@kbediako/codex-orchestrator 0.1.33 → 0.1.34

package/dist/orchestrator/src/cli/doctorIssueLog.js

@@ -0,0 +1,350 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { collectManifests, parseRunIdTimestamp } from '../../../scripts/lib/run-manifests.js';
+const ISSUE_LOG_HEADER = `# Codex Orchestrator Issues Log
+
+Purpose:
+- Track concrete Codex Orchestrator (CO) friction points observed in this repo so they can be addressed upstream.
+`;
+export async function writeDoctorIssueLog(options) {
+    const cwd = resolve(options.cwd ?? process.cwd());
+    const env = options.env ?? process.env;
+    const repoRoot = resolveIssueLogRepoRoot(cwd, env);
+    const runsRoot = resolveIssueLogRootPath(repoRoot, env.CODEX_ORCHESTRATOR_RUNS_DIR, '.runs');
+    const outRoot = resolveIssueLogRootPath(repoRoot, env.CODEX_ORCHESTRATOR_OUT_DIR, 'out');
+    const defaultTaskId = normalizeIssueLogTaskId(env);
+    const capturedAt = new Date().toISOString();
+    const issueId = formatIssueId(capturedAt);
+    const issueTitle = normalizeText(options.issueTitle) ?? 'Observed Codex Orchestrator issue';
+    const issueNotes = normalizeText(options.issueNotes);
+    const taskFilter = normalizeText(options.taskFilter);
+    const issueLogPath = resolveIssueLogPath(repoRoot, options.issueLogPath);
+    const runContext = await resolveLatestRunContext({
+        runsRoot,
+        repoRoot,
+        taskFilter
+    });
+    const bundleTaskId = normalizeArtifactTaskId(taskFilter ?? runContext?.task_id ?? defaultTaskId);
+    const bundleDir = join(outRoot, bundleTaskId, 'doctor', 'issue-bundles');
+    await mkdir(bundleDir, { recursive: true });
+    const bundlePath = join(bundleDir, `${toCompactTimestamp(capturedAt)}-${slugify(issueTitle)}.json`);
+    const bundlePayload = {
+        version: 1,
+        captured_at: capturedAt,
+        issue: {
+            id: issueId,
+            title: issueTitle,
+            notes: issueNotes,
+            command: 'codex-orchestrator doctor --issue-log'
+        },
+        repo: {
+            cwd,
+            repo_root: repoRoot
+        },
+        task_filter: taskFilter,
+        doctor: options.doctor,
+        usage: options.usage ?? null,
+        cloud_preflight: options.cloudPreflight ?? null,
+        run_context: runContext
+    };
+    await writeFile(bundlePath, `${JSON.stringify(bundlePayload, null, 2)}\n`, 'utf8');
+    await writeIssueLogMarkdown({
+        issueLogPath,
+        issueId,
+        issueTitle,
+        issueNotes,
+        taskFilter,
+        capturedAt,
+        doctor: options.doctor,
+        cloudPreflight: options.cloudPreflight ?? null,
+        runContext,
+        bundlePath,
+        repoRoot,
+        cwd
+    });
+    return {
+        issue_id: issueId,
+        issue_title: issueTitle,
+        issue_log_path: toDisplayPath(issueLogPath, cwd),
+        bundle_path: toDisplayPath(bundlePath, cwd),
+        task_filter: taskFilter,
+        run_context: runContext
+    };
+}
+export function formatDoctorIssueLogSummary(result) {
+    const lines = [];
+    lines.push(`Issue log: ${result.issue_id}`);
+    lines.push(`  - markdown: ${result.issue_log_path}`);
+    lines.push(`  - bundle: ${result.bundle_path}`);
+    if (result.run_context) {
+        lines.push(`  - run: ${result.run_context.run_id} (${result.run_context.status})`);
+    }
+    else {
+        lines.push('  - run: <none found>');
+    }
+    return lines;
+}
+function resolveIssueLogPath(repoRoot, rawPath) {
+    const normalized = normalizeText(rawPath);
+    if (!normalized) {
+        return join(repoRoot, 'docs', 'codex-orchestrator-issues.md');
+    }
+    if (isAbsolute(normalized)) {
+        return normalized;
+    }
+    return resolve(repoRoot, normalized);
+}
+function resolveIssueLogRepoRoot(cwd, env) {
+    const configuredRoot = normalizeText(env.CODEX_ORCHESTRATOR_ROOT);
+    const rootHint = configuredRoot === null
+        ? cwd
+        : isAbsolute(configuredRoot)
+            ? configuredRoot
+            : resolve(cwd, configuredRoot);
+    return resolveRepoRootFromHint(rootHint);
+}
+function resolveRepoRootFromHint(rootHint) {
+    const normalizedHint = resolve(rootHint);
+    const gitBoundary = findNearestGitBoundary(normalizedHint);
+    let current = normalizedHint;
+    while (current) {
+        if (existsSync(join(current, 'tasks', 'index.json'))) {
+            return current;
+        }
+        if (gitBoundary && current === gitBoundary) {
+            break;
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            break;
+        }
+        current = parent;
+    }
+    return gitBoundary ?? normalizedHint;
+}
+function findNearestGitBoundary(start) {
+    let current = resolve(start);
+    while (current) {
+        if (existsSync(join(current, '.git'))) {
+            return current;
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            break;
+        }
+        current = parent;
+    }
+    return null;
+}
+function resolveIssueLogRootPath(repoRoot, configuredPath, fallback) {
+    const normalized = normalizeText(configuredPath);
+    if (!normalized) {
+        return resolve(repoRoot, fallback);
+    }
+    if (isAbsolute(normalized)) {
+        return normalized;
+    }
+    return resolve(repoRoot, normalized);
+}
+function normalizeIssueLogTaskId(env) {
+    return normalizeArtifactTaskId(normalizeText(env.MCP_RUNNER_TASK_ID)
+        ?? normalizeText(env.TASK)
+        ?? normalizeText(env.CODEX_ORCHESTRATOR_TASK_ID)
+        ?? '0101');
+}
+async function writeIssueLogMarkdown(options) {
+    await mkdir(dirname(options.issueLogPath), { recursive: true });
+    let content = ISSUE_LOG_HEADER;
+    if (existsSync(options.issueLogPath)) {
+        content = await readFile(options.issueLogPath, 'utf8');
+        if (!content.trim()) {
+            content = ISSUE_LOG_HEADER;
+        }
+    }
+    const dateHeading = options.capturedAt.slice(0, 10);
+    const dateMarker = `\n## ${dateHeading}\n`;
+    if (!content.includes(dateMarker) && !content.endsWith(`## ${dateHeading}`)) {
+        content = `${content.replace(/\s*$/u, '')}\n\n## ${dateHeading}\n`;
+    }
+    const cloudPreflightStatus = options.cloudPreflight
+        ? options.cloudPreflight.ok
+            ? 'ok'
+            : 'failed'
+        : 'not-run';
+    const cloudPreflightIssueCodes = options.cloudPreflight
+        ? options.cloudPreflight.issues.map((issue) => issue.code).filter(Boolean)
+        : [];
+    const lines = [];
+    lines.push(`### ${options.issueId}: ${options.issueTitle}`);
+    lines.push('- Logged via: `codex-orchestrator doctor --issue-log`');
+    lines.push(`- Captured at: ${options.capturedAt}`);
+    lines.push(`- Repo root: \`${toDisplayPath(options.repoRoot, options.cwd)}\``);
+    lines.push(`- Task filter: \`${options.taskFilter ?? '<none>'}\``);
+    lines.push(`- Doctor status: \`${options.doctor.status}\``);
+    lines.push(`- Cloud preflight: \`${cloudPreflightStatus}\``);
+    if (cloudPreflightIssueCodes.length > 0) {
+        lines.push(`- Cloud preflight issue codes: \`${cloudPreflightIssueCodes.join(', ')}\``);
+    }
+    if (options.runContext) {
+        lines.push(`- Latest run id: \`${options.runContext.run_id}\``);
+        lines.push(`- Latest run status: \`${options.runContext.status}\``);
+        lines.push(`- Latest run pipeline: \`${options.runContext.pipeline_id}\``);
+        lines.push(`- Latest run manifest: \`${options.runContext.manifest_path}\``);
+        if (options.runContext.cloud_fallback_reason) {
+            lines.push(`- Latest run cloud fallback: \`${options.runContext.cloud_fallback_reason}\``);
+        }
+        if (options.runContext.cloud_execution_status) {
+            const cloudBits = [
+                `status=${options.runContext.cloud_execution_status}`,
+                options.runContext.cloud_execution_task_id
+                    ? `task=${options.runContext.cloud_execution_task_id}`
+                    : null,
+                options.runContext.cloud_execution_status_url
+                    ? `url=${options.runContext.cloud_execution_status_url}`
+                    : null
+            ].filter((item) => Boolean(item));
+            lines.push(`- Latest run cloud execution: \`${cloudBits.join(' ')}\``);
+        }
+    }
+    else {
+        lines.push('- Latest run context: `<none found under .runs>`');
+    }
+    if (options.issueNotes) {
+        lines.push(`- Notes: ${options.issueNotes}`);
+    }
+    lines.push(`- Bundle JSON: \`${toDisplayPath(options.bundlePath, options.cwd)}\``);
+    lines.push('');
+    content = `${content.replace(/\s*$/u, '')}\n\n${lines.join('\n')}\n`;
+    await writeFile(options.issueLogPath, content, 'utf8');
+}
+async function resolveLatestRunContext(options) {
+    const manifestPaths = await collectManifests(options.runsRoot, options.taskFilter ?? undefined);
+    let latest = null;
+    for (const manifestPath of manifestPaths) {
+        const parsed = await parseManifestSnapshot(manifestPath, options.repoRoot);
+        if (!parsed) {
+            continue;
+        }
+        if (!latest || parsed.sort_time_ms > latest.sort_time_ms) {
+            latest = parsed;
+        }
+    }
+    if (!latest) {
+        return null;
+    }
+    return {
+        task_id: latest.task_id,
+        run_id: latest.run_id,
+        pipeline_id: latest.pipeline_id,
+        status: latest.status,
+        status_detail: latest.status_detail,
+        summary: latest.summary,
+        manifest_path: latest.manifest_path,
+        log_path: latest.log_path,
+        cloud_fallback_reason: latest.cloud_fallback_reason,
+        cloud_fallback_issue_codes: latest.cloud_fallback_issue_codes,
+        cloud_execution_status: latest.cloud_execution_status,
+        cloud_execution_task_id: latest.cloud_execution_task_id,
+        cloud_execution_status_url: latest.cloud_execution_status_url
+    };
+}
+async function parseManifestSnapshot(manifestPath, repoRoot) {
+    try {
+        const raw = await readFile(manifestPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        const fallbackIssuesRaw = parsed.cloud_fallback && typeof parsed.cloud_fallback === 'object'
+            ? parsed.cloud_fallback.issues
+            : null;
+        const fallbackIssueCodes = Array.isArray(fallbackIssuesRaw)
+            ? fallbackIssuesRaw
+                .map((issue) => {
+                if (!issue || typeof issue !== 'object') {
+                    return null;
+                }
+                const code = issue.code;
+                return typeof code === 'string' && code.trim().length > 0 ? code.trim() : null;
+            })
+                .filter((code) => Boolean(code))
+            : [];
+        const cloudFallbackReason = parsed.cloud_fallback && typeof parsed.cloud_fallback === 'object'
+            ? normalizeText(parsed.cloud_fallback.reason)
+            : null;
+        const cloudExecution = parsed.cloud_execution && typeof parsed.cloud_execution === 'object'
+            ? parsed.cloud_execution
+            : null;
+        const runId = normalizeText(parsed.run_id) ?? basename(dirname(manifestPath));
+        const startedAtMs = Date.parse(String(parsed.started_at ?? ''));
+        const sortTimeMs = Number.isFinite(startedAtMs) && startedAtMs > 0
+            ? startedAtMs
+            : parseRunIdTimestamp(runId)?.getTime() ?? 0;
+        return {
+            task_id: normalizeText(parsed.task_id) ?? 'unknown-task',
+            run_id: runId,
+            pipeline_id: normalizeText(parsed.pipeline_id) ?? 'unknown-pipeline',
+            status: normalizeText(parsed.status) ?? 'unknown',
+            status_detail: normalizeText(parsed.status_detail),
+            summary: normalizeText(parsed.summary),
+            manifest_path: toRepoRelativePath(manifestPath, repoRoot),
+            log_path: normalizeText(parsed.log_path),
+            cloud_fallback_reason: cloudFallbackReason,
+            cloud_fallback_issue_codes: fallbackIssueCodes,
+            cloud_execution_status: normalizeText(cloudExecution?.status),
+            cloud_execution_task_id: normalizeText(cloudExecution?.task_id),
+            cloud_execution_status_url: normalizeText(cloudExecution?.status_url),
+            sort_time_ms: sortTimeMs
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeArtifactTaskId(value) {
+    const normalized = normalizeText(value);
+    if (!normalized) {
+        return 'issue-log';
+    }
+    const safe = normalized.replace(/[^A-Za-z0-9._-]+/gu, '-').replace(/^-+|-+$/gu, '');
+    return safe.length > 0 ? safe : 'issue-log';
+}
+function formatIssueId(iso) {
+    const compact = iso
+        .replace(/\.\d{3}Z$/u, '')
+        .replace(/[-:]/gu, '')
+        .replace('T', '-');
+    return `CO-${compact}`;
+}
+function toCompactTimestamp(iso) {
+    return iso.replace(/[-:.]/gu, '').replace(/Z$/u, 'Z');
+}
+function slugify(value) {
+    const normalized = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/gu, '-')
+        .replace(/^-+|-+$/gu, '');
+    if (!normalized) {
+        return 'issue';
+    }
+    return normalized.slice(0, 48);
+}
+function toRepoRelativePath(pathValue, repoRoot) {
+    const rel = relative(repoRoot, pathValue);
+    if (!rel || rel.startsWith('..')) {
+        return pathValue;
+    }
+    return rel.replace(/\\/gu, '/');
+}
+function toDisplayPath(pathValue, cwd) {
+    const rel = relative(cwd, pathValue);
+    if (!rel || rel.startsWith('..')) {
+        return pathValue;
+    }
+    return rel.replace(/\\/gu, '/');
+}
+function normalizeText(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}

package/dist/orchestrator/src/cli/init.js

@@ -2,6 +2,8 @@ import { copyFile, mkdir, readdir, stat } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 import { findPackageRoot } from './utils/packageInfo.js';
+const CODEX_TEMPLATE = 'codex';
+const CODEX_PIPELINE_CONFIG = 'codex.orchestrator.json';
 export async function initCodexTemplates(options) {
     const root = findPackageRoot();
     const templateRoot = join(root, 'templates', options.template);
@@ -13,6 +15,13 @@ export async function initCodexTemplates(options) {
         written,
         skipped
     });
+    if (options.template === CODEX_TEMPLATE) {
+        await copyTemplateFile(join(root, CODEX_PIPELINE_CONFIG), join(options.cwd, CODEX_PIPELINE_CONFIG), {
+            force: options.force,
+            written,
+            skipped
+        });
+    }
     return { written, skipped, templateRoot };
 }
 async function assertDirectory(path) {
@@ -43,6 +52,19 @@ async function copyTemplateDir(sourceDir, targetDir, options) {
         options.written.push(targetPath);
     }
 }
+async function copyTemplateFile(sourcePath, targetPath, options) {
+    const info = await stat(sourcePath).catch(() => null);
+    if (!info || !info.isFile()) {
+        throw new Error(`Template file not found: ${sourcePath}`);
+    }
+    if (existsSync(targetPath) && !options.force) {
+        options.skipped.push(targetPath);
+        return;
+    }
+    await mkdir(dirname(targetPath), { recursive: true });
+    await copyFile(sourcePath, targetPath);
+    options.written.push(targetPath);
+}
 export function formatInitSummary(result, cwd) {
     const lines = [];
     if (result.written.length > 0) {
@@ -61,6 +83,7 @@ export function formatInitSummary(result, cwd) {
         lines.push('No files written.');
     }
     lines.push('Next steps (recommended):');
+    lines.push('  - Review codex.orchestrator.json and adjust pipeline commands to your repository toolchain');
     lines.push('  - codex-orchestrator setup --yes  # installs bundled skills + configures delegation/devtools wiring');
     lines.push('  - codex-orchestrator codex setup  # optional managed/pinned Codex CLI (activate with CODEX_CLI_USE_MANAGED=1; stock codex is default)');
     return lines;

package/dist/orchestrator/src/cli/orchestrator.js

@@ -24,6 +24,7 @@ import { SchedulerService } from './services/schedulerService.js';
 import { applyHandlesToRunSummary, applyPrivacyToRunSummary, applyCloudExecutionToRunSummary, applyCloudFallbackToRunSummary, applyUsageKpiToRunSummary, persistRunSummary } from './services/runSummaryWriter.js';
 import { prepareRun, resolvePipelineForResume, overrideTaskEnvironment } from './services/runPreparation.js';
 import { loadPackageConfig, loadUserConfig } from './config/userConfig.js';
+import { formatRepoConfigRequiredError, isRepoConfigRequired } from './config/repoConfigPolicy.js';
 import { loadDelegationConfigFiles, computeEffectiveDelegationConfig, parseDelegationConfigOverride, splitDelegationConfigOverrides } from './config/delegationConfig.js';
 import { ControlServer } from './control/controlServer.js';
 import { RunEventEmitter, RunEventPublisher, snapshotStages } from './events/runEvents.js';
@@ -240,6 +241,9 @@ export class CodexOrchestrator {
             approvalPolicy: options.approvalPolicy ?? null,
             planTargetId: preparation.planPreview?.targetId ?? preparation.plannerTargetId ?? null
         });
+        if (preparation.configNotice) {
+            appendSummary(manifest, preparation.configNotice);
+        }
         const persister = new ManifestPersister({
             manifest,
             paths,
@@ -337,8 +341,12 @@ export class CodexOrchestrator {
         const actualEnv = overrideTaskEnvironment(env, manifest.task_id);
         const resolver = new PipelineResolver();
         const designConfig = await resolver.loadDesignConfig(actualEnv.repoRoot);
-        const userConfig = await loadUserConfig(actualEnv);
-        const fallbackConfig = manifest.pipeline_id === 'rlm' && userConfig?.source === 'repo'
+        const repoConfigRequired = isRepoConfigRequired(process.env);
+        const userConfig = await loadUserConfig(actualEnv, { allowPackageFallback: !repoConfigRequired });
+        if (repoConfigRequired && userConfig?.source !== 'repo') {
+            throw new Error(formatRepoConfigRequiredError(actualEnv.repoRoot));
+        }
+        const fallbackConfig = !repoConfigRequired && manifest.pipeline_id === 'rlm' && userConfig?.source === 'repo'
             ? await loadPackageConfig(actualEnv)
             : null;
         const pipeline = resolvePipelineForResume(actualEnv, manifest, userConfig, fallbackConfig);
@@ -360,6 +368,9 @@ export class CodexOrchestrator {
             planTargetFallback: manifest.plan_target_id ?? null,
             envOverrides
         });
+        if (preparation.configNotice && !(manifest.summary ?? '').includes(preparation.configNotice)) {
+            appendSummary(manifest, preparation.configNotice);
+        }
         manifest.plan_target_id = preparation.planPreview?.targetId ?? preparation.plannerTargetId ?? null;
         const persister = new ManifestPersister({
             manifest,
@@ -1028,7 +1039,12 @@ export class CodexOrchestrator {
                         branch,
                         enableFeatures,
                         disableFeatures,
-                        env: cloudEnvOverrides
+                        env: cloudEnvOverrides,
+                        onUpdate: async (cloudExecution) => {
+                            manifest.cloud_execution = cloudExecution;
+                            targetEntry.log_path = cloudExecution.log_path;
+                            await schedulePersist({ manifest: true, force: true });
+                        }
                     });
                     success = cloudResult.success;
                     notes.push(...cloudResult.notes);

package/dist/orchestrator/src/cli/services/pipelineResolver.js

@@ -3,64 +3,116 @@ import { loadPackageConfig, loadUserConfig } from '../config/userConfig.js';
 import { resolvePipeline } from '../pipelines/index.js';
 import { loadDesignConfig, shouldActivateDesignPipeline, designPipelineId } from '../../../../packages/shared/config/index.js';
 import { logger } from '../../logger.js';
+import { formatRepoConfigRequiredError, isRepoConfigRequired } from '../config/repoConfigPolicy.js';
 const DEVTOOLS_PIPELINE_ALIASES = new Map([
     ['implementation-gate-devtools', 'implementation-gate'],
     ['frontend-testing-devtools', 'frontend-testing']
 ]);
 export class PipelineResolver {
-    async loadDesignConfig(rootDir) {
+    logInfo(message, quiet) {
+        if (!quiet) {
+            logger.info(message);
+        }
+    }
+    logWarn(message, quiet) {
+        if (!quiet) {
+            logger.warn(message);
+        }
+    }
+    logError(message, quiet) {
+        if (!quiet) {
+            logger.error(message);
+        }
+    }
+    async loadDesignConfig(rootDir, quiet = false) {
         const designConfig = await loadDesignConfig({ rootDir });
         if (designConfig.warnings.length > 0) {
             for (const warning of designConfig.warnings) {
-                logger.warn(`[design-config] ${warning}`);
+                this.logWarn(`[design-config] ${warning}`, quiet);
             }
         }
         return designConfig;
     }
     async resolve(env, options) {
-        logger.info(`PipelineResolver.resolve start for ${options.pipelineId ?? '<default>'}`);
-        const designConfig = await this.loadDesignConfig(env.repoRoot);
-        logger.info(`PipelineResolver.resolve loaded design config from ${designConfig.path}`);
-        const userConfig = await loadUserConfig(env);
-        logger.info(`PipelineResolver.resolve loaded user config`);
+        const quiet = options.quiet === true;
+        const runtimeEnv = options.processEnv ?? process.env;
+        this.logInfo(`PipelineResolver.resolve start for ${options.pipelineId ?? '<default>'}`, quiet);
+        const designConfig = await this.loadDesignConfig(env.repoRoot, quiet);
+        if (designConfig.exists) {
+            this.logInfo(`[design-config] loaded repo file at ${designConfig.path}`, quiet);
+        }
+        else {
+            this.logInfo(`[design-config] using defaults (missing file at ${designConfig.path})`, quiet);
+        }
+        const repoConfigRequired = isRepoConfigRequired(runtimeEnv);
+        const userConfig = await loadUserConfig(env, { allowPackageFallback: !repoConfigRequired, quiet });
+        if (repoConfigRequired && userConfig?.source !== 'repo') {
+            throw new Error(formatRepoConfigRequiredError(env.repoRoot));
+        }
+        let configNotice = null;
+        if (userConfig?.source === 'package') {
+            configNotice =
+                'Using packaged fallback codex.orchestrator.json (compatibility path). ' +
+                    'Run `codex-orchestrator init codex` to pin repo-local config.';
+            this.logWarn(`[codex-config] ${configNotice}`, quiet);
+        }
+        else if (userConfig?.source === 'repo') {
+            this.logInfo('[codex-config] Using repo-local codex.orchestrator.json.', quiet);
+        }
+        else {
+            this.logWarn('[codex-config] No codex.orchestrator.json found in repo or package.', quiet);
+        }
         const pipelineCandidate = options.pipelineId ??
             (shouldActivateDesignPipeline(designConfig) ? designPipelineId(designConfig) : undefined);
         const resolvedAlias = this.resolvePipelineAlias(pipelineCandidate);
         const requestedPipelineId = resolvedAlias.pipelineId;
-        const envOverrides = this.resolveDesignEnvOverrides(designConfig, requestedPipelineId);
+        const envOverrides = this.resolveDesignEnvOverrides(designConfig, requestedPipelineId, runtimeEnv);
         if (resolvedAlias.devtoolsRequested) {
             envOverrides.CODEX_REVIEW_DEVTOOLS = '1';
-            logger.warn(`[pipeline] ${resolvedAlias.aliasId} is deprecated; use ${requestedPipelineId} with CODEX_REVIEW_DEVTOOLS=1.`);
+            this.logWarn(`[pipeline] ${resolvedAlias.aliasId} is deprecated; use ${requestedPipelineId} with CODEX_REVIEW_DEVTOOLS=1.`, quiet);
         }
         try {
             const { pipeline, source } = resolvePipeline(env, {
                 pipelineId: requestedPipelineId,
                 config: userConfig
             });
-            logger.info(`PipelineResolver.resolve selected pipeline ${pipeline.id}`);
-            return { pipeline, userConfig, designConfig, source, envOverrides };
+            this.logInfo(`PipelineResolver.resolve selected pipeline ${pipeline.id}`, quiet);
+            return { pipeline, userConfig, designConfig, source, configNotice, envOverrides };
         }
         catch (error) {
-            if (requestedPipelineId === 'rlm' && userConfig?.source === 'repo') {
-                const packageConfig = await loadPackageConfig(env);
+            if (requestedPipelineId === 'rlm' && userConfig?.source === 'repo' && repoConfigRequired) {
+                throw new Error('Repo-local codex.orchestrator.json is missing the rlm pipeline while strict repo-config mode is enabled.');
+            }
+            if (requestedPipelineId === 'rlm' && userConfig?.source === 'repo' && !repoConfigRequired) {
+                const packageConfig = await loadPackageConfig(env, { quiet });
                 if (packageConfig) {
+                    const fallbackNotice = 'Repo config is missing the rlm pipeline; using packaged fallback pipeline for compatibility. ' +
+                        'Add rlm to your repo-local codex.orchestrator.json to avoid fallback.';
+                    this.logWarn(`[codex-config] ${fallbackNotice}`, quiet);
                     const { pipeline, source } = resolvePipeline(env, {
                         pipelineId: requestedPipelineId,
                         config: packageConfig
                     });
-                    logger.info(`PipelineResolver.resolve selected package pipeline ${pipeline.id}`);
-                    return { pipeline, userConfig: packageConfig, designConfig, source, envOverrides };
+                    this.logInfo(`PipelineResolver.resolve selected package pipeline ${pipeline.id}`, quiet);
+                    return {
+                        pipeline,
+                        userConfig: packageConfig,
+                        designConfig,
+                        source,
+                        configNotice: fallbackNotice,
+                        envOverrides
+                    };
                 }
             }
-            logger.error(`PipelineResolver.resolve failed for ${requestedPipelineId ?? '<default>'}: ${error.message}`);
+            this.logError(`PipelineResolver.resolve failed for ${requestedPipelineId ?? '<default>'}: ${error.message}`, quiet);
             throw error;
         }
     }
-    resolveDesignEnvOverrides(designConfig, pipelineId) {
+    resolveDesignEnvOverrides(designConfig, pipelineId, runtimeEnv = process.env) {
         const envOverrides = {
             DESIGN_CONFIG_PATH: designConfig.path
         };
-        if (pipelineId === designPipelineId(designConfig) && process.env.DESIGN_PIPELINE === undefined) {
+        if (pipelineId === designPipelineId(designConfig) && runtimeEnv.DESIGN_PIPELINE === undefined) {
             envOverrides.DESIGN_PIPELINE = '1';
         }
         return envOverrides;

package/dist/orchestrator/src/cli/services/runPreparation.js

@@ -36,6 +36,7 @@ export async function prepareRun(options) {
         ? {
             pipeline: options.pipeline,
             source: options.pipelineSource ?? null,
+            configNotice: options.configNotice ?? null,
             envOverrides: options.envOverrides ?? {}
         }
         : await resolver.resolve(env, { pipelineId: options.pipelineId });
@@ -53,6 +54,7 @@ export async function prepareRun(options) {
         env,
         pipeline: resolvedPipeline.pipeline,
         pipelineSource: resolvedPipeline.source ?? null,
+        configNotice: resolvedPipeline.configNotice ?? null,
         envOverrides: resolvedPipeline.envOverrides ?? {},
         planner,
         plannerTargetId: planPreview?.targetId ?? targetId,

package/dist/orchestrator/src/cli/utils/commandPreview.js

@@ -0,0 +1,10 @@
+const SAFE_COMMAND_PREVIEW_TOKEN = /^[A-Za-z0-9_./:@=-]+$/u;
+export function quoteCommandPreviewToken(value) {
+    if (SAFE_COMMAND_PREVIEW_TOKEN.test(value)) {
+        return value;
+    }
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export function buildCommandPreview(command, args) {
+    return [quoteCommandPreviewToken(command), ...args.map((arg) => quoteCommandPreviewToken(arg))].join(' ');
+}

package/dist/orchestrator/src/cli/utils/devtools.js

@@ -4,6 +4,7 @@ import process from 'node:process';
 import { EnvUtils } from '../../../../packages/shared/config/env.js';
 import { resolveCodexCliBin } from './codexCli.js';
 import { resolveCodexHome } from './codexPaths.js';
+import { buildCommandPreview } from './commandPreview.js';
 export const DEVTOOLS_SKILL_NAME = 'chrome-devtools';
 export const DEVTOOLS_CONFIG_OVERRIDE = 'mcp_servers.chrome-devtools.enabled=true';
 const CONFIG_OVERRIDE_ENV_KEYS = ['CODEX_MCP_CONFIG_OVERRIDES', 'CODEX_CONFIG_OVERRIDES'];
@@ -77,7 +78,7 @@ export function buildDevtoolsSetupPlan(env = process.env) {
         configPath,
         command,
         args,
-        commandLine: [command, ...args].join(' '),
+        commandLine: buildCommandPreview(command, args),
         configSnippet: DEVTOOLS_CONFIG_SNIPPET
     };
 }