata, /- "git commit"/);
 	assert.match(interfaceMetadata, /- "history search"/);
 });

package/packages/omo-codex/plugin/test/teammode-safety-fixture.mjs

@@ -0,0 +1,88 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { root } from "./aggregate-plugin-fixture.mjs";
+
+const teamScript = join(root, "components", "teammode", "skills", "teammode", "scripts", "team.mjs");
+
+export function createTeamRoot(prefix) {
+	return mkdtempSync(join(tmpdir(), prefix));
+}
+
+export function cleanupTeamRoot(tempRoot) {
+	rmSync(tempRoot, { recursive: true, force: true });
+}
+
+export function teamDir(tempRoot, sessionId) {
+	return join(tempRoot, ".omo", "teams", sessionId);
+}
+
+export function teamJsonPath(tempRoot, sessionId) {
+	return join(teamDir(tempRoot, sessionId), "team.json");
+}
+
+export function readTeamJson(tempRoot, sessionId) {
+	return JSON.parse(readFileSync(teamJsonPath(tempRoot, sessionId), "utf8"));
+}
+
+export function runTeam(cwd, ...args) {
+	const result = runTeamRaw(cwd, ...args);
+	assert.equal(result.status, 0, `team.mjs ${args.join(" ")} failed: ${result.stderr}`);
+	return result;
+}
+
+export function runTeamRaw(cwd, ...args) {
+	return spawnSync(process.execPath, [teamScript, ...args], {
+		cwd,
+		encoding: "utf8",
+		timeout: 10_000,
+	});
+}
+
+export function symlinkOrSkip(t, target, path, type) {
+	try {
+		symlinkSync(target, path, type);
+		return true;
+	} catch (error) {
+		if (isUnavailableSymlinkError(error)) {
+			t.skip(`symlink unavailable on this filesystem: ${error.code}`);
+			return false;
+		}
+		throw error;
+	}
+}
+
+function isUnavailableSymlinkError(error) {
+	return error?.code === "EPERM" || error?.code === "EACCES" || error?.code === "EINVAL";
+}
+
+export function createArchivedOutsideTeam(tempRoot, sessionId) {
+	const outsideTeams = join(tempRoot, "outside-teams");
+	const outsideTeamDir = join(outsideTeams, sessionId);
+	mkdirSync(outsideTeamDir, { recursive: true });
+	writeFileSync(
+		join(outsideTeamDir, "team.json"),
+		`${JSON.stringify(
+			{
+				schemaVersion: 2,
+				teamId: "outside-team",
+				teamName: "Outside",
+				sessionName: "Escape",
+				leader: { kind: "main-session", sessionId },
+				status: "archived",
+				members: [],
+			},
+			null,
+			2,
+		)}\n`,
+	);
+	return { outsideTeams, outsideTeamDir };
+}
+
+export function assertOutsideTeamIntact(outsideTeamDir) {
+	assert.equal(existsSync(outsideTeamDir), true);
+	assert.equal(JSON.parse(readFileSync(join(outsideTeamDir, "team.json"), "utf8")).teamId, "outside-team");
+}

package/packages/omo-codex/plugin/test/teammode-safety.test.mjs

@@ -0,0 +1,240 @@
+import assert from "node:assert/strict";
+import { mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+
+import {
+	assertOutsideTeamIntact,
+	cleanupTeamRoot,
+	createArchivedOutsideTeam,
+	createTeamRoot,
+	readTeamJson,
+	runTeam,
+	runTeamRaw,
+	symlinkOrSkip,
+	teamDir,
+	teamJsonPath,
+} from "./teammode-safety-fixture.mjs";
+
+test("#given guide.md is a symlink #when guide is regenerated #then the outside target stays untouched", (t) => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-guide-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Symlink", "--session-name", "Escape", "--session", "safe-guide");
+		const guidePath = join(teamDir(tempRoot, "safe-guide"), "guide.md");
+		const outsidePath = join(tempRoot, "outside-guide-target.md");
+		writeFileSync(outsidePath, "ORIGINAL_OUTSIDE\n");
+		unlinkSync(guidePath);
+		if (!symlinkOrSkip(t, outsidePath, guidePath)) return;
+
+		const result = runTeamRaw(tempRoot, "guide", "--team", "safe-guide");
+
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /guide\.md is a symlink|persist target escapes/);
+		assert.equal(readFileSync(outsidePath, "utf8"), "ORIGINAL_OUTSIDE\n");
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+
+test("#given member A exists #when add-member receives A with trailing space #then state is not partially mutated", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-duplicate-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Duplicate", "--session-name", "Members", "--session", "safe-duplicate");
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate",
+			"--id",
+			"A",
+			"--focus",
+			"alpha",
+			"--lens",
+			"area",
+			"--deliverable",
+			"first",
+		);
+
+		const result = runTeamRaw(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate",
+			"--id",
+			"A ",
+			"--focus",
+			"beta",
+			"--lens",
+			"ownership",
+			"--deliverable",
+			"second",
+		);
+		const team = readTeamJson(tempRoot, "safe-duplicate");
+
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /member id "A" already exists/);
+		assert.deepEqual(
+			team.members.map((member) => member.id),
+			["A"],
+		);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+
+test("#given member focus already exists #when add-member receives same focus with different spacing and case #then state is not partially mutated", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-duplicate-focus-");
+	try {
+		runTeam(tempRoot, "init", "--name", "DuplicateFocus", "--session-name", "Members", "--session", "safe-duplicate-focus");
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate-focus",
+			"--id",
+			"A",
+			"--focus",
+			"Plugin Hook Packaging",
+			"--lens",
+			"ownership",
+			"--deliverable",
+			"first",
+		);
+
+		const result = runTeamRaw(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-duplicate-focus",
+			"--id",
+			"B",
+			"--focus",
+			" plugin   hook packaging ",
+			"--lens",
+			"area",
+			"--deliverable",
+			"second",
+		);
+		const team = readTeamJson(tempRoot, "safe-duplicate-focus");
+
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /member focus "plugin   hook packaging" duplicates "Plugin Hook Packaging"/);
+		assert.deepEqual(
+			team.members.map((member) => member.id),
+			["A"],
+		);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+
+test("#given only one member exists #when bind-thread runs #then member is not activated", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-understaffed-bind-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Understaffed", "--session-name", "Members", "--session", "safe-understaffed");
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-understaffed",
+			"--id",
+			"A",
+			"--focus",
+			"installer",
+			"--lens",
+			"area",
+			"--deliverable",
+			"first",
+		);
+
+		const result = runTeamRaw(tempRoot, "bind-thread", "--team", "safe-understaffed", "--id", "A", "--thread", "thread-a");
+		let team = readTeamJson(tempRoot, "safe-understaffed");
+
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /at least 2 distinct members/);
+		assert.equal(team.members[0].threadId, null);
+		assert.equal(team.members[0].status, "pending");
+
+		runTeam(
+			tempRoot,
+			"add-member",
+			"--team",
+			"safe-understaffed",
+			"--id",
+			"B",
+			"--focus",
+			"runtime qa",
+			"--lens",
+			"perspective",
+			"--deliverable",
+			"second",
+		);
+		runTeam(tempRoot, "bind-thread", "--team", "safe-understaffed", "--id", "A", "--thread", "thread-a");
+		team = readTeamJson(tempRoot, "safe-understaffed");
+
+		assert.equal(team.members[0].threadId, "thread-a");
+		assert.equal(team.members[0].status, "active");
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+
+test("#given persisted paths are mutated outside trusted team dir #when guide is regenerated #then outside file stays untouched", () => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-mutated-paths-");
+	try {
+		runTeam(tempRoot, "init", "--name", "Mutated", "--session-name", "Paths", "--session", "safe-mutated");
+		const teamPath = teamJsonPath(tempRoot, "safe-mutated");
+		const outsideDir = join(tempRoot, "outside");
+		const outsideGuide = join(outsideDir, "guide.md");
+		mkdirSync(outsideDir);
+		writeFileSync(outsideGuide, "ORIGINAL_OUTSIDE\n");
+		const team = JSON.parse(readFileSync(teamPath, "utf8"));
+		team.paths.dir = outsideDir;
+		team.paths.guide = outsideGuide;
+		writeFileSync(teamPath, `${JSON.stringify(team, null, 2)}\n`);
+
+		const result = runTeamRaw(tempRoot, "guide", "--team", "safe-mutated");
+
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /persisted team dir does not match trusted team dir/);
+		assert.equal(readFileSync(outsideGuide, "utf8"), "ORIGINAL_OUTSIDE\n");
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+
+test("#given team dir is swapped to a symlink #when status reads team state #then command refuses the symlink", (t) => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-dir-symlink-");
+	try {
+		runTeam(tempRoot, "init", "--name", "SymlinkDir", "--session-name", "Paths", "--session", "safe-dir");
+		const targetTeamDir = teamDir(tempRoot, "safe-dir");
+		const outsideDir = join(tempRoot, "outside-team-dir");
+		mkdirSync(outsideDir);
+		rmSync(targetTeamDir, { recursive: true, force: true });
+		if (!symlinkOrSkip(t, outsideDir, targetTeamDir, "dir")) return;
+
+		const result = runTeamRaw(tempRoot, "status", "--team", "safe-dir");
+
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /path component is a symlink|team dir is a symlink/);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});
+
+test("#given teams root is a symlink #when delete runs #then outside team state stays untouched", (t) => {
+	const tempRoot = createTeamRoot("omo-codex-teammode-delete-root-symlink-");
+	try {
+		const { outsideTeams, outsideTeamDir } = createArchivedOutsideTeam(tempRoot, "escape");
+		mkdirSync(join(tempRoot, ".omo"), { recursive: true });
+		if (!symlinkOrSkip(t, outsideTeams, join(tempRoot, ".omo", "teams"), "dir")) return;
+
+		const result = runTeamRaw(tempRoot, "delete", "--team", "escape", "--force");
+
+		assert.notEqual(result.status, 0);
+		assert.match(result.stderr, /path component is a symlink/);
+		assertOutsideTeamIntact(outsideTeamDir);
+	} finally {
+		cleanupTeamRoot(tempRoot);
+	}
+});

package/packages/omo-codex/plugin/test/ultraresearch-skill-contract.test.mjs

@@ -124,3 +124,51 @@ test("#given ultraresearch worker sizing #when spawn guidance is inspected #then
 		);
 	}
 });
+
+test("#given ultraresearch execution substrate #when team usage is inspected #then it prefers a cooperating team with harness-native team tools", async () => {
+	for (const copy of await readUltraresearchCopies()) {
+		assert.match(
+			copy.content,
+			/cooperating team/i,
+			`${copy.label}: body must encourage running the swarm as a cooperating team`,
+		);
+		assert.match(copy.content, /\bteammode\b/i, `${copy.label}: body must name the Codex teammode skill`);
+		assert.match(copy.content, /team_mode/i, `${copy.label}: body must name the OpenCode team_mode path`);
+	}
+});
+
+test("#given ultraresearch team composition #when member slicing is inspected #then members map to part/ownership/perspective, never job titles", async () => {
+	for (const copy of await readUltraresearchCopies()) {
+		assert.match(
+			copy.content,
+			/by part, ownership, or perspective/i,
+			`${copy.label}: body must compose members by part, ownership, or perspective`,
+		);
+		assert.match(
+			copy.content,
+			/never a job title|not (?:a |by )?job title/i,
+			`${copy.label}: body must forbid vague job-title members`,
+		);
+	}
+});
+
+test("#given ultraresearch team communication #when the raise law is inspected #then members broadcast every lead immediately rather than hoarding", async () => {
+	for (const copy of await readUltraresearchCopies()) {
+		assert.match(
+			copy.content,
+			/raise law|broadcast every lead/i,
+			`${copy.label}: body must state the raise/broadcast law`,
+		);
+		assert.match(copy.content, /over-communicate/i, `${copy.label}: body must demand over-communication`);
+		assert.match(
+			copy.content,
+			/the (?:moment|instant) it (?:surfaces|appears|lands)/i,
+			`${copy.label}: body must require raising leads the moment they surface`,
+		);
+		assert.match(
+			copy.content,
+			/hoard/i,
+			`${copy.label}: body must reject hoarding leads for a final dump`,
+		);
+	}
+});