codedeck 0.4.1 → 0.5.0

package/dist/open/launchers/codex.js

@@ -0,0 +1,236 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { detectBinary } from "../../drivers/helpers.js";
+import { getRegistry } from "../../drivers/registry.js";
+import { getCachedOrDiscoverModels } from "../../core/models.js";
+import { parseEffort } from "../../core/driver.js";
+import { DISPATCHER_PRESET } from "../../config/orchestrator-mode.js";
+import { catalogWarning, judgeModelIn, resolveRoleContract, } from "../contract.js";
+import { composeOrchestratorProse } from "../orchestrator-prose.js";
+import { SESSION_ID_PATTERN } from "../runtime.js";
+/**
+ * Codex has no system-prompt flag on its interactive TUI (no equivalent of
+ * Claude's --append-system-prompt-file), so the role contract travels as a
+ * `-c developer_instructions` override instead of the session's first prompt.
+ * Probed against codex-cli 0.154.0: the key lands as the opening `developer`
+ * message (visible via `codex debug prompt-input`), the TUI starts empty, and
+ * no turn is spent. `model_instructions_file` is deliberately avoided: it
+ * replaces the sanctioned model instructions instead of appending to them.
+ */
+export function initialPrompt(pluginDir, role, mode = DISPATCHER_PRESET) {
+    const { agentBody, ultra } = resolveRoleContract(pluginDir, role, mode);
+    const orchestratorProse = role === "orchestrator" ? composeOrchestratorProse(mode) : "";
+    const body = orchestratorProse ? `${agentBody}\n\n${orchestratorProse}` : agentBody;
+    return `${ultra.trimEnd()}\n\n${body}`;
+}
+/**
+ * TOML-escape a contract for `-c developer_instructions="""..."""`. The value
+ * is parsed as TOML, so a raw `"` or `\` would break out of the string and
+ * inject a second config assignment. LF stays raw, which multiline basic
+ * strings allow; every other C0 control and DEL goes as `\uXXXX`, which has
+ * no raw form. No control literal appears in the source below: the branch is
+ * on the char code, so linters that flag control escapes stay quiet.
+ */
+export function developerInstructionsOverride(prompt) {
+    let escaped = "";
+    for (const c of prompt) {
+        const code = c.codePointAt(0) ?? 0;
+        if (c === "\\")
+            escaped += "\\\\";
+        else if (c === '"')
+            escaped += '\\"';
+        else if (c === "\n")
+            escaped += c;
+        else if (code < 0x20 || code === 0x7f) {
+            escaped += `\\u${code.toString(16).padStart(4, "0").toUpperCase()}`;
+        }
+        else
+            escaped += c;
+    }
+    return `developer_instructions="""${escaped}"""`;
+}
+/**
+ * Approximate role permissions with the only knob codex offers: the sandbox.
+ * Codex cannot deny reads while allowing dispatch the way the opencode
+ * permission map can, so the read-only roles land on read-only and everything
+ * that dispatches work lands on workspace-write. With the default bypass this
+ * mapping is dormant; it only binds under --no-bypass.
+ */
+export function roleSandbox(role) {
+    switch (role) {
+        case "reviewer":
+        case "auditor":
+            return "read-only";
+        case "general":
+        case "orchestrator":
+            return "workspace-write";
+    }
+}
+/**
+ * Interactive codex argv. Mirrors the exec driver's flag spellings (measured
+ * against codex-cli 0.154.0): resume is a subcommand, a resumed thread keeps
+ * its policy and working root, and effort is a TOML config override.
+ *
+ * The role contract travels as `-c developer_instructions`, never as the
+ * positional [PROMPT]: the TUI starts empty and no turn is spent. Multiple
+ * `-c` flags coexist (effort + instructions), each kept adjacent to its
+ * value or codex reads the next flag as the value.
+ *
+ * No model default is pinned here: without an explicit model the flag is
+ * omitted and the codex config.toml answers.
+ */
+export function buildOpenArgs(role, flags, pluginDir, passthrough, openCwd, mode = DISPATCHER_PRESET) {
+    const isResume = flags.resume !== undefined;
+    const args = [];
+    if (isResume)
+        args.push("resume", flags.resume);
+    if (flags.model)
+        args.push("-m", flags.model);
+    if (!isResume)
+        args.push("-s", roleSandbox(role));
+    if (flags.bypass !== false)
+        args.push("--dangerously-bypass-approvals-and-sandbox");
+    // Validated, never interpolated raw: the value lands inside a TOML string
+    // and an unescaped quote would inject a second config assignment.
+    if (flags.effort)
+        args.push("-c", `model_reasoning_effort="${parseEffort(flags.effort)}"`);
+    // The resume slot takes an optional follow-up prompt, so a resumed thread
+    // never gets the role contract re-injected as a new message.
+    if (!isResume)
+        args.push("-c", developerInstructionsOverride(initialPrompt(pluginDir, role, mode)));
+    if (!isResume)
+        args.push("-C", openCwd);
+    args.push(...passthrough);
+    return args;
+}
+export const CODEX_NOT_FOUND = "Codex was not found on PATH. Install Codex and ensure `codex` is available.";
+/**
+ * The codex half of the split: find this harness's catalog, judge it with
+ * the shared pure verdict. Kept while the suite pins this shape.
+ */
+export function judgeModel(model, catalogs, fromConfig) {
+    return judgeModelIn(catalogs?.find((item) => item.agent === "codex"), model, fromConfig, "Codex");
+}
+export async function preflight(model, fromConfig) {
+    let catalogs;
+    try {
+        catalogs = await getCachedOrDiscoverModels(getRegistry(), { agent: "codex" });
+    }
+    catch (error) {
+        // A catalog that cannot be reached is not evidence against the model, so
+        // this warns and lets the launch decide.
+        const text = error instanceof Error ? error.message : String(error);
+        console.warn(catalogWarning("Codex", model, `unavailable (${text})`));
+        return;
+    }
+    const verdict = judgeModel(model, catalogs, fromConfig);
+    if (verdict.kind === "ok")
+        return;
+    if (verdict.kind === "unknown-catalog") {
+        console.warn(verdict.warning);
+        return;
+    }
+    throw new Error(verdict.error);
+}
+/**
+ * Returns the resolved path rather than a boolean so everything downstream
+ * launches the exact binary that was checked.
+ */
+export async function resolveBinary() {
+    const installation = await detectBinary("codex");
+    if (!installation.installed || !installation.path) {
+        throw new Error(CODEX_NOT_FOUND);
+    }
+    return installation.path;
+}
+/**
+ * Where the TUI persists rollout files, honouring CODEX_HOME like the harness
+ * does. Day directories use the local date, matching the filenames codex
+ * writes.
+ */
+export function codexSessionsDir(now = new Date(), home = os.homedir(), codexHome = process.env.CODEX_HOME) {
+    const base = codexHome && codexHome.length > 0 ? codexHome : path.join(home, ".codex");
+    const pad = (n) => String(n).padStart(2, "0");
+    return path.join(base, "sessions", String(now.getFullYear()), pad(now.getMonth() + 1), pad(now.getDate()));
+}
+/**
+ * Best-effort snapshot of the day's rollout files. A missing directory means
+ * no rollouts yet, not a failed capture; any other read failure stays
+ * undefined so the close path refuses the diff instead of guessing.
+ */
+export function readCodexRollouts(dir = codexSessionsDir()) {
+    try {
+        return fs
+            .readdirSync(dir)
+            .filter((file) => file.startsWith("rollout-") && file.endsWith(".jsonl"))
+            .sort();
+    }
+    catch {
+        try {
+            if (!fs.existsSync(dir))
+                return [];
+        }
+        catch { }
+        return undefined;
+    }
+}
+/**
+ * Who a rollout file belongs to, read off its opening session_meta line.
+ * Anything unparseable means "cannot tell", and a missing hint beats a
+ * wrong one.
+ */
+export function rolloutIdentity(file) {
+    try {
+        const first = fs.readFileSync(file, "utf8").split("\n", 1)[0] ?? "";
+        const line = JSON.parse(first);
+        const id = line?.payload?.id;
+        if (typeof id !== "string" || !SESSION_ID_PATTERN.test(id))
+            return undefined;
+        const cwd = line?.payload?.cwd;
+        return { id, ...(typeof cwd === "string" && cwd ? { cwd } : {}) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The thread id a rollout file belongs to. When the launching cwd is known
+ * it must match the rollout's own cwd: two concurrent launches in different
+ * directories must never record each other's session.
+ */
+export function threadIdFromRollout(file, expectedCwd) {
+    const identity = rolloutIdentity(file);
+    if (!identity)
+        return undefined;
+    if (expectedCwd !== undefined && identity.cwd !== expectedCwd)
+        return undefined;
+    return identity.id;
+}
+/**
+ * The id of the session created between snapshots, or undefined. Zero or
+ * ambiguous new files mean "cannot tell". Snapshots span directories so a
+ * session crossing midnight is still found; a resumed thread appends to its
+ * existing rollout, so resumes fall back to the --resume value at the close
+ * path instead of this diff.
+ */
+export function diffCodexRolloutsAcross(before, snapshots, expectedCwd) {
+    const known = new Set(before);
+    const fresh = [];
+    for (const snapshot of snapshots) {
+        for (const file of snapshot.files) {
+            if (!known.has(file))
+                fresh.push({ dir: snapshot.dir, file });
+        }
+    }
+    if (fresh.length !== 1)
+        return undefined;
+    return threadIdFromRollout(path.join(fresh[0].dir, fresh[0].file), expectedCwd);
+}
+/**
+ * Single-day form of the across-directories diff.
+ */
+export function diffCodexRollouts(dir, before, after, expectedCwd) {
+    return diffCodexRolloutsAcross(before, [{ dir, files: after }], expectedCwd);
+}
+//# sourceMappingURL=codex.js.map

package/dist/open/launchers/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/open/launchers/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAsB,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,WAAW,EAAqB,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,IAAU,EACV,OAAyB,iBAAiB;IAE1C,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,SAAS,OAAO,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,MAAM,CAAC;aAC7B,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,KAAK,CAAC;aAChC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC;aAC7B,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACtE,CAAC;;YAAM,OAAO,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,6BAA6B,OAAO,KAAK,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAU;IACpC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC;QACrB,KAAK,SAAS,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,iBAAiB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAU,EACV,KAAqC,EACrC,SAAiB,EACjB,WAAqB,EACrB,OAAe,EACf,OAAyB,iBAAiB;IAE1C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;IAC5C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAgB,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACpF,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,2BAA2B,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3F,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAC1B,6EAA6E,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,QAAqC,EACrC,UAAmB;IAEnB,OAAO,YAAY,CACjB,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,EAChD,KAAK,EACL,UAAU,EACV,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,UAAmB;IAChE,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,yBAAyB,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,yCAAyC;QACzC,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,IAAI,GAAG,CAAC,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO;IAClC,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAY,IAAI,IAAI,EAAE,EACtB,OAAe,EAAE,CAAC,OAAO,EAAE,EAC3B,YAAgC,OAAO,CAAC,GAAG,CAAC,UAAU;IAEtD,MAAM,IAAI,GAAG,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,EACJ,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EACzB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EACvB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,gBAAgB,EAAE;IAChE,IAAI,CAAC;QACH,OAAO,EAAE;aACN,WAAW,CAAC,GAAG,CAAC;aAChB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aACxE,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAG5B,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAoB;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgB,EAChB,SAA4B,EAC5B,WAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,MAAgB,EAChB,KAAe,EACf,WAAoB;IAEpB,OAAO,uBAAuB,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;AAC/E,CAAC"}

package/dist/plugin/agents/auditor.md

@@ -1,12 +1,23 @@
 ---
+# DO NOT EDIT: generated from roles/auditor.md + partials (dispatch, proof, rename-run).
+# Do not hand-edit; edit the manifest or partials and rebuild.
 name: auditor
 description: Review a scope too large for one pass by fanning out, then consolidate the findings and prove them.
 tools: Read, Grep, Glob, Bash, WebFetch, WebSearch, Task
 ---
 
-You are the CodeDeck auditor. You review a scope large enough that one pass would miss things, by splitting it and consolidating what comes back. You are read only, and so is everyone you dispatch: nothing in this review edits, stages, commits, or pushes.
+- Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
+- Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
+- The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
+- Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
+- Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".
+
+- Verify before you claim.
+- Read `codedeck diff <id>` yourself before believing any worker. The artifact is authoritative, the success message is not.
 
-Once the task is clear in a `codedeck run` worker, rename your session with `codedeck rename "$CODEDECK_SESSION_ID" <short-task-slug>`.
+- Once the task is clear in a `codedeck run` worker, rename your session with `codedeck rename "$CODEDECK_SESSION_ID" <short-task-slug>`.
+
+You are the CodeDeck auditor. You review a scope large enough that one pass would miss things, by splitting it and consolidating what comes back. You are read only, and so is everyone you dispatch: nothing in this review edits, stages, commits, or pushes.
 
 ## Splitting
 
@@ -15,9 +26,6 @@ Once the task is clear in a `codedeck run` worker, rename your session with `cod
 - Choose the mechanism by what the slice needs, not by an assumed cost gap. There is no measured one: `docs/harness-behaviour.md` records the attempt and why its two columns cannot be compared.
 - Neither mechanism starts with your context. A native subagent inherits this conversation only when it is a fork, and a separate worker begins around 80% cache reads rather than from nothing. Either way the briefing carries the whole task, and neither one is cheap because it already knows something.
 - Native subagents are the default for reading and research: no worktree, no second process, nothing to clean up. When a slice needs a separate process, use `codedeck run --role reviewer --no-worktree "<briefing>"`.
-- `--role` selects the harness and model the human configured for that role. It also loads the role's contract into the worker prompt, including for non-Claude harnesses.
-- Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
-- The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
 - A file-changing worker uses the canonical form `codedeck run --role <role> --worktree "<briefing>"`, but this review is read only. Never use `--worktree` for an audit slice.
 - Every slice carries the full reviewer contract: open the real file, cite `file:line` you actually opened, prove runtime claims with a probe you ran, valid only when it ties to a reproducible failure or a stated contract, and close with what you did not cover.
 

package/dist/plugin/agents/general.md

@@ -1,8 +1,362 @@
 ---
+# DO NOT EDIT: generated from roles/general.md + partials (review-self, worktree, dispatch, proof, rename-run, commit, pr-writer).
+# Do not hand-edit; edit the manifest or partials and rebuild.
 name: general
 description: Do CodeDeck work directly in the current workspace, with evidence.
 ---
 
+- Before declaring a file-changing task ready, dispatch `codedeck run --role reviewer --no-worktree "<briefing>"` on your own change.
+- The review is read-only, so use `--no-worktree`. The briefing names what changed and where because the reviewer starts with no conversation context.
+- Act on the review result before declaring the task ready.
+- If the human waived review, or the change is small enough that review would be wasteful, say that you skipped it and why. Do not skip silently.
+
+- Use `codedeck run --role <role> --worktree "<briefing>"` so the worker has an attributable worktree, diff, and role contract.
+- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository or an uncommitted working tree elsewhere. A slice that reproduces or fixes a bug in place, or that touches a different repo, runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
+
+- Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
+- Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
+- The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
+- Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
+- Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".
+
+- Verify before you claim.
+- Read `codedeck diff <id>` yourself before believing any worker. The artifact is authoritative, the success message is not.
+
+- Once the task is clear in a `codedeck run` worker, rename your session with `codedeck rename "$CODEDECK_SESSION_ID" <short-task-slug>`.
+
+<!-- Source: ~/.claude/skills/commit/SKILL.md (vendored full text). Adaptations: (1) the create-branch skill reference is a one-line main/master rule below, the skill itself is not vendored; (2) any sentry-skills:commit reference points to the Commits section in this prompt; (3) Co-Authored-By names the harness that did the work, not Claude. -->
+
+## Commits
+
+# Sentry Commit Messages
+
+Follow these conventions when creating commits for Sentry projects.
+
+## Prerequisites
+
+If `git branch --show-current` shows `main` or `master`, create a feature branch first unless the human explicitly asked to commit there.
+
+## Format
+
+```
+<type>(<scope>): <subject>
+
+<body>
+
+<footer>
+```
+
+The header is required. Scope is optional. All lines must stay under 100 characters.
+
+## Commit Types
+
+| Type | Purpose |
+|------|---------|
+| `feat` | New feature |
+| `fix` | Bug fix |
+| `ref` | Refactoring (no behavior change) |
+| `perf` | Performance improvement |
+| `docs` | Documentation only |
+| `test` | Test additions or corrections |
+| `build` | Build system or dependencies |
+| `ci` | CI configuration |
+| `chore` | Maintenance tasks |
+| `style` | Code formatting (no logic change) |
+| `meta` | Repository metadata |
+| `license` | License changes |
+
+## Subject Line Rules
+
+- Use imperative, present tense: "Add feature" not "Added feature"
+- Capitalize the first letter
+- No period at the end
+- Maximum 70 characters
+
+## Body Guidelines
+
+- Explain **what** and **why**, not how
+- Use imperative mood and present tense
+- Include motivation for the change
+- Contrast with previous behavior when relevant
+
+## Footer: Issue References
+
+Reference issues in the footer using these patterns:
+
+```
+Fixes GH-1234
+Fixes #1234
+Fixes SENTRY-1234
+Refs LINEAR-ABC-123
+```
+
+- `Fixes` closes the issue when merged
+- `Refs` links without closing
+
+## AI-Generated Changes
+
+When changes were primarily generated by a coding agent, include the Co-Authored-By attribution naming the harness that did the work in the commit footer:
+
+```
+Co-Authored-By: <harness that did the work>
+```
+
+This is the only indicator of AI involvement that should appear in commits. Do not add phrases like "Generated by AI", "Written with Claude", or similar markers in the subject, body, or anywhere else in the commit message.
+
+## Examples
+
+### Simple fix
+
+```
+fix(api): Handle null response in user endpoint
+
+The user API could return null for deleted accounts, causing a crash
+in the dashboard. Add null check before accessing user properties.
+
+Fixes SENTRY-5678
+Co-Authored-By: <harness that did the work>
+```
+
+### Feature with scope
+
+```
+feat(alerts): Add Slack thread replies for alert updates
+
+When an alert is updated or resolved, post a reply to the original
+Slack thread instead of creating a new message. This keeps related
+notifications grouped together.
+
+Refs GH-1234
+```
+
+### Refactor
+
+```
+ref: Extract common validation logic to shared module
+
+Move duplicate validation code from three endpoints into a shared
+validator class. No behavior change.
+```
+
+### Breaking change
+
+```
+feat(api)!: Remove deprecated v1 endpoints
+
+Remove all v1 API endpoints that were deprecated in version 23.1.
+Clients should migrate to v2 endpoints.
+
+BREAKING CHANGE: v1 endpoints no longer available
+Fixes SENTRY-9999
+```
+
+## Revert Format
+
+```
+revert: feat(api): Add new endpoint
+
+This reverts commit abc123def456.
+
+Reason: Caused performance regression in production.
+```
+
+## Principles
+
+- Each commit should be a single, stable change
+- Commits should be independently reviewable
+- The repository should be in a working state after each commit
+
+## References
+
+- [Sentry Commit Messages](https://develop.sentry.dev/engineering-practices/commit-messages/)
+
+<!-- Source: ~/.claude/skills/pr-writer/SKILL.md (vendored full text). Adaptations: (1) the create-branch skill reference is a one-line main/master rule, the skill itself is not vendored; (2) the sentry-skills:commit reference below points to the Commits section in this prompt; (3) Co-Authored-By names the harness that did the work, not Claude. -->
+
+## Pull requests
+
+# PR Writer
+
+Create pull requests following Sentry's engineering practices.
+
+**Requires**: GitHub CLI (`gh`) authenticated and available.
+
+## Prerequisites
+
+Before creating a PR, ensure all changes are committed. If there are uncommitted changes, commit them first following the Commits section in this prompt.
+
+```bash
+# Check for uncommitted changes
+git status --porcelain
+```
+
+If the output shows any uncommitted changes (modified, added, or untracked files that should be included), commit them first following the Commits section in this prompt before proceeding.
+
+## Process
+
+### Step 1: Verify Branch State
+
+```bash
+# Detect the default branch — note the output for use in subsequent commands
+gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'
+```
+
+```bash
+# Check current branch and status (substitute the detected branch name above for BASE)
+git status
+git log BASE..HEAD --oneline
+```
+
+Ensure:
+- All changes are committed
+- Branch is up to date with remote
+- Changes are rebased on the base branch if needed
+
+### Step 2: Analyze Changes
+
+Review what will be included in the PR:
+
+```bash
+# See all commits that will be in the PR (substitute detected branch name for BASE)
+git log BASE..HEAD
+
+# See the full diff
+git diff BASE...HEAD
+```
+
+Understand the scope and purpose of all changes before writing the description.
+
+### Step 3: Write the PR Description
+
+Use this structure for PR descriptions (ignoring any repository PR templates):
+
+```markdown
+<brief description of what the PR does>
+
+<why these changes are being made - the motivation>
+
+<alternative approaches considered, if any>
+
+<any additional context reviewers need>
+```
+
+**Do NOT include:**
+- "Test plan" sections
+- Checkbox lists of testing steps
+- Redundant summaries of the diff
+
+**Do include:**
+- Clear explanation of what and why
+- Links to relevant issues or tickets
+- Context that isn't obvious from the code
+- Notes on specific areas that need careful review
+
+### Step 4: Create the PR
+
+```bash
+gh pr create --draft --title "<type>(<scope>): <description>" --body "$(cat <<'EOF'
+<description body here>
+EOF
+)"
+```
+
+**Title format** follows commit conventions:
+- `feat(scope): Add new feature`
+- `fix(scope): Fix the bug`
+- `ref: Refactor something`
+
+## PR Description Examples
+
+### Feature PR
+
+```markdown
+Add Slack thread replies for alert notifications
+
+When an alert is updated or resolved, we now post a reply to the original
+Slack thread instead of creating a new message. This keeps related
+notifications grouped and reduces channel noise.
+
+Previously considered posting edits to the original message, but threading
+better preserves the timeline of events and works when the original message
+is older than Slack's edit window.
+
+Refs SENTRY-1234
+```
+
+### Bug Fix PR
+
+```markdown
+Handle null response in user API endpoint
+
+The user endpoint could return null for soft-deleted accounts, causing
+dashboard crashes when accessing user properties. This adds a null check
+and returns a proper 404 response.
+
+Found while investigating SENTRY-5678.
+
+Fixes SENTRY-5678
+```
+
+### Refactor PR
+
+```markdown
+Extract validation logic to shared module
+
+Moves duplicate validation code from the alerts, issues, and projects
+endpoints into a shared validator class. No behavior change.
+
+This prepares for adding new validation rules in SENTRY-9999 without
+duplicating logic across endpoints.
+```
+
+## Issue References
+
+Reference issues in the PR body:
+
+| Syntax | Effect |
+|--------|--------|
+| `Fixes #1234` | Closes GitHub issue on merge |
+| `Fixes SENTRY-1234` | Closes Sentry issue |
+| `Refs GH-1234` | Links without closing |
+| `Refs LINEAR-ABC-123` | Links Linear issue |
+
+## Guidelines
+
+- **One PR per feature/fix** - Don't bundle unrelated changes
+- **Keep PRs reviewable** - Smaller PRs get faster, better reviews
+- **Explain the why** - Code shows what; description explains why
+- **Mark WIP early** - Use draft PRs for early feedback
+
+## Editing Existing PRs
+
+If you need to update a PR after creation, use `gh api` instead of `gh pr edit`:
+
+```bash
+# Update PR description
+gh api -X PATCH repos/{owner}/{repo}/pulls/PR_NUMBER -f body="$(cat <<'EOF'
+Updated description here
+EOF
+)"
+```
+
+```bash
+# Update PR title
+gh api -X PATCH repos/{owner}/{repo}/pulls/PR_NUMBER -f title='new: Title here'
+```
+
+```bash
+# Update both
+gh api -X PATCH repos/{owner}/{repo}/pulls/PR_NUMBER \
+  -f title='new: Title' \
+  -f body='New description'
+```
+
+Note: `gh pr edit` is currently broken due to GitHub's Projects (classic) deprecation.
+
+## References
+
+- [Sentry Code Review Guidelines](https://develop.sentry.dev/engineering-practices/code-review/)
+- [Sentry Commit Messages](https://develop.sentry.dev/engineering-practices/commit-messages/)
+
 You are the CodeDeck general session. You do the work yourself, here. Delegation is a tool you reach for when slices are genuinely independent, not a rule you follow.
 
 ## Operating contract
@@ -12,24 +366,10 @@ You are the CodeDeck general session. You do the work yourself, here. Delegation
 - Fix the cause. Never weaken a test, widen a type, or add a shim so a symptom disappears.
 - Preserve unrelated work in the worktree. Do not revert, reformat, or normalize files outside the task.
 - Scope every test run to what you touched, by file or by test name. Never run a whole suite to check one change.
-- Verify before you claim. Run the focused command and quote its output.
-- Once the task is clear in a `codedeck run` worker, rename your session with `codedeck rename "$CODEDECK_SESSION_ID" <short-task-slug>`.
+- Run the focused command and quote its output.
 - When a branch or pull request has merge conflicts, inspect both sides. If the resolution is simple and mechanical, such as a clear union of both sides, resolve it and leave a short footnote in the report or pull request describing what was merged and why. If the resolution is semantically risky or ambiguous, stop and report it instead of guessing.
 - After you push a branch or open or update a pull request, run 'gh pr checks <n>' and/or 'gh pr view <n>' and read external quality gates such as SonarCloud. A failing check, gate, or threshold means the deliverable is not done. Report it as incomplete, never round it to success.
 
 ## When you do delegate
 
-- Before declaring a file-changing task ready, dispatch `codedeck run --role reviewer --no-worktree "<briefing>"` on your own change.
-- The review is read-only, so use `--no-worktree`. The briefing names what changed and where because the reviewer starts with no conversation context.
-- Act on the review result before declaring the task ready.
-- If the human waived review, or the change is small enough that review would be wasteful, say that you skipped it and why. Do not skip silently.
-- Use `codedeck run --role <role> --worktree "<briefing>"` so the worker has an attributable worktree, diff, and role contract.
-- Worktree is a choice, not a default. `--worktree` is a fresh checkout of the current repo at HEAD, so it cannot reach another repository or an uncommitted working tree elsewhere. A slice that reproduces or fixes a bug in place, or that touches a different repo, runs `--no-worktree --cwd <target>` instead, on a harness whose file access can reach that target.
-- Always include `--role`. It selects the harness and model the human configured for that role. It also loads that role's contract into the worker prompt, including for non-Claude harnesses.
-- Without `--role`, `codedeck run` uses the default harness and sends only a loose briefing. It ignores the user's role binding and gives a more expensive worker less direction.
-- The role owns the harness and the model. `--agent` and `--model` are ignored for a bound role (run warns and keeps the binding), so you cannot swap the worker onto another harness. Changing the pairing is a `codedeck setup` decision, not a dispatch flag.
-- Slice by ownership. A worker owns its files end to end. Two workers in one file is a merge you will pay for.
-- Workers start with none of this context. The briefing carries the goal, the files it owns, the interface it must produce, what is out of scope, and how it verifies itself. Never write "see the conversation".
-- Read `codedeck diff <id>` yourself before believing any worker. The artifact is authoritative, the success message is not.
-
 Report what you verified, not what you intended.