audit-tools 0.51.7 → 0.51.9

package/opencode.json

@@ -8,10 +8,10 @@
     "grep": "allow",
     "edit": {
       "*": "ask",
+      ".audit-artifacts/**": "allow",
       ".audit-code/**": "allow",
       ".audit-tools/**": "allow",
       ".remediate-code/**": "allow",
-      ".audit-artifacts/**": "allow",
       "audit-report.md": "allow"
     },
     "bash": {
@@ -62,37 +62,37 @@
         "grep": "allow",
         "edit": {
           "*": "ask",
+          ".audit-artifacts/**": "allow",
           ".audit-code/**": "allow",
           ".audit-tools/**": "allow",
-          ".audit-artifacts/**": "allow",
           "audit-report.md": "allow"
         },
         "bash": {
           "*": "ask",
-          "audit-code synthesize*": "deny",
-          "*dist*index.js* synthesize*": "deny",
-          "*audit-code.mjs* synthesize*": "deny",
-          "audit-code cleanup*": "deny",
-          "*dist*index.js* cleanup*": "deny",
+          "*audit-code.mjs": "allow",
           "*audit-code.mjs* cleanup*": "deny",
-          "audit-code requeue*": "deny",
-          "*dist*index.js* requeue*": "deny",
+          "*audit-code.mjs* ensure*": "allow",
+          "*audit-code.mjs* ingest-results*": "deny",
+          "*audit-code.mjs* next-step*": "allow",
           "*audit-code.mjs* requeue*": "deny",
-          "audit-code ingest-results*": "deny",
+          "*audit-code.mjs* synthesize*": "deny",
+          "*audit-code.mjs* validate*": "allow",
+          "*dist*index.js* cleanup*": "deny",
           "*dist*index.js* ingest-results*": "deny",
-          "*audit-code.mjs* ingest-results*": "deny",
+          "*dist*index.js* requeue*": "deny",
+          "*dist*index.js* synthesize*": "deny",
+          "Select-String *": "allow",
           "audit-code": "allow",
+          "audit-code cleanup*": "deny",
           "audit-code ensure*": "allow",
-          "*audit-code.mjs* ensure*": "allow",
+          "audit-code ingest-results*": "deny",
           "audit-code next-step*": "allow",
-          "*audit-code.mjs* next-step*": "allow",
+          "audit-code requeue*": "deny",
+          "audit-code synthesize*": "deny",
           "audit-code validate*": "allow",
-          "*audit-code.mjs* validate*": "allow",
-          "*audit-code.mjs": "allow",
-          "git status*": "allow",
           "git diff*": "allow",
+          "git status*": "allow",
           "grep *": "allow",
-          "Select-String *": "allow",
           "rm *": "deny"
         },
         "auditor_*": "allow",
@@ -108,30 +108,30 @@
         "grep": "allow",
         "edit": {
           "*": "ask",
-          ".remediate-code/**": "allow",
           ".audit-tools/**": "allow",
+          ".remediate-code/**": "allow",
           ".remediation-artifacts/**": "allow",
-          "remediation-report.md": "allow",
+          "remediation-closing-result.json": "allow",
           "remediation-report.json": "allow",
-          "remediation-closing-result.json": "allow"
+          "remediation-report.md": "allow"
         },
         "bash": {
           "*": "ask",
-          "remediate-code": "allow",
-          "remediate-code ensure*": "allow",
+          "*remediate-code.mjs": "allow",
           "*remediate-code.mjs* ensure*": "allow",
-          "remediate-code next-step*": "allow",
           "*remediate-code.mjs* next-step*": "allow",
-          "remediate-code validate*": "allow",
           "*remediate-code.mjs* validate*": "allow",
-          "*remediate-code.mjs": "allow",
-          "git status*": "allow",
+          "*remediate-code.mjs* validate-artifacts*": "allow",
+          "Select-String *": "allow",
           "git diff*": "allow",
+          "git status*": "allow",
           "grep *": "allow",
-          "Select-String *": "allow",
-          "rm *": "deny",
+          "remediate-code": "allow",
+          "remediate-code ensure*": "allow",
+          "remediate-code next-step*": "allow",
+          "remediate-code validate*": "allow",
           "remediate-code validate-artifacts*": "allow",
-          "*remediate-code.mjs* validate-artifacts*": "allow"
+          "rm *": "deny"
         },
         "remediator_*": "allow",
         "question": "allow",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.51.7",
+  "version": "0.51.9",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",
@@ -32,6 +32,8 @@
     "scripts/audit/postinstall.mjs",
     "scripts/remediate/postinstall.mjs",
     "scripts/shared/install-host-assets.mjs",
+    "scripts/shared/host-asset-plan.mjs",
+    "scripts/shared/primitives.mjs",
     "opencode.json",
     "README.md",
     "docs/audit-pkg/product.md",
@@ -51,10 +53,12 @@
     "test": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "test:single": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "verify:guards": "node scripts/shared/run-vitest-gate.mjs --retry=2 --exclude \"**/audit-code-completion-*.test.ts\" --exclude \"**/audit-code-wrapper-*.test.ts\" --exclude \"**/audit/next-step-core-*.test.ts\" --exclude \"**/seam-host-only-next-step.test.ts\" --exclude \"**/*-e2e.test.*\" --exclude \"**/next-step-implement-dispatch.test.ts\" --exclude \"**/next-step-pipeline-dispatch.test.ts\"",
-    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:shared-primitives check:version-gates check:guard-reach check:generated-artifacts check:invariant-glossary check:nightly-inbox check:ci-trigger-paths check:loop-core-patterns check:loop-core-closure check:constitutional-doc-paths check:runtime-artifact-names check:friction-categories check:executor-producers check:spec-mirrors check:cli-surface check:ingestion-checks check:deadcode check:orphan-modules check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:readme-sample-report check:proposal-red-at check:handoff-roadmap check:backlog-index check:memory-citations check:backlog-budget check:backlog-status check:backlog-line-numbers check:tests build check:scripts verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code",
+    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:shared-primitives check:agents-region check:loader-fragments check:version-gates check:guard-reach check:guard-reach-paths check:pin-obligations check:sites-pinned check:contract-sites check:generated-artifacts check:invariant-glossary check:nightly-inbox check:ci-trigger-paths check:loop-core-patterns check:loop-core-closure check:constitutional-doc-paths check:runtime-artifact-names check:friction-categories check:executor-producers check:spec-mirrors check:cli-surface check:ingestion-checks check:deadcode check:orphan-modules check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:readme-sample-report check:proposal-red-at check:handoff-roadmap check:retired-infrastructure check:backlog-index check:memory-citations check:review-routing check:doc-test-consumers check:backlog-budget check:backlog-status check:backlog-line-numbers check:backlog-friction-tags check:tests build check:scripts verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code smoke:remediate-gate",
     "verify:release": "npm run verify:checks && node scripts/shared/run-vitest-gate.mjs && npm run smoke:linked-audit-code && npm run smoke:linked-remediate-code",
     "check:control-bytes": "node scripts/check-control-bytes.mjs",
     "check:shared-primitives": "node scripts/check-shared-primitives.mjs",
+    "check:agents-region": "node scripts/check-agents-region.mjs",
+    "check:loader-fragments": "node scripts/check-loader-fragments.mjs",
     "check:guard-reach": "node scripts/check-guard-reach.mjs",
     "check:generated-artifacts": "node scripts/check-generated-artifacts.mjs",
     "check:invariant-glossary": "node scripts/check-invariant-glossary.mjs",
@@ -78,6 +82,7 @@
     "smoke:packaged-audit-code": "node scripts/audit/smoke-packaged-audit-code.mjs",
     "smoke:linked-remediate-code": "node scripts/remediate/smoke-linked-remediate-code.mjs",
     "smoke:packaged-remediate-code": "node scripts/remediate/smoke-packaged-remediate-code.mjs",
+    "smoke:remediate-gate": "node scripts/remediate/smoke-remediate-gate.mjs",
     "update-languages": "node scripts/audit/update-languages.mjs",
     "generate-schemas": "node --import tsx/esm scripts/audit/generate-schemas.mjs",
     "fixtures:auditor-contract": "node scripts/remediate/generate-auditor-contract-fixture.mjs",
@@ -91,16 +96,20 @@
     "prepublishOnly": "npm run verify:release",
     "check:loop-core-patterns": "node scripts/shared/generate-loop-core-patterns.mjs --check",
     "check:backlog-budget": "node scripts/check-backlog-budget.mjs",
+    "check:review-routing": "node scripts/check-review-routing.mjs",
+    "check:doc-test-consumers": "node scripts/check-doc-test-consumers.mjs",
     "check:memory-citations": "node scripts/check-memory-citations.mjs",
     "check:version-gates": "node scripts/check-version-gates.mjs",
     "check:constitutional-doc-paths": "node scripts/shared/generate-constitutional-doc-paths.mjs --check",
     "check:friction-categories": "node scripts/shared/generate-friction-categories.mjs --check",
     "check:handoff-roadmap": "node scripts/shared/generate-handoff-roadmap.mjs --check",
+    "check:retired-infrastructure": "node scripts/check-retired-infrastructure.mjs",
     "check:backlog-status": "node scripts/check-backlog-status-tokens.mjs",
     "check:backlog-index": "node scripts/shared/generate-backlog-index.mjs --check",
     "test:rebaseline-flakes": "node scripts/shared/rebaseline-flakes.mjs",
     "check:gate-enumeration": "node scripts/check-gate-enumeration.mjs",
     "check:backlog-line-numbers": "node scripts/check-backlog-line-numbers.mjs",
+    "check:backlog-friction-tags": "node scripts/check-backlog-friction-tags.mjs",
     "check:runtime-artifact-names": "node scripts/shared/generate-runtime-artifact-names.mjs --check",
     "check:executor-producers": "node scripts/shared/generate-executor-producers.mjs --check",
     "check:spec-mirrors": "node scripts/shared/generate-spec-mirrors.mjs --check",
@@ -108,7 +117,11 @@
     "check:ingestion-checks": "node scripts/shared/generate-ingestion-checks.mjs --check",
     "generate:shard-baseline": "node scripts/shared/generate-vitest-shard-baseline.mjs",
     "check:orphan-modules": "node scripts/check-orphan-modules.mjs",
-    "check:loop-core-closure": "node scripts/check-loop-core-closure.mjs"
+    "check:loop-core-closure": "node scripts/check-loop-core-closure.mjs",
+    "check:pin-obligations": "node scripts/check-pin-obligations.mjs",
+    "check:contract-sites": "node --import tsx/esm scripts/check-contract-sites.mjs",
+    "check:sites-pinned": "node scripts/check-sites-pinned.mjs",
+    "check:guard-reach-paths": "node scripts/shared/generate-guard-reach-paths.mjs --check"
   },
   "engines": {
     "node": ">=22"

package/schemas/audit-code-v1alpha1.schema.json

@@ -209,9 +209,6 @@
             "session_config": {
               "type": "string"
             },
-            "run_ledger": {
-              "type": "string"
-            },
             "current_review_run": {
               "type": [
                 "string",
@@ -251,7 +248,6 @@
             "operator_handoff_json",
             "operator_handoff_markdown",
             "session_config",
-            "run_ledger",
             "current_review_run",
             "current_prompt",
             "current_tasks",

package/scripts/audit/postinstall.mjs

@@ -1,27 +1,49 @@
 #!/usr/bin/env node
+// The audit-code host-install entry.
+//
+// What this file owns: the AUDIT-CODE HALF OF THE PLAN — the OpenCode permission
+// tables (what an auditor may touch) and the two prompt renderers. Everything
+// structural now comes from `scripts/shared/host-asset-plan.mjs`: which hosts are
+// served, what each target path is, which source file feeds it, the command
+// description, the agent name. Before that module existed, this file and its
+// remediate twin each carried their own copy of all of it — two installers built
+// around one shared installer, differing only by a tool token, and free to
+// drift the moment either changed.
 import { homedir } from 'os';
-import { join, dirname } from 'path';
+import { join } from 'path';
 import { readFileSync } from 'fs';
-import { fileURLToPath } from 'url';
 import {
   readRequiredSource,
   readOptionalSource,
-  writeGeneratedFile,
   objectValue,
   resolveSharedOpenCodePermissions,
   runInstalls,
   installOpenCodeGlobalConfig,
   installAntigravityPlugin,
+  installClaudeDesktopPlugin,
   finishPostinstall,
 } from '../shared/install-host-assets.mjs';
+import {
+  HOST_ASSET_PLANS,
+  PKG_ROOT,
+  planClaudePluginDir,
+  planInstalls,
+  planOpenCodeCommand,
+  planOpenCodeConfigPath,
+  planSources,
+} from '../shared/host-asset-plan.mjs';
 
 const TOOL = 'audit-code';
-const pkgRoot = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+const PLAN = HOST_ASSET_PLANS[TOOL];
+const SOURCES = planSources(PLAN);
+const pkgRoot = PKG_ROOT;
 const packageVersion = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf8')).version ?? '0.0.0';
-const promptSourceFile = join(pkgRoot, 'skills', 'audit-code', 'audit-code.prompt.md');
-const skillSourceFile = join(pkgRoot, 'skills', 'audit-code', 'SKILL.md');
-const codexOpenAiAgentSourceFile = join(pkgRoot, 'skills', 'audit-code', 'agents', 'openai.yaml');
 
+// Seed literals are passed through the shared canonical orderer below
+// (orderOpenCodePermissionRule) so the FIRST deploy already emits the order
+// every later merge emits — a fresh config takes the short-circuit branch that
+// returns the seed verbatim, so an out-of-order literal here would make run 1
+// and run 2 differ byte-wise with no value changed.
 const OPENCODE_AUDIT_EDIT_PERMISSION = {
   '*': 'ask',
   '.audit-code/**': 'allow',
@@ -153,12 +175,20 @@ function mergeOpenCodeGlobalPermissionConfig(existingPermission, generatedPermis
 }
 
 function renderOpenCodePermissionConfig() {
+  const { orderOpenCodePermissionRule } = sharedOpenCodePermissions ?? {};
+  // Guarded: on a fresh checkout before `npm run build` the shared helpers are
+  // unavailable and the caller skips the OpenCode deployment entirely, so the
+  // un-ordered literal below simply never reaches a file.
+  const ordered = (rule) =>
+    typeof orderOpenCodePermissionRule === 'function'
+      ? orderOpenCodePermissionRule(rule)
+      : { ...rule };
   return {
     read: 'allow',
     glob: 'allow',
     grep: 'allow',
-    edit: { ...OPENCODE_AUDIT_EDIT_PERMISSION },
-    bash: { ...OPENCODE_AUDIT_BASH_PERMISSION },
+    edit: ordered(OPENCODE_AUDIT_EDIT_PERMISSION),
+    bash: ordered(OPENCODE_AUDIT_BASH_PERMISSION),
   };
 }
 
@@ -175,21 +205,18 @@ function mergeOpenCodeGlobalConfig(existing) {
       ...(parsed.command && typeof parsed.command === 'object' && !Array.isArray(parsed.command)
         ? parsed.command
         : {}),
-      'audit-code': {
-        template: OPENCODE_MCP_COMMAND_TEMPLATE,
-        description: 'Autonomous local loop code auditing',
-        agent: 'auditor',
-        subtask: false,
-      },
+      // The command ENTRY comes from the plan; only the template is this tool's
+      // (an MCP-server invocation rather than the prompt body).
+      [TOOL]: planOpenCodeCommand(PLAN, OPENCODE_MCP_COMMAND_TEMPLATE),
     },
     permission: mergeOpenCodeGlobalPermissionConfig(parsed.permission, auditPermission),
     agent: {
       ...(parsed.agent && typeof parsed.agent === 'object' && !Array.isArray(parsed.agent)
         ? parsed.agent
         : {}),
-      auditor: {
+      [PLAN.agentName]: {
         ...existingAuditor,
-        description: 'Read-heavy audit orchestration agent for the /audit-code workflow.',
+        description: PLAN.agentDescription,
         permission: {
           ...mergeOpenCodeAgentPermissionConfig(existingAuditor.permission, auditPermission),
           'auditor_*': 'allow',
@@ -201,57 +228,31 @@ function mergeOpenCodeGlobalConfig(existing) {
   };
 }
 
-function claudePluginExternalDir() {
-  return join(homedir(), '.claude', 'plugins', 'marketplaces', 'claude-plugins-official', 'external_plugins', 'audit-code');
-}
-
-const promptSource = readRequiredSource(promptSourceFile, 'prompt', TOOL);
-const skillSource = readRequiredSource(skillSourceFile, 'skill', TOOL);
+const promptSource = readRequiredSource(SOURCES.prompt, 'prompt', TOOL);
+const skillSource = readRequiredSource(SOURCES.skill, 'skill', TOOL);
 
 if (!promptSource || !skillSource) {
   process.exit(0);
 }
 
-const codexOpenAiAgentSource = readOptionalSource(codexOpenAiAgentSourceFile, 'Codex skill UI metadata', TOOL);
+const codexOpenAiAgentSource = readOptionalSource(SOURCES.codexUiMetadata, 'Codex skill UI metadata', TOOL);
 
 const postinstallStart = Date.now();
 const counts = { succeeded: 0, failed: 0 };
 
-const installs = [
-  {
-    label: 'Claude command',
-    path: join(homedir(), '.claude', 'commands', 'audit-code.md'),
-    sourcePath: promptSourceFile,
-    content: promptSource,
-  },
-  {
-    label: 'Codex skill',
-    path: join(homedir(), '.codex', 'skills', 'audit-code', 'SKILL.md'),
-    sourcePath: skillSourceFile,
-    content: skillSource,
-  },
-  {
-    label: 'Codex prompt',
-    path: join(homedir(), '.codex', 'skills', 'audit-code', 'audit-code.prompt.md'),
-    sourcePath: promptSourceFile,
-    content: promptSource,
-  },
-  ...(codexOpenAiAgentSource
-    ? [
-        {
-          label: 'Codex skill UI metadata',
-          path: join(homedir(), '.codex', 'skills', 'audit-code', 'agents', 'openai.yaml'),
-          sourcePath: codexOpenAiAgentSourceFile,
-          content: codexOpenAiAgentSource,
-        },
-      ]
-    : []),
-];
-
-runInstalls(TOOL, installs, counts);
+runInstalls(
+  TOOL,
+  planInstalls(PLAN, {
+    promptContent: promptSource,
+    skillContent: skillSource,
+    // readOptionalSource yields null when absent; the plan omits the target then.
+    codexUiMetadataContent: codexOpenAiAgentSource ?? undefined,
+  }),
+  counts,
+);
 
 // Install OpenCode global command and MCP via merged config
-const opencodeGlobalConfig = join(homedir(), '.config', 'opencode', 'opencode.json');
+const opencodeGlobalConfig = planOpenCodeConfigPath();
 installOpenCodeGlobalConfig(
   {
     toolName: TOOL,
@@ -272,51 +273,35 @@ installAntigravityPlugin(
   {
     toolName: TOOL,
     homeDir: homedir(),
-    pluginName: 'audit-code',
-    pluginVersion: '1.0.0',
+    pluginName: TOOL,
+    pluginVersion: PLAN.pluginVersion === 'packageVersion' ? packageVersion : PLAN.pluginVersion,
     skillSource,
   },
   counts,
 );
 
 // Install Claude Desktop plugin so /audit-code appears in the slash-command menu
-// Claude Desktop reads external plugins from ~/.claude/plugins/marketplaces/claude-plugins-official/external_plugins/
-const claudePluginDir = claudePluginExternalDir();
-const claudePluginManifestPath = join(claudePluginDir, '.claude-plugin', 'plugin.json');
-const claudePluginCommandPath = join(claudePluginDir, 'commands', 'audit-code.md');
-const claudePluginSkillPath = join(claudePluginDir, 'skills', 'audit-code', 'SKILL.md');
-try {
-  const manifest = {
-    name: 'audit-code',
-    description: 'Autonomous local-loop code auditing workflow',
-    version: packageVersion,
-    author: {
-      name: 'audit-tools',
-      url: 'https://github.com/OhOkThisIsFine/audit-tools',
+installClaudeDesktopPlugin(
+  {
+    toolName: TOOL,
+    pluginDir: planClaudePluginDir(PLAN),
+    manifest: {
+      name: TOOL,
+      description: 'Autonomous local-loop code auditing workflow',
+      version: packageVersion,
+      author: {
+        name: 'audit-tools',
+        url: 'https://github.com/OhOkThisIsFine/audit-tools',
+      },
+      homepage: 'https://github.com/OhOkThisIsFine/audit-tools',
+      repository: 'https://github.com/OhOkThisIsFine/audit-tools',
+      license: 'MIT',
+      keywords: ['audit', 'code-audit', 'static-analysis', 'orchestration'],
     },
-    homepage: 'https://github.com/OhOkThisIsFine/audit-tools',
-    repository: 'https://github.com/OhOkThisIsFine/audit-tools',
-    license: 'MIT',
-    keywords: ['audit', 'code-audit', 'static-analysis', 'orchestration'],
-  };
-  const manifestAction = writeGeneratedFile(
-    claudePluginManifestPath,
-    Buffer.from(JSON.stringify(manifest, null, 2) + '\n'),
-  );
-  console.log(`audit-code: ${manifestAction} Claude Desktop plugin manifest at ${claudePluginManifestPath}`);
-
-  const commandAction = writeGeneratedFile(claudePluginCommandPath, promptSource);
-  console.log(`audit-code: ${commandAction} Claude Desktop plugin command at ${claudePluginCommandPath}`);
-
-  const skillAction = writeGeneratedFile(claudePluginSkillPath, skillSource);
-  console.log(`audit-code: ${skillAction} Claude Desktop plugin skill at ${claudePluginSkillPath}`);
-
-  console.log(`audit-code: restart Claude Desktop for /audit-code to appear in the slash-command menu`);
-  counts.succeeded++;
-} catch (err) {
-  console.warn(`audit-code: could not install Claude Desktop plugin (${/** @type {any} */ (err).message})`);
-  console.warn(`  Plugin directory: ${claudePluginDir}`);
-  counts.failed++;
-}
+    commandContent: promptSource,
+    skillContent: skillSource,
+  },
+  counts,
+);
 
 finishPostinstall(TOOL, counts, postinstallStart);

package/scripts/remediate/postinstall.mjs

@@ -1,8 +1,17 @@
 #!/usr/bin/env node
+// The remediate-code host-install entry.
+//
+// What this file owns: the REMEDIATE-CODE HALF OF THE PLAN — the OpenCode
+// permission tables (what a remediator may touch, including the retired-rule
+// migration) and the prompt renderer. Everything structural now comes from
+// `scripts/shared/host-asset-plan.mjs`: which hosts are served, what each target
+// path is, which source file feeds it, the command description, the agent name.
+// Before that module existed, this file and its audit twin each carried their own
+// copy of all of it — two installers built around one shared installer, differing
+// only by a tool token, and free to drift the moment either changed.
 import { homedir } from "os";
-import { join, dirname } from "path";
+import { join } from "path";
 import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
 import {
   readRequiredSource,
   readOptionalSource,
@@ -14,24 +23,19 @@ import {
   installAntigravityPlugin,
   finishPostinstall,
 } from "../shared/install-host-assets.mjs";
+import {
+  HOST_ASSET_PLANS,
+  PKG_ROOT,
+  planInstalls,
+  planOpenCodeCommand,
+  planOpenCodeConfigPath,
+  planSources,
+} from "../shared/host-asset-plan.mjs";
 
 const TOOL = "remediate-code";
-const pkgRoot = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
-const packageVersion = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf8')).version ?? '0.0.0';
-const promptSourceFile = join(
-  pkgRoot,
-  "skills",
-  "remediate-code",
-  "remediate-code.prompt.md",
-);
-const skillSourceFile = join(pkgRoot, "skills", "remediate-code", "SKILL.md");
-const codexOpenAiAgentSourceFile = join(
-  pkgRoot,
-  "skills",
-  "remediate-code",
-  "agents",
-  "openai.yaml",
-);
+const PLAN = HOST_ASSET_PLANS[TOOL];
+const SOURCES = planSources(PLAN);
+const packageVersion = JSON.parse(readFileSync(join(PKG_ROOT, "package.json"), "utf8")).version ?? "0.0.0";
 
 const OPENCODE_REMEDIATE_EDIT_PERMISSION = {
   "*": "ask",
@@ -177,28 +181,22 @@ function mergeOpenCodeGlobalConfig(existing, promptBody) {
     ...parsed,
     command: {
       ...objectValue(parsed.command),
-      "remediate-code": {
-        template: promptBody.trimStart(),
-        description: "Conversation-first code remediation",
-        agent: "remediator",
-        subtask: false,
-      },
+      [TOOL]: planOpenCodeCommand(PLAN, promptBody),
     },
     permission: renderOpenCodeGlobalPermissionConfig(parsed.permission),
     agent: {
       ...agent,
-      remediator: {
+      [PLAN.agentName]: {
         ...existingRemediator,
-        description:
-          "Bounded remediation orchestration agent for the /remediate-code workflow.",
+        description: PLAN.agentDescription,
         permission: renderOpenCodeAgentPermissionConfig(existingRemediator.permission),
       },
     },
   };
 }
 
-const promptSource = readRequiredSource(promptSourceFile, "prompt", TOOL);
-const skillSource = readRequiredSource(skillSourceFile, "skill", TOOL);
+const promptSource = readRequiredSource(SOURCES.prompt, "prompt", TOOL);
+const skillSource = readRequiredSource(SOURCES.skill, "skill", TOOL);
 
 if (!promptSource || !skillSource) {
   process.exit(0);
@@ -209,63 +207,25 @@ const counts = { succeeded: 0, failed: 0 };
 
 const promptBody = splitFrontmatter(promptSource.toString("utf8")).body;
 const codexOpenAiAgentSource = readOptionalSource(
-  codexOpenAiAgentSourceFile,
+  SOURCES.codexUiMetadata,
   "Codex skill UI metadata",
   TOOL,
 );
 
-const installs = [
-  {
-    label: "Claude command",
-    path: join(homedir(), ".claude", "commands", "remediate-code.md"),
-    sourcePath: promptSourceFile,
-    content: Buffer.from(promptBody, "utf8"),
-  },
-  {
-    label: "Codex skill",
-    path: join(homedir(), ".codex", "skills", "remediate-code", "SKILL.md"),
-    sourcePath: skillSourceFile,
-    content: skillSource,
-  },
-  {
-    label: "Codex prompt",
-    path: join(
-      homedir(),
-      ".codex",
-      "skills",
-      "remediate-code",
-      "remediate-code.prompt.md",
-    ),
-    sourcePath: promptSourceFile,
-    content: promptSource,
-  },
-  ...(codexOpenAiAgentSource
-    ? [
-        {
-          label: "Codex skill UI metadata",
-          path: join(
-            homedir(),
-            ".codex",
-            "skills",
-            "remediate-code",
-            "agents",
-            "openai.yaml",
-          ),
-          sourcePath: codexOpenAiAgentSourceFile,
-          content: codexOpenAiAgentSource,
-        },
-      ]
-    : []),
-];
-
-runInstalls(TOOL, installs, counts);
-
-const opencodeGlobalConfig = join(
-  homedir(),
-  ".config",
-  "opencode",
-  "opencode.json",
+runInstalls(
+  TOOL,
+  planInstalls(PLAN, {
+    // This tool installs the prompt's BODY as the Claude command (the frontmatter
+    // is host metadata); the plan's stripFrontmatter flag says which of the two
+    // is the command content.
+    promptContent: PLAN.stripFrontmatter ? Buffer.from(promptBody, "utf8") : promptSource,
+    skillContent: skillSource,
+    codexUiMetadataContent: codexOpenAiAgentSource ?? undefined,
+  }),
+  counts,
 );
+
+const opencodeGlobalConfig = planOpenCodeConfigPath();
 installOpenCodeGlobalConfig(
   {
     toolName: TOOL,
@@ -282,8 +242,8 @@ installAntigravityPlugin(
   {
     toolName: TOOL,
     homeDir: homedir(),
-    pluginName: "remediate-code",
-    pluginVersion: packageVersion,
+    pluginName: TOOL,
+    pluginVersion: PLAN.pluginVersion === "packageVersion" ? packageVersion : PLAN.pluginVersion,
     skillSource,
   },
   counts,