oh-my-opencode 4.14.0 → 4.14.1

package/packages/omo-codex/scripts/install-delegated-command.test.mjs

@@ -75,11 +75,104 @@ test("#given a dry-run doctor #when delegating #then routes to the Codex LazyCod
 	// then
 	assert.equal(ran, false);
 	assert.match(logged, /^codex exec /);
+	assert.match(logged, /--sandbox danger-full-access/);
+	assert.doesNotMatch(logged, /--model/);
+	assert.doesNotMatch(logged, /gpt-5\.5-codex-mini/);
+	assert.doesNotMatch(logged, /--sandbox read-only/);
 	assert.match(logged, /Use \$omo:lcx-doctor/);
+	assert.match(logged, /LAZYCODEX_SOURCE_ROOT/);
+	assert.match(logged, /\$\{TMPDIR:-\/tmp\}\/lazycodex-sources/);
 	assert.match(logged, /Requested doctor arguments: --json/);
 	assert.doesNotMatch(logged, /oh-my-openagent omo doctor/);
 });
 
+test("#given doctor without model override #when delegating #then uses the configured Codex default model", async () => {
+	// given
+	const parsed = { kind: "command", command: "doctor", args: ["--json"] };
+
+	// when
+	const invocation = buildDelegatedOmoInvocation(parsed);
+
+	// then
+	assert.equal(invocation.command, "codex");
+	assert.equal(invocation.args.includes("--model"), false);
+	assert.equal(invocation.args.some((arg) => arg.includes("gpt-5.5-codex-mini")), false);
+});
+
+test("#given explicit doctor model override #when delegating #then passes only that model to Codex exec", async () => {
+	// given
+	const parsed = { kind: "command", command: "doctor", args: ["--model", "gpt-5.5", "--json"] };
+
+	// when
+	const invocation = buildDelegatedOmoInvocation(parsed);
+
+	// then
+	assert.equal(invocation.command, "codex");
+	assert.deepEqual(invocation.args.slice(0, 9), [
+		"exec",
+		"--ephemeral",
+		"--sandbox",
+		"danger-full-access",
+		"--skip-git-repo-check",
+		"--cd",
+		".",
+		"--model",
+		"gpt-5.5",
+	]);
+	assert.match(invocation.args.at(-1), /Requested doctor arguments: --json/);
+	assert.doesNotMatch(invocation.args.at(-1), /--model/);
+});
+
+test("#given doctor source-root override #when delegating #then passes it to the Codex workflow environment", async () => {
+	// given
+	const parsed = { kind: "command", command: "doctor", args: ["--source-root", "/var/tmp/lcx-sources", "--json"] };
+
+	// when
+	const invocation = buildDelegatedOmoInvocation(parsed);
+
+	// then
+	assert.equal(invocation.env?.LAZYCODEX_SOURCE_ROOT, "/var/tmp/lcx-sources");
+	assert.deepEqual(invocation.args.slice(0, 7), [
+		"exec",
+		"--ephemeral",
+		"--sandbox",
+		"danger-full-access",
+		"--skip-git-repo-check",
+		"--cd",
+		".",
+	]);
+	assert.match(invocation.args.at(-1), /Requested doctor arguments: --json/);
+	assert.doesNotMatch(invocation.args.at(-1), /--source-root/);
+});
+
+test("#given dry-run install without explicit platform #when delegating #then logs one Windows-safe Codex install command", async () => {
+	// given
+	const parsed = {
+		kind: "command",
+		command: "install",
+		dryRun: true,
+		noTui: true,
+		skipAuth: false,
+		autonomousPermissions: true,
+		repoRoot: undefined,
+		args: [],
+	};
+	const logged = [];
+
+	// when
+	await runDelegatedOmoCommand(parsed, {
+		cwd: "/tmp/project",
+		log: (line) => {
+			logged.push(line);
+		},
+		runCommand: async () => {},
+	});
+
+	// then
+	assert.deepEqual(logged, [
+		"npx --yes oh-my-openagent@latest install --platform=codex --no-tui --codex-autonomous",
+	]);
+});
 test("#given doctor recursion guard is active #when lazycodex doctor delegates #then rejects before launching Codex", async () => {
 	// given
 	const parsed = { kind: "command", command: "doctor", args: [] };

package/packages/omo-codex/scripts/install-dist/install-local.mjs

@@ -5907,7 +5907,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@oh-my-opencode/omo-codex",
-    version: "4.14.0",
+    version: "4.14.1",
     type: "module",
     private: true,
     description: "Codex harness adapter for oh-my-openagent. Vendored Codex plugin namespace (omo) + TypeScript installer + telemetry.",
@@ -6603,10 +6603,9 @@ function posixRuntimeWrapper(cliPath, codexHome, binDir, nodeCliPath) {
     "#!/bin/sh",
     `# ${RUNTIME_WRAPPER_MARKER}`,
     `export CODEX_HOME="\${CODEX_HOME:-${escapedCodexHome}}"`,
-    'export OMO_SPARKSHELL_APP_SERVER_SOCKET="${OMO_SPARKSHELL_APP_SERVER_SOCKET:-$CODEX_HOME/app-server-control/app-server-control.sock}"',
     'if [ "$1" = "ulw-loop" ] && [ -x "' + escapedUlwLoopBin + '" ]; then',
     "  shift",
-    '  exec "' + escapedUlwLoopBin + '" "$@"',
+    '  exec "' + escapedUlwLoopBin + '" ulw-loop "$@"',
     "fi",
     `if [ "\${OMO_RUNTIME:-}" = "node" ] && [ -f "${nodeCli}" ]; then`,
     `  exec node "${nodeCli}" "$@"`,
@@ -6645,11 +6644,10 @@ function windowsRuntimeWrapper(cliPath, codexHome, binDir, nodeCliPath) {
     "@echo off",
     `rem ${RUNTIME_WRAPPER_MARKER}`,
     `if not defined CODEX_HOME set "CODEX_HOME=${codexHome}"`,
-    'if not defined OMO_SPARKSHELL_APP_SERVER_SOCKET set "OMO_SPARKSHELL_APP_SERVER_SOCKET=%CODEX_HOME%\\app-server-control\\app-server-control.sock"',
     ...windowsNodeDiscoveryLines(),
     `if "%~1"=="ulw-loop" if exist "${ulwLoopBin}" (`,
     "  shift /1",
-    `  "${ulwLoopBin}" %*`,
+    `  "${ulwLoopBin}" ulw-loop %*`,
     "  exit /b %ERRORLEVEL%",
     ")",
     `if "%OMO_RUNTIME%"=="node" if defined OMO_NODE_BINARY if exist "${nodeCliPath}" (`,
@@ -7442,6 +7440,7 @@ async function installCachedPlugin(input) {
     await copyDirectory(input.sourcePath, tempPath);
     await rewriteCachedPackageLocalFileDependencies(tempPath, input.sourcePath);
     await copyBundledMcpRuntimeDists({ pluginRoot: tempPath, sourceRoot: input.sourcePath });
+    await copyRootRuntimeDists({ pluginRoot: tempPath, sourcePath: input.sourcePath });
     await maybeRunNpmInstall(tempPath, input.runCommand, ["ci", "--omit=dev"]);
     await removeCachedManagedNpmBinShims(tempPath);
     if (input.buildSource === false)
@@ -7524,6 +7523,29 @@ function shouldCopyPluginPath(path, root) {
   const parts = relative4.split(sep5);
   return !parts.some((part) => part === ".git" || part === "node_modules");
 }
+async function copyRootRuntimeDists(input) {
+  const repoRoot = repoRootForCodexPluginSource(input.sourcePath);
+  if (repoRoot === null)
+    return;
+  for (const runtimePath of ["dist/cli", "dist/cli-node"]) {
+    const sourcePath = join11(repoRoot, runtimePath);
+    if (!await fileExistsStrict(join11(sourcePath, "index.js")))
+      continue;
+    await mkdir3(dirname4(join11(input.pluginRoot, runtimePath)), { recursive: true });
+    await cp2(sourcePath, join11(input.pluginRoot, runtimePath), { recursive: true });
+  }
+}
+function repoRootForCodexPluginSource(sourcePath) {
+  const codexPackageRoot = dirname4(sourcePath);
+  const packagesRoot = dirname4(codexPackageRoot);
+  if (basename3(sourcePath) !== "plugin")
+    return null;
+  if (basename3(codexPackageRoot) !== "omo-codex")
+    return null;
+  if (basename3(packagesRoot) !== "packages")
+    return null;
+  return dirname4(packagesRoot);
+}
 // packages/omo-codex/src/install/codex-cache-prune.ts
 import { lstat as lstat4, readdir as readdir3, rm as rm4, stat as stat3 } from "node:fs/promises";
 import { join as join12 } from "node:path";
@@ -8117,7 +8139,7 @@ function ensureMarketplaceBlock(config, marketplaceName, source) {
 }
 
 // packages/omo-codex/src/install/codex-config-permissions.ts
-var AUTONOMOUS_FEATURES = ["multi_agent", "child_agents_md", "unified_exec", "goals"];
+var AUTONOMOUS_FEATURES = ["multi_agent", "unified_exec", "goals"];
 function ensureAutonomousPermissions(config) {
   let next = replaceOrInsertRootSetting(config, "approval_policy", JSON.stringify("never"));
   next = replaceOrInsertRootSetting(next, "sandbox_mode", JSON.stringify("danger-full-access"));
@@ -8537,7 +8559,6 @@ async function updateCodexConfig(input) {
   config = ensureFeatureEnabled(config, "plugins");
   config = ensureFeatureEnabled(config, "plugin_hooks");
   config = ensureFeatureEnabled(config, "multi_agent");
-  config = ensureFeatureEnabled(config, "child_agents_md");
   config = removeUnsupportedCodexMultiAgentModeConfig(config);
   config = ensureCodexReasoningConfig(config, await readCodexModelCatalog(input.repoRoot));
   config = ensureCodexMultiAgentV2Config(config);
@@ -13554,7 +13575,7 @@ async function runCodexInstaller(options = {}) {
       if (runtimeLink !== null)
         log2(`Linked ${runtimeLink.name} -> ${runtimeLink.target}`);
       else
-        log2(`Warning: skipped the omo runtime wrapper because ${join31(repoRoot, "dist", "cli", "index.js")} is missing; omo sparkshell/ulw-loop commands will be unavailable until a package shipping dist/cli is installed`);
+        log2(`Warning: skipped the omo runtime wrapper because ${join31(repoRoot, "dist", "cli", "index.js")} is missing; omo ulw-loop commands will be unavailable until a package shipping dist/cli is installed`);
     }
     pluginSources.push({ name: entry.name, sourcePath });
     installed.push(plugin);
@@ -13855,6 +13876,7 @@ function formatLazyCodexInstallHelp() {
     "Usage: lazycodex-ai install [--no-tui] [--codex-autonomous|--no-codex-autonomous] [--repo-root <path>]",
     "       lazycodex-ai uninstall [--project <path>]",
     "       lazycodex-ai update [--dry-run] [--repo-root <path>]",
+    "       lazycodex-ai doctor [--source-root <path>] [--model <model>] [--json|--status|--verbose]",
     "       lazycodex-ai version",
     "       lazycodex-ai <command> [args...]",
     "",
@@ -13884,20 +13906,22 @@ async function runDelegatedOmoCommand(parsed, options) {
 function buildDelegatedOmoInvocation(parsed) {
   if (parsed.command === "doctor")
     return buildLazyCodexDoctorInvocation(parsed.args);
-  const args = ["--yes", "--package", "oh-my-openagent", "omo", parsed.command];
   if (parsed.command === "install") {
-    args.push("--platform=codex");
+    const args2 = ["--yes", "oh-my-openagent@latest", parsed.command, "--platform=codex"];
     if (parsed.noTui)
-      args.push("--no-tui");
+      args2.push("--no-tui");
     if (parsed.skipAuth)
-      args.push("--skip-auth");
+      args2.push("--skip-auth");
     if (parsed.autonomousPermissions !== false)
-      args.push("--codex-autonomous");
+      args2.push("--codex-autonomous");
     if (parsed.autonomousPermissions === false)
-      args.push("--no-codex-autonomous");
+      args2.push("--no-codex-autonomous");
     if (parsed.repoRoot)
-      args.push(`--repo-root=${parsed.repoRoot}`);
-  } else if (parsed.command === "cleanup") {
+      args2.push(`--repo-root=${parsed.repoRoot}`);
+    return { command: "npx", args: args2, delegatesToOmo: true };
+  }
+  const args = ["--yes", "--package", "oh-my-openagent", "omo", parsed.command];
+  if (parsed.command === "cleanup") {
     args.push("--platform=codex", ...parsed.args);
   } else {
     args.push(...parsed.args);
@@ -13905,21 +13929,26 @@ function buildDelegatedOmoInvocation(parsed) {
   return { command: "npx", args, delegatesToOmo: true };
 }
 function buildLazyCodexDoctorInvocation(doctorArgs) {
+  const doctorOptions = parseLazyCodexDoctorOptions(doctorArgs);
+  const codexArgs = [
+    "exec",
+    "--ephemeral",
+    "--sandbox",
+    "danger-full-access",
+    "--skip-git-repo-check",
+    "--cd",
+    "."
+  ];
+  if (doctorOptions.model !== undefined)
+    codexArgs.push("--model", doctorOptions.model);
+  codexArgs.push(buildLazyCodexDoctorPrompt(doctorOptions.args));
   return {
     command: "codex",
-    args: [
-      "exec",
-      "--ephemeral",
-      "--sandbox",
-      "read-only",
-      "--skip-git-repo-check",
-      "--cd",
-      ".",
-      buildLazyCodexDoctorPrompt(doctorArgs)
-    ],
+    args: codexArgs,
     delegatesToOmo: false,
     env: {
-      LAZYCODEX_DOCTOR_LCX_ACTIVE: "1"
+      LAZYCODEX_DOCTOR_LCX_ACTIVE: "1",
+      ...doctorOptions.sourceRoot === undefined ? {} : { LAZYCODEX_SOURCE_ROOT: doctorOptions.sourceRoot }
     }
   };
 }
@@ -13927,12 +13956,58 @@ function buildLazyCodexDoctorPrompt(doctorArgs) {
   return [
     "Use $omo:lcx-doctor to diagnose this LazyCodex/Codex installation.",
     "This command is already the lazycodex doctor surface; never invoke lazycodex doctor from inside the doctor workflow.",
-    "Sync the latest LazyCodex and OpenAI Codex sources into /tmp, inventory the local installation,",
+    "Use the resolved source root from LAZYCODEX_SOURCE_ROOT when set; otherwise use ${TMPDIR:-/tmp}/lazycodex-sources.",
+    "Validate cached source checkouts before reuse, quarantine corrupt caches, and do not rely on /tmp/lazycodex-source.",
+    "Sync the latest LazyCodex and OpenAI Codex sources there, inventory the local installation,",
     "probe the Codex plugin/cache/hooks/MCP state, and report PASS/WARN/FAIL findings with evidence and remediations.",
     buildDoctorOutputInstruction(doctorArgs),
     doctorArgs.length > 0 ? `Requested doctor arguments: ${doctorArgs.join(" ")}` : "Requested doctor arguments: none"
   ].join(" ");
 }
+function parseLazyCodexDoctorOptions(doctorArgs) {
+  const args = [];
+  let model;
+  let sourceRoot;
+  let index = 0;
+  while (index < doctorArgs.length) {
+    const arg = doctorArgs[index];
+    if (arg === "--model") {
+      const value = doctorArgs[index + 1];
+      if (typeof value !== "string" || value.trim().length === 0)
+        throw new Error("--model requires a value");
+      model = value;
+      index += 2;
+      continue;
+    }
+    if (typeof arg === "string" && arg.startsWith("--model=")) {
+      const value = arg.slice("--model=".length);
+      if (value.trim().length === 0)
+        throw new Error("--model requires a value");
+      model = value;
+      index += 1;
+      continue;
+    }
+    if (arg === "--source-root") {
+      const value = doctorArgs[index + 1];
+      if (typeof value !== "string" || value.trim().length === 0)
+        throw new Error("--source-root requires a path");
+      sourceRoot = value;
+      index += 2;
+      continue;
+    }
+    if (typeof arg === "string" && arg.startsWith("--source-root=")) {
+      const value = arg.slice("--source-root=".length);
+      if (value.trim().length === 0)
+        throw new Error("--source-root requires a path");
+      sourceRoot = value;
+      index += 1;
+      continue;
+    }
+    args.push(arg);
+    index += 1;
+  }
+  return { args, ...model === undefined ? {} : { model }, ...sourceRoot === undefined ? {} : { sourceRoot } };
+}
 function buildDoctorOutputInstruction(doctorArgs) {
   if (doctorArgs.includes("--json")) {
     return "Return exactly one JSON object with summary, environment, checks, remediations, and knownIssues fields; do not wrap it in Markdown.";

package/packages/omo-codex/scripts/install-local-entrypoint.test.mjs

@@ -69,7 +69,7 @@ test("#given dry-run install flags #when running the Node installer entrypoint #
 	).trim();
 
 	// then
-	assert.equal(output, "npx --yes --package oh-my-openagent omo install --platform=codex --no-tui --codex-autonomous");
+	assert.equal(output, "npx --yes oh-my-openagent@latest install --platform=codex --no-tui --codex-autonomous");
 });
 
 test("#given dry-run install opt-out #when running the Node installer entrypoint #then preserves existing Codex permission settings", () => {
@@ -84,7 +84,21 @@ test("#given dry-run install opt-out #when running the Node installer entrypoint
 	).trim();
 
 	// then
-	assert.equal(output, "npx --yes --package oh-my-openagent omo install --platform=codex --no-tui --no-codex-autonomous");
+	assert.equal(output, "npx --yes oh-my-openagent@latest install --platform=codex --no-tui --no-codex-autonomous");
+});
+
+test("#given explicit non-Codex dry-run platform #when running the Node installer entrypoint #then rejects it", () => {
+	// given
+	const scriptPath = fileURLToPath(new URL("./install-local.mjs", import.meta.url));
+
+	// when/then
+	assert.throws(
+		() =>
+			execFileSync(process.execPath, [scriptPath, "--dry-run", "install", "--platform=gemini", "--no-tui"], {
+				encoding: "utf8",
+			}),
+		/lazycodex-ai installs the Codex Light edition only/,
+	);
 });
 
 test("#given dry-run doctor #when running the Node installer entrypoint #then prints Codex LazyCodex doctor workflow command", () => {
@@ -98,7 +112,12 @@ test("#given dry-run doctor #when running the Node installer entrypoint #then pr
 
 	// then
 	assert.match(output, /^codex exec /);
+	assert.match(output, /--sandbox danger-full-access/);
+	assert.doesNotMatch(output, /--model/);
+	assert.doesNotMatch(output, /gpt-5\.5-codex-mini/);
+	assert.doesNotMatch(output, /--sandbox read-only/);
 	assert.match(output, /Use \$omo:lcx-doctor/);
+	assert.match(output, /\$\{TMPDIR:-\/tmp\}\/lazycodex-sources/);
 	assert.match(output, /Requested doctor arguments: --json/);
 	assert.match(output, /Return exactly one JSON object/);
 	assert.doesNotMatch(output, /oh-my-openagent omo doctor/);

package/packages/omo-codex/scripts/install-local.test.mjs

@@ -69,7 +69,6 @@ test("#given custom CODEX_HOME and PATH without omo #when installing locally wit
 		new RegExp(escapeRegExp(escapePosixDoubleQuoted(toPosixPath(join(repoRoot, "dist", "cli", "index.js"))))),
 	);
 	assert.match(wrapper, /CODEX_HOME/);
-	assert.match(wrapper, /OMO_SPARKSHELL_APP_SERVER_SOCKET/);
 	assert.match(wrapper, /omo-ulw-loop/);
 });
 

package/packages/shared-skills/skills/lcx-contribute-bug-fix/SKILL.md

@@ -18,7 +18,7 @@ Route ownership the same way as `$lcx-report-bug`, but the deliverable differs b
 
 For `openai/codex`, create a fork PR that includes:
 
-- a focused branch from a fresh `/tmp` clone/worktree
+- a focused branch from a fresh `${TMPDIR:-/tmp}` clone/worktree
 - reproduction logs from before the fix
 - the smallest implementation that fixes the defect
 - verification logs from after the fix
@@ -30,7 +30,7 @@ For `code-yeongyu/lazycodex`, create an issue (never a PR) that includes:
 
 - reproduction logs from before the fix
 - the root cause with source evidence
-- the verified patch as a unified diff, produced and tested in a fresh `/tmp` clone/worktree
+- the verified patch as a unified diff, produced and tested in a fresh `${TMPDIR:-/tmp}` clone/worktree
 - verification logs from after the fix
 - the `lazycodex-generated` label and the footer tag `Tag: lazycodex-generated`
 - cleanup of temporary worktrees and clones
@@ -39,27 +39,58 @@ For `code-yeongyu/lazycodex`, create an issue (never a PR) that includes:
 
 1. Read the user's bug report and identify the affected surface.
 2. Invoke `$omo:debugging` for the investigation. If only unqualified skill names are exposed, invoke `$debugging` and state that it is the OMO debugging skill.
-3. Materialize the latest sources, then decide the target repository. Sync both checkouts on every run and compare them before choosing — a stale checkout routes the fix to the wrong repo:
+3. Materialize the latest sources under `LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"`, then decide the target repository. Sync both checkouts on every run and compare them before choosing. Validate cached checkouts before reuse so an incomplete `.git` directory cannot route the fix to the wrong repo:
 
 ```bash
+LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"
+mkdir -p "$LAZYCODEX_SOURCE_ROOT"
+
+valid_source_checkout() {
+  DEST="$1"
+  git -C "$DEST" rev-parse --is-inside-work-tree >/dev/null 2>&1 &&
+    git -C "$DEST" config --get remote.origin.url >/dev/null 2>&1
+}
+
+recover_corrupt_source_checkout() {
+  DEST="$1"
+  if [ -e "$DEST" ] && ! valid_source_checkout "$DEST"; then
+    QUARANTINED="$DEST.corrupt.$(date +%Y%m%d%H%M%S)"
+    mv "$DEST" "$QUARANTINED"
+    echo "Moved corrupt source cache $DEST to $QUARANTINED" >&2
+  fi
+}
+
 sync_latest_source() {
   REPO="$1"; DEST="$2"
-  if [ ! -d "$DEST/.git" ]; then
+  recover_corrupt_source_checkout "$DEST"
+  if [ ! -d "$DEST" ]; then
     gh repo clone "$REPO" "$DEST" -- --depth=1 \
       || git clone --depth=1 "https://github.com/$REPO" "$DEST"
   fi
+  if ! valid_source_checkout "$DEST"; then
+    echo "Source cache $DEST is not a usable git checkout after clone" >&2
+    return 1
+  fi
+  git -C "$DEST" remote set-url origin "https://github.com/$REPO.git" >/dev/null 2>&1 || true
   DEFAULT_BRANCH="$(git -C "$DEST" remote show origin | sed -n '/HEAD branch/s/.*: //p')"
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    DEFAULT_BRANCH="$(git -C "$DEST" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+  fi
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    echo "Could not determine default branch for $REPO in $DEST" >&2
+    return 1
+  fi
   git -C "$DEST" fetch --depth=1 origin "$DEFAULT_BRANCH"
   git -C "$DEST" checkout -B "$DEFAULT_BRANCH" FETCH_HEAD
 }
-sync_latest_source code-yeongyu/lazycodex /tmp/lazycodex-source
-sync_latest_source openai/codex /tmp/openai-codex-source
+sync_latest_source code-yeongyu/lazycodex "$LAZYCODEX_SOURCE_ROOT/lazycodex-source"
+sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/openai-codex-source"
 ```
-4. Create a fresh temporary clone and branch. Do not modify the user's current repository for the target fix unless the current repository is itself the requested target and the user explicitly asked for local edits.
+4. Create a fresh temporary clone and branch under `${TMPDIR:-/tmp}`. Do not modify the user's current repository for the target fix unless the current repository is itself the requested target and the user explicitly asked for local edits.
 
 ```bash
 TARGET_REPO="code-yeongyu/lazycodex" # or openai/codex
-WORK_ROOT="$(mktemp -d /tmp/lazycodex-fix-XXXXXX)"
+WORK_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/lazycodex-fix-XXXXXX")"
 gh repo clone "$TARGET_REPO" "$WORK_ROOT/repo" -- --depth=1
 cd "$WORK_ROOT/repo"
 BASE_BRANCH="$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')"
@@ -71,7 +102,7 @@ cd "$WORK_ROOT/worktree"
 
 If `gh` cannot clone, use `git clone --depth=1 "https://github.com/$TARGET_REPO" "$WORK_ROOT/repo"` and continue with the same worktree flow.
 
-5. Reproduce the bug in the worktree through the real surface. Save exact command output to `/tmp/lazycodex-fix-<short-slug>-repro.log`.
+5. Reproduce the bug in the worktree through the real surface. Save exact command output to `${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-repro.log`.
 6. Write or update a failing regression test before production changes. Confirm it fails for the bug, not for a missing fixture or typo.
 7. Implement the smallest correct fix. Avoid refactors unless the fix cannot be made safely without one.
 8. Run the regression test, adjacent tests, and the smallest real-surface QA command that proves the user-visible behavior changed.
@@ -89,7 +120,7 @@ git log --oneline "origin/$BASE_BRANCH..HEAD"
    - `code-yeongyu/lazycodex`: export the verified patch and write the issue body from the Verified-Fix Issue Template below:
 
 ```bash
-PATCH_FILE="/tmp/lazycodex-fix-<short-slug>.patch"
+PATCH_FILE="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>.patch"
 git diff "origin/$BASE_BRANCH"..HEAD > "$PATCH_FILE"
 ```
 
@@ -108,7 +139,7 @@ fi
    - `code-yeongyu/lazycodex`: create the verified-fix issue. Never push a branch to this repo and never run `gh pr create` against it:
 
 ```bash
-ISSUE_BODY="/tmp/lazycodex-fix-<short-slug>-issue.md"
+ISSUE_BODY="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-issue.md"
 gh issue create --repo code-yeongyu/lazycodex --title "<short fix title>" "${LABEL_ARGS[@]}" --body-file "$ISSUE_BODY"
 ```
 
@@ -184,8 +215,8 @@ Use the bundled script to generate the PR body. Create a JSON file with this sha
 Run:
 
 ```bash
-PR_INPUT="/tmp/lazycodex-fix-<short-slug>-pr.json"
-PR_BODY="/tmp/lazycodex-fix-<short-slug>-pr.md"
+PR_INPUT="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-pr.json"
+PR_BODY="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-pr.md"
 node "<skill-root>/scripts/create-pr-body.mjs" "$PR_INPUT" "$PR_BODY"
 ```
 

package/packages/shared-skills/skills/lcx-contribute-bug-fix/agents/openai.yaml

@@ -9,4 +9,4 @@ interface:
     - "lazycodex fix"
     - "omo-codex bug fix"
     - "codex bug fix pr"
-  default_prompt: "Use $lcx-contribute-bug-fix to debug this LazyCodex or Codex bug, work from a fresh /tmp clone and worktree, implement the smallest verified fix, apply the lazycodex-generated label, deliver it (verified-fix issue on code-yeongyu/lazycodex — never a PR there; fork PR only for openai/codex), and clean up."
+  default_prompt: "Use $lcx-contribute-bug-fix to debug this LazyCodex or Codex bug, work from a fresh ${TMPDIR:-/tmp} clone and worktree, implement the smallest verified fix, apply the lazycodex-generated label, deliver it (verified-fix issue on code-yeongyu/lazycodex — never a PR there; fork PR only for openai/codex), and clean up."

package/packages/shared-skills/skills/lcx-doctor/SKILL.md

@@ -7,40 +7,73 @@ metadata:
 
 # lcx-doctor
 
-You are a LazyCodex install doctor. Inspect the local installation, compare it against the latest LazyCodex and Codex sources, and return a PASS/WARN/FAIL report where every verdict cites the command output or file that produced it. Diagnose only: the only writes you make are under `/tmp`. Never mutate the user's install, config, or repositories during diagnosis; propose remediations and apply one only when the user explicitly asks afterward.
+You are a LazyCodex install doctor. Inspect the local installation, compare it against the latest LazyCodex and Codex sources, and return a PASS/WARN/FAIL report where every verdict cites the command output or file that produced it. Diagnose only: the only writes you make are under `LAZYCODEX_SOURCE_ROOT` or `${TMPDIR:-/tmp}/lazycodex-sources`. Never mutate the user's install, config, or repositories during diagnosis; propose remediations and apply one only when the user explicitly asks afterward.
 
 Use GPT-5.5 style: outcome first, concise, evidence-bound.
 
 ## Required Workflow
 
-1. Materialize the latest sources under `/tmp` first. Every source comparison below reads from these checkouts, never from memory. Re-sync on every run so a cached checkout cannot go stale:
+1. Materialize the latest sources under `LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"` first. Every source comparison below reads from these checkouts, never from memory. Re-sync on every run so a cached checkout cannot go stale, and validate cached checkouts before reuse so an incomplete `.git` directory cannot poison diagnosis:
 
 ```bash
+LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"
+mkdir -p "$LAZYCODEX_SOURCE_ROOT"
+
+valid_source_checkout() {
+  DEST="$1"
+  git -C "$DEST" rev-parse --is-inside-work-tree >/dev/null 2>&1 &&
+    git -C "$DEST" config --get remote.origin.url >/dev/null 2>&1
+}
+
+recover_corrupt_source_checkout() {
+  DEST="$1"
+  if [ -e "$DEST" ] && ! valid_source_checkout "$DEST"; then
+    QUARANTINED="$DEST.corrupt.$(date +%Y%m%d%H%M%S)"
+    mv "$DEST" "$QUARANTINED"
+    echo "Moved corrupt source cache $DEST to $QUARANTINED" >&2
+  fi
+}
+
 sync_latest_source() {
   REPO="$1"; DEST="$2"
-  if [ ! -d "$DEST/.git" ]; then
+  recover_corrupt_source_checkout "$DEST"
+  if [ ! -d "$DEST" ]; then
     gh repo clone "$REPO" "$DEST" -- --depth=1 \
       || git clone --depth=1 "https://github.com/$REPO" "$DEST"
   fi
+  if ! valid_source_checkout "$DEST"; then
+    echo "Source cache $DEST is not a usable git checkout after clone" >&2
+    return 1
+  fi
+  git -C "$DEST" remote set-url origin "https://github.com/$REPO.git" >/dev/null 2>&1 || true
   DEFAULT_BRANCH="$(git -C "$DEST" remote show origin | sed -n '/HEAD branch/s/.*: //p')"
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    DEFAULT_BRANCH="$(git -C "$DEST" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+  fi
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    echo "Could not determine default branch for $REPO in $DEST" >&2
+    return 1
+  fi
   git -C "$DEST" fetch --depth=1 origin "$DEFAULT_BRANCH"
   git -C "$DEST" checkout -B "$DEFAULT_BRANCH" FETCH_HEAD
 }
-sync_latest_source code-yeongyu/lazycodex /tmp/lazycodex-source
-sync_latest_source openai/codex /tmp/openai-codex-source
+sync_latest_source code-yeongyu/lazycodex "$LAZYCODEX_SOURCE_ROOT/lazycodex-source"
+sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/openai-codex-source"
 ```
 
 2. Inventory the installed surface. Resolve `CODEX_HOME` (default `~/.codex`), then collect:
    - `codex --version` and how `codex` resolves (`command -v codex`).
    - Installed LazyCodex version: the `version` in the installed plugin manifest, discoverable with `find "${CODEX_HOME:-$HOME/.codex}/plugins" -path '*/.codex-plugin/plugin.json'`. Installed plugins live under `$CODEX_HOME/plugins/cache/<marketplace>/<name>/<version>/`.
-   - Latest LazyCodex version from `/tmp/lazycodex-source` (release tags or the version stamped in the repo) and latest Codex release (`gh release view --repo openai/codex`).
+   - Latest LazyCodex version from `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` (release tags or the version stamped in the repo) and latest Codex release (`gh release view --repo openai/codex`).
    - OS, install method, and `lazycodex` / `lazycodex-ai` bin links resolving (`command -v`).
-3. Check config and wiring against the latest installer, not against assumptions. Read what the current installer under `/tmp/lazycodex-source` writes (installer sources live in the omo-codex package, e.g. `scripts/install/`), then verify the local equivalents:
+3. Check config and wiring against the latest installer, not against assumptions. Read what the current installer under `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` writes (installer sources live in the omo-codex package, e.g. `scripts/install/`), then verify the local equivalents:
    - `$CODEX_HOME/config.toml` exists and parses; LazyCodex-managed entries match what the latest installer would write.
-   - Plugin payload present and non-empty: `hooks/hooks.json`, `skills/`, `.mcp.json`, components under the installed plugin root.
+   - Plugin payload present and non-empty: read `.codex-plugin/plugin.json`; when that manifest declares a `hooks` array, validate every direct hook path declared by the manifest; require `hooks/hooks.json` only when the manifest declares it; do not require retired paths such as `components/workflow-selector` or `hooks/user-prompt-submit-selecting-lazycodex-workflow.json` unless the current manifest declares them.
+   - Verify the manifest-declared runtime payload, not a remembered source tree. Current payload includes `skills/`, `.mcp.json`, root CLI runtimes such as `dist/cli/index.js` and `dist/cli-node/index.js`, and every hook/MCP `components/*/dist/*.js` target referenced by installed manifests.
+   - Treat install-time materialization rewrites as expected when the rewritten target exists and is non-empty. For example, `.mcp.json` may use plugin-local or absolute installed paths for CodeGraph/MCP runtimes; that is PASS/WARN context, not payload drift. Missing or zero-byte rewritten targets are FAIL.
    - Stale project-local leftovers the installer now removes (e.g. `.codex/hooks.json`, `.codex/skills` in the project) are flagged, not deleted.
-4. Probe the real surface. Do not invoke `lazycodex doctor`; this skill is already running inside that doctor workflow, so calling it would recurse. Instead run non-recursive probes directly: `codex --version`, `command -v codex`, the bin-link checks above, config/plugin payload inspections, and a trivial non-interactive Codex invocation that loads the plugin. Capture stderr verbatim; a clean exit with warnings is WARN, not PASS.
-5. Compare for drift. Where installed bundled files differ from the same files at the installed version, or the latest source renamed or removed something the local config still references, record it with both paths.
+4. Probe the real surface. Do not invoke `lazycodex doctor`; this skill is already running inside that doctor workflow, so calling it would recurse. Instead run non-recursive probes directly: `codex --version`, `command -v codex`, the bin-link checks above, config/plugin payload inspections, and a trivial non-interactive Codex invocation that loads the plugin. Use the configured Codex default model for the runtime probe unless the user explicitly passed a model override to the doctor surface; never force a guessed/rejected model such as `gpt-5.5-codex-mini`. Capture stderr verbatim; a clean exit with warnings is WARN, not PASS.
+5. Compare for drift. Where installed manifest-declared bundled files differ from the same files at the installed version, or the latest source removed or renamed something the local config still references, record it with both paths. Do not report expected materialization differences, such as absolute `.mcp.json` runtime paths, as drift when their targets exist and are non-empty.
 6. Check whether each FAIL is already known: `gh issue list --repo code-yeongyu/lazycodex --search "<short symptom>" --state open` (and `openai/codex` when the failure points upstream). Link matches in the report instead of re-diagnosing from scratch.
 7. If a probe fails and the cause is not explained by config or source comparison, invoke `$omo:debugging` for the investigation. If Codex exposes only unqualified skill names in the current session, invoke `$debugging` and state that it is the OMO debugging skill.
 8. Emit the report.
@@ -67,7 +100,7 @@ sync_latest_source openai/codex /tmp/openai-codex-source
 | Plugin payload wiring | PASS/WARN/FAIL | [evidence] |
 | Bin links / aliases | PASS/WARN/FAIL | [evidence] |
 | Runtime probe | PASS/WARN/FAIL | [evidence] |
-| Drift vs latest source | PASS/WARN/FAIL | [evidence, citing /tmp/lazycodex-source or /tmp/openai-codex-source paths] |
+| Drift vs latest source | PASS/WARN/FAIL | [evidence, citing `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` or `$LAZYCODEX_SOURCE_ROOT/openai-codex-source` paths] |
 
 ### Remediations
 1. [Most important fix first: exact command or config edit, and what it resolves.]
@@ -79,7 +112,7 @@ sync_latest_source openai/codex /tmp/openai-codex-source
 ## Follow-up Routing
 
 - Local misconfiguration or stale install: give the remediation; reinstalling via the standard LazyCodex install command is the default fix for payload drift.
-- Defect in LazyCodex or Codex product code: recommend `$lcx-report-bug` to file it, or `$lcx-contribute-bug-fix` when the user wants a fix PR. Both reuse the `/tmp` checkouts you already synced.
+- Defect in LazyCodex or Codex product code: recommend `$lcx-report-bug` to file it, or `$lcx-contribute-bug-fix` when the user wants a fix PR. Both reuse the source-root checkouts you already synced.
 
 ## Stop Conditions
 
@@ -89,5 +122,7 @@ Do not:
 
 - mutate config, installs, or repositories during diagnosis
 - report a verdict without captured evidence
-- compare against remembered source layout instead of `/tmp/lazycodex-source` and `/tmp/openai-codex-source`
+- compare against remembered source layout instead of `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` and `$LAZYCODEX_SOURCE_ROOT/openai-codex-source`
+- require retired payload paths that the current `.codex-plugin/plugin.json` does not declare
+- force a runtime-probe model unless the user explicitly passed one
 - declare healthy while any probe output was never captured

package/packages/shared-skills/skills/lcx-doctor/agents/openai.yaml

@@ -8,4 +8,4 @@ interface:
     - "codex doctor"
     - "lazycodex install broken"
     - "omo-codex diagnose"
-  default_prompt: "Use $lcx-doctor to sync the latest LazyCodex and Codex sources into /tmp, inventory the local installation, compare versions, config, and wiring against the latest sources, probe the real surface, and report PASS/WARN/FAIL findings with evidence and remediations."
+  default_prompt: "Use $lcx-doctor to sync the latest LazyCodex and Codex sources under LAZYCODEX_SOURCE_ROOT or ${TMPDIR:-/tmp}/lazycodex-sources, inventory the local installation, compare versions, config, and wiring against the latest sources, probe the real surface, and report PASS/WARN/FAIL findings with evidence and remediations."