@hybridlabor-api/aos 4.5.0 → 4.5.2

package/.opencode/plugins/bdb-aos.js

@@ -0,0 +1,171 @@
+/**
+ * BDB Agent OS (AOS) plugin for OpenCode.
+ *
+ * Implements:
+ * 1. tool.execute.before: Releases gatekeeper (go-gate). Guards outward-facing
+ *    or hard-to-reverse actions (git push, npm publish, npm version, rm -rf)
+ *    unless the user explicitly authorized it with the literal word "GO".
+ * 2. chat.message: Ambient memory injection (memB). Injects relevant project & user
+ *    memories as ephemeral context from ~/.MemBDB/memb.db via node:sqlite.
+ *
+ * Zero external runtime dependencies. Fails open on memory lookup, fails closed
+ * on unguarded destructive actions.
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const GUARDED_PATTERNS = [
+  /^\s*git\s+push\b/i,
+  /^\s*npm\s+publish\b/i,
+  /^\s*npm\s+version\b/i,
+  /^\s*rm\s+(-\w*[rR]\w*|--recursive)\b/i,
+];
+
+let lastHumanPrompt = '';
+
+function isGuardedCommand(cmd) {
+  if (typeof cmd !== 'string') return false;
+  return GUARDED_PATTERNS.some((re) => re.test(cmd));
+}
+
+function verifyGoAuthorized(lastPrompt) {
+  const trimmed = (lastPrompt || '').trim();
+  return trimmed.toUpperCase() === 'GO';
+}
+
+// Extract ambient memory from local memB database
+async function getMembContext(prompt, currentDir) {
+  const home = os.homedir();
+  const dbPath = path.join(home, '.MemBDB', 'memb.db');
+  if (!existsSync(dbPath)) return null;
+
+  try {
+    const { DatabaseSync } = await import('node:sqlite');
+    const db = new DatabaseSync(dbPath, { readOnly: true });
+    db.exec('PRAGMA busy_timeout = 3000;');
+
+    const contextItems = [];
+
+    // Standing persona facts
+    const personaFile = path.join(home, '.MemBDB', 'ambient-persona.txt');
+    if (existsSync(personaFile)) {
+      try {
+        for (const line of readFileSync(personaFile, 'utf8').split('\n')) {
+          const t = line.trim();
+          if (t && !t.startsWith('#')) contextItems.push(`- ${t}`);
+        }
+      } catch {}
+    }
+
+    // Resolve project ID candidate
+    let projectName = path.basename(currentDir);
+    const pkgPath = path.join(currentDir, 'package.json');
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        if (pkg?.name) projectName = pkg.name;
+      } catch {}
+    }
+
+    // Query project memories
+    try {
+      const sql = `
+        SELECT payload FROM memb_vectors
+        WHERE collection = 'bdb_agent_memory'
+          AND (
+            json_extract(payload, '$.project_id') = ?
+            OR json_extract(payload, '$.metadata.project_id') = ?
+            OR json_extract(payload, '$.project') = ?
+            OR json_extract(payload, '$.metadata.project') = ?
+          )
+        ORDER BY rowid DESC
+        LIMIT 3
+      `;
+      const rows = db.prepare(sql).all(projectName, projectName, projectName, projectName);
+      for (const r of rows) {
+        try {
+          const p = JSON.parse(r.payload);
+          const text = (p.memory || p.data || '').trim().replace(/\s+/g, ' ');
+          if (text.length > 10) {
+            contextItems.push(`- Project [${projectName}]: ${text.slice(0, 180)}`);
+          }
+        } catch {}
+      }
+    } catch {}
+
+    db.close();
+
+    if (contextItems.length === 0) return null;
+    return `[AOS Ambient Memory - memB]\n${contextItems.join('\n')}`;
+  } catch {
+    return null;
+  }
+}
+
+export default async function bdbAosPlugin(input) {
+  const directory = input.directory || process.cwd();
+
+  return {
+    'chat.message': async (msgInput, msgOutput) => {
+      // Capture the user prompt text for GO-gate verification
+      const textParts = (msgOutput.parts || []).filter((p) => p && p.type === 'text' && typeof p.text === 'string');
+      const fullText = textParts.map((p) => p.text).join('\n').trim();
+      if (fullText) {
+        lastHumanPrompt = fullText;
+      }
+
+      // Inject memB ambient memory
+      try {
+        const membContext = await getMembContext(fullText, directory);
+        if (membContext) {
+          msgOutput.parts.unshift({
+            id: `memb-${Date.now()}`,
+            sessionID: msgInput.sessionID,
+            messageID: msgInput.messageID || '',
+            type: 'text',
+            text: membContext,
+            synthetic: true,
+          });
+        }
+      } catch {}
+    },
+
+    'tool.execute.before': async (toolInput, toolOutput) => {
+      const toolName = (toolInput.tool || '').toLowerCase();
+      // Intercept bash, terminal, or command execution tools
+      if (toolName === 'bash' || toolName === 'terminal' || toolName === 'shell' || toolName === 'exec' || toolName === 'run_command') {
+        const cmd = toolOutput?.args?.command || toolOutput?.args?.cmd || toolOutput?.args?.script || '';
+        if (isGuardedCommand(cmd)) {
+          let authorized = verifyGoAuthorized(lastHumanPrompt);
+
+          // If last cached prompt wasn't GO, query recent session messages via OpenCode client as fallback
+          if (!authorized && input.client && toolInput.sessionID) {
+            try {
+              const res = await input.client.session.messages({ path: { id: toolInput.sessionID } });
+              const msgs = res?.data || [];
+              for (let i = msgs.length - 1; i >= 0; i--) {
+                const m = msgs[i];
+                if (m.role === 'user') {
+                  const parts = m.parts || [];
+                  const text = parts.filter((p) => p.type === 'text').map((p) => p.text).join('\n').trim();
+                  if (text) {
+                    authorized = (text.toUpperCase() === 'GO');
+                    break;
+                  }
+                }
+              }
+            } catch {}
+          }
+
+          if (!authorized) {
+            throw new Error(
+              `Blocked by BDB go-gate: Command "${cmd.slice(0, 80)}" is guarded and requires explicit authorization with the literal word "GO" before proceeding.`
+            );
+          }
+        }
+      }
+    },
+  };
+}

package/bin/aos-dashboard.mjs

@@ -603,6 +603,12 @@ server.listen(PORT, '127.0.0.1', () => {
   const url = `http://127.0.0.1:${PORT}`;
   console.log(`AOS Dashboard v${AOS_VERSION || '?'}: ${url}   (Strg-C beendet)`);
   if (!OPEN) return;
-  const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
-  execFile(opener, [url], () => { /* no browser is not an error */ });
+  if (process.platform === 'win32') {
+    spawn('cmd.exe', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' })
+      .on('error', () => { /* no browser or spawn error is not fatal */ })
+      .unref();
+  } else {
+    const opener = process.platform === 'darwin' ? 'open' : 'xdg-open';
+    execFile(opener, [url], () => { /* no browser is not an error */ });
+  }
 });

package/installer.js

@@ -3175,11 +3175,62 @@ function injectHarnessRules() {
 // most (a fresh install got it; every machine that already had AOS did not).
 function installGlobalHooks() {
     const hooksSrc = path.join(srcDir, '.claude', 'hooks');
+    const workflowsSrc = path.join(srcDir, '.claude', 'workflows');
+
+    // 1. Claude Code
     if (fs.existsSync(hooksSrc)) {
         copyDirRecursiveSync(hooksSrc, path.join(homeDir, '.claude', 'hooks'));
         log.step(`Installed hooks to ${path.join(homeDir, '.claude', 'hooks')}`);
     }
+    if (fs.existsSync(workflowsSrc)) {
+        copyDirRecursiveSync(workflowsSrc, path.join(homeDir, '.claude', 'workflows'));
+    }
     mergeBdbSettingsHooks(path.join(homeDir, '.claude', 'settings.json'));
+
+    // 2. Google Antigravity
+    const agyHooksDir = path.join(geminiDir, 'config', 'hooks');
+    const agyWorkflowsDir = path.join(geminiDir, 'config', 'workflows');
+    if (fs.existsSync(hooksSrc)) {
+        copyDirRecursiveSync(hooksSrc, agyHooksDir);
+        log.step(`Installed hooks to ${agyHooksDir}`);
+    }
+    if (fs.existsSync(workflowsSrc)) {
+        copyDirRecursiveSync(workflowsSrc, agyWorkflowsDir);
+    }
+    mergeAntigravityHooks(path.join(geminiDir, 'config', 'hooks.json'));
+    if (fs.existsSync(path.join(geminiDir, 'antigravity-cli'))) {
+        mergeAntigravityHooks(path.join(geminiDir, 'antigravity-cli', 'hooks.json'));
+    }
+
+    // 3. OpenAI Codex CLI
+    const codexHooksDir = path.join(homeDir, '.codex', 'hooks');
+    const codexWorkflowsDir = path.join(homeDir, '.codex', 'workflows');
+    if (fs.existsSync(hooksSrc)) {
+        copyDirRecursiveSync(hooksSrc, codexHooksDir);
+        log.step(`Installed hooks to ${codexHooksDir}`);
+    }
+    if (fs.existsSync(workflowsSrc)) {
+        copyDirRecursiveSync(workflowsSrc, codexWorkflowsDir);
+    }
+    mergeCodexTomlHooks(path.join(homeDir, '.codex', 'config.toml'));
+
+    // 4. OpenCode CLI
+    const opencodeDir = process.platform === 'win32'
+        ? path.join(process.env.APPDATA || homeDir, 'opencode')
+        : path.join(homeDir, '.config', 'opencode');
+    const opencodePluginSrc = path.join(srcDir, '.opencode', 'plugins', 'bdb-aos.js');
+    if (fs.existsSync(opencodePluginSrc)) {
+        const opencodePluginsDir = path.join(opencodeDir, 'plugins');
+        const opencodePluginDest = path.join(opencodePluginsDir, 'bdb-aos.js');
+        try {
+            fs.mkdirSync(opencodePluginsDir, { recursive: true });
+            fs.copyFileSync(opencodePluginSrc, opencodePluginDest);
+            try { fs.chmodSync(opencodePluginDest, 0o644); } catch (e) { logDebug(e, 'chmod opencode plugin'); }
+            log.step(`Installed OpenCode plugin to ${opencodePluginDest}`);
+        } catch (e) {
+            log.warn(`Could not install OpenCode plugin: ${e.message}`);
+        }
+    }
 }
 
 // Merge the BDB hooks -- the two gates plus the memB ambient-memory hook --
@@ -3258,12 +3309,161 @@ function mergeBdbSettingsHooks(settingsPath, { projectLocal = false } = {}) {
     }
 
     try {
+        fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
         fs.writeFileSync(settingsPath, JSON.stringify(buildMerged(existing), null, 2) + '\n');
     } catch (e) {
         log.warn(`Could not write ${settingsPath}: ${e.message}`);
     }
 }
 
+// Merge the BDB hooks into Google Antigravity's hooks.json (.agents/hooks.json or
+// ~/.gemini/config/hooks.json), preserving user-defined foreign hooks.
+function mergeAntigravityHooks(hooksPath, { projectLocal = false } = {}) {
+    const bdbHookScripts = ['go-gate.mjs', 'graph-gate.mjs', 'memb-inject.mjs', 'startcycle-dispatch.mjs'];
+    const isBdbEntry = (entry) => {
+        const cmds = (entry && Array.isArray(entry.hooks) ? entry.hooks : [entry])
+            .map((h) => (h && typeof h.command === 'string' ? h.command : (typeof h === 'string' ? h : '')))
+            .join(' ');
+        return bdbHookScripts.some((name) => cmds.includes(name));
+    };
+
+    const baseDir = path.dirname(hooksPath);
+    const hooksDir = projectLocal ? path.join(currentDir, '.agents', 'hooks') : path.join(baseDir, 'hooks');
+    const workflowsDir = projectLocal ? path.join(currentDir, '.agents', 'workflows') : path.join(baseDir, 'workflows');
+    const globalHooksDir = projectLocal ? path.join(homeDir, '.gemini', 'config', 'hooks') : hooksDir;
+
+    const bdbHooks = {
+        PreToolUse: [
+            {
+                matcher: "run_command|Bash",
+                hooks: [{ type: "command", command: `node "${path.join(hooksDir, 'go-gate.mjs')}"`, timeout: 10000 }]
+            }
+        ],
+        Stop: [
+            {
+                hooks: [{ type: "command", command: `node "${path.join(hooksDir, 'graph-gate.mjs')}"`, timeout: 10000 }]
+            }
+        ],
+        PreInvocation: [
+            {
+                hooks: [
+                    { type: "command", command: `node "${path.join(globalHooksDir, 'memb-inject.mjs')}"`, timeout: 8000 },
+                    { type: "command", command: `node "${path.join(workflowsDir, 'startcycle-dispatch.mjs')}"`, timeout: 30000 }
+                ]
+            }
+        ]
+    };
+
+    const buildMerged = (existing) => {
+        const merged = existing && typeof existing === 'object' ? existing : {};
+        merged.hooks = merged.hooks && typeof merged.hooks === 'object' ? merged.hooks : {};
+        for (const [event, entries] of Object.entries(bdbHooks)) {
+            const foreignEntries = (Array.isArray(merged.hooks[event]) ? merged.hooks[event] : [])
+                .filter((e) => !isBdbEntry(e));
+            merged.hooks[event] = [...foreignEntries, ...entries];
+        }
+        return merged;
+    };
+
+    let existing = null;
+    if (fs.existsSync(hooksPath)) {
+        existing = readJsonFile(hooksPath);
+        if (!existing) {
+            const backupCopy = `${hooksPath}.corrupt_${timestamp}.bak`;
+            const sideCarPath = `${hooksPath}.bdb-new.json`;
+            let backupWritten = true;
+            try {
+                fs.copyFileSync(hooksPath, backupCopy);
+            } catch (copyError) {
+                backupWritten = false;
+                log.warn(`Could not create the hooks backup: ${copyError.message}`);
+            }
+            try {
+                fs.writeFileSync(sideCarPath, JSON.stringify(buildMerged(null), null, 2) + '\n');
+            } catch (writeError) {
+                log.warn(`Could not write ${path.basename(sideCarPath)}: ${writeError.message}`);
+            }
+            log.warn(`${path.basename(hooksPath)} is not valid JSON - hook merge skipped, nothing overwritten.`);
+            if (backupWritten) log.warn(`Backup copy: ${backupCopy}`);
+            log.warn(`BDB-wired hooks: ${sideCarPath}`);
+            return;
+        }
+    }
+
+    try {
+        fs.mkdirSync(path.dirname(hooksPath), { recursive: true });
+        fs.writeFileSync(hooksPath, JSON.stringify(buildMerged(existing), null, 2) + '\n');
+    } catch (e) {
+        log.warn(`Could not write ${hooksPath}: ${e.message}`);
+    }
+}
+
+// Merge the BDB hooks into ChatGPT Codex CLI's config.toml (~/.codex/config.toml or
+// .codex/config.toml), ensuring [features] hooks = true and preserving existing
+// non-BDB settings, comments, and MCP servers.
+function mergeCodexTomlHooks(configTomlPath, { projectLocal = false } = {}) {
+    const baseDir = path.dirname(configTomlPath);
+    const hooksDir = projectLocal ? path.join(currentDir, '.codex', 'hooks') : path.join(baseDir, 'hooks');
+    const workflowsDir = projectLocal ? path.join(currentDir, '.codex', 'workflows') : path.join(baseDir, 'workflows');
+    const globalHooksDir = projectLocal ? path.join(homeDir, '.codex', 'hooks') : hooksDir;
+
+    const tomlSnippet = [
+        '# AOS:HOOKS:START',
+        '[[hooks.PreToolUse]]',
+        'matcher = "^(Bash|run_command)$"',
+        '[[hooks.PreToolUse.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(hooksDir, 'go-gate.mjs')}"`)}`,
+        'timeout = 30',
+        '',
+        '[[hooks.Stop]]',
+        '[[hooks.Stop.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(hooksDir, 'graph-gate.mjs')}"`)}`,
+        'timeout = 30',
+        '',
+        '[[hooks.UserPromptSubmit]]',
+        '[[hooks.UserPromptSubmit.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(globalHooksDir, 'memb-inject.mjs')}"`)}`,
+        'timeout = 30',
+        '',
+        '[[hooks.UserPromptSubmit]]',
+        '[[hooks.UserPromptSubmit.hooks]]',
+        'type = "command"',
+        `command = ${JSON.stringify(`node "${path.join(workflowsDir, 'startcycle-dispatch.mjs')}"`)}`,
+        'timeout = 30',
+        '# AOS:HOOKS:END'
+    ].join('\n');
+
+    let content = fs.existsSync(configTomlPath) ? fs.readFileSync(configTomlPath, 'utf8') : '';
+
+    // Ensure [features] hooks = true
+    const hasHooksFeature = /(?:hooks|codex_hooks)\s*=\s*true/m.test(content);
+    if (!hasHooksFeature) {
+        if (/^\[features\]/m.test(content)) {
+            content = content.replace(/^\[features\]/m, '[features]\nhooks = true');
+        } else {
+            content = `[features]\nhooks = true\n\n${content.trimStart()}`;
+        }
+    }
+
+    // Replace existing AOS:HOOKS block or append
+    const hookBlockRegex = /# AOS:HOOKS:START[\s\S]*?# AOS:HOOKS:END/;
+    if (hookBlockRegex.test(content)) {
+        content = content.replace(hookBlockRegex, tomlSnippet);
+    } else {
+        content = `${content.trimEnd()}\n\n${tomlSnippet}\n`;
+    }
+
+    try {
+        fs.mkdirSync(path.dirname(configTomlPath), { recursive: true });
+        fs.writeFileSync(configTomlPath, content, { mode: 0o600 });
+    } catch (e) {
+        log.warn(`Could not write ${configTomlPath}: ${e.message}`);
+    }
+}
+
 // Tier 9 (Local Project Harness): drop the dispatcher contract into the
 // CURRENT PROJECT only -- no writes to $HOME, no global skill/MCP sync, and
 // this runs as an early return BEFORE any global install step. A bare
@@ -3276,22 +3476,29 @@ function mergeBdbSettingsHooks(settingsPath, { projectLocal = false } = {}) {
 // non-interactively via `--project-harness` (combine with -y for CI).
 function installProjectHarness() {
     const projectClaudeDir = path.join(currentDir, '.claude');
-    installStep(`create ${projectClaudeDir}`, () => {
+    const projectAgentsDir = path.join(currentDir, '.agents');
+    const projectCodexDir = path.join(currentDir, '.codex');
+
+    installStep(`create harness directories`, () => {
         fs.mkdirSync(projectClaudeDir, { recursive: true });
+        fs.mkdirSync(projectAgentsDir, { recursive: true });
+        fs.mkdirSync(projectCodexDir, { recursive: true });
     }, 'The harness copies below will most likely fail as well.');
 
     installStep('copy .agents/ contract into project', () => {
         const agentsSrc = path.join(srcDir, '.agents');
         if (!fs.existsSync(agentsSrc)) throw new Error(`missing payload: ${agentsSrc}`);
-        copyDirRecursiveSync(agentsSrc, path.join(currentDir, '.agents'));
-        log.step(`Copied .agents/ contract to ${path.join(currentDir, '.agents')}`);
+        copyDirRecursiveSync(agentsSrc, projectAgentsDir);
+        log.step(`Copied .agents/ contract to ${projectAgentsDir}`);
     }, 'graph.md / state.schema.json may be missing in the project.');
 
     installStep('copy dispatcher workflows into project', () => {
         const workflowsSrc = path.join(srcDir, '.claude', 'workflows');
         if (fs.existsSync(workflowsSrc)) {
             copyDirRecursiveSync(workflowsSrc, path.join(projectClaudeDir, 'workflows'));
-            log.step(`Copied dispatcher workflows to ${path.join(projectClaudeDir, 'workflows')}`);
+            copyDirRecursiveSync(workflowsSrc, path.join(projectAgentsDir, 'workflows'));
+            copyDirRecursiveSync(workflowsSrc, path.join(projectCodexDir, 'workflows'));
+            log.step(`Copied dispatcher workflows to project harnesses`);
         }
     }, '/startcycle dispatch degrades to graph.md as a manual guide.');
 
@@ -3299,7 +3506,9 @@ function installProjectHarness() {
         const hooksSrc = path.join(srcDir, '.claude', 'hooks');
         if (fs.existsSync(hooksSrc)) {
             copyDirRecursiveSync(hooksSrc, path.join(projectClaudeDir, 'hooks'));
-            log.step(`Copied hooks to ${path.join(projectClaudeDir, 'hooks')}`);
+            copyDirRecursiveSync(hooksSrc, path.join(projectAgentsDir, 'hooks'));
+            copyDirRecursiveSync(hooksSrc, path.join(projectCodexDir, 'hooks'));
+            log.step(`Copied hooks to project harnesses`);
         }
     }, 'go-gate / graph-gate enforcement stays inactive in this project.');
 
@@ -3311,9 +3520,11 @@ function installProjectHarness() {
         }
     }, 'The dispatcher runs, but its agent-file pointers resolve to nothing.');
 
-    installStep('wire project .claude/settings.json to local hooks', () => {
+    installStep('wire project harnesses to local hooks', () => {
         mergeBdbSettingsHooks(path.join(projectClaudeDir, 'settings.json'), { projectLocal: true });
-        log.step(`Wired project hooks in ${path.join(projectClaudeDir, 'settings.json')}`);
+        mergeAntigravityHooks(path.join(projectAgentsDir, 'hooks.json'), { projectLocal: true });
+        mergeCodexTomlHooks(path.join(projectCodexDir, 'config.toml'), { projectLocal: true });
+        log.step(`Wired project hooks in Claude, Antigravity, and Codex configurations`);
     }, 'The gate hooks exist but are not auto-wired for this project.');
 
     log.success(`Project harness installed to ${currentDir}`);
@@ -3829,17 +4040,98 @@ async function universalHarnessSync(primaryMcpConfigPath) {
             const existing = readJsoncFile(targetPath);
             const data = existing && existing.mcp ? existing : Object.assign({}, existing || {}, { mcp: {} });
             if (masterMcpData.mcpServers) {
+                // OpenCode provider APIs (e.g. OpenAI-compatible, Console) enforce tool name length limits
+                // (e.g. max 64 chars) and context limits. Loading 20+ MCPs causes provider errors (e.g. 73-char tool names).
+                // OpenCode uses a slim profile: only core servers (memb_mcp, zavora_computer_use) are enabled by default.
+                const OPENCODE_DEFAULT_SLIM = new Set(['memb_mcp', 'zavora_computer_use']);
+                const existingMcp = existing && existing.mcp ? existing.mcp : {};
+                const hasExistingKeys = Object.keys(existingMcp).length > 0;
+
                 for (const [key, val] of Object.entries(masterMcpData.mcpServers)) {
-                    const cmd = Array.isArray(val.command) ? val.command : [val.command];
-                    const args = Array.isArray(val.args) ? val.args : [];
+                    const rawCmd = Array.isArray(val.command) ? val.command : [val.command];
+                    const rawArgs = Array.isArray(val.args) ? val.args : [];
+                    const fullCmd = [...rawCmd, ...rawArgs].map(c => {
+                        if (c === '__PYTHON_BIN__') {
+                            return process.platform === 'win32'
+                                ? path.join(homeDir, '.gemini', 'config', 'mcps', 'memb-mcp', '.venv', 'Scripts', 'python.exe')
+                                : path.join(homeDir, '.gemini', 'config', 'mcps', 'memb-mcp', '.venv', 'bin', 'python');
+                        }
+                        return c;
+                    });
+
+                    const existingEntry = existingMcp[key];
+
+                    // If existing config is intentionally slimmed (has keys, but omitted this one), don't resurrect unless in slim set
+                    if (hasExistingKeys && !existingEntry && !OPENCODE_DEFAULT_SLIM.has(key)) {
+                        continue;
+                    }
+
+                    // Preserve user's explicit enabled/disabled setting; otherwise default to true only for slim set
+                    const isEnabled = existingEntry && typeof existingEntry.enabled === 'boolean'
+                        ? existingEntry.enabled
+                        : OPENCODE_DEFAULT_SLIM.has(key);
+
+                    let envObj = val.environment || val.env;
+                    if (envObj) {
+                        envObj = Object.assign({}, envObj);
+                        for (const [eKey, eVal] of Object.entries(envObj)) {
+                            if (eVal === '__GEMINI_API_KEY__') {
+                                envObj[eKey] = '${GEMINI_API_KEY}';
+                            }
+                        }
+                    }
+
                     data.mcp[key] = {
                         type: "local",
-                        command: [...cmd, ...args],
-                        enabled: true,
-                        ...(val.environment || val.env ? { environment: val.environment || val.env } : {})
+                        command: fullCmd,
+                        enabled: isEnabled,
+                        ...(envObj ? { environment: envObj } : {})
                     };
                 }
             }
+
+            // Wire BDB AOS Plugin for OpenCode
+            const opencodeDir = path.dirname(targetPath);
+            const pluginsDir = path.join(opencodeDir, 'plugins');
+            const pluginFile = path.join(pluginsDir, 'bdb-aos.js');
+            const pluginSrc = path.join(srcDir, '.opencode', 'plugins', 'bdb-aos.js');
+
+            try {
+                if (fs.existsSync(pluginSrc)) {
+                    fs.mkdirSync(pluginsDir, { recursive: true });
+                    fs.copyFileSync(pluginSrc, pluginFile);
+                    try { fs.chmodSync(pluginFile, 0o644); } catch (e) { logDebug(e, 'chmod pluginFile'); }
+                }
+            } catch (pluginErr) {
+                log.warn(`Could not install OpenCode plugin: ${pluginErr.message}`);
+            }
+
+            // Register plugin in opencode.jsonc if plugin file exists
+            if (fs.existsSync(pluginFile)) {
+                if (!Array.isArray(data.plugin)) {
+                    data.plugin = [];
+                }
+                const pluginPathNormalized = pluginFile.replace(/\\/g, '/');
+                const alreadyRegistered = data.plugin.some(p => {
+                    const str = typeof p === 'string' ? p : (Array.isArray(p) ? p[0] : '');
+                    return str.includes('bdb-aos');
+                });
+                if (!alreadyRegistered) {
+                    data.plugin.push(pluginPathNormalized);
+                }
+            }
+
+            // Register skills paths for OpenCode
+            if (!data.skills || typeof data.skills !== 'object') {
+                data.skills = { paths: [".agents/skills"] };
+            } else if (Array.isArray(data.skills.paths)) {
+                if (!data.skills.paths.includes(".agents/skills")) {
+                    data.skills.paths.push(".agents/skills");
+                }
+            } else {
+                data.skills.paths = [".agents/skills"];
+            }
+
             fs.mkdirSync(path.dirname(targetPath), { recursive: true });
             fs.writeFileSync(targetPath, JSON.stringify(data, null, 2), { mode: 0o600 });
             try { fs.chmodSync(targetPath, 0o600); } catch (e) { logDebug(e, 'chmod targetPath'); }
@@ -4406,6 +4698,9 @@ module.exports = {
     detectPlatforms,
     markPlatformsExplicit,
     mergeBdbSettingsHooks,
+    mergeAntigravityHooks,
+    mergeCodexTomlHooks,
+    mergeCodexHooks: mergeCodexTomlHooks,
     installGlobalHooks,
     installProjectHarness,
     mirrorMcpServersTo,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "engines": {

package/skills/global_config/aos-setup/SKILL.md

@@ -36,15 +36,12 @@ believing memory works everywhere:
 | | Skills | MCP | Hooks |
 |---|---|---|---|
 | Claude Code | `~/.claude/skills` | `~/.claude.json` | **yes** |
-| Antigravity | `~/.gemini/config/skills` | `mcp_config.json` | no |
-| Codex | `~/.codex/skills` | `config.toml` | no |
+| Antigravity | `~/.gemini/config/skills` | `mcp_config.json` | **yes** (.agents/hooks.json / hooks.json) |
+| Codex | `~/.codex/skills` | `config.toml` | **yes** (config.toml) |
 | OpenCode | — | `opencode.jsonc` | no |
 | Cursor / Roo | `bdb-skills` | `mcp.json` | no |
 
-Only Claude Code has hooks, so only there can memB inject per prompt. Elsewhere
-the same context arrives through the rule files that harness loads at start —
-see section 5 — which means it is as fresh as the last write, not as fresh as
-the prompt. Say so plainly rather than letting someone assume parity.
+Claude Code, Google Antigravity, and OpenAI Codex have native hook support, allowing memB to inject ambient memory per prompt across all three harnesses. For hookless harnesses (Cursor, Roo, OpenCode, Windsurf), the same context arrives through the rule files that harness loads at start — see section 5 — which means it is as fresh as the last write, not as fresh as the prompt. Say so plainly rather than letting someone assume parity.
 
 ---
 
@@ -173,7 +170,8 @@ injects the relevant memories as context. It fails open: any error exits `0`
 and the prompt proceeds untouched.
 
 Since v4.4.0 the installer ships `memb-inject.mjs` into `~/.claude/hooks/` and
-wires it as a `UserPromptSubmit` hook. **v4.4.0's Quick Update did not** — it
+wires it as an automated prompt hook across Claude Code (`UserPromptSubmit` in `settings.json`),
+Google Antigravity (`PreInvocation` in `hooks.json` / `.agents/hooks.json`), and OpenAI Codex (`UserPromptSubmit` in `config.toml`). **v4.4.0's Quick Update did not** — it
 refreshes skills and submodules, and hooks are harness plumbing rather than
 skills, so a machine that already had AOS updated to 4.4.0 without ever
 receiving the hook. Fixed in v4.4.1; a machine that took that update needs one
@@ -183,7 +181,7 @@ more run:
 npx -y @hybridlabor-api/aos@latest
 ```
 
-The wiring is merged into `~/.claude/settings.json`, never written over it:
+The wiring is merged into `~/.claude/settings.json`, Antigravity `hooks.json`, and Codex `config.toml`, never written over them:
 user keys and foreign hook entries survive, and a re-run replaces the BDB entry
 rather than adding a second copy.
 
@@ -199,7 +197,7 @@ harness — the memB store is machine-global, and pointing it at
 `$CLAUDE_PROJECT_DIR` would make it fail on every prompt in any project the
 harness was never installed into.
 
-**On a harness without hooks** — everything except Claude Code — the same
+**On hookless harnesses** — Cursor, Roo, OpenCode, Windsurf — native hooks are not supported, so the same
 context is written into the rule files that harness loads instead:
 
 ```bash