@link-assistant/hive-mind 2.7.4 → 2.8.1

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @link-assistant/hive-mind
 
+## 2.8.1
+
+### Patch Changes
+
+- 23a2187: Provision required Codex plugins and Agent Skills in persistent repository-scoped state before solver execution, including Docker propagation and actionable missing-capability diagnostics.
+
+## 2.8.0
+
+### Minor Changes
+
+- 8d02cf6: feat(fix): add `/fix --ci-cd <repository>` command (#1733)
+
+  `/fix --ci-cd` automatically generates and solves a CI/CD remediation issue for
+  a target repository:
+
+  - detects the repository's languages via the GitHub `/languages` API and selects
+    the matching CI/CD templates, ordered by detected language (byte-weighted);
+  - inspects the latest default-branch commit and lists its CI/CD runs in the issue
+    (falling back to the most recent default-branch runs when a release/tag commit
+    has none of its own);
+  - creates the remediation issue reusing the title and description of the standard
+    prompt (web-capture#139), with its retired case-study paragraph permanently
+    replaced by `--development-log` and the paragraphs supplied by `--deep-analysis`
+    omitted when that option is enabled. The issue is created as type `Bug`
+    (best-effort, since issue types are org-scoped) because that is what makes the
+    deep-analysis omission valid, and links to `docs/CI-CD-BEST-PRACTICES.md`;
+  - hands the issue off to `/solve --development-log --deep-analysis --auto-merge`,
+    forwarding every option `/fix` does not consume itself (e.g. `--tool`,
+    `--model`, `--think`);
+  - supports `--dry-run` (preview the issue) and `--no-solve` (create only).
+
+  The command is also available from the Telegram bot as `/fix <repository>`
+  (`--ci-cd` is implied), toggleable with `--no-fix` / `TELEGRAM_FIX=false` and
+  documented in all four locales.
+
+  Also adds the PHP template
+  (`link-foundation/php-ai-driven-development-pipeline-template`) to
+  `docs/CI-CD-BEST-PRACTICES.md` and documents the new "Automatic CI/CD
+  Remediation" flow in all four languages (en/zh/hi/ru).
+
 ## 2.7.4
 
 ### Patch Changes

package/README.hi.md

@@ -210,14 +210,15 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # Extract auth data from a running (or stopped) container to the host:
-mkdir -p ~/.hive-mind
+mkdir -p ~/.hive-mind ~/.hive-mind/agents/skills
 docker cp hive-mind:/home/box/.claude ~/.hive-mind/claude
+docker cp hive-mind:/home/box/.codex ~/.hive-mind/codex
 docker cp hive-mind:/home/box/.claude.json ~/.hive-mind/claude.json
 docker cp hive-mind:/home/box/.config/gh ~/.hive-mind/gh
 
 # Fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/codex ~/.hive-mind/agents ~/.hive-mind/gh
 chown $BOX_UID:$BOX_UID ~/.hive-mind/claude.json
 
 # On subsequent runs, mount the auth data to keep it between restarts:
@@ -225,11 +226,15 @@ docker run -dit \
   --name hive-mind \
   --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
+  -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest
 ```
 
+`codex exec` शुरू होने से पहले Hive Mind issue और उसकी comments में स्पष्ट plugin तथा Agent Skill requirements खोजता है। आवश्यक provider `/home/box/.codex/hive-mind/repositories/<owner>/<repo>` में install होता है, इसलिए configuration restart के बाद भी रहती है और दूसरे repositories को प्रभावित नहीं करती। `/home/box/.agents/skills` के user skills भी Docker-isolated tasks में उपलब्ध होते हैं; capability न मिलने पर preflight AI session से पहले exact identifier और remediation command बताता है।
+
 **Docker के लाभ:**
 
 - ✅ पूर्व-कॉन्फ़िगर Ubuntu 24.04 वातावरण
@@ -532,6 +537,28 @@ message पर `/merge` से reply भी कर सकते हैं जि
 mergeable होने तक wait करता है। Merge-conflict skips अभी भी `--auto-resolve` के
 साथ काम करते हैं।
 
+#### `/fix` - CI/CD स्वतः ठीक करें
+
+```
+/fix <github-repository-url> --ci-cd [options]
+
+Examples:
+/fix https://github.com/owner/repo --ci-cd
+/fix owner/repo --ci-cd --tool codex --model gpt-5.5 --think max
+/fix owner/repo --ci-cd --dry-run
+/fix owner/repo --ci-cd --no-solve
+```
+
+`/fix --ci-cd` लक्ष्य रिपॉज़िटरी की भाषाओं का पता लगाता है, डिफ़ॉल्ट ब्रांच के नवीनतम कमिट और उसके CI/CD रनों
+की जाँच करता है, और स्वचालित रूप से एक CI/CD सुधार issue बनाता है (मानक प्रॉम्प्ट और
+[`docs/CI-CD-BEST-PRACTICES.md`](docs/CI-CD-BEST-PRACTICES.md) के टेम्पलेट्स का उपयोग करके, जिन्हें पहचानी
+गई भाषाओं के अनुसार क्रमबद्ध किया जाता है)। इसके बाद यह issue को
+`/solve --development-log --deep-analysis --auto-merge` को सौंप देता है। हर वह विकल्प जिसे `/fix` स्वयं
+उपयोग नहीं करता (जैसे `--tool`, `--model`, `--think`) `/solve` को अग्रेषित कर दिया जाता है। issue बनाए बिना
+उसका पूर्वावलोकन करने के लिए `--dry-run` का उपयोग करें, या `/solve` शुरू किए बिना केवल issue बनाने के लिए
+`--no-solve` का उपयोग करें। विवरण के लिए
+[स्वचालित CI/CD सुधार](docs/CI-CD-BEST-PRACTICES.md#automatic-cicd-remediation) देखें।
+
 #### `/limits` - उपयोग सीमाएँ दिखाएँ
 
 ```

package/README.md

@@ -213,7 +213,7 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # On the host, create the directories used by the current Docker workflow:
-mkdir -p /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/gh
+mkdir -p /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/agents/skills /root/.hive-mind/gh
 touch -a /root/.hive-mind/claude.json
 
 # In our Docker images HOME=/home/box, so Codex stores its data in /home/box/.codex.
@@ -221,13 +221,14 @@ touch -a /root/.hive-mind/claude.json
 docker run -dit --user box --name hive-mind --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
   -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest bash -l -c 'bash /home/box/start-bot.sh'
 
 # After the first start, fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/agents /root/.hive-mind/gh
 chown $BOX_UID:$BOX_UID /root/.hive-mind/claude.json
 
 # Important: mounted ~/.codex data overrides the image-baked Codex config.
@@ -246,6 +247,8 @@ docker exec -it hive-mind bash -lc 'codex mcp list && codex mcp add playwright -
 
 The Docker image itself now registers Playwright MCP for both Claude and Codex during build, and CI verifies those registrations in the built container. If `codex mcp list` is still empty in a running container, the usual cause is not the published image itself but a mounted `/home/box/.codex` directory from the host that replaces the image's default Codex configuration.
 
+Before `codex exec`, Hive Mind scans the issue and its comments for explicit required plugin selectors and Agent Skill names. It resolves skill providers from Codex's marketplace catalog and installs them under `/home/box/.codex/hive-mind/repositories/<owner>/<repo>`, so enablement persists across restarts without affecting other repositories. Required user skills placed in `/home/box/.agents/skills` are also propagated to Docker-isolated tasks. An unavailable requirement stops before the AI session with the exact capability and a catalog remediation command.
+
 See [docs/DOCKER.md](./docs/DOCKER.md) for advanced Docker usage.
 
 #### Stoping and removing docker container
@@ -551,6 +554,30 @@ request link, such as a previous `/codex ...issues/123` command.
 If a target PR is not finished yet, `/merge` waits for it to become mergeable
 before merging. Merge-conflict skips still work with `--auto-resolve`.
 
+#### `/fix` - Auto-Remediate CI/CD
+
+```
+/fix <github-repository-url> --ci-cd [options]
+
+Examples:
+/fix https://github.com/owner/repo --ci-cd
+/fix owner/repo --ci-cd --tool codex --model gpt-5.5 --think max
+/fix owner/repo --ci-cd --dry-run
+/fix owner/repo --ci-cd --no-solve
+```
+
+`/fix --ci-cd` detects the target repository's languages, inspects the latest
+default-branch commit and its CI/CD runs, and automatically creates a CI/CD
+remediation issue (using the standard prompt and the templates from
+[`docs/CI-CD-BEST-PRACTICES.md`](docs/CI-CD-BEST-PRACTICES.md), sorted by the
+detected languages). It then hands the issue off to
+`/solve --development-log --deep-analysis --auto-merge`. Every option `/fix`
+does not consume itself (e.g. `--tool`, `--model`, `--think`) is forwarded to
+`/solve`. Use `--dry-run` to preview the issue without creating it, or
+`--no-solve` to create the issue without starting `/solve`. See
+[Automatic CI/CD Remediation](docs/CI-CD-BEST-PRACTICES.md#automatic-cicd-remediation)
+for details.
+
 #### `/limits` - Show Usage Limits
 
 ```

package/README.ru.md

@@ -210,14 +210,15 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # Extract auth data from a running (or stopped) container to the host:
-mkdir -p ~/.hive-mind
+mkdir -p ~/.hive-mind ~/.hive-mind/agents/skills
 docker cp hive-mind:/home/box/.claude ~/.hive-mind/claude
+docker cp hive-mind:/home/box/.codex ~/.hive-mind/codex
 docker cp hive-mind:/home/box/.claude.json ~/.hive-mind/claude.json
 docker cp hive-mind:/home/box/.config/gh ~/.hive-mind/gh
 
 # Fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/codex ~/.hive-mind/agents ~/.hive-mind/gh
 chown $BOX_UID:$BOX_UID ~/.hive-mind/claude.json
 
 # On subsequent runs, mount the auth data to keep it between restarts:
@@ -225,11 +226,15 @@ docker run -dit \
   --name hive-mind \
   --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
+  -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest
 ```
 
+Перед запуском `codex exec` Hive Mind ищет явные требования к плагинам и Agent Skills в issue и его комментариях. Нужный провайдер устанавливается в `/home/box/.codex/hive-mind/repositories/<owner>/<repo>`, поэтому конфигурация переживает перезапуски, но не влияет на другие репозитории. Пользовательские навыки из `/home/box/.agents/skills` также передаются в Docker-изолированные задачи; если capability недоступна, preflight до запуска ИИ-сессии сообщает точный идентификатор и команду исправления.
+
 **Преимущества Docker:**
 
 - ✅ Предварительно настроенная среда Ubuntu 24.04
@@ -533,6 +538,27 @@ pull request, например на предыдущую команду `/codex
 выполняет слияние. Пропуск конфликтов слияния по-прежнему работает с
 `--auto-resolve`.
 
+#### `/fix` — Автоматическое исправление CI/CD
+
+```
+/fix <github-repository-url> --ci-cd [options]
+
+Examples:
+/fix https://github.com/owner/repo --ci-cd
+/fix owner/repo --ci-cd --tool codex --model gpt-5.5 --think max
+/fix owner/repo --ci-cd --dry-run
+/fix owner/repo --ci-cd --no-solve
+```
+
+`/fix --ci-cd` определяет языки целевого репозитория, анализирует последний коммит ветки по умолчанию и его
+запуски CI/CD и автоматически создаёт issue для исправления CI/CD (используя стандартный промпт и шаблоны из
+[`docs/CI-CD-BEST-PRACTICES.md`](docs/CI-CD-BEST-PRACTICES.md), отсортированные по обнаруженным языкам). Затем
+он передаёт issue в `/solve --development-log --deep-analysis --auto-merge`. Любая опция, которую `/fix` не
+использует сам (например, `--tool`, `--model`, `--think`), передаётся в `/solve`. Используйте `--dry-run`,
+чтобы предварительно просмотреть issue без его создания, или `--no-solve`, чтобы создать issue без запуска
+`/solve`. Подробнее см.
+[Автоматическое исправление CI/CD](docs/CI-CD-BEST-PRACTICES.md#automatic-cicd-remediation).
+
 #### `/limits` — Показать лимиты использования
 
 ```

package/README.zh.md

@@ -210,14 +210,15 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # Extract auth data from a running (or stopped) container to the host:
-mkdir -p ~/.hive-mind
+mkdir -p ~/.hive-mind ~/.hive-mind/agents/skills
 docker cp hive-mind:/home/box/.claude ~/.hive-mind/claude
+docker cp hive-mind:/home/box/.codex ~/.hive-mind/codex
 docker cp hive-mind:/home/box/.claude.json ~/.hive-mind/claude.json
 docker cp hive-mind:/home/box/.config/gh ~/.hive-mind/gh
 
 # Fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/codex ~/.hive-mind/agents ~/.hive-mind/gh
 chown $BOX_UID:$BOX_UID ~/.hive-mind/claude.json
 
 # On subsequent runs, mount the auth data to keep it between restarts:
@@ -225,11 +226,15 @@ docker run -dit \
   --name hive-mind \
   --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
+  -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest
 ```
 
+在启动 `codex exec` 之前，Hive Mind 会扫描 issue 及其评论中的显式插件和 Agent Skill 要求。它将所需提供程序安装到 `/home/box/.codex/hive-mind/repositories/<owner>/<repo>`，因此配置可跨重启持久化，但不会影响其他仓库。`/home/box/.agents/skills` 中的用户技能也会传入 Docker 隔离任务；若能力不可用，预检会在 AI 会话启动前报告确切标识符和修复命令。
+
 **Docker 的优势：**
 
 - ✅ 预配置的 Ubuntu 24.04 环境
@@ -528,6 +533,26 @@ Examples:
 如果目标 PR 尚未完成，`/merge` 会等待它变为可合并后再合并。合并冲突跳过仍可配合
 `--auto-resolve` 使用。
 
+#### `/fix` - 自动修复 CI/CD
+
+```
+/fix <github-repository-url> --ci-cd [options]
+
+Examples:
+/fix https://github.com/owner/repo --ci-cd
+/fix owner/repo --ci-cd --tool codex --model gpt-5.5 --think max
+/fix owner/repo --ci-cd --dry-run
+/fix owner/repo --ci-cd --no-solve
+```
+
+`/fix --ci-cd` 会检测目标仓库使用的语言，检查默认分支的最新提交及其 CI/CD 运行情况，并自动创建一个 CI/CD
+修复 issue（使用标准提示词，以及来自
+[`docs/CI-CD-BEST-PRACTICES.md`](docs/CI-CD-BEST-PRACTICES.md) 的模板，按检测到的语言排序）。随后它会将该
+issue 交给 `/solve --development-log --deep-analysis --auto-merge` 处理。所有 `/fix`
+自身不消费的选项（例如 `--tool`、`--model`、`--think`）都会转发给 `/solve`。使用 `--dry-run` 可在不创建
+issue 的情况下预览，使用 `--no-solve` 可只创建 issue 而不启动 `/solve`。详见
+[自动 CI/CD 修复](docs/CI-CD-BEST-PRACTICES.md#automatic-cicd-remediation)。
+
 #### `/limits` - 显示用量限制
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.7.4",
+  "version": "2.8.1",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",
@@ -8,6 +8,7 @@
     "hive": "./src/hive.mjs",
     "solve": "./src/solve.mjs",
     "task": "./src/task.mjs",
+    "fix": "./src/fix.mjs",
     "hive-cleanup": "./src/cleanup.mjs",
     "review": "./src/review.mjs",
     "configure-claude": "./src/configure-claude.mjs",
@@ -28,7 +29,7 @@
     "changeset": "changeset",
     "changeset:version": "changeset version",
     "changeset:publish": "npm run build:pre && changeset publish",
-    "build:pre": "chmod +x src/hive.mjs && chmod +x src/solve.mjs && chmod +x src/configure-claude.mjs && chmod +x src/hive-screens.mjs",
+    "build:pre": "chmod +x src/hive.mjs && chmod +x src/solve.mjs && chmod +x src/fix.mjs && chmod +x src/configure-claude.mjs && chmod +x src/hive-screens.mjs",
     "prepare": "husky"
   },
   "repository": {

package/src/codex-capability-preflight.lib.mjs

@@ -0,0 +1,274 @@
+/**
+ * Repository-scoped Codex capability preflight (issue #2074).
+ *
+ * Explicit plugin and Agent Skill requirements are discovered from the issue
+ * before `codex exec`. Required marketplace plugins are installed into a
+ * persistent CODEX_HOME scoped by repository, leaving the operator's global
+ * plugin enablement and the target repository untouched.
+ */
+
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+const REQUIREMENT_WORDS = /\b(?:depend(?:s|ency)?|install|invoke|mandatory|must|need(?:ed|s)?|preflight|required?|requires|use)\b/i;
+const NEGATED_REQUIREMENT = /\b(?:does\s+not\s+require|not\s+required|optional)\b/i;
+const PLUGIN_SELECTOR = /\b([a-z0-9][a-z0-9-]*@[a-z0-9][a-z0-9-]*(?:-remote)?)\b/gi;
+const NAMESPACED_SKILL = /\b([a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*)\b/gi;
+const EXPLICIT_BARE_SKILL = /\$([a-z0-9][a-z0-9-]*)|`([a-z0-9][a-z0-9-]*)`\s+(?:agent\s+)?skill/gi;
+
+export class CodexCapabilityPreflightError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = 'CodexCapabilityPreflightError';
+    this.details = details;
+  }
+}
+
+export function normalizePluginSelector(selector) {
+  return String(selector || '')
+    .trim()
+    .toLowerCase()
+    .replace(/@openai-curated-remote$/u, '@openai-curated');
+}
+
+export function detectRequiredCodexCapabilities(text) {
+  const plugins = new Set();
+  const skills = new Set();
+
+  for (const rawLine of String(text || '').split(/\r?\n/u)) {
+    const line = rawLine.trim();
+    if (!line || !REQUIREMENT_WORDS.test(line) || NEGATED_REQUIREMENT.test(line)) continue;
+
+    for (const match of line.matchAll(PLUGIN_SELECTOR)) plugins.add(normalizePluginSelector(match[1]));
+    for (const match of line.matchAll(NAMESPACED_SKILL)) skills.add(match[1].toLowerCase());
+
+    for (const match of line.matchAll(EXPLICIT_BARE_SKILL)) {
+      const name = (match[1] || match[2]).toLowerCase();
+      if (!['agent', 'codex', 'required', 'the'].includes(name)) skills.add(name);
+    }
+  }
+
+  return { plugins: [...plugins].sort(), skills: [...skills].sort() };
+}
+
+const sanitizePathSegment = value => String(value || '').replace(/[^a-zA-Z0-9._-]/gu, '_');
+
+export function buildCodexCapabilityStatePath({ baseCodexHome, owner, repo }) {
+  return path.join(baseCodexHome, 'hive-mind', 'repositories', sanitizePathSegment(owner), sanitizePathSegment(repo));
+}
+
+export function applyCodexCapabilityEnv(env, { codexHome, baseCodexHome } = {}) {
+  if (!codexHome) return env;
+  return { ...env, CODEX_HOME: codexHome, HIVE_MIND_PARENT_CODEX_HOME: baseCodexHome };
+}
+
+const defaultRunCommand = async ({ command, args, env = process.env, cwd }) => {
+  try {
+    const result = await execFileAsync(command, args, { cwd, env, encoding: 'utf8', maxBuffer: 20 * 1024 * 1024 });
+    return { stdout: result.stdout || '', stderr: result.stderr || '', code: 0 };
+  } catch (error) {
+    return { stdout: error.stdout || '', stderr: error.stderr || error.message, code: Number.isInteger(error.code) ? error.code : 1 };
+  }
+};
+
+const parseJsonCommand = (result, label) => {
+  if (result.code !== 0) throw new CodexCapabilityPreflightError(`${label} failed: ${String(result.stderr || result.stdout).trim()}`);
+  try {
+    return JSON.parse(result.stdout || 'null');
+  } catch (error) {
+    throw new CodexCapabilityPreflightError(`${label} returned invalid JSON: ${error.message}`);
+  }
+};
+
+const catalogEntries = catalog => [...(catalog?.installed || []), ...(catalog?.available || [])];
+
+const skillParts = skill => {
+  const separator = skill.indexOf(':');
+  return separator === -1 ? { namespace: null, name: skill } : { namespace: skill.slice(0, separator), name: skill.slice(separator + 1) };
+};
+
+const pluginProvidesSkill = async (plugin, skill) => {
+  const sourcePath = plugin?.source?.path;
+  if (!sourcePath) return false;
+  const { name } = skillParts(skill);
+  try {
+    await fs.access(path.join(sourcePath, 'skills', name, 'SKILL.md'));
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const skillExistsInDirectories = async (skill, skillDirectories) => {
+  const { name } = skillParts(skill);
+  for (const directory of skillDirectories || []) {
+    try {
+      await fs.access(path.join(directory, name, 'SKILL.md'));
+      return true;
+    } catch {
+      // Keep searching the remaining standard skill locations.
+    }
+  }
+  return false;
+};
+
+export async function resolveRequiredPlugins({ requirements, catalog, skillDirectories = [] }) {
+  const entries = catalogEntries(catalog);
+  const byId = new Map(entries.map(entry => [normalizePluginSelector(entry.pluginId), entry]));
+  const selected = new Map();
+  const missing = [];
+
+  for (const selector of requirements.plugins || []) {
+    const normalized = normalizePluginSelector(selector);
+    const entry = byId.get(normalized);
+    if (!entry) missing.push(normalized);
+    else selected.set(normalized, entry);
+  }
+
+  for (const skill of requirements.skills || []) {
+    const { namespace } = skillParts(skill);
+    if (!namespace && (await skillExistsInDirectories(skill, skillDirectories))) continue;
+    let candidates = entries;
+    if (namespace) candidates = entries.filter(entry => entry.name === namespace || String(entry.pluginId || '').startsWith(`${namespace}@`));
+
+    let provider = null;
+    for (const entry of candidates) {
+      if (await pluginProvidesSkill(entry, skill)) {
+        provider = entry;
+        break;
+      }
+    }
+    if (provider) selected.set(normalizePluginSelector(provider.pluginId), provider);
+    else missing.push(skill);
+  }
+
+  if (missing.length > 0) {
+    throw new CodexCapabilityPreflightError(`Required Codex capability unavailable: ${missing.join(', ')}. ` + `Run 'codex plugin list --available --json' in the operator container and configure a marketplace that provides it. ` + `Hive Mind installs discovered capabilities into repository-scoped CODEX_HOME state; it does not enable plugins globally.`, { missing });
+  }
+
+  return [...selected.keys()].sort();
+}
+
+const readIssueRequirementText = async ({ owner, repo, issueNumber, runCommand }) => {
+  const issueResult = await runCommand({ command: 'gh', args: ['api', `repos/${owner}/${repo}/issues/${issueNumber}`], env: process.env });
+  const issue = parseJsonCommand(issueResult, 'Codex capability issue discovery');
+  const commentsResult = await runCommand({ command: 'gh', args: ['api', `repos/${owner}/${repo}/issues/${issueNumber}/comments`, '--paginate'], env: process.env });
+  const comments = parseJsonCommand(commentsResult, 'Codex capability comment discovery');
+  return [issue?.title, issue?.body, ...(Array.isArray(comments) ? comments.map(comment => comment?.body) : [])].filter(Boolean).join('\n');
+};
+
+const replaceWithRelativeSymlink = async ({ source, target }) => {
+  try {
+    const current = await fs.readlink(target);
+    if (path.resolve(path.dirname(target), current) === path.resolve(source)) return;
+  } catch {
+    // Missing path or a non-symlink is reconciled below.
+  }
+  await fs.rm(target, { recursive: true, force: true });
+  await fs.mkdir(path.dirname(target), { recursive: true });
+  await fs.symlink(path.relative(path.dirname(target), source), target, 'dir');
+};
+
+const syncFileIfPresent = async (source, target) => {
+  try {
+    await fs.copyFile(source, target);
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      await fs.rm(target, { force: true });
+      return false;
+    }
+    throw error;
+  }
+};
+
+const readIfPresent = async filePath => {
+  try {
+    return await fs.readFile(filePath, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return '';
+    throw error;
+  }
+};
+
+// Runtime settings follow the operator config while plugin enablement remains
+// persistent and isolated to this repository.
+const syncScopedConfig = async ({ baseConfigPath, scopedConfigPath }) => {
+  const baseConfig = await readIfPresent(baseConfigPath);
+  const scopedConfig = await readIfPresent(scopedConfigPath);
+  const pluginPattern = /^\[plugins\."[^"]+"\][^\n]*(?:\n(?!\[)[^\n]*)*/gmu;
+  const pluginBlocks = scopedConfig.match(pluginPattern) || [];
+  const baseWithoutPlugins = baseConfig.replace(pluginPattern, '').trimEnd();
+  const nextConfig = [baseWithoutPlugins, ...pluginBlocks.map(block => block.trim())].filter(Boolean).join('\n\n');
+  if (nextConfig) await fs.writeFile(scopedConfigPath, `${nextConfig}\n`);
+};
+
+const prepareScopedCodexHome = async ({ baseCodexHome, codexHome }) => {
+  await fs.mkdir(codexHome, { recursive: true });
+  await syncScopedConfig({ baseConfigPath: path.join(baseCodexHome, 'config.toml'), scopedConfigPath: path.join(codexHome, 'config.toml') });
+  await syncFileIfPresent(path.join(baseCodexHome, 'auth.json'), path.join(codexHome, 'auth.json'));
+  await syncFileIfPresent(path.join(baseCodexHome, 'installation_id'), path.join(codexHome, 'installation_id'));
+
+  const marketplaceSource = path.join(baseCodexHome, '.tmp', 'plugins');
+  const marketplaceSha = path.join(baseCodexHome, '.tmp', 'plugins.sha');
+  try {
+    await fs.access(marketplaceSource);
+    await fs.access(marketplaceSha);
+    await replaceWithRelativeSymlink({ source: marketplaceSource, target: path.join(codexHome, '.tmp', 'plugins') });
+    await fs.copyFile(marketplaceSha, path.join(codexHome, '.tmp', 'plugins.sha'));
+  } catch {
+    throw new CodexCapabilityPreflightError(`The operator Codex marketplace snapshot is unavailable at ${marketplaceSource}. ` + `Run 'codex plugin list --available --json' once in the operator container, then retry.`);
+  }
+};
+
+export async function runCodexCapabilityPreflight({ owner, repo, issueNumber, projectDir, baseCodexHome = process.env.HIVE_MIND_PARENT_CODEX_HOME || process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), codexPath = 'codex', runCommand = defaultRunCommand, log = async () => {} } = {}) {
+  if (!owner || !repo || !issueNumber) return { required: false, plugins: [], codexHome: null };
+
+  // `executeToolWithBun` uses a shell expression for execution. Preflight uses
+  // execFile and therefore selects the installed Codex binary directly.
+  const command = /\s/u.test(codexPath) ? 'codex' : codexPath;
+  const requirementText = await readIssueRequirementText({ owner, repo, issueNumber, runCommand });
+  const requirements = detectRequiredCodexCapabilities(requirementText);
+  if (requirements.plugins.length === 0 && requirements.skills.length === 0) return { required: false, plugins: [], codexHome: null };
+
+  await log(`🔌 Codex capability preflight: detected ${requirements.plugins.length} plugin and ${requirements.skills.length} skill requirement(s)`);
+  const baseEnv = { ...process.env, CODEX_HOME: baseCodexHome, HIVE_MIND_PARENT_CODEX_HOME: baseCodexHome };
+  const baseCatalogResult = await runCommand({ command, args: ['plugin', 'list', '--available', '--json'], env: baseEnv });
+  const baseCatalog = parseJsonCommand(baseCatalogResult, 'Codex plugin catalog discovery');
+  const skillDirectories = [path.join(os.homedir(), '.agents', 'skills'), projectDir && path.join(projectDir, '.agents', 'skills')].filter(Boolean);
+  const plugins = await resolveRequiredPlugins({ requirements, catalog: baseCatalog, skillDirectories });
+  if (plugins.length === 0) {
+    await log('   ✅ Required Agent Skills are already available from standard skill directories');
+    return { required: true, plugins, skills: requirements.skills, codexHome: null, baseCodexHome };
+  }
+
+  const codexHome = buildCodexCapabilityStatePath({ baseCodexHome, owner, repo });
+  await prepareScopedCodexHome({ baseCodexHome, codexHome });
+  const scopedEnv = { ...process.env, CODEX_HOME: codexHome, HIVE_MIND_PARENT_CODEX_HOME: baseCodexHome };
+
+  const scopedCatalogResult = await runCommand({ command, args: ['plugin', 'list', '--json'], env: scopedEnv });
+  const scopedCatalog = parseJsonCommand(scopedCatalogResult, 'Repository-scoped Codex plugin discovery');
+  const installed = new Set((scopedCatalog.installed || []).filter(plugin => plugin.installed && plugin.enabled).map(plugin => normalizePluginSelector(plugin.pluginId)));
+
+  for (const plugin of plugins) {
+    if (installed.has(plugin)) continue;
+    const installResult = await runCommand({ command, args: ['plugin', 'add', plugin, '--json'], env: scopedEnv });
+    parseJsonCommand(installResult, `Installing required Codex plugin ${plugin}`);
+    await log(`   ✅ Provisioned ${plugin} in repository-scoped Codex state`);
+  }
+
+  const verifyResult = await runCommand({ command, args: ['plugin', 'list', '--json'], env: scopedEnv });
+  const verifiedCatalog = parseJsonCommand(verifyResult, 'Codex capability verification');
+  const verified = new Set((verifiedCatalog.installed || []).filter(plugin => plugin.installed && plugin.enabled).map(plugin => normalizePluginSelector(plugin.pluginId)));
+  const unverified = plugins.filter(plugin => !verified.has(plugin));
+  if (unverified.length > 0) throw new CodexCapabilityPreflightError(`Codex capability installation did not verify successfully: ${unverified.join(', ')}`, { missing: unverified });
+
+  await log(`   Codex capability state: ${codexHome}`, { verbose: true });
+  return { required: true, plugins, skills: requirements.skills, codexHome, baseCodexHome };
+}
+
+export default { applyCodexCapabilityEnv, detectRequiredCodexCapabilities, runCodexCapabilityPreflight };

package/src/codex.lib.mjs

@@ -35,6 +35,7 @@ import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } fro
 import { parseSubSessionSize, buildCodexSubSessionSizeConfigArgs, buildCodexDisable1mContextConfigArgs } from './sub-session-size.lib.mjs'; // Issue #1706
 import { getCumulativeContextInputTokens } from './context-fill.lib.mjs';
 import { deployHandoffSkill } from './handoff-skill.lib.mjs'; // Issue #1877
+import { applyCodexCapabilityEnv, runCodexCapabilityPreflight } from './codex-capability-preflight.lib.mjs'; // Issue #2074
 import { createPullRequestBaseBranchCommandIntervention } from './solve.pr-base-command-intervention.lib.mjs';
 import Decimal from 'decimal.js-light';
 
@@ -744,6 +745,7 @@ export const executeCodex = async params => {
   // it natively from .agents/skills/handoff/SKILL.md (no-op unless --use-handoff).
   await deployHandoffSkill({ tempDir, argv, log, $ });
 
+  const capabilityPreflight = await runCodexCapabilityPreflight({ owner, repo, issueNumber, projectDir: tempDir, codexPath, log });
   // Execute the Codex command
   return await executeCodexCommand({
     tempDir,
@@ -761,11 +763,12 @@ export const executeCodex = async params => {
     owner,
     repo,
     prNumber,
+    capabilityPreflight,
   });
 };
 
 export const executeCodexCommand = async params => {
-  const { tempDir, branchName, prompt, systemPrompt, argv, log, formatAligned, getResourceSnapshot, forkedRepo, feedbackLines, codexPath, $, owner, repo, prNumber, calculatePricing = calculateCodexPricing, waitForRetryDelay = waitWithCountdown } = params;
+  const { tempDir, branchName, prompt, systemPrompt, argv, log, formatAligned, getResourceSnapshot, forkedRepo, feedbackLines, codexPath, $, owner, repo, prNumber, capabilityPreflight, calculatePricing = calculateCodexPricing, waitForRetryDelay = waitWithCountdown } = params;
 
   const shellQuote = value => `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
   const expectedBaseBranch = String(argv?.baseBranch || '').trim();
@@ -806,7 +809,10 @@ export const executeCodexCommand = async params => {
     const mappedModel = mapModelToId(argv.model);
     const { reasoningEffort, source: reasoningEffortSource, rolloutTokenBudget } = resolveCodexReasoningEffort(argv);
     const isResumeMode = !!argv.resume;
-    const codexEnv = getCodexExecEnv(argv.verbose);
+    const codexEnv = applyCodexCapabilityEnv(getCodexExecEnv(argv.verbose), {
+      codexHome: capabilityPreflight?.codexHome,
+      baseCodexHome: capabilityPreflight?.baseCodexHome,
+    });
 
     // For Codex, we combine system and user prompts into a single message
     // Codex doesn't have separate system prompt support in CLI mode