oh-my-opencode 4.19.1 → 4.19.3

package/packages/omo-codex/plugin/components/codegraph/test/serve-provision.test.ts

@@ -1,10 +1,12 @@
 import { describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { runCodegraphServe } from "../src/serve.ts";
 
 describe("runCodegraphServe provisioning", () => {
-	it("#given CodeGraph is unresolved and daemon is off by default #when serving MCP #then provisions CodeGraph before spawning with CODEGRAPH_NO_DAEMON=1", async () => {
+	it("#given CodeGraph is unresolved and daemon is omitted #when serving MCP #then provisions CodeGraph with daemon-on", async () => {
 		// given
 		const binPath = join("/tmp/home/.omo/codegraph", "bin", "codegraph");
 		const calls: Array<{
@@ -42,7 +44,6 @@ describe("runCodegraphServe provisioning", () => {
 				command: binPath,
 				env: {
 					CODEGRAPH_INSTALL_DIR: join("/tmp/home", ".omo", "codegraph"),
-					CODEGRAPH_NO_DAEMON: "1",
 					CODEGRAPH_NO_DOWNLOAD: "1",
 					CODEGRAPH_TELEMETRY: "0",
 					DO_NOT_TRACK: "1",
@@ -52,7 +53,50 @@ describe("runCodegraphServe provisioning", () => {
 		]);
 	});
 
-	it("#given CodeGraph is unresolved and codegraph.daemon=true #when serving MCP #then provisions CodeGraph and omits CODEGRAPH_NO_DAEMON so the daemon may run", async () => {
+	it("#given a bundled runtime and a stale managed install #when serving MCP #then it upgrades and uses the managed runtime", async () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-serve-managed-upgrade-"));
+		const installDir = join(homeDir, ".omo", "codegraph");
+		const binPath = join(installDir, "bin", "codegraph");
+		mkdirSync(join(installDir, "bin"), { recursive: true });
+		mkdirSync(join(installDir, ".provisioned"), { recursive: true });
+		writeFileSync(binPath, "stale codegraph\n");
+		writeFileSync(
+			join(installDir, ".provisioned", "codegraph-1.4.1.json"),
+			`${JSON.stringify({ binPath, version: "1.4.1" })}\n`,
+		);
+		const provisionCalls: unknown[] = [];
+		const processCalls: Array<{ readonly args: readonly string[]; readonly command: string }> = [];
+
+		try {
+			// when
+			const exitCode = await runCodegraphServe({
+				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
+				homeDir,
+				managedInstallExists: () => true,
+				nodeVersion: "22.14.0",
+				resolve: () => ({ argsPrefix: ["codegraph.js"], command: "/opt/node22/bin/node", exists: true, source: "bundled" }),
+				resolveManagedBin: () => null,
+				ensureProvisioned: (options) => {
+					provisionCalls.push(options);
+					return Promise.resolve({ binPath, provisioned: true });
+				},
+				runProcess: (command, args) => {
+					processCalls.push({ args, command });
+					return Promise.resolve(0);
+				},
+			});
+
+			// then
+			expect(exitCode).toBe(0);
+			expect(provisionCalls).toEqual([{ installDir, lockDir: join(installDir, ".locks"), version: "1.5.0" }]);
+			expect(processCalls).toEqual([{ args: ["serve", "--mcp"], command: binPath }]);
+		} finally {
+			rmSync(homeDir, { force: true, recursive: true });
+		}
+	});
+
+	it("#given CodeGraph is unresolved and codegraph.daemon=false #when serving MCP #then provisions CodeGraph with daemon-off", async () => {
 		// given
 		const binPath = join("/tmp/home/.omo/codegraph", "bin", "codegraph");
 		const calls: Array<{
@@ -64,7 +108,7 @@ describe("runCodegraphServe provisioning", () => {
 
 		// when
 		const exitCode = await runCodegraphServe({
-			config: { codegraph: { daemon: true, enabled: true }, sources: [], warnings: [] },
+			config: { codegraph: { daemon: false, enabled: true }, sources: [], warnings: [] },
 			env: { PATH: "/bin" },
 			homeDir: "/tmp/home",
 			nodeVersion: "22.14.0",
@@ -90,6 +134,7 @@ describe("runCodegraphServe provisioning", () => {
 				command: binPath,
 				env: {
 					CODEGRAPH_INSTALL_DIR: join("/tmp/home", ".omo", "codegraph"),
+					CODEGRAPH_NO_DAEMON: "1",
 					CODEGRAPH_NO_DOWNLOAD: "1",
 					CODEGRAPH_TELEMETRY: "0",
 					DO_NOT_TRACK: "1",
@@ -97,6 +142,6 @@ describe("runCodegraphServe provisioning", () => {
 				},
 			},
 		]);
-		expect(calls[0]?.env["CODEGRAPH_NO_DAEMON"]).toBeUndefined();
+		expect(calls[0]?.env["CODEGRAPH_NO_DAEMON"]).toBe("1");
 	});
 });

package/packages/omo-codex/plugin/components/codegraph/test/serve-unavailable.test.ts

@@ -17,6 +17,7 @@ describe("runCodegraphServe unavailable CodeGraph paths", () => {
 			...closedMcpStdio(),
 			config: { codegraph: { auto_provision: false, enabled: true }, sources: [], warnings: [] },
 			env: { PATH: "/bin" },
+			nodeVersion: "22.14.0",
 			buildEnv: () => ({}),
 			resolve: () => ({ argsPrefix: [], command: "codegraph", exists: false, source: "path" }),
 			runProcess: (command: string) => {
@@ -96,8 +97,8 @@ describe("runCodegraphServe unavailable CodeGraph paths", () => {
 		try {
 			mkdirSync(join(homeDir, ".omo"), { recursive: true });
 			mkdirSync(join(workspace, ".omo"), { recursive: true });
-			writeFileSync(join(homeDir, ".omo", "config.jsonc"), '{ "codegraph": { "enabled": true } }\n');
-			writeFileSync(join(workspace, ".omo", "config.jsonc"), '{ "[codex]": { "codegraph": { "enabled": false } } }\n');
+			writeFileSync(join(homeDir, ".omo", "omo.jsonc"), '{ "codegraph": { "enabled": true } }\n');
+			writeFileSync(join(workspace, ".omo", "omo.jsonc"), '{ "[codex]": { "codegraph": { "enabled": false } } }\n');
 
 			// when
 			const exitCode = await runCodegraphServe({

package/packages/omo-codex/plugin/components/codegraph/test/serve.test.ts

@@ -5,6 +5,7 @@ import { dirname, join, resolve } from "node:path";
 import { Readable, Writable } from "node:stream";
 import { fileURLToPath } from "node:url";
 
+import { CODEGRAPH_PINNED_VERSION } from "../../../../../utils/src/codegraph/manifest.ts";
 import { resolveServeProcessInvocation, runCodegraphServe } from "../src/serve.ts";
 
 const componentRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -48,7 +49,6 @@ describe("runCodegraphServe", () => {
 				cwd: resolve(runCwd),
 				env: {
 					CODEGRAPH_INSTALL_DIR: join("/tmp/home", ".omo", "codegraph"),
-					CODEGRAPH_NO_DAEMON: "1",
 					CODEGRAPH_NO_DOWNLOAD: "1",
 					CODEGRAPH_TELEMETRY: "0",
 					DO_NOT_TRACK: "1",
@@ -61,7 +61,7 @@ describe("runCodegraphServe", () => {
 		expect(calls[0]?.env["OPENAI_API_KEY"]).toBeUndefined();
 	});
 
-	it("#given codegraph.daemon=true #when serving MCP #then CODEGRAPH_NO_DAEMON is omitted so the daemon may run", async () => {
+	it("#given codegraph.daemon=false #when serving MCP #then CODEGRAPH_NO_DAEMON pins daemon-off", async () => {
 		// given
 		const runCwd = componentRoot;
 		const calls: Array<{
@@ -74,7 +74,7 @@ describe("runCodegraphServe", () => {
 
 		// when
 		const exitCode = await runCodegraphServe({
-			config: { codegraph: { daemon: true, enabled: true }, sources: [], warnings: [] },
+			config: { codegraph: { daemon: false, enabled: true }, sources: [], warnings: [] },
 			cwd: runCwd,
 			env: { CUSTOM: "drop", HOME: "/tmp/home", OPENAI_API_KEY: "sk-test-secret" },
 			nodeVersion: "22.14.0",
@@ -100,6 +100,7 @@ describe("runCodegraphServe", () => {
 				cwd: resolve(runCwd),
 				env: {
 					CODEGRAPH_INSTALL_DIR: join("/tmp/home", ".omo", "codegraph"),
+					CODEGRAPH_NO_DAEMON: "1",
 					CODEGRAPH_NO_DOWNLOAD: "1",
 					CODEGRAPH_TELEMETRY: "0",
 					DO_NOT_TRACK: "1",
@@ -108,7 +109,7 @@ describe("runCodegraphServe", () => {
 				stdio: "pipe",
 			},
 		]);
-		expect(calls[0]?.env["CODEGRAPH_NO_DAEMON"]).toBeUndefined();
+		expect(calls[0]?.env["CODEGRAPH_NO_DAEMON"]).toBe("1");
 		expect(calls[0]?.env["CUSTOM"]).toBeUndefined();
 		expect(calls[0]?.env["OPENAI_API_KEY"]).toBeUndefined();
 	});
@@ -182,12 +183,12 @@ describe("runCodegraphServe", () => {
 		expect(spawned).toEqual([{ args: ["serve", "--mcp"], command: commandPath }]);
 	});
 
-	it("#given Windows Codex SOT install_dir has codegraph.cmd and daemon is off by default #when serving MCP #then it resolves there, exports CODEGRAPH_INSTALL_DIR, and pins CODEGRAPH_NO_DAEMON=1", async () => {
-		await withProcessPlatform("win32", async () => {
+	it("#given Codex SOT install_dir has the pinned launcher and daemon is omitted #when serving MCP #then it defaults daemon-on", async () => {
+		await withProcessPlatform(process.platform, async () => {
 			// given
 			const tempRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-serve-install-dir-"));
 			const installDir = join(tempRoot, "custom-codegraph");
-			const binPath = join(installDir, "bin", "codegraph.cmd");
+			const binPath = join(installDir, "bin", process.platform === "win32" ? "codegraph.cmd" : "codegraph");
 			const calls: Array<{
 				readonly args: readonly string[];
 				readonly command: string;
@@ -196,7 +197,12 @@ describe("runCodegraphServe", () => {
 
 			try {
 				mkdirSync(join(installDir, "bin"), { recursive: true });
+				mkdirSync(join(installDir, ".provisioned"), { recursive: true });
 				writeFileSync(binPath, "");
+				writeFileSync(
+					join(installDir, ".provisioned", `codegraph-${CODEGRAPH_PINNED_VERSION}.json`),
+					`${JSON.stringify({ binPath, version: CODEGRAPH_PINNED_VERSION })}\n`,
+				);
 
 				// when
 				const exitCode = await runCodegraphServe({
@@ -223,7 +229,6 @@ describe("runCodegraphServe", () => {
 						command: binPath,
 						env: {
 							CODEGRAPH_INSTALL_DIR: installDir,
-							CODEGRAPH_NO_DAEMON: "1",
 							CODEGRAPH_NO_DOWNLOAD: "1",
 							CODEGRAPH_TELEMETRY: "0",
 							DO_NOT_TRACK: "1",
@@ -237,12 +242,12 @@ describe("runCodegraphServe", () => {
 		});
 	});
 
-	it("#given Windows Codex SOT install_dir with codegraph.daemon=true #when serving MCP #then CODEGRAPH_NO_DAEMON is omitted so the daemon may run", async () => {
-		await withProcessPlatform("win32", async () => {
+	it("#given Codex SOT install_dir with codegraph.daemon=false #when serving MCP #then CODEGRAPH_NO_DAEMON pins daemon-off", async () => {
+		await withProcessPlatform(process.platform, async () => {
 			// given
 			const tempRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-serve-install-dir-daemon-"));
 			const installDir = join(tempRoot, "custom-codegraph");
-			const binPath = join(installDir, "bin", "codegraph.cmd");
+			const binPath = join(installDir, "bin", process.platform === "win32" ? "codegraph.cmd" : "codegraph");
 			const calls: Array<{
 				readonly args: readonly string[];
 				readonly command: string;
@@ -251,11 +256,16 @@ describe("runCodegraphServe", () => {
 
 			try {
 				mkdirSync(join(installDir, "bin"), { recursive: true });
+				mkdirSync(join(installDir, ".provisioned"), { recursive: true });
 				writeFileSync(binPath, "");
+				writeFileSync(
+					join(installDir, ".provisioned", `codegraph-${CODEGRAPH_PINNED_VERSION}.json`),
+					`${JSON.stringify({ binPath, version: CODEGRAPH_PINNED_VERSION })}\n`,
+				);
 
 				// when
 				const exitCode = await runCodegraphServe({
-					config: { codegraph: { daemon: true, enabled: true, install_dir: installDir }, sources: [], trustedCodegraphInstallDir: installDir, warnings: [] },
+					config: { codegraph: { daemon: false, enabled: true, install_dir: installDir }, sources: [], trustedCodegraphInstallDir: installDir, warnings: [] },
 					env: { HOME: "/tmp/home" },
 					nodeVersion: "22.14.0",
 					homeDir: "/tmp/home",
@@ -278,6 +288,7 @@ describe("runCodegraphServe", () => {
 						command: binPath,
 						env: {
 							CODEGRAPH_INSTALL_DIR: installDir,
+							CODEGRAPH_NO_DAEMON: "1",
 							CODEGRAPH_NO_DOWNLOAD: "1",
 							CODEGRAPH_TELEMETRY: "0",
 							DO_NOT_TRACK: "1",
@@ -285,7 +296,7 @@ describe("runCodegraphServe", () => {
 						},
 					},
 				]);
-				expect(calls[0]?.env["CODEGRAPH_NO_DAEMON"]).toBeUndefined();
+				expect(calls[0]?.env["CODEGRAPH_NO_DAEMON"]).toBe("1");
 			} finally {
 				rmSync(tempRoot, { recursive: true, force: true });
 			}

package/packages/omo-codex/plugin/components/codegraph/test/session-start-node-support.test.ts

@@ -1,10 +1,15 @@
 import { describe, expect, it } from "bun:test";
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { runCodegraphSessionStartWorker } from "../src/hook.ts";
 
+function writeProjectDatabase(workspace: string): void {
+	mkdirSync(join(workspace, ".codegraph"), { recursive: true });
+	writeFileSync(join(workspace, ".codegraph", "codegraph.db"), "fixture");
+}
+
 describe("CodeGraph SessionStart worker Node support", () => {
 	it("#given an unsupported local Node and a PATH CodeGraph command with auto provisioning disabled #when worker runs #then it skips without touching the workspace", async () => {
 		// given
@@ -52,7 +57,7 @@ describe("CodeGraph SessionStart worker Node support", () => {
 		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-worker-node-provision-home-"));
 		const binPath = join(homeDir, ".omo", "codegraph", "bin", "codegraph");
 		const calls: Array<{ readonly args: readonly string[]; readonly command: string }> = [];
-		const provisionCalls: Array<{ readonly installDir?: string; readonly lockDir: string; readonly version: "1.4.1" }> = [];
+		const provisionCalls: Array<{ readonly installDir?: string; readonly lockDir: string; readonly version: "1.5.0" }> = [];
 		const outcomes: unknown[] = [];
 
 		try {
@@ -78,19 +83,17 @@ describe("CodeGraph SessionStart worker Node support", () => {
 					resolveCommand: () => ({ argsPrefix: [], command: "/usr/local/bin/codegraph", exists: true, source: "path" }),
 					runCommand: (_projectRoot, command, args) => {
 						calls.push({ args, command });
-						return Promise.resolve({ exitCode: 0, stdout: calls.length === 1 ? '{"initialized":false}' : "", timedOut: false });
+						writeProjectDatabase(workspace);
+						return Promise.resolve({ exitCode: 0, stdout: "", timedOut: false });
 					},
 				},
 			});
 
 			// then
 			expect(result).toEqual({ action: "initialized" });
-			expect(calls).toEqual([
-				{ args: ["status", "--json"], command: binPath },
-				{ args: ["init"], command: binPath },
-			]);
+			expect(calls).toEqual([{ args: ["init"], command: binPath }]);
 			expect(provisionCalls).toEqual([
-				{ installDir: join(homeDir, ".omo", "codegraph"), lockDir: join(homeDir, ".omo", "codegraph", ".locks"), version: "1.4.1" },
+				{ installDir: join(homeDir, ".omo", "codegraph"), lockDir: join(homeDir, ".omo", "codegraph", ".locks"), version: "1.5.0" },
 			]);
 			expect(outcomes).toEqual([{ action: "initialized", exitCode: 0, projectRoot: workspace, source: "provisioned", timedOut: false }]);
 		} finally {
@@ -99,6 +102,62 @@ describe("CodeGraph SessionStart worker Node support", () => {
 		}
 	});
 
+	it("#given bundled CodeGraph and a stale managed install #when the worker runs #then it upgrades and uses the managed runtime", async () => {
+		// given
+		const workspace = mkdtempSync(join(tmpdir(), "omo-codegraph-worker-managed-upgrade-"));
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-worker-managed-upgrade-home-"));
+		const installDir = join(homeDir, ".omo", "codegraph");
+		const binPath = join(installDir, "bin", "codegraph");
+		mkdirSync(join(installDir, "bin"), { recursive: true });
+		mkdirSync(join(installDir, ".provisioned"), { recursive: true });
+		writeFileSync(binPath, "stale codegraph\n");
+		writeFileSync(
+			join(installDir, ".provisioned", "codegraph-1.4.1.json"),
+			`${JSON.stringify({ binPath, version: "1.4.1" })}\n`,
+		);
+		const provisionCalls: unknown[] = [];
+		const commandCalls: Array<{ readonly args: readonly string[]; readonly command: string }> = [];
+
+		try {
+			// when
+			const result = await runCodegraphSessionStartWorker({
+				cwd: workspace,
+				env: { HOME: homeDir },
+				nodeVersion: "22.14.0",
+				deps: {
+					ensureGitignored: () => true,
+					ensureProvisioned: (options) => {
+						provisionCalls.push(options);
+						return Promise.resolve({ binPath, provisioned: true });
+					},
+					managedInstallExists: () => true,
+					prepareWorkspace: () => ({
+						dataDir: join(homeDir, ".omo/codegraph/projects/test"),
+						dataRoot: join(homeDir, ".omo/codegraph"),
+						linked: true,
+						mode: "global-linked",
+						projectLink: join(workspace, ".codegraph"),
+					}),
+					resolveCommand: () => ({ argsPrefix: ["codegraph.js"], command: "/opt/node22/bin/node", exists: true, source: "bundled" }),
+					resolveManagedBin: () => null,
+					runCommand: (_projectRoot, command, args) => {
+						commandCalls.push({ args, command });
+						writeProjectDatabase(workspace);
+						return Promise.resolve({ exitCode: 0, stdout: "", timedOut: false });
+					},
+				},
+			});
+
+			// then
+			expect(result).toEqual({ action: "initialized" });
+			expect(provisionCalls).toEqual([{ installDir, lockDir: join(installDir, ".locks"), version: "1.5.0" }]);
+			expect(commandCalls).toEqual([{ args: ["init"], command: binPath }]);
+		} finally {
+			rmSync(workspace, { recursive: true, force: true });
+			rmSync(homeDir, { recursive: true, force: true });
+		}
+	});
+
 	it("#given an unsupported local Node but bundled CodeGraph resolves through CODEGRAPH_NODE_BIN #when worker runs #then it bootstraps with the compatible runtime", async () => {
 		// given
 		const workspace = mkdtempSync(join(tmpdir(), "omo-codegraph-worker-compatible-node-"));
@@ -129,17 +188,15 @@ describe("CodeGraph SessionStart worker Node support", () => {
 					resolveCommand: () => ({ argsPrefix: ["codegraph.js"], command: nodeBin, exists: true, source: "bundled" }),
 					runCommand: (_projectRoot, command, args) => {
 						calls.push({ args, command });
-						return Promise.resolve({ exitCode: 0, stdout: calls.length === 1 ? '{"initialized":false}' : "", timedOut: false });
+						writeProjectDatabase(workspace);
+						return Promise.resolve({ exitCode: 0, stdout: "", timedOut: false });
 					},
 				},
 			});
 
 			// then
 			expect(result).toEqual({ action: "initialized" });
-			expect(calls).toEqual([
-				{ args: ["codegraph.js", "status", "--json"], command: nodeBin },
-				{ args: ["codegraph.js", "init"], command: nodeBin },
-			]);
+			expect(calls).toEqual([{ args: ["codegraph.js", "init"], command: nodeBin }]);
 			expect(outcomes).toEqual([{ action: "initialized", exitCode: 0, projectRoot: workspace, source: "bundled", timedOut: false }]);
 		} finally {
 			rmSync(workspace, { recursive: true, force: true });

package/packages/omo-codex/plugin/components/codegraph/test/session-start-project.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { probeCodegraphProject } from "../src/session-start-project.ts";
+
+describe("CodeGraph SessionStart project probe", () => {
+	it("#given the exact project directory has a CodeGraph database #when probing #then it is initialized", () => {
+		// given
+		const projectRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-probe-exact-"));
+		try {
+			mkdirSync(join(projectRoot, ".codegraph"), { recursive: true });
+			writeFileSync(join(projectRoot, ".codegraph", "codegraph.db"), "fixture");
+
+			// when
+			const result = probeCodegraphProject(projectRoot);
+
+			// then
+			expect(result).toEqual({ kind: "initialized" });
+		} finally {
+			rmSync(projectRoot, { recursive: true, force: true });
+		}
+	});
+
+	it("#given an ancestor directory has a CodeGraph database #when probing a nested project #then the ancestor covers it", () => {
+		// given
+		const ancestorRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-probe-ancestor-"));
+		const projectRoot = join(ancestorRoot, "apps", "server");
+		try {
+			mkdirSync(join(ancestorRoot, ".codegraph"), { recursive: true });
+			mkdirSync(projectRoot, { recursive: true });
+			writeFileSync(join(ancestorRoot, ".codegraph", "codegraph.db"), "fixture");
+
+			// when
+			const result = probeCodegraphProject(projectRoot);
+
+			// then
+			expect(result).toEqual({ ancestorRoot: realpathSync(ancestorRoot), kind: "nested-root" });
+		} finally {
+			rmSync(ancestorRoot, { recursive: true, force: true });
+		}
+	});
+
+	it("#given neither the project nor its ancestors have a CodeGraph database #when probing #then it is definitively uninitialized", () => {
+		// given
+		const projectRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-probe-missing-"));
+		try {
+			// when
+			const result = probeCodegraphProject(projectRoot);
+
+			// then
+			expect(result).toEqual({ kind: "uninitialized" });
+		} finally {
+			rmSync(projectRoot, { recursive: true, force: true });
+		}
+	});
+});

package/packages/omo-codex/plugin/components/codegraph/test/session-start-state.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync, utimesSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+	clearSessionStartCooldown,
+	readSessionStartCooldown,
+	recordSessionStartFailure,
+} from "../src/session-start-cooldown.ts";
+import {
+	acquireSessionStartLock,
+	releaseSessionStartLock,
+} from "../src/session-start-lock.ts";
+
+describe("CodeGraph SessionStart lock", () => {
+	it("#given a live project lock #when a second hook acquires it #then the second hook is deduplicated", () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-lock-home-"));
+		const projectRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-lock-project-"));
+		try {
+			const first = acquireSessionStartLock({ homeDir, nowMs: 10_000, projectRoot, staleMs: 60_000 });
+			expect(first.kind).toBe("acquired");
+
+			// when
+			const second = acquireSessionStartLock({ homeDir, nowMs: 10_001, projectRoot, staleMs: 60_000 });
+
+			// then
+			expect(second).toEqual({ kind: "locked" });
+			if (first.kind === "acquired") releaseSessionStartLock(first.lock);
+		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
+			rmSync(projectRoot, { recursive: true, force: true });
+		}
+	});
+
+	it("#given a project lock older than the stale threshold #when another hook acquires it #then the stale lock is recovered", () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-stale-home-"));
+		const projectRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-stale-project-"));
+		try {
+			const first = acquireSessionStartLock({ homeDir, nowMs: 1_000, projectRoot, staleMs: 500 });
+			expect(first.kind).toBe("acquired");
+			if (first.kind !== "acquired") return;
+			const staleDate = new Date(1_000);
+			utimesSync(first.lock.path, staleDate, staleDate);
+
+			// when
+			const second = acquireSessionStartLock({ homeDir, nowMs: 2_000, projectRoot, staleMs: 500 });
+
+			// then
+			expect(second.kind).toBe("acquired");
+			if (second.kind === "acquired") {
+				expect(second.recoveredStale).toBe(true);
+				releaseSessionStartLock(second.lock);
+			}
+		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
+			rmSync(projectRoot, { recursive: true, force: true });
+		}
+	});
+});
+
+describe("CodeGraph SessionStart cooldown", () => {
+	it("#given a failed worker outcome #when the cooldown is checked #then retries are suppressed until expiry and the next failure backs off", () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-cooldown-home-"));
+		const projectRoot = mkdtempSync(join(tmpdir(), "omo-codegraph-cooldown-project-"));
+		try {
+			const first = recordSessionStartFailure({
+				action: "failed",
+				baseCooldownMs: 1_000,
+				homeDir,
+				nowMs: 1_000,
+				projectRoot,
+			});
+
+			// when
+			const active = readSessionStartCooldown({ baseCooldownMs: 1_000, homeDir, nowMs: 1_999, projectRoot });
+			const expired = readSessionStartCooldown({ baseCooldownMs: 1_000, homeDir, nowMs: 2_000, projectRoot });
+			const second = recordSessionStartFailure({
+				action: "skipped-status",
+				baseCooldownMs: 1_000,
+				homeDir,
+				nowMs: 2_000,
+				projectRoot,
+			});
+
+			// then
+			expect(first).toMatchObject({ cooldownUntil: 2_000, failureCount: 1 });
+			expect(active).toMatchObject({ cooldownUntil: 2_000, failureCount: 1, kind: "active" });
+			expect(expired).toEqual({ failureCount: 1, kind: "inactive" });
+			expect(second).toMatchObject({ cooldownUntil: 4_000, failureCount: 2 });
+			clearSessionStartCooldown({ homeDir, projectRoot });
+			expect(readSessionStartCooldown({ baseCooldownMs: 1_000, homeDir, nowMs: 2_001, projectRoot })).toEqual({
+				failureCount: 0,
+				kind: "inactive",
+			});
+		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
+			rmSync(projectRoot, { recursive: true, force: true });
+		}
+	});
+});

package/packages/omo-codex/plugin/components/codegraph/test/session-start-trust-boundary.test.ts

@@ -15,7 +15,7 @@ describe("CodeGraph SessionStart trust boundary", () => {
 		const calls: Array<{ readonly env: Record<string, string>; readonly installDir?: string; readonly lockDir?: string }> = [];
 		try {
 			mkdirSync(join(workspace, ".omo"), { recursive: true });
-			writeFileSync(join(workspace, ".omo", "config.jsonc"), JSON.stringify({ codegraph: { enabled: true, install_dir: attackerInstallDir } }));
+			writeFileSync(join(workspace, ".omo", "omo.jsonc"), JSON.stringify({ codegraph: { enabled: true, install_dir: attackerInstallDir } }));
 
 			// when
 			const result = await runCodegraphSessionStartWorker({
@@ -45,7 +45,9 @@ describe("CodeGraph SessionStart trust boundary", () => {
 					},
 					runCommand: (_projectRoot, _command, _args, options) => {
 						calls.push({ env: options.env });
-						return Promise.resolve({ exitCode: 0, stdout: calls.length === 2 ? '{"initialized":false}' : "", timedOut: false });
+						mkdirSync(join(workspace, ".codegraph"), { recursive: true });
+						writeFileSync(join(workspace, ".codegraph", "codegraph.db"), "fixture");
+						return Promise.resolve({ exitCode: 0, stdout: "", timedOut: false });
 					},
 				},
 			});