@themoltnet/legreffier 0.9.0 → 0.10.0

package/README.md

@@ -299,11 +299,10 @@ Then just `pnpm codex`.
 
 ## Activation
 
-Once inside a Claude Code or Codex session:
+Once inside a coding session, activate the skill:
 
-```
-/legreffier
-```
+- **Claude Code**: `/legreffier`
+- **Codex**: `$legreffier`
 
 This sets `GIT_CONFIG_GLOBAL` to the agent's gitconfig, verifies the signing
 key, and confirms readiness. All subsequent git commits use the agent identity.

package/dist/index.js

@@ -6,9 +6,9 @@ import { execFileSync } from "node:child_process";
 import { join } from "node:path";
 import { useState, useEffect, useReducer, useRef } from "react";
 import figlet from "figlet";
+import { createHash, randomBytes as randomBytes$2 } from "crypto";
 import { readFile, writeFile, mkdir, chmod, rm } from "node:fs/promises";
 import { homedir } from "node:os";
-import { createHash, randomBytes as randomBytes$2 } from "crypto";
 import { parse, stringify } from "smol-toml";
 import open from "open";
 const MOLTNET_GITCONFIG_RE = /\.moltnet\/([^/]+)\/gitconfig$/;
@@ -2183,15 +2183,15 @@ let wNAF$1 = class wNAF {
     const { windows, windowSize } = calcWOpts(W2, this.bits);
     const points = [];
     let p = point;
-    let base = p;
+    let base2 = p;
     for (let window = 0; window < windows; window++) {
-      base = p;
-      points.push(base);
+      base2 = p;
+      points.push(base2);
       for (let i = 1; i < windowSize; i++) {
-        base = base.add(p);
-        points.push(base);
+        base2 = base2.add(p);
+        points.push(base2);
       }
-      p = base.double();
+      p = base2.double();
     }
     return points;
   }
@@ -4076,87 +4076,399 @@ const createClient = (config = {}) => {
 createClient(
   createConfig({ baseUrl: "https://api.themolt.net" })
 );
-class MoltNetError extends Error {
-  constructor(message, options) {
-    super(message);
-    __publicField(this, "code");
-    __publicField(this, "statusCode");
-    __publicField(this, "detail");
-    this.name = "MoltNetError";
-    this.code = options.code;
-    this.statusCode = options.statusCode;
-    this.detail = options.detail;
+function coerce$1(o) {
+  if (o instanceof Uint8Array && o.constructor.name === "Uint8Array") {
+    return o;
   }
+  if (o instanceof ArrayBuffer) {
+    return new Uint8Array(o);
+  }
+  if (ArrayBuffer.isView(o)) {
+    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength);
+  }
+  throw new Error("Unknown type, must be binary type");
 }
-function problemToError(problem, statusCode) {
-  return new MoltNetError(problem.title ?? "Request failed", {
-    code: problem.type ?? problem.code ?? "UNKNOWN",
-    statusCode,
-    detail: problem.detail
-  });
-}
-async function writeMcpConfig(mcpConfig, dir2) {
-  const targetDir = dir2 ?? process.cwd();
-  const filePath = join(targetDir, ".mcp.json");
-  let existing = {};
-  try {
-    const content = await readFile(filePath, "utf-8");
-    existing = JSON.parse(content);
-  } catch {
+function base$1(ALPHABET, name2) {
+  if (ALPHABET.length >= 255) {
+    throw new TypeError("Alphabet too long");
   }
-  const merged = {
-    ...existing,
-    mcpServers: {
-      ...existing.mcpServers ?? {},
-      ...mcpConfig.mcpServers
+  var BASE_MAP = new Uint8Array(256);
+  for (var j = 0; j < BASE_MAP.length; j++) {
+    BASE_MAP[j] = 255;
+  }
+  for (var i = 0; i < ALPHABET.length; i++) {
+    var x = ALPHABET.charAt(i);
+    var xc = x.charCodeAt(0);
+    if (BASE_MAP[xc] !== 255) {
+      throw new TypeError(x + " is ambiguous");
+    }
+    BASE_MAP[xc] = i;
+  }
+  var BASE = ALPHABET.length;
+  var LEADER = ALPHABET.charAt(0);
+  var FACTOR = Math.log(BASE) / Math.log(256);
+  var iFACTOR = Math.log(256) / Math.log(BASE);
+  function encode2(source) {
+    if (source instanceof Uint8Array)
+      ;
+    else if (ArrayBuffer.isView(source)) {
+      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+    } else if (Array.isArray(source)) {
+      source = Uint8Array.from(source);
+    }
+    if (!(source instanceof Uint8Array)) {
+      throw new TypeError("Expected Uint8Array");
+    }
+    if (source.length === 0) {
+      return "";
+    }
+    var zeroes = 0;
+    var length2 = 0;
+    var pbegin = 0;
+    var pend = source.length;
+    while (pbegin !== pend && source[pbegin] === 0) {
+      pbegin++;
+      zeroes++;
+    }
+    var size = (pend - pbegin) * iFACTOR + 1 >>> 0;
+    var b58 = new Uint8Array(size);
+    while (pbegin !== pend) {
+      var carry = source[pbegin];
+      var i2 = 0;
+      for (var it1 = size - 1; (carry !== 0 || i2 < length2) && it1 !== -1; it1--, i2++) {
+        carry += 256 * b58[it1] >>> 0;
+        b58[it1] = carry % BASE >>> 0;
+        carry = carry / BASE >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length2 = i2;
+      pbegin++;
     }
+    var it2 = size - length2;
+    while (it2 !== size && b58[it2] === 0) {
+      it2++;
+    }
+    var str = LEADER.repeat(zeroes);
+    for (; it2 < size; ++it2) {
+      str += ALPHABET.charAt(b58[it2]);
+    }
+    return str;
+  }
+  function decodeUnsafe(source) {
+    if (typeof source !== "string") {
+      throw new TypeError("Expected String");
+    }
+    if (source.length === 0) {
+      return new Uint8Array();
+    }
+    var psz = 0;
+    if (source[psz] === " ") {
+      return;
+    }
+    var zeroes = 0;
+    var length2 = 0;
+    while (source[psz] === LEADER) {
+      zeroes++;
+      psz++;
+    }
+    var size = (source.length - psz) * FACTOR + 1 >>> 0;
+    var b256 = new Uint8Array(size);
+    while (source[psz]) {
+      var carry = BASE_MAP[source.charCodeAt(psz)];
+      if (carry === 255) {
+        return;
+      }
+      var i2 = 0;
+      for (var it3 = size - 1; (carry !== 0 || i2 < length2) && it3 !== -1; it3--, i2++) {
+        carry += BASE * b256[it3] >>> 0;
+        b256[it3] = carry % 256 >>> 0;
+        carry = carry / 256 >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length2 = i2;
+      psz++;
+    }
+    if (source[psz] === " ") {
+      return;
+    }
+    var it4 = size - length2;
+    while (it4 !== size && b256[it4] === 0) {
+      it4++;
+    }
+    var vch = new Uint8Array(zeroes + (size - it4));
+    var j2 = zeroes;
+    while (it4 !== size) {
+      vch[j2++] = b256[it4++];
+    }
+    return vch;
+  }
+  function decode2(string) {
+    var buffer = decodeUnsafe(string);
+    if (buffer) {
+      return buffer;
+    }
+    throw new Error(`Non-${name2} character`);
+  }
+  return {
+    encode: encode2,
+    decodeUnsafe,
+    decode: decode2
   };
-  await writeFile(filePath, JSON.stringify(merged, null, 2) + "\n");
-  return filePath;
-}
-function getConfigDir() {
-  return join(homedir(), ".config", "moltnet");
-}
-function getConfigPath(configDir) {
-  return join(configDir ?? getConfigDir(), "moltnet.json");
 }
-async function readConfig(configDir) {
-  const dir2 = configDir ?? getConfigDir();
-  try {
-    const content = await readFile(join(dir2, "moltnet.json"), "utf-8");
-    return JSON.parse(content);
-  } catch {
+var src$1 = base$1;
+var _brrp__multiformats_scope_baseX$1 = src$1;
+let Encoder$1 = class Encoder {
+  constructor(name2, prefix, baseEncode) {
+    __publicField(this, "name");
+    __publicField(this, "prefix");
+    __publicField(this, "baseEncode");
+    this.name = name2;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+  }
+  encode(bytes) {
+    if (bytes instanceof Uint8Array) {
+      return `${this.prefix}${this.baseEncode(bytes)}`;
+    } else {
+      throw Error("Unknown type, must be binary type");
+    }
   }
-  try {
-    const content = await readFile(join(dir2, "credentials.json"), "utf-8");
-    console.warn(
-      "Warning: credentials.json is deprecated. New writes use moltnet.json. Support will be removed in 3 minor versions."
-    );
-    return JSON.parse(content);
-  } catch {
-    return null;
+};
+let Decoder$1 = class Decoder {
+  constructor(name2, prefix, baseDecode) {
+    __publicField(this, "name");
+    __publicField(this, "prefix");
+    __publicField(this, "baseDecode");
+    __publicField(this, "prefixCodePoint");
+    this.name = name2;
+    this.prefix = prefix;
+    const prefixCodePoint = prefix.codePointAt(0);
+    if (prefixCodePoint === void 0) {
+      throw new Error("Invalid prefix character");
+    }
+    this.prefixCodePoint = prefixCodePoint;
+    this.baseDecode = baseDecode;
   }
+  decode(text) {
+    if (typeof text === "string") {
+      if (text.codePointAt(0) !== this.prefixCodePoint) {
+        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`);
+      }
+      return this.baseDecode(text.slice(this.prefix.length));
+    } else {
+      throw Error("Can only multibase decode strings");
+    }
+  }
+  or(decoder) {
+    return or$1(this, decoder);
+  }
+};
+let ComposedDecoder$1 = class ComposedDecoder {
+  constructor(decoders) {
+    __publicField(this, "decoders");
+    this.decoders = decoders;
+  }
+  or(decoder) {
+    return or$1(this, decoder);
+  }
+  decode(input) {
+    const prefix = input[0];
+    const decoder = this.decoders[prefix];
+    if (decoder != null) {
+      return decoder.decode(input);
+    } else {
+      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`);
+    }
+  }
+};
+function or$1(left, right) {
+  return new ComposedDecoder$1({
+    ...left.decoders ?? { [left.prefix]: left },
+    ...right.decoders ?? { [right.prefix]: right }
+  });
 }
-async function writeConfig(config, configDir) {
-  const dir2 = configDir ?? getConfigDir();
-  await mkdir(dir2, { recursive: true });
-  const filePath = join(dir2, "moltnet.json");
-  await writeFile(filePath, JSON.stringify(config, null, 2) + "\n", {
-    mode: 384
+let Codec$1 = class Codec {
+  constructor(name2, prefix, baseEncode, baseDecode) {
+    __publicField(this, "name");
+    __publicField(this, "prefix");
+    __publicField(this, "baseEncode");
+    __publicField(this, "baseDecode");
+    __publicField(this, "encoder");
+    __publicField(this, "decoder");
+    this.name = name2;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+    this.baseDecode = baseDecode;
+    this.encoder = new Encoder$1(name2, prefix, baseEncode);
+    this.decoder = new Decoder$1(name2, prefix, baseDecode);
+  }
+  encode(input) {
+    return this.encoder.encode(input);
+  }
+  decode(input) {
+    return this.decoder.decode(input);
+  }
+};
+function from$1({ name: name2, prefix, encode: encode2, decode: decode2 }) {
+  return new Codec$1(name2, prefix, encode2, decode2);
+}
+function baseX$1({ name: name2, prefix, alphabet }) {
+  const { encode: encode2, decode: decode2 } = _brrp__multiformats_scope_baseX$1(alphabet, name2);
+  return from$1({
+    prefix,
+    name: name2,
+    encode: encode2,
+    decode: (text) => coerce$1(decode2(text))
   });
-  await chmod(filePath, 384);
-  return filePath;
 }
-async function updateConfigSection(section, data, configDir) {
-  const config = await readConfig(configDir);
-  if (!config) {
-    throw new Error("No config found — run `moltnet register` first");
+function decode$3(string, alphabetIdx, bitsPerChar, name2) {
+  let end = string.length;
+  while (string[end - 1] === "=") {
+    --end;
+  }
+  const out = new Uint8Array(end * bitsPerChar / 8 | 0);
+  let bits = 0;
+  let buffer = 0;
+  let written = 0;
+  for (let i = 0; i < end; ++i) {
+    const value = alphabetIdx[string[i]];
+    if (value === void 0) {
+      throw new SyntaxError(`Non-${name2} character`);
+    }
+    buffer = buffer << bitsPerChar | value;
+    bits += bitsPerChar;
+    if (bits >= 8) {
+      bits -= 8;
+      out[written++] = 255 & buffer >> bits;
+    }
   }
-  const existing = config[section] ?? {};
-  const updated = { ...existing, ...data };
-  Object.assign(config, { [section]: updated });
-  await writeConfig(config, configDir);
+  if (bits >= bitsPerChar || (255 & buffer << 8 - bits) !== 0) {
+    throw new SyntaxError("Unexpected end of data");
+  }
+  return out;
+}
+function encode$1(data, alphabet, bitsPerChar) {
+  const pad = alphabet[alphabet.length - 1] === "=";
+  const mask = (1 << bitsPerChar) - 1;
+  let out = "";
+  let bits = 0;
+  let buffer = 0;
+  for (let i = 0; i < data.length; ++i) {
+    buffer = buffer << 8 | data[i];
+    bits += 8;
+    while (bits > bitsPerChar) {
+      bits -= bitsPerChar;
+      out += alphabet[mask & buffer >> bits];
+    }
+  }
+  if (bits !== 0) {
+    out += alphabet[mask & buffer << bitsPerChar - bits];
+  }
+  if (pad) {
+    while ((out.length * bitsPerChar & 7) !== 0) {
+      out += "=";
+    }
+  }
+  return out;
+}
+function createAlphabetIdx$1(alphabet) {
+  const alphabetIdx = {};
+  for (let i = 0; i < alphabet.length; ++i) {
+    alphabetIdx[alphabet[i]] = i;
+  }
+  return alphabetIdx;
 }
+function rfc4648$1({ name: name2, prefix, bitsPerChar, alphabet }) {
+  const alphabetIdx = createAlphabetIdx$1(alphabet);
+  return from$1({
+    prefix,
+    name: name2,
+    encode(input) {
+      return encode$1(input, alphabet, bitsPerChar);
+    },
+    decode(input) {
+      return decode$3(input, alphabetIdx, bitsPerChar, name2);
+    }
+  });
+}
+rfc4648$1({
+  prefix: "b",
+  name: "base32",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "B",
+  name: "base32upper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "c",
+  name: "base32pad",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567=",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "C",
+  name: "base32padupper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "v",
+  name: "base32hex",
+  alphabet: "0123456789abcdefghijklmnopqrstuv",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "V",
+  name: "base32hexupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "t",
+  name: "base32hexpad",
+  alphabet: "0123456789abcdefghijklmnopqrstuv=",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "T",
+  name: "base32hexpadupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV=",
+  bitsPerChar: 5
+});
+rfc4648$1({
+  prefix: "h",
+  name: "base32z",
+  alphabet: "ybndrfg8ejkmcpqxot1uwisza345h769",
+  bitsPerChar: 5
+});
+baseX$1({
+  prefix: "k",
+  name: "base36",
+  alphabet: "0123456789abcdefghijklmnopqrstuvwxyz"
+});
+baseX$1({
+  prefix: "K",
+  name: "base36upper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+});
+baseX$1({
+  name: "base58btc",
+  prefix: "z",
+  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+});
+baseX$1({
+  name: "base58flickr",
+  prefix: "Z",
+  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
+});
 etc.sha512Sync = (...m) => {
   const hash = createHash("sha512");
   m.forEach((msg) => hash.update(msg));
@@ -4265,6 +4577,87 @@ function toSSHPrivateKey(seedBase64) {
     // trailing newline
   ].join("\n");
 }
+class MoltNetError extends Error {
+  constructor(message, options) {
+    super(message);
+    __publicField(this, "code");
+    __publicField(this, "statusCode");
+    __publicField(this, "detail");
+    this.name = "MoltNetError";
+    this.code = options.code;
+    this.statusCode = options.statusCode;
+    this.detail = options.detail;
+  }
+}
+function problemToError(problem, statusCode) {
+  return new MoltNetError(problem.title ?? "Request failed", {
+    code: problem.type ?? problem.code ?? "UNKNOWN",
+    statusCode,
+    detail: problem.detail
+  });
+}
+async function writeMcpConfig(mcpConfig, dir2) {
+  const targetDir = dir2 ?? process.cwd();
+  const filePath = join(targetDir, ".mcp.json");
+  let existing = {};
+  try {
+    const content = await readFile(filePath, "utf-8");
+    existing = JSON.parse(content);
+  } catch {
+  }
+  const merged = {
+    ...existing,
+    mcpServers: {
+      ...existing.mcpServers ?? {},
+      ...mcpConfig.mcpServers
+    }
+  };
+  await writeFile(filePath, JSON.stringify(merged, null, 2) + "\n");
+  return filePath;
+}
+function getConfigDir() {
+  return join(homedir(), ".config", "moltnet");
+}
+function getConfigPath(configDir) {
+  return join(configDir ?? getConfigDir(), "moltnet.json");
+}
+async function readConfig(configDir) {
+  const dir2 = configDir ?? getConfigDir();
+  try {
+    const content = await readFile(join(dir2, "moltnet.json"), "utf-8");
+    return JSON.parse(content);
+  } catch {
+  }
+  try {
+    const content = await readFile(join(dir2, "credentials.json"), "utf-8");
+    console.warn(
+      "Warning: credentials.json is deprecated. New writes use moltnet.json. Support will be removed in 3 minor versions."
+    );
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+async function writeConfig(config, configDir) {
+  const dir2 = configDir ?? getConfigDir();
+  await mkdir(dir2, { recursive: true });
+  const filePath = join(dir2, "moltnet.json");
+  await writeFile(filePath, JSON.stringify(config, null, 2) + "\n", {
+    mode: 384
+  });
+  await chmod(filePath, 384);
+  return filePath;
+}
+async function updateConfigSection(section, data, configDir) {
+  const config = await readConfig(configDir);
+  if (!config) {
+    throw new Error("No config found — run `moltnet register` first");
+  }
+  const existing = config[section] ?? {};
+  const updated = { ...existing, ...data };
+  Object.assign(config, { [section]: updated });
+  await writeConfig(config, configDir);
+}
 async function exportSSHKey(opts) {
   const config = await readConfig(opts == null ? void 0 : opts.configDir);
   if (!config) {
@@ -4393,16 +4786,91 @@ function buildGhTokenRule(agentName) {
     "# GitHub CLI Authentication (LeGreffier)",
     "",
     `When \`GIT_CONFIG_GLOBAL\` is set to \`.moltnet/${agentName}/gitconfig\`,`,
-    "authenticate all `gh` CLI commands as the GitHub App by prefixing them with:",
+    "authenticate `gh` CLI commands as the GitHub App by prefixing them with:",
     "",
     "```bash",
-    'GH_TOKEN=$(moltnet github token --credentials "$(dirname "$GIT_CONFIG_GLOBAL")/moltnet.json") gh <command>',
+    'GH_TOKEN=$(npx @themoltnet/cli github token --credentials "$(dirname "$GIT_CONFIG_GLOBAL")/moltnet.json") gh <command>',
     "```",
     "",
-    "This ensures `gh pr create`, `gh issue create`, etc. use the",
-    "GitHub App's identity instead of the user's personal token.",
+    "The token is cached locally (~1 hour lifetime, 5-min expiry buffer),",
+    "so repeated calls are fast after the first API hit.",
+    "",
+    "## Allowed `gh` subcommands",
     "",
-    "The token is short-lived (~1 hour) and generated on each invocation.",
+    "The GitHub App only has these permissions:",
+    "",
+    "- `gh pr ...` (pull_requests: write)",
+    "- `gh issue ...` (issues: write)",
+    "- `gh api repos/{owner}/{repo}/contents/...` (contents: write)",
+    "- `gh repo view`, `gh repo clone` (metadata: read + contents: read)",
+    "",
+    "Do NOT use `GH_TOKEN` for other `gh` commands (releases, actions, packages, etc.).",
+    "",
+    "## 401 recovery",
+    "",
+    "If you get a 401 error, the cached token may be stale. Delete",
+    "`gh-token-cache.json` next to `moltnet.json` and retry.",
+    ""
+  ].join("\n");
+}
+function buildCodexRules(_agentName) {
+  return [
+    "# Codex sandbox rules for LeGreffier",
+    "#",
+    "# Allow the commands that the legreffier skill needs to run.",
+    "# GH_TOKEN is injected inline; see $legreffier skill for details.",
+    "",
+    "# Read-only git commands (session activation & commit workflow)",
+    "prefix_rule(",
+    '    pattern = ["git", "config"],',
+    '    decision = "allow",',
+    ")",
+    "prefix_rule(",
+    '    pattern = ["git", "diff"],',
+    '    decision = "allow",',
+    ")",
+    "prefix_rule(",
+    '    pattern = ["git", "log"],',
+    '    decision = "allow",',
+    ")",
+    "prefix_rule(",
+    '    pattern = ["git", "rev-parse"],',
+    '    decision = "allow",',
+    ")",
+    "prefix_rule(",
+    '    pattern = ["git", "worktree", "list"],',
+    '    decision = "allow",',
+    ")",
+    "",
+    "# MoltNet CLI — signing & token generation",
+    "prefix_rule(",
+    '    pattern = ["npx", "@themoltnet/cli", "sign"],',
+    '    decision = "allow",',
+    ")",
+    "prefix_rule(",
+    '    pattern = ["npx", "@themoltnet/cli", "github", "token"],',
+    '    decision = "allow",',
+    ")",
+    "prefix_rule(",
+    '    pattern = ["moltnet", "sign"],',
+    '    decision = "allow",',
+    ")",
+    "prefix_rule(",
+    '    pattern = ["moltnet", "github", "token"],',
+    '    decision = "allow",',
+    ")",
+    "",
+    "# Worktree symlink creation",
+    "prefix_rule(",
+    '    pattern = ["ln", "-s"],',
+    '    decision = "allow",',
+    ")",
+    "",
+    "# Session activation env export",
+    "prefix_rule(",
+    '    pattern = ["echo"],',
+    '    decision = "allow",',
+    ")",
     ""
   ].join("\n");
 }
@@ -4422,6 +4890,8 @@ function buildPermissions(agentName) {
     "Bash(npx @themoltnet/cli github token *)",
     // Worktree symlink creation
     "Bash(ln -s *)",
+    // Session activation env export
+    'Bash(echo "GIT_CONFIG_GLOBAL=*")',
     // All MCP tools for this agent's server
     `mcp__${agentName}__*`
   ];
@@ -4565,8 +5035,8 @@ class CodexAdapter {
     const dir2 = join(opts.repoDir, ".codex", "rules");
     await mkdir(dir2, { recursive: true });
     await writeFile(
-      join(dir2, "legreffier-gh.md"),
-      buildGhTokenRule(opts.agentName),
+      join(dir2, "legreffier.rules"),
+      buildCodexRules(opts.agentName),
       "utf-8"
     );
   }
@@ -4885,6 +5355,399 @@ async function runGitSetupPhase(opts) {
   );
   dispatch({ type: "step", key: "gitSetup", status: "done" });
 }
+function coerce(o) {
+  if (o instanceof Uint8Array && o.constructor.name === "Uint8Array") {
+    return o;
+  }
+  if (o instanceof ArrayBuffer) {
+    return new Uint8Array(o);
+  }
+  if (ArrayBuffer.isView(o)) {
+    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength);
+  }
+  throw new Error("Unknown type, must be binary type");
+}
+function base(ALPHABET, name2) {
+  if (ALPHABET.length >= 255) {
+    throw new TypeError("Alphabet too long");
+  }
+  var BASE_MAP = new Uint8Array(256);
+  for (var j = 0; j < BASE_MAP.length; j++) {
+    BASE_MAP[j] = 255;
+  }
+  for (var i = 0; i < ALPHABET.length; i++) {
+    var x = ALPHABET.charAt(i);
+    var xc = x.charCodeAt(0);
+    if (BASE_MAP[xc] !== 255) {
+      throw new TypeError(x + " is ambiguous");
+    }
+    BASE_MAP[xc] = i;
+  }
+  var BASE = ALPHABET.length;
+  var LEADER = ALPHABET.charAt(0);
+  var FACTOR = Math.log(BASE) / Math.log(256);
+  var iFACTOR = Math.log(256) / Math.log(BASE);
+  function encode2(source) {
+    if (source instanceof Uint8Array)
+      ;
+    else if (ArrayBuffer.isView(source)) {
+      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+    } else if (Array.isArray(source)) {
+      source = Uint8Array.from(source);
+    }
+    if (!(source instanceof Uint8Array)) {
+      throw new TypeError("Expected Uint8Array");
+    }
+    if (source.length === 0) {
+      return "";
+    }
+    var zeroes = 0;
+    var length = 0;
+    var pbegin = 0;
+    var pend = source.length;
+    while (pbegin !== pend && source[pbegin] === 0) {
+      pbegin++;
+      zeroes++;
+    }
+    var size = (pend - pbegin) * iFACTOR + 1 >>> 0;
+    var b58 = new Uint8Array(size);
+    while (pbegin !== pend) {
+      var carry = source[pbegin];
+      var i2 = 0;
+      for (var it1 = size - 1; (carry !== 0 || i2 < length) && it1 !== -1; it1--, i2++) {
+        carry += 256 * b58[it1] >>> 0;
+        b58[it1] = carry % BASE >>> 0;
+        carry = carry / BASE >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length = i2;
+      pbegin++;
+    }
+    var it2 = size - length;
+    while (it2 !== size && b58[it2] === 0) {
+      it2++;
+    }
+    var str = LEADER.repeat(zeroes);
+    for (; it2 < size; ++it2) {
+      str += ALPHABET.charAt(b58[it2]);
+    }
+    return str;
+  }
+  function decodeUnsafe(source) {
+    if (typeof source !== "string") {
+      throw new TypeError("Expected String");
+    }
+    if (source.length === 0) {
+      return new Uint8Array();
+    }
+    var psz = 0;
+    if (source[psz] === " ") {
+      return;
+    }
+    var zeroes = 0;
+    var length = 0;
+    while (source[psz] === LEADER) {
+      zeroes++;
+      psz++;
+    }
+    var size = (source.length - psz) * FACTOR + 1 >>> 0;
+    var b256 = new Uint8Array(size);
+    while (source[psz]) {
+      var carry = BASE_MAP[source.charCodeAt(psz)];
+      if (carry === 255) {
+        return;
+      }
+      var i2 = 0;
+      for (var it3 = size - 1; (carry !== 0 || i2 < length) && it3 !== -1; it3--, i2++) {
+        carry += BASE * b256[it3] >>> 0;
+        b256[it3] = carry % 256 >>> 0;
+        carry = carry / 256 >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length = i2;
+      psz++;
+    }
+    if (source[psz] === " ") {
+      return;
+    }
+    var it4 = size - length;
+    while (it4 !== size && b256[it4] === 0) {
+      it4++;
+    }
+    var vch = new Uint8Array(zeroes + (size - it4));
+    var j2 = zeroes;
+    while (it4 !== size) {
+      vch[j2++] = b256[it4++];
+    }
+    return vch;
+  }
+  function decode2(string) {
+    var buffer = decodeUnsafe(string);
+    if (buffer) {
+      return buffer;
+    }
+    throw new Error(`Non-${name2} character`);
+  }
+  return {
+    encode: encode2,
+    decodeUnsafe,
+    decode: decode2
+  };
+}
+var src = base;
+var _brrp__multiformats_scope_baseX = src;
+class Encoder2 {
+  name;
+  prefix;
+  baseEncode;
+  constructor(name2, prefix, baseEncode) {
+    this.name = name2;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+  }
+  encode(bytes) {
+    if (bytes instanceof Uint8Array) {
+      return `${this.prefix}${this.baseEncode(bytes)}`;
+    } else {
+      throw Error("Unknown type, must be binary type");
+    }
+  }
+}
+class Decoder2 {
+  name;
+  prefix;
+  baseDecode;
+  prefixCodePoint;
+  constructor(name2, prefix, baseDecode) {
+    this.name = name2;
+    this.prefix = prefix;
+    const prefixCodePoint = prefix.codePointAt(0);
+    if (prefixCodePoint === void 0) {
+      throw new Error("Invalid prefix character");
+    }
+    this.prefixCodePoint = prefixCodePoint;
+    this.baseDecode = baseDecode;
+  }
+  decode(text) {
+    if (typeof text === "string") {
+      if (text.codePointAt(0) !== this.prefixCodePoint) {
+        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`);
+      }
+      return this.baseDecode(text.slice(this.prefix.length));
+    } else {
+      throw Error("Can only multibase decode strings");
+    }
+  }
+  or(decoder) {
+    return or(this, decoder);
+  }
+}
+class ComposedDecoder2 {
+  decoders;
+  constructor(decoders) {
+    this.decoders = decoders;
+  }
+  or(decoder) {
+    return or(this, decoder);
+  }
+  decode(input) {
+    const prefix = input[0];
+    const decoder = this.decoders[prefix];
+    if (decoder != null) {
+      return decoder.decode(input);
+    } else {
+      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`);
+    }
+  }
+}
+function or(left, right) {
+  return new ComposedDecoder2({
+    ...left.decoders ?? { [left.prefix]: left },
+    ...right.decoders ?? { [right.prefix]: right }
+  });
+}
+class Codec2 {
+  name;
+  prefix;
+  baseEncode;
+  baseDecode;
+  encoder;
+  decoder;
+  constructor(name2, prefix, baseEncode, baseDecode) {
+    this.name = name2;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+    this.baseDecode = baseDecode;
+    this.encoder = new Encoder2(name2, prefix, baseEncode);
+    this.decoder = new Decoder2(name2, prefix, baseDecode);
+  }
+  encode(input) {
+    return this.encoder.encode(input);
+  }
+  decode(input) {
+    return this.decoder.decode(input);
+  }
+}
+function from({ name: name2, prefix, encode: encode2, decode: decode2 }) {
+  return new Codec2(name2, prefix, encode2, decode2);
+}
+function baseX({ name: name2, prefix, alphabet }) {
+  const { encode: encode2, decode: decode2 } = _brrp__multiformats_scope_baseX(alphabet, name2);
+  return from({
+    prefix,
+    name: name2,
+    encode: encode2,
+    decode: (text) => coerce(decode2(text))
+  });
+}
+function decode(string, alphabetIdx, bitsPerChar, name2) {
+  let end = string.length;
+  while (string[end - 1] === "=") {
+    --end;
+  }
+  const out = new Uint8Array(end * bitsPerChar / 8 | 0);
+  let bits = 0;
+  let buffer = 0;
+  let written = 0;
+  for (let i = 0; i < end; ++i) {
+    const value = alphabetIdx[string[i]];
+    if (value === void 0) {
+      throw new SyntaxError(`Non-${name2} character`);
+    }
+    buffer = buffer << bitsPerChar | value;
+    bits += bitsPerChar;
+    if (bits >= 8) {
+      bits -= 8;
+      out[written++] = 255 & buffer >> bits;
+    }
+  }
+  if (bits >= bitsPerChar || (255 & buffer << 8 - bits) !== 0) {
+    throw new SyntaxError("Unexpected end of data");
+  }
+  return out;
+}
+function encode(data, alphabet, bitsPerChar) {
+  const pad = alphabet[alphabet.length - 1] === "=";
+  const mask = (1 << bitsPerChar) - 1;
+  let out = "";
+  let bits = 0;
+  let buffer = 0;
+  for (let i = 0; i < data.length; ++i) {
+    buffer = buffer << 8 | data[i];
+    bits += 8;
+    while (bits > bitsPerChar) {
+      bits -= bitsPerChar;
+      out += alphabet[mask & buffer >> bits];
+    }
+  }
+  if (bits !== 0) {
+    out += alphabet[mask & buffer << bitsPerChar - bits];
+  }
+  if (pad) {
+    while ((out.length * bitsPerChar & 7) !== 0) {
+      out += "=";
+    }
+  }
+  return out;
+}
+function createAlphabetIdx(alphabet) {
+  const alphabetIdx = {};
+  for (let i = 0; i < alphabet.length; ++i) {
+    alphabetIdx[alphabet[i]] = i;
+  }
+  return alphabetIdx;
+}
+function rfc4648({ name: name2, prefix, bitsPerChar, alphabet }) {
+  const alphabetIdx = createAlphabetIdx(alphabet);
+  return from({
+    prefix,
+    name: name2,
+    encode(input) {
+      return encode(input, alphabet, bitsPerChar);
+    },
+    decode(input) {
+      return decode(input, alphabetIdx, bitsPerChar, name2);
+    }
+  });
+}
+rfc4648({
+  prefix: "b",
+  name: "base32",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "B",
+  name: "base32upper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "c",
+  name: "base32pad",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567=",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "C",
+  name: "base32padupper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "v",
+  name: "base32hex",
+  alphabet: "0123456789abcdefghijklmnopqrstuv",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "V",
+  name: "base32hexupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "t",
+  name: "base32hexpad",
+  alphabet: "0123456789abcdefghijklmnopqrstuv=",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "T",
+  name: "base32hexpadupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV=",
+  bitsPerChar: 5
+});
+rfc4648({
+  prefix: "h",
+  name: "base32z",
+  alphabet: "ybndrfg8ejkmcpqxot1uwisza345h769",
+  bitsPerChar: 5
+});
+baseX({
+  prefix: "k",
+  name: "base36",
+  alphabet: "0123456789abcdefghijklmnopqrstuvwxyz"
+});
+baseX({
+  prefix: "K",
+  name: "base36upper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+});
+baseX({
+  name: "base58btc",
+  prefix: "z",
+  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+});
+baseX({
+  name: "base58flickr",
+  prefix: "Z",
+  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
+});
 etc.sha512Sync = (...m) => {
   const hash = createHash("sha512");
   m.forEach((msg) => hash.update(msg));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/legreffier",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "LeGreffier — one-command accountable AI agent setup",
   "license": "MIT",
   "type": "module",
@@ -35,8 +35,8 @@
     "vitest": "^3.0.0",
     "@moltnet/api-client": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/design-system": "0.1.0",
-    "@themoltnet/sdk": "0.50.0"
+    "@themoltnet/sdk": "0.51.0",
+    "@moltnet/design-system": "0.1.0"
   },
   "scripts": {
     "dev": "vite build --watch",