test(codex): add a real first-session plugin lifecycle smoke test

[corylanou]

Problem

The installer test suite stubs the codex command. That verifies our orchestration, but it cannot detect incompatibilities with Codex's real cache naming, config activation order, hook resolution, or startup reconciliation.

This allowed the installer to pass while a newly installed go-workflow plugin produced:

• SessionStart hook (failed): hook exited with code 127
• Stop hook (failed): hook exited with code 127

A second session worked, which is characteristic of a first-session lifecycle race.

Proposed coverage

Add an integration smoke test using a real supported Codex CLI:

1. Create an isolated Codex test home/config.
2. Register a local gopher-ai marketplace fixture.
3. Install go-workflow through the public plugin CLI.
4. Start a fresh Codex session and complete a minimal turn.
5. Assert the SessionStart and Stop hooks launch successfully and no exit-127 event is emitted.
6. Repeat after upgrading the marketplace to a new plugin version.
7. Verify the old root remains usable by a session started before the update.

If authentication or PTY constraints make this unsuitable for every PR, run it in a dedicated integration job or scheduled workflow with a pinned/current Codex matrix.

Acceptance criteria

• The test exercises the real Codex plugin installer and hook runtime rather than only a stub.
• First-install and update scenarios are both covered.
• Hook stderr/exit codes are captured with actionable diagnostics.
• A missing or prematurely removed hook path fails the job.
• The supported Codex version or version range is explicit.

[corylanou]

Codex Workpad

Plan

• Re-read issue test(codex): add a real first-session plugin lifecycle smoke test #252, all comments, cleared dependency fix(codex): install global plugins through codex plugin add #253, merged PR fix(codex): install global plugins through CLI #254, and current branch/PR state.
• Rebase the Detent worktree onto the merged installer lifecycle implementation.
• Add a real-Codex smoke harness with an isolated home, local Git marketplace, and local Responses-compatible test server.
• Cover first install, a session held active across a plugin-version update, and a fresh post-update session.
• Assert SessionStart and Stop execution, preserve exact old hook paths while active, and emit captured stdout/stderr on hook or exit-code failures.
• Run focused checks and the configured full validation gate.
• Commit, push, open non-draft PR test(codex): add real plugin lifecycle smoke #255 with Fixes #252, and re-check current-head CI and review feedback.

Acceptance criteria

• Uses real Codex CLI 0.144.6 rather than a stubbed executable.
• Covers first-install and update lifecycle behavior.
• Proves the old root remains usable by a session active across the update.
• Fails on hook stderr/exit failures, including exit 127 and missing hook paths.
• Pins the supported Codex version in the dedicated integration job.

Validation evidence

• Dependency fix(codex): install global plugins through codex plugin add #253 is Done through merged PR fix(codex): install global plugins through CLI #254; this branch is based on merge commit 29437ec.
• Focused checks passed: Bash syntax, shellcheck, Python byte compilation, scripts/test-installation.sh, and the real Codex 0.144.6 lifecycle smoke.
• The real smoke held the first session after SessionStart, upgraded the local marketplace to a distinct plugin version, verified both exact old hook paths remained executable, completed the old Stop hook, and then completed SessionStart and Stop in a fresh post-update session.
• The configured full validation gate passed after the final test-script edit.
• Commit 15b82ee is pushed and non-draft PR test(codex): add real plugin lifecycle smoke #255 is open, mergeable, and references Fixes #252.
• All eight current-head checks passed. PR CI duration was 24 seconds; no checks were slow, and the longest was test-codex-plugin-lifecycle at 23 seconds.
• Quiet-window wait was 15 seconds after CI. The final audit found no PR comments, reviews, or inline review threads.
• Local merge-gate duration was approximately 8 seconds. Post-merge main CI is not running because the PR remains open.

schema: 1
status: complete
blockers: []
human_action: null

[corylanou]

Observed this issue move from In Progress to Blocked during worker completion.

• source: tracker_refresh
• reason: workpad_blocked
• blocker: fix(codex): install global plugins through codex plugin add #253 — waiting for the public Codex plugin installer lifecycle to merge