archgraph-argo 0.27.0 → 0.28.0

package/dsh-argo-workspace/index.js

@@ -1,142 +1,227 @@
-// dsh-argo-workspace - single source of truth for the DSH workspace bridge.
-// install-argo.ps1 copies this file verbatim into ~/.dsh/plugins, so the
-// deployed plugin and this shipped bundle artifact are byte-identical.
-//
-// Direct MCP bridge to the argo server for DeepSeek Harness. Registers every
-// argo tool as mcp__argo__* and injects the current session's workspace
-// directory (SessionHeader.cwd) as the per-call `workspaceRoot` argument, so
-// one dsh instance follows whichever workspace the user switched to - the
-// model sees no extra parameters and no internal tool names. The argo server
-// honors the injected workspaceRoot unconditionally.
-//
-// Zero dependencies on purpose: implements the minimal MCP stdio client
-// (JSON-RPC 2.0, one JSON object per line) with Node built-ins only, so the
-// plugin runs from any DSH layout without resolving @modelcontextprotocol/sdk.
-import { spawn } from 'node:child_process'
-import readline from 'node:readline'
-import { fileURLToPath } from 'node:url'
-
-export const name = 'dsh-argo-workspace'
-export const inject = ['tools']
-
-// 包内默认：<pkg>/argo/scripts/argo-mcp-server.js —— 随包走，跨机器可移植。
-const DEFAULT_SERVER_PATH = fileURLToPath(
-  new URL('../argo/scripts/argo-mcp-server.js', import.meta.url),
-)
-
-/** Minimal MCP stdio client over the argo server process. */
-function createArgoClient(serverPath, env, cwd) {
-  const child = spawn('node', [serverPath], {
-    stdio: ['pipe', 'pipe', 'pipe'],
-    env,
-    ...(cwd ? { cwd } : {}),
-  })
-  const pending = new Map()
-  let nextId = 1
-  readline.createInterface({ input: child.stdout }).on('line', (line) => {
-    let message
-    try { message = JSON.parse(line) } catch { return }
-    if (message && typeof message.id === 'number' && pending.has(message.id)) {
-      const { resolve, reject } = pending.get(message.id)
-      pending.delete(message.id)
-      if (message.error) reject(new Error(JSON.stringify(message.error)))
-      else resolve(message.result)
-    }
-  })
-  child.stderr.on('data', () => {}) // drain; the argo server logs to stderr
-  const request = (method, params) => new Promise((resolve, reject) => {
-    const id = nextId++
-    pending.set(id, { resolve, reject })
-    child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n')
-  })
-  return {
-    request,
-    notify: (method, params) => {
-      child.stdin.write(JSON.stringify({ jsonrpc: '2.0', method, params }) + '\n')
-    },
-    close: () => child.kill(),
-  }
-}
-
-/** Connect, list tools, register them, and keep the client until disposal. */
-export async function apply(ctx, config) {
-  const serverPath = config.serverPath
-    ?? process.env.ARGO_SERVER_PATH
-    ?? DEFAULT_SERVER_PATH
-  const workspaces = Array.isArray(config.workspaces) ? config.workspaces : []
-  const env = { ...process.env }
-  if (workspaces.length > 0) env.ARGO_WORKSPACE_ROOTS = workspaces.join(';')
-  const client = createArgoClient(serverPath, env, config.cwd)
-  ctx.effect(() => () => client.close(), 'dsh-argo-workspace.dispose()')
-
-  let tools = []
-  try {
-    await client.request('initialize', {
-      protocolVersion: '2024-11-05',
-      capabilities: {},
-      clientInfo: { name: 'dsh-argo-workspace', version: '0.1.0' },
-    })
-    client.notify('notifications/initialized', {})
-    const listed = await client.request('tools/list', {})
-    tools = (listed && Array.isArray(listed.tools)) ? listed.tools : []
-  } catch (error) {
-    console.warn(`[dsh-argo-workspace] failed to connect to the argo MCP server (${serverPath}): ${error && error.message ? error.message : error}`)
-    return
-  }
-
-  const disposers = []
-  for (const tool of tools) {
-    const publicName = 'mcp__argo__' + tool.name
-    disposers.push(ctx.tools.register({
-      name: publicName,
-      description: tool.description ?? '',
-      parameters: tool.inputSchema,
-      output: {
-        schema: {
-          type: 'object',
-          properties: {
-            content: { type: 'array', items: {} },
-            structuredContent: {},
-          },
-          required: ['content'],
-          additionalProperties: false,
-        },
-        render: (_args, value) => value.content,
-      },
-      execute: async (args, exec) => {
-        // SessionHeader.cwd (the durable session workspace), NOT
-        // requestHeader() — that returns the request EpochHeader
-        // (config/system/tools) which has no cwd field.
-        const sessionCwd = exec && exec.agent && exec.agent.session
-          ? exec.agent.session.header?.cwd
-          : undefined
-        const injected = { ...(args && typeof args === 'object' ? args : {}) }
-        if (typeof sessionCwd === 'string' && sessionCwd !== '') {
-          injected.workspaceRoot = sessionCwd
-        }
-        if (exec && exec.signal && exec.signal.aborted) {
-          throw new Error('aborted')
-        }
-        const result = await client.request('tools/call', {
-          name: tool.name,
-          arguments: injected,
-        })
-        const text = Array.isArray(result.content)
-          ? result.content
-              .map((block) => block && block.type === 'text' && typeof block.text === 'string'
-                ? block.text
-                : JSON.stringify(block))
-              .join('\n')
-          : (result.toolResult !== undefined ? JSON.stringify(result.toolResult) : '(no output)')
-        if (result.isError === true) throw new Error(text)
-        return {
-          content: [{ type: 'text', text }],
-          ...(result.structuredContent !== undefined ? { structuredContent: result.structuredContent } : {}),
-        }
-      },
-    }))
-  }
-  ctx.effect(() => () => {
-    for (const dispose of disposers) dispose()
-  }, 'dsh-argo-workspace.tools')
-}
+// dsh-argo-workspace - single source of truth for the DSH workspace bridge.
+// install-argo.ps1 copies this file verbatim into ~/.dsh/plugins, so the
+// deployed plugin and this shipped bundle artifact are byte-identical.
+//
+// Direct MCP stdio bridge(es) for DeepSeek Harness. Registers every tool of each
+// configured MCP server as mcp__<id>__* and, for the argo server, injects the
+// current session's workspace directory (SessionHeader.cwd) as the per-call
+// `workspaceRoot` argument, so one dsh instance follows whichever workspace the
+// user switched to - the model sees no extra parameters and no internal tool
+// names. The argo server honors the injected workspaceRoot unconditionally.
+//
+// Multiple servers are supported so a host that can only spawn local stdio
+// children (DSH) can still mount the remote federation Graph MCP through the
+// stdio bridge (GRAPH_MCP_URL). Configure via `config.servers` (a list); the
+// legacy single-server shape (`config.serverPath`) is still honored.
+//
+// Zero dependencies on purpose: implements the minimal MCP stdio client
+// (JSON-RPC 2.0, one JSON object per line) with Node built-ins only, so the
+// plugin runs from any DSH layout without resolving @modelcontextprotocol/sdk.
+import { spawn } from 'node:child_process'
+import readline from 'node:readline'
+import { fileURLToPath } from 'node:url'
+
+export const name = 'dsh-argo-workspace'
+export const inject = ['tools']
+
+// 包内默认：<pkg>/argo/scripts/argo-mcp-server.js —— 随包走，跨机器可移植。
+const DEFAULT_SERVER_PATH = fileURLToPath(
+  new URL('../argo/scripts/argo-mcp-server.js', import.meta.url),
+)
+
+// A `serverPath`/`args` entry that starts with ./ or ../ resolves relative to this
+// plugin module (portable bundle references); an absolute path is used as-is.
+function resolveMaybeRelative(value) {
+  if (typeof value === 'string' && /^[.][\\/]/.test(value)) {
+    try {
+      return fileURLToPath(new URL(value, import.meta.url))
+    } catch {
+      return value
+    }
+  }
+  return value
+}
+
+/** Normalize config into a list of server specs (backward compatible). */
+function normalizeServerSpecs(config) {
+  const topWorkspaces = Array.isArray(config.workspaces) ? config.workspaces : []
+  const withCommon = (spec) => {
+    const env = { ...process.env, ...(spec.env || {}) }
+    if (spec.injectWorkspaceRoot && topWorkspaces.length > 0) {
+      env.ARGO_WORKSPACE_ROOTS = topWorkspaces.join(';')
+    }
+    // Assert the broker-controlled workspace channel: the argo server will only
+    // trust the per-call sessionWorkspaceRoot (which this bridge sets from the
+    // durable SessionHeader.cwd, overwriting any model value) when this flag is
+    // present. The model cannot set a server process env var, so the trust is
+    // unforgeable.
+    if (spec.injectWorkspaceRoot) {
+      env.ARGO_WORKSPACE_ROOT_TRUSTED = '1'
+    }
+    return { ...spec, env, cwd: spec.cwd ?? (spec.injectWorkspaceRoot ? config.cwd : undefined) }
+  }
+
+  if (Array.isArray(config.servers) && config.servers.length > 0) {
+    return config.servers.map((server) => {
+      const id = typeof server.id === 'string' && server.id !== '' ? server.id : 'server'
+      const injectWorkspaceRoot = server.injectWorkspaceRoot !== undefined
+        ? server.injectWorkspaceRoot === true
+        : id === 'argo'
+      const serverPath = resolveMaybeRelative(server.serverPath)
+        ?? (id === 'argo' ? DEFAULT_SERVER_PATH : undefined)
+      const args = Array.isArray(server.args)
+        ? server.args.map(resolveMaybeRelative)
+        : (serverPath ? [serverPath] : [])
+      return withCommon({
+        id,
+        // mcp__<id>__ prefix mirrors the host's server-name convention.
+        prefix: typeof server.prefix === 'string' && server.prefix !== '' ? server.prefix : 'mcp__' + id + '__',
+        command: typeof server.command === 'string' && server.command !== '' ? server.command : 'node',
+        args,
+        env: server.env && typeof server.env === 'object' ? server.env : {},
+        cwd: server.cwd,
+        injectWorkspaceRoot,
+      })
+    })
+  }
+
+  // Legacy single-server shape: the argo workspace bridge.
+  const serverPath = config.serverPath ?? process.env.ARGO_SERVER_PATH ?? DEFAULT_SERVER_PATH
+  return [withCommon({
+    id: 'argo',
+    prefix: 'mcp__argo__',
+    command: 'node',
+    args: [serverPath],
+    env: {},
+    cwd: config.cwd,
+    injectWorkspaceRoot: true,
+  })]
+}
+
+/** Minimal MCP stdio client over one spawned server process. */
+function createStdioClient(command, args, env, cwd) {
+  const child = spawn(command, args, {
+    stdio: ['pipe', 'pipe', 'pipe'],
+    env,
+    ...(cwd ? { cwd } : {}),
+  })
+  const pending = new Map()
+  let nextId = 1
+  readline.createInterface({ input: child.stdout }).on('line', (line) => {
+    let message
+    try { message = JSON.parse(line) } catch { return }
+    if (message && typeof message.id === 'number' && pending.has(message.id)) {
+      const { resolve, reject } = pending.get(message.id)
+      pending.delete(message.id)
+      if (message.error) reject(new Error(JSON.stringify(message.error)))
+      else resolve(message.result)
+    }
+  })
+  child.stderr.on('data', () => {}) // drain; the server logs to stderr
+  const request = (method, params) => new Promise((resolve, reject) => {
+    const id = nextId++
+    pending.set(id, { resolve, reject })
+    child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n')
+  })
+  return {
+    request,
+    notify: (method, params) => {
+      child.stdin.write(JSON.stringify({ jsonrpc: '2.0', method, params }) + '\n')
+    },
+    close: () => child.kill(),
+  }
+}
+
+/** Connect one server, list its tools, and register them under its prefix. */
+async function mountServer(ctx, spec, registered) {
+  const client = createStdioClient(spec.command, spec.args, spec.env, spec.cwd)
+  ctx.effect(() => () => client.close(), `dsh-argo-workspace.dispose(${spec.id})`)
+
+  let tools = []
+  try {
+    await client.request('initialize', {
+      protocolVersion: '2024-11-05',
+      capabilities: {},
+      clientInfo: { name: 'dsh-argo-workspace', version: '0.1.0' },
+    })
+    client.notify('notifications/initialized', {})
+    const listed = await client.request('tools/list', {})
+    tools = (listed && Array.isArray(listed.tools)) ? listed.tools : []
+  } catch (error) {
+    console.warn(`[dsh-argo-workspace] failed to connect to '${spec.id}' (${spec.args.join(' ')}): ${error && error.message ? error.message : error}`)
+    return
+  }
+
+  for (const tool of tools) {
+    const publicName = spec.prefix + tool.name
+    registered.push(ctx.tools.register({
+      name: publicName,
+      description: tool.description ?? '',
+      parameters: tool.inputSchema,
+      output: {
+        schema: {
+          type: 'object',
+          properties: {
+            content: { type: 'array', items: {} },
+            structuredContent: {},
+          },
+          required: ['content'],
+          additionalProperties: false,
+        },
+        render: (_args, value) => value.content,
+      },
+      execute: async (args, exec) => {
+        // SessionHeader.cwd (the durable session workspace), NOT
+        // requestHeader() — that returns the request EpochHeader
+        // (config/system/tools) which has no cwd field.
+        const injected = { ...(args && typeof args === 'object' ? args : {}) }
+        if (spec.injectWorkspaceRoot) {
+          const sessionCwd = exec && exec.agent && exec.agent.session
+            ? exec.agent.session.header?.cwd
+            : undefined
+          if (typeof sessionCwd === 'string' && sessionCwd !== '') {
+            injected.workspaceRoot = sessionCwd
+            // Broker-only trusted channel: the server allows WRITES to this
+            // workspace (see workspace-write-guard.js). Set AFTER the spread so
+            // a model-supplied value can never win.
+            injected.sessionWorkspaceRoot = sessionCwd
+          } else {
+            // No session workspace: never forward a model-supplied trusted field.
+            delete injected.sessionWorkspaceRoot
+          }
+        }
+        if (exec && exec.signal && exec.signal.aborted) {
+          throw new Error('aborted')
+        }
+        const result = await client.request('tools/call', {
+          name: tool.name,
+          arguments: injected,
+        })
+        const text = Array.isArray(result.content)
+          ? result.content
+              .map((block) => block && block.type === 'text' && typeof block.text === 'string'
+                ? block.text
+                : JSON.stringify(block))
+              .join('\n')
+          : (result.toolResult !== undefined ? JSON.stringify(result.toolResult) : '(no output)')
+        if (result.isError === true) throw new Error(text)
+        return {
+          content: [{ type: 'text', text }],
+          ...(result.structuredContent !== undefined ? { structuredContent: result.structuredContent } : {}),
+        }
+      },
+    }))
+  }
+}
+
+/** Connect every configured server, register its tools, keep clients until disposal. */
+export async function apply(ctx, config) {
+  const specs = normalizeServerSpecs(config || {})
+  const registered = []
+  for (const spec of specs) {
+    await mountServer(ctx, spec, registered)
+  }
+  ctx.effect(() => () => {
+    for (const dispose of registered) dispose()
+  }, 'dsh-argo-workspace.tools')
+}

package/install-argo.ps1

@@ -28,6 +28,9 @@ param(
     [string]$DoubaoHome = "$env:USERPROFILE\Doubao",
     [string]$DoubaoWorkspace = "$env:LOCALAPPDATA\Doubao\User Data\Default\.doubao\agent_mode\workspace",
     [switch]$SkipDoubao,
+    [string]$CodexHome = "$env:USERPROFILE\.codex",
+    [string]$CodexRepoRoot = '',
+    [switch]$SkipCodex,
     [string]$McpPath,
     [string]$GraphMcpUrl = 'https://argo.derekworkspacev5.com/mcp'
 )
@@ -596,6 +599,71 @@ function Write-OpenClawMcpConfig {
     [System.IO.File]::WriteAllText($configPath, $json, (New-Object System.Text.UTF8Encoding $false))
 }
 
+function ConvertTo-TomlString {
+    # Encode a value as a TOML basic string (escape backslash + double quote).
+    param([string]$Value)
+    return '"' + ($Value -replace '\\', '\\\\' -replace '"', '\"') + '"'
+}
+
+function Write-CodexMcpConfig {
+    # Register the argo and graph-mcp MCP servers in the Codex config file
+    # (~/.codex/config.toml). Codex stores MCP servers as standard TOML tables
+    # [mcp_servers.<name>] (NOT the JSON/YAML shapes the other hosts use), so
+    # this is a text-level table upsert:
+    #   - the previous managed tables ([mcp_servers.argo], [mcp_servers.argo.env],
+    #     [mcp_servers.graph-mcp]) are removed first, so a re-deploy replaces
+    #     rather than duplicates them (duplicate TOML tables are a parse error);
+    #   - every unrelated config.toml key (the desktop app's own settings, other
+    #     MCP servers, plugins, marketplaces) is preserved verbatim;
+    #   - the file is written without a BOM.
+    #
+    # Workspace: Codex spawns every stdio MCP server with the SESSION workspace
+    # as its process cwd and without ARGO_* env (verified), and argo-paths.js
+    # falls back to process.cwd() when ARGO_REPO_ROOT is unset. So, like
+    # OpenCode / DeepSeek Harness, the single global argo server FOLLOWS whichever
+    # workspace the user opened in Codex and ARGO_REPO_ROOT is NOT pinned by
+    # default. Pass -RepoRoot to pin a fixed workspace instead (opt-in).
+    param(
+        [string]$ConfigPath,
+        [string]$ArgoServer,
+        [string]$GraphMcpUrl,
+        [string]$RepoRoot
+    )
+    $targetHeaders = @('[mcp_servers.argo]', '[mcp_servers.argo.env]', '[mcp_servers.graph-mcp]')
+    $existing = if (Test-Path $ConfigPath) { [System.IO.File]::ReadAllText($ConfigPath) } else { '' }
+    $lines = if ($existing -eq '') { @() } else { $existing -split "\r?\n" }
+
+    $kept = New-Object System.Collections.Generic.List[string]
+    $i = 0
+    while ($i -lt $lines.Count) {
+        $trim = $lines[$i].Trim()
+        if ($targetHeaders -contains $trim) {
+            # Skip the header and its body up to the next top-level table header.
+            $i++
+            while ($i -lt $lines.Count -and -not $lines[$i].TrimStart().StartsWith('[')) { $i++ }
+            continue
+        }
+        $kept.Add($lines[$i])
+        $i++
+    }
+    while ($kept.Count -gt 0 -and $kept[$kept.Count - 1].Trim() -eq '') { $kept.RemoveAt($kept.Count - 1) }
+
+    $blocks = New-Object System.Collections.Generic.List[string]
+    $blocks.Add((@('[mcp_servers.argo]', 'command = "node"', "args = [$(ConvertTo-TomlString $ArgoServer)]") -join "`n"))
+    if (-not [string]::IsNullOrWhiteSpace($RepoRoot)) {
+        $blocks.Add(("[mcp_servers.argo.env]`nARGO_REPO_ROOT = $(ConvertTo-TomlString $RepoRoot)"))
+    }
+    $blocks.Add(("[mcp_servers.graph-mcp]`nurl = $(ConvertTo-TomlString $GraphMcpUrl)"))
+
+    $result = ($kept -join "`n")
+    if ($result.Trim() -ne '') { $result = $result.TrimEnd() + "`n`n" }
+    $result += ($blocks -join "`n`n") + "`n"
+
+    New-Item -ItemType Directory -Force -Path (Split-Path $ConfigPath) | Out-Null
+    [System.IO.File]::WriteAllText($ConfigPath, $result, (New-Object System.Text.UTF8Encoding $false))
+    Write-Host "  Codex MCP: argo (stdio) + graph-mcp (streamable http) -> $ConfigPath"
+}
+
 function Write-DshManagedBlock {
     # Text-level upsert of a marker-delimited block into a file (used for the
     # managed rows in ~/.dsh/cordis.patch.yml): replaces the previous managed
@@ -776,10 +844,9 @@ Write-Host "[4/22] argo\skills\argo-init -> $skillDest"
 Copy-Tree -Source $skillSrc -Destination $skillDest
 $reconcileSkillSrc = Join-Path (Join-Path $argoDir 'skills') 'ea-human-reconcile'
 $diagSkillSrc = Join-Path (Join-Path $argoDir 'skills') 'agent-search-diagnosis'
-Write-Host '  argo\skills\ea-human-reconcile -> $SkillsRoot\ea-human-reconcile (EA human draft reconcile skill)'
+Write-Host "  argo\skills\ea-human-reconcile -> $SkillsRoot\ea-human-reconcile (EA human draft reconcile skill)"
 Copy-Tree -Source $reconcileSkillSrc -Destination (Join-Path $SkillsRoot 'ea-human-reconcile')
-Write-Host '  argo\skills\agent-search-diagnosis -> $SkillsRoot\agent-search-diagnosis (agent search diagnosis skill)'
-Copy-Tree -Source $diagSkillSrc -Destination (Join-Path $SkillsRoot 'agent-search-diagnosis')
+# agent-search-diagnosis is OpenCode-only (it assumes `opencode` session export); not deployed to Copilot.
 
 $ruleSrc = Join-Path (Join-Path $argoDir 'rules') 'archgraph.instructions.md'
 $ruleDest = Join-Path $PromptsRoot 'archgraph.instructions.md'
@@ -795,10 +862,9 @@ Copy-Item -Force -Path $depsSrc -Destination $depsDest
 $cursorSkillDest = Join-Path $CursorSkillsRoot 'argo-init'
 Write-Host "[7/22] argo\skills\argo-init -> $cursorSkillDest (Cursor)"
 Copy-Tree -Source $skillSrc -Destination $cursorSkillDest
-Write-Host '  argo\skills\ea-human-reconcile -> $CursorSkillsRoot\ea-human-reconcile (Cursor)'
+Write-Host "  argo\skills\ea-human-reconcile -> $CursorSkillsRoot\ea-human-reconcile (Cursor)"
 Copy-Tree -Source $reconcileSkillSrc -Destination (Join-Path $CursorSkillsRoot 'ea-human-reconcile')
-Write-Host '  argo\skills\agent-search-diagnosis -> $CursorSkillsRoot\agent-search-diagnosis (Cursor)'
-Copy-Tree -Source $diagSkillSrc -Destination (Join-Path $CursorSkillsRoot 'agent-search-diagnosis')
+# agent-search-diagnosis is OpenCode-only (it assumes `opencode` session export); not deployed to Cursor.
 
 $mcpBridgeSrc = Join-Path $argoDir 'mcp-bridges'
 $mcpBridgeDest = Join-Path $CursorMcpBridgesRoot ''
@@ -808,9 +874,9 @@ Copy-Tree -Source $mcpBridgeSrc -Destination $mcpBridgeDest
 $openCodeSkillDest = Join-Path $OpenCodeSkillsRoot 'argo-init'
 Write-Host "[8/22] argo\skills\argo-init -> $openCodeSkillDest (OpenCode)"
 Copy-Tree -Source $skillSrc -Destination $openCodeSkillDest
-Write-Host '  argo\skills\ea-human-reconcile -> $OpenCodeSkillsRoot\ea-human-reconcile (OpenCode)'
+Write-Host "  argo\skills\ea-human-reconcile -> $OpenCodeSkillsRoot\ea-human-reconcile (OpenCode)"
 Copy-Tree -Source $reconcileSkillSrc -Destination (Join-Path $OpenCodeSkillsRoot 'ea-human-reconcile')
-Write-Host '  argo\skills\agent-search-diagnosis -> $OpenCodeSkillsRoot\agent-search-diagnosis (OpenCode)'
+Write-Host "  argo\skills\agent-search-diagnosis -> $OpenCodeSkillsRoot\agent-search-diagnosis (OpenCode-only: assumes opencode session export)"
 Copy-Tree -Source $diagSkillSrc -Destination (Join-Path $OpenCodeSkillsRoot 'agent-search-diagnosis')
 
 Write-Host "[9/22] argo\rules\archgraph.instructions.md -> $OpenCodeAgentsPath (OpenCode global AGENTS.md)"
@@ -849,15 +915,14 @@ if ($SkipDsh) {
 
     Write-Host "[16/22] argo\skills\argo-init -> $dshSkillDest (DeepSeek Harness skill)"
     Copy-Tree -Source (Join-Path $argoDir 'skills\argo-init') -Destination $dshSkillDest
-    Write-Host '  argo\skills\ea-human-reconcile -> $DshHome\skills\ea-human-reconcile (DeepSeek Harness skill)'
+    Write-Host "  argo\skills\ea-human-reconcile -> $DshHome\skills\ea-human-reconcile (DeepSeek Harness skill)"
     Copy-Tree -Source (Join-Path $argoDir 'skills\ea-human-reconcile') -Destination (Join-Path (Join-Path $DshHome 'skills') 'ea-human-reconcile')
-    Write-Host '  argo\skills\agent-search-diagnosis -> $DshHome\skills\agent-search-diagnosis (DeepSeek Harness skill)'
-    Copy-Tree -Source $diagSkillSrc -Destination (Join-Path (Join-Path $DshHome 'skills') 'agent-search-diagnosis')
+    # agent-search-diagnosis is OpenCode-only (it assumes `opencode` session export); not deployed to DeepSeek Harness.
 
     Write-Host "[17/22] dsh-argo-wakeup\index.js (single source; gate from argo\rules\archgraph.instructions.md <WakeupGuideline>) -> $DshHome\plugins\dsh-argo-wakeup\index.js (DeepSeek Harness wakeup plugin)"
     $wakeupDshPath = New-DshWakeupPlugin -DshHome $DshHome
 
-    Write-Host "[18/22] argo-workspace + argo-wakeup rows -> $patchPath (DeepSeek Harness MCP bridge + wakeup plugin)"
+    Write-Host "[18/22] argo-workspace (argo + graph-mcp) + argo-wakeup rows -> $patchPath (DeepSeek Harness MCP bridges + wakeup plugin)"
     # The generated dsh-argo-workspace bridge connects directly to the argo
     # server (no dsh-mcp-client row), registers every tool as mcp__argo__* and
     # injects the current session's workspace (SessionHeader.cwd) as the
@@ -865,9 +930,20 @@ if ($SkipDsh) {
     # user switched to. The server honors the injected workspaceRoot
     # unconditionally.
     $bridgeDshPath = New-DshWorkspaceBridge -DshHome $DshHome
+    # Deploy the federation Graph MCP stdio bridge next to the DSH plugins, so the
+    # remote graph-mcp (registry_*/mirror_*/graph_*) mounts as an ordinary local
+    # stdio server - the same bridge Cursor/Doubao already use.
+    $dshBridgeDir = Join-Path $DshHome 'mcp-bridges'
+    Copy-Tree -Source (Join-Path $argoDir 'mcp-bridges') -Destination $dshBridgeDir
+    $dshGraphBridgePath = (Join-Path $dshBridgeDir 'graph-mcp-stdio.js').Replace('\', '/')
     if ($bridgeDshPath) {
         $bridgeUrl = 'file:///' + (($bridgeDshPath -replace '\\', '/').TrimStart('/'))
-        $bridgeConfig = "    config:`n      serverPath: '$argoServer'`n"
+        # One bridge plugin mounts every server; the argo server follows the session
+        # workspace (workspaceRoot), graph-mcp does not inject workspaceRoot.
+        $serversYaml = "      servers:`n"
+        $serversYaml += "        - id: argo`n          serverPath: '$argoServer'`n          injectWorkspaceRoot: true`n"
+        $serversYaml += "        - id: graph-mcp`n          command: node`n          args:`n            - '$dshGraphBridgePath'`n          env:`n            GRAPH_MCP_URL: '$GraphMcpUrl'`n          injectWorkspaceRoot: false`n"
+        $bridgeConfig = "    config:`n" + $serversYaml
         if ($DshWorkspaces) {
             $wsList = @($DshWorkspaces.Replace('\', '/').Split(';') | ForEach-Object { "        - $_" }) -join "`n"
             $bridgeConfig += "      workspaces:`n" + $wsList + "`n"
@@ -891,10 +967,8 @@ if ($SkipDsh) {
     Write-Host "[19/22] argo\agents -> $DshHome\.agent-presets\<id> (DeepSeek Harness agent presets)"
     New-DshAgentPresets -DshHome $DshHome -AgentsSrc (Join-Path $argoDir 'agents')
 
-    Write-Host "  note: graph-mcp remote ($GraphMcpUrl) is NOT registered for DeepSeek Harness -"
-    Write-Host "  ~/.dsh/cordis.patch.yml only carries plugin rows (the dsh-argo-workspace bridge spawns"
-    Write-Host "  the local argo server); an HTTP remote MCP server has no equivalent cordis row here."
-    Write-Host "  Restart `dsh web` to activate the MCP bridge and the wakeup plugin;"
+    Write-Host "  graph-mcp registered for DeepSeek Harness as a stdio bridge -> $dshGraphBridgePath (GRAPH_MCP_URL=$GraphMcpUrl)"
+    Write-Host "  Restart `dsh web` to activate the MCP bridges and the wakeup plugin;"
     Write-Host '  new sessions pick up the global rule and the argo-init skill automatically.'
     Write-Host '  The argo tools (mcp__argo__*) auto-follow the workspace the user switched to'
     Write-Host '  in one dsh instance - no restart needed between workspaces (the server honors'
@@ -914,10 +988,9 @@ if ($SkipOpenClaw) {
 
     Write-Host "[21/22] argo\skills\argo-init -> $openClawSkillDest (OpenClaw managed skill, all agents)"
     Copy-Tree -Source (Join-Path $argoDir 'skills\argo-init') -Destination $openClawSkillDest
-Write-Host '  argo\skills\ea-human-reconcile -> $OpenClawHome\skills\ea-human-reconcile (OpenClaw managed skill, all agents)'
+Write-Host "  argo\skills\ea-human-reconcile -> $OpenClawHome\skills\ea-human-reconcile (OpenClaw managed skill, all agents)"
 Copy-Tree -Source (Join-Path $argoDir 'skills\ea-human-reconcile') -Destination (Join-Path (Join-Path $OpenClawHome 'skills') 'ea-human-reconcile')
-Write-Host '  argo\skills\agent-search-diagnosis -> $OpenClawHome\skills\agent-search-diagnosis (OpenClaw managed skill, all agents)'
-Copy-Tree -Source $diagSkillSrc -Destination (Join-Path (Join-Path $OpenClawHome 'skills') 'agent-search-diagnosis')
+# agent-search-diagnosis is OpenCode-only (it assumes `opencode` session export); not deployed to OpenClaw.
 
     Write-Host '  OpenClaw injects AGENTS.md into Project Context on every session, so the wakeup'
     Write-Host '  gate (UNCONDITIONAL STARTUP GATE) is active on the next OpenClaw session; restart'
@@ -937,7 +1010,8 @@ if ($SkipDoubao) {
     # fully ported surface). MCP servers are registered through Doubao's in-app
     # custom connector UI (STDIO), not a config file, so the installer emits a
     # copy-paste connector recipe instead of writing a config.
-    $doubaoSkills = @('argo-init', 'ea-human-reconcile', 'agent-search-diagnosis')
+    # agent-search-diagnosis is OpenCode-only (it assumes `opencode` session export); not deployed to Doubao.
+    $doubaoSkills = @('argo-init', 'ea-human-reconcile')
     $doubaoSkillsSrc = Join-Path $argoDir 'skills'
     Write-Host '==> Deploying Doubao (desktop agent mode) integration'
     Copy-DoubaoSkills -Root (Join-Path $DoubaoWorkspace '.user_skills') -SourceSkillsRoot $doubaoSkillsSrc -SkillNames $doubaoSkills -Label 'workspace .user_skills'
@@ -1142,6 +1216,33 @@ if ($SkipMcp) {
     }
 }
 
+if ($SkipCodex) {
+    Write-Host 'Skipped Codex integration (-SkipCodex).'
+} else {
+    $ruleSrcContent = Get-Content $ruleSrc -Raw -Encoding UTF8
+    $codexAgentsPath = Join-Path $CodexHome 'AGENTS.md'
+    $codexSkillsRoot = Join-Path $CodexHome 'skills'
+
+    Write-Host '==> Deploying Codex integration'
+    Write-Host "[Codex 1/3] argo\rules\archgraph.instructions.md -> $codexAgentsPath (Codex global AGENTS.md, frontmatter stripped)"
+    Write-ArchGraphRuleBlock -DestPath $codexAgentsPath -RuleText $ruleSrcContent -Label 'Codex rule'
+
+    Write-Host "[Codex 2/3] argo\skills -> $codexSkillsRoot (Codex user skills: argo-init, ea-human-reconcile)"
+    Copy-DoubaoSkills -Root $codexSkillsRoot -SourceSkillsRoot (Join-Path $argoDir 'skills') -SkillNames @('argo-init', 'ea-human-reconcile') -Label 'Codex user skills'
+    # agent-search-diagnosis is OpenCode-only (it assumes `opencode` session export); not deployed to Codex.
+
+    if ($SkipMcp) {
+        Write-Host '  Skipped Codex MCP registration (-SkipMcp).'
+    } else {
+        $codexConfigPath = Join-Path $CodexHome 'config.toml'
+        Write-Host "[Codex 3/3] argo MCP (stdio) + graph-mcp -> $codexConfigPath (Codex config.toml)"
+        Write-CodexMcpConfig -ConfigPath $codexConfigPath -ArgoServer $argoServer -GraphMcpUrl $GraphMcpUrl -RepoRoot $CodexRepoRoot
+    }
+    Write-Host '  Codex injects the global AGENTS.md into every session, so the wakeup gate is'
+    Write-Host '  active on the next Codex session; skills load on trigger. Restart Codex so it'
+    Write-Host '  picks up config.toml and the new skills.'
+}
+
 $wakeupPluginPath = Join-Path $PluginsRoot 'argo-wakeup.js'
 if (Test-Path $wakeupPluginPath) {
     Write-Host '==> Registering argo-wakeup plugin in OpenCode'