@orchid-labs/pluxx 0.1.15 → 0.1.16

package/dist/index.js

@@ -7855,7 +7855,7 @@ function getEnabledRuntimeReadinessBindings(capability, plan) {
   });
 }
 var NAMED_PROMPT_TARGET_NOTE = "Named `skills` / `commands` readiness targets currently translate through prompt-entry gating with best-effort matching because the core four do not share one exact per-skill or per-command runtime interception surface.";
-var CODEX_EXTERNAL_NOTE = "Codex readiness now bundles translated hooks in the plugin, but Pluxx still emits `.codex/readiness.generated.json` and `.codex/hooks.generated.json` companion guidance because some Codex runtimes still gate hook activation behind `codex_hooks`.";
+var CODEX_EXTERNAL_NOTE = "Codex readiness now bundles translated hooks in the plugin, and Pluxx still emits `.codex/readiness.generated.json` plus `.codex/hooks.generated.json` as debugging companions because some Codex runtimes still gate hook activation behind a `[features]` flag. Current Codex config surfaces still accept both `hooks = true` and `codex_hooks = true`, but maintained interactive probes on May 13, 2026 showed local Codex CLI 0.130.0 timing out without a project-local hook side effect under either flag while emitting a deprecation warning for `codex_hooks` that points users to `hooks`.";
 function getRuntimeReadinessNamedPromptTargetNote() {
   return NAMED_PROMPT_TARGET_NOTE;
 }
@@ -7920,7 +7920,7 @@ function getRuntimeReadinessCapability(platform, pluginRootVar = "PLUGIN_ROOT")
     case "codex":
       return {
         platform,
-        delivery: "generated-guidance",
+        delivery: "bundled-hooks",
         bundleEnforced: false,
         namedPromptTargetScope: "best-effort",
         scriptPath: ".codex/pluxx-readiness.mjs",
@@ -8024,7 +8024,7 @@ var PLATFORM_LIMITS = {
     manifestPromptCountMax: 3,
     manifestPathPrefix: "./",
     instructionsMaxBytes: 32768,
-    hooksFeatureFlag: "codex_hooks"
+    hooksFeatureFlag: "hooks"
   },
   "cursor": {
     ...NULL_LIMITS,
@@ -8178,17 +8178,17 @@ var PLATFORM_VALIDATION_RULES = {
       notes: "The manifest is optional; if present, name is the only required field."
     },
     mcp: {
-      files: [".mcp.json", ".claude-plugin/plugin.json"],
+      files: [".mcp.json", "~/.claude.json", "managed-mcp.json", ".claude-plugin/plugin.json"],
       rootKey: "mcpServers",
       transports: ["stdio", "http", "sse"],
       auth: ["headers", "env interpolation", "OAuth 2.0", "bearer tokens", "dynamic headers"],
-      notes: "Claude Code supports either inline MCP config in plugin.json or a separate .mcp.json file, with marketplace and dependency-aware install flows."
+      notes: "Claude Code project-scoped MCP lives in .mcp.json, while local and user scopes live in ~/.claude.json; managed deployments can also pin managed-mcp.json. Current docs explicitly warn that settings.json does not read mcpServers."
     },
     hooks: {
       supported: true,
-      files: ["hooks/hooks.json", ".claude-plugin/plugin.json", "~/.claude/settings.json", ".claude/settings.json", ".claude/settings.local.json"],
+      files: ["hooks/hooks.json", ".claude-plugin/plugin.json", "managed settings", "~/.claude/settings.json", ".claude/settings.json", ".claude/settings.local.json"],
       eventNames: ["SessionStart", "Setup", "UserPromptSubmit", "UserPromptExpansion", "PreToolUse", "PermissionRequest", "PermissionDenied", "PostToolUse", "PostToolUseFailure", "PostToolBatch", "Notification", "SubagentStart", "SubagentStop", "TaskCreated", "TaskCompleted", "Stop", "StopFailure", "TeammateIdle", "InstructionsLoaded", "ConfigChange", "CwdChanged", "FileChanged", "WorktreeCreate", "WorktreeRemove", "PreCompact", "PostCompact", "Elicitation", "ElicitationResult", "SessionEnd"],
-      notes: "Hook configs can be stored in hooks/hooks.json, inlined in plugin.json, added in settings files, or scoped through skill and agent frontmatter. Claude also documents a broader lifecycle event set than the older simplified Pluxx model."
+      notes: "Hook configs can be stored in hooks/hooks.json, inlined in plugin.json, added in user/project/local settings files, or controlled by managed policy settings; Claude also documents a broader lifecycle event set than the older simplified Pluxx model."
     },
     instructions: {
       files: ["CLAUDE.md"],
@@ -8304,7 +8304,7 @@ var PLATFORM_VALIDATION_RULES = {
       supported: true,
       files: ["hooks/hooks.json", ".codex/hooks.json", "~/.codex/hooks.json"],
       eventNames: ["SessionStart", "PreToolUse", "PermissionRequest", "PostToolUse", "UserPromptSubmit", "Stop"],
-      notes: "Codex documents hooks in project and user config, and the hooks docs still mention the codex_hooks feature flag/runtime caveat. The official hooks docs also cover plugin-bundled hooks, which Pluxx now emits at hooks/hooks.json."
+      notes: "Codex documents hooks in project and user config, and the current config schema still accepts both `[features].hooks = true` and `[features].codex_hooks = true`. Maintained interactive probes on May 13, 2026 showed local Codex CLI 0.130.0 timing out without a project-local `.codex/hooks.json` side effect or `/hooks` review gate under either flag; the `codex_hooks` variant also emitted a deprecation message that points users to `hooks`, while the official docs still show `codex_hooks`. The official hooks docs also cover plugin-bundled hooks, which Pluxx now emits at `hooks/hooks.json`."
     },
     instructions: {
       files: ["AGENTS.md", "AGENTS.override.md"],
@@ -8738,22 +8738,22 @@ var CORE_FOUR_PRIMITIVE_CAPABILITIES = {
       agents: {
         mode: "translate",
         nativeSurfaces: [".codex/agents/*.toml", "~/.codex/agents/*.toml", "subagent workflows"],
-        notes: "Codex custom agents and subagents are real native surfaces, but they are not packaged the same way as Claude or Cursor plugin agents."
+        notes: 'Codex custom agents and subagents are real native surfaces, but they are not packaged the same way as Claude or Cursor plugin agents. Local May 13, 2026 headless probes now prove explicit invocation, built-in-name override, project-local precedence, and discovered `.agents/skills` inheritance. The same maintained headless suite also showed two config-depth caveats: a parent `[[skills.config]] enabled = false` entry did not disable a discovered project skill, and an agent-local `[[skills.config]]` entry did not preload an undiscovered `skills/` path. The maintained `bun scripts/probe-codex-mcp-runtime.ts --json` headless probe now also shows a more precise MCP approval split: default project-scoped and user-scoped root MCP both emit a real `mcp_tool_call` item but fail it with `user cancelled MCP tool call` before any server-side `tools/call`, while the default inline-agent path reaches startup plus `tools/list` and then falls back to `MCP_PROOF_MARKER_MISSING`. The same maintained suite now also proves five approved allow-paths: explicit `[mcp_servers.<id>.tools.<tool>] approval_mode = "approve"` works for project-scoped root MCP, user-scoped root MCP, agent-local inline `mcp_servers`, and custom agents that inherit an approved project-scoped or user-scoped root MCP server. All three approved custom-agent MCP paths still avoid a root `mcp_tool_call` item in the parent `codex exec --json` stream and instead surface child `agents_states` moving through `pending_init` to `completed`; project-scoped servers still do not appear in `codex mcp list`, and user-scoped servers do appear there. The maintained `bun scripts/probe-codex-agents-interactive-runtime.ts --json` trusted interactive probe also showed the same `sandbox_mode = "read-only"` child agent still wrote to the workspace there too, so these fields are not yet uniformly trustworthy runtime boundaries.'
       },
       hooks: {
         mode: "translate",
         nativeSurfaces: ["hooks/hooks.json", ".codex/hooks.json", "~/.codex/hooks.json"],
-        notes: "Hooks are native. Pluxx bundles translated Codex hooks in the plugin and still tracks the project/user config paths plus the codex_hooks feature-gate caveat."
+        notes: "Hooks are native. Pluxx bundles translated Codex hooks in the plugin and still tracks the project/user config paths plus the mixed `[features].hooks` / `[features].codex_hooks` activation caveat and current runtime/doc drift."
       },
       permissions: {
         mode: "translate",
         nativeSurfaces: ["approvals", "sandbox policy", "hook matchers", "custom agent config"],
-        notes: "Codex expresses permission intent through approvals, sandboxing, hooks, and custom agents rather than skill frontmatter."
+        notes: 'Codex expresses permission intent through approvals, sandboxing, hooks, and custom agents rather than skill frontmatter. Pluxx now also emits `.codex/config.generated.toml` for the live-proven top-level MCP allow-path when canonical `MCP(...)` rules are concrete enough to materialize per-tool `approval_mode = "approve"` stanzas, while `.codex/permissions.generated.json` remains the broader advisory mirror.'
       },
       runtime: {
         mode: "preserve",
         nativeSurfaces: [".mcp.json", ".app.json", ".codex/config.toml", "scripts/", "assets/"],
-        notes: `Bundle-local MCP config exists, but active MCP state also lives in config.toml. ${getRuntimeReadinessExternalConfigNote()}`
+        notes: `Bundle-local MCP config exists, but active MCP state also lives in config.toml. Local May 13, 2026 headless Codex MCP probes reached startup plus \`tools/list\` across project-scoped, user-scoped, and inline-agent config; default root MCP emitted a real \`mcp_tool_call\` item but failed it with \`user cancelled MCP tool call\` before any server-side \`tools/call\`, while the default inline-agent path fell back to \`MCP_PROOF_MARKER_MISSING\` after startup plus \`tools/list\`. The same maintained suite now proves five concrete approval paths: project-scoped root MCP, user-scoped root MCP, agent-local inline \`mcp_servers\`, a custom agent inheriting an approved project-scoped root MCP server, and a custom agent inheriting an approved user-scoped root MCP server all reach real server-side \`tools/call\` once explicit \`[mcp_servers.<id>.tools.<tool>] approval_mode = "approve"\` is present in the relevant layer. All three approved custom-agent MCP paths still avoid a root \`mcp_tool_call\` item in the parent \`codex exec --json\` stream and instead surface child \`agents_states\` moving through \`pending_init\` to \`completed\`; project-scoped servers still do not appear in \`codex mcp list\`, and user-scoped servers do appear there. ${getRuntimeReadinessExternalConfigNote()}`
       },
       distribution: {
         mode: "preserve",
@@ -10294,12 +10294,13 @@ function runPublish(config, options = {}) {
 }
 
 // src/cli/verify-install.ts
-import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync5, readlinkSync, realpathSync, statSync } from "fs";
+import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync5, readlinkSync, realpathSync as realpathSync2, statSync } from "fs";
 import { resolve as resolve5 } from "path";
 
 // src/cli/doctor.ts
 import { spawn, spawnSync as spawnSync2 } from "child_process";
-import { accessSync, constants, existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
+import { accessSync, constants, existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync } from "fs";
+import { homedir } from "os";
 import { basename, dirname as dirname2, resolve as resolve4 } from "path";
 
 // node_modules/jiti/lib/jiti.mjs
@@ -10466,7 +10467,7 @@ function resolveBundleReference(rootDir, value) {
 }
 function readBundleManifestReferences(manifest) {
   const references = [];
-  for (const key of ["commands", "skills", "hooks", "mcpServers"]) {
+  for (const key of ["commands", "skills", "hooks", "mcpServers", "rules", "apps"]) {
     const value = manifest[key];
     if (typeof value === "string") {
       references.push(value);
@@ -10504,6 +10505,37 @@ function extractBundleCommandTargets(command) {
   const matches = command.match(/\$\{(?:CLAUDE_PLUGIN_ROOT|CURSOR_PLUGIN_ROOT|PLUGIN_ROOT)\}[\\/][^\s"'`;$|&<>]+|\.\.?[\\/][^\s"'`;$|&<>]+/g);
   return matches ?? [];
 }
+function resolveInstalledHooksReference(rootDir, platform, manifest) {
+  const manifestReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
+  if (manifestReference) {
+    return {
+      reference: manifestReference,
+      path: resolveBundleReference(rootDir, manifestReference)
+    };
+  }
+  if (platform === "claude-code") {
+    const fallbackReference = "./hooks/hooks.json";
+    const fallbackPath = resolve3(rootDir, "hooks/hooks.json");
+    if (existsSync3(fallbackPath)) {
+      return {
+        reference: fallbackReference,
+        path: fallbackPath
+      };
+    }
+  }
+  return {};
+}
+function getClaudeStandardHooksManifestIssue(rootDir, platform, manifest) {
+  if (platform !== "claude-code") return void 0;
+  const manifestReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
+  if (!manifestReference) return void 0;
+  const manifestHooksPath = resolveBundleReference(rootDir, manifestReference);
+  const standardHooksPath = resolve3(rootDir, "hooks/hooks.json");
+  if (!manifestHooksPath || manifestHooksPath !== standardHooksPath || !existsSync3(standardHooksPath)) {
+    return void 0;
+  }
+  return "Claude auto-loads hooks/hooks.json. Current Claude CLI releases report a duplicate hooks file load error when manifest.hooks also points at ./hooks/hooks.json, so manifest.hooks should only reference additional hook files.";
+}
 function findInstalledBundleIntegrityIssues(rootDir, platform) {
   const manifestPath = manifestPathForPlatform(platform);
   if (!manifestPath) {
@@ -10537,17 +10569,19 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
     const resolved = resolveBundleReference(rootDir, value);
     return resolved !== void 0 && !existsSync3(resolved);
   }).sort();
-  const hooksReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
+  const manifestIssue = getClaudeStandardHooksManifestIssue(rootDir, platform, manifest);
+  const { reference: hooksReference, path: hooksPath } = resolveInstalledHooksReference(rootDir, platform, manifest);
   if (!hooksReference) {
     return {
+      ...manifestIssue ? { manifestIssue } : {},
       missingManifestPaths,
       missingHookTargets: [],
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
     };
   }
-  const hooksPath = resolveBundleReference(rootDir, hooksReference);
   if (!hooksPath || !existsSync3(hooksPath)) {
     return {
+      ...manifestIssue ? { manifestIssue } : {},
       missingManifestPaths,
       missingHookTargets: [],
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
@@ -10564,12 +10598,15 @@ function findInstalledBundleIntegrityIssues(rootDir, platform) {
       })
     )].sort();
     return {
+      ...manifestIssue ? { manifestIssue } : {},
       missingManifestPaths,
       missingHookTargets,
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
     };
-  } catch {
+  } catch (error) {
     return {
+      ...manifestIssue ? { manifestIssue } : {},
+      hookConfigIssue: `hooks config at ${hooksReference} is not parseable: ${error instanceof Error ? error.message : String(error)}`,
       missingManifestPaths,
       missingHookTargets: [],
       invalidRuntimeScripts: findInstalledRuntimeScriptIssues(rootDir, manifest)
@@ -10754,6 +10791,180 @@ var MUTATING_PREFIXES = [
 ];
 var MUTATING_PREFIX_PATTERN = new RegExp(`^(${MUTATING_PREFIXES.join("|")})\\b`, "i");
 
+// src/codex-hooks-feature.ts
+var RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG = "hooks";
+var ALTERNATE_CODEX_HOOKS_FEATURE_FLAG = "codex_hooks";
+function getCodexHooksFeatureState(features) {
+  if (!features) {
+    return {
+      recommended: false,
+      alternate: false
+    };
+  }
+  return {
+    recommended: features[RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG] === true,
+    alternate: features[ALTERNATE_CODEX_HOOKS_FEATURE_FLAG] === true
+  };
+}
+
+// src/toml-lite.ts
+function stripTomlComment(line) {
+  let inString = false;
+  let quote = "";
+  for (let i = 0; i < line.length; i += 1) {
+    const char = line[i];
+    if ((char === '"' || char === "'") && line[i - 1] !== "\\") {
+      if (!inString) {
+        inString = true;
+        quote = char;
+      } else if (quote === char) {
+        inString = false;
+        quote = "";
+      }
+      continue;
+    }
+    if (char === "#" && !inString) return line.slice(0, i);
+  }
+  return line;
+}
+function parseTomlValue(value) {
+  if (value.startsWith('"') && value.endsWith('"')) return unquoteTomlString(value);
+  if (value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
+  if (value.startsWith("[") && value.endsWith("]")) {
+    const inner = value.slice(1, -1).trim();
+    if (!inner) return [];
+    return splitTomlList(inner).map((part) => parseTomlValue(part.trim()));
+  }
+  if (value.startsWith("{") && value.endsWith("}")) {
+    const inner = value.slice(1, -1).trim();
+    const result = {};
+    if (!inner) return result;
+    for (const part of splitTomlList(inner)) {
+      const assignment = part.trim().match(/^([A-Za-z0-9_-]+)\s*=\s*(.+)$/);
+      if (!assignment) continue;
+      result[assignment[1]] = parseTomlValue(assignment[2].trim());
+    }
+    return result;
+  }
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return value;
+}
+function splitTomlList(value) {
+  const parts = [];
+  let current = "";
+  let inString = false;
+  let quote = "";
+  let braceDepth = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    const char = value[i];
+    if ((char === '"' || char === "'") && value[i - 1] !== "\\") {
+      if (!inString) {
+        inString = true;
+        quote = char;
+      } else if (quote === char) {
+        inString = false;
+        quote = "";
+      }
+    }
+    if (!inString && char === "{") braceDepth += 1;
+    if (!inString && char === "}") braceDepth -= 1;
+    if (!inString && braceDepth === 0 && char === ",") {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (current.trim()) parts.push(current);
+  return parts;
+}
+function unquoteTomlString(value) {
+  return value.slice(1, -1).replace(/\\"/g, '"').replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\\\/g, "\\");
+}
+
+// src/codex-permissions-companion.ts
+function parseCodexApprovedMcpToolsFromToml(source) {
+  const approvals = /* @__PURE__ */ new Map();
+  let currentSection = null;
+  const addApproval = (entry) => {
+    approvals.set(`${entry.serverName}.${entry.toolName}`, entry);
+  };
+  for (const rawLine of source.split(/\r?\n/)) {
+    const line = stripTomlComment(rawLine).trim();
+    if (!line) continue;
+    const sectionMatch = line.match(/^\[(.+)\]$/);
+    if (sectionMatch) {
+      currentSection = parseCodexApprovalSection(sectionMatch[1].trim());
+      continue;
+    }
+    const assignmentMatch = line.match(/^([^=]+?)\s*=\s*(.+)$/);
+    if (!assignmentMatch) continue;
+    const key = assignmentMatch[1].trim();
+    const parsedValue = parseTomlValue(assignmentMatch[2].trim());
+    if (currentSection && key === "approval_mode" && parsedValue === "approve") {
+      addApproval(currentSection);
+      continue;
+    }
+    if (!key.includes(".")) continue;
+    const entry = parseCodexApprovalAssignment(key, parsedValue);
+    if (entry) addApproval(entry);
+  }
+  return [...approvals.values()].sort((a, b) => a.serverName.localeCompare(b.serverName) || a.toolName.localeCompare(b.toolName));
+}
+function parseCodexApprovalSection(sectionName) {
+  const tokens = splitTomlDottedPath(sectionName);
+  if (tokens.length !== 4) return null;
+  if (tokens[0] !== "mcp_servers" || tokens[2] !== "tools") return null;
+  return {
+    serverName: tokens[1],
+    toolName: tokens[3]
+  };
+}
+function parseCodexApprovalAssignment(key, value) {
+  if (value !== "approve") return null;
+  const tokens = splitTomlDottedPath(key);
+  if (tokens.length !== 5) return null;
+  if (tokens[0] !== "mcp_servers" || tokens[2] !== "tools" || tokens[4] !== "approval_mode") return null;
+  return {
+    serverName: tokens[1],
+    toolName: tokens[3]
+  };
+}
+function splitTomlDottedPath(value) {
+  const parts = [];
+  let current = "";
+  let inString = false;
+  let quote = "";
+  for (let i = 0; i < value.length; i += 1) {
+    const char = value[i];
+    if ((char === '"' || char === "'") && value[i - 1] !== "\\") {
+      if (!inString) {
+        inString = true;
+        quote = char;
+      } else if (quote === char) {
+        inString = false;
+        quote = "";
+      }
+      current += char;
+      continue;
+    }
+    if (!inString && char === ".") {
+      const trimmed2 = current.trim();
+      if (trimmed2) parts.push(trimmed2);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  const trimmed = current.trim();
+  if (trimmed) parts.push(trimmed);
+  return parts.map((part) => {
+    const parsed = parseTomlValue(part);
+    return typeof parsed === "string" ? parsed : part;
+  });
+}
+
 // src/cli/doctor.ts
 var MATERIALIZED_ENV_MARKER = "materialized required config";
 var MIN_NODE_MAJOR = 18;
@@ -10860,6 +11071,278 @@ function detectConsumerLayout(rootDir) {
 function readJsonFile(rootDir, relativePath) {
   return JSON.parse(readFileSync4(resolve4(rootDir, relativePath), "utf-8"));
 }
+function listCodexConfigCandidates(projectRoot) {
+  const projectCandidate = resolve4(projectRoot ?? process.cwd(), ".codex/config.toml");
+  const homeDir = process.env.HOME?.trim() || homedir();
+  const codexHome = process.env.CODEX_HOME?.trim() || resolve4(homeDir, ".codex");
+  const userCandidate = resolve4(codexHome, "config.toml");
+  const seen = /* @__PURE__ */ new Set();
+  const candidates = [];
+  for (const candidate of [
+    { path: projectCandidate, scope: "project" },
+    { path: userCandidate, scope: "user" }
+  ]) {
+    if (seen.has(candidate.path)) continue;
+    seen.add(candidate.path);
+    candidates.push(candidate);
+  }
+  return candidates;
+}
+function readCodexHooksFeatureFlag(filePath) {
+  let inFeaturesTable = false;
+  const lines = readFileSync4(filePath, "utf-8").split(/\r?\n/);
+  let recommended;
+  let alternate;
+  const assignFeatureFlag = (key, rawValue) => {
+    const parsed = parseTomlValue(rawValue.trim());
+    if (typeof parsed !== "boolean") return;
+    if (key === RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG) recommended = parsed;
+    if (key === ALTERNATE_CODEX_HOOKS_FEATURE_FLAG) alternate = parsed;
+  };
+  for (const rawLine of lines) {
+    const line = stripTomlComment(rawLine).trim();
+    if (!line) continue;
+    const sectionMatch = line.match(/^\[(.+)\]$/);
+    if (sectionMatch) {
+      inFeaturesTable = sectionMatch[1].trim() === "features";
+      continue;
+    }
+    const dottedFeatureMatch = line.match(/^features\.(hooks|codex_hooks)\s*=\s*(.+)$/);
+    if (dottedFeatureMatch) {
+      assignFeatureFlag(dottedFeatureMatch[1], dottedFeatureMatch[2]);
+      continue;
+    }
+    const inlineFeaturesMatch = line.match(/^features\s*=\s*(.+)$/);
+    if (inlineFeaturesMatch) {
+      const parsed = parseTomlValue(inlineFeaturesMatch[1].trim());
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const featureState = getCodexHooksFeatureState(parsed);
+        recommended = featureState.recommended;
+        alternate = featureState.alternate;
+      }
+      continue;
+    }
+    if (!inFeaturesTable) continue;
+    const featureMatch = line.match(/^(hooks|codex_hooks)\s*=\s*(.+)$/);
+    if (!featureMatch) continue;
+    assignFeatureFlag(featureMatch[1], featureMatch[2]);
+  }
+  if (recommended === void 0 && alternate === void 0) return void 0;
+  return {
+    recommended: recommended === true,
+    alternate: alternate === true
+  };
+}
+function probeCodexHooksFeatureFlags(projectRoot) {
+  return listCodexConfigCandidates(projectRoot).map((candidate) => {
+    if (!existsSync4(candidate.path)) {
+      return {
+        ...candidate,
+        exists: false,
+        enabled: false,
+        recommendedEnabled: false,
+        alternateEnabled: false
+      };
+    }
+    try {
+      const featureState = readCodexHooksFeatureFlag(candidate.path);
+      return {
+        ...candidate,
+        exists: true,
+        enabled: featureState?.recommended === true || featureState?.alternate === true,
+        recommendedEnabled: featureState?.recommended === true,
+        alternateEnabled: featureState?.alternate === true
+      };
+    } catch (error) {
+      return {
+        ...candidate,
+        exists: true,
+        enabled: false,
+        recommendedEnabled: false,
+        alternateEnabled: false,
+        parseError: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function probeCodexMcpApprovalEntries(projectRoot) {
+  return listCodexConfigCandidates(projectRoot).map((candidate) => {
+    if (!existsSync4(candidate.path)) {
+      return {
+        ...candidate,
+        exists: false,
+        approvals: []
+      };
+    }
+    try {
+      return {
+        ...candidate,
+        exists: true,
+        approvals: parseCodexApprovedMcpToolsFromToml(readFileSync4(candidate.path, "utf-8"))
+      };
+    } catch (error) {
+      return {
+        ...candidate,
+        exists: true,
+        approvals: [],
+        parseError: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function getCodexProjectPathCandidates(projectRoot) {
+  if (!projectRoot) return [];
+  const candidates = /* @__PURE__ */ new Set();
+  const resolvedProjectRoot = resolve4(projectRoot);
+  candidates.add(resolvedProjectRoot);
+  try {
+    candidates.add(realpathSync(resolvedProjectRoot));
+  } catch {
+  }
+  return [...candidates];
+}
+function parseCodexProjectKeySegment(segment) {
+  const trimmed = segment.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    const parsed = parseTomlValue(trimmed);
+    return typeof parsed === "string" ? parsed : null;
+  }
+  return null;
+}
+function readCodexProjectTrust(filePath, projectPaths) {
+  const matchedPaths = /* @__PURE__ */ new Set();
+  let currentProjectKey = null;
+  const lines = readFileSync4(filePath, "utf-8").split(/\r?\n/);
+  for (const rawLine of lines) {
+    const line = stripTomlComment(rawLine).trim();
+    if (!line) continue;
+    const sectionMatch = line.match(/^\[(.+)\]$/);
+    if (sectionMatch) {
+      currentProjectKey = null;
+      const section = sectionMatch[1].trim();
+      if (section.startsWith("projects.")) {
+        currentProjectKey = parseCodexProjectKeySegment(section.slice("projects.".length));
+      }
+      continue;
+    }
+    const dottedTrustMatch = line.match(/^projects\.(.+)\.trust_level\s*=\s*(.+)$/);
+    if (dottedTrustMatch) {
+      const projectKey = parseCodexProjectKeySegment(dottedTrustMatch[1]);
+      const parsed2 = parseTomlValue(dottedTrustMatch[2].trim());
+      if (projectKey && projectPaths.has(projectKey) && parsed2 === "trusted") {
+        matchedPaths.add(projectKey);
+      }
+      continue;
+    }
+    if (!currentProjectKey || !projectPaths.has(currentProjectKey)) continue;
+    const trustMatch = line.match(/^trust_level\s*=\s*(.+)$/);
+    if (!trustMatch) continue;
+    const parsed = parseTomlValue(trustMatch[1].trim());
+    if (parsed === "trusted") {
+      matchedPaths.add(currentProjectKey);
+    }
+  }
+  return [...matchedPaths];
+}
+function probeCodexProjectTrust(projectRoot) {
+  const projectPaths = getCodexProjectPathCandidates(projectRoot);
+  if (projectPaths.length === 0) return void 0;
+  const userConfig = listCodexConfigCandidates(projectRoot).find((candidate) => candidate.scope === "user");
+  if (!userConfig) return void 0;
+  if (!existsSync4(userConfig.path)) {
+    return {
+      path: userConfig.path,
+      exists: false,
+      trusted: false,
+      matchedProjectPaths: []
+    };
+  }
+  try {
+    const matchedProjectPaths = readCodexProjectTrust(userConfig.path, new Set(projectPaths));
+    return {
+      path: userConfig.path,
+      exists: true,
+      trusted: matchedProjectPaths.length > 0,
+      matchedProjectPaths
+    };
+  } catch (error) {
+    return {
+      path: userConfig.path,
+      exists: true,
+      trusted: false,
+      matchedProjectPaths: [],
+      parseError: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function getClaudeManagedSettingsPath() {
+  switch (process.platform) {
+    case "darwin":
+      return "/Library/Application Support/ClaudeCode/managed-settings.json";
+    case "linux":
+      return "/etc/claude-code/managed-settings.json";
+    case "win32":
+      return "C:\\Program Files\\ClaudeCode\\managed-settings.json";
+    default:
+      return void 0;
+  }
+}
+function listClaudeSettingsCandidates(projectRoot) {
+  const homeDir = process.env.HOME?.trim() || homedir();
+  const candidates = [];
+  const managedPath = getClaudeManagedSettingsPath();
+  if (managedPath) {
+    candidates.push({ path: managedPath, scope: "managed" });
+  }
+  candidates.push({ path: resolve4(homeDir, ".claude/settings.json"), scope: "user" });
+  if (projectRoot) {
+    candidates.push({ path: resolve4(projectRoot, ".claude/settings.json"), scope: "project" });
+    candidates.push({ path: resolve4(projectRoot, ".claude/settings.local.json"), scope: "local" });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return candidates.filter((candidate) => {
+    if (seen.has(candidate.path)) return false;
+    seen.add(candidate.path);
+    return true;
+  });
+}
+function readClaudeDisableAllHooks(filePath) {
+  const parsed = readJsonFile(dirname2(filePath), basename(filePath));
+  return typeof parsed.disableAllHooks === "boolean" ? parsed.disableAllHooks : void 0;
+}
+function probeClaudeDisableAllHooks(projectRoot) {
+  return listClaudeSettingsCandidates(projectRoot).map((candidate) => {
+    if (!existsSync4(candidate.path)) {
+      return {
+        ...candidate,
+        exists: false,
+        disableAllHooks: false
+      };
+    }
+    try {
+      return {
+        ...candidate,
+        exists: true,
+        disableAllHooks: readClaudeDisableAllHooks(candidate.path) === true
+      };
+    } catch (error) {
+      return {
+        ...candidate,
+        exists: true,
+        disableAllHooks: false,
+        parseError: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function getInstalledClaudeHooksReference(rootDir, manifest) {
+  if (existsSync4(resolve4(rootDir, "hooks/hooks.json"))) {
+    return "./hooks/hooks.json";
+  }
+  const manifestReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
+  return manifestReference;
+}
 function checkConsumerBundlePath(checks, rootDir) {
   try {
     accessSync(rootDir, constants.R_OK);
@@ -11159,6 +11642,9 @@ function checkInstalledBundleIntegrity(checks, rootDir, layout) {
   if (issues.manifestIssue) {
     details.push(issues.manifestIssue);
   }
+  if (issues.hookConfigIssue) {
+    details.push(issues.hookConfigIssue);
+  }
   if (issues.missingManifestPaths.length > 0) {
     details.push(`manifest references missing path${issues.missingManifestPaths.length === 1 ? "" : "s"}: ${issues.missingManifestPaths.join(", ")}`);
   }
@@ -11182,12 +11668,207 @@ function checkInstalledBundleIntegrity(checks, rootDir, layout) {
   addCheck(checks, {
     level: "error",
     code: "consumer-bundle-integrity-invalid",
-    title: "Installed bundle is missing referenced files",
+    title: "Installed bundle integrity is broken",
     detail: details.join("; "),
-    fix: "Reinstall the plugin or rebuild the bundle so every manifest path and hook target exists in the installed plugin.",
+    fix: "Reinstall the plugin or rebuild the bundle so every manifest path, hook config, and hook target is valid inside the installed plugin.",
     path: layout.manifestPath
   });
 }
+function checkInstalledClaudeHookSettings(checks, rootDir, layout, options) {
+  if (layout.platform !== "claude-code") return;
+  if (checks.some((check) => check.code === "consumer-bundle-integrity-invalid")) return;
+  let manifest;
+  try {
+    manifest = readJsonFile(rootDir, layout.manifestPath);
+  } catch {
+    return;
+  }
+  const hooksReference = getInstalledClaudeHooksReference(rootDir, manifest);
+  if (!hooksReference) return;
+  const probes = probeClaudeDisableAllHooks(options.projectRoot);
+  const disabled = probes.filter((probe) => probe.disableAllHooks);
+  const parseErrors = probes.filter((probe) => probe.parseError).map((probe) => `${probe.path}: ${probe.parseError}`);
+  const checkedPaths = probes.map((probe) => `${probe.scope} ${probe.exists ? "settings" : "path"}: ${probe.path}${probe.exists ? "" : " (missing)"}`).join("; ");
+  if (disabled.length > 0) {
+    addCheck(checks, {
+      level: "warning",
+      code: "consumer-claude-hooks-disabled",
+      title: "Claude settings may currently suppress bundled hook activation",
+      detail: `This installed Claude bundle uses hooks at ${hooksReference}, and \`disableAllHooks = true\` was found in ${disabled.map((probe) => `${probe.scope} settings ${probe.path}`).join(" and ")}. Live Claude CLI 2.1.140 headless probes on 2026-05-13 showed this setting suppressing SessionStart settings-hook execution across user, project, and local layers.${parseErrors.length > 0 ? ` Unparseable settings: ${parseErrors.join("; ")}.` : ""} This check only inspects the file-based managed path plus user/project/local settings; Claude enterprise policy can also arrive through registry, plist/MDM, or server-managed policy, and \`allowManagedHooksOnly\` is not evaluated here.`,
+      fix: "Remove or flip `disableAllHooks` in the active Claude settings layer, run /reload-plugins or restart Claude, rerun pluxx verify-install, and use Claude /status when enterprise managed policy may still control hook activation.",
+      path: disabled[0].path
+    });
+    return;
+  }
+  if (parseErrors.length > 0) {
+    addCheck(checks, {
+      level: "warning",
+      code: "consumer-claude-hook-settings-invalid",
+      title: "Claude hook settings could not be fully inspected",
+      detail: `This installed Claude bundle uses hooks at ${hooksReference}, but some checked Claude settings files were not parseable. Checked ${checkedPaths}. Unparseable settings: ${parseErrors.join("; ")}. This check only inspects the file-based managed path plus user/project/local settings; it does not verify registry, plist/MDM, server-managed policy, or \`allowManagedHooksOnly\`.`,
+      fix: "Fix the malformed Claude settings JSON, reload Claude, rerun pluxx verify-install, and use Claude /status if enterprise policy may still control hook activation.",
+      path: probes.find((probe) => probe.parseError)?.path ?? hooksReference
+    });
+    return;
+  }
+  addCheck(checks, {
+    level: "success",
+    code: "consumer-claude-hook-settings-clear",
+    title: "No checked Claude settings layer is disabling hooks",
+    detail: `This installed Claude bundle uses hooks at ${hooksReference}, and no checked Claude settings layer currently sets \`disableAllHooks = true\`. Checked ${checkedPaths}. This success result only covers the file-based managed path plus user/project/local settings; it does not prove registry, plist/MDM, server-managed policy, or \`allowManagedHooksOnly\` are clear.`,
+    fix: "No action needed.",
+    path: hooksReference
+  });
+}
+function checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options) {
+  if (layout.platform !== "codex") return;
+  if (checks.some((check) => check.code === "consumer-bundle-integrity-invalid")) return;
+  let manifest;
+  try {
+    manifest = readJsonFile(rootDir, layout.manifestPath);
+  } catch {
+    return;
+  }
+  const hooksReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
+  if (!hooksReference) return;
+  const probes = probeCodexHooksFeatureFlags(options.projectRoot);
+  const enabledProbes = probes.filter((probe) => probe.enabled);
+  const checkedPaths = probes.map((probe) => `${probe.scope} ${probe.exists ? "config" : "path"}: ${probe.path}${probe.exists ? "" : " (missing)"}`).join("; ");
+  const describeEnabledFlags = (probe) => {
+    const enabledFlags = [];
+    if (probe.recommendedEnabled) enabledFlags.push(RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG);
+    if (probe.alternateEnabled) enabledFlags.push(ALTERNATE_CODEX_HOOKS_FEATURE_FLAG);
+    return enabledFlags.join(" + ");
+  };
+  if (enabledProbes.length > 0) {
+    const legacyOnlyProbes = enabledProbes.filter((probe) => probe.alternateEnabled && !probe.recommendedEnabled);
+    if (legacyOnlyProbes.length > 0) {
+      addCheck(checks, {
+        level: "warning",
+        code: "consumer-codex-hooks-feature-flag-legacy-only",
+        title: "Codex hooks are enabled only through the legacy compatibility flag",
+        detail: `This installed Codex bundle declares hooks at ${hooksReference}, and the checked Codex config enables only \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\` in ${legacyOnlyProbes.map((probe) => `${probe.scope} config ${probe.path}`).join(" and ")}. Maintained interactive probes on May 13, 2026 showed local Codex CLI 0.130.0 emitting a deprecation warning for \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` that points users to \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\`.`,
+        fix: `Prefer \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the active Codex config, keep \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` only as a compatibility fallback if needed, reload Codex, and rerun pluxx verify-install.`,
+        path: legacyOnlyProbes[0].path
+      });
+    }
+    addCheck(checks, {
+      level: "success",
+      code: "consumer-codex-hooks-feature-flag-enabled",
+      title: "Codex hook feature flag found for this install",
+      detail: `This installed Codex bundle declares hooks at ${hooksReference}, and a Codex hook feature flag was found in ${enabledProbes.map((probe) => `${probe.scope} config ${probe.path} (${describeEnabledFlags(probe)})`).join(" and ")}. Treat that as a prerequisite, not proof of live hook execution: maintained local probes on May 13, 2026 showed local Codex CLI 0.130.0 still failing to execute the project-local hook under \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\`, \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\`, and the current CLI feature path \`--enable hooks\`.`,
+      fix: "No action needed.",
+      path: enabledProbes[0].path
+    });
+    return;
+  }
+  const parseErrors = probes.filter((probe) => probe.parseError).map((probe) => `${probe.path}: ${probe.parseError}`);
+  addCheck(checks, {
+    level: "warning",
+    code: "consumer-codex-hooks-feature-flag-missing",
+    title: "Codex hook activation is missing its known feature-gate prerequisite",
+    detail: `This installed Codex bundle declares hooks at ${hooksReference}, but neither \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` nor \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\` was found in the checked Codex config layers. Current Codex config surfaces still accept both keys under \`[features]\`, but maintained probes on May 13, 2026 showed local Codex CLI 0.130.0 still failing to execute the project-local hook under \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\`, \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG} = true\`, and the current CLI feature path \`--enable hooks\`, while also emitting a deprecation warning for \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` that points users to \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG}\`. Checked ${checkedPaths}.${parseErrors.length > 0 ? ` Unparseable config: ${parseErrors.join("; ")}.` : ""}`,
+    fix: `Enable \`${RECOMMENDED_CODEX_HOOKS_FEATURE_FLAG} = true\` under \`[features]\` in the relevant project or user Codex config, reload Codex, and rerun pluxx verify-install. Keep \`${ALTERNATE_CODEX_HOOKS_FEATURE_FLAG}\` only as a compatibility fallback if your Codex runtime still needs it, and treat any enabled flag as best-effort activation rather than proof that hooks will execute.`,
+    path: probes.find((probe) => probe.exists)?.path ?? hooksReference
+  });
+}
+function checkInstalledCodexProjectTrust(checks, rootDir, layout, options) {
+  if (layout.platform !== "codex") return;
+  if (checks.some((check) => check.code === "consumer-bundle-integrity-invalid")) return;
+  if (!options.projectRoot) return;
+  let manifest;
+  try {
+    manifest = readJsonFile(rootDir, layout.manifestPath);
+  } catch {
+    return;
+  }
+  const hooksReference = typeof manifest.hooks === "string" ? manifest.hooks : void 0;
+  if (!hooksReference) return;
+  const trustProbe = probeCodexProjectTrust(options.projectRoot);
+  if (!trustProbe) return;
+  const projectPaths = getCodexProjectPathCandidates(options.projectRoot);
+  const displayProjectPaths = projectPaths.join(" or ");
+  const parseErrorDetail = trustProbe.parseError ? ` Unparseable user config: ${trustProbe.parseError}.` : "";
+  if (trustProbe.trusted) {
+    addCheck(checks, {
+      level: "success",
+      code: "consumer-codex-project-trust-enabled",
+      title: "Codex trusted-project entry found for this install",
+      detail: `This installed Codex bundle declares hooks at ${hooksReference}, and the user Codex config ${trustProbe.path} trusts ${trustProbe.matchedProjectPaths.join(" and ")} for project-local hook loading.`,
+      fix: "No action needed.",
+      path: trustProbe.path
+    });
+    return;
+  }
+  addCheck(checks, {
+    level: "warning",
+    code: "consumer-codex-project-trust-missing",
+    title: "Codex project trust may still block hook activation",
+    detail: `This installed Codex bundle declares hooks at ${hooksReference}, but the user Codex config ${trustProbe.exists ? trustProbe.path : `${trustProbe.path} (missing)`} does not currently trust ${displayProjectPaths}. Current Codex CLI releases can keep project-local config, hooks, and exec policies disabled until the project is trusted.${parseErrorDetail}`,
+    fix: `Trust the project in Codex, or add a matching \`[projects."<absolute-project-path>"]\\ntrust_level = "trusted"\` entry in ${trustProbe.path}, reload Codex, retry a trusted interactive prompt, and rerun pluxx verify-install if hooks still do not activate.`,
+    path: trustProbe.path
+  });
+}
+function checkInstalledCodexPermissionCompanion(checks, rootDir, layout, options) {
+  if (layout.platform !== "codex") return;
+  if (checks.some((check) => check.code === "consumer-bundle-integrity-invalid")) return;
+  const companionPath = resolve4(rootDir, ".codex/config.generated.toml");
+  const companionReference = ".codex/config.generated.toml";
+  if (!existsSync4(companionPath)) return;
+  let expectedEntries;
+  try {
+    expectedEntries = parseCodexApprovedMcpToolsFromToml(readFileSync4(companionPath, "utf-8"));
+  } catch (error) {
+    addCheck(checks, {
+      level: "error",
+      code: "consumer-codex-mcp-approval-companion-invalid",
+      title: "Generated Codex MCP approval companion is malformed",
+      detail: `${companionReference} could not be parsed: ${error instanceof Error ? error.message : String(error)}`,
+      fix: "Rebuild or reinstall the plugin so the generated Codex MCP approval companion is written correctly before you merge it into active Codex config.",
+      path: companionReference
+    });
+    return;
+  }
+  if (expectedEntries.length === 0) return;
+  const probes = probeCodexMcpApprovalEntries(options.projectRoot);
+  const checkedPaths = probes.map((probe) => `${probe.scope} ${probe.exists ? "config" : "path"}: ${probe.path}${probe.exists ? "" : " (missing)"}`).join("; ");
+  const parseErrors = probes.filter((probe) => probe.parseError).map((probe) => `${probe.path}: ${probe.parseError}`);
+  const activeEntries = new Set(
+    probes.flatMap((probe) => probe.approvals.map((entry) => `${entry.serverName}.${entry.toolName}`))
+  );
+  const missingEntries = expectedEntries.filter((entry) => !activeEntries.has(`${entry.serverName}.${entry.toolName}`));
+  const formatEntries = (entries) => entries.map((entry) => `${entry.serverName}.${entry.toolName}`).join(", ");
+  if (missingEntries.length > 0) {
+    addCheck(checks, {
+      level: "warning",
+      code: "consumer-codex-mcp-approval-config-missing",
+      title: "Generated Codex MCP approval stanzas are not fully merged into active config",
+      detail: `This installed Codex bundle includes ${companionReference} with ${expectedEntries.length} per-tool approval stanza${expectedEntries.length === 1 ? "" : "s"}, but the checked Codex config layers are still missing ${missingEntries.length === expectedEntries.length ? "all of them" : formatEntries(missingEntries)}. Checked ${checkedPaths}.${parseErrors.length > 0 ? ` Unparseable config: ${parseErrors.join("; ")}.` : ""} Live maintained Codex MCP probes on May 13, 2026 only proved this approval path once explicit per-tool \`approval_mode = "approve"\` entries were merged into active config.`,
+      fix: `Merge the missing stanza${missingEntries.length === 1 ? "" : "s"} from ${companionReference} into the active project or user Codex config.toml, reload Codex, and rerun pluxx verify-install. Keep .codex/permissions.generated.json as the broader mirror for selectors that still remain external.`,
+      path: companionReference
+    });
+    return;
+  }
+  if (parseErrors.length > 0) {
+    addCheck(checks, {
+      level: "warning",
+      code: "consumer-codex-mcp-approval-config-unparseable",
+      title: "Codex MCP approval config could not be fully inspected",
+      detail: `This installed Codex bundle includes ${companionReference}, and matching approval stanzas were found in the checked Codex config layers, but some config files were not parseable. Checked ${checkedPaths}. Unparseable config: ${parseErrors.join("; ")}.`,
+      fix: "Fix the malformed Codex config, reload Codex, and rerun pluxx verify-install so Pluxx can confirm the generated approval stanzas are still merged correctly.",
+      path: probes.find((probe) => probe.parseError)?.path ?? companionReference
+    });
+    return;
+  }
+  addCheck(checks, {
+    level: "success",
+    code: "consumer-codex-mcp-approval-config-merged",
+    title: "Generated Codex MCP approval stanzas are present in active config",
+    detail: `This installed Codex bundle includes ${companionReference} with ${expectedEntries.length} per-tool approval stanza${expectedEntries.length === 1 ? "" : "s"}, and matching entries were found in the checked Codex config layers. Checked ${checkedPaths}.`,
+    fix: "No action needed.",
+    path: companionReference
+  });
+}
 function parseInstalledPermissionRules(scriptSource) {
   const match = scriptSource.match(/const RULES = (\[[\s\S]*?\]);\nconst ACTION_PRIORITY/);
   if (!match?.[1]) {
@@ -11552,7 +12233,7 @@ function checkInstalledOpenCodeSkills(checks, rootDir) {
     const missingDetail = missingSkills.length > 0 ? `missing exported skills: ${missingSkills.join(", ")}` : void 0;
     const malformedDetail = malformedSkills.length > 0 ? `malformed exported skills: ${malformedSkills.join(", ")}` : void 0;
     addCheck(checks, {
-      level: "warning",
+      level: "error",
       code: "consumer-opencode-skill-sync-incomplete",
       title: "OpenCode exported skills are incomplete",
       detail: [missingDetail, malformedDetail].filter(Boolean).join("; "),
@@ -11570,7 +12251,7 @@ function checkInstalledOpenCodeSkills(checks, rootDir) {
     path: "skills"
   });
 }
-async function doctorConsumer(rootDir = process.cwd()) {
+async function doctorConsumer(rootDir = process.cwd(), options = {}) {
   const checks = [];
   addRuntimeChecks(checks, "consumer");
   checkConsumerBundlePath(checks, rootDir);
@@ -11615,6 +12296,10 @@ async function doctorConsumer(rootDir = process.cwd()) {
   });
   checkConsumerManifest(checks, rootDir, layout);
   checkInstalledBundleIntegrity(checks, rootDir, layout);
+  checkInstalledClaudeHookSettings(checks, rootDir, layout, options);
+  checkInstalledCodexHooksFeatureFlag(checks, rootDir, layout, options);
+  checkInstalledCodexProjectTrust(checks, rootDir, layout, options);
+  checkInstalledCodexPermissionCompanion(checks, rootDir, layout, options);
   checkInstalledPermissionHook(checks, rootDir, layout);
   checkInstalledUserConfig(checks, rootDir);
   checkInstalledEnvValidation(checks, rootDir);
@@ -11632,6 +12317,7 @@ function buildCheckFromReport(target, pluginName, report) {
   const consumerPath = resolveInstalledConsumerPath(target, pluginName);
   const staleReason = target.built && existsSync5(consumerPath) ? detectStaleInstall(target, pluginName, consumerPath) : void 0;
   const stale = staleReason !== void 0;
+  const issues = listVerifyInstallIssues(report.checks);
   return {
     platform: target.platform,
     installPath: consumerPath,
@@ -11643,9 +12329,22 @@ function buildCheckFromReport(target, pluginName, report) {
     ok: report.errors === 0 && !stale,
     errors: report.errors + (stale ? 1 : 0),
     warnings: report.warnings,
-    infos: report.infos
+    infos: report.infos,
+    issues
   };
 }
+function listVerifyInstallIssues(checks) {
+  return checks.filter(
+    (check) => !check.code.startsWith("primitive-") && check.level !== "success"
+  ).map((check) => ({
+    level: check.level,
+    code: check.code,
+    title: check.title,
+    detail: check.detail,
+    fix: check.fix,
+    ...check.path ? { path: check.path } : {}
+  }));
+}
 function manifestPathForPlatform2(platform) {
   switch (platform) {
     case "claude-code":
@@ -11708,8 +12407,8 @@ function detectStaleInstall(target, pluginName, consumerPath) {
   try {
     const details = lstatSync2(consumerPath);
     if (details.isSymbolicLink()) {
-      const installedRealPath = realpathSync(consumerPath);
-      const builtRealPath = realpathSync(target.sourceDir);
+      const installedRealPath = realpathSync2(consumerPath);
+      const builtRealPath = realpathSync2(target.sourceDir);
       if (installedRealPath !== builtRealPath) {
         return `installed symlink points to ${readlinkSync(consumerPath)}, not the current build at ${target.sourceDir}`;
       }
@@ -11736,7 +12435,7 @@ async function verifyInstall(config, options = {}) {
   const checks = await Promise.all(
     filteredPlan.map(async (target) => {
       const consumerPath = resolveInstalledConsumerPath(target, config.name);
-      const report = await doctorConsumer(consumerPath);
+      const report = await doctorConsumer(consumerPath, { projectRoot: rootDir });
       return buildCheckFromReport(target, config.name, report);
     })
   );
@@ -11754,6 +12453,13 @@ function printVerifyInstallResult(result) {
     console.log(`${prefix} ${check.platform}: ${check.consumerPath}`);
     console.log(`  install path: ${check.installPath}`);
     console.log(`  built: ${check.built ? "yes" : "no"}; installed: ${check.installed ? "yes" : "no"}; errors: ${check.errors}; warnings: ${check.warnings}; infos: ${check.infos}`);
+    for (const issue of check.issues) {
+      const issuePrefix = issue.level.toUpperCase().padEnd(7, " ");
+      const pathLabel = issue.path ? ` [${issue.path}]` : "";
+      console.log(`  ${issuePrefix} ${issue.code}${pathLabel} ${issue.title}`);
+      console.log(`           ${issue.detail}`);
+      console.log(`           Fix: ${issue.fix}`);
+    }
     if (check.stale) {
       console.log(`  stale install: ${check.staleReason}`);
     }