claude-dev-env 7.6.1 → 7.7.0

package/bin/install.mjs

@@ -30,13 +30,17 @@ import {
     MANAGED_HOOKS_DIRECTORY_NAME,
     MANAGED_SCRIPTS_DIRECTORY_NAME,
     SETTINGS_FILE_NAME,
+    CODEX_HOME_ENVIRONMENT_VARIABLE,
+    DEFAULT_CODEX_DIRECTORY_NAME,
     CODEX_RULES_PACKAGE_DIRECTORY_NAME,
     CURSOR_SYNC_SCRIPT_FILE_NAME,
     CURSOR_RULES_DIRECTORY_NAME,
     PSTACK_MODEL_RULE_FILE_NAME,
+    SUBAGENT_MODEL_POLICY_FILE_NAME,
     PSTACK_SEEDED_MODEL_PREFERENCES_FILE_NAMES,
     WINDOWS_PYTHON_LAUNCHER_COMMAND,
     PYTHON_PROBE_TIMEOUT_MILLISECONDS,
+    CODEX_NATIVE_ROUTING_MATCHER,
 } from './install-constants.mjs';
 import {
     PSTACK_PLUGIN_DIRECTORY_NAME,
@@ -514,6 +518,20 @@ function seedPstackPreferences(preferenceFileName) {
     }
 }
 
+function seedSubagentModelPolicy() {
+    const policyDirectory = join(AGENTS_HOME, CURSOR_RULES_DIRECTORY_NAME);
+    const policyPath = join(policyDirectory, SUBAGENT_MODEL_POLICY_FILE_NAME);
+    const policySource = join(PACKAGE_ROOT, 'rules', SUBAGENT_MODEL_POLICY_FILE_NAME);
+    mkdirSync(policyDirectory, { recursive: true });
+    try {
+        copyFileSync(policySource, policyPath, filesystemConstants.COPYFILE_EXCL);
+        return policyPath;
+    } catch (copyError) {
+        if (copyError.code === 'EEXIST') return null;
+        throw copyError;
+    }
+}
+
 /**
  * Registers the session-continuity companion in each host configuration this
  * install root resolves. Without this step the companion ships to the agents
@@ -1215,22 +1233,11 @@ function renameCaseOnlyMatchToShippedName(destinationFilePath, entryNamesByDirec
     existingEntryNames[existingEntryNames.indexOf(caseOnlyMatchName)] = shippedFileName;
 }
 
-/**
- * Copy every file under a source directory into a destination directory,
- * reporting what the run created and what it updated.
- *
- * A destination entry whose name differs from the shipped name only in letter
- * case is renamed to the shipped name before the copy, so the tree carries the
- * spelling the package ships. The directory listing behind that decision is read
- * once per destination directory and reused for every file the run copies there.
- *
- * @param {string} sourceBase The absolute source directory to copy from.
- * @param {string} destBase The absolute destination directory to copy into.
- * @param {{isCaseInsensitive?: boolean}} options Whether name comparison folds letter case; defaults to this host's filesystem.
- * @returns {{created: number, updated: number, paths: string[]}} The counts and the destination paths written.
- */
 export function copyTree(sourceBase, destBase, options = {}) {
-    const files = collectFiles(sourceBase);
+    const excludedFileNames = new Set(options.excludeFileNames ?? []);
+    const files = collectFiles(sourceBase).filter(
+        sourceFile => !excludedFileNames.has(basename(sourceFile)),
+    );
     const stats = { created: 0, updated: 0, paths: [] };
     const entryNamesByDirectory = new Map();
     for (const sourceFile of files) {
@@ -1274,15 +1281,6 @@ function backupHubBeforeOverwrite(destPath, incomingPath, backupName) {
     return backupPath;
 }
 
-/**
- * Hook script paths the installer manages even though hooks.json
- * carries no standalone entry for them. Most were folded into the PreToolUse
- * dispatcher in Stage 1; retired hooks have no current registration.
- * Each path stays in this set so a reinstall from an older settings shape
- * prunes its standalone entry — a folded hook would otherwise double-run
- * alongside the dispatcher, and a retired hook's entry would continue to run
- * from the user's settings.json.
- */
 export const FOLDED_HOOK_RELATIVE_PATHS = new Set([
     'blocking/write_existing_file_blocker.py',
     'blocking/sensitive_file_protector.py',
@@ -1358,25 +1356,18 @@ export const RETIRED_HOOK_REGISTRATION_RELATIVE_PATHS = new Set([
     'blocking/session_handoff_blocker.py',
 ]);
 
-/**
- * Builds the set of hook script paths this installer manages, each relative to
- * the hooks directory (e.g. 'blocking/code_rules_enforcer.py'), parsed from the
- * `${CLAUDE_PLUGIN_ROOT}/hooks/<path>` references in hooks.json. Inline
- * `python3 -c` commands reference the hooks directory without a script tail and
- * contribute nothing. Also includes every path from FOLDED_HOOK_RELATIVE_PATHS
- * and the retained path sets so a reinstall from an older settings shape prunes
- * folded and retired entries.
- *
- * @param {{hooks: object}} hooksConfig Parsed hooks.json.
- * @returns {Set<string>} Forward-slash relative script paths under hooks/.
- */
+export const MOVED_HOOK_RELATIVE_PATHS = new Set([
+    'blocking/subagent_model_routing.mjs',
+]);
+
 export function managedHookScriptRelativePaths(hooksConfig) {
     const relativePaths = new Set([
         ...FOLDED_HOOK_RELATIVE_PATHS,
         ...POST_FOLDED_HOOK_RELATIVE_PATHS,
         ...RETIRED_HOOK_REGISTRATION_RELATIVE_PATHS,
+        ...MOVED_HOOK_RELATIVE_PATHS,
     ]);
-    const scriptReferencePattern = /\$\{CLAUDE_PLUGIN_ROOT\}\/hooks\/(\S+?\.py)/g;
+    const scriptReferencePattern = /\$\{CLAUDE_PLUGIN_ROOT\}\/hooks\/(\S+?\.(?:py|mjs))/g;
     for (const matcherGroups of Object.values(hooksConfig.hooks)) {
         for (const sourceGroup of matcherGroups) {
             for (const hook of sourceGroup.hooks) {
@@ -1457,19 +1448,16 @@ export function commandReferencesManagedHook(commandString, managedHookRelativeP
     return false;
 }
 
-/**
- * Reports whether a command contains the `/.claude/hooks/<relative>` tail ending
- * at a path boundary: end of string, or an argument separator (whitespace, quote,
- * or semicolon). Anchoring the tail keeps a user hook whose path is the managed
- * tail plus a suffix (`code_rules_enforcer.py.bak`, `a.py/extra/thing.py`) outside
- * the managed set, so it is never pruned.
- *
- * @param {string} normalizedCommand Forward-slash-normalized hook command.
- * @param {string} relativePath Managed script path under hooks/.
- * @returns {boolean} True when the managed tail ends at a path boundary.
- */
 function commandTailEndsAtManagedHook(normalizedCommand, relativePath) {
-    return commandHoldsPathAtBoundary(normalizedCommand, `/.claude/hooks/${relativePath}`);
+    if (commandHoldsPathAtBoundary(normalizedCommand, `/.claude/hooks/${relativePath}`)) {
+        return true;
+    }
+    return MANAGED_HOOK_ROOT_PATHS.some(eachHooksRoot => (
+        commandHoldsPathAtBoundary(
+            normalizedCommand,
+            `${eachHooksRoot.replace(/\\/g, '/')}/${relativePath}`,
+        )
+    ));
 }
 
 /**
@@ -2160,16 +2148,7 @@ function reportRetiredHookStandIns(allHookRootPaths, standInPaths) {
 }
 
 
-/**
- * Load ~/.claude/settings.json for an in-place merge, or `{}` when absent/empty.
- *
- * Malformed JSON or a non-object root ends the process so install never writes
- * onto a shape the harness cannot read.
- *
- * @param {string} settingsPath Absolute path to settings.json.
- * @returns {object}
- */
-function loadClaudeSettingsObjectOrExit(settingsPath) {
+function loadClaudeSettingsObject(settingsPath) {
     if (!existsSync(settingsPath)) {
         return {};
     }
@@ -2181,42 +2160,67 @@ function loadClaudeSettingsObjectOrExit(settingsPath) {
     try {
         settings = JSON.parse(raw);
     } catch {
-        console.error('  ERROR: settings.json is malformed JSON. Fix it and rerun.');
-        process.exit(1);
+        throw new Error('settings.json is malformed JSON. Fix it and rerun.');
     }
     if (!settings || typeof settings !== 'object' || Array.isArray(settings)) {
-        console.error('  ERROR: settings.json holds a value other than a JSON object. Fix it and rerun.');
-        process.exit(1);
+        throw new Error('settings.json holds a value other than a JSON object. Fix it and rerun.');
     }
     return settings;
 }
 
-/**
- * Merge one package source root's hook groups into ~/.claude/settings.json.
- *
- * A settings file holding anything other than a JSON object ends the install with
- * a message naming the file, so the run stops before it writes hook entries onto
- * a shape the harness cannot read.
- *
- * @param {string} hooksSourceRoot The package root whose hooks/hooks.json is merged.
- * @param {string} pythonCommand Interpreter command that replaces python3.
- * @returns {number} Count of matcher groups merged.
- */
-function mergeHooks(hooksSourceRoot, pythonCommand) {
+function mergeHooksAtPath(
+    hooksSourceRoot,
+    settingsPath,
+    indentation,
+    pythonCommand,
+    selectHooksConfig = hooksConfig => hooksConfig,
+    pluginRootDir = CLAUDE_HOME,
+) {
     const hooksSource = resolvePackageManagedDirectory(
         hooksSourceRoot,
         MANAGED_HOOKS_DIRECTORY_NAME,
     );
     const hooksJsonPath = join(hooksSource, 'hooks.json');
     if (!existsSync(hooksJsonPath)) return 0;
-    const hooksConfig = JSON.parse(readFileSync(hooksJsonPath, 'utf8'));
-    const settingsPath = join(CLAUDE_HOME, SETTINGS_FILE_NAME);
-    const settings = loadClaudeSettingsObjectOrExit(settingsPath);
-    const groupCount = mergeHooksIntoSettings(settings, hooksConfig, CLAUDE_HOME, pythonCommand);
-    writeFileSync(settingsPath, JSON.stringify(settings, null, 4) + '\n');
+    const hooksConfig = selectHooksConfig(JSON.parse(readFileSync(hooksJsonPath, 'utf8')));
+    const settings = loadClaudeSettingsObject(settingsPath);
+    const groupCount = mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, pythonCommand);
+    writeFileSync(settingsPath, JSON.stringify(settings, null, indentation) + '\n');
     return groupCount;
 }
 
+function selectCodexNativeHooksConfig(hooksConfig) {
+    const preToolUseGroups = hooksConfig.hooks?.PreToolUse;
+    return {
+        ...hooksConfig,
+        hooks: {
+            PreToolUse: Array.isArray(preToolUseGroups)
+                ? preToolUseGroups.filter(group => group?.matcher === CODEX_NATIVE_ROUTING_MATCHER)
+                : [],
+        },
+    };
+}
+
+function mergeHooks(hooksSourceRoot, pythonCommand) {
+    return mergeHooksAtPath(
+        hooksSourceRoot,
+        join(CLAUDE_HOME, SETTINGS_FILE_NAME),
+        4,
+        pythonCommand,
+    );
+}
+
+function mergeCodexHooks(hooksSourceRoot, pythonCommand) {
+    return mergeHooksAtPath(
+        hooksSourceRoot,
+        CODEX_HOOKS_CONFIGURATION_PATH,
+        2,
+        pythonCommand,
+        selectCodexNativeHooksConfig,
+        dirname(CODEX_HOOKS_CONFIGURATION_PATH),
+    );
+}
+
 function writeManifest(installedFiles, skillNames, managedPermissions = null) {
     const manifest = buildTargetManifestRecord({
         packageName: PACKAGE_NAME,
@@ -2296,7 +2300,7 @@ function mergeManagedPermissions() {
     }
     const settingsPath = join(CLAUDE_HOME, SETTINGS_FILE_NAME);
     const settingsExisted = existsSync(settingsPath);
-    const settings = loadClaudeSettingsObjectOrExit(settingsPath);
+    const settings = loadClaudeSettingsObject(settingsPath);
     const pruneOutcome = pruneManagedPermissionsFromSettings(settings, allRetiredManagedDenyEntries);
     const mergeOutcome = hasCurrentManagedDenyEntries
         ? mergeManagedPermissionsIntoSettings(settings, allCurrentManagedDenyEntries)
@@ -2598,6 +2602,7 @@ function executeInstallPlan(plan) {
         managedRoot: CLAUDE_HOME,
         manifestFilePath: MANIFEST_FILE,
         settingsPath: plan.settingsPath,
+        additionalSettingsPaths: [CODEX_HOOKS_CONFIGURATION_PATH],
         priorManifestFiles: plan.priorManifest.files,
         journalParentDirectory: join(CLAUDE_HOME, TRANSACTION_JOURNAL_DIRECTORY_NAME),
     });
@@ -2706,7 +2711,9 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
             if (!existsSync(sourceDir)) continue;
             const destDir = join(CLAUDE_HOME, directory);
             if (hasFullAccess) {
-                const stats = copyTree(sourceDir, destDir);
+                const stats = copyTree(sourceDir, destDir, directory === 'rules'
+                    ? { excludeFileNames: [SUBAGENT_MODEL_POLICY_FILE_NAME] }
+                    : {});
                 if (!summary[directory]) {
                     summary[directory] = stats;
                 } else {
@@ -2720,7 +2727,7 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
                 let rulesUpdated = 0;
                 for (const ruleFile of allowedRules) {
                     const sourcePath = join(sourceDir, ruleFile);
-                    if (!existsSync(sourcePath)) continue;
+                    if (!existsSync(sourcePath) || ruleFile === SUBAGENT_MODEL_POLICY_FILE_NAME) continue;
                     const destPath = join(destDir, ruleFile);
                     mkdirSync(dirname(destPath), { recursive: true });
                     const existed = existsSync(destPath);
@@ -2818,6 +2825,11 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
                 allUserOwnedPreferencePaths.add(seededPreferencePath);
             }
         }
+        const seededPolicyPath = seedSubagentModelPolicy();
+        if (seededPolicyPath) {
+            allInstalledFiles.push(seededPolicyPath);
+            allUserOwnedPreferencePaths.add(seededPolicyPath);
+        }
         syncWrittenPaths(allInstalledFiles);
     }
     let skillsCreated = 0;
@@ -2866,6 +2878,7 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
         let totalHooksCreated = 0;
         let totalHooksUpdated = 0;
         let totalHookGroups = 0;
+        let totalCodexHookGroups = 0;
         for (const sourceRoot of allSourceRoots) {
             const hooksSource = resolvePackageManagedDirectory(
                 sourceRoot,
@@ -2891,11 +2904,13 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
             }
             const groupCount = mergeHooks(sourceRoot, pythonCommand);
             totalHookGroups += groupCount;
+            totalCodexHookGroups += mergeCodexHooks(sourceRoot, pythonCommand);
         }
         summary.hookFiles = { created: totalHooksCreated, updated: totalHooksUpdated };
         console.log(`  Hook files: ${totalHooksCreated} new, ${totalHooksUpdated} updated`);
         summary.hookGroups = totalHookGroups;
-        console.log(`  Hook groups: ${totalHookGroups} merged into settings.json`);
+        summary.codexHookGroups = totalCodexHookGroups;
+        console.log(`  Hook groups: ${totalHookGroups} merged into settings.json, ${totalCodexHookGroups} merged into hooks.json`);
         syncWrittenPaths([...allInstalledFiles, ...publishedPointerPaths]);
         throwIfFault(FAULT_PHASES.AFTER_SETTINGS_WRITE);
 
@@ -3157,15 +3172,40 @@ function resolveUninstallPlan(isManifestRequired) {
     });
 }
 
-/**
- * Apply one preflighted uninstall plan: remove removable files, prune managed
- * hooks from settings, unset core.hooksPath when it points here, then drop the
- * ownership manifest. Fault phases mirror the install transaction names.
- *
- * @param {ReturnType<typeof buildUninstallPlan>} plan
- * @param {{ throwIfFault?: (phase: string) => void }} [helpers]
- * @returns {number} Count of files this call removed.
- */
+function pruneManagedHooksFromHostConfiguration(settingsPath, defaultIndentation) {
+    if (!existsSync(settingsPath)) return false;
+    let settingsText;
+    let settings;
+    try {
+        settingsText = readFileSync(settingsPath, 'utf8');
+        settings = JSON.parse(settingsText);
+    } catch (readError) {
+        throw new Error(`host hook configuration is malformed JSON: ${readError.message}`);
+    }
+    if (!settings || typeof settings !== 'object' || Array.isArray(settings)) {
+        throw new Error('host hook configuration must hold a JSON object');
+    }
+    if (!settings.hooks || typeof settings.hooks !== 'object') return false;
+    const managedHookRelativePaths = managedHookScriptRelativePathsFromSourceRoots(
+        managedPackageSourceRoots(),
+    );
+    pruneManagedHooksFromSettings(settings, managedHookRelativePaths);
+    writeFileSync(
+        settingsPath,
+        JSON.stringify(settings, null, hostConfigurationIndent(settingsText) || defaultIndentation) + '\n',
+    );
+    console.log(`  Hook entries removed from ${basename(settingsPath)}`);
+    return true;
+}
+
+function codexRoutingHookExists() {
+    return existsSync(join(
+        INSTALL_ROOT_RESOLUTION.codexHooksInstallDirectory,
+        'routing',
+        'subagent_model_routing.mjs',
+    ));
+}
+
 function executeUninstallPlan(plan, helpers = {}) {
     const throwIfFault = helpers.throwIfFault || (() => {});
     let removed = 0;
@@ -3225,6 +3265,9 @@ function executeUninstallPlan(plan, helpers = {}) {
             writeFileSync(plan.settingsPath, JSON.stringify(settings, null, 4) + '\n');
         }
     }
+    if (!codexRoutingHookExists()) {
+        pruneManagedHooksFromHostConfiguration(CODEX_HOOKS_CONFIGURATION_PATH, 2);
+    }
     removeSessionContinuityHooksFromOtherHosts();
     throwIfFault(FAULT_PHASES.AFTER_SETTINGS_WRITE);
 
@@ -3300,6 +3343,7 @@ function uninstall() {
         managedRoot: CLAUDE_HOME,
         manifestFilePath: MANIFEST_FILE,
         settingsPath: plan.settingsPath,
+        additionalSettingsPaths: [CODEX_HOOKS_CONFIGURATION_PATH],
         priorManifestFiles: plan.removableFiles,
         journalParentDirectory: join(CLAUDE_HOME, TRANSACTION_JOURNAL_DIRECTORY_NAME),
     });
@@ -3447,7 +3491,9 @@ function loadDirectoryNameByProfileId() {
 function runInstallForAllTargets(allTargets, childArgv) {
     if (allTargets.length === 1) {
         const onlyTarget = allTargets[0];
-        if (onlyTarget.managedRoot !== CLAUDE_HOME || onlyTarget.targetIdentity !== INSTALL_TARGET_IDENTITY) {
+        if (onlyTarget.managedRoot !== CLAUDE_HOME
+            || onlyTarget.targetIdentity !== INSTALL_TARGET_IDENTITY
+            || !isDefaultClaudeTarget(onlyTarget)) {
             const childStatus = spawnInstallChild(onlyTarget, childArgv);
             process.exit(childStatus);
         }
@@ -3474,6 +3520,13 @@ function runInstallForAllTargets(allTargets, childArgv) {
  * @returns {number | null}
  */
 function spawnInstallChild(target, childArgv) {
+    const childEnvironment = { ...process.env };
+    if (!isDefaultClaudeTarget(target)) {
+        childEnvironment[CODEX_HOME_ENVIRONMENT_VARIABLE] = join(
+            target.managedRoot,
+            DEFAULT_CODEX_DIRECTORY_NAME,
+        );
+    }
     const childProcess = spawnSync(
         process.execPath,
         [
@@ -3486,7 +3539,7 @@ function spawnInstallChild(target, childArgv) {
         ],
         {
             stdio: 'inherit',
-            env: process.env,
+            env: childEnvironment,
         },
     );
     if (childProcess.error) {
@@ -3496,6 +3549,10 @@ function spawnInstallChild(target, childArgv) {
     return childProcess.status === null ? 1 : childProcess.status;
 }
 
+function isDefaultClaudeTarget(target) {
+    return resolve(target.managedRoot) === resolve(join(homedir(), '.claude'));
+}
+
 if (invokedAsEntryPoint(import.meta.url, process.argv[1])) {
     const rawArgs = process.argv.slice(2);
     if (rawArgs.includes('--help') || rawArgs.includes('-h')) {
@@ -3541,6 +3598,10 @@ if (invokedAsEntryPoint(import.meta.url, process.argv[1])) {
             || (
                 targetSelection.mode === 'profiles'
                 && allTargets[0].targetIdentity !== INSTALL_TARGET_IDENTITY
+            )
+            || (
+                targetSelection.mode !== 'child-identity'
+                && !isDefaultClaudeTarget(allTargets[0])
             );
 
         if (needsChildHop && !args.includes('--uninstall')) {

package/bin/install.transaction.test.mjs

@@ -134,6 +134,44 @@ test('capture and restore recover settings, manifest, files, and hooksPath', ()
     rmSync(box.root, { recursive: true, force: true });
 });
 
+test('capture and restore recover an additional host settings file', () => {
+    const box = sandbox();
+    const gitConfigPath = join(box.root, '.gitconfig');
+    const codexHooksPath = join(box.root, '.codex', 'hooks.json');
+    writeFileSync(gitConfigPath, '');
+    writeFileWithParents(box.settingsPath, '{"host":"claude"}\n');
+    writeFileWithParents(codexHooksPath, '{"host":"codex"}\n');
+    const io = {
+        env: {
+            ...process.env,
+            CDE_INSTALL_PSTACK: '0',
+            HOME: box.root,
+            USERPROFILE: box.root,
+            GIT_CONFIG_GLOBAL: gitConfigPath,
+        },
+        execFileSync,
+    };
+
+    const snapshot = capturePriorInstallSnapshot({
+        managedRoot: box.managedRoot,
+        manifestFilePath: box.manifestFilePath,
+        settingsPath: box.settingsPath,
+        additionalSettingsPaths: [codexHooksPath],
+        priorManifestFiles: [],
+        journalParentDirectory: box.journalParent,
+        io,
+    });
+    writeFileSync(box.settingsPath, '{"host":"changed"}\n');
+    writeFileSync(codexHooksPath, '{"host":"changed"}\n');
+
+    restorePriorInstallSnapshot(snapshot, { io });
+
+    assert.equal(readFileSync(box.settingsPath, 'utf8'), '{"host":"claude"}\n');
+    assert.equal(readFileSync(codexHooksPath, 'utf8'), '{"host":"codex"}\n');
+    discardInstallTransactionJournal(snapshot);
+    rmSync(box.root, { recursive: true, force: true });
+});
+
 test('runWithInstallTransaction restores prior state on injected fault', () => {
     const box = sandbox();
     const gitConfigPath = join(box.root, '.gitconfig');
@@ -312,12 +350,16 @@ test('installer fault after_settings_write restores prior settings and files', (
     try {
         const { claudeDirectory, rulesFile } = seedPriorInstall(homeDirectory);
         const priorSettings = readFileSync(join(claudeDirectory, 'settings.json'), 'utf8');
+        const codexHooksPath = join(homeDirectory, '.codex', 'hooks.json');
+        writeFileWithParents(codexHooksPath, '{"hooks":{"PreToolUse":[{"matcher":"custom"}]}}\n');
+        const priorCodexHooks = readFileSync(codexHooksPath, 'utf8');
 
         const failedRun = runInstaller(homeDirectory, [], {
             faultPhase: FAULT_PHASES.AFTER_SETTINGS_WRITE,
         });
         assert.notEqual(failedRun.status, 0, failedRun.stdout + failedRun.stderr);
         assert.equal(readFileSync(join(claudeDirectory, 'settings.json'), 'utf8'), priorSettings);
+        assert.equal(readFileSync(codexHooksPath, 'utf8'), priorCodexHooks);
         assert.equal(readFileSync(rulesFile, 'utf8'), 'prior-body\n');
         assert.match(
             readFileSync(join(claudeDirectory, '.claude-dev-env-manifest.json'), 'utf8'),
@@ -328,6 +370,25 @@ test('installer fault after_settings_write restores prior settings and files', (
     }
 });
 
+test('installer fault after_settings_write removes a newly created Codex hooks file', () => {
+    const homeDirectory = mkdtempSync(join(tmpdir(), 'cdev-txn-e2e-absent-codex-hooks-'));
+    try {
+        const { claudeDirectory } = seedPriorInstall(homeDirectory);
+        const codexHooksPath = join(homeDirectory, '.codex', 'hooks.json');
+        const failedRun = runInstaller(homeDirectory, [], {
+            faultPhase: FAULT_PHASES.AFTER_SETTINGS_WRITE,
+        });
+        assert.notEqual(failedRun.status, 0, failedRun.stdout + failedRun.stderr);
+        assert.equal(existsSync(codexHooksPath), false);
+        assert.equal(
+            existsSync(join(claudeDirectory, '.claude-dev-env-manifest.json')),
+            true,
+        );
+    } finally {
+        rmSync(homeDirectory, { recursive: true, force: true });
+    }
+});
+
 test('installer fault after_manifest_write restores prior manifest', () => {
     const homeDirectory = mkdtempSync(join(tmpdir(), 'cdev-txn-e2e-manifest-'));
     try {
@@ -404,4 +465,3 @@ test('successful install after prior install leaves one manifest and no fault',
         rmSync(homeDirectory, { recursive: true, force: true });
     }
 });
-

package/bin/pstack-model-preferences.codex.json

@@ -1,5 +1,6 @@
 {
     "host": "codex",
+    "defaultEffort": "medium",
     "modelsByRole": {
         "feature, refactoring": ["gpt-5.6-sol"],
         "bug-fix": ["gpt-5.6-sol"],

package/bin/pstack.mjs

@@ -67,6 +67,9 @@ function adapterFiles(root) {
         ...['common.md', ...hosts.map(host => `host-${host}.md`), 'create-skill.md'].map(name => [name, join(adapters, name)]),
         ...['pstack-host-mapping.md', 'pstack-models.md'].map(name => [name, join(root, 'rules', name)]),
         ['select_pstack_models.mjs', join(root, 'scripts', 'select_pstack_models.mjs')],
+        ['subagent_model_policy.mjs', join(root, 'scripts', 'subagent_model_policy.mjs')],
+        ['resolve_advisor_model_route.mjs', join(root, 'scripts', 'resolve_advisor_model_route.mjs')],
+        ['subagent-model-policy.json', join(root, 'rules', 'subagent-model-policy.json')],
     ].map(([name, path]) => [name, readFileSync(path, 'utf8')]));
 }
 
@@ -141,7 +144,7 @@ export function prepareRelease(checkout, stage, finalRoot, lock, adapters) {
     const fileDigests = Object.fromEntries(filesUnder(stage).map(path => [relative(stage, path), digest(readFileSync(path))]));
     const managedRoot = dirname(dirname(dirname(finalRoot)));
     const agentsRoot = basename(managedRoot) === '.claude' ? join(dirname(managedRoot), '.agents') : managedRoot + '.agents';
-    const release = { preferencesDirectory: join(agentsRoot, 'rules'), selectorPath: join(finalRoot, 'compat', 'select_pstack_models.mjs'), schemaVersion: 1, commit: lock.commit, adapterVersion: lock.adapterVersion, skills, agents, fileDigests, verification: 'filesystem-only' };
+    const release = { preferencesDirectory: join(agentsRoot, 'rules'), policyPath: join(agentsRoot, 'rules', 'subagent-model-policy.json'), selectorPath: join(finalRoot, 'compat', 'select_pstack_models.mjs'), schemaVersion: 1, commit: lock.commit, adapterVersion: lock.adapterVersion, skills, agents, fileDigests, verification: 'filesystem-only' };
     writeFileSync(join(stage, 'release.json'), json(release));
     return release;
 }
@@ -171,7 +174,7 @@ export function verifyRelease(root) {
 function layout(options) {
     const root = resolve(options.root ?? (options.project ? join(options.project, '.claude') : process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude')));
     const agents = basename(root) === '.claude' ? join(dirname(root), '.agents') : root + '.agents';
-    return { root, store: join(root, 'pstack'), skillHomes: [join(root, 'skills'), join(agents, 'skills')] };
+    return { root, agents, store: join(root, 'pstack'), skillHomes: [join(root, 'skills'), join(agents, 'skills')] };
 }
 
 function loadState(store) {
@@ -224,6 +227,19 @@ function publish(releaseRoot, release, homes, prior) {
     return { links, restore };
 }
 
+function seedPolicy(releaseRoot, release, agentsRoot) {
+    const policyPath = join(agentsRoot, 'rules', 'subagent-model-policy.json');
+    if (typeof release.policyPath !== 'string') throw new Error('Invalid release policy path');
+    if (resolve(release.policyPath) !== resolve(policyPath)) throw new Error('Invalid release policy path');
+    mkdirSync(dirname(policyPath), { recursive: true });
+    if (entryExists(policyPath)) {
+        if (!lstatSync(policyPath).isFile()) throw new Error(`Keep existing unmanaged policy path: ${policyPath}`);
+        return () => {};
+    }
+    writeFileSync(policyPath, readFileSync(join(releaseRoot, 'compat', 'subagent-model-policy.json')), { flag: 'wx' });
+    return () => { if (entryExists(policyPath)) unlinkSync(policyPath); };
+}
+
 function liveLeases(store) {
     const root = join(store, 'sessions');
     if (!existsSync(root)) return false;
@@ -247,7 +263,7 @@ function readCentralLock(temporaryRoot) {
 }
 
 export function installPstack(options = {}, dependencies = {}) {
-    const { store, skillHomes } = layout(options);
+    const { agents, store, skillHomes } = layout(options);
     mkdirSync(store, { recursive: true });
     const lockDirectory = join(store, '.install-lock');
     mkdirSync(lockDirectory);
@@ -291,12 +307,18 @@ export function installPstack(options = {}, dependencies = {}) {
             renameSync(stage, releaseRoot);
         }
         const release = verifyRelease(releaseRoot);
-        const publication = publish(releaseRoot, release, skillHomes, prior);
-        const state = { release: id, commit: lock.commit, adapterVersion: lock.adapterVersion, adapterDigest, checkedAt, lock, links: publication.links };
+        const policyPublication = seedPolicy(releaseRoot, release, agents);
+        let publication;
         try {
+            publication = publish(releaseRoot, release, skillHomes, prior);
+            const state = { release: id, commit: lock.commit, adapterVersion: lock.adapterVersion, adapterDigest, checkedAt, lock, links: publication.links };
             writeFileSync(join(store, 'installed.next.json'), json(state));
             renameSync(join(store, 'installed.next.json'), join(store, 'installed.json'));
-        } catch (error) { publication.restore(); throw error; }
+        } catch (error) {
+            publication?.restore();
+            policyPublication();
+            throw error;
+        }
         return finish({ ...verifyInstallation(options), status: prior?.release === id ? 'unchanged' : 'installed' });
     } catch (error) {
         if (!options.strict) {