auditor-lambda 0.3.12 → 0.3.13

package/README.md

@@ -30,7 +30,7 @@ npm install -g auditor-lambda
 
 That makes `audit-code` available on `PATH`. During package install, the package
 also writes user-level command/skill assets for hosts we can seed safely, including
-the Claude command file and Codex skill bundle.
+the Claude command file and global Codex skill bundle.
 
 After that, invoke `/audit-code` in a supported host. The prompt self-bootstraps
 the current repository by running:
@@ -51,7 +51,7 @@ audit-code install
 
 That bootstraps repo-local `/audit-code` surfaces for the hosts we can automate today, including:
 
-- Codex skill bundle, `AGENTS.md` guidance, and MCP setup notes
+- Codex `AGENTS.md` fallback guidance for the global skill surface
 - Claude Desktop local MCP bundle artifacts and project template guidance
 - OpenCode command, skill, and `opencode.json` surfaces
 - VS Code prompt, custom agent, Copilot instructions, and `.vscode/mcp.json`

package/audit-code-wrapper-lib.mjs

@@ -398,6 +398,23 @@ async function writeGeneratedMarkdown(targetPath, content) {
   };
 }
 
+async function removeGeneratedMarkdownIfMatches(targetPath, expectedContent) {
+  const existing = await readTextIfExists(targetPath);
+  if (existing === null) {
+    return null;
+  }
+
+  if (normalizeNewlines(existing) !== normalizeNewlines(expectedContent)) {
+    return null;
+  }
+
+  await unlink(targetPath);
+  return {
+    path: targetPath,
+    mode: 'removed',
+  };
+}
+
 async function writeGeneratedJson(targetPath, value) {
   const existed = await fileExists(targetPath);
   await mkdir(dirname(targetPath), { recursive: true });
@@ -1021,22 +1038,20 @@ const INSTALL_HOST_DEFINITIONS = {
     host: 'codex',
     label: 'Codex',
     support_level: 'supported',
-    setup_kind: 'skills+mcp+instructions',
+    setup_kind: 'global-skill+instructions',
     summary:
-      'Use the generated Codex skill bundle, AGENTS instructions, and shared MCP launcher so Codex can drive the backend through native tools instead of raw shell commands.',
-    primary_path_key: 'codexSkillPath',
+      'Use the global Codex skill installed by npm plus AGENTS fallback instructions for this repository. Repo-local Codex skill bundles are intentionally not generated.',
+    primary_path_key: 'agentsInstructionsPath',
     supporting_path_keys: [
-      'agentsInstructionsPath',
-      'codexMcpSetupPath',
-      'codexAutomationRecipePath',
+      'installedPromptPath',
+      'mcpLauncherPath',
     ],
     steps: [
       'Open this repository in Codex.',
-      'Ensure Codex can access the repo-local auditor MCP server using the generated setup guide.',
-      'Ask Codex to use the auditor MCP tools to start or continue `/audit-code`.',
+      'Use the global `/audit-code` skill installed by `npm install -g auditor-lambda`.',
+      'If the global skill is unavailable, follow the AGENTS fallback instructions that point at the repo-local prompt asset.',
     ],
     profile: {
-      writeCodex: true,
       writeAgents: true,
     },
   },
@@ -1685,43 +1700,14 @@ async function verifyInstalledBootstrap(argv) {
 
     switch (hostKey) {
       case 'codex':
-        await collectVerifyCheck(checks, 'codex_skill', async () => {
-          const content = await readFile(assetPaths.codexSkillPath, 'utf8');
-          if (!content.includes('# audit-code skill')) {
-            throw new Error(`Codex skill file is missing the expected heading: ${assetPaths.codexSkillPath}`);
-          }
-          const sourceSkill = (await readFile(skillAssetPath, 'utf8')).replace(/\r\n/g, '\n');
-          if (content.replace(/\r\n/g, '\n') !== sourceSkill) {
-            throw new Error(
-              `Codex skill is out of sync with the source skill. Run "audit-code install --host codex" or "audit-code install".`,
-            );
+        await collectVerifyCheck(checks, 'codex_global_surface', async () => {
+          const content = await readFile(assetPaths.agentsInstructionsPath, 'utf8');
+          if (!content.includes('/audit-code')) {
+            throw new Error(`AGENTS instructions do not reference /audit-code: ${assetPaths.agentsInstructionsPath}`);
           }
           return {
-            summary: 'Codex skill bundle is present and matches the source skill.',
-            path: assetPaths.codexSkillPath,
-          };
-        });
-        await collectVerifyCheck(checks, 'codex_prompt', async () => {
-          const content = await readFile(assetPaths.codexPromptPath, 'utf8');
-          const sourcePrompt = await readFile(promptAssetPath, 'utf8');
-          if (content !== sourcePrompt) {
-            throw new Error(
-              `Codex prompt is out of sync with the source prompt. Run "audit-code install --host codex" or "audit-code install".`,
-            );
-          }
-          return {
-            summary: 'Codex prompt bundle is present and matches the source prompt.',
-            path: assetPaths.codexPromptPath,
-          };
-        });
-        await collectVerifyCheck(checks, 'codex_mcp_setup', async () => {
-          const content = await readFile(assetPaths.codexMcpSetupPath, 'utf8');
-          if (!content.includes(MCP_LAUNCHER_FILENAME)) {
-            throw new Error(`Codex MCP setup guide does not reference ${MCP_LAUNCHER_FILENAME}.`);
-          }
-          return {
-            summary: 'Codex MCP setup guide references the shared launcher.',
-            path: assetPaths.codexMcpSetupPath,
+            summary: 'Codex uses the global skill surface with AGENTS fallback instructions.',
+            path: assetPaths.agentsInstructionsPath,
           };
         });
         break;
@@ -1989,6 +1975,10 @@ async function detectBootstrapRefreshReason(root, host) {
     (installManifest.hosts ?? []).map((entry) => entry.host),
   );
 
+  if (hostCatalog.has('codex') && (assetPaths.codexSkillPath || assetPaths.codexPromptPath)) {
+    return 'legacy_repo_local_codex_skill';
+  }
+
   for (const hostKey of getInstallHostKeys(host)) {
     if (!hostCatalog.has(hostKey)) {
       return `missing_host_surface:${hostKey}`;
@@ -2029,14 +2019,6 @@ async function detectBootstrapRefreshReason(root, host) {
   for (const hostKey of getInstallHostKeys(host)) {
     switch (hostKey) {
       case 'codex': {
-        const codexSkill = await readTextIfExists(assetPaths.codexSkillPath);
-        if (codexSkill?.replace(/\r\n/g, '\n') !== sourceSkill) {
-          return 'stale_host_asset:codex:skill';
-        }
-        const codexPrompt = await readTextIfExists(assetPaths.codexPromptPath);
-        if (codexPrompt !== sourcePrompt) {
-          return 'stale_host_asset:codex:prompt';
-        }
         break;
       }
       case 'opencode': {
@@ -2240,6 +2222,23 @@ async function installBootstrap(argv, options = {}) {
     );
   }
 
+  if (!profile.writeCodex) {
+    const legacyCodexSkillRemoval = await removeGeneratedMarkdownIfMatches(
+      join(root, '.codex', 'skills', 'audit-code', 'SKILL.md'),
+      skillSource,
+    );
+    if (legacyCodexSkillRemoval) {
+      results.push(legacyCodexSkillRemoval);
+    }
+    const legacyCodexPromptRemoval = await removeGeneratedMarkdownIfMatches(
+      join(root, '.codex', 'skills', 'audit-code', 'audit-code.prompt.md'),
+      promptSource,
+    );
+    if (legacyCodexPromptRemoval) {
+      results.push(legacyCodexPromptRemoval);
+    }
+  }
+
   if (profile.writeCodex) {
     results.push(
       await writeGeneratedMarkdown(

package/dist/cli.js

@@ -792,7 +792,7 @@ async function cmdRunToCompletion(argv) {
             });
             const blockRunId = buildRunId(obligationId, runCount + 1);
             const blockPaths = getRunPaths(artifactsDir, blockRunId);
-            const blockPendingTasks = await addFileLineCountHints(root, buildPendingAuditTasks(bundle).slice(0, agentBatchSize));
+            const blockPendingTasks = await addFileLineCountHints(root, buildPendingAuditTasks(bundle));
             const blockPendingTasksPath = join(blockPaths.runDir, "pending-audit-tasks.json");
             const blockAuditResultsPath = join(blockPaths.runDir, "audit-results.json");
             const blockTask = {
@@ -1193,7 +1193,7 @@ async function cmdRunToCompletion(argv) {
             continue;
         }
         const pendingAuditTasks = preferredExecutor === "agent"
-            ? await addFileLineCountHints(root, buildPendingAuditTasks(bundle).slice(0, agentBatchSize))
+            ? await addFileLineCountHints(root, buildPendingAuditTasks(bundle))
             : undefined;
         const pendingAuditTasksPath = preferredExecutor === "agent"
             ? join(paths.runDir, "pending-audit-tasks.json")

package/docs/agent-integrations.md

@@ -78,15 +78,16 @@ Use `/audit-code` in conversation, treat the active conversation model as the de
 
 The global npm install seeds `~/.codex/skills/audit-code/` so the command can be
 available before a repository is bootstrapped. The first `/audit-code` run then
-uses `audit-code ensure --quiet` to create or refresh repo-local Codex support.
+uses `audit-code ensure --quiet` to create or refresh only repo-local fallback
+instructions and shared launcher assets.
 
 Use `audit-code install --host codex` only when you want to repair or force-refresh
-the Codex repo-local files from the target repository root.
+the Codex fallback files from the target repository root.
 
-That writes a repo-local Codex skill bundle, updates `AGENTS.md` through a managed block when needed, and emits Codex-specific MCP setup guidance plus an automation recipe in `.audit-code/install/codex/`.
-The intended operator flow is still conversational first, with the generated skill and AGENTS guidance steering the active Codex session toward `/audit-code` and the MCP-backed workflow.
-
-The Codex automation recipe should still be treated as optional follow-through after the basic local flow is validated in the real app.
+That updates `AGENTS.md` through a managed fallback block when needed. It does
+not write a repo-local Codex skill bundle, so Codex should expose only the
+global `/audit-code` command surface.
+The intended operator flow is still conversational first, with the global skill and AGENTS guidance steering the active Codex session toward `/audit-code` and the MCP-backed workflow.
 
 ### Claude Desktop
 

package/docs/bootstrap-install.md

@@ -8,7 +8,7 @@ npm install -g auditor-lambda
 
 That makes the `audit-code` command available from any repository. Package
 install also seeds user-level command or skill assets for hosts we can update
-safely, including the Claude command file and Codex skill bundle.
+safely, including the Claude command file and global Codex skill bundle.
 
 After that, the normal user flow is to invoke `/audit-code` in a supported host.
 The prompt starts by running:
@@ -55,10 +55,7 @@ Installed shared surfaces:
 Installed host-specific surfaces:
 
 - Codex:
-  - `.codex/skills/audit-code/*`
-  - `AGENTS.md` managed block when needed
-  - `.audit-code/install/codex/MCP-SETUP.md`
-  - `.audit-code/install/codex/RE-AUDIT-AUTOMATION.md`
+  - `AGENTS.md` managed fallback block when needed
 - Claude Desktop:
   - `.audit-code/install/claude-desktop/PROJECT-TEMPLATE.md`
   - `.audit-code/install/claude-desktop/remote-mcp-connector.json`
@@ -99,11 +96,11 @@ without supplying extra root paths, provider flags, or model-selection arguments
 ## What is fully automated today
 
 - global `npm install -g auditor-lambda` seeds user-level Claude command and
-  Codex skill assets when filesystem permissions allow it
+  global Codex skill assets when filesystem permissions allow it
 - `/audit-code` runs `audit-code ensure --quiet` before advancing the audit
 - shared installer output, manifest generation, and repo-local MCP launcher generation
 - default backend fallback session-config creation when no config exists yet
-- Codex skill-bundle and AGENTS-oriented install output
+- Codex global-skill and AGENTS-oriented install output
 - OpenCode command, skill, prompt, and config generation
 - VS Code prompt, custom-agent, instruction, and MCP config generation
 - Claude Desktop project-template, remote-connector, and local bundle generation

package/docs/next-steps.md

@@ -24,7 +24,7 @@ The repository now supports:
 - repo-local MCP resources for current artifacts, operator handoff, install guidance, and the current audit report
 - repo-local MCP prompts for `audit-code`, `review-task`, and `synthesize-report`
 - generated `.audit-code/install/manifest.json` plus a shared repo-local MCP launcher script
-- Codex install assets including a repo skill bundle, `AGENTS.md` support, MCP setup guidance, and an automation recipe
+- Codex global skill assets plus `AGENTS.md` fallback support
 - Claude Desktop install assets including a project template, remote connector template, and generated local bundle artifacts
 - OpenCode install assets including command, skill, prompt, and `opencode.json` support
 - VS Code install assets including prompt file, Copilot instructions, custom agent, and `.vscode/mcp.json`
@@ -66,7 +66,7 @@ The biggest remaining gap is not raw feature presence anymore. It is host-by-hos
 
 Near-term work should focus on:
 
-- verifying the Codex skill bundle, `AGENTS.md`, MCP setup guidance, and automation recipe against the real Codex app flow
+- verifying the global Codex skill bundle and `AGENTS.md` fallback guidance against the real Codex app flow
 - installing and smoke-testing the generated Claude Desktop `DXT` or bundle output in a real Desktop environment
 - validating that the OpenCode `opencode.json` shape, command file, and MCP config match current OpenCode behavior
 - validating the VS Code prompt, agent, and `.vscode/mcp.json` flow inside a real workspace

package/docs/packaging.md

@@ -22,7 +22,7 @@ That means the package needs to ship:
 - packet-dispatch support data such as `dispatch/lens-definitions.json`
 - the backend fallback wrapper exposed as `audit-code`
 - user-level postinstall assets for hosts we can safely seed from a global npm
-  install, currently the Claude command and Codex skill bundle
+  install, currently the Claude command and global Codex skill bundle
 - `audit-code ensure`, so a globally installed slash command can lazily create
   the repo-local host assets it needs in each target repository
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditor-lambda",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "private": false,
   "description": "Portable hybrid code-auditing framework for arbitrary repositories.",
   "type": "module",

package/skills/audit-code/SKILL.md

@@ -20,6 +20,9 @@ Normal usage should:
 Semantic review should be delegated to bounded subagents whenever the host can
 dispatch them. The conversation orchestrator owns dispatch and ingestion control;
 it should not perform broad review itself when subagents are available.
+Entering `/audit-code` is explicit user authorization to fan out those review
+subagents; do not require a separate delegation request before parallel
+dispatch.
 
 If the host cannot delegate to subagents, the conversation orchestrator may
 complete exactly one assigned review task, ingest it through the provided backend
@@ -52,9 +55,10 @@ current repository before advancing the audit:
 audit-code ensure --quiet
 ```
 
-That idempotent bootstrap writes repo-local host assets for Codex, Claude Desktop,
-OpenCode, VS Code, and Antigravity plus shared MCP setup guidance only when they
-are missing or stale.
+That idempotent bootstrap writes repo-local fallback/guidance assets for
+supported hosts plus shared MCP setup guidance only when they are missing or
+stale. Codex uses the global skill installed by npm rather than a repo-local
+skill bundle.
 
 Use the explicit installer for repair or forced refresh:
 

package/skills/audit-code/audit-code.prompt.md

@@ -28,6 +28,9 @@ and ingest results mechanically.
 - CRITICAL: Do not use your `Read` tool to read `entry.prompt_path` or JSON schemas into your own context window. The subagent will read them. Pass the path literally.
 - Prefer subagent dispatch for semantic review whenever the host exposes an
   Agent/subagent tool.
+- Treat the user's `/audit-code` request as explicit authorization to launch
+  review subagents in parallel. Do not ask for a separate delegation request
+  before using available Agent/subagent tools.
 - Do not use `browser_subagent` for semantic review of source code unless the
   task explicitly requires browser-based validation.
 - If the host cannot dispatch subagents, complete exactly one assigned review
@@ -83,7 +86,7 @@ If status is `"blocked"` for semantic review, continue to Step 2.
 
 ## Step 2 - Dispatch Review Work
 
-When the host supports subagents, prepare a dispatch plan:
+When the host supports subagents, prepare a dispatch plan by default:
 
 ```bash
 audit-code prepare-dispatch --run-id <run_id> --artifacts-dir <artifacts_dir>