direxio-deployer 0.1.0

package/scripts/lib/ops.sh

@@ -0,0 +1,230 @@
+#!/usr/bin/env bash
+# lib/ops.sh - existing-node update/reset helpers.
+
+ops_state_path() {
+  local explicit=${1:-}
+  if [ -n "$explicit" ]; then
+    printf '%s\n' "$explicit"
+    return 0
+  fi
+  printf '%s/state.json\n' "$(direxio_default_workdir)"
+}
+
+ops_require_state() {
+  local state=$1
+  [ -f "$state" ] || {
+    echo "state.json not found: $state" >&2
+    return 1
+  }
+}
+
+ops_state_get() {
+  local state=$1 path=$2
+  jq -r "$path // empty" "$state"
+}
+
+ops_sh_quote() {
+  printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
+}
+
+ops_path_dirname() {
+  local path=$1
+  path=${path%/}
+  case "$path" in
+    */*) printf '%s\n' "${path%/*}" ;;
+    *) printf '.\n' ;;
+  esac
+}
+
+ops_normalize_path() {
+  local path=$1
+  path=$(printf '%s' "$path" | sed 's#\\#/#g')
+  if command -v cygpath >/dev/null 2>&1; then
+    cygpath -m "$path" 2>/dev/null && return 0
+  fi
+  while [ "${#path}" -gt 1 ] && [ "${path%/}" != "$path" ]; do
+    case "$path" in [A-Za-z]:/) break ;; esac
+    path=${path%/}
+  done
+  printf '%s\n' "$path"
+}
+
+ops_paths_match() {
+  local left right
+  left=$(ops_normalize_path "$1")
+  right=$(ops_normalize_path "$2")
+  case "$left:$right" in
+    [A-Za-z]:/*:[A-Za-z]:/*)
+      [ "$(printf '%s' "$left" | tr '[:upper:]' '[:lower:]')" = "$(printf '%s' "$right" | tr '[:upper:]' '[:lower:]')" ]
+      ;;
+    *)
+      [ "$left" = "$right" ]
+      ;;
+  esac
+}
+
+ops_remote_base() {
+  local state=$1 keyfile pubip
+  keyfile=$(ops_state_get "$state" '.resources.key_file')
+  pubip=$(ops_state_get "$state" '.resources.public_ip')
+  [ -n "$keyfile" ] && [ -n "$pubip" ] || {
+    echo "state is missing resources.key_file or resources.public_ip; cannot SSH to existing EC2" >&2
+    return 1
+  }
+  printf '%s\t%s\n' "$keyfile" "$pubip"
+}
+
+ops_ssh() {
+  local state=$1 command=$2 keyfile pubip
+  IFS=$'\t' read -r keyfile pubip < <(ops_remote_base "$state")
+  ssh -i "$keyfile" -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 ubuntu@"$pubip" "$command"
+}
+
+ops_cc_connect_service_name() {
+  local state=$1 service_name service_dir
+  service_name=$(ops_state_get "$state" '.agent_service_id')
+  [ -n "$service_name" ] || service_name=$(ops_state_get "$state" '.domain')
+  if [ -z "$service_name" ]; then
+    service_dir=$(ops_state_get "$state" '.agent_service_dir')
+    [ -n "$service_dir" ] && service_name=$(basename "$service_dir")
+  fi
+  printf '%s\n' "${service_name:-cc-connect}"
+}
+
+ops_cc_connect_target_work_dir() {
+  local state=$1 config runtime_dir service_dir
+  config=$(ops_state_get "$state" '.cc_connect_config')
+  runtime_dir=$(ops_state_get "$state" '.cc_connect_runtime_dir')
+  service_dir=$(ops_state_get "$state" '.agent_service_dir')
+  if [ -n "$config" ]; then
+    ops_path_dirname "$config"
+  elif [ -n "$runtime_dir" ]; then
+    printf '%s\n' "$runtime_dir"
+  elif [ -n "$service_dir" ]; then
+    printf '%s/cc-connect\n' "${service_dir%/}"
+  fi
+}
+
+ops_stop_scoped_daemon() {
+  local state=$1 binary service_name target_work_dir status_out daemon_status work_dir
+  binary=$(ops_state_get "$state" '.cc_connect_binary')
+  [ -n "$binary" ] || binary=direxio-connect
+  service_name=$(ops_cc_connect_service_name "$state")
+  target_work_dir=$(ops_cc_connect_target_work_dir "$state")
+  [ -n "$target_work_dir" ] || return 1
+
+  case "$binary" in
+    */*|[A-Za-z]:/*|[A-Za-z]:\\*)
+      [ -x "$binary" ] || return 1
+      ;;
+    *)
+      command -v "$binary" >/dev/null 2>&1 || return 1
+      ;;
+  esac
+
+  status_out=$("$binary" daemon status --service-name "$service_name" 2>/dev/null) || return 1
+  daemon_status=$(printf '%s\n' "$status_out" | sed -nE 's/^[[:space:]]*Status:[[:space:]]*//p' | head -n 1)
+  work_dir=$(printf '%s\n' "$status_out" | sed -nE 's/^[[:space:]]*WorkDir:[[:space:]]*//p' | head -n 1)
+  [ "$daemon_status" = "Running" ] || return 1
+  [ -n "$work_dir" ] || return 1
+  ops_paths_match "$target_work_dir" "$work_dir" || return 1
+
+  "$binary" daemon stop --service-name "$service_name" >/dev/null 2>&1
+}
+
+ops_update_remote_command() {
+  local image=${1:-} image_q remote_script
+  image_q=$(ops_sh_quote "$image")
+  remote_script=$(cat <<'EOF'
+set -eu
+cd /opt/p2p
+if [ -n "${MESSAGE_SERVER_IMAGE:-}" ]; then
+  IMAGE=$MESSAGE_SERVER_IMAGE
+  escaped_image=$(printf '%s\n' "$IMAGE" | sed 's/[\/&]/\\&/g')
+  if grep -q '^MESSAGE_SERVER_IMAGE=' .env; then
+    sed -i "s#^MESSAGE_SERVER_IMAGE=.*#MESSAGE_SERVER_IMAGE=$escaped_image#" .env
+  else
+    printf 'MESSAGE_SERVER_IMAGE=%s\n' "$IMAGE" | tee -a .env >/dev/null
+  fi
+fi
+docker compose --env-file .env pull
+docker compose --env-file .env up -d
+DOMAIN=$(grep '^DOMAIN=' .env | cut -d= -f2)
+sync_container_bootstrap() {
+  tmp=$(mktemp)
+  if docker compose --env-file .env exec -T message-server sh -c 'test -s /var/direxio-message-server/p2p/bootstrap.json && cat /var/direxio-message-server/p2p/bootstrap.json' > "$tmp"; then
+    install -m 0600 "$tmp" /opt/p2p/bootstrap.json
+    rm -f "$tmp"
+    return 0
+  fi
+  rm -f "$tmp"
+  return 1
+}
+bootstrap_ready() {
+  test -s /opt/p2p/bootstrap.json \
+    && grep -q '"password"[[:space:]]*:' /opt/p2p/bootstrap.json \
+  && grep -q '"agent_token"[[:space:]]*:' /opt/p2p/bootstrap.json \
+  && grep -q '"access_token"[[:space:]]*:' /opt/p2p/bootstrap.json \
+    && grep -Eq '"agent_room_id"[[:space:]]*:[[:space:]]*"![^"]+"' /opt/p2p/bootstrap.json
+}
+if sync_container_bootstrap && bootstrap_ready; then
+  echo "[update] existing bootstrap credentials are present; skipping portal.bootstrap."
+else
+  DOMAIN="$DOMAIN" bash /opt/p2p/init-tokens.sh
+fi
+EOF
+)
+  printf 'sudo MESSAGE_SERVER_IMAGE=%s sh -lc %s\n' "$image_q" "$(ops_sh_quote "$remote_script")"
+}
+
+ops_reset_remote_command() {
+  cat <<'EOF'
+set -eu
+cd /opt/p2p
+sudo docker compose --env-file .env down
+project=$(basename "$PWD")
+for volume in postgres-data message-config message-data; do
+  ids=$(sudo docker volume ls -q --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.volume=$volume" 2>/dev/null || true)
+  if [ -n "$ids" ]; then
+    sudo docker volume rm $ids >/dev/null 2>&1 || true
+  fi
+  sudo docker volume rm "${project}_${volume}" >/dev/null 2>&1 || true
+done
+sudo rm -f /opt/p2p/bootstrap.json /opt/p2p/wellknown/owner.json
+new_code=$(od -An -N4 -tu4 /dev/urandom | awk '{printf "%08d", $1 % 100000000}')
+sudo sed -i '/^P2P_PORTAL_PASSWORD=/d' .env
+printf 'P2P_PORTAL_PASSWORD=%s\n' "$new_code" | sudo tee -a .env >/dev/null
+sudo docker compose --env-file .env up -d
+DOMAIN=$(grep '^DOMAIN=' .env | cut -d= -f2)
+sudo DOMAIN="$DOMAIN" bash /opt/p2p/init-tokens.sh
+EOF
+}
+
+ops_mark_refresh_pending() {
+  local state=$1 start_phase=${2:-S4_BOOTSTRAP_STACK} tmp
+  tmp="$state.tmp.$$"
+  jq --arg start "$start_phase" --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" '
+    del(
+      .password,
+      .access_token,
+      .agent_token,
+      .agent_room_id,
+      .user_confirmations,
+      .runtime_checks
+    )
+    | .agent_install_status = "refresh_pending"
+    | .phase = $start
+    | (if ($start == "S4_BOOTSTRAP_STACK") then
+        .phases.S4_BOOTSTRAP_STACK = {status:"pending", ts:$ts, evidence:"existing node operation requires fresh health check"}
+      else . end)
+    | .phases.S5_INIT_TOKENS = {status:"pending", ts:$ts, evidence:"existing node operation requires fresh bootstrap credentials"}
+    | .phases.S6_WIRE_LOCAL = {status:"pending", ts:$ts, evidence:"existing node operation requires local credentials and MCP refresh"}
+    | .phases.S7_VERIFY_E2E = {status:"pending", ts:$ts, evidence:"existing node operation requires fresh verification"}
+  ' "$state" > "$tmp" && mv "$tmp" "$state"
+}
+
+ops_write_report() {
+  local operation=$1 status=$2 state=$3 report
+  report=$(operation_report_write "$operation" "$status" "$state")
+  printf '%s\n' "$report"
+}

package/scripts/lib/paths.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# lib/paths.sh - local Direxio service directory helpers.
+
+direxio_home() {
+  printf '%s\n' "${DIREXIO_HOME:-$HOME/.direxio}"
+}
+
+direxio_service_id() {
+  local raw=${1:-} host
+  host=${raw#http://}
+  host=${host#https://}
+  host=${host%%/*}
+  case "$host" in
+    *:*) host="${host%%:*}-${host#*:}" ;;
+  esac
+  printf '%s\n' "$host" | tr '[:upper:]' '[:lower:]' | sed -E 's/:/-/g; s/[^a-z0-9._-]+/-/g; s/^-+//; s/-+$//; s/^$/direxio-service/'
+}
+
+direxio_service_dir() {
+  local service_id
+  service_id=$(direxio_service_id "$1")
+  printf '%s/nodes/%s\n' "$(direxio_home)" "$service_id"
+}
+
+direxio_default_workdir() {
+  if [ -n "${P2P_WORKDIR:-}" ]; then
+    printf '%s\n' "$P2P_WORKDIR"
+  elif [ -n "${DIREXIO_WORKDIR:-}" ]; then
+    printf '%s\n' "$DIREXIO_WORKDIR"
+  elif [ -n "${DOMAIN:-}" ]; then
+    direxio_service_dir "$DOMAIN"
+  else
+    printf '%s/nodes\n' "$(direxio_home)"
+  fi
+}

package/scripts/lib/state.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# lib/state.sh - state.json helpers for the deployment state machine.
+#
+# Sourced by orchestrate.sh and phases/*.sh. All state.json reads/writes go
+# through this file to keep structure and fields consistent. Requires jq.
+#
+# state.json path: $P2P_WORKDIR/state.json.
+# By default, DOMAIN=__DOMAIN__ maps to ~/.direxio/nodes/<service_id>/state.json.
+#
+# PHASES order is the state-machine execution order.
+
+STATE_LIB_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck disable=SC1090
+source "$STATE_LIB_DIR/paths.sh"
+
+# Phase list; order matters.
+PHASES=(
+  S0_PREREQ_AWS
+  S1_PREFLIGHT
+  S2_DOMAIN
+  S3_PROVISION
+  S4_BOOTSTRAP_STACK
+  S5_INIT_TOKENS
+  S6_WIRE_LOCAL
+  S7_VERIFY_E2E
+)
+
+# Paths.
+P2P_WORKDIR=$(direxio_default_workdir)
+STATE_JSON="$P2P_WORKDIR/state.json"
+
+# Timestamp helper.
+_now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+
+# Shared logging helpers.
+log()  { echo -e "\033[36m[p2p]\033[0m $*" >&2; }
+ok()   { echo -e "\033[32m[p2p]\033[0m $*" >&2; }
+warn() { echo -e "\033[33m[p2p]\033[0m $*" >&2; }
+fail() { echo -e "\033[31m[p2p][FATAL]\033[0m $*" >&2; exit 1; }
+is_yes() {
+  case "$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')" in
+    y|yes|true|1) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Initialize state.json for a new deployment.
+state_init() {
+  mkdir -p "$P2P_WORKDIR"
+  local run_id=${RUN_ID:-p2p-$(date -u +%Y%m%d-%H%M%S)}
+  local phases_json="{}"
+  local p
+  for p in "${PHASES[@]}"; do
+    phases_json=$(echo "$phases_json" | jq --arg k "$p" '. + {($k): {"status":"pending"}}')
+  done
+  jq -n \
+    --arg run_id "$run_id" \
+    --arg region "${AWS_DEFAULT_REGION:-${AWS_REGION:-}}" \
+    --argjson phases "$phases_json" \
+    --arg ts "$(_now)" \
+    '{
+       run_id: $run_id,
+       region: (if $region == "" then null else $region end),
+       domain_mode: null,
+       domain: null,
+       domain_confirmed_irreversible: false,
+       instance_type: null,
+       dns_ready: false,
+       existing_state_confirmed: false,
+       phase: "S0_PREREQ_AWS",
+       created_at: $ts,
+       phases: $phases,
+       resources: {}
+     }' > "$STATE_JSON"
+  log "Initialized state.json -> $STATE_JSON (run_id=$run_id)"
+}
+
+# Ensure state.json exists.
+state_ensure() {
+  [ -f "$STATE_JSON" ] || state_init
+}
+
+# Atomic write using a jq filter.
+_state_write() {
+  local filter=$1; shift
+  local tmp="$STATE_JSON.tmp.$$"
+  jq "$@" "$filter" "$STATE_JSON" > "$tmp" && mv "$tmp" "$STATE_JSON"
+}
+
+# Top-level field accessors.
+state_get()      { jq -r --arg k "$1" '.[$k] // empty' "$STATE_JSON"; }
+state_set()      { _state_write '.[$k] = $v' --arg k "$1" --arg v "$2"; }
+state_set_raw()  { _state_write ".$1 = $2"; }
+
+# Resource records used by destroy.sh.
+res_set() { _state_write '.resources[$k] = $v' --arg k "$1" --arg v "$2"; }
+res_get() { jq -r --arg k "$1" '.resources[$k] // empty' "$STATE_JSON"; }
+
+# Phase status helpers.
+# phase_status <PHASE>
+phase_status() { jq -r --arg p "$1" '.phases[$p].status // "pending"' "$STATE_JSON"; }
+
+# phase_set <PHASE> <status> [evidence]
+phase_set() {
+  local p=$1 st=$2 ev=${3:-}
+  _state_write '
+    .phases[$p].status = $st
+    | .phases[$p].ts = $ts
+    | (if $ev != "" then .phases[$p].evidence = $ev else . end)
+    | .phase = $p
+  ' --arg p "$p" --arg st "$st" --arg ev "$ev" --arg ts "$(_now)"
+}
+
+# Find the first phase whose status is not done.
+first_unfinished_phase() {
+  local p
+  for p in "${PHASES[@]}"; do
+    [ "$(phase_status "$p")" != "done" ] && { echo "$p"; return 0; }
+  done
+  echo "DONE"
+}
+
+# poll_until <description> <interval-seconds> <max-attempts> <check-command...>
+# Return 0 when the check command succeeds. max=0 means poll forever.
+poll_until() {
+  local desc=$1 interval=$2 maxn=$3; shift 3
+  local i=0
+  while true; do
+    if "$@"; then ok "$desc ✓"; return 0; fi
+    i=$((i+1))
+    if [ "$maxn" -gt 0 ] && [ "$i" -ge "$maxn" ]; then
+      warn "$desc timed out after $i unsuccessful attempts"; return 1
+    fi
+    log "$desc waiting (attempt $i, retry in ${interval}s)"
+    sleep "$interval"
+  done
+}

package/scripts/mcp-tools-list.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+
+const command = process.argv[2] || "direxio-mcp";
+const timeoutMs = Number.parseInt(process.env.DIREXIO_MCP_TOOLS_TIMEOUT_MS || "8000", 10);
+
+const child = spawn(command, {
+  env: process.env,
+  shell: true,
+  stdio: ["pipe", "pipe", "pipe"]
+});
+
+let stdout = Buffer.alloc(0);
+let stderr = "";
+let completed = false;
+const responses = new Map();
+
+const timer = setTimeout(() => {
+  finishWithError(`timed out waiting for MCP tools/list after ${timeoutMs}ms`);
+}, timeoutMs);
+
+child.stderr.on("data", (chunk) => {
+  stderr += chunk.toString("utf8");
+});
+
+child.stdout.on("data", (chunk) => {
+  stdout = Buffer.concat([stdout, chunk]);
+  readFrames();
+  if (responses.has(2)) {
+    const response = responses.get(2);
+    const tools = Array.isArray(response?.result?.tools) ? response.result.tools : [];
+    const names = tools
+      .map((tool) => tool?.name)
+      .filter((name) => typeof name === "string" && name.length > 0);
+    finish({ tools: names, tool_count: names.length });
+  }
+});
+
+child.on("error", (error) => {
+  finishWithError(error.message);
+});
+
+child.on("exit", (code) => {
+  if (!completed && code !== 0) {
+    finishWithError(`MCP server exited with code ${code}${stderr ? `: ${stderr.trim()}` : ""}`);
+  }
+});
+
+send({
+  jsonrpc: "2.0",
+  id: 1,
+  method: "initialize",
+  params: {
+    protocolVersion: "2024-11-05",
+    capabilities: {},
+    clientInfo: { name: "direxio-deployer", version: "0.0.0" }
+  }
+});
+send({ jsonrpc: "2.0", method: "notifications/initialized", params: {} });
+send({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
+
+function send(message) {
+  child.stdin.write(`${JSON.stringify(message)}\n`);
+}
+
+function readFrames() {
+  while (true) {
+    const lineEnd = stdout.indexOf("\n");
+    if (lineEnd < 0) return;
+    const line = stdout.subarray(0, lineEnd).toString("utf8").replace(/\r$/, "");
+    stdout = stdout.subarray(lineEnd + 1);
+    if (line.length === 0) continue;
+    const message = JSON.parse(line);
+    if (typeof message.id !== "undefined") {
+      responses.set(message.id, message);
+    }
+  }
+}
+
+function finish(value) {
+  if (completed) return;
+  completed = true;
+  clearTimeout(timer);
+  console.log(JSON.stringify(value));
+  child.kill();
+}
+
+function finishWithError(message) {
+  if (completed) return;
+  completed = true;
+  clearTimeout(timer);
+  console.error(message);
+  child.kill();
+  process.exitCode = 1;
+}

package/scripts/orchestrate.ps1

@@ -0,0 +1,112 @@
+param(
+  [Parameter(ValueFromRemainingArguments = $true)]
+  [string[]] $OrchestrateArgs
+)
+
+$ErrorActionPreference = 'Stop'
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$RepoRoot = Split-Path -Parent $ScriptDir
+
+function Find-GitBash {
+  $candidates = @(
+    "$env:ProgramFiles\Git\bin\bash.exe",
+    "$env:ProgramFiles\Git\usr\bin\bash.exe",
+    "$env:LOCALAPPDATA\Programs\Git\bin\bash.exe",
+    "$env:LOCALAPPDATA\Programs\Git\usr\bin\bash.exe"
+  )
+  foreach ($candidate in $candidates) {
+    if ($candidate -and (Test-Path $candidate)) {
+      return $candidate
+    }
+  }
+  throw "Git Bash was not found. Install Git for Windows or run scripts/orchestrate.sh from a POSIX shell."
+}
+
+function ConvertTo-GitBashPath([string] $Path) {
+  $full = [System.IO.Path]::GetFullPath($Path)
+  $drive = $full.Substring(0, 1).ToLowerInvariant()
+  $rest = $full.Substring(2).Replace('\', '/')
+  return "/$drive$rest"
+}
+
+function Quote-BashArg([string] $Value) {
+  return "'" + ($Value -replace "'", "'\''") + "'"
+}
+
+function Find-CodexBinary {
+  $root = Join-Path $env:LOCALAPPDATA 'OpenAI\Codex\bin'
+  if (-not (Test-Path $root)) {
+    return Find-CommandPath @('codex.exe', 'codex.cmd', 'codex')
+  }
+  $bundled = Get-ChildItem $root -Filter codex.exe -Recurse -ErrorAction SilentlyContinue |
+    Select-Object -First 1 -ExpandProperty FullName
+  if ($bundled) {
+    return $bundled
+  }
+  return Find-CommandPath @('codex.exe', 'codex.cmd', 'codex')
+}
+
+function Find-CommandPath([string[]] $Names) {
+  foreach ($name in $Names) {
+    $cmd = Get-Command $name -ErrorAction SilentlyContinue | Select-Object -First 1
+    if ($cmd -and $cmd.Source) {
+      return $cmd.Source
+    }
+  }
+  return $null
+}
+
+function Set-AgentCommandIfMissing([string[]] $EnvNames, [string[]] $CommandNames) {
+  foreach ($envName in $EnvNames) {
+    if ([Environment]::GetEnvironmentVariable($envName, 'Process')) {
+      return
+    }
+  }
+  $path = Find-CommandPath $CommandNames
+  if (-not $path) {
+    return
+  }
+  [Environment]::SetEnvironmentVariable($EnvNames[0], $path, 'Process')
+}
+
+$bash = Find-GitBash
+
+$windowsDirexioHome = if ($env:DIREXIO_HOME) { $env:DIREXIO_HOME } else { Join-Path $env:USERPROFILE '.direxio' }
+$env:DIREXIO_WINDOWS_HOME = $windowsDirexioHome
+$env:DIREXIO_HOME = ConvertTo-GitBashPath $windowsDirexioHome
+$env:DIREXIO_LOCAL_PATH_STYLE = 'windows'
+
+if (-not $env:DIREXIO_AGENT_WORKSPACE) {
+  $env:DIREXIO_AGENT_WORKSPACE_WINDOWS = (Get-Location).ProviderPath
+}
+
+if ($env:P2P_WORKDIR) {
+  $env:P2P_WORKDIR_WINDOWS = $env:P2P_WORKDIR
+  $env:P2P_WORKDIR = ConvertTo-GitBashPath $env:P2P_WORKDIR
+}
+
+if (-not $env:DIREXIO_CODEX_COMMAND) {
+  $codex = Find-CodexBinary
+  if ($codex) { $env:DIREXIO_CODEX_COMMAND = $codex }
+}
+
+Set-AgentCommandIfMissing @('DIREXIO_CLAUDECODE_COMMAND', 'DIREXIO_CLAUDE_CODE_COMMAND', 'DIREXIO_CLAUDE_COMMAND') @('claude.exe', 'claude.cmd', 'claude', 'claude-code.exe', 'claude-code.cmd', 'claude-code')
+Set-AgentCommandIfMissing @('DIREXIO_GEMINI_COMMAND') @('gemini.exe', 'gemini.cmd', 'gemini')
+Set-AgentCommandIfMissing @('DIREXIO_COPILOT_COMMAND') @('copilot.exe', 'copilot.cmd', 'copilot')
+Set-AgentCommandIfMissing @('DIREXIO_DEVIN_COMMAND') @('devin.exe', 'devin.cmd', 'devin')
+Set-AgentCommandIfMissing @('DIREXIO_KIMI_COMMAND') @('kimi.exe', 'kimi.cmd', 'kimi')
+Set-AgentCommandIfMissing @('DIREXIO_OPENCODE_COMMAND', 'DIREXIO_OPEN_CODE_COMMAND') @('opencode.exe', 'opencode.cmd', 'opencode')
+Set-AgentCommandIfMissing @('DIREXIO_IFLOW_COMMAND') @('iflow.exe', 'iflow.cmd', 'iflow')
+Set-AgentCommandIfMissing @('DIREXIO_QODER_COMMAND', 'DIREXIO_QODERCLI_COMMAND') @('qodercli.exe', 'qodercli.cmd', 'qodercli', 'qoder.exe', 'qoder.cmd', 'qoder')
+Set-AgentCommandIfMissing @('DIREXIO_PI_COMMAND') @('pi.exe', 'pi.cmd', 'pi')
+Set-AgentCommandIfMissing @('DIREXIO_ANTIGRAVITY_COMMAND', 'DIREXIO_AGY_COMMAND') @('agy.exe', 'agy.cmd', 'agy')
+Set-AgentCommandIfMissing @('DIREXIO_OPENCLAW_COMMAND') @('openclaw.exe', 'openclaw.cmd', 'openclaw')
+Set-AgentCommandIfMissing @('DIREXIO_HERMES_COMMAND') @('hermes.exe', 'hermes.cmd', 'hermes')
+
+$repoRootForBash = ConvertTo-GitBashPath $RepoRoot
+$quotedArgs = ($OrchestrateArgs | ForEach-Object { Quote-BashArg $_ }) -join ' '
+$command = "cd $(Quote-BashArg $repoRootForBash) && ./scripts/orchestrate.sh $quotedArgs"
+
+& $bash -lc $command
+exit $LASTEXITCODE