oh-my-opencode 4.19.2 → 4.19.3

package/packages/omo-codex/plugin/components/codegraph/test/hook-session-start-guard.test.ts

@@ -0,0 +1,160 @@
+import { describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { fileURLToPath } from "node:url";
+
+import {
+	executeCodegraphSessionStartHook,
+	type CodegraphSessionStartOutcome,
+	type WorkerSpawnInvocation,
+} from "../src/hook.ts";
+import { recordSessionStartFailure } from "../src/session-start-cooldown.ts";
+
+const pluginRoot = resolve(fileURLToPath(new URL("../../..", import.meta.url)));
+
+function createAllowedWorkspace(prefix: string): string {
+	return mkdtempSync(join(pluginRoot, `.tmp-${prefix}-`));
+}
+
+describe("CodeGraph SessionStart spawn guards", () => {
+	it("#given an inconclusive probe timeout #when SessionStart runs #then timeout is not treated as uninitialized", async () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-timeout-home-"));
+		const workspace = createAllowedWorkspace("codegraph-timeout-workspace");
+		const spawned: WorkerSpawnInvocation[] = [];
+		try {
+			// when
+			const result = await executeCodegraphSessionStartHook({
+				ancestorProbe: () => ({ kind: "inconclusive", reason: "status timed out" }),
+				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
+				cwd: workspace,
+				env: { HOME: homeDir },
+				spawnWorker: (invocation) => spawned.push(invocation),
+				stdin: Readable.from(["{}"]),
+				sweepZombies: () => undefined,
+			});
+
+			// then
+			expect(result).toEqual({ action: "skipped-inconclusive", exitCode: 0 });
+			expect(spawned).toEqual([]);
+		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
+			rmSync(workspace, { recursive: true, force: true });
+		}
+	});
+
+	it("#given one hook already owns the project lock #when a second SessionStart runs #then it records skipped-locked without spawning", async () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-dedup-home-"));
+		const workspace = createAllowedWorkspace("codegraph-dedup-workspace");
+		const outcomes: CodegraphSessionStartOutcome[] = [];
+		const spawned: WorkerSpawnInvocation[] = [];
+		const options = {
+			ancestorProbe: () => ({ kind: "uninitialized" } as const),
+			config: { codegraph: { enabled: true }, sources: [], warnings: [] },
+			cwd: workspace,
+			env: { HOME: homeDir },
+			logOutcome: (outcome: CodegraphSessionStartOutcome) => outcomes.push(outcome),
+			spawnWorker: (invocation: WorkerSpawnInvocation) => {
+				spawned.push(invocation);
+			},
+			stdin: Readable.from(["{}"]),
+			sweepZombies: () => undefined,
+		};
+		try {
+			await executeCodegraphSessionStartHook(options);
+
+			// when
+			const second = await executeCodegraphSessionStartHook({ ...options, stdin: Readable.from(["{}"]) });
+
+			// then
+			expect(second).toEqual({ action: "skipped-locked", exitCode: 0 });
+			expect(spawned).toHaveLength(1);
+			expect(outcomes).toContainEqual({ action: "skipped-locked", projectRoot: workspace });
+		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
+			rmSync(workspace, { recursive: true, force: true });
+		}
+	});
+
+	it("#given a failed worker cooldown #when SessionStart retries before and after expiry #then only the expired retry spawns", async () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-cooldown-hook-home-"));
+		const workspace = createAllowedWorkspace("codegraph-cooldown-hook-workspace");
+		const outcomes: CodegraphSessionStartOutcome[] = [];
+		const spawned: WorkerSpawnInvocation[] = [];
+		try {
+			recordSessionStartFailure({
+				action: "failed",
+				baseCooldownMs: 60_000,
+				homeDir,
+				nowMs: 1_000,
+				projectRoot: workspace,
+			});
+			const baseOptions = {
+				ancestorProbe: () => ({ kind: "uninitialized" } as const),
+				config: { codegraph: { enabled: true, session_start_cooldown_ms: 60_000 }, sources: [], warnings: [] },
+				cwd: workspace,
+				env: { HOME: homeDir },
+				logOutcome: (outcome: CodegraphSessionStartOutcome) => outcomes.push(outcome),
+				spawnWorker: (invocation: WorkerSpawnInvocation) => {
+					spawned.push(invocation);
+				},
+				sweepZombies: () => undefined,
+			};
+
+			// when
+			const suppressed = await executeCodegraphSessionStartHook({ ...baseOptions, nowMs: 60_999, stdin: Readable.from(["{}"]) });
+			const expired = await executeCodegraphSessionStartHook({ ...baseOptions, nowMs: 61_000, stdin: Readable.from(["{}"]) });
+
+			// then
+			expect(suppressed).toEqual({ action: "skipped-cooldown", exitCode: 0 });
+			expect(expired).toEqual({ action: "spawned", exitCode: 0 });
+			expect(spawned).toHaveLength(1);
+			expect(outcomes).toContainEqual({
+				action: "skipped-cooldown",
+				cooldownUntil: 61_000,
+				failureCount: 1,
+				projectRoot: workspace,
+			});
+		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
+			rmSync(workspace, { recursive: true, force: true });
+		}
+	});
+
+	it("#given an ancestor has a CodeGraph database #when SessionStart runs in a nested project #then it records skipped-nested-root", async () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-nested-home-"));
+		const ancestorRoot = createAllowedWorkspace("codegraph-nested-ancestor");
+		const workspace = join(ancestorRoot, "apps", "server");
+		const outcomes: CodegraphSessionStartOutcome[] = [];
+		const spawned: WorkerSpawnInvocation[] = [];
+		try {
+			mkdirSync(join(ancestorRoot, ".codegraph"), { recursive: true });
+			mkdirSync(workspace, { recursive: true });
+			writeFileSync(join(ancestorRoot, ".codegraph", "codegraph.db"), "fixture");
+
+			// when
+			const result = await executeCodegraphSessionStartHook({
+				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
+				cwd: workspace,
+				env: { HOME: homeDir },
+				logOutcome: (outcome) => outcomes.push(outcome),
+				spawnWorker: (invocation) => spawned.push(invocation),
+				stdin: Readable.from(["{}"]),
+				sweepZombies: () => undefined,
+			});
+
+			// then
+			expect(result).toEqual({ action: "skipped-nested-root", exitCode: 0 });
+			expect(spawned).toEqual([]);
+			expect(outcomes).toContainEqual({ action: "skipped-nested-root", ancestorRoot, projectRoot: workspace });
+		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
+			rmSync(ancestorRoot, { recursive: true, force: true });
+		}
+	});
+});

package/packages/omo-codex/plugin/components/codegraph/test/hook-store-upgrade.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "bun:test";
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { Readable } from "node:stream";
@@ -9,108 +9,33 @@ import { executeCodegraphSessionStartHook, type WorkerSpawnInvocation } from "..
 
 const pluginRoot = resolve(fileURLToPath(new URL("../../..", import.meta.url)));
 
-// Observed verbatim from a REAL codegraph 1.4.1 binary running `status --json` (exit 0)
-// against a project store built by a REAL codegraph 1.0.1 binary
-// (see .omo/evidence/codegraph-daemon-process-hygiene/task-2-store-upgrade.txt).
-const MIGRATED_1_0_1_STORE_STATUS_JSON = JSON.stringify({
-	initialized: true,
-	version: "1.4.1",
-	projectPath: "/private/tmp/cg-task2/fixture",
-	indexPath: "/private/tmp/cg-task2/fixture/.codegraph",
-	lastIndexed: "2026-07-21T04:28:09.593Z",
-	fileCount: 2,
-	nodeCount: 5,
-	edgeCount: 4,
-	dbSizeBytes: 159744,
-	backend: "node-sqlite",
-	journalMode: "wal",
-	nodesByKind: { file: 2, function: 3 },
-	languages: ["typescript"],
-	pendingChanges: { added: 0, modified: 0, removed: 0 },
-	worktreeMismatch: null,
-	index: {
-		builtWithVersion: "1.0.1",
-		builtWithExtractionVersion: 24,
-		currentExtractionVersion: 24,
-		reindexRecommended: false,
-		state: null,
-		pendingRefs: 0,
-	},
-});
-
 function createAllowedWorkspace(prefix: string): string {
 	return mkdtempSync(join(pluginRoot, `.tmp-${prefix}-`));
 }
 
-// On win32 execFile cannot run a #!/bin/sh script, so emit a codegraph.cmd batch file instead;
-// resolveCodegraphCommandInvocation wraps .cmd in `cmd.exe /d /s /c`, exactly like the real codegraph.cmd.
-function createFakeCodegraphBin(scripts: {
-	readonly posix: string;
-	readonly win32: string;
-	readonly win32Sidecar?: string;
-}): { readonly binPath: string; readonly dir: string } {
-	const dir = mkdtempSync(join(tmpdir(), "omo-codegraph-fake-bin-"));
-	if (process.platform === "win32") {
-		const binPath = join(dir, "codegraph.cmd");
-		writeFileSync(binPath, scripts.win32);
-		if (scripts.win32Sidecar !== undefined) writeFileSync(join(dir, "hang.cjs"), scripts.win32Sidecar);
-		return { binPath, dir };
-	}
-	const binPath = join(dir, "codegraph");
-	writeFileSync(binPath, scripts.posix, { mode: 0o755 });
-	chmodSync(binPath, 0o755);
-	return { binPath, dir };
-}
-
-// Keep the probe hermetic on POSIX but viable on win32: resolveCodegraphCommandInvocation wraps
-// the fake .cmd in `cmd.exe /d /s /c`, and Windows can only resolve cmd.exe when the child env
-// carries the real system PATH (System32) plus SystemRoot (both whitelisted in SAFE_AMBIENT_ENV_KEYS).
-// A POSIX-only PATH makes the probe spawn fail, so the hook reports not-initialized and spawns.
-function probeEnv(homeDir: string, binPath: string): Record<string, string> {
-	if (process.platform === "win32") {
-		const env: Record<string, string> = {
-			HOME: homeDir,
-			OMO_CODEGRAPH_BIN: binPath,
-		};
-		if (process.env["PATH"] !== undefined) env["PATH"] = process.env["PATH"];
-		if (process.env["SystemRoot"] !== undefined) env["SystemRoot"] = process.env["SystemRoot"];
-		return env;
-	}
-	return { HOME: homeDir, OMO_CODEGRAPH_BIN: binPath, PATH: "/usr/bin:/bin" };
-}
-
-function isProcessAlive(pid: number): boolean {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-describe("CodeGraph SessionStart hook with a 1.0.1-era project store under the 1.4.1 binary", () => {
-	it("#given a real 1.4.1 status payload for a migrated 1.0.1 store #when SessionStart probes via the default probe #then it stays silent without spawning a re-init worker", async () => {
+describe("CodeGraph SessionStart hook with a migrated 1.0.1 project store under CodeGraph 1.5.0", () => {
+	it("#given the migrated store has an exact database #when SessionStart runs #then it never invokes the CodeGraph CLI", async () => {
 		// given
 		const stdout: string[] = [];
 		const spawned: WorkerSpawnInvocation[] = [];
 		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-upgrade-home-"));
-		// The payload is a single JSON line with no cmd metacharacters (% ^ & < > |), so a plain echo is safe.
-		const fake = createFakeCodegraphBin({
-			posix: `#!/bin/sh\nprintf '%s\\n' '${MIGRATED_1_0_1_STORE_STATUS_JSON}'\n`,
-			win32: `@echo off\r\n@echo ${MIGRATED_1_0_1_STORE_STATUS_JSON}\r\n`,
-		});
 		const workspace = createAllowedWorkspace("codegraph-upgrade-workspace");
-		mkdirSync(join(workspace, ".codegraph"), { recursive: true });
-
 		try {
+			mkdirSync(join(workspace, ".codegraph"), { recursive: true });
+			writeFileSync(join(workspace, ".codegraph", "codegraph.db"), "migrated-store");
+
 			// when
 			const result = await executeCodegraphSessionStartHook({
+				ancestorProbe: () => {
+					throw new Error("the exact database check must be the complete fast path");
+				},
 				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
 				cwd: workspace,
-				env: probeEnv(homeDir, fake.binPath),
+				env: { HOME: homeDir },
 				stdin: Readable.from(["{}"]),
 				stdout: { write: (chunk) => stdout.push(chunk) },
 				spawnWorker: (invocation) => spawned.push(invocation),
+				sweepZombies: () => undefined,
 			});
 
 			// then
@@ -119,58 +44,7 @@ describe("CodeGraph SessionStart hook with a 1.0.1-era project store under the 1
 			expect(stdout.join("")).toBe("");
 		} finally {
 			rmSync(homeDir, { recursive: true, force: true });
-			rmSync(fake.dir, { recursive: true, force: true });
-			rmSync(workspace, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 });
-		}
-	});
-
-	it("#given the status probe spawns a hanging descendant #when SessionStart times out #then it exits promptly and reaps the descendant", async () => {
-		// given
-		const stdout: string[] = [];
-		const spawned: WorkerSpawnInvocation[] = [];
-		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-slow-home-"));
-		const survivorPidPath = join(homeDir, "survivor.pid");
-		const fake = createFakeCodegraphBin({
-			posix: "#!/bin/sh\nsleep 30 &\necho \"$!\" > \"$HOME/survivor.pid\"\nwait\n",
-			win32: '@echo off\r\nnode "%~dp0hang.cjs"\r\n',
-			win32Sidecar: [
-				'const { spawn } = require("node:child_process");',
-				'const { writeFileSync } = require("node:fs");',
-				'const { join } = require("node:path");',
-				'const child = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], { stdio: "ignore" });',
-				'writeFileSync(join(process.env.HOME, "survivor.pid"), String(child.pid));',
-				"setInterval(() => {}, 1000);",
-				"",
-			].join("\n"),
-		});
-		const workspace = createAllowedWorkspace("codegraph-slow-probe-workspace");
-		let descendantPid: number | undefined;
-
-		try {
-			// when
-			const startedAt = Date.now();
-			const result = await executeCodegraphSessionStartHook({
-				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
-				cwd: workspace,
-				env: probeEnv(homeDir, fake.binPath),
-				stdin: Readable.from(["{}"]),
-				stdout: { write: (chunk) => stdout.push(chunk) },
-				spawnWorker: (invocation) => spawned.push(invocation),
-			});
-			const elapsedMs = Date.now() - startedAt;
-			descendantPid = Number.parseInt(readFileSync(survivorPidPath, "utf8").trim(), 10);
-
-			// then
-			expect(result.exitCode).toBe(0);
-			expect(result.action).toBe("spawned");
-			expect(spawned).toHaveLength(1);
-			expect(elapsedMs).toBeLessThan(15_000);
-			expect(isProcessAlive(descendantPid)).toBeFalse();
-		} finally {
-			if (descendantPid !== undefined && isProcessAlive(descendantPid)) process.kill(descendantPid, "SIGKILL");
-			rmSync(homeDir, { recursive: true, force: true });
-			rmSync(fake.dir, { recursive: true, force: true });
-			rmSync(workspace, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 });
+			rmSync(workspace, { recursive: true, force: true });
 		}
 	});
 });

package/packages/omo-codex/plugin/components/codegraph/test/hook.test.ts

@@ -39,8 +39,9 @@ describe("CodeGraph SessionStart hook", () => {
 				env: { HOME: homeDir },
 				stdin: Readable.from(["{}"]),
 				stdout: { write: (chunk) => stdout.push(chunk) },
+				ancestorProbe: () => ({ kind: "uninitialized" }),
 				spawnWorker: (invocation) => spawned.push(invocation),
-				statusProbe: () => Promise.resolve(false),
+				sweepZombies: () => undefined,
 			});
 
 			// then
@@ -132,7 +133,7 @@ describe("CodeGraph SessionStart hook", () => {
 		try {
 			mkdirSync(join(homeDir, ".omo"), { recursive: true });
 			writeFileSync(
-				join(homeDir, ".omo", "config.jsonc"),
+				join(homeDir, ".omo", "omo.jsonc"),
 				'{ "codegraph": { "enabled": true }, "[codex]": { "codegraph": { "enabled": false } } }\n',
 			);
 
@@ -164,8 +165,8 @@ describe("CodeGraph SessionStart hook", () => {
 		try {
 			mkdirSync(join(homeDir, ".omo"), { recursive: true });
 			mkdirSync(join(workspace, ".omo"), { recursive: true });
-			writeFileSync(join(homeDir, ".omo", "config.jsonc"), '{ "codegraph": { "enabled": true } }\n');
-			writeFileSync(join(workspace, ".omo", "config.jsonc"), '{ "[codex]": { "codegraph": { "enabled": false } } }\n');
+			writeFileSync(join(homeDir, ".omo", "omo.jsonc"), '{ "codegraph": { "enabled": true } }\n');
+			writeFileSync(join(workspace, ".omo", "omo.jsonc"), '{ "[codex]": { "codegraph": { "enabled": false } } }\n');
 
 			// when
 			const result = await executeCodegraphSessionStartHook({
@@ -193,7 +194,7 @@ describe("CodeGraph SessionStart hook", () => {
 		const spawned: WorkerSpawnInvocation[] = [];
 		try {
 			mkdirSync(join(homeDir, ".omo"), { recursive: true });
-			writeFileSync(join(homeDir, ".omo", "config.jsonc"), '{ "codegraph": { "enabled": true } }\n');
+			writeFileSync(join(homeDir, ".omo", "omo.jsonc"), '{ "codegraph": { "enabled": true } }\n');
 
 			// when
 			const result = await executeCodegraphSessionStartHook({
@@ -215,38 +216,33 @@ describe("CodeGraph SessionStart hook", () => {
 		// given
 		const stdout: string[] = [];
 		const spawned: WorkerSpawnInvocation[] = [];
-		const statusProbeDaemonValues: boolean[] = [];
 		const workspace = createAllowedWorkspace("codegraph-workspace");
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-spawn-home-"));
 
 		try {
 			// when
 			const result = await executeCodegraphSessionStartHook({
+				ancestorProbe: () => ({ kind: "uninitialized" }),
 				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
 				cwd: workspace,
-				env: { HOME: "/tmp/home", KEEP: "1", OPENAI_API_KEY: "sk-test-secret" },
+				env: { HOME: homeDir, KEEP: "1", OPENAI_API_KEY: "sk-test-secret" },
 				stdin: Readable.from(["{}"]),
 				stdout: { write: (chunk) => stdout.push(chunk) },
-				spawnWorker: (invocation) => spawned.push(invocation),
-				statusProbe: (options) => {
-					statusProbeDaemonValues.push(options.daemon);
-					return Promise.resolve(false);
+				spawnWorker: (invocation) => {
+					spawned.push(invocation);
 				},
+				sweepZombies: () => undefined,
 				workerCliPath: "/plugin/components/codegraph/dist/cli.js",
 			});
 
 			// then
 			expect(result).toEqual({ action: "spawned", exitCode: 0 });
-			expect(statusProbeDaemonValues).toEqual([true]);
-			expect(spawned).toEqual([
-				{
-					args: ["/plugin/components/codegraph/dist/cli.js", "hook", "session-start-worker"],
-					command: process.execPath,
-					env: {
-						HOME: "/tmp/home",
-						OMO_CODEGRAPH_SESSION_START_CWD: workspace,
-					},
-				},
-			]);
+			expect(spawned).toHaveLength(1);
+			expect(spawned[0]?.args).toEqual(["/plugin/components/codegraph/dist/cli.js", "hook", "session-start-worker"]);
+			expect(spawned[0]?.command).toBe(process.execPath);
+			expect(spawned[0]?.env["HOME"]).toBe(homeDir);
+			expect(spawned[0]?.env["OMO_CODEGRAPH_SESSION_START_CWD"]).toBe(workspace);
+			expect(spawned[0]?.env["OMO_CODEGRAPH_SESSION_START_LOCK_TOKEN"]).toMatch(/^[0-9a-f-]{36}$/);
 			expect(spawned[0]?.env["OPENAI_API_KEY"]).toBeUndefined();
 			expect(spawned[0]?.env["KEEP"]).toBeUndefined();
 			expect(JSON.parse(stdout.join(""))).toEqual({
@@ -256,6 +252,7 @@ describe("CodeGraph SessionStart hook", () => {
 				},
 			});
 		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
 			rmSync(workspace, { recursive: true, force: true });
 		}
 	});
@@ -265,17 +262,23 @@ describe("CodeGraph SessionStart hook", () => {
 		const stdout: string[] = [];
 		const spawned: WorkerSpawnInvocation[] = [];
 		const workspace = createAllowedWorkspace("codegraph-initialized-workspace");
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-initialized-home-"));
 
 		try {
+			mkdirSync(join(workspace, ".codegraph"), { recursive: true });
+			writeFileSync(join(workspace, ".codegraph", "codegraph.db"), "fixture");
+
 			// when
 			const result = await executeCodegraphSessionStartHook({
+				ancestorProbe: () => {
+					throw new Error("an initialized exact root must not invoke any fallback probe");
+				},
 				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
 				cwd: workspace,
-				env: { HOME: "/tmp/home", KEEP: "1" },
+				env: { HOME: homeDir, KEEP: "1" },
 				stdin: Readable.from(["{}"]),
 				stdout: { write: (chunk) => stdout.push(chunk) },
 				spawnWorker: (invocation) => spawned.push(invocation),
-				statusProbe: () => Promise.resolve(true),
 			});
 
 			// then
@@ -283,6 +286,7 @@ describe("CodeGraph SessionStart hook", () => {
 			expect(spawned).toEqual([]);
 			expect(stdout.join("")).toBe("");
 		} finally {
+			rmSync(homeDir, { recursive: true, force: true });
 			rmSync(workspace, { recursive: true, force: true });
 		}
 	});

package/packages/omo-codex/plugin/components/codegraph/test/mcp-bridge-fixtures.ts

@@ -1,6 +1,6 @@
 import { chmodSync, writeFileSync } from "node:fs";
 
-export const CODEGRAPH_141_DEFAULT_TOOLS: readonly Record<string, unknown>[] = [
+export const CODEGRAPH_150_DEFAULT_TOOLS: readonly Record<string, unknown>[] = [
 	{
 		name: "codegraph_explore",
 		description:
@@ -41,10 +41,10 @@ export function writeFakeNewlineCodegraph(filePath: string): void {
 			"rl.on('line', (line) => {",
 			"  const request = JSON.parse(line);",
 			"  if (request.method === 'initialize') {",
-			"    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { capabilities: { tools: { listChanged: false } }, protocolVersion: request.params.protocolVersion, serverInfo: { name: 'codegraph', version: '1.4.1' } } }) + '\\n');",
+			"    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { capabilities: { tools: { listChanged: false } }, protocolVersion: request.params.protocolVersion, serverInfo: { name: 'codegraph', version: '1.5.0' } } }) + '\\n');",
 			"  }",
 			"  if (request.method === 'tools/list') {",
-			`    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { tools: ${JSON.stringify(CODEGRAPH_141_DEFAULT_TOOLS)} } }) + '\\n');`,
+			`    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result: { tools: ${JSON.stringify(CODEGRAPH_150_DEFAULT_TOOLS)} } }) + '\\n');`,
 			"  }",
 			"});",
 		].join("\n"),

package/packages/omo-codex/plugin/components/codegraph/test/package-runtime.test.ts

@@ -43,7 +43,7 @@ describe("CodeGraph component runtime package metadata", () => {
 		const files = packageJson.files ?? [];
 
 		// then
-		expect(optionalDependencies["@colbymchenry/codegraph"]).toBe("1.4.1");
+		expect(optionalDependencies["@colbymchenry/codegraph"]).toBe("1.5.0");
 		expect(files).toContain("LICENSE");
 		expect(files).toContain("NODE-RUNTIME-LICENSES.md");
 		expect(files).toContain("NOTICE");
@@ -58,7 +58,7 @@ describe("CodeGraph component runtime package metadata", () => {
 		// given
 		const notice = readFileSync(resolve(componentRoot, "NOTICE"), "utf8");
 
-		expect(notice).toContain("@colbymchenry/codegraph@1.0.1");
+		expect(notice).toContain("@colbymchenry/codegraph@1.5.0");
 		expect(notice).toContain("MIT license");
 		expect(notice).toContain("Node.js v24.16.0 runtime");
 		expect(notice).toContain("NODE-RUNTIME-LICENSES.md");

package/packages/omo-codex/plugin/components/codegraph/test/provisioned-node-guard.test.ts

@@ -77,19 +77,19 @@ describe("CodeGraph provisioned launcher Node guard", () => {
 							source: provisioned === null ? "path" : "provisioned",
 						};
 					},
+					resolveManagedBin: () => binPath,
 					runCommand: (_projectRoot, command, args) => {
 						calls.push({ args, command });
-						return Promise.resolve({ exitCode: 0, stdout: calls.length === 1 ? '{"initialized":false}' : "", timedOut: false });
+						mkdirSync(join(workspace, ".codegraph"), { recursive: true });
+						writeFileSync(join(workspace, ".codegraph", "codegraph.db"), "fixture");
+						return Promise.resolve({ exitCode: 0, stdout: "", timedOut: false });
 					},
 				},
 			});
 
 			// then
 			expect(result).toEqual({ action: "initialized" });
-			expect(calls).toEqual([
-				{ args: ["status", "--json"], command: binPath },
-				{ args: ["init"], command: binPath },
-			]);
+			expect(calls).toEqual([{ args: ["init"], command: binPath }]);
 			expect(outcomes).toEqual([{ action: "initialized", exitCode: 0, projectRoot: workspace, source: "provisioned", timedOut: false }]);
 		} finally {
 			rmSync(workspace, { recursive: true, force: true });

package/packages/omo-codex/plugin/components/codegraph/test/serve-mcp-bridge.test.ts

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { runCodegraphServe } from "../src/serve.ts";
 import {
 	arrayProperty,
-	CODEGRAPH_141_DEFAULT_TOOLS,
+	CODEGRAPH_150_DEFAULT_TOOLS,
 	findTool,
 	frameMcpRequest,
 	parseMcpBodies,
@@ -87,14 +87,14 @@ describe("runCodegraphServe MCP protocol bridge", () => {
 					result: {
 						capabilities: { tools: { listChanged: false } },
 						protocolVersion: "2025-06-18",
-						serverInfo: { name: "codegraph", version: "1.4.1" },
+						serverInfo: { name: "codegraph", version: "1.5.0" },
 					},
 				},
 				{
 					id: 2,
 					jsonrpc: "2.0",
 					result: {
-						tools: CODEGRAPH_141_DEFAULT_TOOLS,
+						tools: CODEGRAPH_150_DEFAULT_TOOLS,
 					},
 				},
 			]);

package/packages/omo-codex/plugin/components/codegraph/test/serve-mcp-facade.test.ts

@@ -48,7 +48,7 @@ describe("runCodegraphServe MCP unavailable facade", () => {
 			result: {
 				capabilities: { tools: { listChanged: false } },
 				protocolVersion: "2025-06-18",
-				serverInfo: { name: "codegraph", version: "1.4.1" },
+				serverInfo: { name: "codegraph", version: "1.5.0" },
 			},
 		});
 	});

package/packages/omo-codex/plugin/components/codegraph/test/serve-provision.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { runCodegraphServe } from "../src/serve.ts";
@@ -51,6 +53,49 @@ describe("runCodegraphServe provisioning", () => {
 		]);
 	});
 
+	it("#given a bundled runtime and a stale managed install #when serving MCP #then it upgrades and uses the managed runtime", async () => {
+		// given
+		const homeDir = mkdtempSync(join(tmpdir(), "omo-codegraph-serve-managed-upgrade-"));
+		const installDir = join(homeDir, ".omo", "codegraph");
+		const binPath = join(installDir, "bin", "codegraph");
+		mkdirSync(join(installDir, "bin"), { recursive: true });
+		mkdirSync(join(installDir, ".provisioned"), { recursive: true });
+		writeFileSync(binPath, "stale codegraph\n");
+		writeFileSync(
+			join(installDir, ".provisioned", "codegraph-1.4.1.json"),
+			`${JSON.stringify({ binPath, version: "1.4.1" })}\n`,
+		);
+		const provisionCalls: unknown[] = [];
+		const processCalls: Array<{ readonly args: readonly string[]; readonly command: string }> = [];
+
+		try {
+			// when
+			const exitCode = await runCodegraphServe({
+				config: { codegraph: { enabled: true }, sources: [], warnings: [] },
+				homeDir,
+				managedInstallExists: () => true,
+				nodeVersion: "22.14.0",
+				resolve: () => ({ argsPrefix: ["codegraph.js"], command: "/opt/node22/bin/node", exists: true, source: "bundled" }),
+				resolveManagedBin: () => null,
+				ensureProvisioned: (options) => {
+					provisionCalls.push(options);
+					return Promise.resolve({ binPath, provisioned: true });
+				},
+				runProcess: (command, args) => {
+					processCalls.push({ args, command });
+					return Promise.resolve(0);
+				},
+			});
+
+			// then
+			expect(exitCode).toBe(0);
+			expect(provisionCalls).toEqual([{ installDir, lockDir: join(installDir, ".locks"), version: "1.5.0" }]);
+			expect(processCalls).toEqual([{ args: ["serve", "--mcp"], command: binPath }]);
+		} finally {
+			rmSync(homeDir, { force: true, recursive: true });
+		}
+	});
+
 	it("#given CodeGraph is unresolved and codegraph.daemon=false #when serving MCP #then provisions CodeGraph with daemon-off", async () => {
 		// given
 		const binPath = join("/tmp/home/.omo/codegraph", "bin", "codegraph");

package/packages/omo-codex/plugin/components/codegraph/test/serve-unavailable.test.ts

@@ -97,8 +97,8 @@ describe("runCodegraphServe unavailable CodeGraph paths", () => {
 		try {
 			mkdirSync(join(homeDir, ".omo"), { recursive: true });
 			mkdirSync(join(workspace, ".omo"), { recursive: true });
-			writeFileSync(join(homeDir, ".omo", "config.jsonc"), '{ "codegraph": { "enabled": true } }\n');
-			writeFileSync(join(workspace, ".omo", "config.jsonc"), '{ "[codex]": { "codegraph": { "enabled": false } } }\n');
+			writeFileSync(join(homeDir, ".omo", "omo.jsonc"), '{ "codegraph": { "enabled": true } }\n');
+			writeFileSync(join(workspace, ".omo", "omo.jsonc"), '{ "[codex]": { "codegraph": { "enabled": false } } }\n');
 
 			// when
 			const exitCode = await runCodegraphServe({