@webpresso/plugin-codex 0.0.8 → 0.0.10

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-kit",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Webpresso agent-kit: blueprints, skills, hooks, and MCP server",
   "author": {
     "name": "Webpresso",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpresso/plugin-codex",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "private": false,
   "description": "Codex plugin adapter for Webpresso agent-kit skills, hooks, and MCP runtime.",
   "homepage": "https://github.com/webpresso/app#readme",

package/plugin-skill-ownership.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "host": "codex",
   "packageName": "@webpresso/plugin-codex",
-  "packageVersion": "0.0.8",
+  "packageVersion": "0.0.10",
   "runtimeDirs": [".codex/skills", ".agents/skills"],
   "skills": {
     "ai-deslop": {
@@ -42,7 +42,7 @@
       "digest": "sha256:306355888da0827e3523022077f731845726bbaaf595ca12515cc91d8605b5e6"
     },
     "fix": {
-      "digest": "sha256:1fdbda9972b9d9452b1705cefcdb46c3eaf02090b8d3af1d653ae69c8731c949"
+      "digest": "sha256:38ddebb82a73e9e18e5b9909585a8477285387ac7bbad2574e3708362c4d0475"
     },
     "grok": {
       "digest": "sha256:796104b04f70c8dd48cf1056c8d72d9492648f89486a35515e00af1d0de42f0a"
@@ -90,7 +90,7 @@
       "digest": "sha256:22533e26549b60494f042b5f4d7c97abf2019fc0a60697f84a395fa48ef0147f"
     },
     "tooling-friction": {
-      "digest": "sha256:92cc6825c222ad3f8dfe43c4a83a28e59f7a4d0179c886e276246f36670d3d0e"
+      "digest": "sha256:12a24fc747e3481aa857ace38993cd0324686ba70ffec115ff1a1955bd5999bc"
     },
     "tph": {
       "digest": "sha256:bed3684a850651534f315d355cdeae50d951c429817df0f105cccdb7f4e1561b"
@@ -99,7 +99,7 @@
       "digest": "sha256:137a063d5e286934b92b1d87397b7183f8ea6c564cddc3bb7e6cde5f3f306aaf"
     },
     "verify": {
-      "digest": "sha256:7f431a63e611c9f47d5edf87a889d4527658d2dd0c68f9dffd0924c1cd0dd028"
+      "digest": "sha256:071c47c39e0881e381468cadbbd266f99d29c31eae2caf15c22d57591a1dbf94"
     }
   }
 }

package/skills/fix/SKILL.md

@@ -133,9 +133,10 @@ Run the narrowest checks that prove the repaired behavior on the real repo surfa
 - `wp_test` / targeted tests for the repaired path
 - `wp_lint` / `wp_typecheck` for changed surfaces
 - `wp_qa` only when the blast radius needs the bookend
-- Before push: `wp_ci_preflight` (use global `wp ci-preflight` only when MCP is
-  unavailable). Run it after the final commit and do not edit or commit again
-  before pushing: success records the exact-state receipt checked by pre-push.
+- Before push: start `wp_ci_preflight`, then poll `wp_ci_preflight_wait` with
+  its run ID until terminal success (use global `wp ci-preflight` only when MCP
+  is unavailable). Run it after the final commit and do not edit or commit again
+  before pushing: terminal success records the exact-state receipt checked by pre-push.
   Do not use remote CI re-runs as the primary fix loop (`ci-cost-local-first`).
 
 Rules:

package/skills/tooling-friction/SKILL.md

@@ -23,7 +23,7 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 | ---------------------------------------------------- | -------------------------------------------------- |
 | Structured friction tips after land-ish success      | Code bugs (`/investigate` → `/fix`)                |
 | Optional promote to tech-debt (`--category tooling`) | Blueprint claim corrections (`blueprints/errata/`) |
-| Local planning-state JSON (gitignored)               | Human DX audits (`/devex-review`)                  |
+| Repo-scoped desktop-state JSON (outside worktrees)   | Human DX audits (`/devex-review`)                  |
 | Soft bookend from `/verify` Phase 7                  | Required PR section, finalize/merge blockers       |
 
 ## When
@@ -44,13 +44,28 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 1. **Recall only** — do not re-ingest full CI logs or transcripts.
 2. If zero medium+ findings → stop: `skipped: no tooling friction`.
 3. Emit **1–3** findings (hard cap 8 for schema headroom; prefer ≤3).
-4. Write JSON to:
+4. Write JSON to the central, repo-scoped desktop state surface:
 
    ```text
-   .agent/planning/state/tooling-friction/YYYY-MM-DD-<slug|pr|session>.json
+   <state-root>/<repo-key>/tooling-friction/YYYY-MM-DD-<slug|pr|session>.json
    ```
 
-   Create parent dirs as needed. Path is under the durable planning **state** surface (see `Agents.md`). `.agent/` is gitignored — **never** `git add` captures.
+   Ask the read-only MCP resolver for the exact path, then use that returned
+   absolute path for the write:
+
+   ```text
+   wp_tooling_friction_path({"file":"YYYY-MM-DD-<slug|pr|session>.json"})
+   ```
+
+   The resolver is backed directly by
+   `getSurfacePath("tooling-friction/<file>", "repo", <project-cwd>)`. For
+   human CLI use, the equivalent read-only projection is
+   `wp tooling-friction path --file <file>`. The capture is shared by that
+   repository's worktrees but never written to any checkout. Create parent
+   dirs as needed. If the returned path already exists, choose a unique
+   session/HHMM suffix rather than overwriting it. If the surface cannot be
+   resolved or written, report `tooling-friction: skipped: no state surface`
+   and stop; never fall back to a worktree or `.agent/` path.
 
 5. Optional `--promote` or severity `high`/`critical`:  
    `wp tech-debt new "<short title>" --severity <s> --category tooling --status accepted`  
@@ -61,7 +76,10 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 
 ## Store path (SSOT)
 
-`.agent/planning/state/tooling-friction/*.json` — planning `state/`, not a new top-level under `planning/`.
+`wp_tooling_friction_path({"file":"<file>"})` (or the human CLI projection
+`wp tooling-friction path --file <file>`) — a read-only projection of
+`getSurfacePath("tooling-friction/<file>", "repo", <project-cwd>)`, the
+repo-scoped desktop state surface, not a path inside `planning/` or a worktree.
 
 ## Schema v1
 
@@ -112,10 +130,12 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 ### Limits
 
 - findings: prefer ≤3 (schema max 8)
+- finding `id`: `tf-` followed by 4–40 lowercase letters, digits, or hyphens
+- finding `tool`: ≤80 characters
 - `symptom` / `suggested_fix`: ≤280 chars
 - `notes`: ≤400 chars
 - `evidence_refs`: ≤5 items × ≤200 chars (run ids, receipt names, `pr:N` — **not** log bodies)
-- `token_waste` bands: none &lt;1k · low 1–5k · medium 5–20k · high &gt;20k or multi-retry (estimate only)
+- `token_waste` bands: `none` <1k · `low` 1–5k · `medium` 5–20k · `high` >20k or multi-retry (estimate only)
 
 ## Few-shot tips
 
@@ -139,7 +159,7 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 4. No inventing tips on smooth runs
 5. No timeout-as-fix suggestions
 6. No blueprint errata misuse
-7. No committing `.agent/` captures
+7. No committing desktop-state captures
 8. No auto-open GitHub issues per tip
 
 ## Integration
@@ -151,7 +171,7 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 ## Output (agent reply)
 
 ```text
-tooling-friction: wrote .agent/planning/state/tooling-friction/<file>.json
+tooling-friction: wrote desktop state <state-root>/<repo-key>/tooling-friction/<file>.json
 findings: 2 (high=1, medium=1)
 promoted: none | tech-debt/...
 ```

package/skills/verify/SKILL.md

@@ -145,17 +145,21 @@ Run the narrowest checks that prove the touched behavior:
 **Before push or PR open/update**, run the pre-push owner end-to-end:
 
 ```text
-wp_ci_preflight({})
+start = wp_ci_preflight({})
+wp_ci_preflight_wait({ runId: start.details.operation.runId })
 ```
 
+The start result is not a gate verdict. Poll again when wait returns
+`in_progress`; only terminal `success` authorizes push or PR mutation.
+
 MCP-unavailable CLI fallback:
 
 ```bash
 wp ci-preflight
 ```
 
-That is fail-fast branch-scoped format → guardrails → typecheck → lint →
-test. Run it after the final commit and make no further worktree or base-ref
+That runs the repository-owned, branch-scoped required-check plan fail-fast.
+Run it after the final commit and make no further worktree or base-ref
 changes before pushing. Agent-kit's `.husky/pre-push` checks the resulting
 exact-state receipt without rerunning the suite after Git opens the remote
 transport; consumer repos may keep pre-push checks user-owned. Do **not** claim
@@ -168,7 +172,7 @@ Rules:
 - Never claim broader correctness than the commands actually proved.
 - If the repo documents a "full QA" bookend, reserve `wp_qa` / `--full` for the final broad pass rather than every iteration.
 - If CI is already red: read the failed job log, reproduce with the matching
-  local `wp_ci_preflight` (or the `wp ci-preflight` CLI fallback), fix, then push **one**
+  local `wp_ci_preflight` + `wp_ci_preflight_wait` flow (or the `wp ci-preflight` CLI fallback), fix, then push **one**
   corrective commit — do not burn another full matrix “to check.”
 
 ## Phase 3 — Cross-surface impact scan
@@ -265,7 +269,7 @@ When classification is **sensitive**:
 
 - Require delivery review via `risk-review-coverage` / `wp_review_gate`
   (purpose delivery) / qualifying lane approvals for the current
-  `wp-git-diff-v1` subject until `policySatisfied`.
+  review subject until `policySatisfied`.
 - Launch **exactly one** `wp_review_gate` delivery attempt with
   `--base-ref <base-sha>` and `--authority-ref <head-sha>`. Do not substitute
   `HEAD` for the authority SHA, and do not relaunch while the same subject has
@@ -355,6 +359,8 @@ When catalog assets or generated instruction surfaces changed, include public-pa
 If any required check is missing, the correct result is **not done yet**, not a softer claim.
 
 **Tooling friction (optional):** if this session burned medium+ tokens on MCP/CLI/hooks/CI
-gates (not product code), run `/tooling-friction` once and write tips under
-`.agent/planning/state/tooling-friction/`. Skip when the path was smooth. Never
-blocks land — see the `tooling-friction` skill.
+gates (not product code), run `/tooling-friction` once and resolve its capture
+destination with `wp_tooling_friction_path({"file":"<file>"})` (human CLI:
+`wp tooling-friction path --file <file>`). Skip when the path was smooth. If
+the surface cannot be resolved or written, report the skip and never fall
+back to a worktree path. Never blocks land — see the `tooling-friction` skill.