@holmes-lab/holmes-kit 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
+## [0.2.1] - 2026-08-28
+
+Codex governance that is actually wired: the MCP server holmes-kit writes for Codex now lives where Codex reads it.
+
+### Fixed
+- **Codex MCP wiring goes where Codex actually reads it (REQ-266)**: `init` wrote the Codex harness's MCP server to a project-local `.codex/mcp_config.json` (JSON) — a file Codex never loads. Codex reads `[mcp_servers.*]` tables from `.codex/config.toml` (TOML), so **every Codex wiring since it was added was dead**, and because Codex enforces no hooks (`HARNESS_ENFORCES.codex = false`) that MCP server is Codex's *only* governance path — so Codex was wired but ungoverned. `init` now writes `[mcp_servers.holmes-kit]` into `.codex/config.toml`, **merging** so the user's other Codex settings and servers are preserved byte-for-byte (the same discipline as the `.mcp.json` merge), migrates away the obsolete `.codex/mcp_config.json` (only after the new write is confirmed), and `doctor`'s `codex wiring` check now verifies the file Codex reads (a leftover JSON with no `config.toml` is a WARN). The merge is string/bracket-aware — a `[mcp_servers.holmes-kit]` line inside a neighbor's multi-line string or array is not mistaken for a real table, and an unrecognized foreign header always closes our region rather than swallowing it. The three-harness parity meta-test now asserts not only identical launch command/args but that each harness's wiring lands where that harness reads it. Existing Codex projects: re-run `holmes-kit init --agent codex` (doctor will flag the stale wiring).
+- **`.codex/config.toml` is protected from self-disarm like its siblings (REQ-266)**: because that file is now Codex's sole governance path, an un-approved `Write`/`Edit` to it is denied for a config-write approval, exactly as `.mcp.json` and `.agents/*` already were — a session can no longer quietly re-point or delete Codex's MCP wiring.
+
+### Changed
+- **`init` pre-selects every harness by default (REQ-266)**: the interactive harness picker now checks all harnesses (Claude Code, Antigravity, Codex) by default, matching its own "Select All (Recommended)" affordance; Codex was previously left unchecked. Deselecting a harness is one keystroke; a silently un-wired harness is not.
+
+### Unverified (named)
+- `doctor`'s `codex wiring` check does not WARN on an out-of-date npx pin the way the `.mcp.json` version-drift check does; porting that drift WARN to `.codex/config.toml` is a named follow-up (A-SPEC-251.2 family), not a wiring defect.
+
 ## [0.2.0] - 2026-08-27
 
 The approval decision surface, world-tier: the operator stays at one screen, and a grant is exactly what they saw.

package/dist/.build-id

@@ -1 +1 @@
-f7a048d-mtbm5atb
+9a2f304-mtbs8fh6

package/dist/holmes/cli/agents.js

@@ -169,8 +169,12 @@ function agentFiles(agent, opts) {
                 { path: path.join(target, 'AGENTS.md'), content: AGENTS_MD(exports.HARNESS_ENFORCES.antigravity) },
             ];
         case 'codex':
+            // @implements A-SPEC-266 — the MCP wiring is NOT a whole-file overwrite here: Codex reads
+            // `.codex/config.toml` (TOML `[mcp_servers.*]`), a file that also holds the user's other Codex
+            // settings, so it must be MERGED. That merge lives in init.ts alongside the `.mcp.json` merge
+            // (it reads the existing target file); agentFiles stays pure. Here we emit only AGENTS.md.
+            // The former `.codex/mcp_config.json` (JSON) was never read by Codex — init cleans it up.
             return [
-                { path: path.join(target, '.codex', 'mcp_config.json'), content: mcpConfig(packageRoot, specsDir, opts.launcher) },
                 { path: path.join(target, 'AGENTS.md'), content: AGENTS_MD(exports.HARNESS_ENFORCES.codex) },
             ];
         default:

package/dist/holmes/cli/codex-toml.d.ts

@@ -0,0 +1,26 @@
+import { McpServerEntry } from './mcp-launcher';
+/** The one table holmes-kit owns in a Codex config.toml. */
+export declare const CODEX_TABLE = "mcp_servers.holmes-kit";
+/**
+ * Serialize the `[mcp_servers.holmes-kit]` table. `env` is an inline table so the whole entry is ONE
+ * contiguous region (no `[mcp_servers.holmes-kit.env]` child header) — that keeps the merge boundary
+ * unambiguous: our region runs from the header to the next table header. Ends with a trailing newline.
+ */
+export declare function codexMcpBlock(entry: McpServerEntry, specsDir: string): string;
+/**
+ * Merge `block` (a full `codexMcpBlock` output) into `existing`. When `existing` is null/empty the
+ * block stands alone. When our table is already present its region is REPLACED (no duplicate); when
+ * absent the block is appended after a blank-line separator. Every other line is preserved verbatim.
+ */
+export declare function mergeCodexToml(existing: string | null, block: string): string;
+/** Strip our region from `existing`, preserving everything else. Absent → returned unchanged. */
+export declare function removeCodexToml(existing: string): string;
+/**
+ * Read `{command,args}` from our table in a config.toml — for doctor's drift check. Parses only the
+ * shape `codexMcpBlock` writes; anything it cannot read returns null (doctor then WARNs rather than
+ * translating an unreadable wiring into a pass).
+ */
+export declare function readCodexHolmesEntry(raw: string): {
+    command: string;
+    args: string[];
+} | null;

package/dist/holmes/cli/codex-toml.js

@@ -0,0 +1,282 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_TABLE = void 0;
+exports.codexMcpBlock = codexMcpBlock;
+exports.mergeCodexToml = mergeCodexToml;
+exports.removeCodexToml = removeCodexToml;
+exports.readCodexHolmesEntry = readCodexHolmesEntry;
+/** The one table holmes-kit owns in a Codex config.toml. */
+exports.CODEX_TABLE = 'mcp_servers.holmes-kit';
+const HEADER = `[${exports.CODEX_TABLE}]`;
+/** TOML basic-string escape — backslash and quote, the named whitespace escapes, then any remaining
+ * C0 control character as \uXXXX. Built by code point so no literal control byte lives in the source. */
+function tomlStr(s) {
+    let out = '';
+    for (const ch of s) {
+        const code = ch.codePointAt(0);
+        if (ch === '\\')
+            out += '\\\\';
+        else if (ch === '"')
+            out += '\\"';
+        else if (ch === '\n')
+            out += '\\n';
+        else if (ch === '\r')
+            out += '\\r';
+        else if (ch === '\t')
+            out += '\\t';
+        else if (code < 0x20 || code === 0x7f)
+            out += `\\u${code.toString(16).padStart(4, '0')}`;
+        else
+            out += ch;
+    }
+    return `"${out}"`;
+}
+/**
+ * Serialize the `[mcp_servers.holmes-kit]` table. `env` is an inline table so the whole entry is ONE
+ * contiguous region (no `[mcp_servers.holmes-kit.env]` child header) — that keeps the merge boundary
+ * unambiguous: our region runs from the header to the next table header. Ends with a trailing newline.
+ */
+function codexMcpBlock(entry, specsDir) {
+    const args = entry.args.map(tomlStr).join(', ');
+    return [
+        HEADER,
+        `command = ${tomlStr(entry.command)}`,
+        `args = [${args}]`,
+        `env = { HOLMES_SPECS = ${tomlStr(specsDir)} }`,
+        '',
+    ].join('\n');
+}
+/** Advance the string/bracket state across one line's characters (comments end the line). */
+function advance(line, st) {
+    let { ml, depth } = st;
+    let i = 0;
+    while (i < line.length) {
+        if (ml === '"""') {
+            if (line.startsWith('"""', i)) {
+                ml = null;
+                i += 3;
+            }
+            else if (line[i] === '\\') {
+                i += 2;
+            }
+            else
+                i += 1;
+            continue;
+        }
+        if (ml === "'''") { // literal: no escapes
+            if (line.startsWith("'''", i)) {
+                ml = null;
+                i += 3;
+            }
+            else
+                i += 1;
+            continue;
+        }
+        if (line.startsWith('"""', i)) {
+            ml = '"""';
+            i += 3;
+            continue;
+        }
+        if (line.startsWith("'''", i)) {
+            ml = "'''";
+            i += 3;
+            continue;
+        }
+        const c = line[i];
+        if (c === '#')
+            break; // comment runs to end of line
+        if (c === '"') {
+            i += 1;
+            while (i < line.length && line[i] !== '"') {
+                if (line[i] === '\\')
+                    i += 1;
+                i += 1;
+            }
+            i += 1;
+            continue;
+        }
+        if (c === "'") {
+            i += 1;
+            while (i < line.length && line[i] !== "'")
+                i += 1;
+            i += 1;
+            continue;
+        }
+        if (c === '[' || c === '{') {
+            depth += 1;
+            i += 1;
+            continue;
+        }
+        if (c === ']' || c === '}') {
+            depth = Math.max(0, depth - 1);
+            i += 1;
+            continue;
+        }
+        i += 1;
+    }
+    return { ml, depth };
+}
+/** State at the START of each line (index-aligned to `lines`). */
+function lineStartStates(lines) {
+    const states = [];
+    let st = { ml: null, depth: 0 };
+    for (const line of lines) {
+        states.push(st);
+        st = advance(line, st);
+    }
+    return states;
+}
+/**
+ * The dotted key path of a table-header line, quotes stripped and each segment trimmed — so
+ * `[mcp_servers.holmes-kit]`, `[mcp_servers."holmes-kit"]`, and `[ mcp_servers . holmes-kit ]` all
+ * yield ['mcp_servers','holmes-kit'] (TOML treats them as the SAME table; missing an alias would
+ * append a duplicate table and invalidate the whole file — round-1 quoted-key, round-2 whitespace).
+ * Returns null when the line is not a table header.
+ */
+function tableKeyPath(line) {
+    const m = line.match(/^\s*\[\[?([^\]]*)\]\]?\s*(#.*)?$/);
+    if (!m)
+        return null;
+    const inner = m[1];
+    const segs = [];
+    let cur = '';
+    let q = null;
+    for (let i = 0; i < inner.length; i++) {
+        const c = inner[i];
+        if (q) {
+            if (c === q)
+                q = null;
+            else
+                cur += c;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            q = c;
+            continue;
+        }
+        if (c === '.') {
+            segs.push(cur.trim());
+            cur = '';
+            continue;
+        }
+        cur += c;
+    }
+    segs.push(cur.trim());
+    if (q !== null)
+        return null; // unbalanced quote — not a clean header
+    return segs;
+}
+const isOurTable = (kp) => kp.length === 2 && kp[0] === 'mcp_servers' && kp[1] === 'holmes-kit';
+const isOurPrefix = (kp) => kp.length >= 2 && kp[0] === 'mcp_servers' && kp[1] === 'holmes-kit';
+/**
+ * Locate our region as a [start, end) line-index pair, or null if absent. `start` is our table's
+ * header line; `end` is the first later line that opens a DIFFERENT top-level table (exclusive), or
+ * lines.length. Only real headers (outside strings, bracket-depth 0) are considered — AND the end
+ * boundary closes on ANY top-level header line, even one `tableKeyPath` cannot normalize (e.g. a
+ * quoted key containing `]`). That fail-safe is the point: an unrecognized header is never OURS, so
+ * treating it as a boundary preserves the foreign table rather than swallowing it (round-3 finding).
+ */
+function ourRegion(lines) {
+    const states = lineStartStates(lines);
+    const isTopLevelHeaderLine = (i) => states[i].ml === null && states[i].depth === 0 && /^\s*\[/.test(lines[i]);
+    const keyAt = (i) => (isTopLevelHeaderLine(i) ? tableKeyPath(lines[i]) : null);
+    let start = -1;
+    for (let i = 0; i < lines.length; i++) {
+        const kp = keyAt(i);
+        if (kp && isOurTable(kp)) {
+            start = i;
+            break;
+        }
+    }
+    if (start === -1)
+        return null;
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i++) {
+        if (!isTopLevelHeaderLine(i))
+            continue;
+        const kp = tableKeyPath(lines[i]);
+        if (!(kp && isOurPrefix(kp))) {
+            end = i;
+            break;
+        } // any non-our (incl. unparseable) header closes us
+    }
+    return { start, end };
+}
+/**
+ * Merge `block` (a full `codexMcpBlock` output) into `existing`. When `existing` is null/empty the
+ * block stands alone. When our table is already present its region is REPLACED (no duplicate); when
+ * absent the block is appended after a blank-line separator. Every other line is preserved verbatim.
+ */
+function mergeCodexToml(existing, block) {
+    if (existing == null || existing.trim() === '')
+        return block;
+    const lines = existing.split('\n');
+    const region = ourRegion(lines);
+    const blockLines = block.replace(/\n$/, '').split('\n');
+    if (region) {
+        const after = lines.slice(region.end);
+        const merged = [...lines.slice(0, region.start), ...blockLines, ...after];
+        return merged.join('\n').replace(/\n*$/, '\n');
+    }
+    // Append: exactly one blank line between the user's content and our block.
+    const base = existing.replace(/\n*$/, '');
+    return `${base}\n\n${block.replace(/\n*$/, '')}\n`;
+}
+/** Strip our region from `existing`, preserving everything else. Absent → returned unchanged. */
+function removeCodexToml(existing) {
+    const lines = existing.split('\n');
+    const region = ourRegion(lines);
+    if (!region)
+        return existing;
+    const before = lines.slice(0, region.start);
+    const after = lines.slice(region.end);
+    // Drop a trailing blank line left dangling between `before` and `after` so removal is clean.
+    while (before.length > 0 && before[before.length - 1].trim() === '')
+        before.pop();
+    const merged = [...before, ...after];
+    const joined = merged.join('\n');
+    if (joined.trim() === '')
+        return '';
+    return joined.replace(/\n*$/, '\n');
+}
+/**
+ * Read `{command,args}` from our table in a config.toml — for doctor's drift check. Parses only the
+ * shape `codexMcpBlock` writes; anything it cannot read returns null (doctor then WARNs rather than
+ * translating an unreadable wiring into a pass).
+ */
+function readCodexHolmesEntry(raw) {
+    const lines = raw.split('\n');
+    const region = ourRegion(lines);
+    if (!region)
+        return null;
+    let command = null;
+    let args = null;
+    for (let i = region.start + 1; i < region.end; i++) {
+        const cmd = lines[i].match(/^\s*command\s*=\s*"((?:[^"\\]|\\.)*)"\s*(#.*)?$/);
+        if (cmd)
+            command = unescapeToml(cmd[1]);
+        const arr = lines[i].match(/^\s*args\s*=\s*\[(.*)\]\s*(#.*)?$/);
+        if (arr)
+            args = parseTomlStringArray(arr[1]);
+    }
+    if (command === null || args === null)
+        return null;
+    return { command, args };
+}
+function unescapeToml(s) {
+    return s.replace(/\\(u[0-9a-fA-F]{4}|.)/g, (_, e) => {
+        if (e[0] === 'u')
+            return String.fromCharCode(parseInt(e.slice(1), 16));
+        const map = { n: '\n', r: '\r', t: '\t', '"': '"', '\\': '\\' };
+        return map[e] ?? e;
+    });
+}
+/** Parse a TOML inline array of basic strings: `"a", "b"` → ['a','b']. Non-conforming → []. */
+function parseTomlStringArray(inner) {
+    const out = [];
+    const re = /"((?:[^"\\]|\\.)*)"/g;
+    let mm;
+    while ((mm = re.exec(inner)) !== null)
+        out.push(unescapeToml(mm[1]));
+    return out;
+}

package/dist/holmes/cli/doctor.js

@@ -51,6 +51,7 @@ const settings_merge_1 = require("./settings-merge");
 const playbook_skills_1 = require("./playbook-skills");
 const init_1 = require("./init");
 const mcp_version_1 = require("./mcp-version");
+const codex_toml_1 = require("./codex-toml");
 const mcp_launcher_1 = require("./mcp-launcher");
 const GRAMMARS = [
     'tree-sitter-typescript', 'tree-sitter-python', 'tree-sitter-c-sharp', 'tree-sitter-java',
@@ -712,29 +713,52 @@ async function runDoctor(packageRoot, target, opts, extraChecks) {
             const agySkills = path.join(target, '.agents', 'skills');
             add('antigravity skills', fs.existsSync(agySkills) ? 'PASS' : 'WARN', fs.existsSync(agySkills) ? `${agySkills} 가 스킬을 가리킵니다` : `${agySkills} 가 없습니다 — 이 하네스는 스킬을 보지 못합니다`, fs.existsSync(agySkills) ? undefined : `${path.join('..', '.claude', 'skills')} 로 링크하거나 복사하십시오.`);
         }
-        // @implements A-SPEC-264 — 세 하네스 중 codex 만 배선 검사가 없었다(REQ-264 실측). 배선된
-        // 하네스마다 그 하네스의 배선을 검사한다는 A-SPEC-193 의 원칙 그대로: 파일이 없으면
-        // 진단하지 않고, 있으면 이 설치본으로 해석되는지를 판정한다.
-        const cdxMcp = path.join(target, '.codex', 'mcp_config.json');
-        if (fs.existsSync(cdxMcp)) {
+        // @implements A-SPEC-266 (was A-SPEC-264) — Codex reads MCP servers from `.codex/config.toml`
+        // (TOML `[mcp_servers.*]`), so we check the file Codex actually loads — not the
+        // `.codex/mcp_config.json` (JSON) this project used to write and Codex never read. Same A-SPEC-193
+        // principle: no file → no diagnosis; a present file is judged for whether it resolves to THIS
+        // install. A leftover JSON with no config.toml is a stale wiring in a location Codex ignores → WARN.
+        const cdxToml = path.join(target, '.codex', 'config.toml');
+        const cdxJson = path.join(target, '.codex', 'mcp_config.json');
+        if (fs.existsSync(cdxToml)) {
+            let raw = null;
             try {
-                const doc = JSON.parse(fs.readFileSync(cdxMcp, 'utf8'));
-                const entry = doc.mcpServers?.[init_1.SERVER_NAME];
-                if (!entry || typeof entry.command !== 'string' || !Array.isArray(entry.args)) {
-                    add('codex wiring', 'WARN', `${cdxMcp} 에 실행 가능한 ${init_1.SERVER_NAME} 항목이 없습니다 — 반쯤 된 배선입니다`, 'holmes-kit init --target <dir> --agent codex 로 다시 배선하십시오.');
+                raw = fs.readFileSync(cdxToml, 'utf8');
+            }
+            catch { /* handled below */ }
+            if (raw === null) {
+                add('codex wiring', 'FAIL', `${cdxToml} 를 읽을 수 없습니다`, '파일 권한을 확인하거나 지우고 다시 배선하십시오.');
+            }
+            else {
+                const entry = (0, codex_toml_1.readCodexHolmesEntry)(raw);
+                if (!entry) {
+                    add('codex wiring', 'WARN', `${cdxToml} 에 실행 가능한 [mcp_servers.${init_1.SERVER_NAME}] 항목이 없습니다 — 반쯤 된 배선입니다`, 'holmes-kit init --target <dir> --agent codex 로 다시 배선하십시오.');
                 }
                 else if (entry.command === 'node') {
+                    // @implements A-SPEC-266 — "이 설치본으로 해석됩니다"는 존재만으로는 부족하다: node 배선은
+                    // holmes-mcp.js 를 가리켜야 한다. 아무 존재 파일(예: /etc/hosts)에 PASS 를 주면 "해석된다"는
+                    // 주장이 검사보다 강해진다(적대 라운드 Finding 2). 파일명까지 확인해 그 간극을 좁힌다.
                     const bin = entry.args[0] ?? '';
-                    add('codex wiring', fs.existsSync(bin) ? 'PASS' : 'FAIL', fs.existsSync(bin) ? `MCP 배선이 이 설치본으로 해석됩니다: ${bin}` : `MCP 배선이 없는 파일을 가리킵니다: ${bin}`, fs.existsSync(bin) ? undefined : 'holmes-kit init --target <dir> --agent codex --force 로 절대 경로를 갱신하십시오.');
+                    // Resolve the link before judging the name (round-2 F4): a symlink literally named
+                    // `holmes-mcp.js` pointing at /etc/hosts must not read as "resolves to this install".
+                    const realBin = (() => { try {
+                        return fs.realpathSync(bin);
+                    }
+                    catch {
+                        return '';
+                    } })();
+                    const resolvesHere = realBin !== '' && path.basename(realBin) === 'holmes-mcp.js';
+                    add('codex wiring', resolvesHere ? 'PASS' : 'FAIL', resolvesHere ? `MCP 배선이 이 설치본으로 해석됩니다: ${bin}`
+                        : (fs.existsSync(bin) ? `MCP 배선이 holmes-mcp.js 가 아닌 파일을 가리킵니다: ${bin}` : `MCP 배선이 없는 파일을 가리킵니다: ${bin}`), resolvesHere ? undefined : 'holmes-kit init --target <dir> --agent codex --force 로 절대 경로를 갱신하십시오.');
                 }
                 else {
                     const pin = (0, mcp_version_1.mcpLaunchVersion)({ command: entry.command, args: entry.args });
                     add('codex wiring', pin !== null ? 'PASS' : 'FAIL', pin !== null ? `npx 핀 ${pin} 으로 해석됩니다` : `배선에서 실행 버전을 읽을 수 없습니다: ${entry.command} ${entry.args.join(' ')}`, pin !== null ? undefined : 'holmes-kit init --target <dir> --agent codex 로 다시 배선하십시오.');
                 }
             }
-            catch {
-                add('codex wiring', 'FAIL', `${cdxMcp} 를 읽을 수 없습니다(JSON 아님)`, '파일을 고치거나 지우고 다시 배선하십시오.');
-            }
+        }
+        else if (fs.existsSync(cdxJson)) {
+            add('codex wiring', 'WARN', `codex 배선이 Codex 가 읽지 않는 구식 위치(${cdxJson})에 있습니다 — config.toml 로 옮겨야 합니다`, 'holmes-kit init --target <dir> --agent codex 로 다시 배선하면 config.toml 로 이전되고 구식 파일이 정리됩니다.');
         }
         try {
             const sp = wiredSettingsPath(target);

package/dist/holmes/cli/index.js

@@ -933,7 +933,9 @@ async function main(argv) {
             isAdditive = true;
         }
         else if (process.stdin.isTTY && process.stdout.isTTY && flags['dry-run'] !== true && flags.remove !== true) {
-            agents = await promptAgentSelection(AGENTS, ['claude', 'antigravity']);
+            // Default to all harnesses checked — matches the menu's "Select All (Recommended)" and
+            // spares users a toggle per harness. Deselecting is one keystroke; a missed wiring is not.
+            agents = await promptAgentSelection(AGENTS, [...AGENTS]);
             isAdditive = true;
         }
         else {

package/dist/holmes/cli/init.js

@@ -46,6 +46,7 @@ const playbook_skills_1 = require("./playbook-skills");
 const agents_1 = require("./agents");
 const roles_readme_1 = require("./roles-readme");
 const mcp_launcher_1 = require("./mcp-launcher");
+const codex_toml_1 = require("./codex-toml");
 const pre_tool_use_1 = require("../hooks/pre-tool-use");
 const governed_precondition_1 = require("./governed-precondition");
 const risk_gate_1 = require("../guardrail/risk-gate");
@@ -343,6 +344,71 @@ function runInit(opts) {
         }
         messages.push('Restart Claude Code — hooks and MCP servers are read at session start.');
     }
+    // @implements A-SPEC-266 — Codex reads MCP servers from `.codex/config.toml` (TOML
+    // `[mcp_servers.*]`), NOT the `.codex/mcp_config.json` (JSON) this project used to write and Codex
+    // never loaded. That file also holds the user's other Codex settings, so — like `.mcp.json` — we
+    // MERGE only our table. The obsolete JSON is migrated away so no dead wiring is left behind.
+    let codexJsonToMigrate = null; // deleted only after the write loop confirms config.toml
+    {
+        const codexDir = path.join(opts.target, '.codex');
+        const codexTomlPath = path.join(codexDir, 'config.toml');
+        const codexJsonPath = path.join(codexDir, 'mcp_config.json');
+        // A `.codex/config.toml` we cannot read (a directory, a permission wall, a dangling symlink) is
+        // NOT touched — reading it eagerly with readFileSync threw and crashed the whole init. Mirror the
+        // `.mcp.json` "refusing to touch it" discipline: skip codex wiring and say so, migrate nothing.
+        let codexTomlBefore = null;
+        let codexUnreadable = false;
+        if (fs.existsSync(codexTomlPath)) {
+            try {
+                codexTomlBefore = fs.readFileSync(codexTomlPath, 'utf8');
+            }
+            catch {
+                codexUnreadable = true;
+            }
+        }
+        const wantsCodex = (opts.agents ?? []).includes('codex') && !codexUnreadable;
+        if (codexUnreadable)
+            messages.push(`Refusing to touch ${codexTomlPath} — it is not a readable file. Fix or remove it, then re-run.`);
+        // @implements A-SPEC-266 (round-2 F3) — the obsolete JSON is deleted AFTER the config.toml write is
+        // confirmed, never before: an eager delete followed by a failed toml write left the user with NO
+        // codex wiring at all (and a message claiming nothing was lost). Here we only PLAN the migration;
+        // the deletion runs post-write-loop (dry-run just previews it in `removals`).
+        const migrateAwayCodexJson = () => {
+            if (!fs.existsSync(codexJsonPath))
+                return;
+            if (opts.dryRun) {
+                removals.push(codexJsonPath);
+                return;
+            }
+            codexJsonToMigrate = codexJsonPath;
+        };
+        if (opts.remove) {
+            if (codexTomlBefore !== null) {
+                const after = (0, codex_toml_1.removeCodexToml)(codexTomlBefore);
+                if (after.trim() === '' && after !== codexTomlBefore) {
+                    // Our table was the only content — delete the file rather than leave it empty.
+                    if (opts.dryRun)
+                        removals.push(codexTomlPath);
+                    else if (fs.existsSync(codexTomlPath)) {
+                        fs.rmSync(codexTomlPath, { force: true });
+                        messages.push(`Removed ${codexTomlPath} (holmes-kit MCP table was its only content).`);
+                    }
+                }
+                else if (after !== codexTomlBefore) {
+                    changes.push({ path: codexTomlPath, before: codexTomlBefore, after });
+                }
+            }
+            migrateAwayCodexJson();
+        }
+        else if (wantsCodex && opts.mcp) {
+            const mcpBin = path.join(opts.packageRoot, 'bin', 'holmes-mcp.js');
+            const entry = (0, mcp_launcher_1.mcpEntryForInstall)({ packageRoot: opts.packageRoot, mcpBinPath: mcpBin, flag: opts.mcpLauncher });
+            const after = (0, codex_toml_1.mergeCodexToml)(codexTomlBefore, (0, codex_toml_1.codexMcpBlock)(entry, opts.specsDir));
+            if (after !== codexTomlBefore)
+                changes.push({ path: codexTomlPath, before: codexTomlBefore, after });
+            migrateAwayCodexJson();
+        }
+    }
     if (opts.dryRun) {
         // @implements A-SPEC-190 (round 8) — dry-run must plan the SAME set the real run touches, and
         // must not print a deletion under the verb 'would write'. Round-7 planned installs only from
@@ -422,6 +488,18 @@ function runInit(opts) {
                     ] };
             }
         }
+        // @implements A-SPEC-266 (round-2 F3) — the config.toml write above is confirmed now, so it is
+        // safe to remove the obsolete JSON. Doing it earlier risked deleting codex's only wiring and then
+        // failing the toml write.
+        if (codexJsonToMigrate !== null && fs.existsSync(codexJsonToMigrate)) {
+            try {
+                fs.rmSync(codexJsonToMigrate, { force: true });
+                messages.push(`Removed obsolete ${codexJsonToMigrate} (Codex never read it — MCP wiring now lives in config.toml).`);
+            }
+            catch (e) {
+                messages.push(`Could not remove obsolete ${codexJsonToMigrate}: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
         if (!opts.remove && opts.mode === 'governed') {
             for (const d of SPEC_SUBDIRS)
                 fs.mkdirSync(path.join(opts.target, opts.specsDir, d), { recursive: true });

package/dist/holmes/cli/interactive-prompt.js

@@ -52,12 +52,12 @@ function parseAgentList(input) {
 /**
  * Renders an interactive TTY checkbox selection menu using standard readline & ANSI codes.
  */
-async function promptAgentSelection(availableAgents = agents_1.AGENTS, currentWired = ['claude']) {
+async function promptAgentSelection(availableAgents = agents_1.AGENTS, currentWired = [...agents_1.AGENTS]) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        return ['claude', 'antigravity']; // Fallback for non-TTY
+        return [...availableAgents]; // Fallback for non-TTY — default to all harnesses
     }
     return new Promise((resolve) => {
-        const selected = new Set(currentWired.length ? currentWired : ['claude', 'antigravity']);
+        const selected = new Set(currentWired.length ? currentWired : [...availableAgents]);
         let cursor = 0;
         const items = [...availableAgents, 'all'];
         const rl = readline.createInterface({
@@ -91,7 +91,7 @@ async function promptAgentSelection(availableAgents = agents_1.AGENTS, currentWi
                 }
                 else if (item === 'codex') {
                     isChecked = selected.has('codex');
-                    label = '💻 Codex CLI            (.codex/mcp_config.json)';
+                    label = '💻 Codex CLI            (.codex/config.toml)';
                 }
                 const box = isChecked ? '[X]' : '[ ]';
                 const line = `${prefix}${box} ${label}\n`;

package/dist/holmes/cli/mcp-launcher.d.ts

@@ -1,8 +1,8 @@
 /**
  * MCP 서버 배선의 launch 방식을 한 곳에서 계산한다.
  *
- * 왜 한 곳인가: `.mcp.json`(Claude)·`.agents/mcp_config.json`(antigravity)·`.codex/mcp_config.json`
- * 세 배선이 같은 서버를 띄운다. 셋이 각자 command/args 를 지으면 하나가 npx 로 옮겨갈 때 나머지가
+ * 왜 한 곳인가: `.mcp.json`(Claude)·`.agents/mcp_config.json`(antigravity)·`.codex/config.toml`
+ * (codex, TOML `[mcp_servers.holmes-kit]` — A-SPEC-266) 세 배선이 같은 서버를 띄운다. 셋이 각자 command/args 를 지으면 하나가 npx 로 옮겨갈 때 나머지가
  * 절대경로에 남아 어긋난다 — 그 드리프트가 REQ-251 자체의 출발점이었다.
  *
  * 왜 두 모드인가: 최종 사용자는 npm 설치본에서 init 하므로 `npx ...@<정확한버전> holmes-mcp` 가

package/dist/holmes/guardrail/write-target.js

@@ -256,6 +256,13 @@ function protectedFileKindOf(root, raw) {
     const parent = pp.basename(pp.dirname(resolved)).toLowerCase();
     if (parent === '.agents' && (name === 'hooks.json' || name === 'mcp_config.json'))
         return `.agents/${name}`;
+    // @implements A-SPEC-266 — codex 는 훅 게이트가 없어(HARNESS_ENFORCES.codex=false) `.codex/config.toml`
+    // 의 [mcp_servers.holmes-kit] 가 codex 지배의 **유일한** 경로다. 이 슬라이스가 그 배선을 죽은 JSON 에서
+    // 실제 거버넌스로 바꿨으므로, `.agents/*`·`.mcp.json` 과 정확히 같은 성질이 된다 — 세션이 고칠 수 있으면
+    // 세션이 codex 게이트를 끈다. A-SPEC-193 §8 의 원칙을 새로 자격을 갖춘 파일에 적용해 같은 self-disarm
+    // 보호를 준다. 구식 `.codex/mcp_config.json` 도 잠근다 — 그 파일을 되살려 배선을 흐릴 수 없게.
+    if (parent === '.codex' && (name === 'config.toml' || name === 'mcp_config.json'))
+        return `.codex/${name}`;
     // Example/sample/template/dist copies carry no secret — the same exclusion the hook's regex had.
     if (/^\.env(\.[\w-]+)?$/.test(name) && !/\.(example|sample|template|dist)$/.test(name))
         return '.env';

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",