devrites 2.5.1 → 2.6.0

package/mcp/devrites-mcp.mjs

@@ -68,6 +68,8 @@ function handle(msg) {
         protocolVersion: (params && params.protocolVersion) || '2024-11-05',
         capabilities: { tools: {} },
         serverInfo: { name: 'devrites', version: '1.0.0' },
+        instructions:
+          'DevRites exposes deterministic workflow state and gates for the current repo. Use devrites_status/orient to inspect the active feature, devrites_ready before build work, devrites_evidence_fresh and devrites_acceptance before seal/ship, and devrites_use only when the user asks to switch the active feature.',
       });
     case 'notifications/initialized':
     case 'initialized':

package/pack/.claude/hooks/devrites-a1-guard.sh

@@ -6,13 +6,13 @@
 #
 # Safety model: FAIL-OPEN, and OBSERVE by default.
 #   - It NEVER blocks unless ALL hold: a build window is open, the edit is to a source file,
-#     it came from the MAIN thread (no agent_id), and enforce mode is on.
+#     it came from the MAIN thread (no agent_id/agent_type), and enforce mode is on.
 #   - On any doubt — no active workspace, no open window, no node, unparseable payload, a
 #     subagent caller, a .devrites/ path, the inline fallback — it exits 0 and stays silent.
 #   - Default mode is "observe": it LOGS what it would block (to .a1-guard.log) and allows.
 #     Flip to enforce only AFTER confirming the log never flags the wright's own edits — that
-#     confirms this Claude Code build populates agent_id for subagents (older builds may not;
-#     if the log flags wright edits, agent_id is unavailable here — stay in observe).
+#     confirms this agent surface populates agent_id/agent_type for subagents (older builds may not;
+#     if the log flags wright edits, subagent identity is unavailable here — stay in observe).
 #
 # Enable enforce (either one):
 #   export DEVRITES_A1_HOOK=enforce          # session-wide
@@ -47,24 +47,42 @@ d="$root/.devrites/work/$slug"
 
 # Parse with node (ships with Claude Code). No node or a parse failure → fail open.
 command -v node >/dev/null 2>&1 || exit 0
-parsed="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);const ti=j.tool_input||{};const fp=ti.file_path||ti.path||"";process.stdout.write([j.tool_name||"",fp,j.agent_id||""].join("\t"))}catch(e){}})' 2>/dev/null)"
-[ -n "$parsed" ] || exit 0
-IFS=$'\t' read -r tool fpath agent <<EOF
-$parsed
-EOF
+tool="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(JSON.parse(s).tool_name||"")}catch(e){}})' 2>/dev/null)"
+fpath="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const ti=JSON.parse(s).tool_input||{};process.stdout.write(ti.file_path||ti.path||"")}catch(e){}})' 2>/dev/null)"
+agent="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const p=JSON.parse(s);process.stdout.write(p.agent_id||p.agent_type||"")}catch(e){}})' 2>/dev/null)"
+[ -n "$tool" ] || exit 0
 
 # Only Edit-family writes can touch source.
-case "$tool" in Edit|Write|MultiEdit|NotebookEdit) : ;; *) exit 0 ;; esac
+case "$tool" in Edit|Write|MultiEdit|NotebookEdit|apply_patch) : ;; *) exit 0 ;; esac
 
-# Subagent caller (the wright) → allow. agent_id is present only inside a subagent.
+# Subagent caller (the wright) → allow. Claude uses agent_id; Codex uses agent_type.
 [ -n "$agent" ] && exit 0
 
-# Can't tell the path → fail open.
-[ -n "$fpath" ] || exit 0
-case "$fpath" in /*) abs="$fpath" ;; *) abs="$root/$fpath" ;; esac
-
-# Bookkeeping under .devrites/ is the orchestrator's own legit target → allow.
-case "$abs" in "$root/.devrites/"*) exit 0 ;; esac
+# Can't tell the path or patch target → fail open.
+if [ "$tool" = "apply_patch" ]; then
+  source_patch="$(printf '%s' "$input" | ROOT="$root" node -e '
+    let s=""; process.stdin.on("data", d => s += d).on("end", () => {
+      try {
+        const root = process.env.ROOT || "";
+        const cmd = (JSON.parse(s).tool_input || {}).command || "";
+        const paths = [...cmd.matchAll(/^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm)].map(m => m[1]);
+        if (!paths.length) return;
+        const source = paths.some(p => {
+          const abs = p.startsWith("/") ? p : `${root}/${p}`;
+          return !abs.startsWith(`${root}/.devrites/`);
+        });
+        process.stdout.write(source ? "1" : "0");
+      } catch {}
+    });
+  ' 2>/dev/null)"
+  [ "$source_patch" = "1" ] || exit 0
+  abs="apply_patch"
+else
+  [ -n "$fpath" ] || exit 0
+  case "$fpath" in /*) abs="$fpath" ;; *) abs="$root/$fpath" ;; esac
+  # Bookkeeping under .devrites/ is the orchestrator's own legit target → allow.
+  case "$abs" in "$root/.devrites/"*) exit 0 ;; esac
+fi
 
 # Reaching here = the MAIN thread is about to edit a SOURCE file mid-build. That is the A1
 # breach. Observe (default) logs and allows; enforce denies.

package/pack/.claude/hooks/devrites-reviewer-readonly.sh

@@ -8,9 +8,18 @@ set -u
 input="$(cat)"
 case "$input" in *'"tool_name"'*) : ;; *) exit 0 ;; esac
 command -v node >/dev/null 2>&1 || exit 0
-parsed="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);const ti=j.tool_input||{};process.stdout.write((j.tool_name||"")+"
"+(ti.command||""))}catch(e){}})' 2>/dev/null)"
+parsed="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);const ti=j.tool_input||{};process.stdout.write([j.tool_name||"",ti.command||"",j.agent_type||""].join("\u0001"))}catch(e){}})' 2>/dev/null)"
 [ -n "$parsed" ] || exit 0
-tool="${parsed%%$'\001'*}"; cmd="${parsed#*$'\001'}"
+IFS=$'\001' read -r tool cmd agent_type <<EOF
+$parsed
+EOF
+if [ "${DEVRITES_REVIEWER_AGENT_REQUIRED:-0}" = "1" ]; then
+  case "$agent_type" in
+    devrites-slice-wright|"") exit 0 ;;
+    devrites-*) : ;;
+    *) exit 0 ;;
+  esac
+fi
 [ "$tool" = "Bash" ] || exit 0
 [ -n "$cmd" ] || exit 0
 

package/pack/.claude/hooks/devrites-wright-scope.sh

@@ -16,20 +16,49 @@ tf="$d/touched-files.md"
 [ -f "$tf" ] || exit 0
 
 command -v node >/dev/null 2>&1 || exit 0
-parsed="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);const ti=j.tool_input||{};process.stdout.write((j.tool_name||"")+"
"+(ti.file_path||ti.path||""))}catch(e){}})' 2>/dev/null)"
-[ -n "$parsed" ] || exit 0
-tool="${parsed%%$'\001'*}"; fpath="${parsed#*$'\001'}"
-case "$tool" in Edit|Write|MultiEdit|NotebookEdit) : ;; *) exit 0 ;; esac
-[ -n "$fpath" ] || exit 0
-case "$fpath" in *.devrites/*) exit 0 ;; esac
+tool="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(JSON.parse(s).tool_name||"")}catch(e){}})' 2>/dev/null)"
+fpath="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const ti=JSON.parse(s).tool_input||{};process.stdout.write(ti.file_path||ti.path||"")}catch(e){}})' 2>/dev/null)"
+agent_type="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(JSON.parse(s).agent_type||"")}catch(e){}})' 2>/dev/null)"
+[ -n "$tool" ] || exit 0
+if [ "${DEVRITES_WRIGHT_AGENT_REQUIRED:-0}" = "1" ] && [ "$agent_type" != "devrites-slice-wright" ]; then
+  exit 0
+fi
+case "$tool" in Edit|Write|MultiEdit|NotebookEdit|apply_patch) : ;; *) exit 0 ;; esac
 
-rel="${fpath#"$root"/}"
-if grep -qF "$rel" "$tf" 2>/dev/null || grep -qF "$fpath" "$tf" 2>/dev/null; then exit 0; fi
+bad_paths=""
+if [ "$tool" = "apply_patch" ]; then
+  bad_paths="$(printf '%s' "$input" | TF="$tf" ROOT="$root" node -e '
+    const fs = require("fs");
+    let s = ""; process.stdin.on("data", d => s += d).on("end", () => {
+      try {
+        const root = process.env.ROOT || "";
+        const tf = process.env.TF || "";
+        const touched = fs.existsSync(tf) ? fs.readFileSync(tf, "utf8") : "";
+        const cmd = (JSON.parse(s).tool_input || {}).command || "";
+        const paths = [...cmd.matchAll(/^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm)].map(m => m[1]);
+        const bad = paths.filter(p => {
+          if (p.startsWith(".devrites/") || p.includes("/.devrites/")) return false;
+          const rel = p.startsWith(`${root}/`) ? p.slice(root.length + 1) : p;
+          return !touched.includes(rel) && !touched.includes(p);
+        });
+        process.stdout.write(bad.join(", "));
+      } catch {}
+    });
+  ' 2>/dev/null)"
+else
+  [ -n "$fpath" ] || exit 0
+  case "$fpath" in *.devrites/*|.devrites/*) exit 0 ;; esac
+  rel="${fpath#"$root"/}"
+  if ! grep -qF "$rel" "$tf" 2>/dev/null && ! grep -qF "$fpath" "$tf" 2>/dev/null; then
+    bad_paths="$fpath"
+  fi
+fi
+[ -n "$bad_paths" ] || exit 0
 
 mode="${DEVRITES_WRIGHT_SCOPE:-observe}"
 if [ "$mode" = "enforce" ]; then
   printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DevRites scope: this path is not in touched-files.md. Build only the slice contract; if the slice genuinely needs this file, return an Escalation so the orchestrator routes it through the Spec Drift Guard — do not widen scope yourself. (devrites-wright-scope)"}}'
   exit 0
 fi
-printf '%s\tWOULD-BLOCK\t%s\n' "$(date '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || echo '?')" "$fpath" >> "$d/.wright-scope.log" 2>/dev/null || true
+printf '%s\tWOULD-BLOCK\t%s\n' "$(date '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || echo '?')" "$bad_paths" >> "$d/.wright-scope.log" 2>/dev/null || true
 exit 0

package/pack/.claude/skills/devrites-browser-proof/SKILL.md

@@ -14,13 +14,17 @@ The same ladder captures a **developer-facing docs / getting-started page** for
 commands match what actually runs, and note the result in `browser-evidence.md` / `devex.md`.
 
 ## Ladder (top-down)
-1. **browser-harness** — detect `command -v browser-harness`. Connects to the user's
-   Chrome over CDP. Pattern: `new_tab(url)` → `wait_for_load()` → `capture_screenshot()`
-   → read the pixel → `click_at_xy(x,y)` → re-screenshot. Coordinate clicks pass through
-   iframes/shadow/cross-origin. `print(page_info())` for liveness. Don't launch a new
-   browser; don't auto-install.
-2. **Chrome DevTools MCP** (if configured) — screenshots, DOM, console, network,
-   performance, accessibility tree.
+1. **Playwright MCP** (preferred) — detect by tool availability (the `browser_*` tools are
+   present, e.g. `browser_navigate`); detect, don't install. Drives a Playwright-managed
+   browser. Pattern: `browser_navigate(url)` → `browser_snapshot()` (the accessibility tree
+   is the primary perception) → `browser_click` / `browser_type` on a **ref from the
+   snapshot** → `browser_take_screenshot()`. Read `browser_console_messages()` and
+   `browser_network_requests()` for console/network evidence; `browser_resize(w,h)` for each
+   responsive viewport. Act on snapshot refs, not pixel coordinates.
+2. **Chrome DevTools MCP** (when configured — use **alongside** Playwright MCP for more
+   detail) — screenshots, DOM, console, network, performance trace, accessibility tree, and
+   `lighthouse_audit`. Playwright MCP drives the flow; DevTools MCP adds Lighthouse + the perf
+   trace Playwright can't produce.
 3. **Claude Code `/run` + `/verify`** (if available) — launch + observe the app.
 4. **Project-native E2E** (only if present) — Playwright/Cypress/Capybara/Selenium via
    the project's existing commands. Don't add a new framework.
@@ -31,11 +35,13 @@ If `spec.md` carries a perf budget — or a frontend regression risk is visible
 CWV numbers here so the perf reviewer judges real data instead of guessing. Use the highest
 rung available; **detect, don't install**.
 
-1. **Chrome DevTools MCP** (if configured) — `lighthouse_audit` for LCP/INP/CLS + the
-   Lighthouse performance score. Source label: **Lab (Lighthouse)**. A `performance_*` trace
-   gives **Trace (DevTools)** attribution.
-2. **browser-harness** — drive the route, capture a performance trace over CDP. Source
-   label: **Trace (DevTools)**.
+1. **Chrome DevTools MCP** (preferred for CWV when configured) — `lighthouse_audit` for
+   LCP/INP/CLS + the Lighthouse performance score. Source label: **Lab (Lighthouse)**. A
+   `performance_*` trace gives **Trace (DevTools)** attribution.
+2. **Playwright MCP** — `browser_navigate` the route, then `browser_evaluate` the web-vitals
+   library to read LCP/INP/CLS off the live page. Source label: **Trace (DevTools)** (a
+   real-page number, not a Lighthouse score). Use **alongside** rung 1 when both are present —
+   the lab score and the trace corroborate each other.
 3. **CrUX / PageSpeed Insights** — only if the user supplied an API key. Field data, p75.
    Source label: **Field (CrUX)**.
 4. **None available** → mark CWV **pending (manual)** and name the exact command

package/pack/.claude/skills/devrites-lib/scripts/doctor.sh

@@ -3,7 +3,7 @@
 #
 # Checks install integrity + the active .devrites/ workspace for the inconsistencies that
 # silently waste a session: a stale ACTIVE pointer, a corrupt workspace, an orphaned gate,
-# or broken hook wiring. Two surfaces wrap this one core:
+# or broken hook wiring across Claude Code and Codex. Two surfaces wrap this one core:
 #   - the SessionStart orient hook calls it and surfaces issues only when there are any
 #     (silent-when-healthy);
 #   - the /rite-doctor skill calls it with --verbose for a full report on demand.
@@ -52,16 +52,80 @@ else
   ok "devrites-lib core scripts present"
 fi
 
-# 2. Broken hook wiring — every devrites hook referenced in settings.json must exist on disk.
+# 2. Broken Claude hook wiring — every devrites hook referenced in settings.json must exist on disk.
 SET="$ROOT/.claude/settings.json"
 if [ -f "$SET" ]; then
   for h in $(grep -oE 'devrites-[a-z-]+\.sh' "$SET" 2>/dev/null | sort -u); do
     [ -f "$ROOT/.claude/hooks/$h" ] || issue "settings.json wires missing hook: .claude/hooks/$h — reinstall or remove the hook entry"
   done
-  ok "hook wiring checked"
+  ok "Claude hook wiring checked"
 fi
 
-# 3. ACTIVE pointer — if set, it must name a real workspace.
+# 3. Codex support is optional. Only diagnose the Codex surface when DevRites
+# manages it, so unrelated project AGENTS.md/.codex files and --no-codex installs
+# do not produce false failures.
+MF="$ROOT/.claude/devrites.manifest"
+DR_FLAGS=""
+[ -f "$MF" ] && DR_FLAGS="$(sed -n 's/^# devrites-flags:[[:space:]]*//p' "$MF" 2>/dev/null | head -n1)"
+has_flag() {
+  case " $DR_FLAGS " in *" $1 "*) return 0 ;; *) return 1 ;; esac
+}
+manifest_has() {
+  [ -f "$MF" ] && grep -Eq -- "$1" "$MF" 2>/dev/null
+}
+
+codex_managed=0
+if manifest_has '^(\.agents/|\.codex/|AGENTS\.md$|\.claude/devrites\.(agents|codex-config)-merge$)'; then
+  codex_managed=1
+fi
+has_flag --no-codex && codex_managed=0
+
+if [ "$codex_managed" -eq 1 ]; then
+  if ! has_flag --no-skills && manifest_has '^\.agents/skills/'; then
+    [ -f "$ROOT/.agents/skills/rite/SKILL.md" ] \
+      || issue "Codex skill mirror incomplete — missing .agents/skills/rite/SKILL.md — reinstall DevRites"
+  fi
+  if ! has_flag --no-rules && manifest_has '^\.agents/devrites/rules/'; then
+    [ -f "$ROOT/.agents/devrites/rules/core.md" ] \
+      || issue "Codex rules mirror incomplete — missing .agents/devrites/rules/core.md — reinstall DevRites"
+  fi
+  if ! has_flag --no-agents && manifest_has '^\.codex/agents/'; then
+    [ -f "$ROOT/.codex/agents/devrites-code-reviewer.toml" ] \
+      || issue "Codex custom agents incomplete — missing .codex/agents/devrites-code-reviewer.toml — reinstall DevRites"
+  fi
+  if manifest_has '^\.codex/hooks\.json$|^\.codex/hooks/|^\.claude/devrites\.codex-hooks-merge$'; then
+    [ -f "$ROOT/.codex/hooks.json" ] \
+      || issue "Codex hooks incomplete — missing .codex/hooks.json — reinstall DevRites or install with --no-codex"
+    if [ -f "$ROOT/.codex/hooks.json" ]; then
+      grep -q 'devrites-' "$ROOT/.codex/hooks.json" 2>/dev/null \
+        || issue "Codex hooks incomplete — .codex/hooks.json does not reference DevRites hooks — reinstall DevRites"
+      for h in $(grep -oE 'devrites-[a-z-]+\.sh' "$ROOT/.codex/hooks.json" 2>/dev/null | sort -u); do
+        [ -f "$ROOT/.codex/hooks/$h" ] || issue "Codex hooks.json wires missing hook: .codex/hooks/$h — reinstall DevRites"
+      done
+    fi
+  fi
+  if manifest_has '^\.codex/mcp/|^\.codex/config\.toml$|^\.claude/devrites\.codex-config-merge$'; then
+    [ -f "$ROOT/.codex/mcp/devrites-mcp.mjs" ] \
+      || issue "Codex MCP incomplete — missing .codex/mcp/devrites-mcp.mjs — reinstall DevRites or install with --no-codex"
+    if [ -f "$ROOT/.codex/config.toml" ]; then
+      grep -q 'mcp_servers.devrites' "$ROOT/.codex/config.toml" 2>/dev/null \
+        || issue "Codex MCP config missing DevRites server — merge the DevRites block into .codex/config.toml or reinstall DevRites"
+    else
+      issue "Codex config incomplete — missing .codex/config.toml with DevRites MCP server — reinstall DevRites or install with --no-codex"
+    fi
+  fi
+  if manifest_has '^AGENTS\.md$|^\.claude/devrites\.agents-merge$'; then
+    if [ -f "$ROOT/AGENTS.md" ]; then
+      grep -q 'DevRites' "$ROOT/AGENTS.md" 2>/dev/null \
+        || issue "AGENTS.md does not include the DevRites Codex bridge — reinstall with --force or merge the DevRites AGENTS.md guidance"
+    else
+      issue "Codex guidance incomplete — missing AGENTS.md bridge — reinstall DevRites"
+    fi
+  fi
+  ok "Codex support wiring checked"
+fi
+
+# 4. ACTIVE pointer — if set, it must name a real workspace.
 slug="$(cat "$DR/ACTIVE" 2>/dev/null | tr -d '[:space:]')"
 if [ -z "$slug" ]; then
   ok "no active feature (ACTIVE empty)"

package/pack/.claude/skills/rite-doctor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rite-doctor
-description: Diagnose DevRites install + workspace health on demand and print a full report — install integrity, a stale `.devrites/ACTIVE` pointer, a corrupt workspace, orphaned gates, and broken hook wiring. Use when the user says "rite doctor", "check my DevRites install", or "why isn't the workflow picking up my feature". Not for debugging the user's own code (use `devrites-debug-recovery`) or for feature progress / next-action (use `/rite-status`).
+description: Diagnose DevRites install + workspace health on demand and print a full report — install integrity, Codex/Claude hook wiring, Codex support mirrors, a stale `.devrites/ACTIVE` pointer, a corrupt workspace, and orphaned gates. Use when the user says "rite doctor", "check my DevRites install", or "why isn't the workflow picking up my feature". Not for debugging the user's own code (use `devrites-debug-recovery`) or for feature progress / next-action (use `/rite-status`).
 argument-hint: ""
 user-invocable: true
 ---
@@ -10,6 +10,7 @@ user-invocable: true
 The on-demand deep report. The same checks run **silently at session start** (the orient
 hook surfaces issues only when there are any); `/rite-doctor` runs them **verbosely** —
 printing every check, pass or fail — so you can inspect health even when nothing is broken.
+It covers both Claude Code wiring and optional Codex mirrors/hooks when those files are present.
 
 It is **read-only**: it never edits the workspace, never advances a phase, never blocks.
 

package/pack/.claude/skills/rite-polish/reference/harden-checklist.md

@@ -91,7 +91,7 @@ If the project has the tools, run them; capture evidence in `evidence.md`.
 - `prefers-reduced-motion`: emulate in DevTools → re-verify motion.
 - Throttle to "Slow 3G" → re-verify loading + error states.
 - Lighthouse / axe / pa11y → re-verify accessibility floor.
-- Browser-harness or Chrome DevTools MCP (per `devrites-browser-proof`) → capture
+- Playwright MCP or Chrome DevTools MCP (per `devrites-browser-proof`) → capture
   screenshots of the worst-case input states above.
 
 ## Reporting in `/rite-polish`

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -14,7 +14,7 @@ workspace first; if none, run `/rite-spec <feature>`.
 > single change; `/run` launches the app. `/rite-prove` is feature-scoped:
 > it walks `spec.md` acceptance criteria one-by-one, runs the full relevant
 > test suite + build/typecheck/lint, ascends the browser-proof ladder
-> (browser-harness → DevTools MCP → `/run`+`/verify` → project E2E →
+> (Playwright MCP → DevTools MCP → `/run`+`/verify` → project E2E →
 > manual), and writes `evidence.md` + `browser-evidence.md` keyed to the
 > active `.devrites/work/<slug>/`. Use `/verify` or `/run` on their own
 > when there is no DevRites feature workspace.

package/pack/.claude/skills/rite-prove/reference/browser-proof.md

@@ -5,7 +5,7 @@ What `browser-evidence.md` must capture for a UI slice. Delegates to
 
 ```markdown
 ## Slice <N> — <name>  (<date>)
-- Tooling: browser-harness | devtools-mcp | /run+/verify | <e2e> | manual
+- Tooling: playwright-mcp | devtools-mcp | /run+/verify | <e2e> | manual
 - Route(s): <url(s) exercised>
 - Viewports: 375 / 768 / 1280  (note which were checked)
 - Screenshots: <path(s)>  — described: <what is actually visible>

package/pack/.claude/skills/rite-prove/reference/proof-ladder.md

@@ -3,12 +3,14 @@
 Prefer real runtime evidence. For UI/browser work, try tools top-down and record which
 rung you used. Detect, don't install — browser tooling setup is the user's call.
 
-1. **browser-harness** (preferred when installed & connected)
-   - Detect: `command -v browser-harness`. Use its doctor/connection check only when
-     safe. Capabilities: navigation, screenshots, coordinate clicks, console logs, DOM
-     reads, network, raw CDP. Connects to the user's Chrome — don't launch a new browser.
-2. **Chrome DevTools MCP** (if configured) — screenshots, DOM, console, network,
-   performance, accessibility tree.
+1. **Playwright MCP** (preferred when configured)
+   - Detect: the Playwright MCP `browser_*` tools are available (e.g. `browser_navigate`).
+     Capabilities: navigation, accessibility-tree snapshots, screenshots, ref-based
+     clicks/typing, console messages, network requests, `browser_evaluate`. Drives a
+     Playwright-managed browser; detect, don't install.
+2. **Chrome DevTools MCP** (when configured — pairs with Playwright MCP for Lighthouse, the
+   perf trace, and deeper DOM) — screenshots, DOM, console, network, performance,
+   accessibility tree.
 3. **Claude Code `/run` and `/verify`** (if available) — launch and observe the app;
    prefer a project-specific run/verify skill if one exists.
 4. **Project-native E2E** (only if already present) — Playwright, Cypress, Capybara,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devrites",
-  "version": "2.5.1",
-  "description": "DevRites — disciplined senior-engineer workflow skills pack for Claude Code",
+  "version": "2.6.0",
+  "description": "DevRites — disciplined senior-engineer workflow skills pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
   "repository": {
@@ -13,6 +13,7 @@
   },
   "keywords": [
     "claude-code",
+    "codex",
     "skills",
     "agent-skills",
     "workflow",

package/scripts/check-no-global-writes.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # check-no-global-writes.sh — static guard that the installer/uninstaller never
-# writes to the user's global ~/.claude, and that the global guard is present.
+# writes to the user's global ~/.claude or ~/.codex, and that the global guard is present.
 # Exits non-zero on violation.
 
 set -u
@@ -18,12 +18,12 @@ else
   echo "ok: install.sh contains the no-global guard"
 fi
 
-# 2) no write operation may target ~/.claude or \$HOME/.claude.
+# 2) no write operation may target ~/.claude, ~/.codex, or their $HOME forms.
 #    Write verbs are actual file-writing commands / redirections. ('install' is
 #    intentionally excluded: the installer uses cp/mkdir, and "install" appears in
 #    prose like "install into a project", which is not a write.)
 WRITE_RE='(\bmkdir\b|\bcp\b|\btee\b|\brsync\b|\bmv\b|\bln\b|>>?)'
-GLOBAL_RE='(\$HOME/\.claude|~/\.claude)'
+GLOBAL_RE='(\$HOME/\.(claude|codex)|~/\.(claude|codex))'
 for f in $SCRIPTS; do
   [ -f "$f" ] || continue
   # lines that contain a global-claude path AND a write verb, excluding comments
@@ -34,7 +34,7 @@ for f in $SCRIPTS; do
     fail=1
   fi
 done
-[ "$fail" -eq 0 ] && echo "ok: no write operations target ~/.claude"
+[ "$fail" -eq 0 ] && echo "ok: no write operations target global agent homes"
 
 if [ "$fail" -eq 0 ]; then
   echo "PASS: no global-write risks detected"

package/scripts/install-lib.sh

@@ -48,7 +48,7 @@ dr_manifest_contains() {
 # ---- misc ----------------------------------------------------------------
 dr_lc() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
 
-# Is $1 (canonical) equal to, or inside, the user's global ~/.claude?
+# Is $1 (canonical) equal to, or inside, a global agent home?
 # Used to refuse global writes. No write verbs here — read-only comparison.
 dr_is_global_claude() {
   _t="$1"
@@ -60,6 +60,16 @@ dr_is_global_claude() {
   return 1
 }
 
+dr_is_global_codex() {
+  _t="$1"
+  _home_codex="$HOME/.codex"
+  [ "$_t" = "$_home_codex" ] && return 0
+  case "$_t/" in
+    "$_home_codex"/*) return 0 ;;
+  esac
+  return 1
+}
+
 # ---- alias wrapper template ----------------------------------------------
 # Generate a thin SKILL.md that delegates to a DevRites skill. Used by:
 #   - install.sh (--short-aliases=all → /define, /build, /prove, /seal)

package/scripts/merge-codex-hooks.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+
+const [, , mode, ...args] = process.argv;
+let existingPath;
+let devritesPath;
+let outPath;
+
+if (mode === 'merge') {
+  [existingPath, devritesPath, outPath] = args;
+} else if (mode === 'strip') {
+  [existingPath, outPath] = args;
+}
+
+if (!['merge', 'strip'].includes(mode) || !existingPath || !outPath || (mode === 'merge' && !devritesPath)) {
+  console.error('usage: merge-codex-hooks.mjs merge EXISTING DEVRITES OUT');
+  console.error('   or: merge-codex-hooks.mjs strip EXISTING OUT');
+  process.exit(2);
+}
+
+function readJson(path) {
+  return JSON.parse(fs.readFileSync(path, 'utf8'));
+}
+
+function isDevRitesHook(value) {
+  const s = JSON.stringify(value);
+  return s.includes('.codex/hooks/devrites-') || s.includes('DevRites:') || s.includes('DEVRITES_');
+}
+
+function stripDevRitesHooks(config) {
+  if (!config || typeof config !== 'object' || Array.isArray(config)) return {};
+  const next = { ...config };
+  if (typeof next.$comment === 'string' && next.$comment.includes('DevRites hooks for Codex')) {
+    delete next.$comment;
+  }
+  const hooks = next.hooks && typeof next.hooks === 'object' && !Array.isArray(next.hooks)
+    ? { ...next.hooks }
+    : {};
+
+  for (const [event, entries] of Object.entries(hooks)) {
+    const kept = Array.isArray(entries) ? entries.filter((entry) => !isDevRitesHook(entry)) : entries;
+    if (Array.isArray(kept) && kept.length === 0) {
+      delete hooks[event];
+    } else {
+      hooks[event] = kept;
+    }
+  }
+
+  if (Object.keys(hooks).length) {
+    next.hooks = hooks;
+  } else {
+    delete next.hooks;
+  }
+  return next;
+}
+
+const existing = stripDevRitesHooks(readJson(existingPath));
+
+if (mode === 'merge') {
+  const devrites = readJson(devritesPath);
+  const hooks = existing.hooks && typeof existing.hooks === 'object' && !Array.isArray(existing.hooks)
+    ? existing.hooks
+    : {};
+  const devritesHooks = devrites.hooks && typeof devrites.hooks === 'object' && !Array.isArray(devrites.hooks)
+    ? devrites.hooks
+    : {};
+
+  for (const [event, entries] of Object.entries(devritesHooks)) {
+    hooks[event] = [
+      ...(Array.isArray(hooks[event]) ? hooks[event] : []),
+      ...(Array.isArray(entries) ? entries : []),
+    ];
+  }
+
+  existing.hooks = hooks;
+}
+
+fs.writeFileSync(outPath, `${JSON.stringify(existing, null, 2)}\n`);