@axiomatic-labs/claudeflow 2.49.7 → 2.49.9

package/bin/cli.js

@@ -3,7 +3,7 @@
 // Claudeflow CLI entry point.
 //
 // Dual role:
-//   1. Package manager: `claudeflow install` / `version` (npx-friendly).
+//   1. Package manager: `claudeflow install` / `version` (npx-friendly; installs Claude Code + Codex layers).
 //   2. Daily driver wrapper: `claudeflow [claude-args...]` spawns
 //      `claude` with `--append-system-prompt-file` auto-injected when
 //      an `append-system-prompt.md` is present in the project tree.
@@ -92,7 +92,7 @@ async function runSubcommand(command, args = []) {
       console.log("");
       console.log("  Claudeflow commands:");
       console.log(
-        `    ${ui.CYAN}install${ui.RESET}    Install or update Claudeflow in the current project`,
+        `    ${ui.CYAN}install${ui.RESET}    Install or update Claudeflow for Claude Code and Codex`,
       );
       console.log(`    ${ui.CYAN}version${ui.RESET}    Show version info`);
       console.log(

package/lib/install.js

@@ -8,15 +8,16 @@ const { writeLocalVersion, readLocalVersion } = require('./version.js');
 const ui = require('./ui.js');
 
 // claudeflow installs a small, namespaced footprint. Most of it is self-contained files that are simply
-// PLACED (playbooks, scripts, skills) — those can't conflict with the user's project. The things that need a
-// MERGE (never a clobber) are: .claude/settings.json (register our hooks + env alongside theirs), CLAUDE.md
-// (upsert our guidance block between markers — user content outside stays untouched), and the root .mcp.json
-// (seed the base MCP servers add-if-absent — never clobber a server the user configured). Those merges live
-// here, in Node, so install works on every platform with no shell dependency. The GitHub auth gate
-// (auth.js/download.js) is untouched.
+// PLACED (playbooks, scripts, skills, agents) — those can't conflict with the user's project. The things that
+// need a MERGE (never a clobber) are: .claude/settings.json, .codex/hooks.json, .codex/config.toml, CLAUDE.md,
+// AGENTS.md, the root .mcp.json, and the local Codex marketplace entry. Those merges live here, in Node, so
+// install works on every platform with no shell dependency. The GitHub auth gate (auth.js/download.js) is
+// untouched.
 
 const CLAUDE_MARK = '<!-- claudeflow:begin -->';
 const CLAUDE_END = '<!-- claudeflow:end -->';
+const CODEX_MARK = '<!-- codexflow:begin -->';
+const CODEX_END = '<!-- codexflow:end -->';
 const HOOK_TAG = 'scripts/claudeflow/hook_';            // identifies OUR hook entries in settings.json
 // create-if-absent, never clobber. `test-context.json` ships NO default (it's filled at runtime by the
 // orchestrator with the project's TEST auth) — listing it here just means an update never clobbers it.
@@ -25,8 +26,9 @@ const PER_PROJECT_CONFIGS = ['brand.json', 'risk-signals.json', 'test-context.js
 // Paths appended to the project's .gitignore (add-if-absent). These hold TEST credentials / Playwright
 // storage state — they must NEVER be committed. test-context.json is per-project runtime state; .auth/
 // holds storageState files the orchestrator seeds for auth-gated functional verification.
-const GITIGNORE_LINES = ['.claudeflow/test-context.json', '.claudeflow/.auth/'];
+const GITIGNORE_LINES = ['.claudeflow/test-context.json', '.claudeflow/.auth/', '.claudeflow/telemetry/', '.claudeflow/certification/'];
 const SHARED_CONFIGS = ['playbook-map.json', 'agent-map.json'];   // always refreshed (shared system)
+const CODEX_DOCS = ['claudeflow-codex-migration.md', 'codexflow-codex-native-workflow.md', 'codexflow-local-actions.md'];
 
 function rmrf(p) { fs.rmSync(p, { recursive: true, force: true }); }
 
@@ -78,6 +80,142 @@ function mergeSettings(cwd, payloadSettings) {
   fs.writeFileSync(sp, JSON.stringify(data, null, 2) + '\n');
 }
 
+function mergeCodexHooks(cwd, payloadHooksFile) {
+  const hp = path.join(cwd, '.codex', 'hooks.json');
+  const payloadHooks = (payloadHooksFile && payloadHooksFile.hooks) || {};
+  if (!Object.keys(payloadHooks).length) return false;
+
+  let data = {};
+  if (fs.existsSync(hp)) {
+    try { data = JSON.parse(fs.readFileSync(hp, 'utf8')); } catch { return false; }
+    if (typeof data !== 'object' || data === null || Array.isArray(data)) return false;
+  }
+
+  const hooks = data.hooks || (data.hooks = {});
+  for (const evt of Object.keys(hooks)) {
+    hooks[evt] = (hooks[evt] || []).filter(e => !(e.hooks || []).some(h => (h.command || '').includes(HOOK_TAG)));
+    if (!hooks[evt].length) delete hooks[evt];
+  }
+  for (const evt of Object.keys(payloadHooks)) {
+    const arr = hooks[evt] || (hooks[evt] = []);
+    for (const entry of payloadHooks[evt]) arr.push(entry);
+  }
+
+  fs.mkdirSync(path.dirname(hp), { recursive: true });
+  fs.writeFileSync(hp, JSON.stringify(data, null, 2) + '\n');
+  return true;
+}
+
+function tomlKey(line) {
+  const m = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/);
+  return m ? m[1] : null;
+}
+
+function escapeRe(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function hasTomlKey(text, key) {
+  return new RegExp(`^\\s*${escapeRe(key)}\\s*=`, 'm').test(text);
+}
+
+function splitTomlSections(text) {
+  const top = [];
+  const sections = [];
+  let current = top;
+  for (const line of String(text).split('\n')) {
+    const m = line.match(/^\s*\[([^\]]+)\]\s*$/);
+    if (m) {
+      const section = { name: m[1], lines: [line] };
+      sections.push(section);
+      current = section.lines;
+    } else {
+      current.push(line);
+    }
+  }
+  return { top, sections };
+}
+
+function insertBeforeFirstTomlSection(text, lines) {
+  if (!lines.length) return text;
+  const block = lines.join('\n') + '\n';
+  const firstSection = text.search(/^\s*\[[^\]]+\]\s*$/m);
+  if (firstSection === -1) return text.replace(/\s*$/, '\n') + block;
+  const prefix = text.slice(0, firstSection).replace(/\s*$/, '\n');
+  return prefix + block + '\n' + text.slice(firstSection);
+}
+
+function tomlSectionRange(text, name) {
+  const headerRe = new RegExp(`^\\s*\\[${escapeRe(name)}\\]\\s*$`, 'm');
+  const match = headerRe.exec(text);
+  if (!match) return null;
+  const nextRe = /^\s*\[[^\]]+\]\s*$/gm;
+  nextRe.lastIndex = match.index + match[0].length;
+  const next = nextRe.exec(text);
+  return { start: match.index, end: next ? next.index : text.length };
+}
+
+function mergeTomlSection(text, section) {
+  const range = tomlSectionRange(text, section.name);
+  if (!range) {
+    return text.replace(/\s*$/, '\n') + '\n' + section.lines.join('\n').replace(/\s*$/, '') + '\n';
+  }
+
+  const current = text.slice(range.start, range.end);
+  const missing = section.lines.slice(1).filter(line => {
+    const key = tomlKey(line);
+    return key && !hasTomlKey(current, key);
+  });
+  if (!missing.length) return text;
+  const insert = (text[range.end - 1] === '\n' ? '' : '\n') + missing.join('\n') + '\n';
+  return text.slice(0, range.end) + insert + text.slice(range.end);
+}
+
+function mergeCodexConfig(cwd, payloadConfigText) {
+  if (!payloadConfigText || !String(payloadConfigText).trim()) return false;
+  const cp = path.join(cwd, '.codex', 'config.toml');
+  fs.mkdirSync(path.dirname(cp), { recursive: true });
+  if (!fs.existsSync(cp)) {
+    fs.writeFileSync(cp, String(payloadConfigText).replace(/\s*$/, '\n'));
+    return true;
+  }
+
+  const before = fs.readFileSync(cp, 'utf8');
+  const payload = splitTomlSections(payloadConfigText);
+  const topAssignments = payload.top.filter(line => {
+    const key = tomlKey(line);
+    return key && !hasTomlKey(before, key);
+  });
+
+  let updated = insertBeforeFirstTomlSection(before, topAssignments);
+  for (const section of payload.sections) updated = mergeTomlSection(updated, section);
+  if (updated === before) return false;
+  fs.writeFileSync(cp, updated.replace(/\s*$/, '\n'));
+  return true;
+}
+
+function mergeCodexMarketplace(cwd, payloadMarketplace) {
+  const payloadPlugins = (payloadMarketplace && payloadMarketplace.plugins) || [];
+  if (!Array.isArray(payloadPlugins) || !payloadPlugins.length) return false;
+
+  const mp = path.join(cwd, '.agents', 'plugins', 'marketplace.json');
+  let data = {};
+  if (fs.existsSync(mp)) {
+    try { data = JSON.parse(fs.readFileSync(mp, 'utf8')); } catch { return false; }
+    if (typeof data !== 'object' || data === null || Array.isArray(data)) return false;
+  }
+
+  if (!data.name && payloadMarketplace.name) data.name = payloadMarketplace.name;
+  if (!data.interface && payloadMarketplace.interface) data.interface = payloadMarketplace.interface;
+  const managedNames = new Set(payloadPlugins.map(p => p && p.name).filter(Boolean));
+  const existing = Array.isArray(data.plugins) ? data.plugins : [];
+  data.plugins = existing.filter(p => !managedNames.has(p && p.name)).concat(payloadPlugins);
+
+  fs.mkdirSync(path.dirname(mp), { recursive: true });
+  fs.writeFileSync(mp, JSON.stringify(data, null, 2) + '\n');
+  return true;
+}
+
 // Seed the BASE MCP server set (playwright for visual QA / browser_verification, context7 for live library
 // docs during Discover) into the project's root `.mcp.json` — the set the old framework shipped, restored.
 // ADD-IF-ABSENT by server key: create the file if missing, else merge in only the keys the user doesn't
@@ -126,32 +264,57 @@ function mergeGitignore(cwd, lines) {
 //   • CLAUDE.md WITH the block → REPLACE the marked region in place, so guidance updates PROPAGATE on `update`
 //     (the old code appended-once and never refreshed → a stale project never got new disciplines).
 //   • begin marker but no end (corrupted) → leave it untouched (don't risk eating user content)
-function syncClaudeMd(cwd, snippetPath) {
+function syncMarkedMd(cwd, targetName, snippetPath, beginMark, endMark) {
   if (!fs.existsSync(snippetPath)) return false;
-  const target = path.join(cwd, 'CLAUDE.md');
+  const target = path.join(cwd, targetName);
   const block = fs.readFileSync(snippetPath, 'utf8').trim();
   if (!fs.existsSync(target)) {
     fs.writeFileSync(target, block + '\n');
     return true;
   }
   const cur = fs.readFileSync(target, 'utf8');
-  const b = cur.indexOf(CLAUDE_MARK);
+  const b = cur.indexOf(beginMark);
   if (b === -1) {
     fs.writeFileSync(target, cur.replace(/\s*$/, '') + '\n\n' + block + '\n');
     return true;
   }
-  const e = cur.indexOf(CLAUDE_END, b);
+  const e = cur.indexOf(endMark, b);
   if (e === -1) return false;  // begin without end → corrupt region; don't clobber
-  const updated = cur.slice(0, b) + block + cur.slice(e + CLAUDE_END.length);
+  const updated = cur.slice(0, b) + block + cur.slice(e + endMark.length);
   if (updated === cur) return false;  // already current
   fs.writeFileSync(target, updated);
   return true;
 }
 
+function syncClaudeMd(cwd, snippetPath) {
+  return syncMarkedMd(cwd, 'CLAUDE.md', snippetPath, CLAUDE_MARK, CLAUDE_END);
+}
+
+function syncAgentsMd(cwd, snippetPath) {
+  return syncMarkedMd(cwd, 'AGENTS.md', snippetPath, CODEX_MARK, CODEX_END);
+}
+
 // Place + merge the framework from an extracted payload dir into a project. Pure filesystem, no network —
 // so it is testable on a throwaway dir.
 function installFromPayload(src, cwd) {
-  const out = { playbooks: 0, scripts: 0, skills: 0, agents: 0, mcp: 0, gitignore: 0, claudeMd: false, failed: [] };
+  const out = {
+    playbooks: 0,
+    scripts: 0,
+    skills: 0,
+    agents: 0,
+    codexSkills: 0,
+    codexAgents: 0,
+    codexHooks: false,
+    codexConfig: false,
+    codexMarketplace: false,
+    codexPlugin: 0,
+    docs: 0,
+    mcp: 0,
+    gitignore: 0,
+    claudeMd: false,
+    agentsMd: false,
+    failed: [],
+  };
   // Each placement step is ISOLATED: a failure in one (a copy error, a permission hiccup, a weird file in the
   // user's tree) must NOT abort the rest — above all it must not skip the settings/env + CLAUDE.md config, the
   // two steps a user most needs (the env block wires agent-teams + the autocompact window, etc.). Before this,
@@ -222,6 +385,33 @@ function installFromPayload(src, cwd) {
     }
   });
 
+  // 4c) Codex skills — replace shipped claudeflow-* skills in .agents; preserve user skills.
+  step('codex-skills', () => {
+    const srcSkills = path.join(src, '.agents', 'skills');
+    if (fs.existsSync(srcSkills)) {
+      const dst = path.join(cwd, '.agents', 'skills');
+      fs.mkdirSync(dst, { recursive: true });
+      for (const e of fs.readdirSync(srcSkills, { withFileTypes: true })) {
+        if (!e.isDirectory() || !e.name.startsWith('claudeflow-')) continue;
+        const d = path.join(dst, e.name);
+        try { rmrf(d); copyDir(path.join(srcSkills, e.name), d); out.codexSkills++; } catch {}
+      }
+    }
+  });
+
+  // 4d) Codex agents — replace shipped claudeflow-*.toml agents; preserve user agents.
+  step('codex-agents', () => {
+    const srcAgents = path.join(src, '.codex', 'agents');
+    if (fs.existsSync(srcAgents)) {
+      const dst = path.join(cwd, '.codex', 'agents');
+      fs.mkdirSync(dst, { recursive: true });
+      for (const e of fs.readdirSync(srcAgents, { withFileTypes: true })) {
+        if (!e.isFile() || !e.name.startsWith('claudeflow-') || !e.name.endsWith('.toml')) continue;
+        try { fs.copyFileSync(path.join(srcAgents, e.name), path.join(dst, e.name)); out.codexAgents++; } catch {}
+      }
+    }
+  });
+
   // 5) settings.json — MERGE the shipped hooks + env (add-if-absent) into the user's settings (never clobber).
   //    ALWAYS runs (isolated above) — this is what wires CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS et al.
   step('settings', () => {
@@ -246,7 +436,50 @@ function installFromPayload(src, cwd) {
     }
   });
 
-  // 8) .gitignore — ensure the TEST-credential paths are ignored (add-if-absent; never commit creds).
+  // 8) AGENTS.md — upsert the Codex guidance block between markers, preserving project guidance.
+  step('agents-md', () => {
+    out.agentsMd = syncAgentsMd(cwd, path.join(src, 'assets', 'AGENTS.snippet.md'));
+  });
+
+  // 9) Codex hooks/config — merge hooks, and add missing default config keys/sections only.
+  step('codex-hooks', () => {
+    const srcHooks = path.join(src, '.codex', 'hooks.json');
+    if (fs.existsSync(srcHooks)) out.codexHooks = mergeCodexHooks(cwd, JSON.parse(fs.readFileSync(srcHooks, 'utf8')));
+  });
+  step('codex-config', () => {
+    const srcConfig = path.join(src, '.codex', 'config.toml');
+    if (fs.existsSync(srcConfig)) out.codexConfig = mergeCodexConfig(cwd, fs.readFileSync(srcConfig, 'utf8'));
+  });
+
+  // 10) Codex marketplace + local plugin — managed codexflow entry only; user plugins are preserved.
+  step('codex-marketplace', () => {
+    const srcMarketplace = path.join(src, '.agents', 'plugins', 'marketplace.json');
+    if (fs.existsSync(srcMarketplace)) out.codexMarketplace = mergeCodexMarketplace(cwd, JSON.parse(fs.readFileSync(srcMarketplace, 'utf8')));
+  });
+  step('codex-plugin', () => {
+    const srcPlugin = path.join(src, 'plugins', 'codexflow');
+    if (fs.existsSync(srcPlugin)) {
+      const dst = path.join(cwd, 'plugins', 'codexflow');
+      rmrf(dst); copyDir(srcPlugin, dst);
+      out.codexPlugin = countFiles(dst);
+    }
+  });
+
+  // 11) Codex docs — managed filenames only.
+  step('codex-docs', () => {
+    const srcDocs = path.join(src, 'docs');
+    if (fs.existsSync(srcDocs)) {
+      const dstDocs = path.join(cwd, 'docs');
+      fs.mkdirSync(dstDocs, { recursive: true });
+      for (const doc of CODEX_DOCS) {
+        const s = path.join(srcDocs, doc);
+        if (!fs.existsSync(s)) continue;
+        try { fs.copyFileSync(s, path.join(dstDocs, doc)); out.docs++; } catch {}
+      }
+    }
+  });
+
+  // 12) .gitignore — ensure runtime and credential paths are ignored (add-if-absent; never commit creds).
   step('gitignore', () => { out.gitignore = mergeGitignore(cwd, GITIGNORE_LINES); });
 
   return out;
@@ -311,8 +544,14 @@ async function run() {
 
   ui.success(`claudeflow v${version} installed`);
   ui.info(`  ${summary.playbooks} playbooks · ${summary.scripts} scripts · ${summary.skills} skills`
+    + (summary.codexSkills ? ` · ${summary.codexSkills} Codex skills` : '')
+    + (summary.codexAgents ? ` · ${summary.codexAgents} Codex agents` : '')
+    + (summary.codexHooks ? ' · Codex hooks merged' : '')
+    + (summary.codexConfig ? ' · Codex config synced' : '')
+    + (summary.codexMarketplace ? ' · Codex plugin registered' : '')
     + (summary.mcp ? ` · ${summary.mcp} MCP server${summary.mcp > 1 ? 's' : ''} added to .mcp.json` : '')
-    + (summary.claudeMd ? ' · CLAUDE.md guidance synced' : ''));
+    + (summary.claudeMd ? ' · CLAUDE.md guidance synced' : '')
+    + (summary.agentsMd ? ' · AGENTS.md guidance synced' : ''));
   if (summary.failed && summary.failed.length) {
     ui.warn(`  some steps did not complete: ${summary.failed.join(', ')}. Re-run \`npx @axiomatic-labs/claudeflow@latest install\` (the @latest avoids a stale npx cache).`);
   }
@@ -323,5 +562,9 @@ module.exports = run;
 module.exports.installFromPayload = installFromPayload;
 module.exports.mergeSettings = mergeSettings;
 module.exports.syncClaudeMd = syncClaudeMd;
+module.exports.syncAgentsMd = syncAgentsMd;
 module.exports.mergeMcp = mergeMcp;
 module.exports.mergeGitignore = mergeGitignore;
+module.exports.mergeCodexHooks = mergeCodexHooks;
+module.exports.mergeCodexConfig = mergeCodexConfig;
+module.exports.mergeCodexMarketplace = mergeCodexMarketplace;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.49.7",
-  "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
+  "version": "2.49.9",
+  "description": "Claudeflow — AI-powered development toolkit for Claude Code and Codex. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"
   },
@@ -18,6 +18,7 @@
   "keywords": [
     "claude",
     "claude-code",
+    "codex",
     "ai",
     "ai-agents",
     "ai-coding",