fix(cli): reject future-dated star deferral records on the version-match path

A future-dated .star-deferred with a matching version suppressed the
deferral indefinitely (the version-match shortcut returned before the
age check). The age is now computed first and negative age fails
toward re-asking on every path. Adds the behavior-level flow test
(agent deferral fires once per version, marker never written, human
run still prompts) behind a gh/interactiveConfirm test seam, and pins
the future-match regression.

Author: lidge-jun

src/cli/star-prompt.ts

@@ -33,8 +33,10 @@ export function isDeferralCurrent(record: string | null, version: string, now: n
   if (!m) return false;
   const at = Date.parse(m[1]);
   if (Number.isNaN(at)) return false;
-  if (version !== "?" && m[2] === version) return true;
   const age = now - at;
+  // Version match suppresses for that whole version, but a future-dated
+  // record (clock rollback) fails toward re-asking on every path.
+  if (version !== "?" && m[2] === version) return age >= 0;
   return age >= 0 && age < DEFERRAL_MAX_AGE_MS;
 }
 
@@ -83,6 +85,15 @@ function ghAvailable(): boolean {
   return !auth.error && auth.status === 0;
 }
 
+/** Test seam: replace gh/interactiveConfirm so the full prompt flow is
+ * drivable without a real gh login or a TTY conversation. */
+let depsForTests: { ghAvailable?: () => boolean; interactiveConfirm?: typeof interactiveConfirm } | null = null;
+export function setStarPromptDepsForTests(
+  deps: { ghAvailable?: () => boolean; interactiveConfirm?: typeof interactiveConfirm } | null,
+): void {
+  depsForTests = deps;
+}
+
 function starRepo(): { ok: boolean; error?: string } {
   const star = ghInvocation(["api", "-X", "PUT", `/user/starred/${REPO}`]);
   const r = spawnSync(star.file, star.args,
@@ -158,7 +169,8 @@ export async function maybeShowStarPrompt(): Promise<void> {
     const dir = getConfigDir();
     const marker = join(dir, MARKER);
     if (existsSync(marker)) return;
-    if (!ghAvailable()) return; // can't star without an authenticated gh — stay silent and re-check on a later start
+    const ghOk = depsForTests?.ghAvailable ? depsForTests.ghAvailable() : ghAvailable();
+    if (!ghOk) return; // can't star without an authenticated gh — stay silent and re-check on a later start
 
     // An agent would answer this on the user's behalf, using the user's GitHub
     // identity. Hand the question to the agent to relay, and leave the marker
@@ -185,7 +197,8 @@ export async function maybeShowStarPrompt(): Promise<void> {
       writeFileSync(marker, new Date().toISOString());
     } catch { /* best-effort */ }
 
-    const yes = await interactiveConfirm({
+    const ask = depsForTests?.interactiveConfirm ?? interactiveConfirm;
+    const yes = await ask({
       question: "\n  \x1b[38;5;141m⭐ Enjoying opencodex? Star it on GitHub (via gh)?\x1b[0m",
       defaultYes: true,
     });

tests/star-deferral.test.ts

@@ -1,5 +1,9 @@
-import { describe, expect, test } from "bun:test";
-import { isDeferralCurrent } from "../src/cli/star-prompt";
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { isDeferralCurrent, maybeShowStarPrompt, setStarPromptDepsForTests } from "../src/cli/star-prompt";
 
 const NOW = Date.parse("2026-08-02T00:00:00.000Z");
 const DAY = 24 * 60 * 60 * 1000;
@@ -34,4 +38,93 @@ describe("isDeferralCurrent", () => {
     const future = `${new Date(NOW + 30 * DAY).toISOString()} 2.9.1`;
     expect(isDeferralCurrent(future, "2.10.0", NOW)).toBe(false);
   });
+
+  test("a future-dated record with a MATCHING version also fails toward re-asking", () => {
+    // Clock rollback must not suppress the deferral for the version forever.
+    const future = `${new Date(NOW + 30 * DAY).toISOString()} 2.10.0`;
+    expect(isDeferralCurrent(future, "2.10.0", NOW)).toBe(false);
+  });
+});
+
+describe("maybeShowStarPrompt deferral flow (behavior)", () => {
+  let home: string;
+  const priorHome = process.env.OPENCODEX_HOME;
+  const priorThread = process.env.CODEX_THREAD_ID;
+  const stdinTTY = process.stdin.isTTY;
+  const stdoutTTY = process.stdout.isTTY;
+  const AGENT_ENV_VARS = [
+    "CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_SSE_PORT",
+    "CODEX_THREAD_ID", "CODEX_SHELL", "CODEX_CI", "CODEX_SANDBOX", "CODEX_SANDBOX_NETWORK_DISABLED",
+    "CURSOR_TRACE_ID", "CURSOR_SESSION_TOKEN", "CURSOR_AGENT",
+    "AIDER_CHAT", "OPENCODE_BIN_PATH", "GEMINI_CLI",
+    "REPL_ID", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "JENKINS_URL", "TEAMCITY_VERSION", "CODESPACES",
+  ];
+  const savedAgentEnv = new Map<string, string | undefined>();
+
+  beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), "ocx-star-deferral-"));
+    process.env.OPENCODEX_HOME = home;
+    for (const name of AGENT_ENV_VARS) {
+      savedAgentEnv.set(name, process.env[name]);
+      delete process.env[name];
+    }
+    Object.defineProperty(process.stdin, "isTTY", { value: true, configurable: true });
+    Object.defineProperty(process.stdout, "isTTY", { value: true, configurable: true });
+  });
+
+  afterEach(() => {
+    setStarPromptDepsForTests(null);
+    for (const name of AGENT_ENV_VARS) {
+      const value = savedAgentEnv.get(name);
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+    Object.defineProperty(process.stdin, "isTTY", { value: stdinTTY, configurable: true });
+    Object.defineProperty(process.stdout, "isTTY", { value: stdoutTTY, configurable: true });
+    if (priorThread === undefined) delete process.env.CODEX_THREAD_ID;
+    else process.env.CODEX_THREAD_ID = priorThread;
+    if (priorHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = priorHome;
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  test("agent deferral fires once per version, never writes the marker, and a human run still prompts", async () => {
+    process.env.CODEX_THREAD_ID = "agent-session";
+    setStarPromptDepsForTests({
+      ghAvailable: () => true,
+      interactiveConfirm: async () => false,
+    });
+    const log = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      await maybeShowStarPrompt();
+      const firstCalls = log.mock.calls.length;
+      expect(firstCalls).toBeGreaterThan(0);
+      // The deferral record exists; the one-time marker does NOT.
+      expect(existsSync(join(home, ".star-deferred"))).toBe(true);
+      expect(existsSync(join(home, ".star-prompted"))).toBe(false);
+      expect(readFileSync(join(home, ".star-deferred"), "utf-8")).toContain(" ");
+
+      // Second agent-driven start: suppressed by the record.
+      log.mockClear();
+      await maybeShowStarPrompt();
+      expect(log.mock.calls.length).toBe(0);
+      expect(existsSync(join(home, ".star-prompted"))).toBe(false);
+
+      // A hand-typed run still gets the real question (marker written, ask called).
+      delete process.env.CODEX_THREAD_ID;
+      let asked = 0;
+      setStarPromptDepsForTests({
+        ghAvailable: () => true,
+        interactiveConfirm: async () => {
+          asked += 1;
+          return false;
+        },
+      });
+      await maybeShowStarPrompt();
+      expect(asked).toBe(1);
+      expect(existsSync(join(home, ".star-prompted"))).toBe(true);
+    } finally {
+      log.mockRestore();
+    }
+  });
 });

tests/startup-prompt.test.ts

@@ -142,7 +142,8 @@ describe("startup star prompt", () => {
     // shim), so assert the arguments and the resolver rather than the literal.
     expect(prompt).toContain('ghInvocation(["auth", "status"])');
     expect(prompt).toContain('commandInvocation("gh"');
-    expect(prompt).toContain("if (!ghAvailable()) return;");
+    // The gh check gates the prompt via the (test-seamable) ghOk result.
+    expect(prompt).toContain("if (!ghOk) return;");
   });
 
   test("declining the star prompt does not steer the agent afterwards", async () => {