@nurix/etna 0.19.12 → 0.19.14

package/data/harnesses/etna/codex/agents/performance-review.toml

@@ -0,0 +1,222 @@
+# dropped Claude tools: Read, Glob, Grep, Bash
+name = "performance-review"
+description = "Combined dependency + code health audit. Part A audits the dependency supply chain — security CVEs, outdated packages, license compliance, abandoned packages, unwanted transitive dependencies, install size. Part B audits code-level health — bundle size, tree-shaking issues, performance anti-patterns, code-quality flags. Run weekly or before releases. Merges the former `dep-health` and `review` agents so the package tree and the code that uses it are audited together."
+developer_instructions = '''
+
+# Performance-Review Agent
+
+You audit project health on two fronts that reinforce each other: the **dependency supply chain** (Part A) and the **code that consumes it** (Part B). A heavy dependency and a tree-shaking failure that ships it are the same problem seen from two ends — auditing them together lets you connect cause to symptom (e.g., a 10 MB package flagged in Part A that a namespace import in Part B pulls fully into the bundle).
+
+## Before Starting
+
+1. If `./docs/memory/performance-review.md` exists, read it for baselines (vulnerability trends, completed remediations, known exceptions, chunk sizes, prior anti-pattern counts). This prevents re-recommending solved issues and gives comparison points.
+2. Read `./package.json` for direct dependencies, entry points, and scripts.
+3. Detect the package manager by checking for lockfiles: `pnpm-lock.yaml` (pnpm), `package-lock.json` (npm), `yarn.lock` (yarn). Use the matching commands throughout.
+4. If `.claude/rules/general.instructions.md` (or `.claude/rules/general.md`) exists, read the Recommended Packages table for version pins/baselines.
+
+---
+
+# Part A — Dependency Health
+
+## Step 1: Security Vulnerabilities
+
+Run the audit command for the detected PM:
+
+```bash
+# pnpm
+pnpm audit --json 2>/dev/null || pnpm audit
+
+# npm
+npm audit --json 2>/dev/null || npm audit
+
+# yarn
+yarn npm audit --json 2>/dev/null || yarn audit
+```
+
+Parse results by severity (critical, high, moderate, low). For each critical/high CVE report:
+
+- Package name and installed version
+- CVE ID
+- Affected version range
+- Fixed version (if available)
+- Which direct dependency pulls it in
+
+Compare against the previous scan in `docs/memory/performance-review.md` — flag new vulnerabilities since last audit.
+
+## Step 2: Outdated Dependencies
+
+```bash
+pnpm outdated --format json 2>/dev/null || pnpm outdated
+# or: npm outdated --json
+# or: yarn outdated
+```
+
+Classify into:
+
+- **Major behind** (2+ majors) — highest risk
+- **Minor behind** — moderate risk
+- **Patch behind** — low risk
+
+Cross-reference against the Recommended Packages table in the project rules — flag packages where the installed version is behind the pinned version. Report the top 10 most outdated by semver distance.
+
+## Step 3: License Compliance
+
+```bash
+pnpm licenses list --json 2>/dev/null || pnpm licenses list
+# npm: npx license-checker --json
+```
+
+Flag non-permissive licenses in the dependency tree: GPL, AGPL, SSPL, EUPL, or other copyleft. For each: package name, license type, direct or transitive.
+
+## Step 4: Abandoned Packages
+
+For each direct dependency, check npm registry metadata:
+
+```bash
+npm view {package} time --json 2>/dev/null
+```
+
+Flag packages with no publish in 18+ months. Report package name, last publish date, and whether the upstream repository appears archived.
+
+## Step 5: Unwanted Transitive Dependencies
+
+Check for known-bloat packages in the dependency tree:
+
+- `moment` (use date-fns instead)
+- `lodash` (use subpath imports)
+- `underscore`
+- `request` (deprecated)
+- `node-fetch` (when runtime has native fetch)
+
+For each found:
+
+```bash
+pnpm why {package}
+# or: npm ls {package}
+```
+
+Report which direct dependency pulls it in and the installed size. Carry the package names you find here into Part B Step 7 — a transitive bloat package that gets imported as a namespace import is a bundle problem, not just a tree problem.
+
+## Step 6: Dependency Size Impact
+
+```bash
+du -sh node_modules/.pnpm/*/ 2>/dev/null | sort -rh | head -15
+# or for npm: du -sh node_modules/*/ | sort -rh | head -15
+```
+
+List the 15 largest packages by installed size. Flag any single package over 10 MB. Compare against the previous snapshot.
+
+---
+
+# Part B — Code Health
+
+## Step 7: Bundle Size Analysis
+
+1. Run the build (`pnpm build` / `npm run build` / `yarn build` per detected PM) to generate the production bundle
+2. Parse build output to extract chunk sizes (raw and gzip)
+3. Identify the top 10 largest chunks by raw size
+4. Compare against known baselines in `docs/memory/performance-review.md`
+5. Flag any chunk that grew >50 KB since last review
+
+### Common bundle-bloat patterns
+
+Search for anti-patterns that defeat tree-shaking:
+
+- `import * as` namespace imports from large libraries (lucide-react, lodash, etc.)
+- Dynamic string-based icon/component resolution (`Icons[name]`, `Components[type]`)
+- Barrel file re-exports pulling in unused code
+- Missing `React.lazy()` for heavy components (Monaco, Uppy, D3, Plotly, Mermaid)
+- Full library imports where subpath imports exist (`import _ from 'lodash'` vs `import get from 'lodash/get'`)
+
+```bash
+# Find namespace imports from large libraries
+grep -rn "import \* as" src/ --include="*.jsx" --include="*.tsx" --include="*.js" --include="*.ts"
+
+# Find dynamic component/icon resolution
+grep -rn "Icons\[" src/ --include="*.jsx" --include="*.tsx"
+```
+
+## Step 8: Performance Anti-Patterns
+
+Scan for React performance issues:
+
+### Missing memoization
+
+- Components rendering large lists without `React.memo`
+- Expensive computations without `useMemo`
+- Callback props without `useCallback` causing child re-renders
+- Focus on components in tables, lists, grids, repeated rows
+
+### Request waterfalls
+
+- Sequential `await` calls that could be `Promise.all`
+- `useEffect` chains where one fetch triggers another
+- Component trees where parent fetches block child renders
+
+### Missing virtualization
+
+- Lists rendering >50 items without react-window or similar
+- Tables with unbounded row counts
+- Grids without lazy loading
+
+## Step 9: Import Health
+
+1. Check for circular dependencies using import chains
+2. Identify unused exports (files exporting functions not imported elsewhere)
+
+## Step 10: Code-Quality Flags
+
+- `dangerouslySetInnerHTML` usage without sanitization context
+- `// TODO` and `// FIXME` comments older than 30 days
+- `console.log` / `console.warn` / `console.error` left in production code
+- Hardcoded API URLs, credentials, or environment-specific values
+- Missing error boundaries around async components
+
+```bash
+grep -rn "console\.\(log\|warn\|error\)" src/ --include="*.jsx" --include="*.tsx" --include="*.js" --include="*.ts" | grep -v "// eslint"
+grep -rn "TODO\|FIXME\|HACK\|XXX" src/ --include="*.jsx" --include="*.tsx" --include="*.js" --include="*.ts"
+```
+
+---
+
+## Step 11: Report & Track
+
+### Report format
+
+**Dependencies**
+
+- **Vulnerabilities**: critical/high CVEs, new since last audit
+- **Outdated**: top outdated packages by semver distance
+- **Licenses**: non-permissive license flags
+- **Abandoned**: packages with no recent publishes
+- **Transitive bloat**: unwanted packages pulled in transitively
+- **Dependency size**: largest installed packages
+
+**Code**
+
+- **Bundle size**: total vendor size, top offenders, growth since last review
+- **Tree-shaking issues**: namespace imports, barrel-file problems (cross-referenced with the heavy/bloat packages from Part A)
+- **Performance**: missing memoization, request waterfalls, missing virtualization
+- **Code quality**: console statements, TODOs, hardcoded values
+
+**Recommendations**: a single prioritized list spanning both fronts, with estimated impact. A critical CVE outranks everything; bundle growth and tree-shaking fixes follow by impact.
+
+### Update tracking
+
+1. Write a snapshot to `docs/memory/performance-review.md` with date including: vulnerability count by severity, outdated count by category, flagged licenses, abandoned packages, chunk sizes, top packages, anti-pattern counts.
+2. Append new items to `docs/history/backlog.md`:
+   - `- **[P0]** Critical CVE in \`{package}\`: {CVE-ID} — discovered by performance-review`
+   - `- **[P2]** Abandoned dependency: \`{package}\` (last published {date}) — discovered by performance-review`
+   - `- **[P2]** Bundle grew by 80KB in chunk \`{name}\` — discovered by performance-review`
+3. Report summary to the user
+
+## Rules
+
+- Read-only for source code — never modify `src/` files
+- Never run `npm install`, `pnpm install`, `yarn install`, or any command that modifies dependencies
+- May write to `docs/memory/performance-review.md` and `docs/history/backlog.md`
+- Be specific: include package names, byte sizes, CVE IDs, version numbers, file paths, line numbers
+- Prioritize by impact — a critical CVE matters more than a patch update; trends matter more than absolutes when baselines exist
+- If a command isn't available or applicable (e.g., audit unsupported, build fails on a non-JS project), skip that step and note it in the report
+- A clean report is valid — do not invent issues
+'''

package/data/harnesses/etna/harness.json

@@ -7,5 +7,5 @@
     ".prettierignore",
     ".vscode/settings.json"
   ],
-  "digest": "ac886b2bc4b1"
+  "digest": "e4e80329bda9"
 }

package/data/harnesses/hr/CLAUDE.md

@@ -21,7 +21,7 @@ Pick the mode from what the user hands you:
 
 ## Step 0 — first run
 
-If the `interview-eval` skill isn't resolvable (no `.claude/skills/interview-eval/`), this project isn't set up — tell the user to run `npx @nurix/etna --name=hr` (or point you at the skill) before continuing. Confirm `python3` is on PATH; the extractor is stdlib-only and needs nothing else.
+If the `interview-eval` skill isn't resolvable (no `.claude/skills/interview-eval/`), this project isn't set up — tell the user to run `npx --yes @nurix/etna --name=hr` (or point you at the skill) before continuing. Confirm `python3` is on PATH; the extractor is stdlib-only and needs nothing else.
 
 ## Step 1 — intake interview
 

package/data/harnesses/hr/harness.json

@@ -7,5 +7,5 @@
     ".prettierignore",
     ".vscode/settings.json"
   ],
-  "digest": "6d11004d6849"
+  "digest": "1d5cfc7eb67e"
 }

package/lib/codex/README.md

@@ -0,0 +1,31 @@
+# `lib/codex` — Claude→Codex projection
+
+Turns a harness's already-materialized Claude artifacts into their OpenAI Codex counterparts, so one harnessed repo works under **both** Claude Code and Codex. Consumed by both shippers — the installer (`bin/etna.js`) and the marketplace publisher (`.github/scripts/publish.mjs`) — through one module, so the two channels can't drift (the same "keep in agreement" rule as the `evals/`/`fixtures/` ship-filter).
+
+Owning doc: [`docs/features/codex-support.md`](../../../../docs/features/codex-support.md).
+
+## What it emits
+
+| Source | Target | File |
+| --- | --- | --- |
+| `CLAUDE.md` | `AGENTS.md` (exact copy) | `agents-md.mjs` |
+| `.claude/skills/` | `.agents/skills/` (mirror) | `skills.mjs` |
+| bundle `codex/agents/*.toml` | `.codex/agents/*.toml` (copy) | `subagents.mjs` |
+| `hooks.json` | `.codex/hooks.json` (`type:"command"` only) | `hooks.mjs` |
+| `.claude-plugin/*` | `.codex-plugin/plugin.json` + `.agents/plugins/marketplace.json` | `plugin-manifest.mjs` |
+
+`index.mjs` orchestrates the install-time projectors and returns `{installed, notices, warnings, owned}`; `owned` is recorded in `.claude/harness.json` → `owned.codex` for prune-on-refresh.
+
+**Out of scope (owner decision 2026-07-13):** MCP projection and any Codex `settings.json`/`config.toml` equivalent. There is no user-editable Codex file the harness co-owns, so every Codex path is a clean full-overwrite — no managed-block merge.
+
+## Subagents are authored, not derived at install
+
+`.claude/agents/*.md → .codex/agents/*.toml` is lossy/semantic, so it is done by the **real Codex CLI** at authoring time, not a parser at install:
+
+```bash
+node packages/cli/lib/codex/gen-agents.mjs                 # shared catalog (agents/*.md), stale/missing only
+node packages/cli/lib/codex/gen-agents.mjs --force          # regenerate all shared agents
+node packages/cli/lib/codex/gen-agents.mjs --include-plugins # + plugins/*/agents/*.md
+```
+
+`gen-agents.mjs` runs `codex exec` per agent and writes a committed `agents/<name>.codex.toml` sibling. It runs **only on a laptop with `codex` installed + authenticated — never in CI**. `build-data.js` and `publish.mjs` then ship those committed TOML; the installer copies them, so **consumers need no Codex CLI**. Regenerate an agent's TOML in the same change that edits its `.md` (source↔generated parity).

package/lib/codex/agents-md.mjs

@@ -0,0 +1,35 @@
+// packages/cli/lib/codex/agents-md.mjs
+// CLAUDE.md → AGENTS.md — an exact copy (Codex's confirmed CLAUDE.md analog).
+// Mirrors the installer's CLAUDE.md safety net: overwrite in place when git can
+// recover it, otherwise back up the existing file and warn.
+
+import { existsSync, lstatSync, renameSync, cpSync } from 'node:fs';
+import { join } from 'node:path';
+
+function isSymlink(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    } catch {
+        return false;
+    }
+}
+
+export function projectAgentsMd({ targetDir, bundledClaudeMd, projectHasGit }) {
+    if (!existsSync(bundledClaudeMd)) return null;
+    const dest = join(targetDir, 'AGENTS.md');
+    const existed = existsSync(dest) || isSymlink(dest);
+    let notice = null;
+    let warning = null;
+    if (existed) {
+        if (projectHasGit) {
+            notice = 'Overwrote existing AGENTS.md (tracked by git — `git checkout AGENTS.md` to restore).';
+        } else {
+            const ts = new Date().toISOString().replace(/[:.]/g, '-');
+            const backup = `${dest}.bak.${ts}`;
+            renameSync(dest, backup);
+            warning = `No .git here, so no version-control safety net — backed up existing AGENTS.md → ${backup}`;
+        }
+    }
+    cpSync(bundledClaudeMd, dest, { force: true });
+    return { installed: 'AGENTS.md → ./', notice, warning };
+}

package/lib/codex/gen-agents.mjs

@@ -0,0 +1,156 @@
+// packages/cli/lib/codex/gen-agents.mjs
+// AUTHORING-TIME generator — runs ON A LAPTOP with the Codex CLI installed and
+// authenticated, NEVER in CI. For each Claude subagent (agents/<name>.md in the
+// shared catalog, plus plugins/*/agents/*.md with --include-plugins) it runs
+// `codex exec` to translate the markdown into an OpenAI Codex subagent TOML and
+// writes a committed sibling agents/<name>.codex.toml. The shippers (build-data.js,
+// publish.mjs) then carry those committed files; the installer copies them into a
+// consumer's .codex/agents/ with no Codex CLI required downstream.
+//
+// Usage:
+//   node packages/cli/lib/codex/gen-agents.mjs            # shared catalog, only stale/missing
+//   node packages/cli/lib/codex/gen-agents.mjs --force    # regenerate all shared agents
+//   node packages/cli/lib/codex/gen-agents.mjs --include-plugins  # + plugins/*/agents/*.md
+
+import {
+    existsSync,
+    readdirSync,
+    readFileSync,
+    writeFileSync,
+    statSync,
+} from 'node:fs';
+import { dirname, join, resolve, basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, '..', '..', '..', '..');
+
+// Pinned conversion prompt — deterministic instructions so re-runs stay stable.
+// Codex does the semantic md→toml; the body is copied verbatim, tools are dropped
+// (no Codex equivalent) and recorded in a leading comment.
+const CONVERSION_PROMPT = [
+    'Convert the Claude Code subagent definition provided on stdin into an OpenAI Codex subagent TOML document.',
+    'Output ONLY the raw TOML — no prose, no markdown code fences, nothing before or after.',
+    'Set `name` from the frontmatter `name`.',
+    'Set `description` as a TOML basic string (double quotes) from the frontmatter `description`, escaping any interior double-quote as \\".',
+    'Put the ENTIRE markdown body (everything after the closing frontmatter ---) VERBATIM into a TOML multi-line',
+    "LITERAL string delimited by triple SINGLE quotes: developer_instructions = '''<body>'''.",
+    'A literal string is verbatim — do NOT escape anything inside it, and do NOT use triple double-quotes (backslashes like \\s in the body must survive unchanged).',
+    'If frontmatter `model` is a real model id, set `model`; if it is `inherit`, omit `model`.',
+    'If frontmatter has a `tools:` line, do NOT translate it — instead put a single comment line',
+    '`# dropped Claude tools: <the list>` as the first line of the file.',
+    'Emit no keys other than name, description, model (optional), developer_instructions.',
+].join(' ');
+
+const args = process.argv.slice(2);
+const force = args.includes('--force');
+const includePlugins = args.includes('--include-plugins');
+
+function die(msg) {
+    console.error(`gen-codex-agents: ${msg}`);
+    process.exit(1);
+}
+
+// Codex must be present + authenticated — this step cannot run in CI.
+function assertCodexReady() {
+    const which = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+    if (which.status !== 0) {
+        die('the `codex` CLI is not installed / not on PATH. This generator runs only on an authoring laptop.');
+    }
+}
+
+// Every agents/<name>.md to convert: the shared catalog, plus plugin-owned agents on request.
+function collectAgentFiles() {
+    const files = [];
+    const shared = join(repoRoot, 'agents');
+    if (existsSync(shared)) {
+        for (const f of readdirSync(shared)) {
+            if (f.endsWith('.md')) files.push(join(shared, f));
+        }
+    }
+    if (includePlugins) {
+        const pluginsDir = join(repoRoot, 'plugins');
+        if (existsSync(pluginsDir)) {
+            for (const plugin of readdirSync(pluginsDir)) {
+                const agentsDir = join(pluginsDir, plugin, 'agents');
+                if (!existsSync(agentsDir)) continue;
+                for (const f of readdirSync(agentsDir)) {
+                    if (f.endsWith('.md')) files.push(join(agentsDir, f));
+                }
+            }
+        }
+    }
+    return files.sort();
+}
+
+// A regen is due when forced, the toml is missing, or the md is newer than the toml.
+function needsRegen(mdPath, tomlPath) {
+    if (force || !existsSync(tomlPath)) return true;
+    return statSync(mdPath).mtimeMs > statSync(tomlPath).mtimeMs;
+}
+
+// Strip an accidental ```toml fence if the model wrapped its output despite the prompt.
+function stripFences(text) {
+    const trimmed = text.trim();
+    const fence = trimmed.match(/^```(?:toml)?\n([\s\S]*?)\n```$/);
+    return (fence ? fence[1] : trimmed) + '\n';
+}
+
+// Validate that the produced TOML parses. Uses python3's tomllib when present
+// (returns true/error string); returns null when python3 is unavailable so the
+// caller proceeds best-effort rather than hard-failing on a missing dev tool.
+function tomlError(toml) {
+    const res = spawnSync('python3', ['-c', 'import tomllib,sys; tomllib.loads(sys.stdin.read())'], {
+        input: toml,
+        encoding: 'utf8',
+    });
+    if (res.error && res.error.code === 'ENOENT') return null;
+    return res.status === 0 ? '' : (res.stderr || 'invalid TOML').trim();
+}
+
+function convert(mdPath) {
+    const md = readFileSync(mdPath, 'utf8');
+    const res = spawnSync('codex', ['exec', '--sandbox', 'read-only', CONVERSION_PROMPT], {
+        input: md,
+        encoding: 'utf8',
+        maxBuffer: 32 * 1024 * 1024,
+    });
+    if (res.status !== 0) {
+        throw new Error(`codex exec failed for ${mdPath}: ${(res.stderr || '').slice(-400)}`);
+    }
+    const toml = stripFences(res.stdout || '');
+    if (!/^\s*name\s*=/m.test(toml)) {
+        throw new Error(`codex output for ${mdPath} has no \`name =\` key — refusing to write. Got:\n${toml.slice(0, 200)}`);
+    }
+    const err = tomlError(toml);
+    if (err) {
+        throw new Error(`codex output for ${mdPath} is not valid TOML — refusing to write:\n${err.slice(0, 300)}`);
+    }
+    return toml;
+}
+
+assertCodexReady();
+const files = collectAgentFiles();
+if (!files.length) die('no agents/*.md found to convert.');
+
+let wrote = 0;
+let skipped = 0;
+for (const mdPath of files) {
+    const name = basename(mdPath, '.md');
+    const tomlPath = join(dirname(mdPath), `${name}.codex.toml`);
+    if (!needsRegen(mdPath, tomlPath)) {
+        skipped += 1;
+        continue;
+    }
+    process.stdout.write(`converting ${name} … `);
+    try {
+        writeFileSync(tomlPath, convert(mdPath));
+        wrote += 1;
+        console.log('ok');
+    } catch (e) {
+        console.log('FAILED');
+        console.error(`  ${e.message}`);
+    }
+}
+console.log(`\ngen-codex-agents: wrote ${wrote}, skipped ${skipped} (up-to-date) of ${files.length} agent(s).`);

package/lib/codex/hooks.mjs

@@ -0,0 +1,33 @@
+// packages/cli/lib/codex/hooks.mjs
+// .claude/hooks/hooks.json → .codex/hooks.json. Same JSON shape Codex documents;
+// filtered to type:"command" (the only hook type Codex executes — "prompt"/"agent"
+// entries are parsed but skipped). A standalone file, not a config.toml [hooks]
+// table, since the settings/config surface is out of scope for Codex here.
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+
+export function projectHooks({ targetDir, bundledHarnessDir }) {
+    const srcJson = join(bundledHarnessDir, 'hooks', 'hooks.json');
+    if (!existsSync(srcJson)) return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(srcJson, 'utf8'));
+    } catch {
+        return null;
+    }
+    const out = {};
+    for (const [event, groups] of Object.entries(parsed.hooks || {})) {
+        const kept = [];
+        for (const group of groups) {
+            const hooks = (group.hooks || []).filter((h) => h.type === 'command');
+            if (hooks.length) kept.push({ ...group, hooks });
+        }
+        if (kept.length) out[event] = kept;
+    }
+    if (!Object.keys(out).length) return null;
+    const dest = join(targetDir, '.codex', 'hooks.json');
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, JSON.stringify({ hooks: out }, null, 2) + '\n');
+    return { installed: '.codex/hooks.json' };
+}

package/lib/codex/index.mjs

@@ -0,0 +1,62 @@
+// packages/cli/lib/codex/index.mjs
+// Claude→Codex projection entry. Derives a repo's Codex-native artifacts
+// (AGENTS.md, .agents/skills/, .codex/agents/, .codex/hooks.json) from the
+// just-installed Claude tree + the harness bundle. Consumed by BOTH shippers —
+// the installer (bin/etna.js) and the marketplace publisher (publish.mjs) — so
+// the two distribution channels can never diverge (the same "keep in agreement"
+// discipline as the evals/fixtures ship-filter). MCP and a settings/config.toml
+// equivalent are deliberately OUT of scope (owner decision 2026-07-13); see
+// docs/features/codex-support.md.
+
+import { existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { projectAgentsMd } from './agents-md.mjs';
+import { projectSkills } from './skills.mjs';
+import { copyCodexAgents } from './subagents.mjs';
+import { projectHooks } from './hooks.mjs';
+
+// Project every Codex artifact into targetDir. Returns the same {installed,
+// notices, warnings} accounting shape the installer already collects, plus
+// `owned` — the top-level Codex targets, recorded in harness.json's
+// `owned.codex` so a later version can prune one it stops shipping.
+export function projectCodexArtifacts({
+    targetDir,
+    bundledHarnessDir,
+    bundledClaudeMd,
+    projectHasGit,
+    priorCodexOwned = [],
+}) {
+    const installed = [];
+    const notices = [];
+    const warnings = [];
+    const owned = [];
+
+    const collect = (result, ownedPath) => {
+        if (!result) return;
+        if (result.installed) installed.push(result.installed);
+        if (result.notice) notices.push(result.notice);
+        if (result.warning) warnings.push(result.warning);
+        owned.push(ownedPath);
+    };
+
+    // AGENTS.md — exact copy of CLAUDE.md, with the CLAUDE.md backup-if-no-git rule.
+    collect(projectAgentsMd({ targetDir, bundledClaudeMd, projectHasGit }), 'AGENTS.md');
+    // .agents/skills — full-rebuilt mirror of the installed (already ship-filtered) .claude/skills.
+    collect(projectSkills({ targetDir, projectHasGit }), '.agents/skills');
+    // .codex/agents — copy the shipped, pre-generated *.toml (see gen-agents.mjs).
+    collect(copyCodexAgents({ targetDir, bundledHarnessDir, projectHasGit }), '.codex/agents');
+    // .codex/hooks.json — Claude hooks.json filtered to type:"command".
+    collect(projectHooks({ targetDir, bundledHarnessDir }), '.codex/hooks.json');
+
+    // Prune a Codex target a prior version owned but this bundle no longer emits.
+    for (const rel of priorCodexOwned) {
+        if (owned.includes(rel)) continue;
+        const target = join(targetDir, rel);
+        if (existsSync(target)) {
+            rmSync(target, { recursive: true, force: true });
+            notices.push(`removed orphaned codex ${rel}`);
+        }
+    }
+
+    return { installed, notices, warnings, owned };
+}

package/lib/codex/plugin-manifest.mjs

@@ -0,0 +1,36 @@
+// packages/cli/lib/codex/plugin-manifest.mjs
+// Pure builders for the Codex plugin + marketplace manifests, emitted by the
+// marketplace shipper (.github/scripts/publish.mjs) alongside the Claude ones.
+// A Codex plugin reuses the same skills/ and hooks/ dirs as a Claude plugin — only
+// the manifest differs (.codex-plugin/plugin.json) — plus a Codex marketplace
+// catalog (.agents/plugins/marketplace.json). Codex also reads the legacy
+// .claude-plugin/marketplace.json but for DISCOVERY only, so native ones are still emitted.
+
+// The required Codex plugin.json fields + component pointers. `hasHooks` adds the
+// hooks pointer (Codex auto-detects hooks/hooks.json, but naming it is explicit).
+export function buildCodexPluginJson(fm, { hasHooks = false } = {}) {
+    const out = {
+        name: fm.name,
+        version: fm.version,
+        description: fm.description,
+        skills: './skills/',
+    };
+    if (hasHooks) out.hooks = './hooks/hooks.json';
+    return out;
+}
+
+// The repo marketplace catalog Codex reads at .agents/plugins/marketplace.json.
+// Each plugin is a local source; the first keyword (if any) seeds a category.
+export function buildCodexMarketplace(plugins) {
+    return {
+        name: 'nurixlabs',
+        interface: { displayName: 'Nurix Labs' },
+        plugins: [...plugins]
+            .sort((a, b) => a.name.localeCompare(b.name))
+            .map((p) => ({
+                name: p.name,
+                source: `./plugins/${p.name}`,
+                ...(p.frontmatter?.keywords?.length ? { category: p.frontmatter.keywords[0] } : {}),
+            })),
+    };
+}

package/lib/codex/skills.mjs

@@ -0,0 +1,26 @@
+// packages/cli/lib/codex/skills.mjs
+// .claude/skills/ → .agents/skills/ — Codex's official skill-scan path. A full
+// rebuild each run from the installed .claude/skills tree, which the bundle
+// already ship-filtered (evals/, fixtures/ stripped at build time), so this is a
+// straight recursive copy. Both runtimes require exactly name+description in
+// SKILL.md frontmatter, so the mirrored files are valid for Codex unchanged.
+
+import { existsSync, cpSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+
+export function projectSkills({ targetDir, projectHasGit }) {
+    const src = join(targetDir, '.claude', 'skills');
+    if (!existsSync(src)) return null;
+    const dest = join(targetDir, '.agents', 'skills');
+    let warning = null;
+    if (existsSync(dest)) {
+        if (!projectHasGit) {
+            const ts = new Date().toISOString().replace(/[:.]/g, '-');
+            cpSync(dest, `${dest}.bak.${ts}`, { recursive: true });
+            warning = 'No .git here — snapshotted existing .agents/skills/ before rebuild.';
+        }
+        rmSync(dest, { recursive: true, force: true });
+    }
+    cpSync(src, dest, { recursive: true });
+    return { installed: '.agents/skills/ (mirror of .claude/skills)', warning };
+}

package/lib/codex/subagents.mjs

@@ -0,0 +1,26 @@
+// packages/cli/lib/codex/subagents.mjs
+// Copy the harness's pre-generated Codex subagent TOML — bundle codex/agents/*.toml,
+// authored on a Codex-authenticated laptop by gen-agents.mjs — into the project's
+// .codex/agents/. Full rebuild each run. The consumer needs NO Codex CLI: the TOML
+// ships ready, so a missing local Codex never blocks an install.
+
+import { existsSync, readdirSync, cpSync, rmSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+export function copyCodexAgents({ targetDir, bundledHarnessDir, projectHasGit }) {
+    const src = join(bundledHarnessDir, 'codex', 'agents');
+    if (!existsSync(src)) return null;
+    const tomls = readdirSync(src).filter((f) => f.endsWith('.toml'));
+    if (!tomls.length) return null;
+    const dest = join(targetDir, '.codex', 'agents');
+    if (existsSync(dest)) {
+        if (!projectHasGit) {
+            const ts = new Date().toISOString().replace(/[:.]/g, '-');
+            cpSync(dest, `${dest}.bak.${ts}`, { recursive: true });
+        }
+        rmSync(dest, { recursive: true, force: true });
+    }
+    mkdirSync(dest, { recursive: true });
+    for (const f of tomls) cpSync(join(src, f), join(dest, f), { force: true });
+    return { installed: `${tomls.length} codex agent(s) → .codex/agents/` };
+}