lazycodex-ai doctor hardcodes /tmp, relies on inner codex exec networking, and expects obsolete aggregate hook layout

[kobeng]

Summary

lazycodex-ai doctor currently mixes three assumptions that break diagnosis in my environment:

1. the doctor workflow hardcodes source sync under /tmp
2. the workflow delegates diagnosis to an inner codex exec, which does not inherit the host's working GitHub network/DNS
3. lcx-doctor still checks for a root hooks/hooks.json, but the current aggregate OMO plugin manifest no longer uses that layout

I verified these against current lazycodex source at commit d4c4f05.

Environment

• macOS Darwin 25.5.0 arm64
• Codex CLI 0.142.2
• LazyCodex plugin/OMO version 4.13.0
• Host machine can access GitHub normally

Problem 1: doctor hardcodes /tmp

Current doctor entry prompt says:

• Sync the latest LazyCodex and OpenAI Codex sources into /tmp

Current lcx-doctor/SKILL.md also says:

• writes must be under /tmp
• sync to /tmp/lazycodex-source
• sync to /tmp/openai-codex-source

That fails in environments where /tmp is blocked or where the intended temp root is $TMPDIR.

I locally patched the skill to use:

SOURCE_ROOT="${TMPDIR:-/tmp}"
sync_latest_source code-yeongyu/lazycodex "$SOURCE_ROOT/lazycodex-source"
sync_latest_source openai/codex "$SOURCE_ROOT/openai-codex-source"

and confirmed the workflow then targeted my project-local .tmp/ directory instead of /tmp/.

Problem 2: inner codex exec does not inherit host networking

The host machine can reach GitHub:

gh api rate_limit
git ls-remote https://github.com/openai/codex.git HEAD

Both succeed on the host.

But the same commands inside the codex exec session used by lazycodex-ai doctor fail:

error connecting to api.github.com
check your internet connection or https://githubstatus.com

fatal: unable to access 'https://github.com/openai/codex.git/': Could not resolve host: github.com

So even after fixing the /tmp path, the current design still blocks source sync because the inner Codex execution environment does not have the same DNS/network behavior as the host.

Problem 3: lcx-doctor expects obsolete aggregate hook layout

Current source aggregate manifest:

plugins/omo/.codex-plugin/plugin.json

declares hooks as an array of direct file paths:

"hooks": [
  "./hooks/session-start-loading-project-rules.json",
  "./hooks/session-start-recording-session-telemetry.json",
  ...
]

And current source test explicitly asserts that aggregate OMO does not use ./hooks/hooks.json:

plugins/omo/test/aggregate-manifest.test.mjs

assert(!hookPaths.includes("./hooks/hooks.json"));

However lcx-doctor still checks for:

• hooks/hooks.json

under the installed aggregate plugin root.

That creates a false negative: the installed payload can match source exactly while doctor still reports the aggregate hook payload as suspicious because it is checking an outdated shape.

Suggested direction

I am not proposing an implementation in this issue, but the current behavior suggests two design adjustments are needed:

1. lazycodex-ai doctor should not require hardcoded /tmp; it should honor ${TMPDIR:-/tmp} or an explicit source-root override
2. source sync and GitHub/network-dependent steps should run on the host side before entering inner codex exec, with the inner doctor reusing already-synced checkouts
3. aggregate hook validation in lcx-doctor should be aligned with the current aggregate manifest contract, not the old hooks/hooks.json expectation

Repro

1. Run npx lazycodex-ai doctor
2. Observe source sync and diagnosis behavior in an environment where:
   • host GitHub access works
   • inner codex exec cannot resolve github.com
3. Observe that doctor can still flag missing hooks/hooks.json even though the current aggregate manifest intentionally uses direct hook paths

[MongLong0214]

Additional evidence from the doctor/report-bug demo

I reproduced a narrower version of the source-cache failure that affects both lcx-doctor and lcx-report-bug.

What was exercised

• Triggered the installed omo:lcx-doctor skill through a real codex exec session.
• Ran the shared sync_latest_source function shape used by both lcx-doctor and lcx-report-bug.
• Synced fresh LazyCodex and upstream Codex checkouts under a separate temp source root as a control.

Runtime evidence

The fixed source-cache directories existed and each contained a .git directory, so the current helper skipped recloning. But those .git directories were incomplete:

• missing HEAD
• missing config
• git -C <fixed source cache> rev-parse failed with fatal: not a git repository
• the helper then derived DEFAULT_BRANCH= and failed the following fetch / checkout steps

The installed lcx-doctor probe stopped at the source-cache usability gate and emitted its completion marker after confirming that the fixed cache could not be used as the "latest source" comparison basis.

Control proof: running the same helper against fresh, valid temp checkouts succeeded for both repositories:

• LazyCodex source synced to d4c4f05
• upstream Codex source synced to 6b5f574
• DEFAULT_BRANCH=main
• expected control files were present in both checkouts

Hypotheses checked

1. Corrupt or incomplete fixed source cache: confirmed. The cache had .git directories but no HEAD or config, and git -C failed.
2. GitHub/network outage: refuted. Fresh temp checkouts fetched both repositories successfully in the same environment.
3. Upstream Codex ownership: refuted. The affected fixed-cache workflow lives in bundled LazyCodex/OMO skill instructions; upstream Codex source did not contain lcx-doctor, lcx-report-bug, or sync_latest_source.

Maintainer-facing fix direction

The helper should treat "directory has .git" as insufficient. It should validate the checkout with a real Git command before reuse. If validation fails, it should recover into a fresh cache path or clearly report a repairable cache-corruption error instead of deriving an empty default branch.

This also expands the scope from doctor only to lcx-report-bug, because the report-bug workflow carries the same fixed source-cache helper and the same stale-cache failure mode.

---

This issue or PR was generated by LazyCodex.
Tag: lazycodex-generated

[MongLong0214]

Additional rerun evidence: fixed source-cache validation still fails

I reran the doctor/report-bug workflow against the installed OMO 4.13.0 skill surface and confirmed the cache-validation failure mode again.

What was reproduced

The shared sync_latest_source helper used by lcx-doctor, lcx-report-bug, and lcx-contribute-bug-fix treats the presence of a .git directory as sufficient proof that a cached checkout is valid. With a broken fixed source-cache directory that contains .git but lacks normal git metadata such as HEAD and config, the helper skips recloning, derives an empty branch, and then fails:

derived_DEFAULT_BRANCH=
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git

This reproduced for both the LazyCodex source cache and the upstream Codex source cache.

Controls

• Fresh shallow checkouts in new temporary directories synced successfully with the same network/auth environment.
• LazyCodex latest source resolved to d4c4f05d424451bdd917cfa3416dbab3ff973c95.
• Upstream Codex latest source resolved to ccdfb4f342a2e659be7ab878309cc5d81683d737.
• The LazyCodex source contains the helper in:
  • plugins/omo/skills/lcx-doctor/SKILL.md
  • plugins/omo/skills/lcx-report-bug/SKILL.md
  • plugins/omo/skills/lcx-contribute-bug-fix/SKILL.md
• A search of the upstream Codex source for lcx-doctor, lcx-report-bug, and sync_latest_source returned no matches.

Hypothesis status

• H1 confirmed: the helper trusts an invalid .git directory and does not validate the checkout before reuse.
• H2 refuted: fresh source sync works, so this is not a GitHub auth/network failure.
• H3 refuted: the failing workflow is owned by LazyCodex/OMO skill instructions, not upstream Codex.

Real LazyCodex/Codex surface driven

A child codex exec --sandbox read-only run triggered the installed omo:lcx-doctor workflow. It verified Codex 0.141.0, installed OMO 4.13.0, and the fixed source-cache directories, then reported it could not verify freshness because git status on those caches fails with the same broken-checkout behavior. The run printed LCX_DOCTOR_RERUN_SMOKE_DONE and exited 0.

Suggested fix

Before reusing a cache directory, validate it as a usable checkout:

if ! git -C "$DEST" rev-parse --is-inside-work-tree >/dev/null 2>&1 ||
   ! git -C "$DEST" config --get remote.origin.url >/dev/null 2>&1; then
  # recreate the cache or fail with a clear remediation
fi

The current helper should not continue after deriving an empty default branch.

---

This issue or PR was generated by LazyCodex.
Tag: lazycodex-generated

[Ckeplinger199]

Local update from a 4.14.0 repair run on macOS/Codex 0.142.4:

• codex --version: codex-cli 0.142.4
• lazycodex-ai version: lazycodex-ai 4.14.0
• omo --version: 4.14.0
• Latest synced sources:
  • code-yeongyu/lazycodex main db0f80f0aecd
  • openai/codex main ccdfb4f342a2

Additional findings beyond the original issue:

1. The generated doctor wrapper needed local patching from --sandbox read-only to --sandbox danger-full-access. With read-only, the nested doctor cannot do its /tmp source-sync/probe work reliably.
2. The nested runtime probe must not force --model gpt-5.5-codex-mini for ChatGPT accounts. That model was rejected locally; using the configured default model succeeded.
3. The 4.14.0 npm/npx-installed OMO cache was missing files that 4.14.0 source declares:
   • components/workflow-selector
   • hooks/user-prompt-submit-selecting-lazycodex-workflow.json
   • dist/cli/index.js
     The standard npx --yes lazycodex-ai install --no-tui --codex-autonomous did not restore those files. Copying them from the freshly synced source into the installed OMO cache, then updating the installed manifest/package metadata, let payload checks pass.
4. OMO bootstrap state was stuck degraded because dist/cli/index.js was missing. After restoring dist/ and running:
   PLUGIN_DATA="$HOME/.codex/plugins/data/omo-sisyphuslabs" node "$HOME/.codex/plugins/cache/sisyphuslabs/omo/4.14.0/components/bootstrap/dist/cli.js" worker --codex-home "$HOME/.codex" --once
   the bootstrap state became:
   {"completedForVersion":"4.14.0","degraded":[],"lastStatus":"success"}
5. OMO 4.14.0 restamped features.child_agents_md = true, but Codex 0.142.4 reports it as an unknown feature key. I locally patched generated OMO bootstrap/CLI files to stop stamping it, then strict config passed.

After those local repairs:

• codex exec --strict-config --skip-git-repo-check 'Reply exactly STRICT_CONFIG_OK.' exits 0 and returns STRICT_CONFIG_OK.
• lazycodex-ai doctor --status exits 0.
• Doctor PASSes: versions current, config integrity, plugin payload wiring.
• Doctor still WARNs on non-core startup noise:
  • LazyCodex bins resolve from the npx cache rather than stable shell links.
  • Codex plugin metadata warnings from template-creator / ngs-analysis.
  • Skill context budget warnings.

Suggested upstream fixes:

• Doctor wrapper should use a writable sandbox or perform source sync outside the nested codex exec.
• Doctor should use the account's configured default model unless the user explicitly overrides it.
• Published/package materialization should include the current 4.14.0 OMO runtime payload and workflow selector files, or the installer should not compare against source files that the published package intentionally excludes.
• OMO config migration should stop writing features.child_agents_md for current Codex versions.
• Doctor status should distinguish expected install-time materialization diffs, such as absolute .mcp.json paths, from actual missing payload.

---

This issue or PR was generated by LazyCodex.
Tag: lazycodex-generated

[code-yeongyu]

Fixed in code-yeongyu/oh-my-openagent#5775 and merged into dev.

Verified:

• lazycodex-ai doctor no longer forces a default model; explicit --model is still passed through.
• Installer config no longer stamps unsupported features.child_agents_md, while existing user values are preserved.
• Current manifest-declared runtime payloads, root CLI dists, and materialized .mcp.json targets are validated.
• Expected absolute CodeGraph .mcp.json materialization is accepted when the target exists; missing or zero-byte targets still fail.
• Focused installer/doctor/package tests, test:codex, isolated Codex QA, app-server hook proof, manual LazyCodex smoke, and the final GitHub CI matrix passed.