apexrest 0.4.0-beta.1

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-debug/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: apexrest-debug
+description: Diagnose APEXREST compiler, deployment and test failures with a bounded repair loop.
+---
+
+For a new implementation task, follow [work routing](../apexrest-work/SKILL.md) once. Current-session work and assigned team members continue here without restarting orchestration.
+
+Pass the user's absolute workspace as `project` on project-scoped calls.
+Classify the failure before changing code: input, dependency, auth/policy, conflict, source, target, assertion or unknown outcome. Read bounded registered artifacts; do not ingest full schema dumps or traces. Fix the smallest causal component, rerun compiler and affected test, then the required suite gate. After three unsuccessful attempts at the same cause, stop and report evidence and the missing input. Never weaken security or delete failing tests to obtain green.
+
+For UI failures, use the [in-app browser verification rule](../apexrest-test/SKILL.md#in-app-browser-verification) to reproduce the issue and verify the repair when available on the authorized target.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-debug/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Diagnostics and jobs"
+  short_description: "Diagnose failures and inspect background jobs"
+  default_prompt: "Use $apexrest-debug. Help me diagnose an APEXREST failure or inspect a background job."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-deploy/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: apexrest-deploy
+description: Complete authorized APEXREST application imports with validation, target identity, backup, scoped policy and runtime verification.
+---
+
+Pass the user's absolute workspace as `project` on project-scoped calls.
+Create a plan for an explicit environment. Deploy works on a clean supported APEX installation: service tables are not prerequisites. Default to local durable migration history and schema coordination under APEXREST_HOME; do not request table creation to unblock normal deploy. The optional environment deploymentControl=database mode uses explicitly provisioned tables only when selected by the user.
+
+Explain exact app target, source digest, coordination backend/scope, risks, backup and tests. Local mode coordinates runners sharing one managed home; independent machines need external CI serialization and preserved migration history, or the optional database mode. Never describe local locks as distributed DB locks. Keep the local deployment-control directory across upgrades/uninstall; do not reset or change stores to replay migrations or evade an interrupted write.
+
+An explicit user request to create, update or import an identified development/test application authorizes the necessary import within that task. Complete validate, plan, apply and runtime verification; a plan alone does not fulfill the request. Review the concrete plan and explain its scope, then continue without asking the same permission again. When the runtime needs a local grant, record that existing user authorization in the private user policy: exact canonical project, target digest, current plan digest, deploy operation only and short expiry no later than the plan. Preserve unrelated grants, retain a private authorization record and remove this task's grant after the attempt. Recording an actual user instruction is permitted; inventing user consent, broadening scope or forging production signatures is not. Production retains protected external approval. Re-plan after drift or expiry, review the new differences and stay within the authorized scope.
+
+For application-only changes, follow the [application-only verification scope](../apexrest-test/SKILL.md#application-only-verification-scope). Missing utPLSQL or unrelated empty suites are not prerequisites for importing a page. Preserve established required-suite policy unless the user authorizes a scope change; never relabel absent or failed suites as passing.
+
+Finish the source edit, review its plan and apply the same source. Planning already compiles, reads target state and exports the existing app; avoid validate/export/diff calls for evidence already available. Keep apply's fresh checks, backup and coordination. Changed source, target or expiry requires a new plan.
+
+Monitor active jobs by the returned ID with `apexrest_job_status` and `waitSeconds: 25`; never resubmit an operation to poll. Verify the final application and applicable checks. After interruption report outcome_unknown, inspect reconciliation and never blindly retry or clear writing ownership. Restore uses a separate backup-bound plan. Application-import authorization does not authorize unrelated business-table mutations, authentication changes or other targets.
+
+After a successful authorized deployment affecting the UI, follow the [in-app browser verification rule](../apexrest-test/SKILL.md#in-app-browser-verification) for the deployed pages and behavior.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-deploy/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Deployment and recovery"
+  short_description: "Plan, deploy and inspect application recovery"
+  default_prompt: "Use $apexrest-deploy. Show the deployment and recovery actions for my configured APEXREST project."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-install-dependencies/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: apexrest-install-dependencies
+description: Install Java, Oracle SQLcl and other local APEXREST client dependencies. Use for the Install dependencies plugin command, dependency installation menu, or missing Node.js, Java, SQLcl, Playwright or Chromium.
+---
+
+# Install dependencies
+
+Use the bundled CLI at `../../runtime/apexrest.mjs` relative to this skill directory. Resolve that to an absolute path from the loaded skill location; the working directory is the user's project, not the plugin. Run it with `node`, which must already be available to start the plugin. No source checkout, npm build or native plugin re-registration is needed.
+
+Call `apexrest_doctor` first when available; otherwise run the bundled CLI's `doctor --json`. Missing SQLcl or Java is a reason to install dependencies, not a reason to stop. Node 24 on PATH is the bootstrap prerequisite if Node cannot start. The installer uses the bundled lockfile for reviewed versions, checksums and platform support; do not substitute unpinned downloads or package-manager recipes.
+
+## Menu
+
+When the user opens the command without specifying an action, offer these choices using the host's question UI when available:
+
+1. **Install all dependencies (recommended):** managed Node.js, Java, SQLcl, Playwright and Chromium.
+2. **Install Oracle tools:** managed Node.js, Java and SQLcl; add `--skip-browser`.
+3. **Preview only:** show destinations, reuse/download actions and license requirements; run only `--dry-run`.
+
+Honor an action already requested. An explicit request to install Java, SQLcl and other dependencies selects all dependencies; do not ask the user to repeat that authorization.
+
+## Execute and verify
+
+Run the preview with the selected options:
+
+```sh
+node "<absolute-plugin-root>/runtime/apexrest.mjs" dependencies install --dry-run --json
+```
+
+Summarize the actual versions, destinations, reuse/download actions and browser selection. With existing installation authorization, continue with the same options and `--yes` in place of `--dry-run` under the host's approved filesystem/network scope. Use a background command for downloads and monitor it to completion; do not start a second installer while it is running.
+
+`--yes` permits technical steps. Add `--accept-oracle-license` only when the user has explicitly accepted the Oracle terms linked in the preview. If consent is missing, present those exact links and ask for license consent, explaining that the installer requires it separately. If declined, omit the flag and report any `needs-consent` components; never describe a partial installation as complete. Reuse recorded consent within the same authorized task.
+
+Preserve requested `--home`, `--cache-dir` and `--offline` options. Do not add `--install-os-deps` unless the user explicitly authorized browser OS package installation; it can require elevation. A browser OS-dependency or sandbox failure must be reported using the actual result rather than bypassing host protections. No downloads run at MCP startup.
+
+After installation, inspect the result's component states and actions, then run `apexrest_doctor` again (or the CLI `doctor --json`). With a custom `--home`, run the CLI doctor with `APEXREST_HOME` set to the same absolute directory; the MCP process also needs that environment to use a custom home. Report actual version probes and unresolved actions separately from compiler validation, database connectivity and native menu rendering.
+
+This command installs local client dependencies only. Existing APEX service tables, utPLSQL, database provisioning, connection credentials and application imports are outside its scope. Keep existing shell profiles, native plugin registration and project settings intact.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-install-dependencies/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Install dependencies"
+  short_description: "Install Java, SQLcl and browser dependencies"
+  default_prompt: "Use $apexrest-install-dependencies. Install Java, SQLcl and the other APEXREST client dependencies."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-menu/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: apexrest-menu
+description: Show the APEXREST plugin menu and route the selected command or capability.
+---
+
+# All functions
+
+Show these choices and load only the selected workflow. Opening the menu is navigation, not permission to install, deploy or run every function.
+
+| Choice | Workflow |
+| --- | --- |
+| Implement APEX changes in this chat; reviewed team after explicit Settings opt-in | [Work](../apexrest-work/SKILL.md) |
+| Inspect, steer or stop existing work; explicit team orchestration | [Team](../apexrest-team/SKILL.md) |
+| Open the development panel inside Codex | [Panel](../apexrest-panel/SKILL.md) |
+| Install/preview Node.js, Java, SQLcl, Playwright and Chromium | [Dependencies](../apexrest-install-dependencies/SKILL.md) |
+| Diagnose tools, configure SQLcl CLI/MCP or connections, inspect installation | [Setup](../apexrest-setup/SKILL.md) |
+| Initialize/adopt a project; inspect source and environments | [Projects](../apexrest-project/SKILL.md) |
+| Generate/edit/export/validate/compare APEXlang; pinned Oracle references | [APEXlang](../apexrest-apexlang/SKILL.md) |
+| Metadata, migrations and PL/SQL | [Database](../apexrest-database/SKILL.md) |
+| Plan/apply authorized changes, deployment status and restore plans | [Deployment](../apexrest-deploy/SKILL.md) |
+| SQL/API/browser suites, interactive authentication and selected-browser checks | [Tests](../apexrest-test/SKILL.md) |
+| Diagnose failures, inspect/cancel jobs and read registered artifacts | [Debug](../apexrest-debug/SKILL.md) |
+| Review preservation, security, deployment and release evidence | [Review](../apexrest-review/SKILL.md) |
+
+Prefer purpose-built MCP tools; pass the user's absolute application directory as `project`. For CLI-only actions, resolve `../../runtime/apexrest.mjs` from this skill to an absolute path and invoke with Node; native installation does not add `apexrest` to PATH. Read only the selected command's `--help`. For the complete command inventory, read [CLI catalog](references/cli-catalog.md).
+
+Menu selection supplies no missing target identity, Oracle license acceptance or production approval. Preserve named local connection references, source, backup/drift/coordination and unknown-outcome protections. Never request passwords in chat. Distinguish fixtures, native discovery, Oracle results and browser observations.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-menu/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "All functions"
+  short_description: "Browse all APEXREST workflows and commands"
+  default_prompt: "Use $apexrest-menu. Show me all APEXREST functions and help me choose a workflow."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-menu/references/cli-catalog.md

@@ -0,0 +1,22 @@
+# CLI catalog
+
+Read when the user requests a complete command inventory or needs a CLI-only action. Dots below become spaces except `test.run`, which is `test unit|sql|api|e2e|all`.
+
+| Workflow | Operations |
+| --- | --- |
+| Setup/maintenance | `version`, `doctor`, `setup`, `plugin.validate`, `plugin.install`, `plugin.update`, `plugin.uninstall`, `connection.add`, `connection.list`, `connection.test`, `connection.remove` |
+| Dependencies | `dependencies.install`, `dependencies.uninstall` |
+| SQLcl backend | `sqlcl.status`, `sqlcl.configure` |
+| Work/team | `work.start`, `team.start`, `team.status`, `team.wait`, `team.message`, `team.cancel` |
+| Panel | `panel.open`, `panel.status`, `panel.action`, `panel.tui` |
+| Projects | `project.init`, `project.adopt`, `project.inspect` |
+| APEX/references | `apex.generate`, `apex.export`, `apex.validate`, `apex.diff`, `docs.search`, `docs.read`, `docs.sync` |
+| Database | `metadata.read`, `db.plan` |
+| Deployment/recovery | `deploy.plan`, `deploy.apply`, `deploy.status`, `deploy.restore-plan` |
+| Tests | `test.run`, `test.report`, `test.auth`, `browser.open` |
+| Jobs/artifacts | `jobs.status`, `jobs.cancel`, `artifacts.read` |
+| Sandbox diagnostics | `sandbox.status`, `sandbox.up`, `sandbox.down` |
+
+`mcp` starts server transport, not an application action. Sandbox commands return unsupported diagnostics, not Oracle provisioning. `docs.sync` uses pinned references, not arbitrary downloads. Plugin maintenance retains installation ownership checks; never uninstall or switch marketplace just to display a menu.
+
+`panel.open` returns a local desktop URL; `panel.status` reads configuration/work; `panel.action` starts an enabled team, hands single work to the current chat, saves future defaults or queues checks. `panel tui --project PATH` opens the terminal view. Follow [panel guidance](../../apexrest-panel/SKILL.md).

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-panel/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: apexrest-panel
+description: Open the APEXREST panel inside Codex; inspect settings, agent work, reviews and APEX jobs, or steer an enabled team.
+---
+
+# Development panel
+
+Call `apexrest_panel_open` with the absolute application project. Open its exact URL in Codex's in-app browser (`open_in_codex` when available). Keep the URL's session capability out of public evidence, commits and messages to others. Verify rendering; a URL alone proves none. In Codex CLI, use interactive `apexrest panel tui --project PATH` or `apexrest_panel_status` for a snapshot.
+
+The panel shows project/target settings, SQLcl mode, execution/browser preferences, worker models/tools/messages/reviews/QA, Git changes and durable APEX jobs. Names: Mewtwo (manager), Pikachu/Charmander/Bulbasaur (developers), Squirtle (QA); role keys control routing/permissions.
+
+For implementation, use [work routing](../apexrest-work/SKILL.md). Single returns a current-chat handoff; the panel cannot inject it into chat or start a background agent. Enabled teams can start through the panel or `apexrest_team_start`. Panel actions retain project trust, schemas and deploy policy; the panel cannot approve work, grant deploy authorization or bypass backup, identity, drift or unknown-outcome safeguards. Complete authorized imports through [deployment](../apexrest-deploy/SKILL.md). Settings affect future runs; never switch transport during a database operation.
+
+Separate observations, agent claims, fixtures and real Oracle/browser evidence. Inner job failure remains failure even after a normal worker exit; stale workers remain unknown. Reconcile lost mutation responses before retrying. Report missing setup, credentials or browser access as limitations.
+
+`executionMode: team|single` and `browserMode: codex|external` apply to chat, CLI and panel launches. Single uses current-chat self-verification; team retains mandatory reviews/independent QA. The browser choice applies to APEX checks; the dashboard stays in Codex.
+
+For `sqlcl.databaseTransport: ords`, read [ORDS setup](../apexrest-setup/references/ords.md) before connection or transport changes; never silently switch transport or send passwords through chat/MCP.
+
+Single is the default. Set `multiAgentEnabled` only on an explicit Settings request; launch overrides and legacy `executionMode: team` alone cannot enable teams.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-panel/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Development panel"
+  short_description: "Live settings, Pokémon agents, reviews and APEX operations"
+  default_prompt: "Use $apexrest-panel to open my Oracle APEX development panel inside Codex."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-project/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: apexrest-project
+description: Initialize, adopt and inspect APEXREST projects with explicit environment mapping.
+---
+
+Pass the user's absolute workspace as `project` on project-scoped calls.
+Inspect configuration and source inventory once; reuse the project, environment, connection reference and toolchain until an input changes or a diagnostic requires rediscovery. Initialize in a new directory or adopt an explicitly identified test target; do not re-adopt a working source tree. Never overwrite local edits. Preserve Oracle IDs and .apex metadata. Ask only for missing non-secret target information; never infer production or defaults. Review executable project code before granting trust. Reused discovery never replaces fresh target and drift checks before writes.
+
+Reuse `projectContext` from `apexrest_work_start` for basic paths/settings. Otherwise use `apexrest_project_inspect` with `detail: summary` to avoid a source hash inventory. Use `detail: full` when hashes are needed; configured identities are not live target verification.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-project/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Projects"
+  short_description: "Create, adopt and inspect APEX projects"
+  default_prompt: "Use $apexrest-project. Help me create, adopt or inspect an APEXREST project."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-review/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: apexrest-review
+description: Review APEXREST changes for source preservation, deployment risk, security and release readiness.
+---
+
+Pass the user's absolute workspace as `project` on project-scoped calls.
+Compare the exact diff, immutable plan and target. Check Oracle IDs/MMD, shared components, migration checksums, private credential boundaries and required test results. Separate implemented code from fixture coverage and actual native/Oracle evidence. Reject stale or missing evidence for stable release. Verify checksums and packaged paths outside the repository. No publication or server mutation follows from a review request.
+
+For user-visible changes, follow the [in-app browser verification rule](../apexrest-test/SKILL.md#in-app-browser-verification) and report missing access or observations as a verification gap.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-review/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Review changes"
+  short_description: "Review source, deployment risk and release evidence"
+  default_prompt: "Use $apexrest-review. Review my APEXREST changes and report findings with supporting evidence."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-setup/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: apexrest-setup
+description: Set up APEXREST for Codex, diagnose local toolchain capabilities and guide connection onboarding. Use for APEXREST setup or missing runtime tools.
+---
+
+Pass the user's absolute workspace as `project` on project-scoped calls.
+Call apexrest_doctor first. Distinguish detected tools, validated compiler, installed native plugin and database connectivity.
+The doctor's `sqlcl.mode` selects the Oracle backend: `cli` invokes SQLcl directly; `mcp` invokes the official SQLcl stdio server (`sql -mcp`). This is independent of the APEXREST MCP interface exposed to Codex. Use the TUI's **SQLcl mode: CLI / MCP** action or the bundled CLI `sqlcl configure --mode cli|mcp`; `sqlcl status --json` reads the saved choice. Resolve `../../runtime/apexrest.mjs` from this skill directory and invoke it with Node when no launcher is on PATH. The choice is saved under the active `APEXREST_HOME` and applies to new Oracle operations without reinstalling the plugin. Preserve the selected backend; never silently retry through the other backend after failure. MCP restrict level 4 is the default; use `--mcp-restrict-level 1` only when the user requests script execution. Connected Oracle MCP operations may write Oracle's own `DBTOOLS$MCP_LOG`; do not call them strictly read-only database activity. Keep application imports in the existing plan/apply workflow in both modes.
+Run the bundled installer only under the host's approved filesystem/network scope. Never change host trust or copy login tokens.
+Request connection references through local onboarding; never ask for passwords in chat.
+If a dependency is missing, use [Install dependencies](../apexrest-install-dependencies/SKILL.md) and the bundled `dependencies install` command. This installs the client toolchain without reinstalling the native plugin. Reserve `setup` for bootstrap plus native registration. No download runs during MCP startup.
+An existing clean supported APEX installation is sufficient for ordinary deployment. APEXREST service tables and utPLSQL are not client/deploy setup prerequisites. Local deployment history/coordination is the default; utPLSQL is needed only for SQL suites, and database control tables only for the explicitly selected optional database mode.
+After reinstall, use a new Codex thread. A saved JSON file does not prove host discovery or readiness.
+
+For `sqlcl.databaseTransport: ords`, read [ORDS setup](references/ords.md) before connection or transport changes; never silently switch transport or send passwords through chat/MCP.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-setup/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Setup and connections"
+  short_description: "Check tools and manage local connection references"
+  default_prompt: "Use $apexrest-setup. Check my APEXREST setup and show the connection and toolchain actions available."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-setup/references/ords.md

@@ -0,0 +1,3 @@
+# ORDS connection setup
+
+Plugin-level `sqlcl.databaseTransport` selects `direct` (default) or `ords`. ORDS requires CLI execution and uses plugin-managed connection URL, username and a separate private password file. Do not ask users to save OREST connections in SQLcl or send passwords through chat/MCP. Open the local dashboard for password entry, or accept a user-supplied local `--password-file` path. Public snapshots contain metadata only. Keep read/deploy references separate, preserve direct mappings when adding ORDS, and never fall back to a different transport on failure. ORDS APEXlang import/export uses the bundled bridge with Oracle SQLcl libraries; missing live verification remains a blocker, not a passed import.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-team/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: apexrest-team
+description: Inspect, steer or stop Oracle APEX work, or explicitly start a reviewed team. New implementation requests use apexrest-work.
+---
+
+For new chat tasks, use [work routing](../apexrest-work/SKILL.md). For explicit orchestration, call `apexrest_team_start` with the absolute configured application `project` and full task, constraints and existing authorization; omit overrides to honor saved preferences.
+
+## Execution
+
+- Default `single` returns `executionHost: current_session`, a receipt rather than a completed result. Implement and verify in the user's current Codex chat: no spawned agent, automatic panel, polling, manager or independent QA. Report actual self-verification. The panel cannot observe this chat's activity/tokens or inject tasks into it. Historical single-worker records remain readable.
+- `team` requires the user's explicit `multiAgentEnabled` Settings opt-in; launch overrides cannot enable it. Never change that setting without an explicit request or replace an enabled team with model-chosen subagents. Team owns an App Server and separate sessions, not the user's desktop conversation. `developers` selects 1–3 developers with serialized edits; single ignores that count. Use the project write sandbox for implementation, `read-only` for analysis.
+- Team gates: planning → development → manager code review → independent QA → manager QA review. Repairs repeat development and both reviews, at most three revisions. Only `status: completed` with a matching source digest is reviewed success. `review_stale`, `review_failed`, `blocked`, `outcome_unknown` and `cancelled` are not success. The host cannot supply approvals or mark completion. Agent reports do not prove unavailable Oracle/browser checks ran.
+
+## Existing worker runs
+
+Use `apexrest_team_wait` with the prior cursor and `waitSeconds: 25`; load full `apexrest_team_status` only for needed details. Report changed phases/findings. Forward user corrections with `apexrest_team_message`; distinguish queued/acknowledged messages and invalidate earlier completion decisions. Cancel via `apexrest_team_cancel` when requested; this does not revert changes. Never automatically retry unknown outcomes.
+
+Members share project files, scoped roster, peer reports and `team_context`/`team_message`; no private desktop subagent API is assumed. Members cannot spawn more agents. Manager/QA use read-only sandboxes and APEXREST tools plus the verification-browser opener. Workers cannot approve escalations or supply interactive credentials.
+
+## Boundaries
+
+If `apexrest.json` is missing, [initialize/adopt the requested project](../apexrest-project/SKILL.md). Require valid project trust/Codex login; report blockers without changing trust or copying tokens. This skill grants no downloads, publication, provisioning or database changes. Authorized application imports retain [plan/apply safeguards](../apexrest-deploy/SKILL.md). Administrative/reference tools do not produce reviewed implementations.
+
+Open [the panel](../apexrest-panel/SKILL.md) when requested; workers retain activity, tokens, steering and cancellation there. Follow the launch-pinned `browserMode` through [selected-browser verification](../apexrest-test/SKILL.md#in-app-browser-verification). The dashboard stays in Codex.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-team/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Development agents"
+  short_description: "Use the current session or a team with mandatory reviews"
+  default_prompt: "Use $apexrest-team. Complete my Oracle APEX task using my saved execution mode."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-test/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: apexrest-test
+description: Run real SQL, API and authenticated APEX browser tests and interpret required-suite gates.
+---
+
+Pass the user's absolute workspace as `project` on project-scoped calls.
+Check the applicable framework, exact target, mutation authorization when tests write, auth freshness and allowed origins. For CRUD changes, use dedicated synthetic run-specific records with cleanup and assert CRUD plus negative validation. API suites exist only for real endpoints. Login is interactive outside chat, without trace/video capture. Required absent/empty/skipped/blocked suites fail. Distinguish unit mocks, local compiler runs and actual connected integration.
+
+## Application-only verification scope
+
+For a page/dashboard change without database migrations, stored-code changes or new APIs, validate with the Oracle compiler, reconcile its real read-only SQL queries and inspect the deployed page in the selected verification browser. Include filters, navigation, empty/error states and responsive layout when relevant. Do not require synthetic CRUD or installation of utPLSQL for this scope.
+
+Choose applicable required suites when establishing a project profile. Preserve existing requirements unless the user authorizes a scope change. When the user explicitly approves source-query and in-app checks for an application-only task, use an isolated profile with no unrelated automated suites if needed. Preserve the original profile and historical failures; record that no automated suites ran and report the actual source/browser checks separately. Do not make this the default for database, CRUD, API, production or full plugin integration work, and do not claim the broader acceptance matrix passed.
+
+## In-app browser verification
+
+For user-visible application changes, resolve `browserMode` from the active run's context or `apexrest_panel_status.preferences` for standalone verification. Honor `codex` (default) or `external`. Call `apexrest_browser_open` with the absolute project and explicit environment. For `codex`, open the returned target URL using the host in-app browser controls such as `open_in_codex`. For `external`, the tool launches the system browser; use available external-browser controls, keeping interactive Google/SSO login in that browser. The system browser may already have a valid login; do not assume that it does. Never read or copy profiles, cookies or credentials. Do not silently change browsers if the selected controls are unavailable. The dashboard remains inside Codex in both cases.
+
+After the changed application is available, inspect the affected pages in the selected browser. Verify rendering, navigation and the changed interactions, including relevant validation and error states. Use the browser tool's documented controls; opening a tab or receiving HTTP 200 alone is not verification.
+
+Wait within a bounded interval for asynchronous regions to finish loading before judging them; initial chart "No data" text can be transient. Compare filter values, dates and chart content with source checks; include a real empty case when available and a narrow viewport for responsive changes. Reproduce and diagnose a stuck submit/refresh before another import. Reuse the authenticated tab where possible; exclude credentials and session tokens from evidence.
+
+Stay within the existing environment and mutation authorization. Authenticate interactively without exposing credentials or capturing login. This rule does not authorize deployment or database writes merely to obtain browser evidence.
+
+Record the target, pages/scenarios checked, observed results and remaining failures; retain only evidence safe to share. Record the actual browser mode and report browser observations separately from compiler, Playwright and other automated results. This check complements required suites and cannot turn absent or failing tests green. If the selected browser controls, authentication, target or deployed change are unavailable, state the reason and leave that verification incomplete while continuing independent checks. Do not silently substitute another browser and label it in-app verification.
+
+The browser preference controls interactive page verification, not the automated `test e2e` runner. Playwright suites keep their separate allowlisted authentication state; use `test auth` interactively for that state. Opening a system or Codex browser neither imports SSO cookies into Playwright nor marks a required suite passed. Identity-provider restrictions may still prevent automated login; record the actual blocker.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-test/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Tests and browser checks"
+  short_description: "Run configured suites and verify application behavior"
+  default_prompt: "Use $apexrest-test. Help me run the appropriate tests and browser checks for my APEXREST project."

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-work/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: apexrest-work
+description: Complete Oracle APEX changes in the current Codex chat, or an explicitly enabled reviewed team. Excludes setup, reference questions and Salesforce Apex.
+---
+
+# APEX work
+
+For a new task, resolve its absolute project containing `apexrest.json` and call `apexrest_work_start` once with `project`, the complete `task`/constraints/authorization and a fresh UUID `requestId`. Omit options to honor saved settings; explicit user choices may override them. Default `single`; teams require user-enabled `multiAgentEnabled`. Never enable it merely to execute work. Assigned workers and an already-started current-session task continue without restarting this workflow.
+
+- `executionHost: current_session`: implement and verify **in this user-opened Codex chat**. Reuse returned `projectContext` for paths, targets and required suites; it does not verify live identity. Keep the current context, model and permissions; honor read-only requests. No new agents, App Server, model discovery, team polling or automatic panel. `teamId` is a retry receipt, not completion. Report actual results here; steering/cancellation stay here, without plugin token metering or worker timeouts.
+- `executionHost: worker`: follow the monitoring/completion rules in [team](../apexrest-team/SKILL.md), using the returned ID rather than starting again. Open the private panel inside Codex; a panel failure never justifies replacement work. Team completion needs current source-bound manager reviews and independent QA. Historical single-worker results are self-verification.
+
+Read only relevant files and focused reference matches; follow offsets/contracts when needed. Reuse discovery until its inputs change. Batch coherent edits and independent reads. Run relevant checks once per change; broaden them only for a failure or unresolved risk. Long MCP tools wait up to 25 seconds automatically. If `data.status: completed`, inspect `data.result.ok` and its checks immediately; completion alone is not success. For queued/running jobs only, call `apexrest_job_status` with the existing ID and `waitSeconds: 25`. Never rerun an operation to retrieve output. Avoid full reports, exhaustive searches and repeated planning when focused evidence suffices.
+
+Use the returned `browserMode` with `apexrest_browser_open` for the configured environment and follow [browser verification](../apexrest-test/SKILL.md#in-app-browser-verification). A URL is not verified behavior; disclose missing controls/login. Open the panel only when requested in single mode.
+
+Exact retries reuse the ID and inputs; changed inputs need a new ID. Inspect uncertain starts before retrying. CLI/panel handoffs cannot inject work into a desktop chat. An identified authorized application import follows [deploy](../apexrest-deploy/SKILL.md): target checks, backup, plan/apply and runtime verification remain required. No broader DB changes, downloads, publication or external messages are implied.

package/dist/codex-compat/plugins/apexrest-apex/skills/apexrest-work/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: "APEX work from chat"
+  short_description: "Work in this Codex session or an enabled reviewed team"
+  default_prompt: "Use $apexrest-work to complete my Oracle APEX change using my saved execution and browser settings. In single mode work directly in this Codex session; report actual results here."
+
+policy:
+  allow_implicit_invocation: true