@hwip/cli 0.1.3 → 0.1.5

package/README.md

@@ -39,6 +39,17 @@ Codex / …). Safe to re-run: a saved login is reused untouched (no
 prompts), so a re-run just refreshes the agent integrations. To switch
 account, `hwip install --relogin` forces a fresh sign-in.
 
+**Auto session names.** Agents without a title of their own — Codex,
+Cursor, Windsurf, Gemini and pi — name their sessions after what they were
+asked, so the phone shows that instead of a tmux name. The registrations
+`hwip install` writes turn it on (`HWIP_AUTONAME=1` in the MCP entry, the
+`hwip_session_title` tool in the pi extension), so **after updating
+`@hwip/cli`, run `hwip install` once more** to get it on a machine
+installed before; `hwip verify` says which MCP agents still lack it. Claude
+Code and opencode title sessions themselves and are left as they are. To
+hide the names agents choose, turn off *Name sessions automatically* in
+the app's settings — names you set yourself always show.
+
 **Why global, not `npx`?** `hwip cc` (drive a session from your phone)
 needs `hwip` on your `PATH`, and the agent hooks this installs are
 `$(command -v hwip || npx …)` — a global binary skips an npx cold-start
@@ -432,17 +443,28 @@ block here.
    hwip sh --detach     # create it, print its name, exit
    ```
 
-   **The mirror fits a detached session to the phone.** A pane is as wide
-   as the terminal that last drew it, so a desktop's prompt rules and
-   right-aligned clocks fold in two on a phone. While the phone watches a
-   session no terminal is attached to (a `hwip sh --detach` shell, or an
-   agent whose terminal you closed), the listener resizes its window to the
-   phone's width and gives the old width back when the phone leaves. An
-   attached session keeps its size: shrinking it would shrink your desktop
-   terminal, so the phone wraps those rows instead. A window split into
-   panes is never resized, and one a terminal attaches to while the phone
-   watches is handed back within a renew (5 s). A listener that died while
-   a window was fitted restores it the next time it starts.
+   **The mirror fits a session to the phone.** A pane is as wide as the
+   terminal that last drew it, so a desktop's prompt rules and
+   right-aligned clocks fold in two on a phone. Whoever used the session
+   last decides its width, the way tmux's `window-size latest` does: typing
+   from the phone makes the phone the latest user, and the listener resizes
+   the window to the phone's width, and coming back to the mirror later
+   (a locked screen, a resubscribe) takes it again unless the desktop was
+   used since. Opening the mirror without typing does the same once
+   the desktop terminal has been idle for a minute, so a phone reconnecting
+   on its own never shrinks a terminal you are typing in. Pressing a key in
+   (or attaching) a desktop terminal makes it the latest user, and within a
+   renew (5 s) the window is handed back to tmux, which sizes it to that
+   terminal. Moving the mouse over a desktop pane or clicking another
+   pane is not using it: on macOS the listener reads when a key was last
+   pressed (the HID system clock, no permission needed) and counts a
+   desktop terminal as used no later than that key or its attach. Elsewhere
+   any tmux client activity counts. While the phone holds a session, a desktop terminal still
+   attached to it shows it narrower. When the phone leaves, a session no
+   terminal is attached to gets its old width back and an attached one is
+   sized to its terminal. A window split into panes is never resized. A
+   listener that died while a window was fitted restores it the next time
+   it starts.
 
    `hwip cursor` runs **`cursor-agent`**, Cursor's terminal agent — a
    separate install from the Cursor IDE (the bare `cursor` on your PATH
@@ -623,8 +645,9 @@ went.
 - **The prompt** (`--prompt`) is typed once, and only when the agent is the foreground program of the pane and its detection rules read the screen as `idle` — not working, not a dialog. If that does not happen within 90 seconds the prompt is not typed, the session stays, and the phone is told. **Only agents that have an `idle` rule can take a prompt** (today Claude Code, Codex, Gemini CLI and pi): for any other agent nothing separates "ready" from a trust or permission dialog, and the Enter that submits a prompt would answer the dialog's default with nobody there to read it. `hwip schedule add … --prompt` refuses those agents and says which ones work; a schedule without `--prompt` starts any agent. The rules that decide this are the ones shipped in the `hwip` package, not the detection rules the listener updates over the air: a phone's input is typed by someone who has seen the screen, a schedule by nobody, and a rule set that arrives over the air is not signed — it must not be able to call a dialog `idle` and have your prompt and Enter typed into it.
 - **The cap**: a session that runs longer than `--max-runtime` is asked to end the way the phone's *end session* does — the agent's own quit command, then signals. It is never killed; one that stays keeps the schedule from starting its next run (`overlap`).
 - **The phone is told** with one push per listener tick, listing each schedule with how many times and why (`<label> · 놓침 31회` — the push is in Korean). A run skipped because the last one is still going counts once until the result changes; a push that does not go out is tried again after 30 seconds, then 1, 2, 4 … minutes up to 30 (only a refusal by the server, such as the daily limit, is not tried again; a timeout, a proxy or a captive portal in the way is), and is dropped after 24 hours. The push has one title per kind of news — skipped or missed, over its runtime, or a prompt not typed — and a general one when a push holds several kinds. The prompt is never in it. A free account sends at most 100 pushes a day (`pushPerDay`), which is why these are batched.
-- **State** is files under `~/.local/state/hwip`: one `schedules/<id>.json` per schedule (limit 20) and `schedule-state.json`, written only by the listener, with where each schedule has got to.
-- **From the phone**: the app lists the schedules of a computer, makes one for a session this computer has run, and removes one. It names the session, a time and what to do; the directory, the agent's command and its arguments are never the phone's (see *Defense*). A schedule made there needs an agent that can take a prompt, and shows in `hwip schedule` like any other.
+- **Editing**: `hwip schedule edit <id>` changes the time (`--at`, `--days`, `--every`), `--prompt` and `--max-runtime` of a schedule in place; the id, the session, the directory and the agent stay. What a flag does not name is kept — `--at` keeps the days, `--days` the time. A changed time counts from the edit: the times before it are neither started nor counted as missed, and an `--every` schedule runs one period after the edit; changing only the prompt or the run time keeps the schedule on its times. A session already running keeps going. A listener of an older build is restarted first, because it would skip the edited file as unreadable; when it cannot be replaced, a new time is not written (exit 1) and the schedule keeps running as it was.
+- **State** is files under `~/.local/state/hwip`: one `schedules/<id>.json` per schedule (limit 20) and `schedule-state.json`, written only by the listener, with where each schedule has got to. `agent-dirs.json` holds the directories `hwip <agent>` typed in a shell found its agent in: a listener run as a login service has only the PATH its service file baked, so a scheduled launch adds these to it — run an agent from a shell once (`hwip cc`) before scheduling it, or the run is skipped with `'claude' not found on PATH` in `~/.hwip/listener.log`.
+- **From the phone**: the app lists the schedules of a computer, makes one for a session this computer has run, edits one, and removes one. It names the session, a time and what to do; the directory, the agent's command and its arguments are never the phone's (see *Defense*). A schedule made there needs an agent that can take a prompt, and shows in `hwip schedule` like any other.
 
 ### Session history
 
@@ -810,7 +833,7 @@ The phone also reads this machine's schedules (see [Scheduled sessions](#schedul
 { subtype: 'agent.schedule.list.result',  requestId, at, schedules | encrypted | error }
 ```
 
-`schedules` is the list as a JSON string; `encrypted` is the list sealed for the asking device (purpose `schedule.list`, bound to this machine's device id) as `{ v: 1, requestId, at, schedules: [...], unreadable? }` — the app checks that the `requestId` inside is the one it asked, so an older sealed list is not taken for a newer answer. `unreadable` is how many schedule files could not be read; a directory that cannot be listed at all, or that holds more than 20 files, is the error `read_failed`, never an empty list (and a remove then fails as `schedule_failed`; `hwip schedule rm` still works on the computer). A list too long for one frame has its prompts shortened, step by step (`too_large` only when it does not fit even without them). Each entry holds `id`, `source`, `agentKind`, `project` (the directory's name, not its path), `session`, `when`, `prompt` (cut to 500 characters, shorter when the list would not fit), `maxRuntimeMin`, `nextAt` and the `last` result — never a directory path or the agent's arguments.
+`schedules` is the list as a JSON string; `encrypted` is the list sealed for the asking device (purpose `schedule.list`, bound to this machine's device id) as `{ v: 1, requestId, at, schedules: [...], unreadable? }` — the app checks that the `requestId` inside is the one it asked, so an older sealed list is not taken for a newer answer. `unreadable` is how many schedule files could not be read; a directory that cannot be listed at all, or that holds more than 20 files, is the error `read_failed`, never an empty list (and a remove then fails as `schedule_failed`; `hwip schedule rm` still works on the computer). A list too long for one frame has its prompts shortened, step by step (`too_large` only when it does not fit even without them). Each entry holds `id`, `source`, `agentKind`, `project` (the directory's name, not its path), `session`, `when`, `prompt` (cut to 500 characters, shorter when the list would not fit; `promptLocked: true` says the phone cannot change it — it is not the whole text, or the schedule has agent arguments — so the app leaves it to `hwip schedule edit`), `maxRuntimeMin`, `nextAt` and the `last` result — never a directory path or the agent's arguments.
 
 ### Your API key and redirects
 
@@ -950,7 +973,12 @@ handing the listener a key:
   session name, its `seq`/`epoch` and that nonce, so a relay that cannot
   swap in a key of its own (below) can't move one to another stream,
   replay one from an earlier subscription, or hand one back as input —
-  or as anything else this listener sealed for the phone. Your
+  or as anything else this listener sealed for the phone. A history page
+  (scrolling up past the live window) holds the same nonce and `epoch`,
+  the request id it answers and where it sits in the scrollback, so a
+  relay can't hand an earlier page back under a new request or move
+  where the next one is asked for; only the request id rides beside it
+  in the clear. Your
   keystrokes are sealed for this listener as `stream.input` with their
   `seq`/`epoch` stamps, the stream's start epoch and the phone's device
   id inside, so a forged restart can't replay them. The start answer (`agent.stream.start.ok`)
@@ -1166,7 +1194,7 @@ device, takes plain commands as before; an unreadable
 forgets the pins, and with them goes back to taking plain commands until a
 device is pinned again.
 
-**A schedule request** — the phone making or removing a scheduled session — rides
+**A schedule request** — the phone making, changing or removing a scheduled session — rides
 the same `agent.command` push, with a `schedule` field and no `body`. It carries
 a time, a prompt and, if the phone says so, an agent and a run time — and nothing
 else. The directory and the agent come from what this machine recorded for the
@@ -1175,8 +1203,11 @@ schedule at another directory; it cannot send agent arguments, a worktree or a
 label either, and a request that carries one is refused rather than ignored
 (`schedule_invalid`; `schedule_limit` at 20 schedules; `unknown_session` for a
 session this machine never recorded; `schedule_failed` when this machine's own
-files would not read or write). A remove names the schedule's own
-session, so it cannot reach another. Applying a request never types into a
+files would not read or write). A change (`op: 'update'`) carries the schedule's id
+and any of the time, the prompt and the run time; what it leaves out stays as it was,
+and a change with none of them is refused. A schedule made on the computer with agent arguments keeps its prompt: the phone may change its time and run time, not what is typed under those arguments. A change and a remove name the schedule's own
+session, so they cannot reach another. A listener of an older build refuses a change as
+`schedule_invalid`. Applying a request never types into a
 session. The request is sealed like any
 command — the whole of it inside the body, only `op` beside it, and the sender,
 label and counter checks above apply, so a replay or a swapped `op` changes

package/dist/agent-dirs.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Where the person's own shell finds their agents (F8). A schedule is started by the listener, and the listener run by
+ * launchd or systemd has only the PATH its service file baked: tmux's and node's directories and the system ones. An
+ * agent installed anywhere else — `~/.local/bin/claude` — is not on it, and the scheduled session's pane dies at once
+ * with "command not found". So every `hwip <agent>` typed in a shell writes down the directory its agent was found in,
+ * and a schedule launch adds those directories to its PATH.
+ *
+ * Builtins only: wrapper.ts writes this on the `hwip cc` hot path.
+ */
+export declare const agentDirsPath: () => string;
+/** Writes down the directory of `binary`, an absolute path the shell resolved. Best-effort: a launch never fails on it. */
+export declare const rememberAgentDir: (binary: string) => void;
+/** `path` with every written-down directory it lacks appended: what the listener has first, so nothing it runs changes. */
+export declare const withAgentDirs: (path: string | undefined) => string;
+//# sourceMappingURL=agent-dirs.d.ts.map

package/dist/agent-dirs.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Where the person's own shell finds their agents (F8). A schedule is started by the listener, and the listener run by
+ * launchd or systemd has only the PATH its service file baked: tmux's and node's directories and the system ones. An
+ * agent installed anywhere else — `~/.local/bin/claude` — is not on it, and the scheduled session's pane dies at once
+ * with "command not found". So every `hwip <agent>` typed in a shell writes down the directory its agent was found in,
+ * and a schedule launch adds those directories to its PATH.
+ *
+ * Builtins only: wrapper.ts writes this on the `hwip cc` hot path.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withAgentDirs = exports.rememberAgentDir = exports.agentDirsPath = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const gate_js_1 = require("./gate.js");
+const private_files_js_1 = require("./private-files.js");
+/** More than anyone has agents in; bounds what a schedule launch puts on PATH. */
+const MAX_DIRS = 16;
+const agentDirsPath = () => (0, node_path_1.join)((0, gate_js_1.stateDir)(), 'agent-dirs.json');
+exports.agentDirsPath = agentDirsPath;
+/**
+ * Whether the file is the user's own regular file that only they can write: a directory put on PATH by someone else runs
+ * their programs as the agent. 'missing' when there is none yet.
+ */
+const fileState = (path) => {
+    try {
+        const info = (0, node_fs_1.lstatSync)(path);
+        const mine = typeof process.getuid !== 'function' || info.uid === process.getuid();
+        return info.isFile() && mine && (info.mode & 0o022) === 0 ? 'ok' : 'refused';
+    }
+    catch {
+        return 'missing';
+    }
+};
+const readDirs = () => {
+    try {
+        const path = (0, exports.agentDirsPath)();
+        if (fileState(path) !== 'ok')
+            return [];
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf-8'));
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((dir) => typeof dir === 'string' && (0, node_path_1.isAbsolute)(dir)).slice(0, MAX_DIRS);
+    }
+    catch {
+        return [];
+    }
+};
+/** Writes down the directory of `binary`, an absolute path the shell resolved. Best-effort: a launch never fails on it. */
+const rememberAgentDir = (binary) => {
+    if (!(0, node_path_1.isAbsolute)(binary))
+        return;
+    const dir = (0, node_path_1.dirname)(binary);
+    const path = (0, exports.agentDirsPath)();
+    // Never written through a link, nor into a file that is not read back: either would be writing for nothing, or elsewhere.
+    if (fileState(path) === 'refused')
+        return;
+    const dirs = readDirs();
+    if (dirs.includes(dir))
+        return;
+    try {
+        (0, private_files_js_1.mkdirHandedBack)((0, gate_js_1.stateDir)(), 0o700);
+        (0, node_fs_1.writeFileSync)(path, JSON.stringify([...dirs, dir].slice(-MAX_DIRS)), { mode: 0o600 });
+        (0, private_files_js_1.handBackToSudoUser)(path);
+    }
+    catch {
+        // The schedule launch then says the agent is not on PATH, which is the truth.
+    }
+};
+exports.rememberAgentDir = rememberAgentDir;
+/** `path` with every written-down directory it lacks appended: what the listener has first, so nothing it runs changes. */
+const withAgentDirs = (path) => {
+    const have = (path ?? '').split(node_path_1.delimiter).filter(Boolean);
+    return [...have, ...readDirs().filter((dir) => !have.includes(dir))].join(node_path_1.delimiter);
+};
+exports.withAgentDirs = withAgentDirs;

package/dist/agents.d.ts

@@ -10,6 +10,16 @@
  * pi 0.85.1): global is `~/.pi/agent/skills/` and `~/.agents/skills/`, while
  * `.pi/skills/` is the PROJECT dir — scanning `~/.pi/skills` found only three
  * dangling symlinks and reported pi as having no skills at all.
+ *
+ * codex reads `$CODEX_HOME/skills` and `~/.agents/skills` (codex-rs
+ * `ext/skills/src/host_roots.rs`), and keeps its bundled skills in the hidden
+ * `.codex/skills/.system`, which the scanner's dot-skip would otherwise pass
+ * over. opencode reads the claude and agents dirs as well as its own
+ * (opencode `docs/skills.mdx § Discovery`, 2.0.29). Measured against the agents'
+ * own reports on 2026-10-20: codex 59 of `codex app-server` `skills/list` 59;
+ * opencode 87 of `opencode serve` `/api/skill` 91 — the rest are two built-ins
+ * and two skills it reads out of `~/.claude/skills/.trash/`, which the scanner's
+ * dot-skip leaves out on purpose.
  */
 export declare const AGENT_SKILL_DIRS: Record<string, string[]>;
 export interface Agent {

package/dist/agents.js

@@ -20,10 +20,21 @@ const path_1 = require("path");
  * pi 0.85.1): global is `~/.pi/agent/skills/` and `~/.agents/skills/`, while
  * `.pi/skills/` is the PROJECT dir — scanning `~/.pi/skills` found only three
  * dangling symlinks and reported pi as having no skills at all.
+ *
+ * codex reads `$CODEX_HOME/skills` and `~/.agents/skills` (codex-rs
+ * `ext/skills/src/host_roots.rs`), and keeps its bundled skills in the hidden
+ * `.codex/skills/.system`, which the scanner's dot-skip would otherwise pass
+ * over. opencode reads the claude and agents dirs as well as its own
+ * (opencode `docs/skills.mdx § Discovery`, 2.0.29). Measured against the agents'
+ * own reports on 2026-10-20: codex 59 of `codex app-server` `skills/list` 59;
+ * opencode 87 of `opencode serve` `/api/skill` 91 — the rest are two built-ins
+ * and two skills it reads out of `~/.claude/skills/.trash/`, which the scanner's
+ * dot-skip leaves out on purpose.
  */
 exports.AGENT_SKILL_DIRS = {
     claude: ['.claude/skills'],
-    codex: ['.codex/skills'],
+    codex: ['.codex/skills', '.codex/skills/.system', '.agents/skills'],
+    opencode: ['.claude/skills', '.agents/skills', '.config/opencode/skills'],
     pi: ['.pi/agent/skills', '.agents/skills'],
 };
 const HOME = (0, os_1.homedir)();

package/dist/codex-config.d.ts

@@ -1,8 +1,8 @@
-/** The table hwip writes into a config that has none. No `env` block, unlike
- *  the Cursor/Windsurf JSON entry: codex is a terminal app, so the server
- *  inherits the shell's `HWIP_API_KEY`, and an unexpanded `"${HWIP_API_KEY}"`
- *  literal would shadow the ~/.hwip/config.json fallback with junk (the same
- *  reasoning as opencode's). */
+/** The table hwip writes into a config that has none. Its `env` holds only the
+ *  auto-name flag, unlike the Cursor/Windsurf JSON entry: codex is a terminal
+ *  app, so the server inherits the shell's `HWIP_API_KEY`, and an unexpanded
+ *  `"${HWIP_API_KEY}"` literal would shadow the ~/.hwip/config.json fallback
+ *  with junk (the same reasoning as opencode's). */
 export declare const CODEX_MCP_TABLE: string;
 /**
  * The config with hwip's entry present and current, leaving every other byte
@@ -10,6 +10,9 @@ export declare const CODEX_MCP_TABLE: string;
  * it, so nothing above can capture the keys.
  */
 export declare const upsertHwipMcpTable: (config: string) => string;
+/** Whether hwip's entry turns auto names on — what verify checks to tell an
+ *  install from before the flag existed. */
+export declare const hasHwipAutoName: (config: string) => boolean;
 /** The config with hwip's entry and its sub-tables gone, or null when it was
  *  never there (so the caller can report "nothing to remove" rather than
  *  rewriting an untouched file). */

package/dist/codex-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readHwipMcpArgv = exports.removeHwipMcpTable = exports.upsertHwipMcpTable = exports.CODEX_MCP_TABLE = void 0;
+exports.readHwipMcpArgv = exports.removeHwipMcpTable = exports.hasHwipAutoName = exports.upsertHwipMcpTable = exports.CODEX_MCP_TABLE = void 0;
 /**
  * The hwip entry inside `~/.codex/config.toml`, which Codex CLI owns.
  *
@@ -18,8 +18,10 @@ exports.readHwipMcpArgv = exports.removeHwipMcpTable = exports.upsertHwipMcpTabl
  *    `[mcp_servers.hwip.tools.hwip_ask]` when the user picks "always allow".
  *    Removal takes them along (a child of a deleted server is dead config);
  *    re-install keeps them, since they are the user's answer, not ours.
- *  - **Only `command` and `args` are ours.** Any other key in the table —
- *    `cwd`, `startup_timeout_sec`, a comment — survives a re-install.
+ *  - **Only `command`, `args` and the `HWIP_AUTONAME` env pair are ours.** Any
+ *    other key in the table — `cwd`, `startup_timeout_sec`, a comment, the
+ *    user's own env pairs — survives a re-install; the flag joins whichever
+ *    env the user already keeps.
  *  - **Comments before the next table belong to that table**, not to ours, so
  *    the region we replace or delete stops short of them.
  *
@@ -31,6 +33,8 @@ const [MCP_BIN, ...MCP_SUBCOMMAND] = mcp_command_js_1.MCP_LAUNCH_ARGV;
 const HWIP_TABLE_HEADER = /^\[mcp_servers\.(?:hwip|"hwip")\]$/;
 /** A sub-table of ours: `[mcp_servers.hwip.tools.hwip_ask]` and friends. */
 const HWIP_SUBTABLE_HEADER = /^\[mcp_servers\.(?:hwip|"hwip")\..+\]$/;
+/** The user's own env table for hwip — where the flag goes when they keep one. */
+const HWIP_ENV_SUBTABLE_HEADER = /^\[mcp_servers\.(?:hwip|"hwip")\.(?:env|"env")\]$/;
 /**
  * The dotted/inline form — `mcp_servers.hwip = { command = "npx", … }` — which
  * is valid TOML and which older hand-written configs use. It has to be found,
@@ -44,12 +48,87 @@ const isHwipDefinition = (line) => HWIP_TABLE_HEADER.test(line.trim()) || HWIP_I
 const OWNED_KEY = /^(?:command|args)\s*=/;
 const commandLine = `command = "${MCP_BIN}"`;
 const argsLine = `args = [${MCP_SUBCOMMAND.map((a) => `"${a}"`).join(', ')}]`;
-/** The table hwip writes into a config that has none. No `env` block, unlike
- *  the Cursor/Windsurf JSON entry: codex is a terminal app, so the server
- *  inherits the shell's `HWIP_API_KEY`, and an unexpanded `"${HWIP_API_KEY}"`
- *  literal would shadow the ~/.hwip/config.json fallback with junk (the same
- *  reasoning as opencode's). */
-exports.CODEX_MCP_TABLE = ['[mcp_servers.hwip]', commandLine, argsLine].join('\n');
+const flagPair = `${mcp_command_js_1.AUTONAME_ENV} = "1"`;
+const envLine = `env = { ${flagPair} }`;
+/** `env = { … }` in hwip's table — known by its key, so a comment after it cannot hide it. */
+const INLINE_ENV = /^env\s*=\s*\{/;
+/** `env.KEY = …`, the dotted spelling of the same table. */
+const DOTTED_ENV = /^env\./;
+/** The flag's key, bare or quoted: TOML reads all three as one key. */
+const FLAG = `(?:${mcp_command_js_1.AUTONAME_ENV}|"${mcp_command_js_1.AUTONAME_ENV}"|'${mcp_command_js_1.AUTONAME_ENV}')`;
+const FLAG_KEY = new RegExp(`^${FLAG}\\s*=`);
+const DOTTED_FLAG_KEY = new RegExp(`^env\\.${FLAG}\\s*=`);
+const FLAG_ON = new RegExp(`(?:^|[\\s{,.])${FLAG}\\s*=\\s*["']1["']`);
+/** The table hwip writes into a config that has none. Its `env` holds only the
+ *  auto-name flag, unlike the Cursor/Windsurf JSON entry: codex is a terminal
+ *  app, so the server inherits the shell's `HWIP_API_KEY`, and an unexpanded
+ *  `"${HWIP_API_KEY}"` literal would shadow the ~/.hwip/config.json fallback
+ *  with junk (the same reasoning as opencode's). */
+exports.CODEX_MCP_TABLE = ['[mcp_servers.hwip]', commandLine, argsLine, envLine].join('\n');
+/**
+ * Walks a line of TOML outside its strings: `at(i, depth)` sees every character that is not
+ * inside one, with the brace depth before it, and stops the walk by returning true.
+ */
+const walkOutsideStrings = (text, from, at) => {
+    let depth = 0;
+    let quote = null;
+    for (let i = from; i < text.length; i += 1) {
+        const ch = text[i];
+        if (quote) {
+            if (ch === '\\' && quote === '"')
+                i += 1;
+            else if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (at(i, depth))
+            return;
+        if (ch === '{' || ch === '[')
+            depth += 1;
+        else if (ch === '}' || ch === ']')
+            depth -= 1;
+    }
+};
+/** The inline table's inside and what follows its closing brace (a comment), or null when it does
+ *  not close on this line. */
+const inlineParts = (line) => {
+    const open = line.indexOf('{');
+    let parts = null;
+    walkOutsideStrings(line, open, (i, depth) => {
+        if (line[i] !== '}' || depth !== 1)
+            return false;
+        parts = { inner: line.slice(open + 1, i), tail: line.slice(i + 1) };
+        return true;
+    });
+    return parts;
+};
+/** The pairs of an inline table, split at its own commas — never one inside a string or a nested value. */
+const inlinePairs = (inner) => {
+    const pairs = [];
+    let start = 0;
+    walkOutsideStrings(inner, 0, (i, depth) => {
+        if (inner[i] === ',' && depth === 0) {
+            pairs.push(inner.slice(start, i));
+            start = i + 1;
+        }
+        return false;
+    });
+    pairs.push(inner.slice(start));
+    return pairs.map((pair) => pair.trim()).filter(Boolean);
+};
+/** An inline env table with the flag on and first, the user's pairs and comment kept. One that
+ *  cannot be read is left alone: writing a second `env` beside it would break the whole file. */
+const withFlag = (line) => {
+    const parts = inlineParts(line);
+    if (!parts)
+        return line;
+    const rest = inlinePairs(parts.inner).filter((pair) => !FLAG_KEY.test(pair));
+    return `env = { ${[flagPair, ...rest].join(', ')} }${parts.tail}`;
+};
 /** CRLF in, CRLF out — a Windows config must not come back with mixed endings. */
 const eolOf = (config) => (config.includes('\r\n') ? '\r\n' : '\n');
 const splitLines = (config) => config.split(/\r?\n/);
@@ -109,18 +188,48 @@ const upsertHwipMcpTable = (config) => {
         const table = exports.CODEX_MCP_TABLE.split('\n');
         return rejoin([...lines.slice(0, start), ...table, ...lines.slice(start + 1)], eol);
     }
+    // A key defined twice makes codex refuse the whole file, so the flag goes
+    // into whichever env the user already keeps, and gets one only if none.
+    const envTable = lines.slice(bodyEnd(lines, start), entryEnd(lines, start))
+        .findIndex((line) => HWIP_ENV_SUBTABLE_HEADER.test(line.trim()));
+    const after = [...lines];
+    if (envTable !== -1) {
+        const header = bodyEnd(lines, start) + envTable;
+        const tableEnd = bodyEnd(lines, header);
+        const rows = lines.slice(header + 1, tableEnd).filter((line) => !FLAG_KEY.test(line.trim()));
+        after.splice(header, tableEnd - header, lines[header], flagPair, ...rows);
+    }
     const end = withoutTrailingPreamble(lines, start, bodyEnd(lines, start));
-    const kept = lines.slice(start + 1, end).filter((line) => !OWNED_KEY.test(line.trim()));
+    const kept = lines.slice(start + 1, end)
+        .filter((line) => !OWNED_KEY.test(line.trim()) && !DOTTED_FLAG_KEY.test(line.trim()));
+    const inline = kept.findIndex((line) => INLINE_ENV.test(line.trim()));
+    if (inline !== -1)
+        kept[inline] = withFlag(kept[inline].trim());
+    const ours = envTable !== -1 || inline !== -1 ? []
+        : kept.some((line) => DOTTED_ENV.test(line.trim())) ? [`env.${flagPair}`]
+            : [envLine];
     return rejoin([
-        ...lines.slice(0, start),
+        ...after.slice(0, start),
         '[mcp_servers.hwip]',
         commandLine,
         argsLine,
+        ...ours,
         ...kept,
-        ...lines.slice(end),
+        ...after.slice(end),
     ], eol);
 };
 exports.upsertHwipMcpTable = upsertHwipMcpTable;
+/** Whether hwip's entry turns auto names on — what verify checks to tell an
+ *  install from before the flag existed. */
+const hasHwipAutoName = (config) => {
+    const lines = splitLines(config);
+    const start = definitionIndex(lines);
+    if (start === -1)
+        return false;
+    const end = HWIP_INLINE_ENTRY.test(lines[start].trim()) ? start + 1 : entryEnd(lines, start);
+    return lines.slice(start, end).some((line) => !line.trim().startsWith('#') && FLAG_ON.test(line.trim()));
+};
+exports.hasHwipAutoName = hasHwipAutoName;
 /** The config with hwip's entry and its sub-tables gone, or null when it was
  *  never there (so the caller can report "nothing to remove" rather than
  *  rewriting an untouched file). */

package/dist/command-scan.d.ts

@@ -4,8 +4,9 @@
  * Payload discipline (plan PLAN-13-16-18): paths never leave this machine, so
  * the output carries skill names and nothing else.
  *
- * An entry is the slash command itself, so it carries whatever prefix the agent
- * registers the skill under (`AGENT_SKILL_PREFIX`, plugin names for Claude Code).
+ * An entry is the invocation token itself, so it carries whatever prefix the
+ * agent registers the skill under (`AGENT_SKILL_PREFIX`, plugin names for Claude
+ * Code) — including the `$`/`@` mention sigil of agents that take no slash.
  *
  * Names come from the directory, not from the file — an ASSUMPTION, not a rule
  * the agents enforce: pi resolves a skill's name as `frontmatter.name` and only
@@ -23,7 +24,10 @@
  * existence until a divergent skill is actually measured.
  */
 export interface AgentCommandEntry {
-    /** What the user types after `/` — see `AGENT_SKILL_PREFIX`. */
+    /**
+     * What the user types to run the skill: after a `/`, unless it starts with a
+     * mention sigil (`$`, `@`), which is typed as is — see `AGENT_SKILL_PREFIX`.
+     */
     name: string;
 }
 /** agentKind -> skill entries; agents with no skills are omitted. */

package/dist/command-scan.js

@@ -13,12 +13,24 @@ const agents_js_1 = require("./agents.js");
  * pi session was observed to abort rather than run the skill (2026-09-13).
  * Claude Code's user skills are `/<name>`; its PLUGIN skills are
  * `/<plugin>:<name>`, so those get their prefix from the install entry instead.
+ *
+ * codex and opencode do not run skills as slash commands at all. codex takes a
+ * `$name` mention (codex-rs `skills/src/selection.rs`; its `/skills` only opens a
+ * picker), and opencode 2.0 an `@name` mention (`docs/skills.mdx § Loading`; its
+ * `/api/command` lists no skills). Their entries carry that sigil, and a client
+ * inserts a name starting with `$` or `@` as typed, without the `/`.
  */
 const AGENT_SKILL_PREFIX = {
+    codex: '$',
+    opencode: '@',
     pi: 'skill:',
 };
-/** Agents that register skills filed under grouping folders — see `scanSkillDir`. */
-const AGENT_SKILL_RECURSIVE = new Set(['pi']);
+/**
+ * Agents that register skills filed under grouping folders — see `scanSkillDir`.
+ * opencode walks them too: it lists `~/.claude/skills/synced/<id>/<name>`, which
+ * Claude Code itself does not register (`/api/skill`, 2026-10-20).
+ */
+const AGENT_SKILL_RECURSIVE = new Set(['opencode', 'pi']);
 /** Serialized-catalog budget. Names-only measures ~2KB here; ws frames die at 128KB. */
 exports.PAYLOAD_LIMIT_BYTES = 64 * 1024;
 /**
@@ -88,28 +100,60 @@ const scanSkillDir = (dir, recursive = false, depth = 1) => {
     }
     return names;
 };
-/**
- * Plugin skills live at `<installPath>/skills/<name>/SKILL.md`. Only install paths
- * listed in `installed_plugins.json` are scanned — the plugin cache also holds
- * uninstalled marketplace entries (514 of 710 on this machine) that must not
- * appear.
- */
-const scanClaudePlugins = (home) => {
+/** A plain JSON object, as opposed to an array, a scalar or null. */
+const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/** The object under `key` in a JSON file, or an empty one when the file is missing, not JSON, or holds another shape there. */
+const readJsonObject = (file, key) => {
     let parsed;
     try {
-        parsed = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(home, '.claude', 'plugins', 'installed_plugins.json'), 'utf-8'));
+        parsed = JSON.parse((0, fs_1.readFileSync)(file, 'utf-8'));
     }
     catch {
-        return [];
+        return {};
     }
+    const value = isObject(parsed) ? parsed[key] : undefined;
+    return isObject(value) ? value : {};
+};
+/**
+ * Plugin keys Claude Code loads: `enabledPlugins[key] === true` in the user's
+ * `~/.claude/settings.json`. Installed is not enabled — a key set to `false`, or
+ * absent, registers nothing (`claude -p` init `slash_commands`, 2026-10-20: 71
+ * skills of two disabled plugins and one unlisted plugin were missing). A
+ * project's own settings can enable more, but the catalog is device-level.
+ */
+const enabledClaudePlugins = (home) => {
+    const enabled = readJsonObject((0, path_1.join)(home, '.claude', 'settings.json'), 'enabledPlugins');
+    return new Set(Object.entries(enabled).filter(([, on]) => on === true).map(([key]) => key));
+};
+/** Command files of a plugin: `<installPath>/commands/<name>.md`. */
+const scanCommandFiles = (dir) => entriesOf(dir)
+    .filter((entry) => entry.endsWith('.md') && !entry.startsWith('.'))
+    .map((entry) => entry.slice(0, -'.md'.length));
+/**
+ * Plugin commands are `<installPath>/skills/<name>/SKILL.md` and
+ * `<installPath>/commands/<name>.md`, both registered as `/<plugin>:<name>`. Only
+ * install paths listed in `installed_plugins.json` are scanned — the plugin cache
+ * also holds uninstalled marketplace entries (514 of 710 on this machine) that
+ * must not appear — and of those only the enabled ones.
+ */
+const scanClaudePlugins = (home) => {
+    const installed = readJsonObject((0, path_1.join)(home, '.claude', 'plugins', 'installed_plugins.json'), 'plugins');
+    const enabled = enabledClaudePlugins(home);
     const names = [];
-    for (const [key, installs] of Object.entries(parsed.plugins ?? {})) {
+    for (const [key, installs] of Object.entries(installed)) {
+        if (!enabled.has(key) || !Array.isArray(installs))
+            continue;
         // Key is `<plugin>@<marketplace>`; the command prefix is the plugin half.
         const plugin = key.split('@')[0];
-        for (const install of installs ?? []) {
-            if (!install.installPath)
+        for (const install of installs) {
+            const installPath = isObject(install) ? install.installPath : undefined;
+            if (typeof installPath !== 'string' || !installPath)
                 continue;
-            names.push(...scanSkillDir((0, path_1.join)(install.installPath, 'skills')).map((name) => `${plugin}:${name}`));
+            const commands = [
+                ...scanSkillDir((0, path_1.join)(installPath, 'skills')),
+                ...scanCommandFiles((0, path_1.join)(installPath, 'commands')),
+            ];
+            names.push(...commands.map((name) => `${plugin}:${name}`));
         }
     }
     return names;

package/dist/installer.js

@@ -334,7 +334,13 @@ const installGemini = () => {
             ok('MCP server added (legacy gemini CLI)');
         }
         catch {
-            fail(`MCP add failed. Manual: ${mcp_command_js_1.GEMINI_MCP_ADD}`);
+            try {
+                (0, child_process_1.execSync)(mcp_command_js_1.GEMINI_MCP_ADD_BARE, { stdio: 'pipe' });
+                ok('MCP server added (legacy gemini CLI, without auto session names)');
+            }
+            catch {
+                fail(`MCP add failed. Manual: ${mcp_command_js_1.GEMINI_MCP_ADD}`);
+            }
         }
     }
     try {