fix(ce-setup): require ordered BEGIN/END tool-map sentinels

Independent grep treated END-then-BEGIN as a removable map even though
removeCodexAgentsToolMapBlock would leave the file unchanged. Warn only
when the first BEGIN precedes its END.

Author: khsaurabh

skills/ce-setup/references/legacy-codex-tool-map.md

@@ -18,10 +18,11 @@ the main thread. Native plugin install does **not** add this block.
    `~/.codex/AGENTS.md`. Also check `~/.codex/profiles/*/AGENTS.md`.
 2. Look for the exact sentinels `<!-- BEGIN COMPOUND CODEX TOOL MAP -->`
    and `<!-- END COMPOUND CODEX TOOL MAP -->`.
-3. If both are present, delete only the span from the BEGIN line through
-   the END line (inclusive). Leave any other user content untouched. Do
-   not edit project/repo `AGENTS.md` unless those exact sentinels are
-   present there.
+3. Only if a BEGIN is followed later by its END, delete the span from
+   that BEGIN through that END (inclusive). If END appears first, leave
+   the file alone — there is no ordered block to remove. Leave any other
+   user content untouched. Do not edit project/repo `AGENTS.md` unless
+   those exact sentinels form an ordered pair there.
 4. If the file is empty after the removal, delete the file.
 5. Show a short before/after of what changed (or say the block was
    already absent). Do not add a replacement tool map.

skills/ce-setup/scripts/check-health

@@ -295,14 +295,27 @@ CODEX_TOOL_MAP_END="<!-- END COMPOUND CODEX TOOL MAP -->"
 codex_home="${CODEX_HOME:-$HOME/.codex}"
 default_codex_home="$HOME/.codex"
 legacy_codex_map_files=()
+# Ordered pair only: first BEGIN must precede first END (same contract as
+# removeCodexAgentsToolMapBlock). Independent grep would treat END-then-BEGIN
+# as removable even though no safe span exists.
+has_ordered_codex_tool_map() {
+  awk -v s="$CODEX_TOOL_MAP_START" -v e="$CODEX_TOOL_MAP_END" '
+    { buf = buf $0 "\n" }
+    END {
+      si = index(buf, s)
+      ei = index(buf, e)
+      exit (si > 0 && ei > 0 && ei > si) ? 0 : 1
+    }
+  ' "$1"
+}
 scan_codex_agents_file() {
   local f="$1"
   local existing
   [ -f "$f" ] || return 0
   for existing in "${legacy_codex_map_files[@]}"; do
     [ "$existing" = "$f" ] && return 0
   done
-  if grep -F -q -- "$CODEX_TOOL_MAP_START" "$f" && grep -F -q -- "$CODEX_TOOL_MAP_END" "$f"; then
+  if has_ordered_codex_tool_map "$f"; then
     legacy_codex_map_files+=("$f")
   fi
 }

tests/skills/ce-setup-check-health.test.ts

@@ -102,6 +102,29 @@ describe("ce-setup check-health", () => {
     }
   })
 
+  test("does not warn when END sentinel precedes BEGIN (no ordered span)", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "ce-setup-health-"))
+    try {
+      await initGitRepo(root)
+      await mkdir(path.join(root, ".codex"), { recursive: true })
+      await writeFile(
+        path.join(root, ".codex", "AGENTS.md"),
+        [
+          "keep this",
+          "<!-- END COMPOUND CODEX TOOL MAP -->",
+          "user-owned notes",
+          "<!-- BEGIN COMPOUND CODEX TOOL MAP -->",
+          "",
+        ].join("\n"),
+      )
+      const result = await runCheckHealth(root, "/usr/bin:/bin")
+      expect(result.exitCode).toBe(0)
+      expect(result.stdout).not.toContain("Legacy Compound Codex tool map still present")
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
   test("still finds named-profile copies under ~/.codex when CODEX_HOME is elsewhere", async () => {
     const root = await mkdtemp(path.join(os.tmpdir(), "ce-setup-health-"))
     try {