create-agdf 0.13.7 → 0.14.1

package/lib/runtime-check-consent/contract.js

@@ -0,0 +1,73 @@
+import { createHash } from "node:crypto";
+
+const OPERATIONS = Object.freeze([
+  "resolve-local-runtime",
+  "inspect-control-state",
+  "render-bounded-orientation",
+]);
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]));
+}
+
+export function validateRuntimeCheckCapability(capability) {
+  if (capability?.schemaVersion !== 1 || capability.capabilityId !== "automatic-runtime-checks") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: schema or capability id");
+  }
+  if (!Number.isInteger(capability.adapterContractVersion) || capability.adapterContractVersion < 1) {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: adapter contract version");
+  }
+  if (capability.entrypoint !== "runtime/agdf-session-check.js") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: fixed entrypoint required");
+  }
+  if (JSON.stringify(capability.operations) !== JSON.stringify(OPERATIONS)) {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: closed operation vocabulary required");
+  }
+  const constraints = capability.constraints ?? {};
+  if (constraints.arguments !== "forbidden" || constraints.filesystemWrites !== "forbidden"
+      || constraints.network !== "forbidden" || constraints.gateAuthority !== "none") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: read-only constraints required");
+  }
+  const surfaces = capability.surfaces ?? {};
+  if (surfaces.codex !== "native-hook-review" || surfaces.claude !== "exact-command-rule"
+      || surfaces.copilot !== "plugin-hook-review"
+      || surfaces.opencode !== "plugin-internal"
+      || surfaces["portable-skills"] !== "manual-external-required") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: surface contract");
+  }
+  return capability;
+}
+
+export function runtimeCheckCapabilityIdentity({ capability, surface, runtimeDigest, sourceDigest, command }) {
+  validateRuntimeCheckCapability(capability);
+  if (!["codex", "claude", "copilot", "opencode"].includes(surface)) throw new Error("AGDF_RUNTIME_CHECK_SURFACE_INVALID");
+  for (const [name, value] of Object.entries({ runtimeDigest, sourceDigest })) {
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) throw new Error(`AGDF_RUNTIME_CHECK_IDENTITY_INVALID: ${name}`);
+  }
+  if (typeof command !== "string" || !command.trim()) throw new Error("AGDF_RUNTIME_CHECK_IDENTITY_INVALID: command");
+  const payload = stable({
+    schema_version: 1,
+    surface,
+    capability,
+    runtime_digest: runtimeDigest,
+    source_digest: sourceDigest,
+    command: command.trim(),
+  });
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+
+export function fixedRuntimeCheckCommand(surface, pluginRoot, platform = process.platform) {
+  if (surface === "opencode") return "plugin:agdf:automatic-runtime-checks";
+  if (surface === "copilot") return 'node "${PLUGIN_ROOT}/runtime/agdf-session-check.js"';
+  if (surface === "codex" || surface === "claude") {
+    return platform === "win32"
+      ? "node \"$([Environment]::GetEnvironmentVariable('PLUGIN_ROOT') + [Environment]::GetEnvironmentVariable('CLAUDE_PLUGIN_ROOT'))\\runtime\\agdf-session-check.js\""
+      : "node \"${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT}}/runtime/agdf-session-check.js\"";
+  }
+  const normalizedRoot = platform === "win32" ? pluginRoot.replaceAll("/", "\\") : pluginRoot;
+  return `node \"${normalizedRoot}${platform === "win32" ? "\\" : "/"}runtime${platform === "win32" ? "\\" : "/"}agdf-session-check.js\"`;
+}
+
+export const runtimeCheckOperations = OPERATIONS;

package/lib/runtime-check-consent/coordinator.js

@@ -0,0 +1,38 @@
+export const RUNTIME_CHECK_DECISIONS = Object.freeze(["enable", "manual", "cancel"]);
+
+export function resolveRuntimeCheckDecision({ explicitValue, interactive = false, ask }) {
+  if (explicitValue !== undefined) {
+    if (!RUNTIME_CHECK_DECISIONS.includes(explicitValue)) throw new Error("AGDF_RUNTIME_CHECK_DECISION_INVALID");
+    return explicitValue;
+  }
+  if (!interactive || typeof ask !== "function") return "manual";
+  const answer = ask({
+    question: "Allow this AGDF installation to run narrow local read-only checks automatically?",
+    options: [...RUNTIME_CHECK_DECISIONS],
+    default: null,
+  });
+  if (!RUNTIME_CHECK_DECISIONS.includes(answer)) return "cancel";
+  return answer;
+}
+
+export function consentDisclosure(surface) {
+  const permissionOwner = surface === "codex" ? "Codex native hook trust"
+    : surface === "claude" ? "Claude Code user permission settings"
+    : surface === "copilot" ? "GitHub Copilot plugin hook review"
+    : "OpenCode plugin and explicit permission configuration";
+  return Object.freeze({
+    surface,
+    installation_scope: "global user installation",
+    runs: "one argument-free local session check",
+    when: "at session start",
+    executable: "runtime/agdf-session-check.js inside the installed AGDF runtime",
+    reads: "AGDF runtime identity and .agdf/control state in the current repository",
+    writes: "one AGDF-owned intent receipt and, only where supported, one exact host permission rule",
+    network: "none",
+    permission_owner: permissionOwner,
+    renewal: "material command, runtime, source, scope or adapter identity change requires renewed consent",
+    revocation: `npx --yes @agdf/cli@latest runtime-checks manual --surface ${surface}`,
+    gate_authority: "none",
+    choices: [...RUNTIME_CHECK_DECISIONS],
+  });
+}

package/lib/runtime-check-consent/service.js

@@ -0,0 +1,181 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { join } from "node:path";
+import process from "node:process";
+import { generatedRoot, pluginDefinition } from "../cli/runtime-context.js";
+import { defaultOpenCodeConfigDir, resolveOpenCodeInstalledPackage } from "../installers/opencode.js";
+import { defaultAgdfDataRoot } from "../installers/local-marketplace.js";
+import { digestNormalizedPluginSource } from "../runtime/plugin-provenance.js";
+import { fixedRuntimeCheckCommand, runtimeCheckCapabilityIdentity } from "./contract.js";
+import { consentDisclosure, resolveRuntimeCheckDecision } from "./coordinator.js";
+import { claudePermissionRule } from "./adapters.js";
+import { configureClaudeExactRuntimeRule, defaultClaudeSettingsPath, revokeClaudeRuntimeRule } from "./claude-settings.js";
+import { createRuntimeCheckReceipt, readRuntimeCheckReceipt, writeRuntimeCheckReceipt } from "./state.js";
+
+export { fixedRuntimeCheckCommand } from "./contract.js";
+
+export function prepareInstallConsent(surface, options = {}, adapters = {}) {
+  const explicit = options.runtimeChecksDecision;
+  const interactive = explicit === undefined && Boolean(adapters.interactive);
+  const answer = interactive ? adapters.ask?.(consentDisclosure(surface)) : undefined;
+  const decision = resolveRuntimeCheckDecision({ explicitValue: explicit ?? answer, interactive: false });
+  return { decision, persist: explicit !== undefined || interactive, disclosure: consentDisclosure(surface) };
+}
+
+function prospectiveRuntimeCheckIdentity(surface, platform = process.platform) {
+  if (surface === "opencode") {
+    const installed = resolveOpenCodeInstalledPackage(defaultOpenCodeConfigDir(), pluginDefinition.opencode.npmPackage);
+    if (!installed.loadable || !installed.digest) return null;
+    return runtimeCheckCapabilityIdentity({
+      capability: pluginDefinition.automaticRuntimeChecks,
+      surface,
+      runtimeDigest: installed.digest,
+      sourceDigest: installed.digest,
+      command: fixedRuntimeCheckCommand(surface, installed.root, platform),
+    });
+  }
+  if (!["codex", "claude", "copilot"].includes(surface)) return null;
+  const pluginRoot = join(generatedRoot, "plugins", "agdf");
+  let runtimeManifest;
+  try { runtimeManifest = JSON.parse(readFileSync(join(pluginRoot, "runtime", "runtime-manifest.json"), "utf8")); } catch { return null; }
+  if (!/^[a-f0-9]{64}$/.test(runtimeManifest?.digest ?? "")) return null;
+  const sourceDigest = digestNormalizedPluginSource(pluginRoot, pluginDefinition.version);
+  const command = fixedRuntimeCheckCommand(surface, pluginRoot, platform);
+  return runtimeCheckCapabilityIdentity({
+    capability: pluginDefinition.automaticRuntimeChecks,
+    surface,
+    runtimeDigest: runtimeManifest.digest,
+    sourceDigest,
+    command,
+  });
+}
+
+export function retainCurrentInstallConsent(surface, dataRoot = defaultAgdfDataRoot(), platform = process.platform) {
+  const capabilityIdentity = prospectiveRuntimeCheckIdentity(surface, platform);
+  if (!capabilityIdentity) return null;
+  const current = readRuntimeCheckReceipt(dataRoot, surface);
+  if (current.status !== "valid" || current.receipt.capability_identity !== capabilityIdentity) return null;
+  return {
+    decision: current.receipt.requested_state === "enabled" ? "enable" : "manual",
+    persist: false,
+    retained: true,
+    disclosure: consentDisclosure(surface),
+  };
+}
+
+export function persistInstallConsent({ surface, decision, installed, dataRoot, platform, claudeSettingsPath }) {
+  if (decision === "cancel") return { requested: "cancelled", effective: "cancelled", reason: "consent_not_provided", capability_identity: null, verification: "not_attempted", mutation: "none", rollback: "none" };
+  const runtimeDigest = installed?.runtimeDigest ?? installed?.digest;
+  if (!installed?.pluginRoot || !runtimeDigest || !installed?.sourceDigest) {
+    return { requested: decision === "enable" ? "enabled" : "manual", effective: "manual", reason: "host_permission_unverified", capability_identity: null, verification: "unavailable", mutation: "none", rollback: "none" };
+  }
+  const command = fixedRuntimeCheckCommand(surface, installed.pluginRoot, platform);
+  const capabilityIdentity = runtimeCheckCapabilityIdentity({
+    capability: pluginDefinition.automaticRuntimeChecks,
+    surface,
+    runtimeDigest,
+    sourceDigest: installed.sourceDigest,
+    command,
+  });
+  const receipt = createRuntimeCheckReceipt({ surface, decision, capabilityIdentity, command });
+  let configured = null;
+  let configurationReason = null;
+  if (surface === "claude" && decision === "enable") {
+    configured = configureClaudeExactRuntimeRule({
+      path: claudeSettingsPath ?? defaultClaudeSettingsPath(),
+      rule: claudePermissionRule({ platform: platform ?? process.platform, command }),
+    });
+    if (configured.status !== "configured") {
+      configurationReason = configured.reason;
+      configured = null;
+    }
+  }
+  try {
+    writeRuntimeCheckReceipt(dataRoot ?? defaultAgdfDataRoot(), receipt);
+  } catch (error) {
+    configured?.rollback();
+    throw error;
+  }
+  if (configurationReason) return { requested: "enabled", effective: "degraded", reason: configurationReason, capability_identity: capabilityIdentity, verification: "conflict", mutation: "receipt_written", rollback: "none" };
+  return {
+    requested: receipt.requested_state,
+    effective: receipt.requested_state === "manual" ? "manual" : "decision_required",
+    reason: receipt.requested_state === "manual" ? "consent_not_provided" : "host_permission_unverified",
+    capability_identity: capabilityIdentity,
+    verification: receipt.requested_state === "manual" ? "not_required" : "host_unverified",
+    mutation: surface === "claude" && decision === "enable" ? "exact_rule_and_receipt_written" : "receipt_written",
+    rollback: "none",
+  };
+}
+
+export function setRuntimeChecksManual({ dataRoot = defaultAgdfDataRoot(), surface, platform = process.platform, claudeSettingsPath }) {
+  const result = readRuntimeCheckReceipt(dataRoot, surface);
+  if (result.status === "receipt_missing") return { requested: "manual", effective: "manual", reason: "consent_not_provided", capability_identity: null, verification: "not_required", mutation: "none", rollback: "none", path: result.path };
+  if (result.status !== "valid") return { requested: "manual", effective: result.status, reason: result.status, capability_identity: null, verification: "unavailable", mutation: "none", rollback: "none", path: result.path };
+  if (surface === "claude" && result.receipt.requested_state === "enabled") {
+    revokeClaudeRuntimeRule({
+      path: claudeSettingsPath ?? defaultClaudeSettingsPath(),
+      rule: claudePermissionRule({ platform, command: result.receipt.command }),
+    });
+  }
+  const receipt = createRuntimeCheckReceipt({
+    surface,
+    decision: "manual",
+    capabilityIdentity: result.receipt.capability_identity,
+    command: result.receipt.command,
+  });
+  writeRuntimeCheckReceipt(dataRoot, receipt);
+  return {
+    requested: "manual",
+    effective: "manual",
+    reason: "consent_not_provided",
+    capability_identity: receipt.capability_identity,
+    verification: "not_required",
+    mutation: surface === "claude" ? "exact_owned_rule_removed" : "receipt_updated",
+    rollback: "none",
+    path: result.path,
+  };
+}
+
+export function runtimeCheckStatus(dataRoot = defaultAgdfDataRoot(), surface, platform = process.platform) {
+  const result = readRuntimeCheckReceipt(dataRoot, surface);
+  if (result.status !== "valid") return { requested: "unknown", effective: result.status, reason: result.status, capability_identity: null, verification: "unavailable", mutation: "none", rollback: "none", path: result.path };
+  const currentIdentity = prospectiveRuntimeCheckIdentity(surface, platform);
+  if (currentIdentity && currentIdentity !== result.receipt.capability_identity) {
+    return { requested: result.receipt.requested_state, effective: "renewal_required", reason: "capability_identity_changed", capability_identity: result.receipt.capability_identity, verification: "identity_mismatch", mutation: "none", rollback: "none", path: result.path };
+  }
+  return { requested: result.receipt.requested_state, effective: result.receipt.requested_state === "manual" ? "manual" : "decision_required", reason: result.receipt.requested_state === "manual" ? "consent_not_provided" : "host_permission_unverified", capability_identity: result.receipt.capability_identity, verification: result.receipt.requested_state === "manual" ? "not_required" : "host_unverified", mutation: "none", rollback: "none", path: result.path };
+}
+
+export function executeOpenCodeAutomaticRuntimeCheck({
+  directory = process.cwd(),
+  dataRoot = defaultAgdfDataRoot(),
+  packageRoot = fileURLToPath(new URL("../../", import.meta.url)),
+  run = spawnSync,
+  executable = process.platform === "win32" ? "node.exe" : "node",
+  statusResolver = runtimeCheckStatus,
+  entrypointExists = existsSync,
+} = {}) {
+  const status = statusResolver(dataRoot, "opencode");
+  if (status.requested !== "enabled" || status.effective !== "decision_required") {
+    return { ...status, ran: false, output: "" };
+  }
+  const entrypoint = join(packageRoot, "generated", "plugins", "agdf", "runtime", "agdf-session-check.js");
+  if (!entrypointExists(entrypoint)) {
+    return { ...status, effective: "unavailable", reason: "unsupported_host_capability", verification: "entrypoint_missing", ran: false, output: "" };
+  }
+  const child = run(executable, [entrypoint], {
+    cwd: directory,
+    env: { ...process.env, AGDF_SURFACE: "opencode" },
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 10000,
+    maxBuffer: 1024 * 1024,
+  });
+  const output = String(child.stdout || "").trim().slice(0, 20000);
+  if (child.status !== 0 || !output.includes("AGDF automatic runtime check:")) {
+    return { ...status, effective: "degraded", reason: "host_permission_unverified", verification: "execution_failed", ran: true, output: "" };
+  }
+  return { ...status, effective: "enabled", reason: "none", verification: "host_observed", ran: true, output };
+}

package/lib/runtime-check-consent/state.js

@@ -0,0 +1,90 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { renameSyncWithRetry } from "../fs-swap.js";
+
+export function runtimeCheckReceiptPath(dataRoot, surface) {
+  if (!["codex", "claude", "copilot", "opencode"].includes(surface)) throw new Error("AGDF_RUNTIME_CHECK_RECEIPT_SURFACE_INVALID");
+  return join(resolve(dataRoot), "runtime-checks", `${surface}.json`);
+}
+
+export function createRuntimeCheckReceipt({ surface, decision, capabilityIdentity, command }) {
+  if (!["codex", "claude", "copilot", "opencode"].includes(surface)) throw new Error("AGDF_RUNTIME_CHECK_RECEIPT_SURFACE_INVALID");
+  if (!["enable", "manual"].includes(decision)) throw new Error("AGDF_RUNTIME_CHECK_RECEIPT_DECISION_INVALID");
+  if (!/^[a-f0-9]{64}$/.test(capabilityIdentity)) throw new Error("AGDF_RUNTIME_CHECK_RECEIPT_IDENTITY_INVALID");
+  return Object.freeze({
+    schema_version: 1,
+    owner: "create-agdf",
+    capability_id: "automatic-runtime-checks",
+    surface,
+    requested_state: decision === "enable" ? "enabled" : "manual",
+    capability_identity: capabilityIdentity,
+    command,
+  });
+}
+
+export function validateRuntimeCheckReceipt(receipt) {
+  if (receipt?.schema_version !== 1 || receipt.owner !== "create-agdf"
+      || receipt.capability_id !== "automatic-runtime-checks") return { status: "receipt_unowned", receipt: null };
+  if (!["codex", "claude", "copilot", "opencode"].includes(receipt.surface)
+      || !["enabled", "manual"].includes(receipt.requested_state)
+      || !/^[a-f0-9]{64}$/.test(receipt.capability_identity)
+      || typeof receipt.command !== "string" || !receipt.command.trim()) {
+    return { status: "receipt_invalid", receipt: null };
+  }
+  return { status: "valid", receipt };
+}
+
+export function readRuntimeCheckReceipt(dataRoot, surface) {
+  const path = runtimeCheckReceiptPath(dataRoot, surface);
+  if (!existsSync(path)) return { status: "receipt_missing", receipt: null, path };
+  try {
+    const file = lstatSync(path);
+    if (!file.isFile() || file.isSymbolicLink()) return { status: "receipt_unowned", receipt: null, path };
+    return { ...validateRuntimeCheckReceipt(JSON.parse(readFileSync(path, "utf8"))), path };
+  } catch {
+    return { status: "receipt_invalid", receipt: null, path };
+  }
+}
+
+export function writeRuntimeCheckReceipt(dataRoot, receipt, adapters = {}) {
+  const validated = validateRuntimeCheckReceipt(receipt);
+  if (validated.status !== "valid") throw new Error(`AGDF_RUNTIME_CHECK_${validated.status.toUpperCase()}`);
+  const path = runtimeCheckReceiptPath(dataRoot, receipt.surface);
+  const parent = dirname(path);
+  const fs = {
+    mkdir: adapters.mkdir ?? mkdirSync,
+    write: adapters.write ?? writeFileSync,
+    rename: adapters.rename ?? renameSyncWithRetry,
+    remove: adapters.remove ?? rmSync,
+  };
+  fs.mkdir(parent, { recursive: true });
+  const parentStats = lstatSync(parent);
+  if (!parentStats.isDirectory() || parentStats.isSymbolicLink()) throw new Error("AGDF_RUNTIME_CHECK_RECEIPT_PARENT_UNOWNED");
+  const temp = `${path}.tmp-${process.pid}-${randomUUID()}`;
+  const backup = `${path}.bak-${process.pid}-${randomUUID()}`;
+  const hadPrevious = existsSync(path);
+  fs.write(temp, `${JSON.stringify(receipt, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+  try {
+    if (hadPrevious && process.platform === "win32") fs.rename(path, backup);
+    fs.rename(temp, path);
+    if (hadPrevious && process.platform === "win32") fs.remove(backup, { force: true });
+  } catch (error) {
+    try { fs.remove(temp, { force: true }); } catch {}
+    if (hadPrevious && process.platform === "win32" && existsSync(backup) && !existsSync(path)) fs.rename(backup, path);
+    throw error;
+  }
+  return path;
+}
+
+export function deriveRuntimeCheckState({ receiptResult, surface, capabilityIdentity, hostEvidence }) {
+  if (receiptResult.status !== "valid") return { requested: "unknown", effective: receiptResult.status, reason: receiptResult.status };
+  const receipt = receiptResult.receipt;
+  if (receipt.surface !== surface) return { requested: receipt.requested_state, effective: "renewal_required", reason: "installed_identity_mismatch" };
+  if (receipt.capability_identity !== capabilityIdentity) return { requested: receipt.requested_state, effective: "renewal_required", reason: "capability_identity_changed" };
+  if (receipt.requested_state === "manual") return { requested: "manual", effective: "manual", reason: "consent_not_provided" };
+  if (hostEvidence?.status === "enabled" && hostEvidence.capability_identity === capabilityIdentity) {
+    return { requested: "enabled", effective: "enabled", reason: "none" };
+  }
+  return { requested: "enabled", effective: hostEvidence?.status || "decision_required", reason: hostEvidence?.reason || "host_permission_unverified" };
+}

package/lib/scaffold/plan.js

@@ -1,11 +1,9 @@
-import { existsSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { generatedRoot, languageConfigContent, pluginDefinition } from "../cli/runtime-context.js";
 export { doctorRequiredFiles } from "../control-evaluation/required-files.js";
 
-export const agdfFragmentPath = "AGENTS.agdf.md";
 const codexSkillNames = pluginDefinition.skillSet.map((skill) => `${pluginDefinition.codex.skillPrefix}${skill.slug}`);
-const copilotSkillNames = pluginDefinition.skillSet.map((skill) => `${pluginDefinition.copilot.skillPrefix}${skill.slug}`);
 const globalOpenCodeSkillNames = pluginDefinition.skillSet.map((skill) => `${pluginDefinition.opencode.globalSkillPrefix}${skill.slug}`);
 const contractModules = [
   "gate-transition.md",
@@ -96,63 +94,11 @@ const artefactTemplateFiles = [
   join(".agdf", "control", "templates", "artefacts", "QA_REPORT.md"),
   join(".agdf", "control", "templates", "artefacts", "OR.md"),
 ];
-const copilotInstructionFiles = [
-  join(".github", "copilot-instructions.md"),
-  join(".github", "instructions", "agdf-governance.instructions.md"),
-];
-const copilotSkillFiles = [
-  join(".github", "skills", "README.md"),
-  join(".github", "skills", pluginDefinition.copilot.runtimeContractFileName),
-  ...contractModules.map((moduleName) => join(".github", "skills", "contracts", moduleName)),
-  ...copilotSkillNames.map((skillName) => join(".github", "skills", skillName, "SKILL.md")),
-];
 
 function loadAsset(relativePath) {
   return readFileSync(join(generatedRoot, relativePath), "utf8");
 }
 
-function isAgdfOwnedAgentsFile(content) {
-  return content.includes("## Surface Convention")
-    && content.includes("GitHub Copilot repository skills do not have a plugin namespace")
-    && content.includes("AGDF is agent-native first and CLI-verifiable by design");
-}
-
-function addCopilotAgentsFile(files, targetDir, force) {
-  const agentsPath = join(targetDir, "AGENTS.md");
-  if (!existsSync(agentsPath) || force) {
-    files.push({
-      path: "AGENTS.md",
-      content: loadAsset("AGENTS.md"),
-    });
-    return;
-  }
-
-  const existingAgents = readFileSync(agentsPath, "utf8");
-  if (isAgdfOwnedAgentsFile(existingAgents)) {
-    files.push({
-      path: "AGENTS.md",
-      content: loadAsset("AGENTS.md"),
-      allowOverwrite: true,
-      action: "refreshed",
-    });
-    return;
-  }
-
-  files.push({
-    path: agdfFragmentPath,
-    content: loadAsset("AGENTS.md"),
-    allowOverwrite: true,
-    action: "refreshed",
-    preserved: "AGENTS.md",
-  });
-}
-
-function shouldWriteLanguageConfig(target, targetDir, force) {
-  if (force) return true;
-  if ((target === "copilot" || target === "both") && existsSync(join(targetDir, ".agdf", "control", "config.json"))) return false;
-  return true;
-}
-
 function addLanguageConfig(files, languagePreference) {
   files.push({
     path: join(".agdf", "control", "config.json"),
@@ -196,8 +142,8 @@ export function generatedFilesForTarget(target, targetDir, force, languagePrefer
     return files;
   }
 
-  if (target === "codex-repo" || target === "both") {
-    if (shouldWriteLanguageConfig(target, targetDir, force)) addLanguageConfig(files, languagePreference);
+  if (target === "codex-repo") {
+    addLanguageConfig(files, languagePreference);
     for (const codexPath of codexPluginFiles) {
       files.push({
         path: codexPath,
@@ -206,38 +152,6 @@ export function generatedFilesForTarget(target, targetDir, force, languagePrefer
     }
   }
 
-  if (target === "copilot" || target === "both") {
-    if (target !== "both" && shouldWriteLanguageConfig(target, targetDir, force)) addLanguageConfig(files, languagePreference);
-    addCopilotAgentsFile(files, targetDir, force);
-
-    for (const controlPath of controlFiles) {
-      files.push({
-        path: controlPath,
-        content: loadAsset(controlPath),
-        allowOverwrite: true,
-        action: "refreshed",
-      });
-    }
-
-    for (const instructionPath of copilotInstructionFiles) {
-      files.push({
-        path: instructionPath,
-        content: loadAsset(instructionPath),
-        allowOverwrite: true,
-        action: "refreshed",
-      });
-    }
-
-    for (const skillPath of copilotSkillFiles) {
-      files.push({
-        path: skillPath,
-        content: loadAsset(skillPath),
-        allowOverwrite: true,
-        action: "refreshed",
-      });
-    }
-  }
-
   if (target === "opencode-repo") {
     addLanguageConfig(files, languagePreference);
     for (const controlPath of controlFiles) {

package/lib/scaffold/presentation.js

@@ -3,12 +3,9 @@ import { join } from "node:path";
 import { pluginDefinition } from "../cli/runtime-context.js";
 import { printLifecycleResult } from "../lifecycle/presentation.js";
 import { createLifecycleResult } from "../lifecycle/result.js";
-import { agdfFragmentPath } from "./plan.js";
 
-const pluginInstallCommand = "npx --yes @agdf/cli@latest claude";
-
-export function printNextSteps(target, destination, files, wroteAgentsFragment, removedOpenCodeAgents = [], { verbose = false, json = false, io = console } = {}) {
-  const repositorySurface = { "codex-repo": "codex", "opencode-repo": "opencode", copilot: "copilot" }[target];
+export function printNextSteps(target, destination, files, removedOpenCodeAgents = [], { verbose = false, json = false, io = console } = {}) {
+  const repositorySurface = { "codex-repo": "codex", "opencode-repo": "opencode" }[target];
   const verified = files.every((file) => {
     const path = join(destination, file.path);
     return existsSync(path) && readFileSync(path, "utf8") === file.content;
@@ -16,9 +13,7 @@ export function printNextSteps(target, destination, files, wroteAgentsFragment,
   if (repositorySurface) {
     const nextAction = repositorySurface === "codex"
       ? "Restart Codex, open /plugins, select This repository and install agdf; then start a new task with: Run an AGDF gate check for this request."
-      : repositorySurface === "opencode"
-        ? "Restart OpenCode in this repository so the global AGDF plugin observes the durable control configuration."
-        : "Run /instructions in GitHub Copilot CLI to confirm that the generated AGDF repository instructions are visible.";
+      : "Restart OpenCode in this repository so the global AGDF plugin observes the durable control configuration.";
     printLifecycleResult(createLifecycleResult({
       operation: "repository_setup",
       result: verified ? "success" : "partial",
@@ -79,25 +74,11 @@ export function printNextSteps(target, destination, files, wroteAgentsFragment,
     io.log("- Run the installed `agdf doctor` when this repository also uses durable AGDF control state.");
     return;
   }
-  if (wroteAgentsFragment) {
-    io.log(`- Existing AGENTS.md detected. Merge ${agdfFragmentPath} into your current AGENTS.md before using Copilot with AGDF.`);
-  }
-  if (target === "both") {
-    io.log("- Restart Codex in this repository, open /plugins, select This repository and install agdf.");
-    io.log("- Start a new Codex thread in this repository and ask: Run an AGDF gate check for this request.");
-  }
-  if (target === "both") {
-    io.log(`- Optional global Claude Code install: ${pluginInstallCommand}`);
-  }
   if (target === "opencode-repo") {
     io.log("- Install the global OpenCode surface once with npx --yes @agdf/cli@latest opencode if it is not already installed.");
     io.log("- Start or restart OpenCode in this repository; valid .agdf/control/config.json activates the global AGDF runtime here.");
     io.log("- Load agdf-global-gate-check through OpenCode's native skill tool for new build/change intent or unclear approval before later artefacts or implementation.");
     io.log("- Existing .opencode files are left untouched as a compatibility path; this command does not copy a second runtime surface.");
   }
-  if (target === "copilot" || target === "both") {
-    io.log("- In GitHub Copilot CLI, run /instructions after the AGENTS.md step is complete to confirm that AGDF instructions and the repository skills are visible.");
-    io.log("- Run npx --yes @agdf/cli@latest init when the repository needs live AGDF control files.");
-  }
   io.log("- Commit the generated files so the repository becomes the source of truth.");
 }

package/opencode-plugin.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { evaluateOpenCodeRepositoryActivation } from "./lib/installers/opencode-activation.js";
+import { executeOpenCodeAutomaticRuntimeCheck } from "./lib/runtime-check-consent/service.js";
 
 const packageJson = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8"));
 
@@ -15,7 +16,7 @@ const readValidatorExpectedVersion = () => {
   }
 };
 
-export const AGDFPlugin = async ({ directory, client }) => {
+export const AGDFPlugin = async ({ directory, client }, dependencies = {}) => {
   const controlDir = `${directory}/.agdf/control`;
   const activation = () => evaluateOpenCodeRepositoryActivation(directory);
   const status = () => {
@@ -45,13 +46,11 @@ export const AGDFPlugin = async ({ directory, client }) => {
   const appendGuidance = async (output, key) => {
     if (!output || !Array.isArray(output[key])) {
       try {
-        await client.app.log({
-          body: {
-            service: "agdf",
-            level: "warn",
-            message: `AGDF OpenCode guidance degraded: ${key} output is unavailable`,
-            extra: { key, repositoryActivation: activation().state },
-          },
+        await safeLog({
+          service: "agdf",
+          level: "warn",
+          message: `AGDF OpenCode guidance degraded: ${key} output is unavailable`,
+          extra: { key, repositoryActivation: activation().state },
         });
       } catch {}
       return;
@@ -65,17 +64,31 @@ export const AGDFPlugin = async ({ directory, client }) => {
     } catch {}
   };
 
+  const safeLog = async (body) => {
+    try {
+      const response = await client?.app?.log?.({ body });
+      if (response?.error) await client?.app?.log?.(body);
+    } catch {
+      try { await client?.app?.log?.(body); } catch {}
+    }
+  };
+
+  let automaticCheck;
+  const currentAutomaticCheck = () => {
+    automaticCheck ??= (dependencies.executeAutomaticRuntimeCheck ?? executeOpenCodeAutomaticRuntimeCheck)({ directory });
+    return automaticCheck;
+  };
+
   return {
     event: async ({ event }) => {
       if (event?.type === "session.created") {
         const currentStatus = status();
-        await client.app.log({
-          body: {
-            service: "agdf",
-            level: "info",
-            message: currentStatus.active ? "AGDF OpenCode active through durable control" : "AGDF OpenCode global hook active without durable control",
-            extra: currentStatus,
-          },
+        const runtimeCheck = currentAutomaticCheck();
+        await safeLog({
+          service: "agdf",
+          level: "info",
+          message: currentStatus.active ? "AGDF OpenCode active through durable control" : "AGDF OpenCode global hook active without durable control",
+          extra: { ...currentStatus, automatic_runtime_check: { effective: runtimeCheck.effective, reason: runtimeCheck.reason, ran: runtimeCheck.ran } },
         });
         if (!currentStatus.active) {
           await safeToast(
@@ -112,6 +125,8 @@ export const AGDFPlugin = async ({ directory, client }) => {
 
     "experimental.chat.system.transform": async (_input, output) => {
       await appendGuidance(output, "system");
+      const runtimeCheck = currentAutomaticCheck();
+      if (runtimeCheck.ran && runtimeCheck.output && Array.isArray(output?.system)) output.system.push(runtimeCheck.output);
     },
 
     "experimental.session.compacting": async (_input, output) => {