@askexenow/exe-os 0.9.65 → 0.9.67

package/dist/bin/install.js

@@ -1,12 +1,6 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -127,6 +121,10 @@ var init_config = __esm({
         checkOnBoot: true,
         autoInstall: false,
         checkIntervalMs: 24 * 60 * 60 * 1e3
+      },
+      orchestration: {
+        phase: "phase_1_coo",
+        phaseSetBy: "default"
       }
     };
   }
@@ -608,6 +606,63 @@ var init_preferences = __esm({
   }
 });
 
+// src/adapters/mcp-http-config.ts
+import { chmodSync as chmodSync2, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { randomBytes } from "crypto";
+import path6 from "path";
+import os5 from "os";
+function mcpHttpPort() {
+  return process.env.EXE_MCP_PORT || DEFAULT_MCP_HTTP_PORT;
+}
+function mcpHttpUrl() {
+  return `http://127.0.0.1:${mcpHttpPort()}/mcp`;
+}
+function readOrCreateDaemonToken(homeDir = os5.homedir()) {
+  const exeDir = path6.join(homeDir, ".exe-os");
+  const tokenPath = path6.join(exeDir, "exed.token");
+  if (existsSync7(tokenPath)) {
+    try {
+      const token2 = readFileSync5(tokenPath, "utf-8").trim();
+      if (/^[a-f0-9]{64}$/i.test(token2)) return token2;
+    } catch {
+    }
+  }
+  const token = randomBytes(32).toString("hex");
+  mkdirSync3(exeDir, { recursive: true });
+  writeFileSync4(tokenPath, `${token}
+`, "utf-8");
+  try {
+    chmodSync2(tokenPath, 384);
+  } catch {
+  }
+  return token;
+}
+function buildMcpHttpHeaders(homeDir = os5.homedir(), opts = {}) {
+  const agentId = opts.useShellPlaceholders ? "${AGENT_ID:-exe}" : opts.agentId ?? DEFAULT_MCP_HTTP_AGENT_ID;
+  const agentRole = opts.useShellPlaceholders ? "${AGENT_ROLE:-COO}" : opts.agentRole ?? DEFAULT_MCP_HTTP_AGENT_ROLE;
+  return {
+    Authorization: `Bearer ${readOrCreateDaemonToken(homeDir)}`,
+    "X-Agent-Id": agentId,
+    "X-Agent-Role": agentRole
+  };
+}
+function buildClaudeHttpMcpEntry(homeDir = os5.homedir()) {
+  return {
+    type: "http",
+    url: mcpHttpUrl(),
+    headers: buildMcpHttpHeaders(homeDir, { useShellPlaceholders: true })
+  };
+}
+var DEFAULT_MCP_HTTP_PORT, DEFAULT_MCP_HTTP_AGENT_ID, DEFAULT_MCP_HTTP_AGENT_ROLE;
+var init_mcp_http_config = __esm({
+  "src/adapters/mcp-http-config.ts"() {
+    "use strict";
+    DEFAULT_MCP_HTTP_PORT = "48739";
+    DEFAULT_MCP_HTTP_AGENT_ID = "exe";
+    DEFAULT_MCP_HTTP_AGENT_ROLE = "COO";
+  }
+});
+
 // src/adapters/runtime-hook-manifest.ts
 function commandHasAnyMarker(command, markers) {
   return markers.some((marker) => command.includes(marker));
@@ -615,7 +670,7 @@ function commandHasAnyMarker(command, markers) {
 function isLegacySplitPostToolCommand(command) {
   return commandHasAnyMarker(command, LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS);
 }
-var EXE_HOOKS, LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS;
+var EXE_HOOKS, EXE_HOOK_MANIFEST, LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS;
 var init_runtime_hook_manifest = __esm({
   "src/adapters/runtime-hook-manifest.ts"() {
     "use strict";
@@ -633,6 +688,116 @@ var init_runtime_hook_manifest = __esm({
       notification: "dist/hooks/notification.js",
       instructionsLoaded: "dist/hooks/instructions-loaded.js"
     };
+    EXE_HOOK_MANIFEST = [
+      {
+        key: "postToolCombined",
+        event: "PostToolUse",
+        commandMarker: EXE_HOOKS.postToolCombined,
+        owner: "exe-os",
+        purpose: "Single PostToolUse entrypoint for ingestion, error recall, summaries, and bug detection.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "sessionStart",
+        event: "SessionStart",
+        commandMarker: EXE_HOOKS.sessionStart,
+        owner: "exe-os",
+        purpose: "Loads agent identity, procedures, and boot context.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "promptSubmit",
+        event: "UserPromptSubmit",
+        commandMarker: EXE_HOOKS.promptSubmit,
+        owner: "exe-os",
+        purpose: "Injects current tasks, pending reviews, and local context before each prompt.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "heartbeat",
+        event: "UserPromptSubmit",
+        commandMarker: EXE_HOOKS.heartbeat,
+        owner: "exe-os",
+        purpose: "Lightweight heartbeat/status sidecar for Claude Code sessions.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      },
+      {
+        key: "stop",
+        event: "Stop",
+        commandMarker: EXE_HOOKS.stop,
+        owner: "exe-os",
+        purpose: "Finalizes task state, capacity signals, and emergency checkpointing.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "capacity_checkpoint"
+      },
+      {
+        key: "preToolUse",
+        event: "PreToolUse",
+        commandMarker: EXE_HOOKS.preToolUse,
+        owner: "exe-os",
+        purpose: "Preflight guardrails before shell/tool execution.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "subagentStop",
+        event: "SubagentStop",
+        commandMarker: EXE_HOOKS.subagentStop,
+        owner: "exe-os",
+        purpose: "Captures subagent completion context.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      },
+      {
+        key: "preCompact",
+        event: "PreCompact",
+        commandMarker: EXE_HOOKS.preCompact,
+        owner: "exe-os",
+        purpose: "Writes active-task snapshot and compaction recovery context.",
+        runtimes: ["claude"],
+        checkpointRole: "recovery_context"
+      },
+      {
+        key: "postCompact",
+        event: "PostCompact",
+        commandMarker: EXE_HOOKS.postCompact,
+        owner: "exe-os",
+        purpose: "Rehydrates recovery context after compaction.",
+        runtimes: ["claude"],
+        checkpointRole: "recovery_context"
+      },
+      {
+        key: "sessionEnd",
+        event: "SessionEnd",
+        commandMarker: EXE_HOOKS.sessionEnd,
+        owner: "exe-os",
+        purpose: "Stores session-end checkpoint and triages orphaned in-progress tasks.",
+        runtimes: ["claude"],
+        checkpointRole: "session_summary"
+      },
+      {
+        key: "notification",
+        event: "Notification",
+        commandMarker: EXE_HOOKS.notification,
+        owner: "exe-os",
+        purpose: "Captures runtime notifications and nudges.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      },
+      {
+        key: "instructionsLoaded",
+        event: "InstructionsLoaded",
+        commandMarker: EXE_HOOKS.instructionsLoaded,
+        owner: "exe-os",
+        purpose: "Applies runtime instruction post-processing.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      }
+    ];
     LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS = [
       "dist/hooks/ingest.js",
       "dist/hooks/error-recall.js",
@@ -642,54 +807,58 @@ var init_runtime_hook_manifest = __esm({
 });
 
 // src/adapters/claude/installer.ts
-import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, readdir } from "fs/promises";
-import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync4, copyFileSync, mkdirSync as mkdirSync3, chmodSync as chmodSync2 } from "fs";
-import { createHash, randomBytes } from "crypto";
-import path6 from "path";
-import os5 from "os";
+import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, readdir, rm } from "fs/promises";
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync5, copyFileSync, mkdirSync as mkdirSync4 } from "fs";
+import { createHash } from "crypto";
+import path7 from "path";
+import os6 from "os";
 import { execSync as execSync2 } from "child_process";
 import { fileURLToPath } from "url";
 function resolvePackageRoot() {
   const thisFile = fileURLToPath(import.meta.url);
-  let dir = path6.dirname(thisFile);
-  const root = path6.parse(dir).root;
+  let dir = path7.dirname(thisFile);
+  const root = path7.parse(dir).root;
   while (dir !== root) {
-    const pkgPath = path6.join(dir, "package.json");
-    if (existsSync7(pkgPath)) {
+    const pkgPath = path7.join(dir, "package.json");
+    if (existsSync8(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
         if (pkg.name === "@askexenow/exe-os" || pkg.name === "exe-os") return dir;
       } catch {
       }
     }
-    dir = path6.dirname(dir);
+    dir = path7.dirname(dir);
   }
-  return path6.resolve(path6.dirname(thisFile), "..", "..", "..");
+  return path7.resolve(path7.dirname(thisFile), "..", "..", "..");
 }
-async function copySlashCommands(packageRoot, homeDir = os5.homedir()) {
+async function copySlashCommands(packageRoot, homeDir = os6.homedir()) {
   let copied = 0;
   let skipped = 0;
-  const skillsBase = path6.join(homeDir, ".claude", "skills");
-  const exeDir = path6.join(packageRoot, "src", "commands", "exe");
-  if (existsSync7(exeDir)) {
+  const skillsBase = path7.join(homeDir, ".claude", "skills");
+  const deprecatedExeLink = path7.join(skillsBase, "exe-link");
+  if (existsSync8(deprecatedExeLink)) {
+    await rm(deprecatedExeLink, { recursive: true, force: true });
+  }
+  const exeDir = path7.join(packageRoot, "src", "commands", "exe");
+  if (existsSync8(exeDir)) {
     const entries = await readdir(exeDir);
     const mdFiles = entries.filter((f) => f.endsWith(".md"));
     for (const file of mdFiles) {
       const name = file.replace(".md", "");
-      const destDir = path6.join(skillsBase, `exe-${name}`);
+      const destDir = path7.join(skillsBase, `exe-${name}`);
       await mkdir3(destDir, { recursive: true });
-      const srcPath = path6.join(exeDir, file);
-      const destPath = path6.join(destDir, "SKILL.md");
+      const srcPath = path7.join(exeDir, file);
+      const destPath = path7.join(destDir, "SKILL.md");
       const result = await copyAsSkill(srcPath, destPath, `exe-${name}`);
       if (result) copied++;
       else skipped++;
     }
   }
-  const topLevelSrc = path6.join(packageRoot, "src", "commands", "exe.md");
-  if (existsSync7(topLevelSrc)) {
-    const destDir = path6.join(skillsBase, "exe");
+  const topLevelSrc = path7.join(packageRoot, "src", "commands", "exe.md");
+  if (existsSync8(topLevelSrc)) {
+    const destDir = path7.join(skillsBase, "exe");
     await mkdir3(destDir, { recursive: true });
-    const destPath = path6.join(destDir, "SKILL.md");
+    const destPath = path7.join(destDir, "SKILL.md");
     const result = await copyAsSkill(topLevelSrc, destPath, "exe");
     if (result) copied++;
     else skipped++;
@@ -712,7 +881,7 @@ name: ${skillName}
 `);
     }
   }
-  if (existsSync7(destPath)) {
+  if (existsSync8(destPath)) {
     const existing = await readFile3(destPath, "utf-8");
     if (existing === content) return false;
   }
@@ -721,32 +890,32 @@ name: ${skillName}
 }
 function readJsonFile(filePath) {
   try {
-    return JSON.parse(readFileSync5(filePath, "utf-8"));
+    return JSON.parse(readFileSync6(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function findAncestorMcpJsons(startDir, homeDir) {
   const files = [];
-  let dir = path6.resolve(startDir);
-  const root = path6.parse(dir).root;
-  const stop = path6.resolve(homeDir);
+  let dir = path7.resolve(startDir);
+  const root = path7.parse(dir).root;
+  const stop = path7.resolve(homeDir);
   while (dir !== root) {
-    const candidate = path6.join(dir, ".mcp.json");
-    if (existsSync7(candidate)) files.push(candidate);
+    const candidate = path7.join(dir, ".mcp.json");
+    if (existsSync8(candidate)) files.push(candidate);
     if (dir === stop) break;
-    dir = path6.dirname(dir);
+    dir = path7.dirname(dir);
   }
   return files;
 }
 function pathApplies(projectPath, cwd) {
-  const project = path6.resolve(projectPath);
-  const current = path6.resolve(cwd);
-  return current === project || current.startsWith(project + path6.sep);
+  const project = path7.resolve(projectPath);
+  const current = path7.resolve(cwd);
+  return current === project || current.startsWith(project + path7.sep);
 }
-function detectMcpNameCollisions(homeDir = os5.homedir(), cwd = process.cwd()) {
-  const claudeJsonPath = path6.join(homeDir, ".claude.json");
-  if (!existsSync7(claudeJsonPath)) return [];
+function detectMcpNameCollisions(homeDir = os6.homedir(), cwd = process.cwd()) {
+  const claudeJsonPath = path7.join(homeDir, ".claude.json");
+  if (!existsSync8(claudeJsonPath)) return [];
   const claudeJson = readJsonFile(claudeJsonPath);
   if (!claudeJson?.projects) return [];
   const collisions = [];
@@ -773,44 +942,11 @@ function detectMcpNameCollisions(homeDir = os5.homedir(), cwd = process.cwd()) {
   }
   return collisions;
 }
-function readOrCreateDaemonToken(homeDir) {
-  const exeDir = path6.join(homeDir, ".exe-os");
-  const tokenPath = path6.join(exeDir, "exed.token");
-  try {
-    if (existsSync7(tokenPath)) {
-      const token2 = readFileSync5(tokenPath, "utf-8").trim();
-      if (token2) return token2;
-    }
-  } catch {
-  }
-  const token = randomBytes(32).toString("hex");
-  mkdirSync3(exeDir, { recursive: true });
-  writeFileSync4(tokenPath, `${token}
-`, "utf-8");
-  try {
-    chmodSync2(tokenPath, 384);
-  } catch {
-  }
-  return token;
-}
-function buildHttpMcpEntry(homeDir) {
-  const port = process.env.EXE_MCP_PORT || "48739";
-  const token = readOrCreateDaemonToken(homeDir);
-  return {
-    type: "http",
-    url: `http://127.0.0.1:${port}/mcp`,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "X-Agent-Id": "${AGENT_ID:-exe}",
-      "X-Agent-Role": "${AGENT_ROLE:-COO}"
-    }
-  };
-}
 function buildStdioMcpEntry(packageRoot) {
   return {
     type: "stdio",
     command: "node",
-    args: [path6.join(packageRoot, "dist", "mcp", "server.js")],
+    args: [path7.join(packageRoot, "dist", "mcp", "server.js")],
     env: {}
   };
 }
@@ -818,14 +954,14 @@ function mcpTransportMode() {
   const value = process.env.EXE_OS_MCP_TRANSPORT?.trim().toLowerCase();
   if (value === "stdio") return "stdio";
   if (value === "http") return "http";
-  const totalGB = os5.totalmem() / (1024 * 1024 * 1024);
+  const totalGB = os6.totalmem() / (1024 * 1024 * 1024);
   if (totalGB <= 8) return "stdio";
   return "http";
 }
-async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
-  const claudeJsonPath = path6.join(homeDir, ".claude.json");
+async function registerMcpServer(packageRoot, homeDir = os6.homedir()) {
+  const claudeJsonPath = path7.join(homeDir, ".claude.json");
   let claudeJson = {};
-  if (existsSync7(claudeJsonPath)) {
+  if (existsSync8(claudeJsonPath)) {
     try {
       claudeJson = JSON.parse(await readFile3(claudeJsonPath, "utf-8"));
     } catch {
@@ -835,7 +971,7 @@ async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   if (!claudeJson.mcpServers) {
     claudeJson.mcpServers = {};
   }
-  const newEntry = mcpTransportMode() === "stdio" ? buildStdioMcpEntry(packageRoot) : buildHttpMcpEntry(homeDir);
+  const newEntry = mcpTransportMode() === "stdio" ? buildStdioMcpEntry(packageRoot) : buildClaudeHttpMcpEntry(homeDir);
   if (claudeJson.mcpServers[MCP_LEGACY_KEY]) {
     delete claudeJson.mcpServers[MCP_LEGACY_KEY];
     process.stderr.write("exe-os: migrated MCP server key exe-mem \u2192 exe-os\n");
@@ -843,8 +979,8 @@ async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   const currentOs = claudeJson.mcpServers[MCP_PRIMARY_KEY];
   const osMatches = currentOs && JSON.stringify(currentOs) === JSON.stringify(newEntry);
   if (osMatches) {
-    await cleanSettingsJsonMcp(path6.join(homeDir, ".claude", "settings.json"));
-    await migratePermissionsToExeOs(path6.join(homeDir, ".claude", "settings.json"));
+    await cleanSettingsJsonMcp(path7.join(homeDir, ".claude", "settings.json"));
+    await migratePermissionsToExeOs(path7.join(homeDir, ".claude", "settings.json"));
     const collisions2 = detectMcpNameCollisions(homeDir, packageRoot).filter((c) => c.serverName === MCP_PRIMARY_KEY || c.serverName === MCP_LEGACY_KEY);
     for (const c of collisions2) {
       process.stderr.write(
@@ -856,8 +992,8 @@ async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   }
   claudeJson.mcpServers[MCP_PRIMARY_KEY] = newEntry;
   await writeFile3(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + "\n");
-  await cleanSettingsJsonMcp(path6.join(homeDir, ".claude", "settings.json"));
-  await migratePermissionsToExeOs(path6.join(homeDir, ".claude", "settings.json"));
+  await cleanSettingsJsonMcp(path7.join(homeDir, ".claude", "settings.json"));
+  await migratePermissionsToExeOs(path7.join(homeDir, ".claude", "settings.json"));
   const collisions = detectMcpNameCollisions(homeDir, packageRoot).filter((c) => c.serverName === MCP_PRIMARY_KEY || c.serverName === MCP_LEGACY_KEY);
   for (const c of collisions) {
     process.stderr.write(
@@ -868,7 +1004,7 @@ async function registerMcpServer(packageRoot, homeDir = os5.homedir()) {
   return true;
 }
 async function cleanSettingsJsonMcp(settingsPath) {
-  if (!existsSync7(settingsPath)) return;
+  if (!existsSync8(settingsPath)) return;
   try {
     const settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     const servers = settings.mcpServers;
@@ -889,7 +1025,7 @@ async function cleanSettingsJsonMcp(settingsPath) {
   }
 }
 async function migratePermissionsToExeOs(settingsPath) {
-  if (!existsSync7(settingsPath)) return;
+  if (!existsSync8(settingsPath)) return;
   try {
     const settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     const permissions = settings.permissions;
@@ -917,14 +1053,14 @@ async function migratePermissionsToExeOs(settingsPath) {
   } catch {
   }
 }
-async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
-  const settingsPath = path6.join(homeDir, ".claude", "settings.json");
-  const logsDir = path6.join(homeDir, ".exe-os", "logs");
-  const hookLogPath = path6.join(logsDir, "hooks.log");
+async function mergeHooks(packageRoot, homeDir = os6.homedir()) {
+  const settingsPath = path7.join(homeDir, ".claude", "settings.json");
+  const logsDir = path7.join(homeDir, ".exe-os", "logs");
+  const hookLogPath = path7.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir3(logsDir, { recursive: true });
   let settings = {};
-  if (existsSync7(settingsPath)) {
+  if (existsSync8(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -946,7 +1082,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
           }
         ]
       },
@@ -958,7 +1094,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
             timeout: 1e4
           }
         ]
@@ -971,7 +1107,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
           }
         ]
       },
@@ -983,7 +1119,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "exe-heartbeat-hook.js")}"${logSuffix}`,
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "exe-heartbeat-hook.js")}"${logSuffix}`,
             timeout: 5e3
           }
         ]
@@ -996,7 +1132,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -1009,7 +1145,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
           }
         ]
       },
@@ -1021,7 +1157,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "subagent-stop.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "subagent-stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -1033,7 +1169,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "pre-compact.js")}"${logSuffix}`,
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "pre-compact.js")}"${logSuffix}`,
             timeout: 1e4
           }
         ]
@@ -1046,7 +1182,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "session-end.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "session-end.js")}"${logSuffix}`
           }
         ]
       },
@@ -1058,7 +1194,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "notification.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "notification.js")}"${logSuffix}`
           }
         ]
       },
@@ -1070,7 +1206,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "post-compact.js")}"${logSuffix}`,
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "post-compact.js")}"${logSuffix}`,
             timeout: 1e4
           }
         ]
@@ -1083,7 +1219,7 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path6.join(packageRoot, "dist", "hooks", "instructions-loaded.js")}"${logSuffix}`
+            command: `node "${path7.join(packageRoot, "dist", "hooks", "instructions-loaded.js")}"${logSuffix}`
           }
         ]
       },
@@ -1188,13 +1324,13 @@ async function mergeHooks(packageRoot, homeDir = os5.homedir()) {
       allowList.push(fullName);
     }
   }
-  await mkdir3(path6.dirname(settingsPath), { recursive: true });
+  await mkdir3(path7.dirname(settingsPath), { recursive: true });
   await writeFile3(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   return { added, skipped };
 }
-async function cleanOldShellFunctions(homeDir = os5.homedir()) {
-  const rosterPath = path6.join(homeDir, ".exe-os", "exe-employees.json");
-  if (!existsSync7(rosterPath)) return 0;
+async function cleanOldShellFunctions(homeDir = os6.homedir()) {
+  const rosterPath = path7.join(homeDir, ".exe-os", "exe-employees.json");
+  if (!existsSync8(rosterPath)) return 0;
   let employees;
   try {
     employees = JSON.parse(await readFile3(rosterPath, "utf-8"));
@@ -1209,13 +1345,13 @@ async function cleanOldShellFunctions(homeDir = os5.homedir()) {
     return { name: n, funcDef, forLoop };
   });
   const rcFiles = [
-    path6.join(homeDir, ".zshrc"),
-    path6.join(homeDir, ".bashrc")
+    path7.join(homeDir, ".zshrc"),
+    path7.join(homeDir, ".bashrc")
   ];
   const REMOVED_MARKER = "# Removed by exe-os \u2014 wrappers now at ~/.exe-os/bin/";
   let totalRemoved = 0;
   for (const rcPath of rcFiles) {
-    if (!existsSync7(rcPath)) continue;
+    if (!existsSync8(rcPath)) continue;
     let content;
     try {
       content = await readFile3(rcPath, "utf-8");
@@ -1319,8 +1455,8 @@ function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 async function injectOrchestrationRules(homeDir) {
-  const claudeDir = path6.join(homeDir, ".claude");
-  const claudeMdPath = path6.join(claudeDir, "CLAUDE.md");
+  const claudeDir = path7.join(homeDir, ".claude");
+  const claudeMdPath = path7.join(claudeDir, "CLAUDE.md");
   await mkdir3(claudeDir, { recursive: true });
   let existing = "";
   try {
@@ -1342,19 +1478,19 @@ async function injectOrchestrationRules(homeDir) {
   await writeFile3(claudeMdPath, existing + separator + ORCHESTRATION_RULES + "\n", "utf-8");
   return "injected";
 }
-async function installStatusLine(packageRoot, homeDir = os5.homedir()) {
+async function installStatusLine(packageRoot, homeDir = os6.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.ccStatusLine === false) return "opted-out";
-  const claudeDir = path6.join(homeDir, ".claude");
+  const claudeDir = path7.join(homeDir, ".claude");
   await mkdir3(claudeDir, { recursive: true });
-  const assetPath = path6.join(packageRoot, "dist", "assets", "statusline-command.sh");
-  if (!existsSync7(assetPath)) return "asset-missing";
-  const destScript = path6.join(claudeDir, "statusline-command.sh");
+  const assetPath = path7.join(packageRoot, "dist", "assets", "statusline-command.sh");
+  if (!existsSync8(assetPath)) return "asset-missing";
+  const destScript = path7.join(claudeDir, "statusline-command.sh");
   const assetContent = await readFile3(assetPath, "utf-8");
   await writeFile3(destScript, assetContent, { mode: 493 });
-  const settingsPath = path6.join(claudeDir, "settings.json");
+  const settingsPath = path7.join(claudeDir, "settings.json");
   let settings = {};
-  if (existsSync7(settingsPath)) {
+  if (existsSync8(settingsPath)) {
     try {
       settings = JSON.parse(await readFile3(settingsPath, "utf-8"));
     } catch {
@@ -1391,13 +1527,13 @@ async function runInstaller(homeDir) {
     `Hooks: ${hookResult.added} added, ${hookResult.skipped} unchanged
 `
   );
-  const resolvedHome = homeDir ?? os5.homedir();
-  const exeWorkspace = path6.join(resolvedHome, "exe");
-  if (!existsSync7(exeWorkspace)) {
+  const resolvedHome = homeDir ?? os6.homedir();
+  const exeWorkspace = path7.join(resolvedHome, "exe");
+  if (!existsSync8(exeWorkspace)) {
     try {
-      await mkdir3(path6.join(exeWorkspace, "content"), { recursive: true });
-      await mkdir3(path6.join(exeWorkspace, "operations"), { recursive: true });
-      await mkdir3(path6.join(exeWorkspace, "output"), { recursive: true });
+      await mkdir3(path7.join(exeWorkspace, "content"), { recursive: true });
+      await mkdir3(path7.join(exeWorkspace, "operations"), { recursive: true });
+      await mkdir3(path7.join(exeWorkspace, "output"), { recursive: true });
       process.stderr.write(
         `Created ~/exe/ \u2014 your automation workspace for non-code projects
 `
@@ -1432,57 +1568,57 @@ exe-os installed successfully.
 `);
 }
 function setupTmux(home) {
-  const homeDir = home ?? os5.homedir();
-  const exeDir = path6.join(homeDir, ".exe-os");
-  const exeTmuxConf = path6.join(exeDir, "tmux.conf");
-  const userTmuxConf = path6.join(homeDir, ".tmux.conf");
-  const backupPath = path6.join(homeDir, ".tmux.conf.backup");
+  const homeDir = home ?? os6.homedir();
+  const exeDir = path7.join(homeDir, ".exe-os");
+  const exeTmuxConf = path7.join(exeDir, "tmux.conf");
+  const userTmuxConf = path7.join(homeDir, ".tmux.conf");
+  const backupPath = path7.join(homeDir, ".tmux.conf.backup");
   const sourceLine = "source-file ~/.exe-os/tmux.conf";
   const pkgRoot = resolvePackageRoot();
-  const assetPath = path6.join(pkgRoot, "dist", "assets", "tmux.conf");
-  if (!existsSync7(assetPath)) {
+  const assetPath = path7.join(pkgRoot, "dist", "assets", "tmux.conf");
+  if (!existsSync8(assetPath)) {
     process.stderr.write(`exe-os: tmux.conf asset not found at ${assetPath} \u2014 skipping tmux setup
 `);
     return;
   }
-  mkdirSync3(exeDir, { recursive: true });
-  if (existsSync7(exeTmuxConf)) {
-    const currentContent = readFileSync5(exeTmuxConf, "utf8");
-    const newContent = readFileSync5(assetPath, "utf8");
+  mkdirSync4(exeDir, { recursive: true });
+  if (existsSync8(exeTmuxConf)) {
+    const currentContent = readFileSync6(exeTmuxConf, "utf8");
+    const newContent = readFileSync6(assetPath, "utf8");
     const currentHash = createHash("sha256").update(currentContent).digest("hex");
     const newHash = createHash("sha256").update(newContent).digest("hex");
     if (currentHash !== newHash) {
-      const shippedPath = path6.join(exeDir, ".tmux.conf.shipped-hash");
-      const lastShippedHash = existsSync7(shippedPath) ? readFileSync5(shippedPath, "utf8").trim() : "";
+      const shippedPath = path7.join(exeDir, ".tmux.conf.shipped-hash");
+      const lastShippedHash = existsSync8(shippedPath) ? readFileSync6(shippedPath, "utf8").trim() : "";
       if (lastShippedHash && currentHash !== lastShippedHash) {
         process.stderr.write("exe-os: tmux config has user customizations \u2014 skipping overwrite\n");
       } else {
         copyFileSync(assetPath, exeTmuxConf);
         process.stderr.write("exe-os: tmux config updated\n");
       }
-      writeFileSync4(shippedPath, newHash, "utf8");
+      writeFileSync5(shippedPath, newHash, "utf8");
     } else {
       process.stderr.write("exe-os: tmux config already up to date\n");
     }
   } else {
     copyFileSync(assetPath, exeTmuxConf);
-    const newContent = readFileSync5(assetPath, "utf8");
+    const newContent = readFileSync6(assetPath, "utf8");
     const newHash = createHash("sha256").update(newContent).digest("hex");
-    writeFileSync4(path6.join(exeDir, ".tmux.conf.shipped-hash"), newHash, "utf8");
+    writeFileSync5(path7.join(exeDir, ".tmux.conf.shipped-hash"), newHash, "utf8");
   }
-  if (existsSync7(userTmuxConf)) {
-    const existing = readFileSync5(userTmuxConf, "utf8");
+  if (existsSync8(userTmuxConf)) {
+    const existing = readFileSync6(userTmuxConf, "utf8");
     if (!existing.includes(sourceLine)) {
-      if (!existsSync7(backupPath)) {
+      if (!existsSync8(backupPath)) {
         copyFileSync(userTmuxConf, backupPath);
         process.stderr.write(`exe-os: backed up existing tmux config to ${backupPath}
 `);
       }
-      writeFileSync4(userTmuxConf, `${sourceLine}
+      writeFileSync5(userTmuxConf, `${sourceLine}
 ${existing}`);
     }
   } else {
-    writeFileSync4(userTmuxConf, `# Exe OS tmux defaults \u2014 remove this line to use your own config
+    writeFileSync5(userTmuxConf, `# Exe OS tmux defaults \u2014 remove this line to use your own config
 ${sourceLine}
 `);
   }
@@ -1493,10 +1629,10 @@ ${sourceLine}
   process.stderr.write("exe-os: tmux config installed\n");
 }
 function setupGhostty(home) {
-  const homeDir = home ?? os5.homedir();
-  const xdgConfig = path6.join(homeDir, ".config", "ghostty");
-  const macConfig = path6.join(homeDir, "Library", "Application Support", "com.mitchellh.ghostty");
-  const ghosttyInstalled = existsSync7(xdgConfig) || existsSync7(macConfig) || (() => {
+  const homeDir = home ?? os6.homedir();
+  const xdgConfig = path7.join(homeDir, ".config", "ghostty");
+  const macConfig = path7.join(homeDir, "Library", "Application Support", "com.mitchellh.ghostty");
+  const ghosttyInstalled = existsSync8(xdgConfig) || existsSync8(macConfig) || (() => {
     try {
       execSync2("which ghostty 2>/dev/null");
       return true;
@@ -1508,48 +1644,48 @@ function setupGhostty(home) {
     return;
   }
   const pkgRoot = resolvePackageRoot();
-  const assetPath = path6.join(pkgRoot, "dist", "assets", "ghostty.conf");
-  if (!existsSync7(assetPath)) {
+  const assetPath = path7.join(pkgRoot, "dist", "assets", "ghostty.conf");
+  if (!existsSync8(assetPath)) {
     process.stderr.write("exe-os: ghostty.conf asset not found \u2014 skipping Ghostty setup\n");
     return;
   }
   const configDir = xdgConfig;
-  const configPath = path6.join(configDir, "config");
-  const backupPath = path6.join(configDir, "config.backup");
-  mkdirSync3(configDir, { recursive: true });
+  const configPath = path7.join(configDir, "config");
+  const backupPath = path7.join(configDir, "config.backup");
+  mkdirSync4(configDir, { recursive: true });
   const START_MARKER = "# \u2500\u2500 exe-os:ghostty-start \u2500\u2500";
   const END_MARKER = "# \u2500\u2500 exe-os:ghostty-end \u2500\u2500";
-  const assetContent = readFileSync5(assetPath, "utf8").trim();
+  const assetContent = readFileSync6(assetPath, "utf8").trim();
   const markedSection = `${START_MARKER}
 ${assetContent}
 ${END_MARKER}`;
-  if (existsSync7(configPath)) {
-    const existing = readFileSync5(configPath, "utf8");
+  if (existsSync8(configPath)) {
+    const existing = readFileSync6(configPath, "utf8");
     if (existing.includes(START_MARKER) && existing.includes(END_MARKER)) {
       process.stderr.write("exe-os: Ghostty config already installed \u2014 preserving local settings\n");
       return;
     } else if (existing.includes("Exe OS")) {
-      if (!existsSync7(backupPath)) {
+      if (!existsSync8(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
       }
-      writeFileSync4(configPath, `${START_MARKER}
+      writeFileSync5(configPath, `${START_MARKER}
 ${existing.trim()}
 ${END_MARKER}
 `);
     } else {
-      if (!existsSync7(backupPath)) {
+      if (!existsSync8(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
       }
-      writeFileSync4(configPath, `${markedSection}
+      writeFileSync5(configPath, `${markedSection}
 
 ${existing}`);
     }
   } else {
-    writeFileSync4(configPath, `${markedSection}
+    writeFileSync5(configPath, `${markedSection}
 `);
   }
   process.stderr.write("exe-os: Ghostty config installed\n");
@@ -1573,6 +1709,7 @@ var init_installer = __esm({
     init_agent_symlinks();
     init_mcp_prefix();
     init_preferences();
+    init_mcp_http_config();
     init_runtime_hook_manifest();
     EXE_SECTION_START = "<!-- exe-os:orchestration-start -->";
     EXE_SECTION_END = "<!-- exe-os:orchestration-end -->";
@@ -1601,19 +1738,19 @@ __export(installer_exports, {
   verifyCodexHooks: () => verifyCodexHooks
 });
 import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
-import path8 from "path";
-import os6 from "os";
-async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
-  const codexDir = path8.join(homeDir, ".codex");
-  const hooksPath = path8.join(codexDir, "hooks.json");
-  const logsDir = path8.join(homeDir, ".exe-os", "logs");
-  const hookLogPath = path8.join(logsDir, "hooks.log");
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import path9 from "path";
+import os7 from "os";
+async function mergeCodexHooks(packageRoot, homeDir = os7.homedir()) {
+  const codexDir = path9.join(homeDir, ".codex");
+  const hooksPath = path9.join(codexDir, "hooks.json");
+  const logsDir = path9.join(homeDir, ".exe-os", "logs");
+  const hookLogPath = path9.join(logsDir, "hooks.log");
   const logSuffix = ` 2>> "${hookLogPath}"`;
   await mkdir4(codexDir, { recursive: true });
   await mkdir4(logsDir, { recursive: true });
   let hooksJson = {};
-  if (existsSync9(hooksPath)) {
+  if (existsSync10(hooksPath)) {
     try {
       hooksJson = JSON.parse(await readFile4(hooksPath, "utf-8"));
     } catch {
@@ -1624,19 +1761,6 @@ async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
     hooksJson.hooks = {};
   }
   const hooksToRegister = [
-    {
-      event: "SessionStart",
-      group: {
-        hooks: [
-          {
-            type: "command",
-            command: `node "${path8.join(packageRoot, "dist", "hooks", "session-start.js")}"${logSuffix}`,
-            timeout: 30
-          }
-        ]
-      },
-      marker: EXE_HOOKS.sessionStart
-    },
     {
       event: "PostToolUse",
       group: {
@@ -1646,7 +1770,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
             // Combined hook: runs ingest + error-recall in one Node process.
             // Eliminates a cold-start cycle per tool call (~3-6s savings on Codex).
             type: "command",
-            command: `node "${path8.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
+            command: `node "${path9.join(packageRoot, "dist", "hooks", "post-tool-combined.js")}"${logSuffix}`
           }
         ]
       },
@@ -1660,7 +1784,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
             // Single hook: prompt-submit handles memory retrieval + entity boost.
             // exe-heartbeat-hook is CC-specific (intercom) — omitted on Codex.
             type: "command",
-            command: `node "${path8.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
+            command: `node "${path9.join(packageRoot, "dist", "hooks", "prompt-submit.js")}"${logSuffix}`
           }
         ]
       },
@@ -1672,7 +1796,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path8.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
+            command: `node "${path9.join(packageRoot, "dist", "hooks", "stop.js")}"${logSuffix}`
           }
         ]
       },
@@ -1685,7 +1809,7 @@ async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
         hooks: [
           {
             type: "command",
-            command: `node "${path8.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
+            command: `node "${path9.join(packageRoot, "dist", "hooks", "pre-tool-use.js")}"${logSuffix}`
           }
         ]
       },
@@ -1694,6 +1818,16 @@ async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
   ];
   let added = 0;
   let skipped = 0;
+  const sessionStartGroups = hooksJson.hooks["SessionStart"];
+  if (Array.isArray(sessionStartGroups)) {
+    hooksJson.hooks["SessionStart"] = sessionStartGroups.map((g) => ({
+      ...g,
+      hooks: g.hooks.filter((h) => !h.command.includes(EXE_HOOKS.sessionStart))
+    })).filter((g) => g.hooks.length > 0);
+    if (hooksJson.hooks["SessionStart"].length === 0) {
+      delete hooksJson.hooks["SessionStart"];
+    }
+  }
   const postToolGroups = hooksJson.hooks["PostToolUse"];
   if (Array.isArray(postToolGroups)) {
     hooksJson.hooks["PostToolUse"] = postToolGroups.map((g) => ({
@@ -1723,15 +1857,13 @@ async function mergeCodexHooks(packageRoot, homeDir = os6.homedir()) {
   await writeFile4(hooksPath, JSON.stringify(hooksJson, null, 2) + "\n");
   return { added, skipped };
 }
-function verifyCodexHooks(homeDir = os6.homedir()) {
-  const hooksPath = path8.join(homeDir, ".codex", "hooks.json");
-  if (!existsSync9(hooksPath)) return false;
+function verifyCodexHooks(homeDir = os7.homedir()) {
+  const hooksPath = path9.join(homeDir, ".codex", "hooks.json");
+  if (!existsSync10(hooksPath)) return false;
   try {
-    const hooksJson = JSON.parse(
-      __require("fs").readFileSync(hooksPath, "utf-8")
-    );
+    const hooksJson = JSON.parse(readFileSync8(hooksPath, "utf-8"));
     if (!hooksJson.hooks) return false;
-    const required = ["SessionStart", "PostToolUse", "UserPromptSubmit", "Stop", "PreToolUse"];
+    const required = ["PostToolUse", "UserPromptSubmit", "Stop", "PreToolUse"];
     for (const event of required) {
       const groups = hooksJson.hooks[event];
       if (!groups || !groups.some(
@@ -1749,19 +1881,23 @@ function verifyCodexHooks(homeDir = os6.homedir()) {
     )) {
       return false;
     }
+    const sessionStartCommands = (hooksJson.hooks.SessionStart ?? []).flatMap((g) => g.hooks.map((h) => h.command));
+    if (sessionStartCommands.some((cmd) => cmd.includes(EXE_HOOKS.sessionStart))) {
+      return false;
+    }
     return true;
   } catch {
     return false;
   }
 }
-async function installCodexStatusLine(homeDir = os6.homedir()) {
+async function installCodexStatusLine(homeDir = os7.homedir()) {
   const prefs = loadPreferences(homeDir);
   if (prefs.codexStatusLine === false) return "opted-out";
-  const codexDir = path8.join(homeDir, ".codex");
-  const configPath = path8.join(codexDir, "config.toml");
+  const codexDir = path9.join(homeDir, ".codex");
+  const configPath = path9.join(codexDir, "config.toml");
   await mkdir4(codexDir, { recursive: true });
   let content = "";
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     content = await readFile4(configPath, "utf-8");
     if (/\[tui\][\s\S]*?status_line\s*=/.test(content)) {
       return "already-configured";
@@ -1778,53 +1914,47 @@ status_line = [${DEFAULT_CODEX_STATUS_LINE.map((s) => `"${s}"`).join(", ")}]`;
   await writeFile4(configPath, content);
   return "installed";
 }
-function desiredCodexMcpSection(serverJsPath) {
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+function codexHttpHeadersToml(homeDir) {
+  const headers = buildMcpHttpHeaders(homeDir);
+  return `{ ${Object.entries(headers).map(([key, value]) => `${tomlString(key)} = ${tomlString(value)}`).join(", ")} }`;
+}
+function desiredCodexMcpSection(homeDir) {
   return [
     "[mcp_servers.exe-os]",
-    `command = "node"`,
-    `args = ["${serverJsPath}"]`,
+    `url = ${tomlString(mcpHttpUrl())}`,
+    `http_headers = ${codexHttpHeadersToml(homeDir)}`,
     `startup_timeout_sec = ${CODEX_EXE_MCP_STARTUP_TIMEOUT_SEC}`,
     `tool_timeout_sec = ${CODEX_EXE_MCP_TOOL_TIMEOUT_SEC}`,
     ""
   ].join("\n");
 }
-function reconcileCodexMcpSection(sectionContent, serverJsPath) {
+function reconcileCodexMcpSection(sectionContent, homeDir) {
   const desiredLines = {
-    command: `command = "node"`,
-    args: `args = ["${serverJsPath}"]`,
+    url: `url = ${tomlString(mcpHttpUrl())}`,
+    headers: `http_headers = ${codexHttpHeadersToml(homeDir)}`,
     startup: `startup_timeout_sec = ${CODEX_EXE_MCP_STARTUP_TIMEOUT_SEC}`,
     tool: `tool_timeout_sec = ${CODEX_EXE_MCP_TOOL_TIMEOUT_SEC}`
   };
   let next = sectionContent;
-  let changed = false;
-  const replaceOrAppend = (regex, desired) => {
-    if (regex.test(next)) {
-      const updated = next.replace(regex, desired);
-      if (updated !== next) {
-        next = updated;
-        changed = true;
-      }
-      return;
-    }
-    next = next.endsWith("\n") ? `${next}${desired}
+  next = next.split("\n").filter((line) => !/^(command|args|env|type|url|http_headers|startup_timeout_sec|tool_timeout_sec)\s*=/.test(line.trim())).join("\n").replace(/\n{3,}/g, "\n\n");
+  for (const line of [desiredLines.url, desiredLines.headers, desiredLines.startup, desiredLines.tool]) {
+    next = next.endsWith("\n") ? `${next}${line}
 ` : `${next}
-${desired}
+${line}
 `;
-    changed = true;
-  };
-  replaceOrAppend(/^command\s*=.*$/m, desiredLines.command);
-  replaceOrAppend(/^args\s*=.*$/m, desiredLines.args);
-  replaceOrAppend(/^startup_timeout_sec\s*=.*$/m, desiredLines.startup);
-  replaceOrAppend(/^tool_timeout_sec\s*=.*$/m, desiredLines.tool);
-  return { content: next, changed };
-}
-async function registerCodexMcpServer(packageRoot, homeDir = os6.homedir()) {
-  const codexDir = path8.join(homeDir, ".codex");
-  const configPath = path8.join(codexDir, "config.toml");
-  const serverJsPath = path8.join(packageRoot, "dist", "mcp", "server.js");
+  }
+  return { content: next, changed: next !== sectionContent };
+}
+async function registerCodexMcpServer(packageRoot, homeDir = os7.homedir()) {
+  const codexDir = path9.join(homeDir, ".codex");
+  const configPath = path9.join(codexDir, "config.toml");
+  void packageRoot;
   await mkdir4(codexDir, { recursive: true });
   let content = "";
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     content = await readFile4(configPath, "utf-8");
   }
   const sectionHeader = "[mcp_servers.exe-os]";
@@ -1834,7 +1964,7 @@ async function registerCodexMcpServer(packageRoot, homeDir = os6.homedir()) {
     const nextSectionMatch = afterHeader.match(/\n\[(?!mcp_servers\.exe-os)/);
     const sectionEnd = nextSectionMatch ? headerIndex + sectionHeader.length + nextSectionMatch.index : content.length;
     const sectionContent = content.slice(headerIndex, sectionEnd);
-    const reconciled = reconcileCodexMcpSection(sectionContent, serverJsPath);
+    const reconciled = reconcileCodexMcpSection(sectionContent, homeDir);
     if (!reconciled.changed) {
       return "already-registered";
     }
@@ -1842,17 +1972,17 @@ async function registerCodexMcpServer(packageRoot, homeDir = os6.homedir()) {
     await writeFile4(configPath, content);
     return "updated";
   }
-  const newSection = desiredCodexMcpSection(serverJsPath);
+  const newSection = desiredCodexMcpSection(homeDir);
   const separator = content.length > 0 && !content.endsWith("\n") ? "\n\n" : content.length > 0 ? "\n" : "";
   content = content + separator + newSection;
   await writeFile4(configPath, content);
   return "registered";
 }
-async function ensureCodexHooksFeature(homeDir = os6.homedir()) {
-  const configPath = path8.join(homeDir, ".codex", "config.toml");
-  await mkdir4(path8.join(homeDir, ".codex"), { recursive: true });
+async function ensureCodexHooksFeature(homeDir = os7.homedir()) {
+  const configPath = path9.join(homeDir, ".codex", "config.toml");
+  await mkdir4(path9.join(homeDir, ".codex"), { recursive: true });
   let content = "";
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     content = await readFile4(configPath, "utf-8");
   }
   if (/\[features\][\s\S]*?codex_hooks\s*=\s*true/.test(content)) {
@@ -1907,6 +2037,7 @@ var init_installer2 = __esm({
     init_installer();
     init_preferences();
     init_runtime_hook_manifest();
+    init_mcp_http_config();
     DEFAULT_CODEX_STATUS_LINE = [
       "model-with-reasoning",
       "current-dir",
@@ -1922,44 +2053,44 @@ var init_installer2 = __esm({
 
 // src/bin/install.ts
 init_installer();
-import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync6, unlinkSync as unlinkSync3, readdirSync as readdirSync2, openSync, closeSync } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync7, unlinkSync as unlinkSync3, readdirSync as readdirSync2, openSync, closeSync } from "fs";
 import { spawn, execSync as execSync3 } from "child_process";
-import path9 from "path";
-import os7 from "os";
+import path10 from "path";
+import os8 from "os";
 
 // src/lib/session-wrappers.ts
 import {
-  existsSync as existsSync8,
-  readFileSync as readFileSync6,
-  writeFileSync as writeFileSync5,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync9,
+  readFileSync as readFileSync7,
+  writeFileSync as writeFileSync6,
+  mkdirSync as mkdirSync5,
   chmodSync as chmodSync3,
   readdirSync,
   unlinkSync as unlinkSync2
 } from "fs";
-import path7 from "path";
+import path8 from "path";
 import { homedir } from "os";
 var MAX_N = 9;
 function generateSessionWrappers(packageRoot, homeDir) {
   const home = homeDir ?? homedir();
-  const binDir = path7.join(home, ".exe-os", "bin");
-  const rosterPath = path7.join(home, ".exe-os", "exe-employees.json");
-  mkdirSync4(binDir, { recursive: true });
-  const exeStartDst = path7.join(binDir, "exe-start");
+  const binDir = path8.join(home, ".exe-os", "bin");
+  const rosterPath = path8.join(home, ".exe-os", "exe-employees.json");
+  mkdirSync5(binDir, { recursive: true });
+  const exeStartDst = path8.join(binDir, "exe-start");
   const candidates = [
-    path7.join(packageRoot, "dist", "bin", "exe-start.sh"),
-    path7.join(packageRoot, "src", "bin", "exe-start.sh")
+    path8.join(packageRoot, "dist", "bin", "exe-start.sh"),
+    path8.join(packageRoot, "src", "bin", "exe-start.sh")
   ];
   for (const src of candidates) {
-    if (existsSync8(src)) {
-      writeFileSync5(exeStartDst, readFileSync6(src));
+    if (existsSync9(src)) {
+      writeFileSync6(exeStartDst, readFileSync7(src));
       chmodSync3(exeStartDst, 493);
       break;
     }
   }
   let employees = [];
   try {
-    employees = JSON.parse(readFileSync6(rosterPath, "utf8"));
+    employees = JSON.parse(readFileSync7(rosterPath, "utf8"));
   } catch {
     return { created: 0, pathConfigured: false };
   }
@@ -1969,9 +2100,9 @@ function generateSessionWrappers(packageRoot, homeDir) {
   try {
     for (const f of readdirSync(binDir)) {
       if (f === "exe-start") continue;
-      const fPath = path7.join(binDir, f);
+      const fPath = path8.join(binDir, f);
       try {
-        const content = readFileSync6(fPath, "utf8");
+        const content = readFileSync7(fPath, "utf8");
         if (content.includes("exe-start")) {
           unlinkSync2(fPath);
         }
@@ -1986,34 +2117,34 @@ exec "${exeStartDst}" "$0" "$@"
 `;
   for (const emp of employees) {
     for (let n = 1; n <= MAX_N; n++) {
-      const wrapperPath = path7.join(binDir, `${emp.name}${n}`);
-      writeFileSync5(wrapperPath, wrapperContent);
+      const wrapperPath = path8.join(binDir, `${emp.name}${n}`);
+      writeFileSync6(wrapperPath, wrapperContent);
       chmodSync3(wrapperPath, 493);
       created++;
-      const codexPath = path7.join(binDir, `${emp.name}${n}-codex`);
-      writeFileSync5(codexPath, wrapperContent);
+      const codexPath = path8.join(binDir, `${emp.name}${n}-codex`);
+      writeFileSync6(codexPath, wrapperContent);
       chmodSync3(codexPath, 493);
       created++;
     }
   }
   const codexLauncherCandidates = [
-    path7.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
-    path7.join(packageRoot, "src", "bin", "exe-start-codex.ts")
+    path8.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
+    path8.join(packageRoot, "src", "bin", "exe-start-codex.ts")
   ];
   let codexLauncher = null;
   for (const c of codexLauncherCandidates) {
-    if (existsSync8(c)) {
+    if (existsSync9(c)) {
       codexLauncher = c;
       break;
     }
   }
   if (codexLauncher) {
     for (const emp of employees) {
-      const wrapperPath = path7.join(binDir, `${emp.name}-codex`);
+      const wrapperPath = path8.join(binDir, `${emp.name}-codex`);
       const content = `#!/bin/bash
 exec node "${codexLauncher}" --agent ${emp.name} "$@"
 `;
-      writeFileSync5(wrapperPath, content);
+      writeFileSync6(wrapperPath, content);
       chmodSync3(wrapperPath, 493);
       created++;
     }
@@ -2032,24 +2163,24 @@ export PATH="${binDir}:$PATH"
   const shell = process.env.SHELL ?? "/bin/bash";
   const profilePaths = [];
   if (shell.includes("zsh")) {
-    profilePaths.push(path7.join(home, ".zshrc"));
+    profilePaths.push(path8.join(home, ".zshrc"));
   } else if (shell.includes("bash")) {
-    profilePaths.push(path7.join(home, ".bashrc"));
-    profilePaths.push(path7.join(home, ".bash_profile"));
+    profilePaths.push(path8.join(home, ".bashrc"));
+    profilePaths.push(path8.join(home, ".bash_profile"));
   } else {
-    profilePaths.push(path7.join(home, ".profile"));
+    profilePaths.push(path8.join(home, ".profile"));
   }
   for (const profilePath of profilePaths) {
     try {
       let content = "";
       try {
-        content = readFileSync6(profilePath, "utf8");
+        content = readFileSync7(profilePath, "utf8");
       } catch {
       }
       if (content.includes(".exe-os/bin")) {
         return false;
       }
-      writeFileSync5(profilePath, content + exportLine);
+      writeFileSync6(profilePath, content + exportLine);
       return true;
     } catch {
       continue;
@@ -2059,14 +2190,14 @@ export PATH="${binDir}:$PATH"
 }
 
 // src/bin/install.ts
-var homedir2 = os7.homedir;
-var EXE_DIR = path9.join(homedir2(), ".exe-os");
+var homedir2 = os8.homedir;
+var EXE_DIR = path10.join(homedir2(), ".exe-os");
 function restartDaemon() {
-  const pidPath = path9.join(EXE_DIR, "exed.pid");
-  const sockPath = path9.join(EXE_DIR, "exed.sock");
+  const pidPath = path10.join(EXE_DIR, "exed.pid");
+  const sockPath = path10.join(EXE_DIR, "exed.sock");
   try {
-    if (existsSync10(pidPath)) {
-      const pid = parseInt(readFileSync7(pidPath, "utf8").trim(), 10);
+    if (existsSync11(pidPath)) {
+      const pid = parseInt(readFileSync9(pidPath, "utf8").trim(), 10);
       if (!isNaN(pid) && pid > 0) {
         try {
           process.kill(pid, "SIGKILL");
@@ -2107,18 +2238,18 @@ function restartDaemon() {
     } catch {
     }
     try {
-      const versionPath = path9.join(EXE_DIR, "mcp-version");
-      writeFileSync6(versionPath, `deploy-${Date.now()}`);
+      const versionPath = path10.join(EXE_DIR, "mcp-version");
+      writeFileSync7(versionPath, `deploy-${Date.now()}`);
       process.stderr.write(`exe-os: MCP version marker updated \u2014 servers will hot-reload within 10s
 `);
     } catch {
     }
     try {
-      const wpDir = path9.join(EXE_DIR, "worker-pids");
-      if (existsSync10(wpDir)) {
+      const wpDir = path10.join(EXE_DIR, "worker-pids");
+      if (existsSync11(wpDir)) {
         for (const f of readdirSync2(wpDir)) {
           try {
-            unlinkSync3(path9.join(wpDir, f));
+            unlinkSync3(path10.join(wpDir, f));
           } catch {
           }
         }
@@ -2135,7 +2266,7 @@ function restartDaemon() {
     }
   } catch {
   }
-  const totalGB = os7.totalmem() / (1024 * 1024 * 1024);
+  const totalGB = os8.totalmem() / (1024 * 1024 * 1024);
   if (totalGB <= 8) {
     process.stderr.write(
       `exe-os: ${totalGB.toFixed(0)}GB system \u2014 skipping daemon spawn (keyword search mode)
@@ -2145,13 +2276,13 @@ function restartDaemon() {
   }
   try {
     const pkgRoot = resolvePackageRoot();
-    const daemonPath = path9.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-    if (!existsSync10(daemonPath)) {
+    const daemonPath = path10.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+    if (!existsSync11(daemonPath)) {
       process.stderr.write(`exe-os: daemon not found at ${daemonPath} \u2014 skipping respawn
 `);
       return;
     }
-    const logPath = path9.join(EXE_DIR, "exed.log");
+    const logPath = path10.join(EXE_DIR, "exed.log");
     let stderrFd = "ignore";
     try {
       stderrFd = openSync(logPath, "a");