@ze-norm/cli 0.13.0 → 0.14.2

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAMjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,qBAAqB,IAAI,OAAO;IAQhC,OAAO,CAAC,2BAA2B;YAIrB,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AA0BA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiCD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAMjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,qBAAqB,IAAI,OAAO;IAYhC,OAAO,CAAC,2BAA2B;YAIrB,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}

package/dist/api/client.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { ApiError, AuthError, UpgradeRequiredError } from "../util/errors.js";
 import { forceRefreshToken, hasRefreshableCredentials, resolveValidToken, } from "../auth/store.js";
 import { PRODUCTION_API_URL } from "../config/defaults.js";
+import { resolveEnvironment, ZENORM_CLI_ENV_VAR } from "../config/environments.js";
 import { getCliVersion } from "../util/package.js";
 import { log } from "../util/logger.js";
 const UPGRADE_COMMAND = "npm install -g @ze-norm/cli@latest";
@@ -23,11 +24,17 @@ function resolveBaseUrl(explicit) {
     // 1. Explicit option
     if (explicit)
         return explicit;
-    // 2. Environment variable
+    // 2. Named environment via ZENORM_CLI. A selected environment is an explicit
+    //    "talk to this stack" intent, so its API URL wins over a stray
+    //    ZENORM_API_URL / .zenorm.json left over from another workflow.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().apiUrl;
+    }
+    // 3. Environment variable
     const envUrl = process.env["ZENORM_API_URL"];
     if (envUrl)
         return envUrl;
-    // 3. .zenorm.json config file in cwd
+    // 4. .zenorm.json config file in cwd
     const configPath = join(process.cwd(), ".zenorm.json");
     if (existsSync(configPath)) {
         const raw = readFileSync(configPath, "utf-8");
@@ -35,7 +42,7 @@ function resolveBaseUrl(explicit) {
         if (config.apiUrl)
             return config.apiUrl;
     }
-    // 4. Public CLI default
+    // 5. Public CLI default
     return PRODUCTION_API_URL;
 }
 export class ZenormClient {
@@ -95,9 +102,12 @@ export class ZenormClient {
     }
     /** True when requests will intentionally ignore stored credentials. */
     isUsingLocalDevBypass() {
-        return (this.isLocalBaseUrl() &&
-            process.env["ZENORM_LOCAL_DEV_BYPASS_AUTH"] === "true" &&
-            !process.env["ZENORM_API_TOKEN"]);
+        // Selecting the `local` environment implies dev-bypass — that is what the
+        // local stack is (no real Clerk sign-in, dev-bypass headers). An explicit
+        // ZENORM_LOCAL_DEV_BYPASS_AUTH still enables it for a raw localhost URL.
+        const bypassEnabled = process.env["ZENORM_LOCAL_DEV_BYPASS_AUTH"] === "true" ||
+            resolveEnvironment().name === "local";
+        return (this.isLocalBaseUrl() && bypassEnabled && !process.env["ZENORM_API_TOKEN"]);
     }
     shouldBypassAuthForLocalDev() {
         return this.isUsingLocalDevBypass();

package/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkUpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6UpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}

package/dist/auth/device-flow.js

@@ -5,6 +5,7 @@ import { platform } from "node:os";
 import { URL, URLSearchParams } from "node:url";
 import { log } from "../util/logger.js";
 import { CLI_CALLBACK_PORTS, PRODUCTION_CLERK_CLIENT_ID, PRODUCTION_CLERK_ISSUER, } from "../config/defaults.js";
+import { resolveEnvironment, ZENORM_CLI_ENV_VAR } from "../config/environments.js";
 /**
  * Find the first pre-registered callback port that is free to bind. Clerk
  * matches redirect_uris exactly, so the local listener must use one of the
@@ -26,6 +27,11 @@ async function pickFreeCallbackPort() {
         `Free one of them and run \`zenorm login\` again.`);
 }
 function getClerkIssuer() {
+    // A named environment (ZENORM_CLI) selects the whole Clerk instance, so it
+    // wins over a stray ZENORM_CLERK_ISSUER from another workflow.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().clerkIssuer;
+    }
     return process.env["ZENORM_CLERK_ISSUER"] ?? PRODUCTION_CLERK_ISSUER;
 }
 /** Escape user-influenced text before interpolating into the result page HTML. */
@@ -38,6 +44,11 @@ function escapeHtml(value) {
         .replace(/'/g, "'");
 }
 function getClerkClientId() {
+    // A named environment (ZENORM_CLI) selects the whole Clerk instance, so it
+    // wins over stray ZENORM_CLERK_CLIENT_ID / VITE_CLERK_PUBLISHABLE_KEY vars.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().clerkClientId;
+    }
     return (process.env["ZENORM_CLERK_CLIENT_ID"] ??
         process.env["VITE_CLERK_PUBLISHABLE_KEY"] ??
         PRODUCTION_CLERK_CLIENT_ID);

package/dist/auth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}

package/dist/auth/store.js

@@ -2,12 +2,18 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { refreshAccessToken } from "./device-flow.js";
+import { resolveEnvironment } from "../config/environments.js";
 import { log } from "../util/logger.js";
 // Refresh the access token this many ms before it actually expires, so an
 // in-flight request never races the expiry boundary.
 const EXPIRY_SKEW_MS = 60_000;
+// Credentials are scoped per environment so a prod login and a dev login can
+// coexist instead of overwriting each other. Prod keeps the historical
+// `credentials.json` filename for back-compat; other stacks get a suffix.
 function getCredentialsPath() {
-    return join(homedir(), ".zenorm", "credentials.json");
+    const env = resolveEnvironment();
+    const filename = env.name === "prod" ? "credentials.json" : `credentials.${env.name}.json`;
+    return join(homedir(), ".zenorm", filename);
 }
 function ensureDir() {
     const dir = join(homedir(), ".zenorm");

package/dist/commands/interactive-agent.d.ts

@@ -6,7 +6,7 @@ import type { ChildProcess, SpawnOptions } from "node:child_process";
  * the daemon does NOT run the agent headlessly. Instead it launches the active
  * coding agent — Claude Code by default, or Codex when the user runs with
  * `--agent codex` — as a *live interactive session*, seeded with the
- * `/zenorm <specId>` handoff. The agent owns the terminal directly (inherited
+ * harness-native ZeNorm skill handoff. The agent owns the terminal directly (inherited
  * stdio), so the operator works with it interactively until they close it; when
  * the agent exits, the daemon releases the worker and moves on to the next task.
  *

package/dist/commands/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAcA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4F/D"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAcA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8F/D"}

package/dist/commands/pull.js

@@ -39,9 +39,11 @@ export async function pullCommand(argv) {
         log.debug("Listing specs to resolve by key", { specRef });
         const { specs } = await client.get("/v1/specs");
         spec = specs.find((s) => s.key === specRef);
-    }
-    if (!spec) {
-        throw new CliError(`Spec "${specRef}" not found by key or id. Run \`zenorm list\` to see available specs.`);
+        if (!spec) {
+            const available = specs.map((s) => s.key).join(", ");
+            throw new CliError(`Spec "${specRef}" not found by key or id.` +
+                (available ? ` Available spec keys: ${available}` : " The workspace has no specs."));
+        }
     }
     // Fetch grilled blocks (goals, constraints, acceptance criteria, tasks).
     let blocksMd = "";

package/dist/commands/task.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task.d.ts","sourceRoot":"","sources":["../../src/commands/task.ts"],"names":[],"mappings":"AAyOA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/D"}
+{"version":3,"file":"task.d.ts","sourceRoot":"","sources":["../../src/commands/task.ts"],"names":[],"mappings":"AA2OA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/D"}

package/dist/commands/task.js

@@ -33,7 +33,9 @@ async function resolveSpecId(client, specRef) {
     const { specs } = await client.get("/v1/specs");
     const spec = specs.find((s) => s.key === specRef);
     if (!spec) {
-        throw new CliError(`Spec "${specRef}" not found by key or id. Run \`zenorm list\` to see available specs.`);
+        const available = specs.map((s) => s.key).join(", ");
+        throw new CliError(`Spec "${specRef}" not found by key or id.` +
+            (available ? ` Available spec keys: ${available}` : " The workspace has no specs."));
     }
     return spec.id;
 }

package/dist/commands/work.d.ts

@@ -23,8 +23,9 @@ export interface TaskRunner {
  * Build the handoff prompt that hands the agent the WHOLE SPEC the claimed task
  * belongs to, so a single agent session implements every available task for that
  * spec with shared context — instead of one fresh session per task. The
- * `/zenorm <specId>` trigger is what the `zenorm` dispatcher SKILL.md keys on
- * (spec mode → `execute-task` walks every `planned`/`todo` task in order).
+ * harness-native ZeNorm invocation (`/zenorm` for Claude Code, `$zenorm`
+ * for Codex) triggers the dispatcher in spec mode, where `execute-task` walks
+ * every `planned`/`todo` task in order.
  *
  * The claim only flips THIS one task to `active` server-side (the lease that
  * proves there is work for this repo and guards against a second daemon). The
@@ -35,14 +36,14 @@ export interface TaskRunner {
  *
  * Exported for unit testing.
  */
-export declare function buildHandoffPrompt(task: SpecTaskRecord): string;
+export declare function buildHandoffPrompt(task: SpecTaskRecord, agent: SupportedAgent): string;
 /**
  * The interactive (coding-agent mode) handoff prompt. Same spec-mode handoff as
  * the headless prompt, MINUS the "work non-interactively" instruction: in this
  * mode the agent runs as a live session the operator drives, so it SHOULD pause
  * for input. Exported for unit testing.
  */
-export declare function buildInteractiveHandoffPrompt(task: SpecTaskRecord): string;
+export declare function buildInteractiveHandoffPrompt(task: SpecTaskRecord, agent: SupportedAgent): string;
 /**
  * The headless subprocess invocation for a given agent + task. Pure (no
  * side effects) so it can be unit-tested directly without spawning anything.

package/dist/commands/work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,wBAAwB,CAAC;AAehC;;;;GAIG;AACH,QAAA,MAAM,gBAAgB,8BAA+B,CAAC;AACtD,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAuCxD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAS/D;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAG1E;AAsBD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAwDrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA2BrC;AAQD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AAuB5F;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBxE;AAED;;;;;;;;;GASG;AACH,qBAAa,WAAY,YAAW,UAAU;IAI1C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAOvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAI5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAM1B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAxBnC,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAGvB,KAAK,EAAE,cAAc,EAErB,OAAO,GAAE,OAAe,EAExB,KAAK,CAAC,EAAE,MAAM,YAAA,EAOd,WAAW,UAAQ,EAInB,SAAS,GAAE,WAA2B,EAMtC,eAAe,CAAC,EAAE,iBAAiB,YAAA;IAKtD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC;;;OAGG;IACH,OAAO,CAAC,WAAW;IAkCnB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAiCtB;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAwClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;CA+ClB;AAED;;;;GAIG;AACH,qBAAa,YAAa,YAAW,UAAU;IAI3C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAJzB,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAGvB,KAAK,EAAE,cAAc,EACrB,KAAK,CAAC,EAAE,MAAM,YAAA;IAKjC,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAOzC;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAmD3E;AA4BD,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IAGtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAwFD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,OAAO,EACnB,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GACvC,OAAO,CAGT;AAoED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CA2HlB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CA+Df"}
+{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,wBAAwB,CAAC;AAehC;;;;GAIG;AACH,QAAA,MAAM,gBAAgB,8BAA+B,CAAC;AACtD,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAuCxD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,cAAc,GACpB,MAAM,CASR;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,cAAc,GACpB,MAAM,CAGR;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAwDrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA2BrC;AAQD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AAuB5F;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBxE;AAED;;;;;;;;;GASG;AACH,qBAAa,WAAY,YAAW,UAAU;IAI1C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAOvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAI5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAM1B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAxBnC,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAGvB,KAAK,EAAE,cAAc,EAErB,OAAO,GAAE,OAAe,EAExB,KAAK,CAAC,EAAE,MAAM,YAAA,EAOd,WAAW,UAAQ,EAInB,SAAS,GAAE,WAA2B,EAMtC,eAAe,CAAC,EAAE,iBAAiB,YAAA;IAKtD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC;;;OAGG;IACH,OAAO,CAAC,WAAW;IAkCnB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAiCtB;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAwClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;CA+ClB;AAED;;;;GAIG;AACH,qBAAa,YAAa,YAAW,UAAU;IAI3C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAJzB,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAGvB,KAAK,EAAE,cAAc,EACrB,KAAK,CAAC,EAAE,MAAM,YAAA;IAKjC,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAOzC;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAmD3E;AA4BD,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IAGtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAwFD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,OAAO,EACnB,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GACvC,OAAO,CAGT;AAoED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CA2HlB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CA+Df"}

package/dist/commands/work.js

@@ -61,8 +61,9 @@ const AGENT_INSTALL_HINT = {
  * Build the handoff prompt that hands the agent the WHOLE SPEC the claimed task
  * belongs to, so a single agent session implements every available task for that
  * spec with shared context — instead of one fresh session per task. The
- * `/zenorm <specId>` trigger is what the `zenorm` dispatcher SKILL.md keys on
- * (spec mode → `execute-task` walks every `planned`/`todo` task in order).
+ * harness-native ZeNorm invocation (`/zenorm` for Claude Code, `$zenorm`
+ * for Codex) triggers the dispatcher in spec mode, where `execute-task` walks
+ * every `planned`/`todo` task in order.
  *
  * The claim only flips THIS one task to `active` server-side (the lease that
  * proves there is work for this repo and guards against a second daemon). The
@@ -73,10 +74,10 @@ const AGENT_INSTALL_HINT = {
  *
  * Exported for unit testing.
  */
-export function buildHandoffPrompt(task) {
+export function buildHandoffPrompt(task, agent) {
     const zenormCli = process.env["ZENORM_CLI"]?.trim() || "zenorm";
     return [
-        ...handoffPromptBody(task, zenormCli),
+        ...handoffPromptBody(task, zenormCli, agent),
         // Headless runs have no operator to wait on — tell the agent to drive
         // straight through without pausing for input. The interactive variant
         // (buildInteractiveHandoffPrompt) deliberately omits this line.
@@ -89,14 +90,14 @@ export function buildHandoffPrompt(task) {
  * mode the agent runs as a live session the operator drives, so it SHOULD pause
  * for input. Exported for unit testing.
  */
-export function buildInteractiveHandoffPrompt(task) {
+export function buildInteractiveHandoffPrompt(task, agent) {
     const zenormCli = process.env["ZENORM_CLI"]?.trim() || "zenorm";
-    return handoffPromptBody(task, zenormCli).join("\n");
+    return handoffPromptBody(task, zenormCli, agent).join("\n");
 }
 /** Shared spec-mode handoff lines for both the headless and interactive prompts. */
-function handoffPromptBody(task, zenormCli) {
+function handoffPromptBody(task, zenormCli, agent) {
     return [
-        `/zenorm ${task.specId}`,
+        buildSkillInvocation(agent, task.specId),
         "",
         `Execute ALL available tasks for ZeNorm spec ${task.specId} in THIS one`,
         "session (spec mode — walk every `planned`/`todo` task in list order). Do not",
@@ -112,6 +113,19 @@ function handoffPromptBody(task, zenormCli) {
         `\`${zenormCli} task complete <task-id>\` flow as you finish it.`,
     ];
 }
+/** Build the explicit skill invocation understood by the selected harness. */
+function buildSkillInvocation(agent, specId) {
+    switch (agent) {
+        case "claude":
+            return `/zenorm ${specId}`;
+        case "codex":
+            return `$zenorm ${specId}`;
+        default: {
+            const never = agent;
+            throw new CliError(`No ZeNorm skill invocation defined for agent "${String(never)}".`);
+        }
+    }
+}
 /**
  * The headless subprocess invocation for a given agent + task. Pure (no
  * side effects) so it can be unit-tested directly without spawning anything.
@@ -125,7 +139,7 @@ function handoffPromptBody(task, zenormCli) {
  * Exported for unit testing.
  */
 export function buildAgentCommand(agent, task, model) {
-    const prompt = buildHandoffPrompt(task);
+    const prompt = buildHandoffPrompt(task, agent);
     switch (agent) {
         case "claude":
             // stream-json requires --verbose; it does NOT make the transcript verbose
@@ -208,7 +222,7 @@ export function buildAgentCommand(agent, task, model) {
  * Exported for unit testing.
  */
 export function buildInteractiveAgentCommand(agent, task, model) {
-    const prompt = buildInteractiveHandoffPrompt(task);
+    const prompt = buildInteractiveHandoffPrompt(task, agent);
     switch (agent) {
         case "claude":
             return {

package/dist/config/environments.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A named CLI environment: the full bundle of endpoints the CLI talks to.
+ * Selecting one via the `ZENORM_CLI` env var switches API + Clerk together, so
+ * you never have to keep `ZENORM_API_URL`, `ZENORM_CLERK_ISSUER`, and
+ * `ZENORM_CLERK_CLIENT_ID` in sync by hand.
+ *
+ * IMPORTANT: only the **prod** preset is baked into this (published) module.
+ * The non-prod stacks point at an internal Clerk instance whose identifiers
+ * must NOT ship in the public npm tarball (the publish pipeline greps the
+ * package for them and blocks the release). Those stacks are launched by the
+ * non-shipped source entries (`local.ts` / `dev.ts`, run via their repo shims),
+ * which inject `ZENORM_API_URL` + `ZENORM_CLERK_*` before importing the CLI.
+ * When `ZENORM_CLI` selects a non-prod stack, this resolver reads those
+ * injected vars instead of baking the endpoints in.
+ */
+export interface CliEnvironment {
+    readonly name: "prod" | "dev" | "local";
+    readonly apiUrl: string;
+    readonly clerkIssuer: string;
+    readonly clerkClientId: string;
+}
+export declare const ZENORM_CLI_ENV_VAR = "ZENORM_CLI";
+/**
+ * Resolve the active CLI environment from `ZENORM_CLI`.
+ *
+ * Unset → production (the public default). A set-but-unrecognized value is a
+ * loud error rather than a silent fallback: a typo like `ZENORM_CLI=prd` must
+ * not quietly send `zenorm` commands at the wrong stack.
+ */
+export declare function resolveEnvironment(): CliEnvironment;
+//# sourceMappingURL=environments.d.ts.map

package/dist/config/environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/config/environments.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AASD,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAyC/C;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAiBnD"}

package/dist/config/environments.js

@@ -0,0 +1,65 @@
+import { CliError } from "../util/errors.js";
+import { PRODUCTION_API_URL, PRODUCTION_CLERK_CLIENT_ID, PRODUCTION_CLERK_ISSUER, } from "./defaults.js";
+const PROD_ENVIRONMENT = {
+    name: "prod",
+    apiUrl: PRODUCTION_API_URL,
+    clerkIssuer: PRODUCTION_CLERK_ISSUER,
+    clerkClientId: PRODUCTION_CLERK_CLIENT_ID,
+};
+export const ZENORM_CLI_ENV_VAR = "ZENORM_CLI";
+const ENV_NAMES = ["prod", "dev", "local"];
+/**
+ * Normalize a raw `ZENORM_CLI` value to a canonical env name. Accepts the bare
+ * name (`prod`/`dev`/`local`), `production`, and each name with a `-zenorm`
+ * suffix (constructed here so the suffixed literal is never a static token).
+ */
+function parseEnvName(raw) {
+    const key = raw.trim().toLowerCase();
+    if (key === "production")
+        return "prod";
+    for (const name of ENV_NAMES) {
+        if (key === name || key === `${name}-zenorm`)
+            return name;
+    }
+    return null;
+}
+/**
+ * Build a non-prod environment from the endpoint env vars injected by the
+ * repo launchers. Fails loud if they are missing — that means the public
+ * `zenorm` was pointed at an internal stack without the launcher that carries
+ * its (non-shipped) endpoints, and we must not silently fall back to prod.
+ */
+function environmentFromInjectedVars(name) {
+    const apiUrl = process.env["ZENORM_API_URL"];
+    const clerkIssuer = process.env["ZENORM_CLERK_ISSUER"];
+    const clerkClientId = process.env["ZENORM_CLERK_CLIENT_ID"];
+    if (!apiUrl || !clerkIssuer || !clerkClientId) {
+        const shim = `${name}${"-zenorm"}`;
+        throw new CliError(`${ZENORM_CLI_ENV_VAR}=${name} needs the ${name} endpoints, which are not ` +
+            `bundled in the public CLI. Launch it with \`${shim}\` (from the repo), ` +
+            `or set ZENORM_API_URL, ZENORM_CLERK_ISSUER, and ZENORM_CLERK_CLIENT_ID.`);
+    }
+    return { name, apiUrl, clerkIssuer, clerkClientId };
+}
+/**
+ * Resolve the active CLI environment from `ZENORM_CLI`.
+ *
+ * Unset → production (the public default). A set-but-unrecognized value is a
+ * loud error rather than a silent fallback: a typo like `ZENORM_CLI=prd` must
+ * not quietly send `zenorm` commands at the wrong stack.
+ */
+export function resolveEnvironment() {
+    const raw = process.env[ZENORM_CLI_ENV_VAR];
+    if (raw === undefined || raw.trim() === "") {
+        return PROD_ENVIRONMENT;
+    }
+    const name = parseEnvName(raw);
+    if (!name) {
+        const allowed = ENV_NAMES.join(", ");
+        throw new CliError(`Invalid ${ZENORM_CLI_ENV_VAR}=${JSON.stringify(raw)}. ` +
+            `Expected one of: ${allowed} (or a "-zenorm" suffixed form).`);
+    }
+    if (name === "prod")
+        return PROD_ENVIRONMENT;
+    return environmentFromInjectedVars(name);
+}

package/dist/zenorm-skills/skills/zenorm/SKILL.md

@@ -2,9 +2,11 @@
 name: zenorm
 description: >-
   Dispatcher for explicit ZeNorm spec-driven work. Use when the user invokes
-  `/zenorm ...`, or explicitly asks to execute, implement, run, continue, or
-  sync a ZeNorm spec or task — e.g. "implement spec AUTH-123", "run this
-  ZeNorm spec", "continue spec Z-9", "do ZeNorm task <uuid>", "sync zenorm",
+  the harness-native ZeNorm skill command (`/zenorm ...` in Claude Code,
+  `$zenorm ...` in Codex, or `@zenorm ...` in Cursor), or explicitly asks to
+  execute, implement, run, continue, or sync a ZeNorm spec or task — e.g.
+  "implement spec AUTH-123", "run this ZeNorm spec", "continue spec Z-9",
+  "do ZeNorm task UUID", "sync zenorm",
   "wrap up the ZeNorm session". It routes to the right focused skill:
   full-spec execution, single-task execution, or session sync-back, and owns
   the session id and the final outcome flush. Do NOT trigger merely because a
@@ -20,7 +22,8 @@ child skills rely on: the **session id** and the **single final sync**.
 
 ## Routing
 
-`$ARGUMENTS` is everything after `/zenorm`. Run the resolver — it strips
+`$ARGUMENTS` is everything after the harness-native skill invocation
+(`/zenorm`, `$zenorm`, or `@zenorm`). Run the resolver — it strips
 verbs, classifies the target, and resolves spec keys of ANY shape (code,
 slug, or UUID) against the CLI so you do not guess:
 
@@ -42,7 +45,7 @@ for looking unfamiliar. The resolver already checked it against the CLI.
 
 The `--dispatched` flag tells `execute-task` that *you* (the dispatcher) own
 the final `zenorm-sync`, so it will not run its own. This keeps sync
-single-owner: exactly one sync per `/zenorm` invocation, no double posts. (If
+single-owner: exactly one sync per ZeNorm skill invocation, no double posts. (If
 a user runs `execute-task` directly without going through you, it has no
 `--dispatched` flag and syncs itself — that path stays correct too.)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ze-norm/cli",
   "private": false,
-  "version": "0.13.0",
+  "version": "0.14.2",
   "license": "SEE LICENSE IN README.md",
   "type": "module",
   "repository": {