create-agdf 0.14.4 → 0.20.0

package/lib/cli/application.js

@@ -1,15 +1,15 @@
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 import process from "node:process";
 import {
-  createRun,
   migrateLegacy,
   resolveRuns,
   writeLegacyProjection,
-} from "../control-state/index.js";
+} from "#agdf-core/control-state/index.js";
 import {
   defaultOpenCodeConfigDir,
+  evaluateOpenCodeGlobalStatus,
   evaluateOpenCodeStatus,
   installOpenCodeGlobalPlugin,
   installOpenCodeGlobalSurface,
@@ -19,7 +19,9 @@ import {
   installClaudeGlobalPlugin,
   installCopilotGlobalPlugin,
   installCodexGlobalPlugin,
+  preflightClaudeInstall,
 } from "../installers/plugin-installers.js";
+import { defaultCopilotSettingsPath } from "../installers/copilot-settings.js";
 import {
   applyLifecyclePlan,
   planGlobalUninstall,
@@ -28,36 +30,102 @@ import {
   verifyRepositoryDisabled,
 } from "../lifecycle/operations.js";
 import { printGeneralStatus, printLifecycleResult } from "../lifecycle/presentation.js";
-import { createLifecycleResult, globalInstallRestartAction, lifecycleFailure } from "../lifecycle/result.js";
+import { createLifecycleResult, createOperationStatus, globalInstallRestartAction, lifecycleFailure } from "../lifecycle/result.js";
+import { defaultClaudeSettingsPath } from "../runtime-check-consent/claude-settings.js";
 import { prepareInstallConsent, persistInstallConsent, retainCurrentInstallConsent, runtimeCheckStatus, setRuntimeChecksManual } from "../runtime-check-consent/service.js";
-import { evaluateGeneralStatus } from "../lifecycle/status.js";
+import { observeCodexHooks } from "../runtime-check-consent/codex-hooks.js";
+import { approveCodexDispatcher, revokeCodexDispatcher } from "../runtime-check-consent/codex-plugin-consent.js";
+import { projectCodexHookObservation } from "../runtime-check-consent/adapters.js";
+import { evaluateStatusOverview, inspectGlobalInstallationStatus } from "../lifecycle/status.js";
 import { generatedFilesForTarget } from "../scaffold/plan.js";
+import { initializeCanonicalControl } from "../scaffold/canonical-init.js";
 import { printNextSteps } from "../scaffold/presentation.js";
 import { assertGeneratedWritePlan, writeGeneratedFile } from "../scaffold/write.js";
 import { renderUsage, resolveCommand, validateCommandOptions } from "./command-registry.js";
 import { CliUsageError, parseArgs } from "./parse-args.js";
 import { pluginDefinition } from "./runtime-context.js";
 import { createValidationHandlers } from "./validation-handlers.js";
+import { printMcpLifecycleResult, runMcpLifecycle } from "../mcp-lifecycle/service.js";
+import { promptControlMigration, promptControlRepair, promptInstallScope, promptInstallSetup } from "../install-setup/interaction.js";
+import {
+  printInstallSetupResult,
+  renderInstallProgress,
+  renderLoadedSessionsNotice,
+  renderRuntimeCheckConsentDetails,
+  renderRuntimeCheckConsentDisclosure,
+  runtimeCheckInteractionCopy,
+} from "../install-setup/presentation.js";
+import { runInstallSetup } from "../install-setup/service.js";
 
-function createHandlers({ io, env, exec, packagedCopilotExec, prepare, openCodePackageSource, copilotSettingsPath, askRuntimeCheckDecision, interactive }) {
+function createHandlers({
+  io,
+  env,
+  exec,
+  packagedCopilotExec,
+  prepare,
+  preflightClaudeInstall: preflightClaude,
+  openCodePackageSource,
+  copilotSettingsPath,
+  askInstallSetupDecision,
+  askInstallSetupScope,
+  askRuntimeCheckDecision,
+  askControlMigration,
+  askControlRepair,
+  askControlRepairConfirmation,
+  inspectPluginInstallation,
+  interactive,
+  observeCodexHookTrust = observeCodexHooks,
+  approveCodexPluginDispatcher = approveCodexDispatcher,
+  revokeCodexPluginDispatcher = revokeCodexDispatcher,
+  evaluateStatus = evaluateStatusOverview,
+  evaluateOpenCodeGlobal = evaluateOpenCodeGlobalStatus,
+  evaluateOpenCodeRepository = evaluateOpenCodeStatus,
+  installOpenCodePackage = installOpenCodeGlobalPlugin,
+  installOpenCodeSurface = installOpenCodeGlobalSurface,
+  mcpLifecycle = runMcpLifecycle,
+}) {
   const installerAdapters = {
     ...(exec ? { exec } : {}),
     ...(packagedCopilotExec ? { packagedCopilotExec } : {}),
     ...(prepare ? { prepare } : {}),
-    ...(copilotSettingsPath ? { copilotSettingsPath } : {}),
+    ...(preflightClaude ? { preflight: preflightClaude } : {}),
+    copilotSettingsPath: copilotSettingsPath ?? defaultCopilotSettingsPath({ env }),
+    env,
     ...(env.AGDF_DATA_DIR ? { dataRoot: env.AGDF_DATA_DIR } : {}),
   };
   const scaffoldHandler = (options) => runScaffold(options, io);
+  const observeRuntimeChecks = async (surface, state, cwd) => {
+    if (surface !== "codex" || state.requested !== "enabled" || state.effective !== "decision_required") return state;
+    const observation = await observeCodexHookTrust({ cwd, env });
+    return projectCodexHookObservation(state, observation);
+  };
+  const guidedInstall = (options) => runGuidedInstall(options, {
+    io,
+    env,
+    interactive,
+    installerAdapters,
+    openCodePackageSource,
+    askInstallSetupDecision,
+    askInstallSetupScope,
+    askRuntimeCheckDecision,
+    askControlMigration,
+    askControlRepair,
+    askControlRepairConfirmation,
+    observeRuntimeChecks,
+    approveCodexPluginDispatcher,
+    evaluateOpenCodeGlobal,
+    installOpenCodePackage,
+    installOpenCodeSurface,
+    mcpLifecycle,
+    exec,
+    inspectPluginInstallation,
+  });
   return new Map([
     ...createValidationHandlers(io),
     ["codex-repo", scaffoldHandler],
     ["opencode-repo", scaffoldHandler],
     ["init", scaffoldHandler],
     ["config", scaffoldHandler],
-    ["run-create", (options) => {
-      io.log(createRun(options.dir, options.runId));
-      return 0;
-    }],
     ["run-migrate", (options) => {
       io.log(JSON.stringify(migrateLegacy(options.dir, options.runId), null, 2));
       return 0;
@@ -71,200 +139,320 @@ function createHandlers({ io, env, exec, packagedCopilotExec, prepare, openCodeP
     }],
     ["opencode-status", (options) => {
       const configDir = env.OPENCODE_CONFIG_DIR || defaultOpenCodeConfigDir();
-      const report = evaluateOpenCodeStatus(options.dir, configDir);
+      const rawReport = options.dirExplicit
+        ? evaluateOpenCodeRepository(options.dir, configDir)
+        : evaluateOpenCodeGlobal(configDir);
+      const installationEnvelope = installationEnvelopeForOpenCode(rawReport, configDir);
+      const report = options.dirExplicit
+        ? {
+            ...withOpenCodeRepositoryStatusEnvelope(rawReport, options.dir),
+            installation_status: installationEnvelope.installation_status,
+          }
+        : {
+            ...rawReport,
+            ...installationEnvelope,
+          };
       printOpenCodeStatus(report, options.json, io);
-      return report.status === "configured" ? 0 : 1;
+      return report.installation_status === "healthy" ? 0 : 1;
     }],
-    ["status", (options) => {
-      const report = evaluateGeneralStatus(options.dir, {
+    ["status", async (options) => {
+      let report = evaluateStatus({
         ...options,
+        targetDir: options.dirExplicit ? options.dir : null,
         configDir: env.OPENCODE_CONFIG_DIR || defaultOpenCodeConfigDir(),
         dataRoot: env.AGDF_DATA_DIR,
       }, { exec });
+      const runtimeChecks = await observeRuntimeChecks(report.installation.surface, report.runtime_checks, options.dir);
+      let mcp = { status: "not_checked", authorizes: false };
+      if (options.dirExplicit && ["codex", "claude", "copilot", "opencode"].includes(options.surface)) {
+        mcp = mcpLifecycle({
+          action: "status",
+          surface: options.surface,
+          scope: options.scope ?? "project",
+          target: options.dir,
+          env,
+          exec,
+        });
+      }
+      report = { ...report, runtime_checks: runtimeChecks, mcp };
       printGeneralStatus(report, { json: options.json, io });
       return report.installation.status === "healthy" ? 0 : 1;
     }],
-    ["runtime-checks", (options) => {
-      const report = options.runtimeChecksAction === "manual"
-        ? setRuntimeChecksManual({ dataRoot: env.AGDF_DATA_DIR, surface: options.surface })
+    ["runtime-checks", async (options) => {
+      let runtimeState = options.runtimeChecksAction === "manual"
+        ? setRuntimeChecksManual({ dataRoot: env.AGDF_DATA_DIR, surface: options.surface, claudeSettingsPath: defaultClaudeSettingsPath({ env }) })
         : runtimeCheckStatus(env.AGDF_DATA_DIR, options.surface);
-      if (options.runtimeChecksAction === "enable") {
-        report.next_action = `Rerun npx --yes @agdf/cli@latest ${options.surface} --runtime-checks ${options.runtimeChecksAction}; installation ownership and capability identity are revalidated before consent is persisted.`;
-      }
+      runtimeState = await observeRuntimeChecks(options.surface, runtimeState, options.dir);
+      const nextActionText = options.runtimeChecksAction === "enable"
+        ? `Rerun npx --yes @agdf/cli@latest ${options.surface} --runtime-checks ${options.runtimeChecksAction}; installation ownership and capability identity are revalidated before consent is persisted.`
+        : runtimeState.next_action || (runtimeState.effective === "manual" || runtimeState.effective === "enabled"
+          ? "No further runtime-check action is required."
+          : `Review the runtime-check state, then rerun runtime-checks for ${options.surface}.`);
+      const report = {
+        schema_version: 1,
+        ...runtimeState,
+        operation_status: createOperationStatus({
+          operationId: "runtime.checks",
+          outcome: options.runtimeChecksAction === "manual" ? "succeeded" : "reported",
+          targetScope: "global",
+          plannedEffect: options.runtimeChecksAction === "manual" ? "set_runtime_checks_manual" : "read_only_status",
+          excludedAuthority: ["target_inference", "run_creation", "gate_approval", "delivery_mutation"],
+        }),
+        next_action: { kind: "runtime_checks", text: nextActionText },
+      };
       io.log(options.json ? JSON.stringify(report, null, 2) : [
         "AGDF automatic runtime checks",
+        `Operation: ${report.operation_status.operation_id}`,
+        `Outcome: ${report.operation_status.outcome}`,
         `Requested: ${report.requested}`,
         `Effective: ${report.effective}`,
         `Reason: ${report.reason}`,
-        ...(report.next_action ? [`Next action: ${report.next_action}`] : []),
+        `Next action: ${report.next_action.text}`,
       ].join("\n"));
       return report.effective === "enabled" || report.effective === "manual" ? 0 : 1;
     }],
-    ["disable", (options) => runDisable(options, { io, exec })],
-    ["uninstall", (options) => runUninstall(options, { io, env, exec })],
-    ["codex", async (options) => {
-      try {
-        const consent = await installConsentDecision("codex", options, { io, askRuntimeCheckDecision, interactive, dataRoot: installerAdapters.dataRoot });
-        if (consent.decision === "cancel") return printCancelledConsent("codex", options, io);
-        printInstallProgress("codex", options, io, interactive);
-        const installed = installCodexGlobalPlugin(installerAdapters);
-        const finalizedConsent = finalizeInstallConsent(consent, { surface: "codex", installed, dataRoot: installerAdapters.dataRoot });
-        printLifecycleResult(installResult(installed, {
-          restartRequired: true,
-          nextAction: installNextAction("codex", finalizedConsent.state, globalInstallRestartAction(options.target).text),
-          runtimeChecks: finalizedConsent.state,
-          consentFailure: finalizedConsent.failure,
-        }), { json: options.json, compact: !options.verbose, io });
-        printVerboseHostOutput(installed, options, io);
-        return 0;
-      } catch (error) {
-        printInstallFailure(options.target, error, options, io);
-        return 1;
-      }
-    }],
-    ["claude", async (options) => {
-      try {
-        const consent = await installConsentDecision("claude", options, { io, askRuntimeCheckDecision, interactive, dataRoot: installerAdapters.dataRoot });
-        if (consent.decision === "cancel") return printCancelledConsent("claude", options, io);
-        printInstallProgress("claude", options, io, interactive);
-        const installed = installClaudeGlobalPlugin(installerAdapters);
-        const finalizedConsent = finalizeInstallConsent(consent, { surface: "claude", installed, dataRoot: installerAdapters.dataRoot });
-        printLifecycleResult(installResult(installed, {
-          restartRequired: true,
-          nextAction: globalInstallRestartAction(options.target).text,
-          runtimeChecks: finalizedConsent.state,
-          consentFailure: finalizedConsent.failure,
-        }), { json: options.json, compact: !options.verbose, io });
-        printVerboseHostOutput(installed, options, io);
-        return 0;
-      } catch (error) {
-        printInstallFailure(options.target, error, options, io);
-        return 1;
-      }
-    }],
-    ["copilot", async (options) => {
-      const surface = "copilot";
-      try {
-        const consent = await installConsentDecision(surface, options, { io, askRuntimeCheckDecision, interactive, dataRoot: installerAdapters.dataRoot });
-        if (consent.decision === "cancel") return printCancelledConsent(surface, options, io);
-        printInstallProgress(surface, options, io, interactive);
-        const installed = installCopilotGlobalPlugin({
-          ...installerAdapters,
-        });
-        const finalizedConsent = finalizeInstallConsent(consent, { surface, installed, dataRoot: installerAdapters.dataRoot });
-        if (installed.declarativeConfigured) {
-          printLifecycleResult(createLifecycleResult({
-            operation: "install", result: "partial", surface, scope: "global",
-            version: { expected: installed.expectedVersion, installed: null, status: "unknown" },
-            verification: { status: "configured_pending_restart", evidence: installed.evidence },
-            installation: { status: "configured_pending_restart" },
-            activation: { status: "pending_restart" },
-            runtime_checks: finalizedConsent.state,
-            restart: { required: true, reason: "host_reload" },
-            next_action: { kind: "restart", text: "Restart GitHub Copilot. Then verify AGDF in Plugins and the agdf- skills in a fresh session." },
-          }), { json: options.json, compact: !options.verbose, io });
-          return 0;
-        }
-        if (installed.manualHandoff) {
-          printLifecycleResult(createLifecycleResult({
-            operation: "install", result: "partial", surface, scope: "global",
-            version: { expected: installed.expectedVersion, installed: null, status: "unknown" },
-            verification: { status: "unavailable", evidence: installed.evidence },
-            installation: { status: "not_verified" },
-            activation: { status: "not_verified" },
-            runtime_checks: finalizedConsent.state,
-            restart: { required: false, reason: "none" },
-            next_action: { kind: "manual_install", text: `In GitHub Copilot, run /plugins install ${installed.pluginRoot}. Then run /restart and verify /plugins list and /skills list.` },
-            failure: { phase: "executable", message: "Copilot CLI was not available; no plugin installation was performed." },
-          }), { json: options.json, compact: !options.verbose, io });
-          return 1;
-        }
-        printLifecycleResult(installResult(installed, {
-          restartRequired: true,
-          nextAction: installNextAction(surface, finalizedConsent.state, globalInstallRestartAction(surface).text),
-          runtimeChecks: finalizedConsent.state,
-          consentFailure: finalizedConsent.failure,
-        }), { json: options.json, compact: !options.verbose, io });
-        printVerboseHostOutput(installed, options, io);
-        return installed.verificationStatus === "healthy" ? 0 : 1;
-      } catch (error) {
-        printInstallFailure(surface, error, options, io, "copilot");
-        return 1;
-      }
+    ["mcp", (options) => {
+      const report = mcpLifecycle({
+        action: options.mcpAction,
+        surface: options.surface,
+        scope: options.scope ?? "project",
+        target: options.dir,
+        ...(options.retireCockpit || options.restoreCockpit ? { retireCockpit: options.retireCockpit,
+          restoreCockpit: options.restoreCockpit, cockpitEvidence: options.stepFields.evidence } : {}),
+        env,
+        exec,
+      });
+      printMcpLifecycleResult(report, { json: options.json, io, language: options.language?.chat_language ?? "en" });
+      return ["failed", "degraded"].includes(report.result)
+        || ["manual_compatible", "unavailable", "unsupported"].includes(report.capability) ? 1 : 0;
     }],
-    ["opencode", async (options) => {
-      const configDir = options.dirExplicit ? options.dir : defaultOpenCodeConfigDir();
-      try {
-        const consent = await installConsentDecision("opencode", options, { io, askRuntimeCheckDecision, interactive, dataRoot: installerAdapters.dataRoot });
-        if (consent.decision === "cancel") return printCancelledConsent("opencode", options, io);
-        printInstallProgress("opencode", options, io, interactive);
-        const result = runLifecyclePhase("plugin_operation", () => installOpenCodeGlobalPlugin(configDir, { packageSource: openCodePackageSource }));
-        runLifecyclePhase("global_surface", () => installOpenCodeGlobalSurface(configDir));
-        const report = runLifecyclePhase("verification", () => evaluateOpenCodeStatus(options.dir, configDir, result.transition));
-        const alignmentHealthy = ["already_matching", "aligned"].includes(result.sdk_alignment.status);
-        const verificationHealthy = report.status === "configured"
-          && report.package.version_status === "current"
-          && report.global_native_surface.complete
-          && report.experimental_hooks.aggregate === "declared_supported"
-          && report.host_sdk_version.status === "matching"
-          && alignmentHealthy;
-        const nextAction = verificationHealthy
-          ? globalInstallRestartAction(options.target)
-          : {
-              kind: "recovery",
-              text: `Retry the OpenCode installation to align @opencode-ai/plugin to ${result.sdk_alignment.target_version || "the exact host version"}; observed SDK: ${result.sdk_alignment.installed_version || "unknown"}.`,
-            };
-        const finalizedConsent = finalizeInstallConsent(consent, {
-              surface: "opencode",
-              installed: {
-                pluginRoot: result.installed_package.root,
-                digest: result.installed_package.digest,
-                sourceDigest: result.package_source.digest || result.installed_package.digest,
-              },
-              dataRoot: installerAdapters.dataRoot,
-            });
-        printLifecycleResult(createLifecycleResult({
-          operation: result.transition.status === "updated" ? "update" : "install",
-          result: verificationHealthy && !finalizedConsent.failure ? "success" : "partial",
+    ["disable", (options) => options.setupRequest === "full"
+      ? runCoupledDisable(options, { io, env, exec, mcpLifecycle })
+      : runDisable(options, { io, exec })],
+    ["uninstall", (options) => options.setupRequest === "full"
+      ? runCoupledUninstall(options, { io, env, exec, mcpLifecycle, revokeCodexPolicy: revokeCodexPluginDispatcher })
+      : runUninstall(options, { io, env, exec, revokeCodexPolicy: revokeCodexPluginDispatcher })],
+    ["codex", guidedInstall],
+    ["claude", guidedInstall],
+    ["copilot", guidedInstall],
+    ["opencode", guidedInstall],
+  ]);
+}
+
+function pluginInstallFailure(surface, error) {
+  return lifecycleFailure({
+    operation: "install",
+    surface,
+    scope: "global",
+    phase: error.phase || "plugin_operation",
+    message: error.message,
+    evidence: failureEvidenceEntries(error.evidence),
+    nextAction: `Resolve the ${error.phase || "plugin operation"} failure and retry the same installation command.`,
+  });
+}
+
+function copilotInstallReport(installed, runtimeChecks) {
+  if (installed.declarativeConfigured) {
+    return createLifecycleResult({
+      operation: "install", result: "partial", surface: "copilot", scope: "global",
+      version: { expected: installed.expectedVersion, installed: null, status: "unknown" },
+      verification: { status: "configured_pending_restart", evidence: installed.evidence },
+      installation: { status: "configured_pending_restart" },
+      activation: { status: "pending_restart" },
+      runtime_checks: runtimeChecks,
+      restart: { required: true, reason: "host_reload" },
+      next_action: { kind: "restart", text: "Restart GitHub Copilot. Then verify AGDF in Plugins and the agdf- skills in a fresh session." },
+    });
+  }
+  if (installed.manualHandoff) {
+    return createLifecycleResult({
+      operation: "install", result: "partial", surface: "copilot", scope: "global",
+      version: { expected: installed.expectedVersion, installed: null, status: "unknown" },
+      verification: { status: "unavailable", evidence: installed.evidence },
+      installation: { status: "not_verified" },
+      activation: { status: "not_verified" },
+      runtime_checks: runtimeChecks,
+      restart: { required: false, reason: "none" },
+      next_action: { kind: "manual_install", text: "Install the Copilot CLI, then retry the AGDF Copilot installer. The prepared package is retained." },
+      failure: { phase: "executable", message: "Copilot CLI was not available; no plugin installation was performed." },
+    });
+  }
+  return installResult(installed, {
+    restartRequired: true,
+    nextAction: globalInstallRestartAction("copilot").text,
+    runtimeChecks,
+    consentFailure: null,
+  });
+}
+
+function installOpenCodePluginPayload(configDir, consent, {
+  openCodePackageSource,
+  installOpenCodePackage,
+  installOpenCodeSurface,
+  evaluateOpenCodeGlobal,
+}) {
+  const installedPackage = runLifecyclePhase("plugin_operation", () => installOpenCodePackage(configDir, { packageSource: openCodePackageSource }));
+  runLifecyclePhase("global_surface", () => installOpenCodeSurface(configDir));
+  const globalReport = runLifecyclePhase("verification", () => evaluateOpenCodeGlobal(configDir));
+  const report = {
+    ...globalReport,
+    package: { ...globalReport.package, transition: installedPackage.transition },
+  };
+  const alignmentHealthy = ["already_matching", "aligned"].includes(installedPackage.sdk_alignment.status);
+  const verificationHealthy = report.status === "configured"
+    && report.package.version_status === "current"
+    && report.global_native_surface.complete
+    && report.experimental_hooks.aggregate === "declared_supported"
+    && report.host_sdk_version.status === "matching"
+    && alignmentHealthy;
+  const nextAction = verificationHealthy
+    ? globalInstallRestartAction("opencode")
+    : {
+        kind: "recovery",
+        text: `Retry the OpenCode installation to align @opencode-ai/plugin to ${installedPackage.sdk_alignment.target_version || "the exact host version"}; observed SDK: ${installedPackage.sdk_alignment.installed_version || "unknown"}.`,
+      };
+  const lifecycleReport = createLifecycleResult({
+    operation: installedPackage.transition.status === "updated" ? "update" : "install",
+    result: verificationHealthy ? "success" : "partial",
+    surface: "opencode",
+    scope: "global",
+    version: {
+      expected: report.package.expected_version,
+      installed: report.package.installed_version,
+      previous: installedPackage.transition.previous_version,
+      status: report.package.version_status === "current" ? "verified" : "unknown",
+      transition: installedPackage.transition.status,
+    },
+    verification: {
+      status: verificationHealthy ? "healthy" : "degraded",
+      evidence: [
+        report.global_config.path,
+        report.global_native_surface.path,
+        `opencode_host=${report.host.installed_version || "unknown"}`,
+        `plugin_sdk=${report.plugin_sdk.installed_version || "unknown"}`,
+        `experimental_hooks=${report.experimental_hooks.aggregate}`,
+        `host_sdk_version=${report.host_sdk_version.status};policy=${report.host_sdk_version.policy}`,
+        `sdk_alignment=${installedPackage.sdk_alignment.status};target=${installedPackage.sdk_alignment.target_version || "unknown"};installed=${installedPackage.sdk_alignment.installed_version || "unknown"}`,
+        `package_source=${installedPackage.package_source.kind}${installedPackage.package_source.digest ? `;digest=${installedPackage.package_source.digest}` : ""}`,
+      ],
+    },
+    restart: { required: true, reason: "host_reload" },
+    runtime_checks: consent.state,
+    next_action: nextAction,
+  });
+  return {
+    report: lifecycleReport,
+    installed: {
+      pluginRoot: installedPackage.installed_package.root,
+      digest: installedPackage.installed_package.digest,
+      sourceDigest: installedPackage.package_source.digest || installedPackage.installed_package.digest,
+    },
+    native: installedPackage,
+    openCodeReport: report,
+  };
+}
+
+function installPluginPayload(surface, options, consent, pluginConfiguration, dependencies) {
+  printInstallProgress(surface, options, dependencies.io, dependencies.interactive);
+  if (surface === "opencode") {
+    return installOpenCodePluginPayload(pluginConfiguration, consent, dependencies);
+  }
+  const installed = surface === "codex"
+    ? installCodexGlobalPlugin({ ...dependencies.installerAdapters, target: options.dir })
+    : surface === "claude"
+      ? installClaudeGlobalPlugin(dependencies.installerAdapters)
+      : installCopilotGlobalPlugin(dependencies.installerAdapters);
+  const report = surface === "copilot"
+    ? copilotInstallReport(installed, consent.state)
+    : installResult(installed, {
+        restartRequired: true,
+        nextAction: globalInstallRestartAction(surface).text,
+        runtimeChecks: consent.state,
+        consentFailure: null,
+      });
+  return { report, installed };
+}
+
+function printOpenCodeVerbose(payload, options, io) {
+  if (!options.verbose || options.json || !payload?.openCodeReport) return;
+  const report = payload.openCodeReport;
+  const installed = payload.native;
+  io.log(`OpenCode host / plugin SDK: ${report.host.installed_version || "unknown"} / ${report.plugin_sdk.installed_version || "unknown"} (${report.host_sdk_version.status}; ${report.host_sdk_version.policy})`);
+  io.log(`Plugin SDK alignment: ${installed.sdk_alignment.status} (target ${installed.sdk_alignment.target_version || "unknown"}; installed ${installed.sdk_alignment.installed_version || "unknown"})`);
+  io.log(`Experimental hook declarations: ${report.experimental_hooks.aggregate} (SDK declaration evidence; live invocation not observed)`);
+}
+
+async function runGuidedInstall(options, dependencies) {
+  const language = options.language?.chat_language ?? "en";
+  try {
+    // Inside a packaged app every following write would stay private to that app, so the Claude check
+    // runs before setup, consent, control or marketplace work can change anything.
+    if (options.target === "claude") {
+      (dependencies.installerAdapters.preflight ?? preflightClaudeInstall)({ env: dependencies.env });
+    }
+    const outcome = await runInstallSetup({ options, interactive: dependencies.interactive, env: dependencies.env }, {
+      exec: dependencies.exec,
+      inspectPlugin: dependencies.inspectPluginInstallation,
+      mcpLifecycle: dependencies.mcpLifecycle,
+      chooseSetup: dependencies.askInstallSetupDecision
+        ? (preflight) => dependencies.askInstallSetupDecision(preflight)
+        : (preflight) => promptInstallSetup(preflight, { language }),
+      chooseScope: dependencies.askInstallSetupScope
+        ? (preflight) => dependencies.askInstallSetupScope(preflight)
+        : (preflight) => promptInstallScope(preflight, { language }),
+      prepareRuntimeChecks: (surface, currentOptions) => installConsentDecision(surface, currentOptions, {
+        io: dependencies.io,
+        askRuntimeCheckDecision: dependencies.askRuntimeCheckDecision,
+        interactive: dependencies.interactive,
+        dataRoot: dependencies.installerAdapters.dataRoot,
+        language,
+      }),
+      installPlugin: ({ surface, options: currentOptions, plugin_configuration: pluginConfiguration, consent }) =>
+        installPluginPayload(surface, currentOptions, consent, pluginConfiguration, dependencies),
+      createPluginFailure: (error) => pluginInstallFailure(options.target, error),
+      finalizeRuntimeChecks: async (consent, payload) => {
+        const finalized = finalizeInstallConsent(consent, {
           surface: options.target,
-          scope: "global",
-          version: {
-            expected: report.package.expected_version,
-            installed: report.package.installed_version,
-            previous: result.transition.previous_version,
-            status: report.package.version_status === "current" ? "verified" : "unknown",
-            transition: result.transition.status,
-          },
-          verification: {
-            status: verificationHealthy ? "healthy" : "degraded",
-            evidence: [
-              report.global_config.path,
-              report.global_native_surface.path,
-              `opencode_host=${report.host.installed_version || "unknown"}`,
-              `plugin_sdk=${report.plugin_sdk.installed_version || "unknown"}`,
-              `experimental_hooks=${report.experimental_hooks.aggregate}`,
-              `host_sdk_version=${report.host_sdk_version.status};policy=${report.host_sdk_version.policy}`,
-              `sdk_alignment=${result.sdk_alignment.status};target=${result.sdk_alignment.target_version || "unknown"};installed=${result.sdk_alignment.installed_version || "unknown"}`,
-              `package_source=${result.package_source.kind}${result.package_source.digest ? `;digest=${result.package_source.digest}` : ""}`,
-            ],
-          },
-          restart: { required: true, reason: "host_reload" },
-          runtime_checks: finalizedConsent.state,
-          next_action: nextAction,
-          failure: finalizedConsent.failure,
-        }), { json: options.json, compact: !options.verbose, io });
-        if (options.verbose && !options.json) {
-          io.log(`OpenCode host / plugin SDK: ${report.host.installed_version || "unknown"} / ${report.plugin_sdk.installed_version || "unknown"} (${report.host_sdk_version.status}; ${report.host_sdk_version.policy})`);
-          io.log(`Plugin SDK alignment: ${result.sdk_alignment.status} (target ${result.sdk_alignment.target_version || "unknown"}; installed ${result.sdk_alignment.installed_version || "unknown"})`);
-          io.log(`Experimental hook declarations: ${report.experimental_hooks.aggregate} (SDK declaration evidence; live invocation not observed)`);
+          installed: payload.installed,
+          dataRoot: dependencies.installerAdapters.dataRoot,
+          claudeSettingsPath: defaultClaudeSettingsPath({ env: dependencies.env }),
+        });
+        if (options.target === "codex") {
+          finalized.state = await dependencies.observeRuntimeChecks("codex", finalized.state, options.dir);
+          if (options.acceptPluginCapabilities && !finalized.failure) {
+            if (finalized.state.requested !== "enabled" || !finalized.state.capability_identity) {
+              finalized.failure = { phase: "runtime_check_permission", message: "AGDF_PLUGIN_CONSENT_IDENTITY_UNVERIFIED" };
+            } else {
+              const approval = await dependencies.approveCodexPluginDispatcher({ env: dependencies.env, cwd: options.workingDirectory });
+              finalized.state = { ...finalized.state, mcp_approval: approval };
+              if (approval.status !== "configured") finalized.failure = {
+                phase: "runtime_check_permission", message: `AGDF_MCP_APPROVAL_${approval.reason}`,
+              };
+            }
+          }
         }
-        return verificationHealthy ? 0 : 1;
-      } catch (error) {
-        printInstallFailure(options.target, error, options, io);
-        return 1;
-      }
-    }],
-  ]);
+        return finalized;
+      },
+      confirmControlMigration: dependencies.askControlMigration
+        ? (plan) => dependencies.askControlMigration(plan)
+        : (plan) => promptControlMigration(plan, { language }),
+      chooseControlRepair: dependencies.askControlRepair
+        ? (control) => dependencies.askControlRepair(control)
+        : (control) => promptControlRepair(control, { language }),
+      confirmControlRepair: dependencies.askControlRepairConfirmation
+        ? (plan) => dependencies.askControlRepairConfirmation(plan)
+        : (plan) => promptControlRepair(plan, { language, phase: "plan" }),
+    });
+    printInstallSetupResult(outcome.report, { json: options.json, verbose: options.verbose, io: dependencies.io, language });
+    printLoadedSessionsNotice(outcome.plugin_payload?.installed ?? {}, options, dependencies.io, language);
+    printVerboseHostOutput(outcome.plugin_payload?.installed ?? {}, options, dependencies.io);
+    printVerboseFailure(outcome.report, options, dependencies.io);
+    printOpenCodeVerbose(outcome.plugin_payload, options, dependencies.io);
+    return ["failed", "partial"].includes(outcome.report.result) ? 1 : 0;
+  } catch (error) {
+    dependencies.io.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
 }
 
 function runLifecyclePhase(phase, operation) {
@@ -277,9 +465,39 @@ function runLifecyclePhase(phase, operation) {
   }
 }
 
+function withOpenCodeRepositoryStatusEnvelope(report, target) {
+  return Object.freeze({
+    ...report,
+    operation_status: createOperationStatus({
+      operationId: "status.opencode_repository",
+      outcome: "reported",
+      targetScope: "repository",
+      target,
+      plannedEffect: "read_only_status",
+      excludedAuthority: ["target_inference", "run_creation", "gate_approval", "mutation"],
+    }),
+    next_action: {
+      kind: "action",
+      text: report.next_step || "Review the reported OpenCode status.",
+    },
+  });
+}
+
+function installationEnvelopeForOpenCode(report, configDir) {
+  const canonical = inspectGlobalInstallationStatus(
+    { surface: "opencode", configDir },
+    { evaluateOpenCodeGlobalStatus: () => report },
+  );
+  return {
+    installation_status: canonical.status,
+    operation_status: canonical.operation_status,
+    next_action: canonical.next_action,
+  };
+}
+
 function installNextAction(surface, runtimeChecks, fallback) {
   if (surface === "codex" && runtimeChecks.requested === "enabled" && runtimeChecks.effective === "decision_required") {
-    return `${fallback} Approve the AGDF session hook when the fresh Codex session asks.`;
+    return `${fallback} ${runtimeChecks.next_action}`;
   }
   if (surface === "copilot" && runtimeChecks.requested === "enabled" && runtimeChecks.effective === "decision_required") {
     return `${fallback} Review the AGDF session hook when the fresh Copilot session asks.`;
@@ -290,7 +508,7 @@ function installNextAction(surface, runtimeChecks, fallback) {
 function installResult(installed, { restartRequired, nextAction, runtimeChecks, consentFailure }) {
   return createLifecycleResult({
     operation: installed.operation ?? "install",
-    result: consentFailure ? "partial" : "success",
+    result: consentFailure || installed.cockpitTransition?.state === 'qualification_pending' ? "partial" : "success",
     surface: installed.surface,
     scope: "global",
     version: { expected: installed.expectedVersion, installed: installed.installedVersion, status: installed.installedVersion ? "verified" : "unknown" },
@@ -322,47 +540,27 @@ function finalizeInstallConsent(consent, input) {
   }
 }
 
-async function installConsentDecision(surface, options, { io, askRuntimeCheckDecision, interactive, dataRoot }) {
+async function installConsentDecision(surface, options, { io, askRuntimeCheckDecision, interactive, dataRoot, language = "en" }) {
+  if (options.acceptPluginCapabilities) return prepareInstallConsent(surface, { ...options, runtimeChecksDecision: "enable" });
   if (options.runtimeChecksDecision !== undefined) return prepareInstallConsent(surface, options);
+  // Claude Code runs the session check whenever the plugin is enabled, so installing it is the consent.
+  if (surface === "claude") return prepareInstallConsent(surface, { ...options, runtimeChecksDecision: "enable" });
   if (!interactive || options.json || typeof askRuntimeCheckDecision !== "function") {
     return prepareInstallConsent(surface, options);
   }
   const retained = retainCurrentInstallConsent(surface, dataRoot);
   const disclosure = prepareInstallConsent(surface, { ...options, runtimeChecksDecision: "manual" }).disclosure;
-  printInstallConsentDisclosure(disclosure, retained, io);
-  const answer = await askRuntimeCheckDecision(disclosure);
+  printInstallConsentDisclosure(disclosure, retained, io, language);
+  const answer = await askRuntimeCheckDecision(disclosure, { language });
   return prepareInstallConsent(surface, { ...options, runtimeChecksDecision: answer });
 }
 
-function printInstallConsentDisclosure(disclosure, retained, io) {
-  const host = installSurfaceLabel(disclosure.surface);
-  io.log("");
-  io.log(`AGDF ${pluginDefinition.version} for ${host}`);
-  io.log(`Applies to this ${host} installation for your user account.`);
-  io.log("");
-  io.log(`Let AGDF check your project status automatically ${disclosure.when}?`);
-  if (retained) {
-    io.log(retained.decision === "enable"
-      ? "Your previous choice: automatic checks requested"
-      : "Your previous choice: manual checks");
-    if (retained.decision === "enable") io.log(`${host} permission: checked after installation`);
-  }
-  io.log("");
-  io.log("Safe by design");
-  io.log("  Reads only AGDF runtime information and .agdf/control in this project");
-  io.log("  Changes no project files and uses no network");
-  io.log("  Never approves AGDF work");
-  io.log("");
-  io.log(`AGDF saves your choice. ${host} remains in control of permission.`);
-  io.log("You choose again for every install or update and whenever the check changes.");
-  io.log(`Turn it off anytime: ${disclosure.revocation}`);
-  io.log("");
-  io.log("Choose");
-  io.log("  [1] Yes, check automatically");
-  io.log("  [2] No automatic checks");
-  io.log("      AGDF still works. Checks run when you request them.");
-  io.log("  [D] Show technical details");
-  io.log("  [Esc] Cancel installation");
+function printInstallConsentDisclosure(disclosure, retained, io, language = "en") {
+  for (const line of renderRuntimeCheckConsentDisclosure(disclosure, {
+    retained,
+    version: pluginDefinition.version,
+    language,
+  })) io.log(line);
 }
 
 function installSurfaceLabel(surface) {
@@ -375,22 +573,11 @@ function installSurfaceLabel(surface) {
 function printInstallProgress(surface, options, io, interactive) {
   if (!interactive || options.json) return;
   io.log("");
-  io.log(`Setting up AGDF ${pluginDefinition.version} for ${installSurfaceLabel(surface)}...`);
+  io.log(renderInstallProgress(surface, pluginDefinition.version, { language: options.language?.chat_language ?? "en" }));
 }
 
-function installConsentTechnicalDetails(disclosure) {
-  return [
-    "",
-    "Technical details",
-    `  Applies to: ${disclosure.installation_scope}`,
-    `  Runs: ${disclosure.runs} ${disclosure.when}`,
-    `  Reads: ${disclosure.reads}`,
-    `  Saves: ${disclosure.writes}`,
-    `  Permission control: ${disclosure.permission_owner}`,
-    `  Command: ${disclosure.executable}`,
-    `  Renewal: ${disclosure.renewal}`,
-    "",
-  ];
+function installConsentTechnicalDetails(disclosure, language = "en") {
+  return renderRuntimeCheckConsentDetails(disclosure, { language });
 }
 
 function printCancelledConsent(surface, options, io) {
@@ -405,6 +592,30 @@ function printCancelledConsent(surface, options, io) {
   return 0;
 }
 
+// Structured adapter evidence becomes readable "key:value" entries; String() on the object printed
+// "[object Object]" and hid the cause of a failed plugin operation.
+export function failureEvidenceEntries(evidence) {
+  if (evidence === undefined || evidence === null) return [];
+  if (Array.isArray(evidence)) return evidence.map((entry) => (typeof entry === "string" ? entry : JSON.stringify(entry)));
+  if (typeof evidence !== "object") return [String(evidence)];
+  return Object.entries(evidence).map(([key, value]) => `${key}:${typeof value === "string" ? value : JSON.stringify(value)}`);
+}
+
+function printVerboseFailure(report, options, io) {
+  if (!options.verbose || options.json || !report?.failure) return;
+  io.log("Technical failure detail:");
+  if (report.failure.message) io.log(`  ${report.failure.message}`);
+  for (const entry of report.failure.evidence ?? []) io.log(`  ${entry}`);
+}
+
+function printLoadedSessionsNotice(installed, options, io, language) {
+  if (options.json) return;
+  const entry = (installed.evidence ?? []).find((item) => String(item).startsWith("claude_sessions_with_agdf:"));
+  if (!entry) return;
+  const count = entry.slice("claude_sessions_with_agdf:".length).split(",").length;
+  io.log(renderLoadedSessionsNotice(count, installed.expectedVersion ?? pluginDefinition.version, { language }));
+}
+
 function printVerboseHostOutput(installed, options, io) {
   if (!options.verbose || options.json || !installed.nativeOutput?.length) return;
   io.log("Host command output:");
@@ -418,7 +629,7 @@ function printInstallFailure(surface, error, options, io, command = surface) {
     scope: "global",
     phase: error.phase || "plugin_operation",
     message: error.message,
-    evidence: [error.evidence ?? {}],
+    evidence: failureEvidenceEntries(error.evidence),
     nextAction: `Resolve the ${error.phase || "plugin operation"} failure and rerun npx --yes @agdf/cli@latest ${command}.`,
   });
   if (options.json) printLifecycleResult(report, { json: true, io });
@@ -428,7 +639,171 @@ function printInstallFailure(surface, error, options, io, command = surface) {
   }
 }
 
-function runDisable(options, { io, exec }) {
+function createCoupledLifecycleResult({ operation, result, surface, target, mcpScope, plugin, mcp, nextAction }) {
+  if (!new Set(["coupled_disable", "coupled_uninstall"]).has(operation)
+      || !new Set(["success", "partial", "failed", "preview"]).has(result)
+      || !["codex", "claude", "copilot", "opencode"].includes(surface)
+      || !["project", "user"].includes(mcpScope)
+      || typeof target !== "string" || !isAbsolute(target)
+      || !plugin || !mcp || typeof nextAction?.code !== "string" || typeof nextAction?.text !== "string") {
+    throw new Error("AGDF_COUPLED_LIFECYCLE_RESULT_INVALID");
+  }
+  return Object.freeze({
+    schema_version: 1,
+    contract_version: 1,
+    operation,
+    result,
+    surface,
+    target,
+    plugin_scope: operation === "coupled_disable" ? "repository" : "global",
+    mcp_scope: mcpScope,
+    plugin,
+    mcp,
+    next_action: Object.freeze({ code: nextAction.code, text: nextAction.text }),
+    authorizes: false,
+  });
+}
+
+function printCoupledLifecycleResult(report, { json, io }) {
+  if (json) {
+    io.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  io.log(report.operation === "coupled_disable" ? "AGDF plugin and MCP disable" : "AGDF plugin and MCP uninstall");
+  io.log(`Result: ${report.result}`);
+  io.log(`Surface: ${report.surface}`);
+  io.log(`Target: ${report.target}`);
+  io.log(`MCP scope: ${report.mcp_scope}`);
+  io.log(`MCP: ${report.mcp.result ?? report.mcp.status}`);
+  io.log(`Plugin: ${report.plugin.result ?? report.plugin.status}`);
+  io.log(`Authorizes: ${report.authorizes}`);
+  io.log(`Next action: ${report.next_action.text}`);
+}
+
+function inspectCoupledMcp(options, { env, exec, mcpLifecycle }, scope) {
+  return mcpLifecycle({ action: "status", surface: options.surface, scope, target: options.dir, env, exec });
+}
+
+function mcpPreflightBlocked(report) {
+  return report.result === "failed"
+    || ["foreign", "precedence_conflict", "invalid"].includes(report.registration?.status);
+}
+
+function mcpDisableSucceeded(report) {
+  return ["disabled", "unchanged"].includes(report.result);
+}
+
+function coupledPreflightFailure(operation, options, scope, mcp) {
+  return createCoupledLifecycleResult({
+    operation,
+    result: "failed",
+    surface: options.surface,
+    target: options.dir,
+    mcpScope: scope,
+    plugin: { status: "not_run" },
+    mcp,
+    nextAction: {
+      code: "resolve_mcp_registration",
+      text: "Resolve the reported MCP ownership or precedence conflict before retrying.",
+    },
+  });
+}
+
+function runCoupledDisable(options, dependencies) {
+  const scope = "project";
+  try {
+    const before = inspectCoupledMcp(options, dependencies, scope);
+    if (mcpPreflightBlocked(before)) {
+      const report = coupledPreflightFailure("coupled_disable", options, scope, before);
+      printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+      return 1;
+    }
+    const mcp = dependencies.mcpLifecycle({
+      action: "disable", surface: options.surface, scope, target: options.dir,
+      env: dependencies.env, exec: dependencies.exec,
+    });
+    if (!mcpDisableSucceeded(mcp)) {
+      const report = createCoupledLifecycleResult({
+        operation: "coupled_disable", result: "failed", surface: options.surface, target: options.dir,
+        mcpScope: scope, plugin: { status: "not_run" }, mcp,
+        nextAction: { code: "retry_mcp_disable", text: "Resolve the MCP disable failure before changing the repository plugin state." },
+      });
+      printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+      return 1;
+    }
+    const plugin = executeDisable(options, dependencies);
+    const result = plugin.code === 0 ? "success" : "partial";
+    const report = createCoupledLifecycleResult({
+      operation: "coupled_disable", result, surface: options.surface, target: options.dir,
+      mcpScope: scope, plugin: plugin.report, mcp,
+      nextAction: result === "success"
+        ? { code: "restart_host", text: "Restart the host and verify that the repository plugin and project MCP registration are disabled." }
+        : { code: "retry_plugin_disable", text: "MCP is disabled. Resolve the repository plugin disable failure without re-enabling MCP." },
+    });
+    printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+    return result === "success" ? 0 : 1;
+  } catch (error) {
+    dependencies.io.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+
+async function runCoupledUninstall(options, dependencies) {
+  const scope = options.mcpScope;
+  try {
+    const before = inspectCoupledMcp(options, dependencies, scope);
+    if (mcpPreflightBlocked(before)) {
+      const report = coupledPreflightFailure("coupled_uninstall", options, scope, before);
+      printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+      return 1;
+    }
+    if (!options.confirm) {
+      const plugin = await executeUninstall(options, dependencies);
+      const report = createCoupledLifecycleResult({
+        operation: "coupled_uninstall", result: "preview", surface: options.surface, target: options.dir,
+        mcpScope: scope, plugin: plugin.report, mcp: before,
+        nextAction: { code: "confirm", text: "Review both plans, then rerun the same command with --confirm. Both owners revalidate before mutation." },
+      });
+      printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+      return 0;
+    }
+    const revalidated = inspectCoupledMcp(options, dependencies, scope);
+    if (mcpPreflightBlocked(revalidated)) {
+      const report = coupledPreflightFailure("coupled_uninstall", options, scope, revalidated);
+      printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+      return 1;
+    }
+    const mcp = dependencies.mcpLifecycle({
+      action: "disable", surface: options.surface, scope, target: options.dir,
+      env: dependencies.env, exec: dependencies.exec,
+    });
+    if (!mcpDisableSucceeded(mcp)) {
+      const report = createCoupledLifecycleResult({
+        operation: "coupled_uninstall", result: "failed", surface: options.surface, target: options.dir,
+        mcpScope: scope, plugin: { status: "not_run" }, mcp,
+        nextAction: { code: "retry_mcp_disable", text: "Resolve the MCP disable failure before uninstalling the plugin." },
+      });
+      printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+      return 1;
+    }
+    const plugin = await executeUninstall(options, dependencies);
+    const result = plugin.code === 0 ? "success" : "partial";
+    const report = createCoupledLifecycleResult({
+      operation: "coupled_uninstall", result, surface: options.surface, target: options.dir,
+      mcpScope: scope, plugin: plugin.report, mcp,
+      nextAction: result === "success"
+        ? { code: "restart_host", text: "Restart the host and verify that AGDF plugin and selected MCP registration are absent." }
+        : { code: "retry_plugin_uninstall", text: "MCP is disabled. Resolve the plugin uninstall failure without recreating the MCP registration." },
+    });
+    printCoupledLifecycleResult(report, { json: options.json, io: dependencies.io });
+    return result === "success" ? 0 : 1;
+  } catch (error) {
+    dependencies.io.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+
+function executeDisable(options, { exec }) {
   try {
     const plan = planRepositoryDisable(options.dir, options.surface, { shared: options.shared, exec });
     const applied = applyLifecyclePlan(plan, exec ? { exec } : {});
@@ -441,6 +816,7 @@ function runDisable(options, { io, exec }) {
       result,
       surface: options.surface,
       scope: "repository",
+      target: options.dir,
       verification: { status: verified.status === "healthy" ? "healthy" : "degraded", evidence: [...applied.completed.map((item) => item.path || item.executable), ...verified.evidence] },
       activation: { status: result === "success" ? "pending_restart" : "unknown" },
       restart: { required: result === "success", reason: result === "success" ? "host_reload" : "none" },
@@ -455,31 +831,33 @@ function runDisable(options, { io, exec }) {
         ? { phase: "repository_configuration", message: applied.error.message }
         : result === "failed" ? { phase: "verification", message: "Repository disable postcondition was not observed." } : null,
     });
-    printLifecycleResult(report, { json: options.json, io });
-    return result === "success" ? 0 : 1;
+    return { report, code: result === "success" ? 0 : 1 };
   } catch (error) {
     const report = lifecycleFailure({
       operation: "disable",
       surface: options.surface,
       scope: "repository",
+      target: options.dir,
       phase: "repository_preflight",
       message: error.message,
       evidence: [error.message],
       nextAction: "Resolve the reported repository configuration or ignore precondition, then retry disable without changing unrelated files.",
     });
-    if (options.json) printLifecycleResult(report, { json: true, io });
-    else {
-      io.error(error.message);
-      printLifecycleResult(report, { io });
-    }
-    return 1;
+    return { report, code: 1, error };
   }
 }
 
-function runUninstall(options, { io, env, exec }) {
+function runDisable(options, { io, exec }) {
+  const outcome = executeDisable(options, { exec });
+  if (outcome.error && !options.json) io.error(outcome.error.message);
+  printLifecycleResult(outcome.report, { json: options.json, io });
+  return outcome.code;
+}
+
+async function executeUninstall(options, { env, exec, revokeCodexPolicy = revokeCodexDispatcher }) {
   try {
     const configDir = env.OPENCODE_CONFIG_DIR || defaultOpenCodeConfigDir();
-    const plan = planGlobalUninstall(options.surface, { configDir });
+    const plan = planGlobalUninstall(options.surface, { configDir, env, ...(exec ? { exec } : {}) });
     if (!options.confirm) {
       const preview = createLifecycleResult({
         operation: "uninstall", result: "preview", surface: options.surface, scope: "global",
@@ -488,51 +866,110 @@ function runUninstall(options, { io, env, exec }) {
         next_action: { kind: "confirm", text: `Review this preview, then rerun with --surface ${options.surface} --scope global --confirm; ownership is revalidated before apply.` },
         changes: plan.mutations, retained: plan.retained,
       });
-      printLifecycleResult(preview, { json: options.json, io });
-      return 0;
+      return { report: preview, code: 0 };
     }
     const applied = applyLifecyclePlan(plan, exec ? { exec } : {});
     const verified = applied.status === "success"
       ? verifyGlobalUninstall(plan, options.dir, { configDir, exec })
       : { status: "failed", evidence: [] };
-    const result = applied.status === "success" && verified.status !== "healthy" ? "failed" : applied.status;
+    // The Codex tool approval is config, not plugin content: revoke it natively and report what remains.
+    const policyMutation = plan.mutations.find((mutation) => mutation.kind === "codex_tool_policy");
+    const policy = policyMutation && applied.status === "success"
+      ? await revokeCodexPolicy({ env, cwd: options.dir })
+      : null;
+    const policyClean = !policy || ["removed", "absent"].includes(policy.status);
+    const completed = policy?.status === "removed" ? [...applied.completed, policyMutation] : applied.completed;
+    const retained = policyClean ? applied.retained
+      : [...(applied.retained ?? []), `Codex tool approval ${policyMutation.key} (${policy.status}: ${policy.reason})`];
+    const result = applied.status === "success" && verified.status !== "healthy" ? "failed"
+      : applied.status === "success" && !policyClean ? "partial" : applied.status;
     const report = createLifecycleResult({
       operation: "uninstall", result, surface: options.surface, scope: "global",
-      verification: { status: verified.status === "healthy" ? "healthy" : "degraded", evidence: [...applied.completed.map((item) => item.path || item.executable), ...verified.evidence] },
+      verification: { status: verified.status === "healthy" && policyClean ? "healthy" : "degraded", evidence: [
+        ...applied.completed.map((item) => item.path || item.executable), ...verified.evidence,
+        ...(policy ? [`codex_tool_policy:${policy.status}`] : []),
+      ] },
       restart: { required: result === "success", reason: result === "success" ? "host_reload" : "none" },
       next_action: result === "success"
         ? { kind: "restart", text: "Restart the host; the uninstall postcondition has already been verified." }
-        : { kind: "verify", text: "Inspect the reported uninstall or verification failure before retrying." },
-      changes: applied.completed, retained: applied.retained,
+        : !policyClean
+          ? { kind: "verify", text: `The plugin is removed, but Codex kept ${policyMutation.key} in ${policy?.config_file || "the active Codex config.toml"}; remove or change that setting there, then retry uninstall.` }
+          : { kind: "verify", text: "Inspect the reported uninstall or verification failure before retrying." },
+      changes: completed, retained,
       failure: applied.error
         ? { phase: "plugin_operation", message: applied.error.message }
         : result === "failed" ? { phase: "verification", message: "Global uninstall postcondition was not observed." } : null,
     });
-    printLifecycleResult(report, { json: options.json, io });
-    return result === "success" ? 0 : 1;
+    return { report, code: result === "success" ? 0 : 1 };
   } catch (error) {
-    io.error(error.message);
-    return 1;
+    const report = lifecycleFailure({
+      operation: "uninstall",
+      surface: options.surface,
+      scope: "global",
+      phase: error.phase || "uninstall_preflight",
+      message: error.message,
+      evidence: [error.evidence ?? error.message],
+      nextAction: "Resolve the reported global uninstall precondition, then rerun the uninstall preview before applying changes.",
+    });
+    return { report, code: 1, error };
   }
 }
 
+async function runUninstall(options, { io, env, exec, revokeCodexPolicy }) {
+  const outcome = await executeUninstall(options, { env, exec, revokeCodexPolicy });
+  if (outcome.error && !options.json) io.error(outcome.error.message);
+  printLifecycleResult(outcome.report, { json: options.json, io });
+  return outcome.code;
+}
+
 function runScaffold(options, io) {
-  const files = generatedFilesForTarget(options.target, options.dir, options.force, options.language);
+  let files = [];
   let removedOpenCodeAgents = [];
+  let initialization = null;
 
   try {
-    assertGeneratedWritePlan(options.dir, files, options.force);
-    for (const file of files) {
-      writeGeneratedFile(options.dir, file.path, file.content, options.force, file.allowOverwrite);
+    files = generatedFilesForTarget(options.target, options.dir, options.force, options.language);
+    if (options.target === "init") {
+      initialization = initializeCanonicalControl(options.dir, files, { force: options.force });
+      files = [...initialization.files];
+    } else {
+      assertGeneratedWritePlan(options.dir, files, options.force);
+      for (const file of files) {
+        writeGeneratedFile(options.dir, file.path, file.content, options.force, file.allowOverwrite);
+      }
     }
     // Legacy OpenCode assets are intentionally preserved. A future explicit migration command
     // may remove only ownership-proven files after its precedence behavior is verified.
   } catch (error) {
-    io.error(error.message);
+    const repositorySurface = { "codex-repo": "codex", "opencode-repo": "opencode" }[options.target];
+    if (options.target === "init" || repositorySurface) {
+      const report = lifecycleFailure({
+        operation: options.target === "init" ? "control_init" : "repository_setup",
+        surface: repositorySurface ?? "generic",
+        scope: "repository",
+        target: options.dir,
+        phase: options.target === "init" ? "canonical_control_setup" : "repository_setup",
+        message: error.message,
+        evidence: [error.message],
+        nextAction: "Resolve the reported repository setup conflict, then retry with the same explicit target.",
+      });
+      if (options.json) printLifecycleResult(report, { json: true, io });
+      else {
+        io.error(error.message);
+        printLifecycleResult(report, { io });
+      }
+    } else {
+      io.error(error.message);
+    }
     return 1;
   }
 
-  printNextSteps(options.target, options.dir, files, removedOpenCodeAgents, { verbose: options.verbose, json: options.json, io });
+  printNextSteps(options.target, options.dir, files, removedOpenCodeAgents, {
+    verbose: options.verbose,
+    json: options.json,
+    io,
+    initialization,
+  });
   return 0;
 }
 
@@ -574,10 +1011,26 @@ export async function runCli(argv = process.argv.slice(2), adapters = {}) {
     exec: adapters.exec,
     packagedCopilotExec: adapters.packagedCopilotExec,
     prepare: adapters.prepare,
+    preflightClaudeInstall: adapters.preflightClaudeInstall,
     openCodePackageSource: adapters.openCodePackageSource,
     copilotSettingsPath: adapters.copilotSettingsPath,
     askRuntimeCheckDecision: adapters.askRuntimeCheckDecision ?? defaultAskRuntimeCheckDecision,
+    askInstallSetupDecision: adapters.askInstallSetupDecision,
+    askInstallSetupScope: adapters.askInstallSetupScope,
+    askControlMigration: adapters.askControlMigration,
+    askControlRepair: adapters.askControlRepair,
+    askControlRepairConfirmation: adapters.askControlRepairConfirmation,
+    inspectPluginInstallation: adapters.inspectPluginInstallation,
     interactive: adapters.interactive ?? (Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)),
+    observeCodexHookTrust: adapters.observeCodexHookTrust,
+    approveCodexPluginDispatcher: adapters.approveCodexPluginDispatcher,
+    revokeCodexPluginDispatcher: adapters.revokeCodexPluginDispatcher,
+    evaluateStatus: adapters.evaluateStatusOverview,
+    evaluateOpenCodeGlobal: adapters.evaluateOpenCodeGlobalStatus,
+    evaluateOpenCodeRepository: adapters.evaluateOpenCodeStatus,
+    installOpenCodePackage: adapters.installOpenCodeGlobalPlugin,
+    installOpenCodeSurface: adapters.installOpenCodeGlobalSurface,
+    mcpLifecycle: adapters.mcpLifecycle,
   }).get(command.handler);
   if (!handler) throw new Error(`No implementation is registered for ${command.name}.`);
   return await handler(options);
@@ -585,32 +1038,34 @@ export async function runCli(argv = process.argv.slice(2), adapters = {}) {
 
 export const main = runCli;
 
-async function defaultAskRuntimeCheckDecision(disclosure) {
+async function defaultAskRuntimeCheckDecision(disclosure, { language = "en" } = {}) {
   if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
-    return askRuntimeCheckDecisionByKey(process.stdin, process.stdout, disclosure);
+    return askRuntimeCheckDecisionByKey(process.stdin, process.stdout, disclosure, { language });
   }
+  const copy = runtimeCheckInteractionCopy({ language });
   const prompt = createInterface({ input: process.stdin, output: process.stdout });
   try {
     while (true) {
-      const answer = (await prompt.question("Choice (1/2/D/cancel): ")).trim().toLowerCase();
+      const answer = (await prompt.question(copy.linePrompt)).trim().toLowerCase();
       if (["1", "e", "enable"].includes(answer)) return "enable";
       if (["2", "m", "manual"].includes(answer)) return "manual";
       if (["d", "details"].includes(answer)) {
-        for (const line of installConsentTechnicalDetails(disclosure)) process.stdout.write(`${line}\n`);
+        for (const line of installConsentTechnicalDetails(disclosure, language)) process.stdout.write(`${line}\n`);
         continue;
       }
-      if (["c", "cancel"].includes(answer)) return "cancel";
-      process.stdout.write("Press 1, 2 or D, or type cancel.\n");
+      if (["c", "cancel", "abbrechen"].includes(answer)) return "cancel";
+      process.stdout.write(`${copy.lineInvalid}\n`);
     }
   } finally {
     prompt.close();
   }
 }
 
-export async function askRuntimeCheckDecisionByKey(input, output, disclosure) {
+export async function askRuntimeCheckDecisionByKey(input, output, disclosure, { language = "en" } = {}) {
+  const copy = runtimeCheckInteractionCopy({ language });
   const wasRaw = Boolean(input.isRaw);
   emitKeypressEvents(input);
-  output.write("Choice: ");
+  output.write(copy.keyPrompt);
   if (!wasRaw) input.setRawMode(true);
   input.resume();
 
@@ -619,7 +1074,7 @@ export async function askRuntimeCheckDecisionByKey(input, output, disclosure) {
       input.off("keypress", onKeypress);
       if (!wasRaw) input.setRawMode(false);
       input.pause();
-      output.write(`${decision}\n`);
+      output.write(`${copy.decisionEcho[decision]}\n`);
       resolve(decision);
     };
     const onKeypress = (character, key = {}) => {
@@ -629,10 +1084,10 @@ export async function askRuntimeCheckDecisionByKey(input, output, disclosure) {
       if (["2", "m"].includes(choice)) return finish("manual");
       if (choice === "c") return finish("cancel");
       if (choice === "d" && disclosure) {
-        output.write(`details\n${installConsentTechnicalDetails(disclosure).join("\n")}Choice: `);
+        output.write(`${copy.detailsEcho}\n${installConsentTechnicalDetails(disclosure, language).join("\n")}${copy.keyPrompt}`);
         return;
       }
-      output.write("\nPress 1, 2, D or Esc.\nChoice: ");
+      output.write(`\n${copy.keyInvalid}\n${copy.keyPrompt}`);
     };
     input.on("keypress", onKeypress);
   });