@mutmutco/cli 3.72.0 → 3.74.0

package/README.md

@@ -2,7 +2,7 @@
 
 The command-line engine for MMI Future org tooling. It delivers the org-managed `.gitignore` block, reads and claims GitHub Project work, and exposes the model-agnostic commands used by the MMI plugin and non-Claude agents. (Personal agent guides — `AGENTS.md` / `CLAUDE.md` — are developer-owned and gitignored; the CLI does not deliver, overwrite, or fan them out — the whole-spine fanout is retired.)
 
-This package is published from [mutmutco/MMI-Hub](https://github.com/mutmutco/MMI-Hub) and its version matches the MMI Hub Claude Code plugin distribution version (Claude-only since #2741; the release train bumps both in lockstep).
+This package is published from [mutmutco/MMI-Hub](https://github.com/mutmutco/MMI-Hub) and its version matches the MMI Hub plugin distribution version — the release train bumps the CLI and the Claude, Codex, and Kimi plugin manifests in lockstep.
 
 The CLI carries the org **Hub endpoint** intrinsically (override with the `MMI_HUB_URL` env var), so a product repo needs **no committed control-plane config** to reach the Hub — board coords, deploy coordinates, OAuth, and the secrets layout are all discovered from the Hub registry at runtime.
 

package/dist/main.cjs

@@ -3417,7 +3417,7 @@ var program = new Command();
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
 var import_node_fs33 = require("node:fs");
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -13078,8 +13078,8 @@ function selectPrunablePluginVersions(names, currentVersion) {
   }
   return newestFirst.filter((v) => !keep.has(v));
 }
-function pluginCacheRoot(home) {
-  return `${home}/.claude/plugins/cache/mutmutco/mmi`;
+function pluginCacheRootForConfig(configRoot) {
+  return `${configRoot}/plugins/cache/mutmutco/mmi`;
 }
 function runningPluginVersion(env, cliVersion) {
   const root = env.CLAUDE_PLUGIN_ROOT?.trim();
@@ -13087,11 +13087,11 @@ function runningPluginVersion(env, cliVersion) {
   if (leaf && isVersionDirName(leaf)) return leaf;
   return cliVersion && isVersionDirName(cliVersion) ? cliVersion : void 0;
 }
-function pluginCacheStagingRoot(home) {
-  return `${home}/.claude/plugins/cache`;
+function pluginCacheStagingRootForConfig(configRoot) {
+  return `${configRoot}/plugins/cache`;
 }
-function installedPluginsPath(home) {
-  return `${home}/.claude/plugins/installed_plugins.json`;
+function installedPluginsPathForConfig(configRoot) {
+  return `${configRoot}/plugins/installed_plugins.json`;
 }
 var STAGING_DIR = /^temp_git_\d{13}_[a-z0-9]+$/i;
 function isStagingDirName(name) {
@@ -13163,13 +13163,17 @@ function humanStagingAge(ms) {
   return `${Math.floor(hours / 24)}d old`;
 }
 function buildPluginCachePlan(home, running, deps, opts = {}) {
-  const cacheRoot = pluginCacheRoot(home);
-  const stagingRoot = pluginCacheStagingRoot(home);
+  const configRoot = opts.configRoot ?? `${home}/.claude`;
+  const cacheRoot = pluginCacheRootForConfig(configRoot);
+  const stagingRoot = pluginCacheStagingRootForConfig(configRoot);
   let stagingEntries;
-  try {
-    stagingEntries = deps.listStagingDirs(stagingRoot);
-  } catch {
-    stagingEntries = [];
+  if (opts.includeStaging === false) stagingEntries = [];
+  else {
+    try {
+      stagingEntries = deps.listStagingDirs(stagingRoot);
+    } catch {
+      stagingEntries = [];
+    }
   }
   let referenced;
   try {
@@ -16579,8 +16583,10 @@ function runDocRefs(root, deps = {}) {
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
   const commandPaths = deps.commandPaths ?? null;
+  const walked = listDocs(root);
+  const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs2 = Object.fromEntries(
-    listDocs(root).map((rel) => [rel, readFile7((0, import_node_path16.join)(root, rel))]).filter(([, body]) => body != null)
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile7((0, import_node_path16.join)(root, rel))]).filter(([, body]) => body != null)
   );
   const findings = [
     ...checkPins(root, readFile7, docs2).findings,
@@ -21605,7 +21611,7 @@ var import_node_fs27 = require("node:fs");
 var import_promises6 = require("node:fs/promises");
 var import_node_path26 = require("node:path");
 var import_node_os8 = require("node:os");
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -21772,6 +21778,7 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
 
 // src/plugin-guard-io.ts
 var import_node_fs25 = require("node:fs");
+var import_node_child_process12 = require("node:child_process");
 var import_node_path24 = require("node:path");
 var import_node_os6 = require("node:os");
 
@@ -21797,11 +21804,15 @@ function buildPluginGuardLine(state, opts = {}) {
 var isWin = process.platform === "win32";
 var MMI_PLUGIN_ID = "mmi@mutmutco";
 var LEGACY_MMI_MARKETPLACE = "mmi";
+var CODEX_MARKETPLACE = "mutmutco";
 function detectSurface(env) {
   const has = (k) => Boolean(env[k]?.trim());
-  if (env.MMI_AGENT_SURFACE === "codex" || has("CODEX_HOME") || (env.CLAUDE_PLUGIN_ROOT ?? "").includes(".codex")) {
+  if (env.MMI_AGENT_SURFACE === "codex" || has("CODEX_THREAD_ID") || has("CODEX_MANAGED_BY_NPM") || has("CODEX_MANAGED_PACKAGE_ROOT") || (env.CLAUDE_PLUGIN_ROOT ?? "").includes(".codex")) {
     return "codex";
   }
+  if (env.MMI_AGENT_SURFACE === "kimi" || has("KIMI_PLUGIN_ROOT") || has("KIMI_CODE_HOME")) {
+    return "kimi";
+  }
   if (env.MMI_AGENT_SURFACE === "cursor" || has("CURSOR_TRACE_ID") || has("CURSOR_USER") || has("CURSOR_SESSION_ID") || env.CURSOR_AGENT === "1" || has("CURSOR_EXTENSION_HOST_ROLE")) {
     return "cursor";
   }
@@ -21819,6 +21830,8 @@ function surfaceToken(surface) {
       return "claude";
     case "codex":
       return "codex";
+    case "kimi":
+      return "kimi";
     case "cursor":
       return "cursor";
     case "opencode":
@@ -21834,6 +21847,8 @@ function reloadAction(surface) {
       return "restart VS Code";
     case "codex":
       return "restart Codex";
+    case "kimi":
+      return "run /reload (or start a new session) in Kimi Code";
     case "opencode":
       return "restart OpenCode";
     case "cursor":
@@ -21845,6 +21860,7 @@ function reloadAction(surface) {
   }
 }
 var CLAUDE_RECOVERY = `claude plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && claude plugin marketplace remove mutmutco && claude plugin marketplace add mutmutco/MMI-Hub --ref main && claude plugin install mmi@mutmutco`;
+var CODEX_RECOVERY = "codex plugin remove mmi@mutmutco && codex plugin marketplace remove mutmutco && codex plugin marketplace add mutmutco/MMI-Hub --ref main && codex plugin add mmi@mutmutco";
 var PLUGIN_SURFACE_HEAL = {
   claude: {
     delivery: "plugin-cli",
@@ -21858,13 +21874,28 @@ var PLUGIN_SURFACE_HEAL = {
     ],
     fix: (surface) => `${CLAUDE_RECOVERY}   # then ${reloadAction(surface)} to reload MMI commands`,
     updateRecipe: [CLAUDE_RECOVERY]
+  },
+  codex: {
+    delivery: "plugin-cli",
+    recovery: CODEX_RECOVERY,
+    healSteps: [
+      { args: ["plugin", "remove", MMI_PLUGIN_ID], gated: false },
+      { args: ["plugin", "marketplace", "remove", CODEX_MARKETPLACE], gated: false },
+      { args: ["plugin", "marketplace", "add", "mutmutco/MMI-Hub", "--ref", "main"], gated: true },
+      { args: ["plugin", "add", MMI_PLUGIN_ID], gated: true }
+    ],
+    fix: (surface) => `${CODEX_RECOVERY}   # then ${reloadAction(surface)} and review /hooks`,
+    updateRecipe: [CODEX_RECOVERY]
   }
 };
 function nonClaudeSurfaceHealMessage(surface) {
   if (surface === "codex") {
     return "Codex ships an MMI plugin (#3563). Install or repair it with:\n  codex plugin marketplace add mutmutco/MMI-Hub && codex plugin add mmi@mutmutco\n  Then run /hooks and TRUST the MMI hooks \u2014 bundled hooks are skipped until reviewed.\n  Update the CLI too: npm i -g @mutmutco/cli";
   }
-  return "No Hub-shipped MMI plugin on this host \u2014 the Hub ships plugins for Claude and Codex only.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
+  if (surface === "kimi") {
+    return "Kimi Code CLI ships an MMI plugin (kimi-k3). Install or repair it from the Kimi TUI with:\n  /plugins install https://github.com/mutmutco/MMI-Hub\n  Then run /reload (plugin hooks start only after a reload), and TRUST the install when prompted.\n  Update the CLI too: npm i -g @mutmutco/cli";
+  }
+  return "No Hub-shipped MMI plugin on this host \u2014 the Hub ships plugins for Claude, Codex, and Kimi only.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
 }
 function healStepAborts(step, ok) {
   return !ok && step.gated;
@@ -21903,28 +21934,97 @@ var NPM_VIEW_TIMEOUT_MS = 15e3;
 function runHostBin(bin, args, opts) {
   return isWin ? execFileP2("cmd.exe", ["/c", bin, ...args], opts) : execFileP2(bin, args, opts);
 }
-var installedPluginsPath2 = (surface = detectSurface(process.env)) => {
-  const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os6.homedir)()) {
+  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path24.join)(home, ".codex");
+  if (surface === "kimi") return env.KIMI_CODE_HOME?.trim() || (0, import_node_path24.join)(home, ".kimi-code");
+  return (0, import_node_path24.join)(home, ".claude");
+}
+var installedPluginsPath = (surface = detectSurface(process.env)) => {
+  return (0, import_node_path24.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)(installedPluginsPath2(surface), "utf8"));
+    return JSON.parse((0, import_node_fs25.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
 }
-function marketplaceCloneCandidates(surface, home) {
+function marketplaceCloneCandidates(surface, home, env = process.env) {
   if (surface === "codex") {
+    const root = surfaceConfigRoot(surface, env, home);
     return [
-      (0, import_node_path24.join)(home, ".codex", ".tmp", "marketplaces", "mutmutco"),
-      (0, import_node_path24.join)(home, ".codex", "plugins", "marketplaces", "mutmutco")
+      (0, import_node_path24.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
+      (0, import_node_path24.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
     ];
   }
+  if (surface === "kimi") return [];
   return [(0, import_node_path24.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs25.existsSync) {
-  return marketplaceCloneCandidates(surface, home).some(exists);
+function marketplaceClonePresent(surface, home, exists = import_node_fs25.existsSync, env = process.env) {
+  return marketplaceCloneCandidates(surface, home, env).some(exists);
+}
+function runHostBinSync(bin, args) {
+  return isWin ? (0, import_node_child_process12.execFileSync)("cmd.exe", ["/c", bin, ...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 15e3
+  }) : (0, import_node_child_process12.execFileSync)(bin, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 15e3
+  });
+}
+function codexPluginStatus() {
+  try {
+    const raw = runHostBinSync("codex", ["plugin", "list", "--json"]);
+    const parsed = JSON.parse(raw);
+    const plugin = parsed.installed?.find((entry) => entry.pluginId === MMI_PLUGIN_ID);
+    return {
+      installed: plugin?.installed === true,
+      enabled: plugin?.enabled === true,
+      ...plugin?.version ? { version: plugin.version } : {}
+    };
+  } catch {
+    return { installed: false, enabled: false };
+  }
+}
+function countCodexHookCommands(path2) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs25.readFileSync)(path2, "utf8"));
+    let count = 0;
+    for (const groups of Object.values(parsed.hooks ?? {})) {
+      for (const group of groups) {
+        count += (group.hooks ?? []).filter((hook) => hook.type === "command").length;
+      }
+    }
+    return count;
+  } catch {
+    return 0;
+  }
+}
+function codexHookTrustState(status = codexPluginStatus()) {
+  if (!status.installed || !status.version) {
+    return { applicable: false, trusted: false, trustedCount: 0, requiredCount: 0 };
+  }
+  const root = surfaceConfigRoot("codex");
+  const hooksPath = (0, import_node_path24.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", status.version, "hooks", "codex-hooks.json");
+  const requiredCount = countCodexHookCommands(hooksPath);
+  let config = "";
+  try {
+    config = (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(root, "config.toml"), "utf8");
+  } catch {
+    return { applicable: true, trusted: false, trustedCount: 0, requiredCount };
+  }
+  const trustedCount = (config.match(/\[hooks\.state\."mmi@mutmutco:hooks\/codex-hooks\.json:[^"]+"\]/g) ?? []).length;
+  return {
+    applicable: true,
+    // Codex stores a hash beside each approval row and intentionally leaves stale rows behind. The hash
+    // input is not a public host contract, so row count can prove only that approvals EXISTED — never that
+    // the current commands are trusted. `/hooks` is the only honest freshness check.
+    trusted: false,
+    trustedCount,
+    requiredCount
+  };
 }
 async function fetchNpmReleasedVersion() {
   try {
@@ -21945,16 +22045,20 @@ async function npmSelfUpdateCli(target) {
   }
 }
 function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRepo = false) {
-  const homeDir = surface === "codex" ? ".codex" : ".claude";
+  const root = surfaceConfigRoot(surface);
   const installed = readInstalledPlugins(surface);
+  const codexStatus = surface === "codex" ? codexPluginStatus() : void 0;
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
     marketplaceClonePresent: marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
-    pluginCachePresent: (0, import_node_fs25.existsSync)((0, import_node_path24.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    // Kimi keeps no plugin cache dir — installs are copied to plugins/managed/<id> and run from there.
+    pluginCachePresent: surface === "kimi" ? (0, import_node_fs25.existsSync)((0, import_node_path24.join)(root, "plugins", "managed", "mmi")) : surface === "codex" ? Boolean(
+      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs25.existsSync)((0, import_node_path24.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
+    ) : (0, import_node_fs25.existsSync)((0, import_node_path24.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
-function claudePluginGuardState(isOrgRepo) {
+function activePluginGuardState(isOrgRepo) {
   return buildPluginGuardDecision(snapshotPluginGuardInput(detectSurface(process.env), isOrgRepo)).state;
 }
 async function runClaudePlugin(args) {
@@ -21965,6 +22069,14 @@ async function runClaudePlugin(args) {
     return false;
   }
 }
+async function runCodexPlugin(args) {
+  try {
+    await runHostBin("codex", args, { timeout: CLAUDE_PLUGIN_TIMEOUT_MS });
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function marketplaceAddRefSupported(bin) {
   try {
     const { stdout, stderr } = await runHostBin(bin, ["plugin", "marketplace", "add", "--help"], {
@@ -21991,18 +22103,23 @@ function pluginReadGrantNote(login = "<your-github-login>") {
   gh api -X PUT repos/${PLUGIN_READ_REPO2}/collaborators/${login} -f permission=pull`;
 }
 async function applyPluginHeal(surface, log, opts) {
-  if (!opts?.force && surfaceToken(surface) !== "claude") return false;
-  const tableSteps = PLUGIN_SURFACE_HEAL.claude.healSteps;
+  const token = surfaceToken(surface);
+  if (token !== "claude" && token !== "codex") return false;
+  if (!opts?.force && !PLUGIN_SURFACE_HEAL[token]) return false;
+  const descriptor = PLUGIN_SURFACE_HEAL[token];
+  const tableSteps = descriptor.healSteps;
   if (!tableSteps) return false;
-  const refSupported = await marketplaceAddRefSupported("claude");
+  const bin = token;
+  const refSupported = await marketplaceAddRefSupported(bin);
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
-  log(healBannerLine("claude", "claude", refSupported));
+  log(healBannerLine(bin, token, refSupported));
   const pinsPath = (0, import_node_path24.join)((0, import_node_os6.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
-  const pins = captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]);
+  const pins = token === "claude" ? captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]) : /* @__PURE__ */ new Map();
   for (const step of steps) {
-    if (healStepAborts(step, await runClaudePlugin([...step.args]))) return false;
+    const ok = token === "claude" ? await runClaudePlugin([...step.args]) : await runCodexPlugin([...step.args]);
+    if (healStepAborts(step, ok)) return false;
   }
-  const restored = restoreMarketplacePinsOnDisk(pinsPath, pins);
+  const restored = token === "claude" ? restoreMarketplacePinsOnDisk(pinsPath, pins) : void 0;
   if (restored) log(`  ${restored}`);
   return true;
 }
@@ -22018,6 +22135,23 @@ async function healClaudePluginForDoctor(surface = detectSurface(process.env)) {
     detail: ok ? `marketplace remove \u2192 add \u2192 install succeeded${pinNote ? `; ${pinNote}` : ""}` : `\`claude plugin\` reinstall failed or was skipped${steps.length ? ` (${steps[steps.length - 1]})` : ""}`
   };
 }
+async function healActivePluginForDoctor(surface = detectSurface(process.env)) {
+  const token = surfaceToken(surface);
+  if (token !== "claude" && token !== "codex") {
+    return { ok: false, detail: `not a supported plugin surface (${surface})` };
+  }
+  if (token === "claude") return healClaudePluginForDoctor(surface);
+  const steps = [];
+  const applied = await applyPluginHeal(surface, (msg) => steps.push(msg.trim()));
+  const snapshot = applied ? snapshotPluginGuardInput(surface, true) : void 0;
+  const guardState = snapshot ? buildPluginGuardDecision(snapshot).state : "unresolved";
+  const ok = applied && guardState === "healthy";
+  const verification = snapshot ? `record=${snapshot.installRecordPresent ? "yes" : "no"}, marketplace=${snapshot.marketplaceClonePresent ? "yes" : "no"}, enabled-cache=${snapshot.pluginCachePresent ? "yes" : "no"}` : "reinstall steps did not complete";
+  return {
+    ok,
+    detail: ok ? `marketplace remove \u2192 add --ref main \u2192 plugin add succeeded; full guard verified (${verification})` : `\`codex plugin\` reinstall failed full-guard verification (${verification})${steps.length ? `; ${steps[steps.length - 1]}` : ""}`
+  };
+}
 function readKnownMarketplacesFile(path2) {
   try {
     return (0, import_node_fs25.existsSync)(path2) ? (0, import_node_fs25.readFileSync)(path2, "utf8") : void 0;
@@ -22043,9 +22177,10 @@ function restoreMarketplacePinsOnDisk(path2, pins) {
   return failed.length ? `restore did NOT take for ${failed.map(([n]) => n).join(", ")} \u2014 re-pin by hand` : `re-pinned ${[...pins.keys()].join(", ")} (auto-update + catalog ref survive the reinstall)`;
 }
 async function runGuard(readOrigin) {
+  const surface = detectSurface(process.env);
   try {
-    const surface = detectSurface(process.env);
-    if (surfaceToken(surface) !== "claude") {
+    const token = surfaceToken(surface);
+    if (token !== "claude" && token !== "codex") {
       process.exitCode = 0;
       return;
     }
@@ -22054,24 +22189,39 @@ async function runGuard(readOrigin) {
     const { state } = buildPluginGuardDecision(input);
     const { line, exitCode } = buildPluginGuardLine(state);
     if (line) console.error(line);
+    if (token === "codex" && exitCode === 0) {
+      const trust = codexHookTrustState();
+      if (trust.applicable && !trust.trusted) {
+        console.error(`[mmi-guard] MMI Codex hook trust cannot be verified non-interactively (${trust.trustedCount}/${trust.requiredCount} approval rows present); run /hooks and review the current hashes.`);
+      }
+    }
     process.exitCode = exitCode;
   } catch {
-    process.exitCode = 0;
+    if (surfaceToken(surface) === "codex") {
+      console.error("[mmi-guard] Could not inspect the active Codex plugin; run `mmi-cli plugin heal`.");
+      process.exitCode = 1;
+    } else {
+      process.exitCode = 0;
+    }
   }
 }
 async function runPluginHeal(surface = detectSurface(process.env)) {
-  if (surfaceToken(surface) !== "claude") {
-    console.log(nonClaudeSurfaceHealMessage(surfaceToken(surface) ?? void 0));
+  const token = surfaceToken(surface);
+  if (token !== "claude" && token !== "codex") {
+    console.log(nonClaudeSurfaceHealMessage(token ?? void 0));
     return;
   }
-  const descriptor = PLUGIN_SURFACE_HEAL.claude;
-  const healed = await applyPluginHeal(surface, console.log, { force: true });
+  const descriptor = PLUGIN_SURFACE_HEAL[token];
+  const applied = await applyPluginHeal(surface, console.log, { force: true });
+  const healed = token === "codex" ? applied && buildPluginGuardDecision(snapshotPluginGuardInput(surface, true)).state === "healthy" : applied;
   if (healed) {
-    console.log(`  \u2713 MMI plugin reinstalled \u2014 ${reloadAction(surface)} to load MMI commands`);
+    const trust = token === "codex" ? " Then run /hooks and review + trust the MMI hooks." : "";
+    console.log(`  \u2713 MMI plugin reinstalled \u2014 ${reloadAction(surface)} to load MMI commands.${trust}`);
   } else {
-    const refSupported = await marketplaceAddRefSupported("claude");
+    process.exitCode = 1;
+    const refSupported = await marketplaceAddRefSupported(token);
     const recovery = refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
-    const note = refAbsenceNote("claude", refSupported);
+    const note = refAbsenceNote(token, refSupported);
     console.log(`  \u2717 Auto-heal failed or was skipped. Run manually:
   ${recovery}${note}${pluginReadGrantNote()}`);
   }
@@ -22633,7 +22783,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process12.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process13.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -23590,7 +23740,7 @@ ${spec.body ?? ""}`;
   const hash = (0, import_node_crypto5.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
-var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "parent", "repo"]);
+var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo"]);
 function validateBatchSpecs(specs) {
   const errors = [];
   const validated = [];
@@ -23607,6 +23757,11 @@ function validateBatchSpecs(specs) {
       errors.push({ row, error: `unknown key(s): ${unknown.join(", ")} \u2014 expected only: ${[...BATCH_SPEC_KEYS].join(", ")}` });
       continue;
     }
+    if (spec.label !== void 0) {
+      const alias = Array.isArray(spec.label) ? spec.label : [spec.label];
+      spec.labels = [...spec.labels ?? [], ...alias];
+      delete spec.label;
+    }
     if (spec.repo !== void 0 && !/^[\w.-]+\/[\w.-]+$/.test(spec.repo)) {
       errors.push({ row, error: `bad repo "${spec.repo}" \u2014 expected owner/repo` });
       continue;
@@ -25181,6 +25336,10 @@ function pluginHealTrigger(probe) {
 }
 function checkClaudePlugin(probe) {
   const { installed, released, guardState } = probe;
+  const codex = probe.surface === "codex";
+  const id = codex ? "codex-plugin" : "claude-plugin";
+  const label = codex ? "Codex plugin" : "Claude plugin";
+  const restart = codex ? "restart Codex" : "restart Claude";
   const evidence = [
     `installed: ${installed ?? "(none)"}`,
     // #3485 item 7: when the value was reused from the banner's once-a-day cache, say so and say how old.
@@ -25190,38 +25349,57 @@ function checkClaudePlugin(probe) {
   const trigger = pluginHealTrigger(probe);
   if (trigger === "unresolved") {
     return {
-      id: "claude-plugin",
+      id,
       ok: false,
-      label: "Claude plugin",
+      label,
       detail: guardState === "no-install" ? "not installed" : "unresolved (marketplace/cache missing)",
-      fix: "run `mmi-cli doctor --apply` (or `mmi-cli plugin heal`) to reinstall the MMI marketplace + plugin, then restart Claude",
+      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall the MMI marketplace + plugin, then ${restart}`,
       verbose: evidence
     };
   }
   if (trigger === "behind") {
     return {
-      id: "claude-plugin",
+      id,
       ok: false,
-      label: "Claude plugin",
+      label,
       detail: `${installed} \u2192 ${released}`,
       // Name the CLI verb that actually fixes it, like every other red row — `/plugin` is the manual
       // fallback, not the first resort (#3282).
-      fix: "run `mmi-cli doctor --apply` (or `mmi-cli plugin heal`) to reinstall it, then restart Claude",
+      fix: `run \`mmi-cli doctor --apply\` (or \`mmi-cli plugin heal\`) to reinstall it, then ${restart}`,
       verbose: evidence
     };
   }
   if (!released) {
     return {
-      id: "claude-plugin",
+      id,
       ok: false,
       reportOnly: true,
-      label: "Claude plugin",
+      label,
       detail: `${installed ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
       fix: "check it directly: `npm view @mutmutco/cli version`, then `mmi-cli plugin heal` if behind",
       verbose: evidence
     };
   }
-  return { id: "claude-plugin", ok: true, label: "Claude plugin", ...installed ? { detail: installed } : {}, verbose: evidence };
+  return { id, ok: true, label, ...installed ? { detail: installed } : {}, verbose: evidence };
+}
+function checkCodexHookTrust(probe) {
+  if (!probe?.applicable) return null;
+  const evidence = [
+    `stored approval rows: ${probe.trustedCount}/${probe.requiredCount}`,
+    "current command hashes: verify interactively in /hooks"
+  ];
+  if (probe.trusted) {
+    return { id: "codex-hook-trust", ok: true, label: "Codex hook trust", detail: "trusted", verbose: evidence };
+  }
+  return {
+    id: "codex-hook-trust",
+    ok: true,
+    warn: true,
+    label: "Codex hook trust",
+    detail: probe.requiredCount > 0 ? `${probe.trustedCount}/${probe.requiredCount} approval rows present \u2014 current hashes unverified` : "hook bundle could not be verified",
+    fix: probe.requiredCount > 0 ? "Codex does not allow silent hook approval; run `/hooks`, review the MMI commands, and trust them" : "run `mmi-cli plugin heal`, restart Codex, then review and trust MMI under `/hooks`",
+    verbose: evidence
+  };
 }
 function checkCliVersion(input, releasedNote) {
   const report = buildVersionLagReport(input);
@@ -25459,6 +25637,8 @@ async function runDoctorClean(opts, io, deps) {
   ]);
   const ghInstalled2 = login ? true : await deps.ghInstalled();
   const installed = deps.installedPluginVersion();
+  const pluginSurface = deps.pluginSurface?.() ?? "claude-cli";
+  const codexSurface = pluginSurface === "codex";
   const checks = [];
   let restartPending = false;
   checks.push(checkGithubAuth({ login, ghInstalled: ghInstalled2, reach }));
@@ -25485,10 +25665,18 @@ async function runDoctorClean(opts, io, deps) {
     }
   }
   const releasedNote = deps.releasedVersionNote?.();
-  const pluginProbe = { installed, released, guardState: deps.pluginGuardState(isOrgRepo), releasedNote };
+  const pluginProbe = {
+    installed,
+    released,
+    guardState: deps.pluginGuardState(isOrgRepo),
+    releasedNote,
+    surface: pluginSurface
+  };
   const healTrigger = pluginHealTrigger(pluginProbe);
+  let pluginHealed = false;
   if (applyEnv && deps.healPlugin && healTrigger) {
     const heal = await deps.healPlugin();
+    pluginHealed = heal.ok;
     const measured = healTrigger === "behind" ? `${installed} \u2192 ${released}` : "unresolved install";
     const healEvidence = [
       `installed: ${installed ?? "(none)"}`,
@@ -25497,22 +25685,22 @@ async function runDoctorClean(opts, io, deps) {
       `heal: ${heal.detail}`
     ];
     checks.push(heal.ok ? {
-      id: "claude-plugin",
+      id: codexSurface ? "codex-plugin" : "claude-plugin",
       ok: true,
-      label: "Claude plugin",
-      detail: `${measured} \u2014 reinstalled via the MMI marketplace (remove \u2192 add \u2192 install)`,
+      label: codexSurface ? "Codex plugin" : "Claude plugin",
+      detail: `${measured} \u2014 reinstalled via the MMI marketplace (remove \u2192 add \u2192 ${codexSurface ? "add" : "install"})${codexSurface ? "; review trust in /hooks" : ""}`,
       verbose: healEvidence
     } : {
-      id: "claude-plugin",
+      id: codexSurface ? "codex-plugin" : "claude-plugin",
       ok: false,
-      label: "Claude plugin",
+      label: codexSurface ? "Codex plugin" : "Claude plugin",
       detail: measured,
       // #3489: a heal skipped because another doctor holds the env-heal lock is a real ✗ — this run did
       // not fix what it found — but it is not this invocation's to clear. The other process is doing it;
       // waiting is the correct response and a re-run finds it healed. A heal that RAN and failed is a
       // genuine gap and still gates.
       ...heal.skipped ? { reportOnly: true } : {},
-      fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes` : `auto-heal failed (${heal.detail}) \u2014 run \`mmi-cli plugin heal\`, then restart Claude`,
+      fix: heal.skipped ? `${heal.detail} \u2014 another doctor on this machine is healing it now; re-run once it finishes` : `auto-heal failed (${heal.detail}) \u2014 run \`mmi-cli plugin heal\`, then ${codexSurface ? "restart Codex" : "restart Claude"}`,
       verbose: healEvidence
     });
     if (!heal.skipped) restartPending = true;
@@ -25523,6 +25711,10 @@ async function runDoctorClean(opts, io, deps) {
       if (!plugin.ok) restartPending = true;
     }
   }
+  if (codexSurface && (pluginProbe.guardState === "healthy" || pluginHealed)) {
+    const trust = checkCodexHookTrust(deps.pluginTrustState?.());
+    if (trust) checks.push(trust);
+  }
   const cliInput = { currentVersion: deps.currentCliVersion(), releasedVersion: released };
   const cliReport = buildVersionLagReport(cliInput);
   if (applyEnv && deps.updateCli && versionAutoUpdateAction(cliReport) === "npm") {
@@ -25656,7 +25848,12 @@ async function runDoctorClean(opts, io, deps) {
   const exitCode = doctorReportExitCode(checks);
   if (opts.json) {
     const payload = opts.verbose ? checks : checks.map(({ verbose: _evidence, ...check }) => check);
-    io.log(JSON.stringify({ checks: payload, restartPending, exitCode }, null, 2));
+    io.log(JSON.stringify({
+      checks: payload,
+      restartPending,
+      ...restartPending ? { restartAction: codexSurface ? "restart Codex" : "restart Claude" } : {},
+      exitCode
+    }, null, 2));
     return exitCode;
   }
   if (opts.banner) {
@@ -25665,10 +25862,12 @@ async function runDoctorClean(opts, io, deps) {
       io.log(renderReport([c], { restartPending: false }));
       if (opts.verbose) for (const evidence of c.verbose ?? []) io.log(`${VERBOSE_INDENT}${evidence}`);
     }
-    if (restartPending) io.log(RESTART_LINE);
+    if (restartPending) io.log(codexSurface ? "\u21BB Restart Codex to finish." : RESTART_LINE);
     return 0;
   }
-  io.log(renderDoctorText(checks, { verbose: Boolean(opts.verbose), restartPending }));
+  const rendered = renderDoctorText(checks, { verbose: Boolean(opts.verbose), restartPending: restartPending && !codexSurface });
+  io.log(restartPending && codexSurface ? `${rendered}
+\u21BB Restart Codex to finish.` : rendered);
   return exitCode;
 }
 
@@ -25754,9 +25953,9 @@ function ghAccountCaveat(announcedLogin, accounts) {
 var import_node_fs32 = require("node:fs");
 var import_node_os10 = require("node:os");
 var import_node_path30 = require("node:path");
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 var import_node_util8 = require("node:util");
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process13.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process14.execFile);
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
@@ -25770,9 +25969,28 @@ function installedClaudePluginVersion() {
     return void 0;
   }
 }
+function installedActivePluginVersion(surface = detectSurface(process.env)) {
+  if (surface !== "codex") return installedClaudePluginVersion();
+  try {
+    const raw = process.platform === "win32" ? (0, import_node_child_process14.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15e3
+    }) : (0, import_node_child_process14.execFileSync)("codex", ["plugin", "list", "--json"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15e3
+    });
+    const parsed = JSON.parse(raw);
+    const plugin = parsed.installed?.find((entry) => entry.pluginId === MMI_PLUGIN_ID2 && entry.installed === true && entry.enabled === true);
+    return plugin?.version;
+  } catch {
+    return void 0;
+  }
+}
 function worktreeRootSync() {
   try {
-    const out = (0, import_node_child_process13.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = (0, import_node_child_process14.execFileSync)("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     let root = out.endsWith("\n") ? out.slice(0, -1) : out;
     if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
     return root || null;
@@ -25917,8 +26135,10 @@ function mmiDoctorDeps(opts = {}) {
     githubRepoReach: githubRepoReachProbe,
     awsCallerArn,
     isOrgRepo: () => isOrgRepoRoot(),
-    installedPluginVersion: installedClaudePluginVersion,
-    pluginGuardState: claudePluginGuardState,
+    installedPluginVersion: installedActivePluginVersion,
+    pluginGuardState: activePluginGuardState,
+    pluginSurface: () => detectSurface(process.env),
+    pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
     // #3272: the --apply self-heal for a stale running CLI — npm global, shadows any plugin shim (#2879).
@@ -25929,7 +26149,10 @@ function mmiDoctorDeps(opts = {}) {
     updateCli: (target) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target)),
     // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
-    healPlugin: () => withEnvHealLock("Claude plugin reinstall", () => healClaudePluginForDoctor()),
+    healPlugin: () => {
+      const surface = detectSurface(process.env);
+      return withEnvHealLock(`${surface === "codex" ? "Codex" : "Claude"} plugin reinstall`, () => healActivePluginForDoctor(surface));
+    },
     currentCliVersion: resolveClientVersion,
     readGitignore,
     writeGitignore,
@@ -25964,10 +26187,14 @@ function mmiDoctorDeps(opts = {}) {
       return { personal, app };
     },
     pluginCache: () => {
+      const surface = detectSurface(process.env);
+      const configRoot = surfaceConfigRoot(surface);
+      const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
         (0, import_node_os11.homedir)(),
-        runningPluginVersion(process.env, resolveClientVersion()),
-        pluginCacheFsDeps((0, import_node_os11.homedir)(), () => 0)
+        running,
+        pluginCacheFsDeps(configRoot, () => 0),
+        { configRoot, includeStaging: surface !== "codex" }
       );
       return {
         stale: plan.prune,
@@ -26016,6 +26243,7 @@ function mmiDoctorDeps(opts = {}) {
     // which branch it would pick one up from. Two local file reads, no network, fail-soft to no rows.
     marketplaceRows: () => {
       try {
+        if (detectSurface(process.env) === "codex") return [];
         const home = (0, import_node_os11.homedir)();
         return marketplaceRows(
           MMI_MARKETPLACE_NAME,
@@ -26407,7 +26635,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve5, reject) => {
-    const child2 = (0, import_node_child_process14.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child2 = (0, import_node_child_process15.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child2.kill();
@@ -26678,7 +26906,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -28373,8 +28601,8 @@ function directoryBytes(path2) {
 function listDirEntries(dir) {
   return (0, import_node_fs33.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
-function readInstalledPluginRefs(home) {
-  const p = installedPluginsPath(home);
+function readInstalledPluginRefs(configRoot) {
+  const p = installedPluginsPathForConfig(configRoot);
   if (!(0, import_node_fs33.existsSync)(p)) return [];
   try {
     return installedPluginPaths((0, import_node_fs33.readFileSync)(p, "utf8"));
@@ -28382,7 +28610,7 @@ function readInstalledPluginRefs(home) {
     return null;
   }
 }
-function pluginCacheFsDeps(home, dirBytes) {
+function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
     exists: (p) => (0, import_node_fs33.existsSync)(p),
     listVersionDirs: (root) => (0, import_node_fs33.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
@@ -28394,14 +28622,14 @@ function pluginCacheFsDeps(home, dirBytes) {
         return { name: d.name, mtimeMs: Date.now() };
       }
     }),
-    readInstalledPluginPaths: () => readInstalledPluginRefs(home),
+    readInstalledPluginPaths: () => readInstalledPluginRefs(configRoot),
     now: () => Date.now()
   };
 }
-function stagingApplyFsGuard(home) {
-  const stagingRoot = pluginCacheStagingRoot(home);
+function stagingApplyFsGuard(configRoot) {
+  const stagingRoot = pluginCacheStagingRootForConfig(configRoot);
   return {
-    referencedPaths: () => readInstalledPluginRefs(home),
+    referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
       const p = (0, import_node_path31.join)(stagingRoot, name);
       if (!(0, import_node_fs33.existsSync)(p)) return null;
@@ -28415,14 +28643,24 @@ function stagingApplyFsGuard(home) {
   };
 }
 program2.command("plugin-prune").description(`prune stale cached MMI plugin versions (keeps running + newest, ${PLUGIN_CACHE_KEEP} total) and orphaned temp_git_* staging dirs; dry-run unless --apply (#2903, #2990)`).option("--apply", "actually delete the stale version dirs + orphaned staging dirs (default: report only)").option("--json", "machine-readable output").action((o) => {
+  const surface = detectSurface(process.env);
+  const configRoot = surfaceConfigRoot(surface);
+  const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
+  if (o.apply && surface === "codex" && !running) {
+    const detail = "plugin prune refused: Codex could not identify the enabled MMI version; no cache was deleted";
+    if (o.json) console.log(JSON.stringify({ ok: false, error: detail }));
+    else console.error(detail);
+    process.exitCode = 1;
+    return;
+  }
   const plan = buildPluginCachePlan(
     (0, import_node_os11.homedir)(),
-    runningPluginVersion(process.env, resolveClientVersion()),
-    pluginCacheFsDeps((0, import_node_os11.homedir)(), directoryBytes),
-    { withBytes: true }
+    running,
+    pluginCacheFsDeps(configRoot, directoryBytes),
+    { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs33.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard((0, import_node_os11.homedir)())) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs33.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -28485,7 +28723,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) bannerIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     bannerIo.log(worktreeBanner);
   }
   if (isLinkedWorktree(process.cwd())) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.72.0",
-  "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
+  "version": "3.74.0",
+  "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the MMI plugin's skills and gates drive on Claude, Codex, and Kimi.",
   "type": "module",
   "license": "UNLICENSED",
   "author": {