auriga-cli 1.30.0 → 1.30.2

package/README.md

@@ -136,7 +136,7 @@ npx -y auriga-cli install plugins --agent codex --plugin session-instructions-lo
 | claude-md-management | Claude Code / Codex | Audit and improve AGENTS.md / CLAUDE.md |
 | playground | Claude Code / Codex | Build interactive HTML playgrounds |
 | codex | Claude Code | Codex cross-model collaboration |
-| auriga-workflow | Claude Code / Codex | The auriga workflow plugin — workflow skills plus the git lifecycle hooks that enforce them. Skills: `incremental-impl`, `test-designer`, `spec-design`, `arch-design`, `code-simplify`, `session-compound`, `goalify` (plans an autonomous goal and dispatches it via the built-in `/goal` command), `deep-review` (multi-dimensional PR review orchestrator — parallel per-dimension reviewers synthesized into an actionable punch list), `reviewer-creator` (scaffolds project-level custom reviewers under `docs/rules/review/`), `git-workflow` (git lifecycle skill), and `documentation-and-adrs` (architecture decision records and project documentation discipline — ADRs archived under `docs/architecture/`). Hooks: `commit-reminder` (PostToolUse on file edits — `Edit` / `Write` / `MultiEdit` in Claude Code, `apply_patch` in Codex — nudges to commit at the next semantic boundary when uncommitted diff vs `HEAD` exceeds 200 lines or 8 files), `pr-create-guard` (PostToolUse on `gh pr create` → injects a PR-body snapshot for five-element self-verification and flags non-Conventional-Commits titles), `pr-ready-guard` (PreToolUse on `gh pr ready` and non-draft `gh pr create` → blocks on stray planning docs, unfinalized active specs under `docs/specs/`, or unpushed commits), and `pr-merge-guard` (PreToolUse on `gh pr merge` → blocks while the PR body's Acceptance criteria section still has unchecked checklist items). The two PostToolUse hooks reach full Claude Code / Codex parity; Codex currently fails open on `pr-ready-guard`'s PreToolUse `additionalContext` informational path (block path identical). Installed by default through the plugin path. |
+| auriga-workflow | Claude Code / Codex | The auriga workflow plugin — workflow skills plus the git lifecycle hooks that enforce them. Skills: `incremental-impl`, `test-designer`, `spec-design`, `arch-design`, `code-simplify`, `session-compound`, `goalify` (plans an autonomous goal and dispatches it via the built-in `/goal` command), `deep-review` (multi-dimensional PR review orchestrator — parallel per-dimension reviewers synthesized into an actionable punch list), `reviewer-creator` (scaffolds project-level custom reviewers under `docs/rules/review/`), `git-workflow` (git lifecycle skill), and `documentation-and-adrs` (architecture decision records and project documentation discipline — ADRs archived under `docs/architecture/`). Hooks: `commit-reminder` (PostToolUse on file edits — `Edit` / `Write` / `MultiEdit` in Claude Code, `apply_patch` in Codex — nudges to commit at the next semantic boundary when uncommitted diff vs `HEAD` exceeds 200 lines or 8 files), `pr-create-guard` (PostToolUse on `gh pr create` → injects a PR-body snapshot for five-element self-verification and flags non-Conventional-Commits titles), `pr-ready-guard` (PreToolUse on `gh pr ready` and non-draft `gh pr create` → blocks on stray planning docs, unfinalized active specs under `docs/specs/`, or unpushed commits), and `pr-merge-guard` (PreToolUse on `gh pr merge` → blocks while the PR body's Acceptance criteria or Test plan section still has unchecked checklist items). The two PostToolUse hooks reach full Claude Code / Codex parity; Codex currently fails open on `pr-ready-guard`'s PreToolUse `additionalContext` informational path (block path identical). Installed by default through the plugin path. |
 | auriga-notify *(opt-in)* | Claude Code | macOS native notification plugin for Claude Code `Notification` events. Focus-aware sound-only mode, click-to-activate, per-project notification grouping, and migrated `config.json` / `icon.png` support. Not installed by `install --all`; install explicitly with `install plugins --plugin auriga-notify`. |
 | session-instructions-loader | Codex | Codex-only SessionStart plugin that injects ancestor `AGENTS.md` files plus repo-configured extra instruction files. |
 

package/README.zh-CN.md

@@ -136,7 +136,7 @@ npx -y auriga-cli install plugins --agent codex --plugin session-instructions-lo
 | claude-md-management | Claude Code / Codex | 审计和改进 AGENTS.md / CLAUDE.md |
 | playground | Claude Code / Codex | 构建交互式 HTML playground |
 | codex | Claude Code | Codex 跨模型协作 |
-| auriga-workflow | Claude Code / Codex | auriga 工作流插件 —— 工作流 skill 加上强制执行工作流的 git 生命周期 hook。Skills：`incremental-impl`、`test-designer`、`spec-design`、`arch-design`、`code-simplify`、`session-compound`、`goalify`（plan 出自驱 goal 并通过内置 `/goal` 命令分发执行）、`deep-review`（多维度 PR review 编排器——并行派发各维度 reviewer，汇总成可执行的 punch list）、`reviewer-creator`（在 `docs/rules/review/` 下生成项目级自定义 reviewer）、`git-workflow`（git 生命周期 skill）、`documentation-and-adrs`（架构决策记录与项目文档规范，ADR 归档到 `docs/architecture/`）。Hooks：`commit-reminder`（文件编辑的 PostToolUse —— Claude Code 匹配 `Edit` / `Write` / `MultiEdit`，Codex 匹配 `apply_patch` —— 未提交 diff 对比 `HEAD` 超过 200 行或 8 个文件时，提醒在下一个语义边界 commit）、`pr-create-guard`（`gh pr create` 的 PostToolUse —— 注入 PR body 快照供五要素自检，并对不符合 Conventional Commits 的标题提示）、`pr-ready-guard`（`gh pr ready` 与非 draft `gh pr create` 的 PreToolUse —— 拦截游离规划文档、`docs/specs/` 内未结案的活跃 spec、未 push commits）、`pr-merge-guard`（`gh pr merge` 的 PreToolUse —— PR body 的验收标准章节仍有未勾选清单项时拦截合并）。两个 PostToolUse hook 在 Claude Code / Codex 上完全对齐；Codex 仅对 `pr-ready-guard` 的 PreToolUse `additionalContext` 信息路径 fail-open（block 路径两边一致）。默认通过插件路径安装。 |
+| auriga-workflow | Claude Code / Codex | auriga 工作流插件 —— 工作流 skill 加上强制执行工作流的 git 生命周期 hook。Skills：`incremental-impl`、`test-designer`、`spec-design`、`arch-design`、`code-simplify`、`session-compound`、`goalify`（plan 出自驱 goal 并通过内置 `/goal` 命令分发执行）、`deep-review`（多维度 PR review 编排器——并行派发各维度 reviewer，汇总成可执行的 punch list）、`reviewer-creator`（在 `docs/rules/review/` 下生成项目级自定义 reviewer）、`git-workflow`（git 生命周期 skill）、`documentation-and-adrs`（架构决策记录与项目文档规范，ADR 归档到 `docs/architecture/`）。Hooks：`commit-reminder`（文件编辑的 PostToolUse —— Claude Code 匹配 `Edit` / `Write` / `MultiEdit`，Codex 匹配 `apply_patch` —— 未提交 diff 对比 `HEAD` 超过 200 行或 8 个文件时，提醒在下一个语义边界 commit）、`pr-create-guard`（`gh pr create` 的 PostToolUse —— 注入 PR body 快照供五要素自检，并对不符合 Conventional Commits 的标题提示）、`pr-ready-guard`（`gh pr ready` 与非 draft `gh pr create` 的 PreToolUse —— 拦截游离规划文档、`docs/specs/` 内未结案的活跃 spec、未 push commits）、`pr-merge-guard`（`gh pr merge` 的 PreToolUse —— PR body 的验收标准或测试计划章节仍有未勾选清单项时拦截合并）。两个 PostToolUse hook 在 Claude Code / Codex 上完全对齐；Codex 仅对 `pr-ready-guard` 的 PreToolUse `additionalContext` 信息路径 fail-open（block 路径两边一致）。默认通过插件路径安装。 |
 | auriga-notify *(opt-in)* | Claude Code | Claude Code `Notification` 事件的 macOS 原生通知插件。支持焦点感知仅提示音、点击唤起终端、按项目分组通知，并迁移旧 `config.json` / `icon.png`。不随 `install --all` 默认安装，需要显式执行 `install plugins --plugin auriga-notify`。 |
 | session-instructions-loader | Codex | Codex-only SessionStart 插件，注入上层目录的 `AGENTS.md` 和仓库配置的额外 instruction 文件。 |
 

package/dist/catalog.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-05-19T07:23:20.929Z",
+  "generatedAt": "2026-05-21T07:29:20.581Z",
   "workflowSkills": [
     {
       "name": "planning-with-files",

package/dist/plugins.js

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { checkbox, select } from "@inquirer/prompts";
 import { parse as parseToml } from "smol-toml";
-import { codexManifestPath, validateCodexMarketplace, } from "./codex-plugin-config.js";
+import { validateCodexMarketplace, } from "./codex-plugin-config.js";
 import { validateMarketplaceField } from "./marketplace.js";
 import { atomicWriteFile, exec, execAsync, log, withEsc } from "./utils.js";
 // Plugin names and plugin-package names end up in `claude plugins ...`
@@ -467,12 +467,15 @@ function codexSupportsPluginAdd() {
     }
 }
 // `--enable plugins` turns on the global Codex plugins feature; `--enable
-// plugin_hooks` is appended only for plugins that ship hooks. We pass the
-// feature flags explicitly rather than relying on `codex plugin add` to
-// flip them — both flags are idempotent, so re-passing them across
-// multiple `add` calls is harmless. The plugin key (`<name>@<marketplace>`)
-// is validated upstream (PLUGIN_NAME_RE / MARKETPLACE_NAME_RE), so no
-// shell metacharacter can reach this interpolated command.
+// plugin_hooks` turns on the global plugin-hooks feature. Both are plain
+// Codex feature toggles (`-c features.<name>=true`), not per-plugin state —
+// `plugin_hooks` is appended for first-party plugins, which ship hooks, and
+// is harmless for any that don't (the feature simply has no hooks to run).
+// We do not inspect plugin payload to decide this: Codex owns plugin
+// content via `codex plugin add`, and the published CLI never fetches the
+// payload anyway. The plugin key (`<name>@<marketplace>`) is validated
+// upstream (PLUGIN_NAME_RE / MARKETPLACE_NAME_RE), so no shell
+// metacharacter can reach this interpolated command.
 function codexPluginAddCommand(pluginKey, hasHooks) {
     const enable = hasHooks
         ? "--enable plugins --enable plugin_hooks"
@@ -524,16 +527,6 @@ function readCodexMarketplaceSource(marketplaceName) {
 function isCodexMarketplaceDifferentSource(error) {
     return /already added from a different source/i.test(commandErrorText(error));
 }
-function pluginHasHooks(packageRoot, plugin) {
-    const relativeManifestPath = codexManifestPath(plugin);
-    if (!relativeManifestPath)
-        return false;
-    const manifestPath = path.join(packageRoot, relativeManifestPath);
-    if (!fs.existsSync(manifestPath))
-        return false;
-    const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
-    return typeof manifest.hooks === "string" || Array.isArray(manifest.hooks);
-}
 function resolveSelectedCodexMarketplacePlugins(localMarketplace, localSelected) {
     const localMpByName = new Map(localMarketplace.plugins.map((p) => [p.name, p]));
     return localSelected.map((p) => {
@@ -544,17 +537,6 @@ function resolveSelectedCodexMarketplacePlugins(localMarketplace, localSelected)
         return plugin;
     });
 }
-function ensureCodexPluginManifests(packageRoot, plugins) {
-    for (const plugin of plugins) {
-        const manifestPath = codexManifestPath(plugin);
-        if (!manifestPath) {
-            throw new Error(`Codex marketplace.json: plugin ${plugin.name} must use a local source.path`);
-        }
-        if (fs.existsSync(path.join(packageRoot, manifestPath)))
-            continue;
-        throw new Error(`Codex plugin ${plugin.name} manifest missing at ${manifestPath}`);
-    }
-}
 async function addCodexMarketplaceWithRetry(marketplaceName, addCommand, expectedSource, opts, marketplaceExecOpts, failures) {
     const registeredSource = readCodexMarketplaceSource(marketplaceName);
     if (registeredSource !== null) {
@@ -599,20 +581,22 @@ async function addCodexMarketplaceWithRetry(marketplaceName, addCommand, expecte
     }
 }
 // Builds the `codex plugin add` work list: one entry per selected plugin.
-// Local plugins resolve their hooks flag from this repo's manifest;
-// external plugins emit a key straight from extra_plugin_configs.json
-// (Codex CLI fetches the upstream manifest itself) and never set
-// `hasHooks` — we don't have their manifest at install time. Acceptable
-// while no external plugin ships hooks; once one does, prefer fetching the
-// manifest or adding an explicit flag to the extra config entry.
-function composeCodexPluginAdds(pluginContentRoot, localMarketplace, selectedMarketplacePlugins, externalSelected) {
+// Local (first-party) plugins always enable `plugin_hooks` — they ship
+// hooks, and the flag is a harmless global toggle for any that don't. We
+// deliberately do not inspect plugin payload to decide this: Codex owns
+// plugin content via `codex plugin add`, and the published CLI never
+// fetches the payload. External plugins emit a key straight from
+// extra_plugin_configs.json (Codex CLI fetches the upstream manifest
+// itself) and never set `hasHooks` — acceptable while no external plugin
+// ships hooks; once one does, add an explicit flag to the extra config entry.
+function composeCodexPluginAdds(localMarketplace, selectedMarketplacePlugins, externalSelected) {
     const adds = [];
     if (localMarketplace) {
         for (const plugin of selectedMarketplacePlugins) {
             adds.push({
                 key: `${plugin.name}@${localMarketplace.name}`,
                 name: plugin.name,
-                hasHooks: pluginHasHooks(pluginContentRoot, plugin),
+                hasHooks: true,
             });
         }
     }
@@ -708,16 +692,14 @@ async function installCodexPlugins(packageRoot, opts) {
         await addCodexMarketplaceWithRetry(mp.name, codexExternalMarketplaceAddCommand(mp.source), codexExternalMarketplaceSource(mp.source), opts, marketplaceExecOpts, failures);
     }
     if (failures.length === 0) {
-        // Hooks detection reads this repo's manifest directly: local plugins
-        // listed in .agents/plugins/marketplace.json are sourced from this
-        // repo, so packageRoot is the authoritative manifest location. The
-        // plugin payload itself is materialized by `codex plugin add` from the
-        // marketplace snapshot registered above — no manual cache copy.
+        // The plugin payload is materialized by `codex plugin add` from the
+        // marketplace snapshot registered above — no manual cache copy, and no
+        // local manifest inspection. A plugin missing from the snapshot surfaces
+        // as a `codex plugin add` failure, already caught and aggregated below.
         const selectedMarketplacePlugins = localMarketplace
             ? resolveSelectedCodexMarketplacePlugins(localMarketplace, localSelected)
             : [];
-        ensureCodexPluginManifests(packageRoot, selectedMarketplacePlugins);
-        const pluginAdds = composeCodexPluginAdds(packageRoot, localMarketplace, selectedMarketplacePlugins, externalSelected);
+        const pluginAdds = composeCodexPluginAdds(localMarketplace, selectedMarketplacePlugins, externalSelected);
         for (const entry of pluginAdds) {
             try {
                 exec(codexPluginAddCommand(entry.key, entry.hasHooks), marketplaceExecOpts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auriga-cli",
-  "version": "1.30.0",
+  "version": "1.30.2",
   "description": "Interactive CLI to install Claude Code harness modules (Workflow, Skills, Recommended Skills, Plugins)",
   "license": "MIT",
   "repository": {