@hybridlabor-api/aos 4.5.0 → 4.5.1

package/installer.js

@@ -3175,11 +3175,44 @@ function injectHarnessRules() {
 // most (a fresh install got it; every machine that already had AOS did not).
 function installGlobalHooks() {
     const hooksSrc = path.join(srcDir, '.claude', 'hooks');
+    const workflowsSrc = path.join(srcDir, '.claude', 'workflows');
+
+    // 1. Claude Code
     if (fs.existsSync(hooksSrc)) {
         copyDirRecursiveSync(hooksSrc, path.join(homeDir, '.claude', 'hooks'));
         log.step(`Installed hooks to ${path.join(homeDir, '.claude', 'hooks')}`);
     }
+    if (fs.existsSync(workflowsSrc)) {
+        copyDirRecursiveSync(workflowsSrc, path.join(homeDir, '.claude', 'workflows'));
+    }
     mergeBdbSettingsHooks(path.join(homeDir, '.claude', 'settings.json'));
+
+    // 2. Google Antigravity
+    const agyHooksDir = path.join(geminiDir, 'config', 'hooks');
+    const agyWorkflowsDir = path.join(geminiDir, 'config', 'workflows');
+    if (fs.existsSync(hooksSrc)) {
+        copyDirRecursiveSync(hooksSrc, agyHooksDir);
+        log.step(`Installed hooks to ${agyHooksDir}`);
+    }
+    if (fs.existsSync(workflowsSrc)) {
+        copyDirRecursiveSync(workflowsSrc, agyWorkflowsDir);
+    }
+    mergeAntigravityHooks(path.join(geminiDir, 'config', 'hooks.json'));
+    if (fs.existsSync(path.join(geminiDir, 'antigravity-cli'))) {
+        mergeAntigravityHooks(path.join(geminiDir, 'antigravity-cli', 'hooks.json'));
+    }
+
+    // 3. OpenAI Codex CLI
+    const codexHooksDir = path.join(homeDir, '.codex', 'hooks');
+    const codexWorkflowsDir = path.join(homeDir, '.codex', 'workflows');
+    if (fs.existsSync(hooksSrc)) {
+        copyDirRecursiveSync(hooksSrc, codexHooksDir);
+        log.step(`Installed hooks to ${codexHooksDir}`);
+    }
+    if (fs.existsSync(workflowsSrc)) {
+        copyDirRecursiveSync(workflowsSrc, codexWorkflowsDir);
+    }
+    mergeCodexTomlHooks(path.join(homeDir, '.codex', 'config.toml'));
 }
 
 // Merge the BDB hooks -- the two gates plus the memB ambient-memory hook --
@@ -3258,12 +3291,161 @@ function mergeBdbSettingsHooks(settingsPath, { projectLocal = false } = {}) {
     }
 
     try {
+        fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
         fs.writeFileSync(settingsPath, JSON.stringify(buildMerged(existing), null, 2) + '\n');
     } catch (e) {
         log.warn(`Could not write ${settingsPath}: ${e.message}`);
     }
 }
 
+// Merge the BDB hooks into Google Antigravity's hooks.json (.agents/hooks.json or
+// ~/.gemini/config/hooks.json), preserving user-defined foreign hooks.
+function mergeAntigravityHooks(hooksPath, { projectLocal = false } = {}) {
+    const bdbHookScripts = ['go-gate.mjs', 'graph-gate.mjs', 'memb-inject.mjs', 'startcycle-dispatch.mjs'];
+    const isBdbEntry = (entry) => {
+        const cmds = (entry && Array.isArray(entry.hooks) ? entry.hooks : [entry])
+            .map((h) => (h && typeof h.command === 'string' ? h.command : (typeof h === 'string' ? h : '')))
+            .join(' ');
+        return bdbHookScripts.some((name) => cmds.includes(name));
+    };
+
+    const baseDir = path.dirname(hooksPath);
+    const hooksDir = projectLocal ? path.join(currentDir, '.agents', 'hooks') : path.join(baseDir, 'hooks');
+    const workflowsDir = projectLocal ? path.join(currentDir, '.agents', 'workflows') : path.join(baseDir, 'workflows');
+    const globalHooksDir = projectLocal ? path.join(homeDir, '.gemini', 'config', 'hooks') : hooksDir;
+
+    const bdbHooks = {
+        PreToolUse: [
+            {
+                matcher: "run_command|Bash",
+                hooks: [{ type: "command", command: `node "${path.join(hooksDir, 'go-gate.mjs')}"`, timeout: 10000 }]
+            }
+        ],
+        Stop: [
+            {
+                hooks: [{ type: "command", command: `node "${path.join(hooksDir, 'graph-gate.mjs')}"`, timeout: 10000 }]
+            }
+        ],
+        PreInvocation: [
+            {
+                hooks: [
+                    { type: "command", command: `node "${path.join(globalHooksDir, 'memb-inject.mjs')}"`, timeout: 8000 },
+                    { type: "command", command: `node "${path.join(workflowsDir, 'startcycle-dispatch.mjs')}"`, timeout: 30000 }
+                ]
+            }
+        ]
+    };
+
+    const buildMerged = (existing) => {
+        const merged = existing && typeof existing === 'object' ? existing : {};
+        merged.hooks = merged.hooks && typeof merged.hooks === 'object' ? merged.hooks : {};
+        for (const [event, entries] of Object.entries(bdbHooks)) {
+            const foreignEntries = (Array.isArray(merged.hooks[event]) ? merged.hooks[event] : [])
+                .filter((e) => !isBdbEntry(e));
+            merged.hooks[event] = [...foreignEntries, ...entries];
+        }
+        return merged;
+    };
+
+    let existing = null;
+    if (fs.existsSync(hooksPath)) {
+        existing = readJsonFile(hooksPath);
+        if (!existing) {
+            const backupCopy = `${hooksPath}.corrupt_${timestamp}.bak`;
+            const sideCarPath = `${hooksPath}.bdb-new.json`;
+            let backupWritten = true;
+            try {
+                fs.copyFileSync(hooksPath, backupCopy);
+            } catch (copyError) {
+                backupWritten = false;
+                log.warn(`Could not create the hooks backup: ${copyError.message}`);
+            }
+            try {
+                fs.writeFileSync(sideCarPath, JSON.stringify(buildMerged(null), null, 2) + '\n');
+            } catch (writeError) {
+                log.warn(`Could not write ${path.basename(sideCarPath)}: ${writeError.message}`);
+            }
+            log.warn(`${path.basename(hooksPath)} is not valid JSON - hook merge skipped, nothing overwritten.`);
+            if (backupWritten) log.warn(`Backup copy: ${backupCopy}`);
+            log.warn(`BDB-wired hooks: ${sideCarPath}`);
+            return;
+        }
+    }
+
+    try {
+        fs.mkdirSync(path.dirname(hooksPath), { recursive: true });
+        fs.writeFileSync(hooksPath, JSON.stringify(buildMerged(existing), null, 2) + '\n');
+    } catch (e) {
+        log.warn(`Could not write ${hooksPath}: ${e.message}`);
+    }
+}
+
+// Merge the BDB hooks into ChatGPT Codex CLI's config.toml (~/.codex/config.toml or
+// .codex/config.toml), ensuring [features] hooks = true and preserving existing
+// non-BDB settings, comments, and MCP servers.
+function mergeCodexTomlHooks(configTomlPath, { projectLocal = false } = {}) {
+    const baseDir = path.dirname(configTomlPath);
+    const hooksDir = projectLocal ? path.join(currentDir, '.codex', 'hooks') : path.join(baseDir, 'hooks');
+    const workflowsDir = projectLocal ? path.join(currentDir, '.codex', 'workflows') : path.join(baseDir, 'workflows');
+    const globalHooksDir = projectLocal ? path.join(homeDir, '.codex', 'hooks') : hooksDir;
+
+    const tomlSnippet = [
+        '# AOS:HOOKS:START',
+        '[[hooks.PreToolUse]]',
+        'matcher = "^(Bash|run_command)$"',
+        '[[hooks.PreToolUse.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(hooksDir, 'go-gate.mjs')}"`)}`,
+        'timeout = 30',
+        '',
+        '[[hooks.Stop]]',
+        '[[hooks.Stop.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(hooksDir, 'graph-gate.mjs')}"`)}`,
+        'timeout = 30',
+        '',
+        '[[hooks.UserPromptSubmit]]',
+        '[[hooks.UserPromptSubmit.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(globalHooksDir, 'memb-inject.mjs')}"`)}`,
+        'timeout = 30',
+        '',
+        '[[hooks.UserPromptSubmit]]',
+        '[[hooks.UserPromptSubmit.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(workflowsDir, 'startcycle-dispatch.mjs')}"`)}`,
+        'timeout = 30',
+        '# AOS:HOOKS:END'
+    ].join('\n');
+
+    let content = fs.existsSync(configTomlPath) ? fs.readFileSync(configTomlPath, 'utf8') : '';
+
+    // Ensure [features] hooks = true
+    const hasHooksFeature = /(?:hooks|codex_hooks)\s*=\s*true/m.test(content);
+    if (!hasHooksFeature) {
+        if (/^\[features\]/m.test(content)) {
+            content = content.replace(/^\[features\]/m, '[features]\nhooks = true');
+        } else {
+            content = `[features]\nhooks = true\n\n${content.trimStart()}`;
+        }
+    }
+
+    // Replace existing AOS:HOOKS block or append
+    const hookBlockRegex = /# AOS:HOOKS:START[\s\S]*?# AOS:HOOKS:END/;
+    if (hookBlockRegex.test(content)) {
+        content = content.replace(hookBlockRegex, tomlSnippet);
+    } else {
+        content = `${content.trimEnd()}\n\n${tomlSnippet}\n`;
+    }
+
+    try {
+        fs.mkdirSync(path.dirname(configTomlPath), { recursive: true });
+        fs.writeFileSync(configTomlPath, content, { mode: 0o600 });
+    } catch (e) {
+        log.warn(`Could not write ${configTomlPath}: ${e.message}`);
+    }
+}
+
 // Tier 9 (Local Project Harness): drop the dispatcher contract into the
 // CURRENT PROJECT only -- no writes to $HOME, no global skill/MCP sync, and
 // this runs as an early return BEFORE any global install step. A bare
@@ -3276,22 +3458,29 @@ function mergeBdbSettingsHooks(settingsPath, { projectLocal = false } = {}) {
 // non-interactively via `--project-harness` (combine with -y for CI).
 function installProjectHarness() {
     const projectClaudeDir = path.join(currentDir, '.claude');
-    installStep(`create ${projectClaudeDir}`, () => {
+    const projectAgentsDir = path.join(currentDir, '.agents');
+    const projectCodexDir = path.join(currentDir, '.codex');
+
+    installStep(`create harness directories`, () => {
         fs.mkdirSync(projectClaudeDir, { recursive: true });
+        fs.mkdirSync(projectAgentsDir, { recursive: true });
+        fs.mkdirSync(projectCodexDir, { recursive: true });
     }, 'The harness copies below will most likely fail as well.');
 
     installStep('copy .agents/ contract into project', () => {
         const agentsSrc = path.join(srcDir, '.agents');
         if (!fs.existsSync(agentsSrc)) throw new Error(`missing payload: ${agentsSrc}`);
-        copyDirRecursiveSync(agentsSrc, path.join(currentDir, '.agents'));
-        log.step(`Copied .agents/ contract to ${path.join(currentDir, '.agents')}`);
+        copyDirRecursiveSync(agentsSrc, projectAgentsDir);
+        log.step(`Copied .agents/ contract to ${projectAgentsDir}`);
     }, 'graph.md / state.schema.json may be missing in the project.');
 
     installStep('copy dispatcher workflows into project', () => {
         const workflowsSrc = path.join(srcDir, '.claude', 'workflows');
         if (fs.existsSync(workflowsSrc)) {
             copyDirRecursiveSync(workflowsSrc, path.join(projectClaudeDir, 'workflows'));
-            log.step(`Copied dispatcher workflows to ${path.join(projectClaudeDir, 'workflows')}`);
+            copyDirRecursiveSync(workflowsSrc, path.join(projectAgentsDir, 'workflows'));
+            copyDirRecursiveSync(workflowsSrc, path.join(projectCodexDir, 'workflows'));
+            log.step(`Copied dispatcher workflows to project harnesses`);
         }
     }, '/startcycle dispatch degrades to graph.md as a manual guide.');
 
@@ -3299,7 +3488,9 @@ function installProjectHarness() {
         const hooksSrc = path.join(srcDir, '.claude', 'hooks');
         if (fs.existsSync(hooksSrc)) {
             copyDirRecursiveSync(hooksSrc, path.join(projectClaudeDir, 'hooks'));
-            log.step(`Copied hooks to ${path.join(projectClaudeDir, 'hooks')}`);
+            copyDirRecursiveSync(hooksSrc, path.join(projectAgentsDir, 'hooks'));
+            copyDirRecursiveSync(hooksSrc, path.join(projectCodexDir, 'hooks'));
+            log.step(`Copied hooks to project harnesses`);
         }
     }, 'go-gate / graph-gate enforcement stays inactive in this project.');
 
@@ -3311,9 +3502,11 @@ function installProjectHarness() {
         }
     }, 'The dispatcher runs, but its agent-file pointers resolve to nothing.');
 
-    installStep('wire project .claude/settings.json to local hooks', () => {
+    installStep('wire project harnesses to local hooks', () => {
         mergeBdbSettingsHooks(path.join(projectClaudeDir, 'settings.json'), { projectLocal: true });
-        log.step(`Wired project hooks in ${path.join(projectClaudeDir, 'settings.json')}`);
+        mergeAntigravityHooks(path.join(projectAgentsDir, 'hooks.json'), { projectLocal: true });
+        mergeCodexTomlHooks(path.join(projectCodexDir, 'config.toml'), { projectLocal: true });
+        log.step(`Wired project hooks in Claude, Antigravity, and Codex configurations`);
     }, 'The gate hooks exist but are not auto-wired for this project.');
 
     log.success(`Project harness installed to ${currentDir}`);
@@ -4406,6 +4599,9 @@ module.exports = {
     detectPlatforms,
     markPlatformsExplicit,
     mergeBdbSettingsHooks,
+    mergeAntigravityHooks,
+    mergeCodexTomlHooks,
+    mergeCodexHooks: mergeCodexTomlHooks,
     installGlobalHooks,
     installProjectHarness,
     mirrorMcpServersTo,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "engines": {

package/skills/global_config/aos-setup/SKILL.md

@@ -36,15 +36,12 @@ believing memory works everywhere:
 | | Skills | MCP | Hooks |
 |---|---|---|---|
 | Claude Code | `~/.claude/skills` | `~/.claude.json` | **yes** |
-| Antigravity | `~/.gemini/config/skills` | `mcp_config.json` | no |
-| Codex | `~/.codex/skills` | `config.toml` | no |
+| Antigravity | `~/.gemini/config/skills` | `mcp_config.json` | **yes** (.agents/hooks.json / hooks.json) |
+| Codex | `~/.codex/skills` | `config.toml` | **yes** (config.toml) |
 | OpenCode | — | `opencode.jsonc` | no |
 | Cursor / Roo | `bdb-skills` | `mcp.json` | no |
 
-Only Claude Code has hooks, so only there can memB inject per prompt. Elsewhere
-the same context arrives through the rule files that harness loads at start —
-see section 5 — which means it is as fresh as the last write, not as fresh as
-the prompt. Say so plainly rather than letting someone assume parity.
+Claude Code, Google Antigravity, and OpenAI Codex have native hook support, allowing memB to inject ambient memory per prompt across all three harnesses. For hookless harnesses (Cursor, Roo, OpenCode, Windsurf), the same context arrives through the rule files that harness loads at start — see section 5 — which means it is as fresh as the last write, not as fresh as the prompt. Say so plainly rather than letting someone assume parity.
 
 ---
 
@@ -173,7 +170,8 @@ injects the relevant memories as context. It fails open: any error exits `0`
 and the prompt proceeds untouched.
 
 Since v4.4.0 the installer ships `memb-inject.mjs` into `~/.claude/hooks/` and
-wires it as a `UserPromptSubmit` hook. **v4.4.0's Quick Update did not** — it
+wires it as an automated prompt hook across Claude Code (`UserPromptSubmit` in `settings.json`),
+Google Antigravity (`PreInvocation` in `hooks.json` / `.agents/hooks.json`), and OpenAI Codex (`UserPromptSubmit` in `config.toml`). **v4.4.0's Quick Update did not** — it
 refreshes skills and submodules, and hooks are harness plumbing rather than
 skills, so a machine that already had AOS updated to 4.4.0 without ever
 receiving the hook. Fixed in v4.4.1; a machine that took that update needs one
@@ -183,7 +181,7 @@ more run:
 npx -y @hybridlabor-api/aos@latest
 ```
 
-The wiring is merged into `~/.claude/settings.json`, never written over it:
+The wiring is merged into `~/.claude/settings.json`, Antigravity `hooks.json`, and Codex `config.toml`, never written over them:
 user keys and foreign hook entries survive, and a re-run replaces the BDB entry
 rather than adding a second copy.
 
@@ -199,7 +197,7 @@ harness — the memB store is machine-global, and pointing it at
 `$CLAUDE_PROJECT_DIR` would make it fail on every prompt in any project the
 harness was never installed into.
 
-**On a harness without hooks** — everything except Claude Code — the same
+**On hookless harnesses** — Cursor, Roo, OpenCode, Windsurf — native hooks are not supported, so the same
 context is written into the rule files that harness loads instead:
 
 ```bash

package/skills/global_config/aos-setup/scripts/aos-doctor.mjs

@@ -163,7 +163,7 @@ function checkHooks() {
   // the row would go green over a hook carrying a bug this version fixed.
   // Hooks that carry an `aos-hook-version:` line are checked against what this
   // release expects; the ones that do not are existence-only.
-  const EXPECTED_VERSION = { 'memb-inject.mjs': 2 };
+  const EXPECTED_VERSION = { 'memb-inject.mjs': 3 };
   const versionOf = (text) => {
     const m = /^\/\/\s*aos-hook-version:\s*(\d+)/m.exec(text);
     return m ? Number(m[1]) : null;
@@ -195,6 +195,48 @@ function checkHooks() {
     add('hooks', `${file} wired`, wired.includes(file), wired.includes(file) ? `present in ${event}` : `not referenced in ~/.claude/settings.json`,
       'Add it under the matching hooks event in ~/.claude/settings.json (see this skill, section 4).');
   }
+
+  // Antigravity hook wiring
+  const agDir = h('.gemini', 'antigravity-cli');
+  const agHooksCandidate = existsSync(path.join(agDir, 'hooks.json'))
+    ? path.join(agDir, 'hooks.json')
+    : existsSync(h('.gemini', 'config', 'hooks.json'))
+      ? h('.gemini', 'config', 'hooks.json')
+      : existsSync(h('.agents', 'hooks.json'))
+        ? h('.agents', 'hooks.json')
+        : null;
+
+  if (existsSync(agDir) || existsSync(h('.gemini', 'config', 'skills')) || agHooksCandidate) {
+    const targetFile = agHooksCandidate || path.join(agDir, 'hooks.json');
+    if (existsSync(targetFile)) {
+      const agHooks = readJson(targetFile);
+      const agWired = JSON.stringify(agHooks?.hooks || {});
+      const hasMemb = agWired.includes('memb-inject.mjs');
+      add('hooks', 'Antigravity hooks.json wired', hasMemb,
+        hasMemb ? `wired in ${tilde(targetFile)}` : `memb-inject.mjs not wired in ${tilde(targetFile)}`,
+        'Run installer or mergeAntigravityHooks to wire hooks in hooks.json.');
+    } else {
+      add('hooks', 'Antigravity hooks.json', false, `missing ${tilde(targetFile)}`,
+        'Run installer to create and wire hooks.json for Antigravity.');
+    }
+  }
+
+  // Codex hook wiring
+  const codexDir = h('.codex');
+  const codexConf = path.join(codexDir, 'config.toml');
+  if (existsSync(codexDir) || existsSync(codexConf)) {
+    if (existsSync(codexConf)) {
+      let toml = '';
+      try { toml = readFileSync(codexConf, 'utf8'); } catch {}
+      const hasMemb = toml.includes('memb-inject.mjs');
+      add('hooks', 'Codex config.toml wired', hasMemb,
+        hasMemb ? `wired in ${tilde(codexConf)}` : `memb-inject.mjs not wired in ${tilde(codexConf)}`,
+        'Run installer or mergeCodexTomlHooks to wire hooks in config.toml.');
+    } else {
+      add('hooks', 'Codex config.toml', false, `missing ${tilde(codexConf)}`,
+        'Run installer to create and wire config.toml for Codex.');
+    }
+  }
 }
 
 // ---------------------------------------------------------------- memB

package/skills/global_config/openwiki-skill/scripts/install_daemon.ps1

@@ -3,6 +3,8 @@
 $UserHome = [System.Environment]::GetFolderPath('UserProfile')
 $ScriptPath = "$UserHome\.gemini\config\skills\openwiki-skill\scripts\openwiki_daemon.py"
 $DaemonLogDir = "$UserHome\.openwiki"
+$VenvDir = "$DaemonLogDir\venv"
+$DaemonPython = ""
 
 Write-Host "=========================================================" -ForegroundColor Cyan
 Write-Host " Installing OpenWiki Background Daemon (Windows Task Scheduler)" -ForegroundColor Cyan
@@ -18,12 +20,73 @@ if (-not (Test-Path $ScriptPath)) {
     }
 }
 
-# 2. Install Python dependency
-Write-Host "Installing google-genai SDK..." -ForegroundColor Yellow
-try {
-    pip install --quiet google-genai 2>$null
-} catch {
-    Write-Host "Warning: pip install failed. Install google-genai manually." -ForegroundColor Yellow
+# 2. Install Python dependency into a dedicated venv
+Write-Host "Installing google-genai SDK into $VenvDir ..." -ForegroundColor Yellow
+if (-not (Test-Path $DaemonLogDir)) {
+    New-Item -ItemType Directory -Force -Path $DaemonLogDir | Out-Null
+}
+
+$VenvPython = Join-Path $VenvDir "Scripts\python.exe"
+
+$UvCmd = Get-Command uv -ErrorAction SilentlyContinue
+if ($UvCmd) {
+    try {
+        & uv venv "$VenvDir" 2>&1 | Out-Null
+        if (Test-Path $VenvPython) {
+            $InstallOutput = & uv pip install --python $VenvPython --quiet google-genai 2>&1
+            if ($LASTEXITCODE -eq 0) {
+                $DaemonPython = $VenvPython
+            }
+        }
+    } catch {}
+}
+
+if ([string]::IsNullOrWhiteSpace($DaemonPython)) {
+    $SysCmd = Get-Command python -ErrorAction SilentlyContinue
+    if ($SysCmd) {
+        $SysPython = if ($SysCmd.Path) { $SysCmd.Path } elseif ($SysCmd.Source) { $SysCmd.Source } else { "python" }
+        try {
+            & $SysPython -m venv "$VenvDir" 2>&1 | Out-Null
+            if (Test-Path $VenvPython) {
+                $InstallOutput = & $VenvPython -m pip install --quiet google-genai 2>&1
+                if ($LASTEXITCODE -eq 0) {
+                    $DaemonPython = $VenvPython
+                }
+            }
+        } catch {}
+    }
+}
+
+if ([string]::IsNullOrWhiteSpace($DaemonPython)) {
+    Write-Host "Warning: could not install google-genai into $VenvDir." -ForegroundColor Yellow
+    Write-Host "         Reason (last attempt):" -ForegroundColor Yellow
+    $SysCmd = Get-Command python -ErrorAction SilentlyContinue
+    if ($SysCmd) {
+        $SysPython = if ($SysCmd.Path) { $SysCmd.Path } elseif ($SysCmd.Source) { $SysCmd.Source } else { "python" }
+        if (Test-Path $VenvPython) {
+            $diagOutput = & $VenvPython -m pip install google-genai 2>&1
+            if ($diagOutput) {
+                $diagOutput | Select-Object -First 8 | ForEach-Object { Write-Host "           $_" -ForegroundColor DarkGray }
+            }
+        } else {
+            $diagVenv = & $SysPython -m venv "$VenvDir" 2>&1
+            if ($diagVenv) {
+                $diagVenv | Select-Object -First 5 | ForEach-Object { Write-Host "           $_" -ForegroundColor DarkGray }
+            }
+        }
+    } else {
+        Write-Host "           python not found on PATH." -ForegroundColor DarkGray
+    }
+    Write-Host "         The daemon will run in collect-only mode until this is resolved." -ForegroundColor Yellow
+    if (Test-Path $VenvPython) {
+        $DaemonPython = $VenvPython
+    } elseif ($cmd = Get-Command python -ErrorAction SilentlyContinue) {
+        $DaemonPython = if ($cmd.Path) { $cmd.Path } elseif ($cmd.Source) { $cmd.Source } else { "python" }
+    } else {
+        $DaemonPython = "python"
+    }
+} else {
+    Write-Host " -> google-genai installed; daemon will run under $DaemonPython" -ForegroundColor Green
 }
 
 # 3. Resolve provider and API key
@@ -63,7 +126,10 @@ if ($OpenwikiProvider -eq "google") {
         # and is discarded below.
         $env:GEMINI_API_KEY = $ApiKey
         $VerifyScript = Join-Path $PSScriptRoot "verify_api_key.py"
-        $VerifyOutput = & python $VerifyScript 2>&1
+        if (-not (Test-Path $VerifyScript)) {
+            $VerifyScript = Join-Path (Split-Path $ScriptPath -Parent) "verify_api_key.py"
+        }
+        $VerifyOutput = & $DaemonPython $VerifyScript 2>&1
         $VerifyCode = $LASTEXITCODE
         if ($VerifyCode -eq 0 -and ($VerifyOutput -match "VERIFIED_OK")) {
             Write-Host " -> API key verified." -ForegroundColor Green
@@ -118,7 +184,7 @@ if (-not (Test-Path $DaemonLogDir)) {
 # write the key in clear text into the .cmd under
 # %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\, readable by any
 # process in the user context and routinely swept up by backups and sync folders.
-$DaemonCommand = "& { python '$ScriptPath' --one-shot }"
+$DaemonCommand = "& { & '$DaemonPython' '$ScriptPath' --one-shot }"
 $Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -WindowStyle Hidden -Command `"$DaemonCommand`""
 
 # 6. Trigger: every 2 hours via repetition
@@ -151,7 +217,7 @@ function Install-StartupFallback {
     Write-Host "      * startup entry   -> runs ONCE per logon (--one-shot)" -ForegroundColor Yellow
     Write-Host "    Documentation is refreshed only when you log in, or when you run" -ForegroundColor Yellow
     Write-Host "    the daemon manually:" -ForegroundColor Yellow
-    Write-Host "      python `"$ScriptPath`" --one-shot" -ForegroundColor DarkGray
+    Write-Host "      & `"$DaemonPython`" `"$ScriptPath`" --one-shot" -ForegroundColor DarkGray
     Write-Host "    To get the 2-hour schedule, re-run this installer from an elevated" -ForegroundColor Yellow
     Write-Host "    PowerShell (Run as administrator)." -ForegroundColor Yellow
 }
@@ -191,17 +257,40 @@ if ($BlockReason -ne "") {
         Write-Host "    a logon-only startup entry is used instead." -ForegroundColor DarkGray
     }
     Write-Host "Registering task '$TaskName'..." -ForegroundColor Yellow
-    try {
-        Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Description "BDB OpenWiki Daemon - Gemma 4 API documentation generator" -Force -ErrorAction Stop | Out-Null
-        $Registered = $true
+
+    $CurrentUserName = try { [System.Security.Principal.WindowsIdentity]::GetCurrent().Name } catch { $env:USERNAME }
+    $UserPrincipal = try {
+        New-ScheduledTaskPrincipal -UserId $CurrentUserName -LogonType Interactive
     } catch {
-        $FailureMessage = $_.Exception.Message
-        Write-Warning "Scheduled task registration failed ($FailureMessage)."
-        $Reason = "scheduled task registration failed: $FailureMessage"
-        if (-not $IsElevated) {
-            $Reason = "$Reason (administrator rights are likely required on this system)"
+        $null
+    }
+
+    $TaskRegistered = $false
+    # First attempt: register using interactive user principal (needed for non-elevated users)
+    if ($UserPrincipal) {
+        try {
+            Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $UserPrincipal -Description "BDB OpenWiki Daemon - Gemma 4 API documentation generator" -Force -ErrorAction Stop | Out-Null
+            $TaskRegistered = $true
+            $Registered = $true
+        } catch {
+            Write-Verbose "Registration with interactive principal failed: $($_.Exception.Message). Trying default registration..."
+        }
+    }
+
+    # Second attempt: standard registration if principal registration was skipped or failed
+    if (-not $TaskRegistered) {
+        try {
+            Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Description "BDB OpenWiki Daemon - Gemma 4 API documentation generator" -Force -ErrorAction Stop | Out-Null
+            $Registered = $true
+        } catch {
+            $FailureMessage = $_.Exception.Message
+            Write-Warning "Scheduled task registration failed ($FailureMessage)."
+            $Reason = "scheduled task registration failed: $FailureMessage"
+            if (-not $IsElevated) {
+                $Reason = "$Reason (administrator rights are likely required on this system)"
+            }
+            Install-StartupFallback -Command $DaemonCommand -Reason $Reason
         }
-        Install-StartupFallback -Command $DaemonCommand -Reason $Reason
     }
 }