@useorgx/wizard 0.1.51 → 0.1.55

package/README.md

@@ -20,12 +20,14 @@ For local development, use `pnpm dev -- --help`.
 The wizard modifies local tool configuration only. Depending on the command, it can:
 
 - add OrgX MCP server entries to Claude, Cursor, Codex, VS Code, Windsurf, and Zed;
+- detect the audited DeepSeek Harness release, install the OrgX DSH plugin, and launch its headless profile with refreshed browser OAuth;
 - install standalone OrgX skills/rules into Cursor and Claude Code;
-- install companion OrgX plugins for Cursor, Claude Code, Codex, and OpenClaw so those tools receive OrgX skills, rules, MCP config, commands, hooks, and agent prompts through their plugin systems.
+- install companion OrgX plugins for Cursor, Claude Code, Codex, and OpenClaw. The Claude Code plugin is a policy-safe static bundle: user-invoked skills and commands plus a focused, non-destructive, closed-world OrgX status profile through native OAuth, with no runtime hooks or transcript/context sync code.
 
 ## Commands
 
 - `setup` adds OrgX MCP configs, standalone skills/rules, and companion plugins to detected AI tools. When OrgX auth is available in an interactive shell, it guides workspace selection or creation, can create the user's first live OrgX initiative, creates a starter onboarding task under that initiative, and prints a handoff prompt for the configured AI tool of choice. The founder preset preplans plugin installs before it writes standalone skills so plugin-backed hosts do not get duplicate standalone assets in the same run.
+- `deepseek <prompt...>` refreshes the wizard's OrgX OAuth token, strips any separate `ORGX_API_KEY` gateway authority, and runs the pinned DSH `headless` profile with the OrgX MCP access token. It fails closed when DSH, OAuth refresh, or the audited runtime version is unavailable.
 - `work-graph profile --from all --publish --public-share` runs AQ from recent AI-work receipts, publishes a redacted profile, and prints a four-signal operating profile plus the first AQ-lifting repair to execute next.
 - Every profile or preview writes both the full evidence report and a compact, machine-safe `work-graph-agent-brief-*.md` with provenance, the growth edge, and a ready prompt for the smallest verifiable repair.
 - `work-graph preview --from all` shows the same profile story locally without publishing.
@@ -35,7 +37,7 @@ The wizard modifies local tool configuration only. Depending on the command, it
 - `surface remove <name>` removes OrgX-managed config from a specific surface.
 - `mcp add [surface]` and `mcp remove [surface]` manage OrgX MCP entries in Claude, Cursor, Codex, VS Code, Windsurf, and Zed tool configs.
 - `plugins list` shows companion plugin availability and install status for Cursor, Claude Code, Codex, and OpenClaw.
-- `plugins add [target...]` installs the managed Cursor plugin bundle and managed OrgX companion plugins into Claude Code, Codex, and/or OpenClaw. Cursor, Claude Code, and Codex companion plugins carry their own OrgX skills/rules/MCP config and become the source of truth for those hosts.
+- `plugins add [target...]` installs the managed Cursor plugin bundle and managed OrgX companion plugins into Claude Code, Codex, and/or OpenClaw. The Claude Code bundle owns its static OrgX skills, user-invoked commands, and focused closed-world status profile; Cursor and Codex retain their host-specific asset bundles.
 - `plugins remove [target...]` uninstalls the managed Cursor plugin bundle, legacy managed Cursor rules, and managed OrgX companion plugins from Claude Code, Codex, and/or OpenClaw.
 - `uninstall` removes OrgX-managed tool config, companion plugins, legacy managed Cursor rules, wizard-local auth, and wizard-local setup state. Use `--keep-auth`, `--keep-state`, `--skip-plugins`, or `--skip-surfaces` to preserve specific pieces.
 - `doctor` verifies local config, hosted MCP reachability, npm registry readiness, current-workspace connectivity, local OpenClaw health, and optionally the remote setup status API. Hosted MCP tools are OAuth-scoped inside the client connector, so the wizard does not preflight them with `oxk_` API keys. It exits non-zero when blocking connectivity issues remain.
@@ -77,6 +79,7 @@ Set `ORGX_TELEMETRY_DISABLED=1` or `ORGX_TELEMETRY_ENABLED=0` to opt out.
 - `doctor` also checks npm registry reachability for `@useorgx/wizard` and reports whether the package is already published.
 - Remote setup status is separate: `doctor` checks `/api/setup/status` only when `ORGX_SERVICE_KEY` is present because that endpoint is still service-key-only.
 - Auth resolution order is `ORGX_API_KEY`, then the wizard auth store, then OpenClaw config.
+- DeepSeek setup pins `@deepseek-ai/dsh@0.1.0-rc.6` and `@useorgx/deepseek-harness-plugin@0.1.0`. The launcher uses the wizard's browser OAuth access and refresh tokens for hosted MCP; it does not reuse an `oxk_` gateway key as an MCP token.
 
 ## Workspace Bootstrap
 
@@ -98,7 +101,8 @@ Set `ORGX_TELEMETRY_DISABLED=1` or `ORGX_TELEMETRY_ENABLED=0` to opt out.
 - The same command installs available OrgX Claude skill packs by pulling their source files from `useorgx/skills`; pass specific pack names to limit what is installed.
 - `wizard skills add` and `wizard skills sync` both compose generated outputs from OrgX-managed core skills plus any enabled extension files from the wizard skill-extension store.
 - When the Cursor companion plugin is installed, that plugin owns Cursor-side OrgX skills, rules, MCP config, commands, hooks, and agent prompts. In that case `wizard skills add` remains the standalone rules fallback for Cursor installs that are not using the plugin.
-- When the Claude Code companion plugin is installed, that plugin owns Claude-side OrgX skills and skill sync. In that case `wizard skills add` skips overlapping Claude assets instead of writing duplicate copies.
+- When the Claude Code companion plugin is installed, it owns Claude-side static OrgX skills, user-invoked commands, and the pinned `https://mcp.useorgx.com/mcp?profile=claude-directory` native-OAuth MCP connection. The bundle has no hooks or dynamic transcript/context sync code, and `wizard skills add` skips overlapping Claude assets instead of writing duplicate copies.
+- Claude plugin installs are fetched from the reviewed release tag rather than a mutable branch. Before a staged local replacement, the wizard validates the exact static file set, reviewed plugin manifest, MCP object, exact endpoint, and prohibited runtime content. A symlinked destination root or symlink occupying an expected managed path is rejected; unexpected legacy links are pruned by an atomic directory replacement without following them. Existing Claude installations are then refreshed with `claude plugin update` so the installed cache advances too.
 - The Codex companion plugin also bundles its own OrgX skills, so `wizard skills add` does not try to manage Codex skill files at all.
 - Those generated rules expect artifact proof to use durable sources such as GitHub permalinks, public URLs, or absolute file paths / `file://...`, not OrgX wrapper routes like `/live/...`, `/artifacts/...`, or `/console/...`.
 
@@ -115,8 +119,8 @@ OrgX core skills are treated as managed upstream content. User behavior lives in
 ## Release Flow
 
 - GitHub Actions publishes to npm on pushes of version tags matching `v*`.
-- The publish workflow installs dependencies with pnpm, runs `pnpm typecheck`, `pnpm test`, and `pnpm build`, then runs `pnpm publish --no-git-checks`.
-- The workflow expects an `NPM_TOKEN` repository secret.
+- The publish workflow uses Node 22, pnpm 10.7.1, and npm 11.16.0; it runs `pnpm typecheck`, `pnpm test`, and `pnpm build`, verifies the tag matches the package version, then runs `npm publish --access public`.
+- npm authentication uses GitHub Actions trusted publishing through OIDC, so the release does not require a long-lived `NPM_TOKEN`.
 
 ## Troubleshooting