@lifeaitools/clauth 1.30.23 → 1.30.24

package/.clauth-skill/SKILL.md

@@ -9,49 +9,49 @@ Hardware-bound credential vault for the LIFEAI stack. Your machine is the second
 
 ---
 
-## How Claude Interfaces with clauth
-
-> **CRITICAL:** Agents should use the local daemon for credential discovery and
-> exact secret retrieval. Do not ask the user for the vault password just to get
-> a key, do not use interactive prompts, and do not walk every service.
-
-### Method 1 — Local daemon (preferred for agents)
-
-Discover services without reading secrets:
-
-```bash
-curl -s http://127.0.0.1:52437/ping
-curl -s http://127.0.0.1:52437/knowledge
-curl -s http://127.0.0.1:52437/list-services
-```
-
-Retrieve exactly one credential only when the next command needs it:
-
-```bash
-curl -s http://127.0.0.1:52437/v/<service>
-```
-
-`/knowledge` is safe to cache for a session: it returns service metadata and
-`has_key`, but no raw secrets and no Vault secret names. `/status` uses the same
-short metadata cache and can be forced with `?refresh=1`.
-
-### Method 2 — CLI with `--pw` flag (admin/setup only)
-
-All clauth commands accept `-p` / `--pw <password>` to skip the interactive
-password prompt. Use this for local admin/setup tasks, not routine agent secret
-retrieval:
-
-```bash
-clauth status -p "YourPassword"
-clauth test -p "YourPassword"
-clauth enable github -p "YourPassword"
-clauth write key github -p "YourPassword"   # still prompts for the key value
-```
-
-### Method 3 — Direct API calls (implementation/debugging only)
-
-Call the auth-vault Edge Function directly only when debugging clauth internals.
-Normal agents should not bypass the daemon metadata cache.
+## How Claude Interfaces with clauth
+
+> **CRITICAL:** Agents should use the local daemon for credential discovery and
+> exact secret retrieval. Do not ask the user for the vault password just to get
+> a key, do not use interactive prompts, and do not walk every service.
+
+### Method 1 — Local daemon (preferred for agents)
+
+Discover services without reading secrets:
+
+```bash
+curl -s http://127.0.0.1:52437/ping
+curl -s http://127.0.0.1:52437/knowledge
+curl -s http://127.0.0.1:52437/list-services
+```
+
+Retrieve exactly one credential only when the next command needs it:
+
+```bash
+curl -s http://127.0.0.1:52437/v/<service>
+```
+
+`/knowledge` is safe to cache for a session: it returns service metadata and
+`has_key`, but no raw secrets and no Vault secret names. `/status` uses the same
+short metadata cache and can be forced with `?refresh=1`.
+
+### Method 2 — CLI with `--pw` flag (admin/setup only)
+
+All clauth commands accept `-p` / `--pw <password>` to skip the interactive
+password prompt. Use this for local admin/setup tasks, not routine agent secret
+retrieval:
+
+```bash
+clauth status -p "YourPassword"
+clauth test -p "YourPassword"
+clauth enable github -p "YourPassword"
+clauth write key github -p "YourPassword"   # still prompts for the key value
+```
+
+### Method 3 — Direct API calls (implementation/debugging only)
+
+Call the auth-vault Edge Function directly only when debugging clauth internals.
+Normal agents should not bypass the daemon metadata cache.
 
 **Base URL:** `https://<project-ref>.supabase.co/functions/v1/auth-vault`
 **Auth header:** `Authorization: Bearer <supabase-anon-key>`
@@ -97,12 +97,12 @@ const timestamp = window * windowMs;
 
 All auth routes require: `machine_hash`, `token`, `timestamp`, `password`.
 
-### Password Handling
-
-- Do not ask the user for their clauth password for routine credential lookup
-- Use the unlocked local daemon whenever possible
-- Never log or echo the password
-- If the daemon is locked, ask the user to unlock `http://127.0.0.1:52437`
+### Password Handling
+
+- Do not ask the user for their clauth password for routine credential lookup
+- Use the unlocked local daemon whenever possible
+- Never log or echo the password
+- If the daemon is locked, ask the user to unlock `http://127.0.0.1:52437`
 
 ---
 
@@ -165,14 +165,14 @@ See `references/keys-guide.md` for where to find every credential.
 ```
 clauth install [--ref R] [--pat P]     First-time: provision Supabase + install skill
 clauth setup [--admin-token T] [-p P]  Register this machine
-clauth status [-p P]                   All services + state
-clauth test [-p P]                     Verify HMAC connection
-clauth list [-p P]                     Service names
-clauth search <query> [-p P]           Search names and metadata
-clauth search <query> --addresses [-p P]
-                                      Also search redacted address hints (may read multiple secrets)
-
-clauth write key <service> [-p P]      Store a credential
+clauth status [-p P]                   All services + state
+clauth test [-p P]                     Verify HMAC connection
+clauth list [-p P]                     Service names
+clauth search <query> [-p P]           Search names and metadata
+clauth search <query> --addresses [-p P]
+                                      Also search redacted address hints (may read multiple secrets)
+
+clauth write key <service> [-p P]      Store a credential
 clauth write pw [-p P]                 Change password
 clauth enable <svc|all> [-p P]         Activate service
 clauth disable <svc|all> [-p P]        Suspend service
@@ -201,65 +201,65 @@ Service type `fileserver` — mount configuration for fs tools (UI-only config).
 
 ---
 
-## Daemon Metadata Cache
-
-When discovering service names, do not retrieve secrets. Use the daemon metadata
-cache:
-
-```bash
-curl -s http://127.0.0.1:52437/knowledge
-curl -s http://127.0.0.1:52437/list-services
-```
-
-`/knowledge` is agent-safe: it returns service metadata and `has_key`, but no
-raw secrets and no Vault secret names. Fetch `GET /v/<service>` only for the one
-exact credential needed by the next command. Never walk every service and never
-bulk-fetch all secrets.
-
-## MCP Server (v1.16.9+)
-
-clauth runs as an MCP server with five namespaced paths and safe
-credential-discovery tools:
-
-| Path | Namespace | Tools |
-|------|-----------|-------|
-| `/clauth` | `clauth_*` + runtime helpers | 23 default live tools, including `clauth_knowledge` |
-| `/gws` | `gws_*` | 6 Google Workspace tools |
-| `/fs` | `fs_*` | 20 filesystem and git-safe file tools |
-| `/chitchat` | `chitchat_*` | 7 collaboration relay tools |
-| `/codevelop` | `codevelop_*` | 7 peer development tools |
-| `/mcp` | all | 63 tools combined |
-
-The default live `/clauth` surface includes credential tools plus
-`call_agent`, `monkey_dispatch`, `handoff_start`, `terminal_*`, and `channel_*`.
-Admin write tools are gated by write-mode.
+## Daemon Metadata Cache
+
+When discovering service names, do not retrieve secrets. Use the daemon metadata
+cache:
+
+```bash
+curl -s http://127.0.0.1:52437/knowledge
+curl -s http://127.0.0.1:52437/list-services
+```
+
+`/knowledge` is agent-safe: it returns service metadata and `has_key`, but no
+raw secrets and no Vault secret names. Fetch `GET /v/<service>` only for the one
+exact credential needed by the next command. Never walk every service and never
+bulk-fetch all secrets.
+
+## MCP Server (v1.16.9+)
+
+clauth runs as an MCP server with five namespaced paths and safe
+credential-discovery tools:
+
+| Path | Namespace | Tools |
+|------|-----------|-------|
+| `/clauth` | `clauth_*` + runtime helpers | 23 default live tools, including `clauth_knowledge` |
+| `/gws` | `gws_*` | 6 Google Workspace tools |
+| `/fs` | `fs_*` | 20 filesystem and git-safe file tools |
+| `/chitchat` | `chitchat_*` | 7 collaboration relay tools |
+| `/codevelop` | `codevelop_*` | 7 peer development tools |
+| `/mcp` | all | 63 tools combined |
+
+The default live `/clauth` surface includes credential tools plus
+`call_agent`, `monkey_dispatch`, `handoff_start`, `terminal_*`, and `channel_*`.
+Admin write tools are gated by write-mode.
 
 ### claude.ai Connector URLs (noauth mode)
-- `https://clauth.regendevcorp.com/clauth` — credential tools
-- `https://clauth.regendevcorp.com/gws` — Google Workspace
-- `https://clauth.regendevcorp.com/chitchat` — collaboration relay tools
-- `https://clauth.regendevcorp.com/codevelop` — peer development tools
-- `https://fs.regendevcorp.com/fs` — filesystem tools
-
-Noauth mode: fresh domains that return 404 on OAuth endpoints. claude.ai connects directly (Anthropic OAuth proxy bug workaround).
-
-Use `clauth_knowledge` or `clauth_status` for discovery. Use `clauth_get` only
-for one exact secret. `clauth_search` is metadata-only by default; pass
-`addresses: true` only when redacted address hints are intentionally needed.
-`clauth_inject` is guarded against accidental bulk vault sweeps.
-
-### FS Tools
-`fs_read` `fs_write` `fs_stat` `fs_append` `fs_write_chunk` `fs_ingest_url`
-`fs_import_git_files` `fs_list` `fs_grep` `fs_glob` `fs_delete` `fs_mkdir`
-`fs_edit` `fs_move` `fs_copy` `fs_mounts` `fs_repo_status` `fs_use_branch`
-`fs_commit` `fs_diff`
+- `https://clauth.regendevcorp.com/clauth` — credential tools
+- `https://clauth.regendevcorp.com/gws` — Google Workspace
+- `https://clauth.regendevcorp.com/chitchat` — collaboration relay tools
+- `https://clauth.regendevcorp.com/codevelop` — peer development tools
+- `https://fs.regendevcorp.com/fs` — filesystem tools
+
+Noauth mode: fresh domains that return 404 on OAuth endpoints. claude.ai connects directly (Anthropic OAuth proxy bug workaround).
+
+Use `clauth_knowledge` or `clauth_status` for discovery. Use `clauth_get` only
+for one exact secret. `clauth_search` is metadata-only by default; pass
+`addresses: true` only when redacted address hints are intentionally needed.
+`clauth_inject` is guarded against accidental bulk vault sweeps.
+
+### FS Tools
+`fs_read` `fs_write` `fs_stat` `fs_append` `fs_write_chunk` `fs_ingest_url`
+`fs_import_git_files` `fs_list` `fs_grep` `fs_glob` `fs_delete` `fs_mkdir`
+`fs_edit` `fs_move` `fs_copy` `fs_mounts` `fs_repo_status` `fs_use_branch`
+`fs_commit` `fs_diff`
 
 Path-jail security: all paths resolved against mount root. Permission flags (r/w/d) per mount. Uses `@vscode/ripgrep` for grep, `fast-glob` for glob.
 
-### Testing
-```bash
-node test-tools.mjs    # MCP tool execution smoke tests
-```
+### Testing
+```bash
+node test-tools.mjs    # MCP tool execution smoke tests
+```
 
 ---
 

package/README.md

@@ -4,6 +4,31 @@ Hardware-bound credential vault for the LIFEAI stack. Your machine is the second
 
 ---
 
+## Scope — what clauth is, and is not
+
+clauth has exactly two jobs: it is the **credential vault** and the **SSH/box
+entry point** for the LIFEAI stack. Every other capability documented below —
+filesystem tools, collab relay, TinTin agent-session setup — exists in
+service of those two jobs: vaulting secrets and getting an authenticated
+session onto a machine.
+
+**clauth is not, and must never become:**
+- a message broker or pub/sub relay between apps or agents
+- a job queue (create/status/kill/dispatch semantics for long-running work)
+- a backend for another application's UI
+
+A feature that needs durable state, ownership/lifecycle semantics, or
+app-shaped query patterns belongs in that app's own datastore — not bolted
+onto the vault daemon. This boundary has been tested and held twice in one
+short stretch: a proposal to build a message-board feature inside clauth was
+rejected outright, and an existing thin dispatch proxy (job
+create/status/kill routed through clauth) is being extracted to its own
+backing store, leaving clauth to do only authentication and secret delivery
+on that path. If a new clauth feature proposal looks like either of those,
+it almost certainly belongs somewhere else.
+
+---
+
 ## Install
 
 ```bash

package/cli/api.classify.test.js

@@ -1,75 +1,75 @@
-// cli/api.classify.test.js
-// Regression tests for backend/external-resource error classification.
-//
-// WHY THIS EXISTS: on 2026-06-19 a saturated Postgres database made every
-// auth-vault verify call time out. clauth counted each timeout as an
-// authentication failure ([AUTH FAIL n/10]), hit the strike ceiling, and
-// hard-locked the vault — turning a transient DB blip into a full lockout that
-// blocked Claude/Codex from starting. A database timeout, a 5xx, a network
-// drop, or a rate-limit is NOT a wrong password and must never take a strike.
-// These tests pin that classification so the regression can't return.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import {
-  VaultBackendError,
-  classifyBackendError,
-  classifyServerReason,
-} from "./api.js";
-
-test("VaultBackendError marks failures as non-strike + retriable", () => {
-  const e = new VaultBackendError("timeout", "no response", { status: 504, detail: "abort" });
-  assert.equal(e.kind, "timeout");
-  assert.equal(e.isBackend, true);
-  assert.equal(e.retriable, true);
-  assert.equal(e.status, 504);
-  assert.ok(e instanceof Error);
-});
-
-test("classifyBackendError: AbortSignal.timeout shapes => 'timeout'", () => {
-  // This is the exact error that slipped through the old substring check.
-  assert.equal(classifyBackendError({ name: "TimeoutError", message: "The operation was aborted due to timeout" }), "timeout");
-  assert.equal(classifyBackendError({ name: "AbortError", message: "This operation was aborted" }), "timeout");
-  assert.equal(classifyBackendError(new Error("request timed out")), "timeout");
-});
-
-test("classifyBackendError: network/transport shapes => 'network'", () => {
-  assert.equal(classifyBackendError(new Error("fetch failed")), "network");
-  assert.equal(classifyBackendError(new Error("connect ECONNREFUSED 127.0.0.1:443")), "network");
-  assert.equal(classifyBackendError(new Error("getaddrinfo ENOTFOUND db.supabase.co")), "network");
-  assert.equal(classifyBackendError(new Error("read ECONNRESET")), "network");
-});
-
-test("classifyBackendError: a typed VaultBackendError passes its kind through", () => {
-  assert.equal(classifyBackendError(new VaultBackendError("rate_limited", "slow down")), "rate_limited");
-  assert.equal(classifyBackendError(new VaultBackendError("db_error", "pool exhausted")), "db_error");
-});
-
-test("classifyBackendError: a genuine credential error is NOT a backend error", () => {
-  assert.equal(classifyBackendError(new Error("Wrong password")), null);
-  assert.equal(classifyBackendError(new Error("invalid_token")), null);
-  assert.equal(classifyBackendError(null), null);
-  assert.equal(classifyBackendError(undefined), null);
-});
-
-test("classifyServerReason: rate-limit reasons => 'rate_limited'", () => {
-  assert.equal(classifyServerReason("rate_limited"), "rate_limited");
-  assert.equal(classifyServerReason("Rate limit: 38/30 per 60s"), "rate_limited");
-});
-
-test("classifyServerReason: database/backend reasons => 'db_error'", () => {
-  assert.equal(classifyServerReason("canceling statement due to statement timeout"), "db_error");
-  assert.equal(classifyServerReason("database connection pool exhausted"), "db_error");
-  assert.equal(classifyServerReason("internal server error"), "db_error");
-  assert.equal(classifyServerReason("service unavailable"), "db_error");
-});
-
-test("classifyServerReason: genuine auth verdicts are NOT backend errors (they strike)", () => {
-  assert.equal(classifyServerReason("invalid_token (3/5)"), null);
-  assert.equal(classifyServerReason("machine_locked"), null);
-  assert.equal(classifyServerReason("machine_disabled"), null);
-  assert.equal(classifyServerReason("machine_not_found"), null);
-  assert.equal(classifyServerReason("wrong_password"), null);
-  assert.equal(classifyServerReason(null), null);
-  assert.equal(classifyServerReason(""), null);
-});
+// cli/api.classify.test.js
+// Regression tests for backend/external-resource error classification.
+//
+// WHY THIS EXISTS: on 2026-06-19 a saturated Postgres database made every
+// auth-vault verify call time out. clauth counted each timeout as an
+// authentication failure ([AUTH FAIL n/10]), hit the strike ceiling, and
+// hard-locked the vault — turning a transient DB blip into a full lockout that
+// blocked Claude/Codex from starting. A database timeout, a 5xx, a network
+// drop, or a rate-limit is NOT a wrong password and must never take a strike.
+// These tests pin that classification so the regression can't return.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  VaultBackendError,
+  classifyBackendError,
+  classifyServerReason,
+} from "./api.js";
+
+test("VaultBackendError marks failures as non-strike + retriable", () => {
+  const e = new VaultBackendError("timeout", "no response", { status: 504, detail: "abort" });
+  assert.equal(e.kind, "timeout");
+  assert.equal(e.isBackend, true);
+  assert.equal(e.retriable, true);
+  assert.equal(e.status, 504);
+  assert.ok(e instanceof Error);
+});
+
+test("classifyBackendError: AbortSignal.timeout shapes => 'timeout'", () => {
+  // This is the exact error that slipped through the old substring check.
+  assert.equal(classifyBackendError({ name: "TimeoutError", message: "The operation was aborted due to timeout" }), "timeout");
+  assert.equal(classifyBackendError({ name: "AbortError", message: "This operation was aborted" }), "timeout");
+  assert.equal(classifyBackendError(new Error("request timed out")), "timeout");
+});
+
+test("classifyBackendError: network/transport shapes => 'network'", () => {
+  assert.equal(classifyBackendError(new Error("fetch failed")), "network");
+  assert.equal(classifyBackendError(new Error("connect ECONNREFUSED 127.0.0.1:443")), "network");
+  assert.equal(classifyBackendError(new Error("getaddrinfo ENOTFOUND db.supabase.co")), "network");
+  assert.equal(classifyBackendError(new Error("read ECONNRESET")), "network");
+});
+
+test("classifyBackendError: a typed VaultBackendError passes its kind through", () => {
+  assert.equal(classifyBackendError(new VaultBackendError("rate_limited", "slow down")), "rate_limited");
+  assert.equal(classifyBackendError(new VaultBackendError("db_error", "pool exhausted")), "db_error");
+});
+
+test("classifyBackendError: a genuine credential error is NOT a backend error", () => {
+  assert.equal(classifyBackendError(new Error("Wrong password")), null);
+  assert.equal(classifyBackendError(new Error("invalid_token")), null);
+  assert.equal(classifyBackendError(null), null);
+  assert.equal(classifyBackendError(undefined), null);
+});
+
+test("classifyServerReason: rate-limit reasons => 'rate_limited'", () => {
+  assert.equal(classifyServerReason("rate_limited"), "rate_limited");
+  assert.equal(classifyServerReason("Rate limit: 38/30 per 60s"), "rate_limited");
+});
+
+test("classifyServerReason: database/backend reasons => 'db_error'", () => {
+  assert.equal(classifyServerReason("canceling statement due to statement timeout"), "db_error");
+  assert.equal(classifyServerReason("database connection pool exhausted"), "db_error");
+  assert.equal(classifyServerReason("internal server error"), "db_error");
+  assert.equal(classifyServerReason("service unavailable"), "db_error");
+});
+
+test("classifyServerReason: genuine auth verdicts are NOT backend errors (they strike)", () => {
+  assert.equal(classifyServerReason("invalid_token (3/5)"), null);
+  assert.equal(classifyServerReason("machine_locked"), null);
+  assert.equal(classifyServerReason("machine_disabled"), null);
+  assert.equal(classifyServerReason("machine_not_found"), null);
+  assert.equal(classifyServerReason("wrong_password"), null);
+  assert.equal(classifyServerReason(null), null);
+  assert.equal(classifyServerReason(""), null);
+});

package/cli/assets/codevelop/launcher-active.cmd.template

@@ -1,20 +1,20 @@
-@echo off
-setlocal
-set "CODEVELOP_SESSION=${SESSION_ID}"
-set "CODEVELOP_PEER=${PEER}"
-set "CODEVELOP_TARGET=${TARGET_PEER}"
-set "CODEVELOP_BASE_URL=${BASE_URL}"
-set "CODEVELOP_MANIFEST=${MANIFEST}"
-set "CODEVELOP_CONTEXT=${CONTEXT_FILE}"
-set "CELL_ROLE=codevelop-${PEER}"
-cd /d "${CWD}"
-if /i "%~1"=="--print-only" (
-  echo command: ${PRINT_COMMAND}
-  exit /b 0
-)
-echo Co-develop ${PEER} ready. Session ${SESSION_ID}. Listening for collaboration.
-echo Context: ${CONTEXT_FILE}
-node "${CLAUTH_CLI}" codevelop check-partner --repo "${REPO}" --peer ${PEER}
-${COMMAND}
-set EXITCODE=%ERRORLEVEL%
-endlocal & exit /b %EXITCODE%
+@echo off
+setlocal
+set "CODEVELOP_SESSION=${SESSION_ID}"
+set "CODEVELOP_PEER=${PEER}"
+set "CODEVELOP_TARGET=${TARGET_PEER}"
+set "CODEVELOP_BASE_URL=${BASE_URL}"
+set "CODEVELOP_MANIFEST=${MANIFEST}"
+set "CODEVELOP_CONTEXT=${CONTEXT_FILE}"
+set "CELL_ROLE=codevelop-${PEER}"
+cd /d "${CWD}"
+if /i "%~1"=="--print-only" (
+  echo command: ${PRINT_COMMAND}
+  exit /b 0
+)
+echo Co-develop ${PEER} ready. Session ${SESSION_ID}. Listening for collaboration.
+echo Context: ${CONTEXT_FILE}
+node "${CLAUTH_CLI}" codevelop check-partner --repo "${REPO}" --peer ${PEER}
+${COMMAND}
+set EXITCODE=%ERRORLEVEL%
+endlocal & exit /b %EXITCODE%

package/cli/assets/codevelop/launcher-static.cmd.template

@@ -1,7 +1,7 @@
-@echo off
-if not exist "${ACTIVE_LAUNCHER}" (
-  echo No active co-develop launcher has been written.
-  echo Run: clauth codevelop start --repo "${REPO}" --port ${PORT} --start-isolated-clauth
-  exit /b 1
-)
-call "${ACTIVE_LAUNCHER}" %*
+@echo off
+if not exist "${ACTIVE_LAUNCHER}" (
+  echo No active co-develop launcher has been written.
+  echo Run: clauth codevelop start --repo "${REPO}" --port ${PORT} --start-isolated-clauth
+  exit /b 1
+)
+call "${ACTIVE_LAUNCHER}" %*

package/cli/assets/codevelop/windows-terminal.profiles.json

@@ -1,48 +1,48 @@
-{
-  "profiles": [
-    {
-      "name": "Co Develop Claude",
-      "guid": "{a2f8548f-82e6-44b4-bdbb-d934e8881f01}",
-      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-claude.cmd\"",
-      "startingDirectory": "${REPO}",
-      "environment": {
-        "CELL_ROLE": "codevelop-claude"
-      },
-      "icon": "🔴",
-      "tabColor": "#B91C1C",
-      "colorScheme": "Dimidium"
-    },
-    {
-      "name": "Co Develop Codex",
-      "guid": "{31a52b07-6efd-4b3d-96dd-ded73488140a}",
-      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-codex.cmd\"",
-      "startingDirectory": "${REPO}",
-      "environment": {
-        "CELL_ROLE": "codevelop-codex"
-      },
-      "icon": "🧬",
-      "tabColor": "#0F766E",
-      "colorScheme": "Dimidium"
-    }
-  ],
-  "layout": {
-    "wtArgs": [
-      "-w",
-      "new",
-      "new-tab",
-      "--profile",
-      "Co Develop Claude",
-      "--title",
-      "Co Develop Claude",
-      ";",
-      "split-pane",
-      "-V",
-      "--size",
-      "0.50",
-      "--profile",
-      "Co Develop Codex",
-      "--title",
-      "Co Develop Codex"
-    ]
-  }
-}
+{
+  "profiles": [
+    {
+      "name": "Co Develop Claude",
+      "guid": "{a2f8548f-82e6-44b4-bdbb-d934e8881f01}",
+      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-claude.cmd\"",
+      "startingDirectory": "${REPO}",
+      "environment": {
+        "CELL_ROLE": "codevelop-claude"
+      },
+      "icon": "🔴",
+      "tabColor": "#B91C1C",
+      "colorScheme": "Dimidium"
+    },
+    {
+      "name": "Co Develop Codex",
+      "guid": "{31a52b07-6efd-4b3d-96dd-ded73488140a}",
+      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-codex.cmd\"",
+      "startingDirectory": "${REPO}",
+      "environment": {
+        "CELL_ROLE": "codevelop-codex"
+      },
+      "icon": "🧬",
+      "tabColor": "#0F766E",
+      "colorScheme": "Dimidium"
+    }
+  ],
+  "layout": {
+    "wtArgs": [
+      "-w",
+      "new",
+      "new-tab",
+      "--profile",
+      "Co Develop Claude",
+      "--title",
+      "Co Develop Claude",
+      ";",
+      "split-pane",
+      "-V",
+      "--size",
+      "0.50",
+      "--profile",
+      "Co Develop Codex",
+      "--title",
+      "Co Develop Codex"
+    ]
+  }
+}