cli-five 0.2.16 → 0.2.18

package/README.md

@@ -156,13 +156,51 @@ Optional integrations live outside the default scaffold and are installed with `
 
 ```bash
 npx cli-five add            # list known targets
-npx cli-five add codegraph  # stub in this release
+npx cli-five add codegraph  # CodeGraph MCP registration + AGENTS.md instructions
+npx cli-five add jev        # tier-routing tool for the Planner (OpenCode only)
 npx cli-five list-addons    # installed vs. available status
 ```
 
-This release ships the **dispatcher and merge utility** only — no integration is wired in yet. Jev and the CodeGraph migration are future commits.
+Add-ons use `mergeBlock(file, markerFence, content)` to layer a fenced block into an existing JSON or Markdown file without touching the rest of it (distinct from init's blunt overwrite gate). Markdown gets `<!-- NAME_START -->` / `<!-- NAME_END -->` fences; JSON is deep-merged with existing keys preserved. Re-running an add-on is idempotent — no duplicate MCP entries or AGENTS.md sections.
+
+### CodeGraph (`add codegraph`)
+
+`add codegraph` registers the CodeGraph MCP server and adds the CodeGraph section to `AGENTS.md`. It works on **both platforms**:
+
+| Target | MCP registration | Instructions |
+|---|---|---|
+| Copilot | `.vscode/mcp.json` → `servers.codegraph` | `AGENTS.md` block |
+| OpenCode | `opencode.json` → `mcp.codegraph` | `AGENTS.md` block |
+
+**The `init` flags are now thin wrappers.** `init --codegraph` and `init --no-codegraph` still behave exactly as before, but they call the *same* underlying `add codegraph` logic — one implementation, two entry points. CodeGraph remains off by default in minimal `init` and on with `--full-interview`; pass `--codegraph` to force it on, `--no-codegraph` to force it off.
+
+cli-five still does **not** run `codegraph init` itself — it only registers the server and reminds you to index the project:
+
+```bash
+npm i -g @colbymchenry/codegraph
+codegraph init
+```
+
+### Jev (`add jev`) — tier-routing only, OpenCode only
+
+`add jev` scaffolds an OpenCode plugin that adds a `local_tier_heuristic` tool. The Planner calls it once per task to classify the work as `trivial` / `minor` / `major`, then scales planning depth accordingly.
+
+**Two things it deliberately does *not* do, stated plainly:**
+
+1. **It does not call Jev.** `jev-harness` 0.2.0's `route` subcommand exposes no custom-criteria interface — it emits its own fixed tier vocabulary (`deterministic` / `lightweight_system2` / `heavy_system2`) and returns a constant confidence (`0.88`) under its offline/mock engine, so it cannot be thresholded on. The shipped tool is therefore a **local heuristic**, truthfully named `local_tier_heuristic`. The swap point for real Jev wiring is marked in `templates/opencode/plugin/jev-tier-router/index.js` (`JEVR_SWAP_POINT`).
+2. **The test-gate is parked.** Gating Reviewer spawns via plugin interception (`tool.execute.before` / `permission.ask`) does not work: OpenCode plugin hooks do not fire under OpenChamber's embedded-server routing. Do not expect `add jev` to gate anything.
+
+`list-addons` reports each add-on's honest capability rather than a bare "installed":
+
+```
+codegraph   installed (MCP registration + AGENTS.md instructions)   available   MCP registration + AGENTS.md instructions
+jev         installed (tier-routing only)                           available   local heuristic — …; test-gate parked — <issue link>
+```
+
+**Fail-open is non-negotiable.** If the classifier is unavailable, errors, or returns malformed output, the tool returns `available: false` with tier `major` (the expensive tier) and never throws. The Planner falls back to its own judgment. cli-five and the scaffolded agents behave identically whether the plugin works, is missing, or is broken.
+
+**Copilot has no equivalent.** `add jev` refuses cleanly on a Copilot target (exit 1, no files written) — there is no `tools.add`-style surface there.
 
-Add-ons use `mergeBlock(file, markerFence, content)` to layer a fenced block into an existing JSON or Markdown file without touching the rest of it (distinct from init's blunt overwrite gate). Markdown gets `<!-- NAME_START -->` / `<!-- NAME_END -->` fences; JSON is deep-merged with existing keys preserved.
 
 ## Model providers
 
@@ -174,6 +212,8 @@ During `init --full-interview` you can choose the model provider and optionally
 | OpenCode Zen | OpenCode | `opencode/gpt-5.3-codex` |
 | OpenCode Go | OpenCode | `opencode-go/qwen3.8-max` |
 
+**On OpenCode, the default provider is auth-aware.** cli-five checks which provider you are actually authenticated for (`opencode auth list`) and uses it instead of blindly defaulting to OpenCode Zen. If you are authenticated for Go only, `init --target opencode` writes Go models automatically — no `--provider` flag needed. If nothing is detected, or the selected provider does not match your auth, `init` prints a warning telling you how to fix it, so you do not end up with agent files whose models silently fail.
+
 `--yes` uses the provider's defaults. `--provider opencode-go --yes` skips the provider prompt.
 
 ### Copilot cost modes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli-five",
-  "version": "0.2.16",
+  "version": "0.2.18",
   "description": "Code Like I'm Five — scaffold a 5-agent AI team (GitHub Copilot or OpenCode) into any repo.",
   "type": "module",
   "repository": {

package/src/addons/codegraph-command.mjs

@@ -0,0 +1,47 @@
+import kleur from 'kleur';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { log } from '../util/log.mjs';
+import { PLATFORM_COPILOT, PLATFORM_OPENCODE, platformLabel } from '../util/platforms.mjs';
+import { addCodegraphTo, CODEGRAPH_INIT_REMINDER, mcpTargetFor } from './codegraph.mjs';
+
+/**
+ * `add codegraph` — register the CodeGraph MCP server + AGENTS.md section.
+ *
+ * Works on both platforms. Same content and behavior as the previous inline
+ * init implementation; only the invocation path and write mechanism changed
+ * (mergeBlock instead of blunt overwrite).
+ */
+export async function runCodegraph({ cwd, args = {} }) {
+  const platform = detectPlatform(cwd);
+
+  if (platform === 'unknown') {
+    log.err('No cli-five scaffold detected (neither .opencode/agents nor .github/agents).');
+    log.dim('Run `npx cli-five init` first, then `npx cli-five add codegraph`.');
+    process.exitCode = 1;
+    return [];
+  }
+
+  const dryRun = Boolean(args.dryRun);
+  const touched = addCodegraphTo({ cwd, platform, dryRun, track: true });
+
+  for (const t of touched) {
+    const rel = t.path.replace(cwd + '/', '');
+    const symbol = t.action === 'created' || t.action === 'updated' ? '+' : '~';
+    log.raw(`  ${symbol} ${rel} ${kleur.dim(`(${t.action})`)}`);
+  }
+
+  log.ok(`CodeGraph registered for ${platformLabel(platform)}`);
+  log.dim(`MCP: ${mcpTargetFor(platform)} · instructions: AGENTS.md`);
+  log.dim(CODEGRAPH_INIT_REMINDER.replace('CodeGraph is configured. ', ''));
+
+  return touched;
+}
+
+function detectPlatform(cwd) {
+  if (existsSync(join(cwd, '.opencode', 'agents'))) return PLATFORM_OPENCODE;
+  if (existsSync(join(cwd, '.github', 'agents', 'orchestrator.agent.md'))) return PLATFORM_COPILOT;
+  return 'unknown';
+}
+
+export const __testables = { detectPlatform };

package/src/addons/codegraph.mjs

@@ -0,0 +1,124 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { mergeBlock } from '../util/merge.mjs';
+import { PLATFORM_COPILOT, PLATFORM_OPENCODE } from '../util/platforms.mjs';
+
+export const CODEGRAPH_STATUS = 'MCP registration + AGENTS.md instructions';
+export const CODEGRAPH_BLOCK_NAME = 'codegraph';
+export const CODEGRAPH_INIT_REMINDER =
+  'CodeGraph is configured. Remember to run `codegraph init` before asking agents to explore the codebase.';
+
+// The AGENTS.md section is byte-identical to the pre-migration inline constant
+// in scaffold.mjs. Do not change its content — only the write path changed.
+export const CODEGRAPH_BLOCK = `## CodeGraph
+
+This project is configured to use [CodeGraph](https://codegraph.ru) for graph-backed codebase context.
+When you need to understand relationships, call paths, or impacts, use:
+
+\`\`\`
+codegraph explore "<your question>"
+\`\`\`
+
+The CodeGraph MCP server is registered in the project config. Run \`codegraph init\` in this directory
+if the project has not been indexed yet.`;
+
+/**
+ * The CodeGraph MCP server entries, per platform. Unchanged from the previous
+ * inline implementation — same server, same command, same shape.
+ */
+export function codegraphOpencodeConfig() {
+  return {
+    codegraph: {
+      type: 'local',
+      command: ['codegraph', 'serve', '--mcp'],
+      enabled: true,
+    },
+  };
+}
+
+export function codegraphCopilotMcpJson() {
+  return {
+    inputs: [],
+    servers: {
+      codegraph: {
+        command: 'codegraph',
+        args: ['serve', '--mcp'],
+      },
+    },
+  };
+}
+
+/** Which MCP file a given platform owns. Preserves the old per-platform split. */
+export function mcpTargetFor(platform) {
+  return platform === PLATFORM_OPENCODE ? 'opencode.json' : join('.vscode', 'mcp.json');
+}
+
+/**
+ * Register CodeGraph in a workspace, using mergeBlock() for every write.
+ *
+ * Shared by `add codegraph` and init's legacy --codegraph flag — one
+ * implementation, two entry points.
+ *
+ * @returns {Array<{path:string, action:string}>} the files touched.
+ */
+export function addCodegraphTo({ cwd, platform, dryRun = false, track = false }) {
+  const touched = [];
+  const isOpenCode = platform === PLATFORM_OPENCODE;
+
+  // 1. MCP registration.
+  if (isOpenCode) {
+    const opencodePath = join(cwd, 'opencode.json');
+    // Preserve a pre-existing `plugins[]` (e.g. jev): deepMerge replaces arrays,
+    // so carry the existing value through untouched at the root.
+    const existing = readJson(opencodePath) || {};
+    const patch = { mcp: codegraphOpencodeConfig() };
+    if (Array.isArray(existing.plugins)) patch.plugins = existing.plugins;
+    touched.push(mergeBlock(opencodePath, 'codegraph', patch, { dryRun, track }));
+  } else {
+    const mcpPath = join(cwd, '.vscode', 'mcp.json');
+    const existing = readJson(mcpPath) || {};
+    // Preserve the old key order (`inputs` first) so output matches the
+    // pre-migration inline implementation byte-for-byte. `inputs` is an array;
+    // carry it through so deepMerge's array-replace is a no-op.
+    const patch = { inputs: Array.isArray(existing.inputs) ? existing.inputs : [] };
+    patch.servers = { codegraph: codegraphCopilotMcpJson().servers.codegraph };
+    touched.push(mergeBlock(mcpPath, 'codegraph', patch, { dryRun, track }));
+  }
+
+  // 2. AGENTS.md section (fenced block; same marker name as the old template).
+  const agentsPath = join(cwd, 'AGENTS.md');
+  touched.push(mergeBlock(agentsPath, CODEGRAPH_BLOCK_NAME, CODEGRAPH_BLOCK, { dryRun }));
+
+  return touched;
+}
+
+/**
+ * Idempotent remove-of-duplicates is intentionally NOT implemented: mergeBlock
+ * already replaces an existing fenced block in place and deep-merges JSON, so
+ * re-running add codegraph does not duplicate anything.
+ */
+export function isCodegraphPresent(cwd, platform) {
+  const mcpPath = join(cwd, mcpTargetFor(platform));
+  const cfg = readJson(mcpPath);
+  if (platform === PLATFORM_OPENCODE) return Boolean(cfg?.mcp?.codegraph);
+  return Boolean(cfg?.servers?.codegraph);
+}
+
+function readJson(filePath) {
+  if (!existsSync(filePath)) return null;
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** Ensure a file exists with given content (used for a created-not-merged file). */
+export function ensureFile(filePath, contents) {
+  if (existsSync(filePath)) return false;
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, contents);
+  return true;
+}
+
+export const __testables = { readJson, mcpTargetFor };

package/src/addons/jev.mjs

@@ -0,0 +1,98 @@
+import kleur from 'kleur';
+import { existsSync, readFileSync, cpSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { log } from '../util/log.mjs';
+import { mergeBlock } from '../util/merge.mjs';
+import { templatePath } from '../util/fs.mjs';
+
+export const JEVR_STATUS =
+  'local heuristic — jev-harness lacks a custom-criteria interface as of 2026-09-26';
+export const JEVR_TOOL = 'local_tier_heuristic';
+export const TEST_GATE_ISSUE = 'https://github.com/idusortus/cli-five/issues';
+
+const PLUGIN_REL = join('.opencode', 'plugin', 'jev-tier-router');
+
+/**
+ * `add jev` — tier-routing only.
+ *
+ * Ships a local tier-classification tool for the Planner. Does NOT wire the
+ * test-gate (parked: OpenCode plugin hooks don't fire under OpenChamber's
+ * embedded-server routing) and does NOT call Jev (no custom-criteria
+ * interface in jev-harness as of this release).
+ */
+export async function runJev({ cwd, args }) {
+  const platform = detectPlatform(cwd);
+
+  if (platform !== 'opencode') {
+    log.err('jev is OpenCode-only. No tools.add-equivalent surface exists for Copilot.');
+    log.dim('Re-run init with --target opencode, then `npx cli-five add jev`.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const written = [];
+
+  // 1. Plugin directory (package.json + index.js), confirmed convention.
+  const pluginDir = join(cwd, PLUGIN_REL);
+  mkdirSync(pluginDir, { recursive: true });
+  for (const file of ['package.json', 'index.js']) {
+    const src = templatePath('opencode', 'plugin', 'jev-tier-router', file);
+    const dest = join(pluginDir, file);
+    cpSync(src, dest);
+    written.push({ path: dest, written: true });
+  }
+
+  // 2. Register the plugin path in opencode.json's `plugins` array.
+  //    mergeBlock deep-merges JSON but replaces arrays, so read the existing
+  //    array, union it, and hand the unioned value to mergeBlock (single
+  //    write path — no second merge approach).
+  const opencodePath = join(cwd, 'opencode.json');
+  const plugins = readPlugins(opencodePath);
+  const pluginRef = toPosix(PLUGIN_REL);
+  if (!plugins.includes(pluginRef)) plugins.push(pluginRef);
+  mergeBlock(opencodePath, 'jev', { plugins }, { track: true, metaKey: '$cliFive' });
+
+  // 3. Planner instruction in AGENTS.md (fenced block, idempotent).
+  const agentsPath = join(cwd, 'AGENTS.md');
+  mergeBlock(agentsPath, 'jev-tier-routing', plannerInstruction());
+
+  log.ok(`Plugin written to ${kleur.bold(toPosix(PLUGIN_REL))}`);
+  log.ok(`Registered in opencode.json (plugins[])`);
+  log.ok('Planner instruction added to AGENTS.md');
+  log.raw('');
+  log.info(`Tool: ${kleur.bold(JEVR_TOOL)} (tier-routing only)`);
+  log.warn('Status: ' + JEVR_STATUS);
+  log.dim(`Test-gate is parked — see ${TEST_GATE_ISSUE}`);
+}
+
+function plannerInstruction() {
+  return `## Tier routing (local heuristic)
+
+Before planning, call the \`${JEVR_TOOL}\` tool once with the task description.
+
+- If it returns \`confidence\` >= 0.6, use its \`tier\` (trivial | minor | major) as your planning depth.
+- If \`confidence\` < 0.6, or the tool is unavailable, use your own judgment and default to \`major\`.
+- This is a local heuristic, not a Jev call. Never block or fail a turn because the tool is unavailable.`;
+}
+
+function readPlugins(opencodePath) {
+  if (!existsSync(opencodePath)) return [];
+  try {
+    const cfg = JSON.parse(readFileSync(opencodePath, 'utf8'));
+    return Array.isArray(cfg.plugins) ? [...cfg.plugins] : [];
+  } catch {
+    return [];
+  }
+}
+
+function detectPlatform(cwd) {
+  if (existsSync(join(cwd, '.opencode', 'agents'))) return 'opencode';
+  if (existsSync(join(cwd, '.github', 'agents', 'orchestrator.agent.md'))) return 'copilot';
+  return 'unknown';
+}
+
+function toPosix(p) {
+  return p.split('\\').join('/');
+}
+
+export const __testables = { plannerInstruction, readPlugins, detectPlatform };

package/src/addons/registry.mjs

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { runJev, JEVR_STATUS, TEST_GATE_ISSUE } from './jev.mjs';
+import { runCodegraph } from './codegraph-command.mjs';
+import { CODEGRAPH_STATUS } from './codegraph.mjs';
 
 /**
  * Add-on registry for `cli-five add <name>`.
@@ -16,19 +19,27 @@ export const ADDONS = {
     name: 'codegraph',
     label: 'CodeGraph',
     description: 'Graph-backed codebase context MCP server and agent instructions.',
-    available: false,
-    note: 'Currently installed by init (on by default). `add` migration is a future commit.',
+    // Matches jev's status-object pattern: explicit capability + status string,
+    // not a bare boolean.
+    available: true,
+    capability: 'MCP registration + AGENTS.md instructions',
+    status: CODEGRAPH_STATUS,
+    platforms: ['copilot', 'opencode'],
     detect: detectCodeGraph,
-    run: null,
+    run: runCodegraph,
   },
   jev: {
     name: 'jev',
     label: 'Jev',
-    description: 'Optional Jev integration (purpose to be defined in a future commit).',
-    available: false,
-    note: 'Reserved target. No integration wired in this release.',
-    detect: () => [],
-    run: null,
+    description: 'Tier-routing tool for the Planner (local heuristic; test-gate parked).',
+    // Not a bare boolean: jev ships tier-routing ONLY. The test-gate half is
+    // parked because OpenCode plugin hooks don't fire under OpenChamber routing.
+    available: true,
+    capability: 'tier-routing only',
+    status: `${JEVR_STATUS}; test-gate parked — ${TEST_GATE_ISSUE}`,
+    platforms: ['opencode'],
+    detect: detectJev,
+    run: runJev,
   },
 };
 
@@ -94,3 +105,22 @@ function readJson(filePath) {
     return null;
   }
 }
+
+/**
+ * Detect the jev tier-router plugin: its directory on disk and/or its entry in
+ * opencode.json's `plugins` array. Read-only.
+ */
+export function detectJev(cwd) {
+  const signals = [];
+
+  if (existsSync(join(cwd, '.opencode', 'plugin', 'jev-tier-router', 'index.js'))) {
+    signals.push('.opencode/plugin/jev-tier-router');
+  }
+
+  const cfg = readJson(join(cwd, 'opencode.json'));
+  if (Array.isArray(cfg?.plugins) && cfg.plugins.some((p) => String(p).includes('jev-tier-router'))) {
+    signals.push('opencode.json plugins[]');
+  }
+
+  return signals;
+}

package/src/commands/add.mjs

@@ -28,7 +28,7 @@ export async function add(args) {
   if (typeof addon.run !== 'function') {
     log.warn(`${addon.label} is registered but not implemented yet.`);
     log.info('The add dispatcher works — this target is reserved for a future release.');
-    if (addon.note) log.dim(addon.note);
+    if (addon.note || addon.status) log.dim(addon.note || addon.status);
     log.dim('Nothing was written to your project.');
     return;
   }

package/src/commands/init.mjs

@@ -13,6 +13,7 @@ import { choosePlatform, chooseModels, resolveCodegraphDefault } from '../steps/
 import { isGitRepo, gitInit } from '../util/git.mjs';
 import { platformLabel } from '../util/platforms.mjs';
 import { autoProjectInfo } from '../util/project.mjs';
+import { detectAuthenticatedProviders } from '../util/auth.mjs';
 
 export async function init(args) {
   const cwd = args.cwd;
@@ -100,7 +101,7 @@ export async function init(args) {
   } else {
     log.step('4/8 Project info');
     docHints = autoProjectInfo(cwd);
-    logAutoProjectInfo(docHints);
+    logAutoProjectInfo(docHints, { yes: args.yes });
 
     log.step('5/8 Model configuration');
     // Minimal path uses provider defaults without prompting (still honours --provider).
@@ -169,20 +170,30 @@ export async function init(args) {
 }
 
 /** Log which project fields were auto-pulled from the workspace. */
-function logAutoProjectInfo(info) {
+function logAutoProjectInfo(info, { yes = false } = {}) {
   const name = info?.name || {};
   const oneLiner = info?.oneLiner || {};
 
   if (name.value && !name.ambiguous) {
     log.info(`Name:    ${kleur.bold(name.value)} ${kleur.gray(`(${name.sources[0].source})`)}`);
   } else if (name.ambiguous) {
-    log.warn(`Multiple project names found (${name.sources.map((s) => s.source).join(', ')}) — asking.`);
+    const picks = name.sources.map((s) => `${s.source}="${s.value}"`).join(', ');
+    if (yes) {
+      log.warn(`Multiple project names found (${picks}); --yes picked "${name.value}".`);
+    } else {
+      log.warn(`Multiple project names found (${picks}) — asking.`);
+    }
   }
 
   if (oneLiner.value && !oneLiner.ambiguous) {
     log.info(`Tagline: ${oneLiner.value} ${kleur.gray(`(${oneLiner.sources[0].source})`)}`);
   } else if (oneLiner.ambiguous) {
-    log.warn(`Multiple descriptions found (${oneLiner.sources.map((s) => s.source).join(', ')}) — asking.`);
+    const picks = oneLiner.sources.map((s) => `${s.source}="${s.value}"`).join(', ');
+    if (yes) {
+      log.warn(`Multiple descriptions found (${picks}); --yes picked ${oneLiner.sources[0].source}.`);
+    } else {
+      log.warn(`Multiple descriptions found (${picks}) — asking.`);
+    }
   }
 }
 
@@ -208,6 +219,19 @@ function printNextSteps(answers, { generatedInstructions = false } = {}) {
     log.raw(`  3. Run OpenCode from this directory:`);
     log.raw(kleur.gray(`        opencode`));
     log.raw(`  4. Select ${kleur.bold('Orchestrator')} and describe what you want built.`);
+
+    // A provider the user is not authenticated for produces agent files whose
+    // models silently fail. Surface that here rather than at first agent use.
+    const authed = detectAuthenticatedProviders();
+    const provider = answers.provider;
+    if (authed.length > 0 && !authed.includes(provider)) {
+      log.raw('');
+      log.warn(`Models use "${provider}", but you are authenticated for: ${authed.join(', ')}.`);
+      log.dim(`  Authenticate with \`opencode auth login\`, or re-run with --provider ${authed[0]}.`);
+    } else if (authed.length === 0) {
+      log.raw('');
+      log.dim(`  Make sure you are authenticated (\`opencode auth login\`) for provider "${provider}".`);
+    }
   } else {
     log.raw(`  1. Open this folder in VS Code Insiders.`);
     log.raw(`  2. Enable Copilot subagent invocations (settings.json):`);

package/src/commands/list-addons.mjs

@@ -5,24 +5,33 @@ import { detectAddon, listAddons } from '../addons/registry.mjs';
 /**
  * `cli-five list-addons` — show what is installed vs. available.
  *
- * "Installed" is detected read-only from workspace artifacts. CodeGraph is
- * listed honestly even though its `add` plumbing has not moved yet.
+ * "Installed" is detected read-only from workspace artifacts. Status text is
+ * deliberately honest: an add-on that ships partial capability (e.g. jev's
+ * tier-routing without the parked test-gate) must not read as fully installed.
  */
 export function listAddonsCommand(args) {
   const cwd = args.cwd;
   log.raw(kleur.bold().magenta('\ncli-five list-addons') + kleur.gray(`  ${cwd}`));
   log.raw('');
 
-  log.raw(`  ${kleur.gray(pad('ADD-ON', 12))} ${kleur.gray(pad('STATUS', 12))} ${kleur.gray(pad('ADD', 10))} ${kleur.gray('DETAIL')}`);
-  log.raw(`  ${'─'.repeat(12)} ${'─'.repeat(12)} ${'─'.repeat(10)} ${'─'.repeat(30)}`);
+  log.raw(`  ${kleur.gray(pad('ADD-ON', 12))} ${kleur.gray(pad('STATUS', 14))} ${kleur.gray(pad('ADD', 10))} ${kleur.gray('DETAIL')}`);
+  log.raw(`  ${'─'.repeat(12)} ${'─'.repeat(14)} ${'─'.repeat(10)} ${'─'.repeat(30)}`);
 
   for (const addon of listAddons()) {
     const signals = detectAddon(addon, cwd);
     const installed = signals.length > 0;
     const addable = typeof addon.run === 'function';
-    const detail = installed ? signals.join(', ') : addon.note || '';
 
-    const statusText = pad(installed ? 'installed' : 'not found', 12);
+    // An installed add-on with a `capability` note is partial — say so.
+    const statusLabel = installed
+      ? (addon.capability ? `installed (${addon.capability})` : 'installed')
+      : 'not found';
+
+    const detail = installed
+      ? [addon.status || signals.join(', ')].filter(Boolean).join(' — ')
+      : addon.note || addon.status || '';
+
+    const statusText = pad(statusLabel, 14);
     const status = installed ? kleur.green(statusText) : kleur.gray(statusText);
     const addableText = pad(addable ? 'available' : 'planned', 10);
     const addableColored = addable ? kleur.green(addableText) : kleur.yellow(addableText);
@@ -31,7 +40,7 @@ export function listAddonsCommand(args) {
   }
 
   log.raw('');
-  log.dim('Install with `npx cli-five add <name>` once a target is available.');
+  log.dim('Install with `npx cli-five add <name>`.');
   log.raw('');
 }
 

package/src/steps/platform.mjs

@@ -9,6 +9,7 @@ import {
   platformLabel,
 } from '../util/platforms.mjs';
 import { log } from '../util/log.mjs';
+import { detectAuthenticatedProviders, preferredProviderForAuth } from '../util/auth.mjs';
 import {
   agentNames,
   getDefaultModelMap,
@@ -118,10 +119,17 @@ export function detectExistingPlatform(cwd) {
  * override per-agent models.
  */
 export async function chooseModels(platform, args) {
-  // Defaults for the platform.
-  const defaultProvider = providerForPlatform(platform, args.provider);
+  // Defaults for the platform, refined by what the user is actually authed for.
+  const authedProvider = platform === PLATFORM_OPENCODE && !args.provider
+    ? preferredProviderForAuth(platform)
+    : null;
+  const defaultProvider = providerForPlatform(platform, args.provider || authedProvider);
   const defaults = getDefaultModelMap(defaultProvider);
 
+  if (authedProvider && authedProvider !== PROVIDER_ZEN) {
+    log.dim(`Detected authenticated OpenCode provider: ${providerLabel(authedProvider)} (using it instead of the ${providerLabel(PROVIDER_ZEN)} default).`);
+  }
+
   if (args.yes) {
     return {
       provider: defaultProvider,
@@ -206,23 +214,27 @@ async function chooseProvider(platform, cliProvider) {
     return PROVIDER_COPILOT;
   }
 
+  const authed = detectAuthenticatedProviders();
+  const isAuthed = (p) => authed.includes(p);
+  const annotate = (p, label, description) => ({
+    title: isAuthed(p) ? `${label} ${kleur.green('(authenticated)')}` : label,
+    value: p,
+    description,
+  });
+
+  const choices = [
+    annotate(PROVIDER_ZEN, providerLabel(PROVIDER_ZEN), 'Curated, tested models via OpenCode Zen'),
+    annotate(PROVIDER_GO, 'OpenCode Go', 'Low-cost open-coding model subscription'),
+  ];
+  // Put an authenticated provider first so the default is one that works.
+  const initial = Math.max(0, choices.findIndex((c) => isAuthed(c.value)));
+
   const { provider } = await prompts({
     type: 'select',
     name: 'provider',
     message: 'OpenCode model provider',
-    choices: [
-      {
-        title: providerLabel(PROVIDER_ZEN),
-        value: PROVIDER_ZEN,
-        description: 'Curated, tested models via OpenCode Zen',
-      },
-      {
-        title: 'OpenCode Go',
-        value: 'opencode-go',
-        description: 'Low-cost open-coding model subscription',
-      },
-    ],
-    initial: 0,
+    choices,
+    initial,
   });
 
   if (!provider) {

package/src/steps/scaffold.mjs

@@ -3,6 +3,7 @@ import { log } from '../util/log.mjs';
 import { readTemplate, render, writeFile, listFilesRecursive, relTo, templatePath } from '../util/fs.mjs';
 import { readFileSync } from 'node:fs';
 import { PLATFORM_COPILOT, PLATFORM_OPENCODE, agentDirFor, agentFileFor } from '../util/platforms.mjs';
+import { addCodegraphTo } from '../addons/codegraph.mjs';
 
 const AGENT_NAMES = ['orchestrator', 'planner', 'coder', 'designer', 'reviewer'];
 const HISTORY_FILES = ['orchestrator.md', 'planner.md', 'coder.md', 'designer.md', 'reviewer.md'];
@@ -44,6 +45,9 @@ export function scaffold({ cwd, answers, args }) {
   }
 
   // Shared memory primitives
+  // NOTE: AGENTS.md is written WITHOUT the CodeGraph block here. When CodeGraph
+  // is enabled, the block is merged in afterward by addCodegraphTo() — the same
+  // code path `add codegraph` uses (one implementation, two entry points).
   for (const tmpl of [
     'AGENTS.md.tmpl',
     'PROJECT.md.tmpl',
@@ -61,6 +65,13 @@ export function scaffold({ cwd, answers, args }) {
     written.push(writeFile(join(cwd, 'histories', file), readTemplate('histories', file), args));
   }
 
+  // CodeGraph — delegated to the shared add codegraph implementation.
+  if (answers.codegraph) {
+    for (const t of addCodegraphTo({ cwd, platform, dryRun: args.dryRun })) {
+      written.push({ path: t.path, written: !args.dryRun && t.action !== 'unchanged' });
+    }
+  }
+
   return written;
 }
 
@@ -93,11 +104,6 @@ function scaffoldCopilot({ cwd, answers, args, vars }) {
     writeFile(join(cwd, '.github', 'skills', 'README.md'), readTemplate('.github', 'skills', 'README.md'), args),
   );
 
-  // CodeGraph MCP for VS Code Copilot
-  if (answers.codegraph) {
-    written.push(writeFile(join(cwd, '.vscode', 'mcp.json'), JSON.stringify(codegraphMcpJson(), null, 2), args));
-  }
-
   return written;
 }
 
@@ -144,34 +150,10 @@ function buildOpencodeConfig({ answers, orchestratorModel }) {
     subagent_depth: 2,
   };
 
-  if (answers.codegraph) {
-    config.mcp = {
-      codegraph: {
-        type: 'local',
-        command: ['codegraph', 'serve', '--mcp'],
-        enabled: true,
-      },
-    };
-  }
-
   return config;
 }
 
-function codegraphMcpJson() {
-  return {
-    inputs: [],
-    servers: {
-      codegraph: {
-        command: 'codegraph',
-        args: ['serve', '--mcp'],
-      },
-    },
-  };
-}
-
 function buildVars(a) {
-  const codegraphBlock = a.codegraph ? CODEGRAPH_BLOCK : '';
-
   return {
     PROJECT_NAME: a.projectName,
     ONE_LINER: a.oneLiner || 'TODO — write a one-line vision statement.',
@@ -190,7 +172,6 @@ ${a.docs}
 ` : '',
     DATE: new Date().toISOString().slice(0, 10),
     PERSONA_BLOCK: a.snark ? PERSONA_BLOCK : '',
-    CODEGRAPH_BLOCK: codegraphBlock,
   };
 }
 
@@ -221,22 +202,6 @@ const PERSONA_BLOCK = `# Persona
 
 `;
 
-const CODEGRAPH_BLOCK = `
-<!-- CODEGRAPH_START -->
-## CodeGraph
-
-This project is configured to use [CodeGraph](https://codegraph.ru) for graph-backed codebase context.
-When you need to understand relationships, call paths, or impacts, use:
-
-\`\`\`
-codegraph explore "<your question>"
-\`\`\`
-
-The CodeGraph MCP server is registered in the project config. Run \`codegraph init\` in this directory
-if the project has not been indexed yet.
-<!-- CODEGRAPH_END -->
-`;
-
 export function summarize(written, cwd) {
   const lines = [];
   for (const w of written) {

package/src/util/auth.mjs

@@ -0,0 +1,85 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { PROVIDER_ZEN, PROVIDER_GO } from './models.mjs';
+
+// OpenCode auth provider id -> cli-five provider id.
+// Zen authenticates as `opencode`; Go as `opencode-go`.
+const AUTH_ID_TO_PROVIDER = {
+  opencode: PROVIDER_ZEN,
+  'opencode-go': PROVIDER_GO,
+};
+
+/**
+ * Detect which OpenCode model providers the user is actually authenticated for.
+ *
+ * Best-effort and side-effect free: shells out to `opencode auth list --format json`
+ * and falls back to reading OpenCode's auth.json. Returns an array of cli-five
+ * provider ids (e.g. ['opencode-go']); empty when nothing is detected.
+ *
+ * Never throws — a missing OpenCode CLI or unreadable auth must not break init.
+ */
+export function detectAuthenticatedProviders() {
+  for (const ids of [authFromCli(), authFromFile()]) {
+    if (ids && ids.length > 0) return ids;
+  }
+  return [];
+}
+
+function authFromCli() {
+  try {
+    const out = execFileSync('opencode', ['auth', 'list', '--format', 'json'], {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      encoding: 'utf8',
+      timeout: 5000,
+    });
+    const parsed = JSON.parse(out);
+    if (!Array.isArray(parsed)) return null;
+    return parsed
+      .map((entry) => AUTH_ID_TO_PROVIDER[entry?.id])
+      .filter(Boolean);
+  } catch {
+    return null;
+  }
+}
+
+function authFromFile() {
+  const candidates = [
+    process.env.OPENCODE_AUTH_FILE,
+    join(homedir(), '.local', 'share', 'opencode', 'auth.json'),
+    join(process.env.XDG_DATA_HOME || '', 'opencode', 'auth.json'),
+  ].filter(Boolean);
+
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    try {
+      const data = JSON.parse(readFileSync(path, 'utf8'));
+      return Object.keys(data)
+        .map((id) => AUTH_ID_TO_PROVIDER[id])
+        .filter(Boolean);
+    } catch {
+      /* try next */
+    }
+  }
+  return null;
+}
+
+/**
+ * Pick the best provider for a platform given what the user is authenticated for.
+ *
+ * For OpenCode: prefer the authenticated provider when there is one; when the
+ * user has only Go (or only Zen), use it instead of the blind Zen default.
+ * Returns null when no preference can be inferred (caller keeps its default).
+ */
+export function preferredProviderForAuth(platform) {
+  if (platform !== 'opencode') return null;
+  const authed = detectAuthenticatedProviders();
+  if (authed.length === 0) return null;
+  // Prefer Go when both are present only if Zen is absent — otherwise Zen.
+  if (authed.includes(PROVIDER_ZEN)) return PROVIDER_ZEN;
+  if (authed.includes(PROVIDER_GO)) return PROVIDER_GO;
+  return null;
+}
+
+export const __testables = { authFromCli, authFromFile, AUTH_ID_TO_PROVIDER };

package/templates/AGENTS.md.tmpl

@@ -24,4 +24,3 @@ and Copilot all read `AGENTS.md` per the [agents.md](https://agents.md) conventi
 4. Per-agent memory lives in `histories/<agent>.md`.
 5. Append a session summary to `agent-diary.md` when work completes.
 
-{{CODEGRAPH_BLOCK}}

package/templates/opencode/plugin/jev-tier-router/index.js

@@ -0,0 +1,187 @@
+// cli-five jev-tier-router plugin (OpenCode).
+//
+// Ships a `local_tier_heuristic` tool that classifies a task description into
+// cli-five's tier vocabulary: trivial | minor | major.
+//
+// TRUTHFUL NAMING: this is a LOCAL heuristic. It does NOT call Jev. As of
+// 2026-09-26, jev-harness's `route` subcommand exposes no custom-criteria
+// interface (it emits its own fixed tier vocabulary: deterministic /
+// lightweight_system2 / heavy_system2) and returns a constant confidence
+// (0.88) under its offline/mock engine, so it cannot be thresholded on.
+// The name `local_tier_heuristic` is deliberate — do not revive `jev_tier_route`
+// unless/until real Jev wiring is verified. See JEVR_SWAP_POINT below.
+//
+// Fail-open: if anything goes wrong the tool reports `available: false` and
+// tier "major" (the expensive tier), so the Planner falls back to its own
+// judgment. It never throws in a way that would break the Planner's turn.
+
+import { appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const CONFIDENCE_CUTOFF = 0.6;
+const FALLBACK_TIER = 'major';
+
+const TIERS = ['trivial', 'minor', 'major'];
+
+// Weighted signals. `strong` matches dominate; `moderate` accumulate.
+const SIGNALS = [
+  // trivial — mechanical, single-token, no reasoning
+  { tier: 'trivial', weight: 3, re: /\b(typo|typos|whitespace|lint|linting|format|formatting|rename|renaming|comment|comments|docstring|spelling|indent(ation)?)\b/i },
+  { tier: 'trivial', weight: 2, re: /\b(README|changelog|CHANGELOG|\.md\b|docs?)\b/i },
+  { tier: 'trivial', weight: 2, re: /\b(one[- ]?line|single[- ]?(file|line)|small tweak|quick fix|minor tweak)\b/i },
+  { tier: 'trivial', weight: 2, re: /\b(delete|remove)\b[\s\w]{0,20}\b(console\.log|stray|unused|dead code|tmp|temp file)\b/i },
+
+  // major — architectural, cross-cutting, ambiguous scope
+  { tier: 'major', weight: 3, re: /\b(architect(ure|ural)?|redesign|rearchitect|rewrite|overhaul|migrat(e|ion)|replatform|distributed|scalab(le|ility)|multi[- ]?(tenant|region|service))\b/i },
+  { tier: 'major', weight: 3, re: /\b(entire|whole|across (the )?(codebase|repo(sitory)?|project)|end[- ]to[- ]end|system[- ]wide)\b/i },
+  { tier: 'major', weight: 2, re: /\b(concurren(cy|t)|race condition|deadlock|transaction(al)?|consistency|eventual consistency|saga|retry (architecture|strategy)|queue|scheduler|orchestrat(e|ion))\b/i },
+  { tier: 'major', weight: 2, re: /\b(performance|latency|throughput|optimi[sz]e|profil(e|ing)|security|auth(entication|orization)?|encryption|compliance|HIPAA|SOC ?2|GDPR)\b/i },
+  { tier: 'major', weight: 1, re: /\b(design|feature|implement|build|add support for|new (module|service|system))\b/i },
+
+  // minor — bounded, local, incremental
+  { tier: 'minor', weight: 3, re: /\b(validation|validate|error handling|error message|edge case|bug ?fix|fix (a |the )?bug|patch|handle null|guard clause)\b/i },
+  { tier: 'minor', weight: 2, re: /\b(component|function|method|handler|endpoint|form|button|modal|tooltip|dropdown)\b/i },
+  { tier: 'minor', weight: 2, re: /\b(refactor|extract|rename (the )?(function|method|class|module)|tidy|clean ?up)\b/i },
+  { tier: 'minor', weight: 1, re: /\b(add|update|adjust|tweak|improve|tidy)\b/i },
+];
+
+/**
+ * Classify a task description locally.
+ *
+ * Returns { tier, confidence, rationale, available, source }.
+ * Ambiguity fails toward the expensive tier (major), never the cheap one.
+ */
+export function classifyTask(description) {
+  const text = String(description ?? '').trim();
+  if (!text) {
+    return {
+      tier: FALLBACK_TIER,
+      confidence: 0,
+      rationale: 'Empty task description; defaulting to the expensive tier.',
+      available: true,
+      source: 'local_heuristic',
+    };
+  }
+
+  const scores = { trivial: 0, minor: 0, major: 0 };
+  const hits = { trivial: [], minor: [], major: [] };
+
+  for (const signal of SIGNALS) {
+    if (signal.re.test(text)) {
+      scores[signal.tier] += signal.weight;
+      hits[signal.tier].push(signal.re.source.slice(0, 40));
+    }
+  }
+
+  // Length is a weak major signal: long, multi-clause prompts rarely stay local.
+  const words = text.split(/\s+/).filter(Boolean).length;
+  if (words > 25) scores.major += 1;
+  if (words > 60) scores.major += 1;
+
+  const ranked = TIERS.map((tier) => ({ tier, score: scores[tier] })).sort((a, b) => b.score - a.score);
+  const [top, second] = ranked;
+
+  if (top.score === 0) {
+    // Nothing matched — ambiguous. Fail toward the expensive tier.
+    return {
+      tier: FALLBACK_TIER,
+      confidence: 0.3,
+      rationale: 'No tier signals matched; ambiguous, so defaulting to the expensive tier.',
+      available: true,
+      source: 'local_heuristic',
+    };
+  }
+
+  const total = TIERS.reduce((sum, tier) => sum + scores[tier], 0);
+  const separation = (top.score - (second?.score ?? 0)) / top.score;
+  const share = top.score / total;
+  let confidence = 0.5 * share + 0.5 * separation;
+
+  // A single weak hit with no corroboration is not a confident call.
+  if (top.score <= 1) confidence = Math.min(confidence, 0.5);
+
+  confidence = Math.round(confidence * 100) / 100;
+
+  if (confidence < CONFIDENCE_CUTOFF) {
+    return {
+      tier: FALLBACK_TIER,
+      confidence,
+      rationale: `Low confidence (${confidence} < ${CONFIDENCE_CUTOFF}) between ${top.tier} and ${second?.tier ?? 'n/a'}; defaulting to the expensive tier.`,
+      available: true,
+      source: 'local_heuristic',
+    };
+  }
+
+  return {
+    tier: top.tier,
+    confidence,
+    rationale: `Matched ${hits[top.tier].length} ${top.tier} signal(s).`,
+    available: true,
+    source: 'local_heuristic',
+  };
+}
+
+// ── JEVR_SWAP_POINT ───────────────────────────────────────────────────
+// Real-Jev wiring would replace classifyTask() above with a shell-out to
+//   jev-harness route --json --task "<description>"
+// and map the returned `selected_tier` onto cli-five's tiers, thresholding on
+// `confidence`. It is NOT wired because, as of 2026-09-26, `route` exposes no
+// custom-criteria interface, emits a fixed vocabulary, and returns a constant
+// confidence under the offline engine. Re-verify before swapping.
+// Exact call site: the `execute` handler below that calls classifyTask().
+// ──────────────────────────────────────────────────────────────────────
+
+export const __testables = { classifyTask, CONFIDENCE_CUTOFF, FALLBACK_TIER };
+
+export default {
+  id: 'cli-five-jev-tier-router',
+  setup: async (ctx) => {
+    if (!ctx || !ctx.tool || typeof ctx.tool.transform !== 'function') return;
+
+    await ctx.tool.transform((tools) => {
+      tools.add({
+        name: 'local_tier_heuristic',
+        description:
+          'Classify a task description into cli-five\'s tier vocabulary (trivial | minor | major) using a local heuristic. ' +
+          'Call this once per task, before planning. Trust the returned tier when confidence >= 0.6; otherwise fall back to "major". ' +
+          'This is a local heuristic, not a Jev call.',
+        input: {
+          type: 'object',
+          properties: {
+            description: {
+              type: 'string',
+              description: 'The task to classify, verbatim (the user request or planning prompt).',
+            },
+          },
+          required: ['description'],
+          additionalProperties: false,
+        },
+        async execute(input) {
+          try {
+            const result = classifyTask(input?.description);
+            return { content: JSON.stringify(result) };
+          } catch (err) {
+            // Fail-open: never break the caller's turn.
+            try {
+              appendFileSync(
+                process.env.CLI_FIVE_LOGFILE || join(process.cwd(), '.opencode', 'journals', 'jev-tier-router.log'),
+                `${new Date().toISOString()} local_tier_heuristic fail-open: ${err?.message || err}\n`,
+              );
+            } catch {
+              /* logging is best-effort */
+            }
+            return {
+              content: JSON.stringify({
+                tier: FALLBACK_TIER,
+                confidence: 0,
+                rationale: 'Tier classifier unavailable; defaulting to the expensive tier.',
+                available: false,
+                source: 'local_heuristic',
+              }),
+            };
+          }
+        },
+      });
+    });
+  },
+};

package/templates/opencode/plugin/jev-tier-router/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "cli-five-jev-tier-router",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./index.js"
+  }
+}