docks-kit 0.15.5 → 0.16.1

package/cli/src/engine-native/claudeSync.ts

@@ -22,6 +22,7 @@ import {
   syncClaudeModel
 } from "./claudeSettingsModifiers"
 import { claudeRuntimePaths, materializeClaudeSettings, type ClaudeRuntimePaths } from "./claudeRuntime"
+import { RETIRED_PERMISSION_RULES } from "./claudeRetired"
 import { p, spawnProcess, writeBytesIfChanged, writeTextIfChanged } from "./exec"
 import type { Ctx } from "./index"
 import { compareCodepoints, deepMerge, isObject, jqStringify, parseJson, type Json } from "./jq"
@@ -398,8 +399,14 @@ const REMOVED_MANIFEST = {
     "hooks.PreToolUse"
   ],
   permissionRules: {
-    allow: ["Write(./)", "Bash(rtk *)"],
-    deny: ["Write(**/.env)", "Write(**/.env.local)", "Write(**/secrets/**)"]
+    allow: ["Write(./)", "Bash(rtk *)", ...RETIRED_PERMISSION_RULES.allow],
+    deny: [
+      "Write(**/.env)",
+      "Write(**/.env.local)",
+      "Write(**/secrets/**)",
+      ...RETIRED_PERMISSION_RULES.deny
+    ],
+    ask: [...RETIRED_PERMISSION_RULES.ask]
   },
   claudeJsonKeys: [] as Array<string>,
   /** Home-relative artifacts the kit installed outside ~/.claude. */
@@ -447,14 +454,14 @@ function pruneJsonKeys(ctx: Ctx, file: string, keys: Array<string>): number {
 function prunePermissionRules(
   ctx: Ctx,
   file: string,
-  rules: Readonly<Record<"allow" | "deny", ReadonlyArray<string>>>
+  rules: Readonly<Record<"allow" | "deny" | "ask", ReadonlyArray<string>>>
 ): number {
   if (!existsSync(file)) return 0
   const doc = parseJson(readFileSync(file, "utf8"))
   if (doc === undefined || !isObject(doc) || !isObject(doc["permissions"])) return 0
   const permissions = doc["permissions"]
   let present = 0
-  for (const key of ["allow", "deny"] as const) {
+  for (const key of ["allow", "deny", "ask"] as const) {
     const values = permissions[key]
     if (!Array.isArray(values)) continue
     const removed = new Set(rules[key])

package/cli/src/engine-native/codexSync.ts

@@ -20,6 +20,7 @@ export async function codexSync(ctx: Ctx): Promise<void> {
   await ensureBubblewrap(ctx)
   if (!ctx.dryRun) mkdirSync(codexDir, { recursive: true })
   syncConfig(ctx, sotConfig, userConfig)
+  removeRetiredImportedHooks(ctx, codexDir)
   syncCodexModel(ctx, ctx.codexModel)
   syncCodexEffort(ctx, ctx.codexEffort)
   syncRules(ctx, payloadPaths("SoT/.codex/rules/"), p(codexDir, "rules"))
@@ -29,6 +30,74 @@ export async function codexSync(ctx: Ctx): Promise<void> {
   await syncPlugins(ctx, sotConfig)
 }
 
+const RETIRED_CONTEXT_HOOK = `echo "[CONTEXT] Current date: $(date '+%A, %Y-%m-%d %H:%M:%S %Z')"`
+const RETIRED_SKILLS_HOOK = `SKILL_COUNT=$(find .claude/skills -name 'SKILL.md' -mindepth 2 -maxdepth 2 2>/dev/null | wc -l); [ "$SKILL_COUNT" -gt 0 ] && echo "[SKILLS] $SKILL_COUNT project skills available in .claude/skills/. Claude Code loads them on demand via Skill tool. After code changes affecting documented patterns, update the relevant skill and its metadata.updated field." || true`
+const RETIRED_CONFIG_HOOKS = new Set([
+  `echo "[CONFIG] Context: $([ \\\"\${CLAUDE_CODE_DISABLE_1M_CONTEXT:-0}\\\" = \\\"1\\\" ] && echo '200K' || echo '1M') | Compact-window: \${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-full} | Effort: \${CLAUDE_CODE_EFFORT_LEVEL:-high} | Thinking: adaptive | Subagent: \${CLAUDE_CODE_SUBAGENT_MODEL:-default}"`,
+  `echo "[CONFIG] Context: $([ \\\"\${CLAUDE_CODE_DISABLE_1M_CONTEXT:-0}\\\" = \\\"1\\\" ] && echo '200K' || echo '1M') | Compact-window: \${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-full} | Effort: \${CLAUDE_CODE_EFFORT_LEVEL:-high} | Thinking: adaptive | Model: \${ANTHROPIC_DEFAULT_OPUS_MODEL:-default} | Subagent: \${CLAUDE_CODE_SUBAGENT_MODEL:-default}"`,
+  `echo "[CONFIG] Context: $([ \\\"\${CLAUDE_CODE_DISABLE_1M_CONTEXT:-0}\\\" = \\\"1\\\" ] && echo '200K' || echo '1M') | Compact-window: \${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-full} | Effort: \${CLAUDE_CODE_EFFORT_LEVEL:-$(jq -r .effortLevel $HOME/.claude/settings.json 2>/dev/null || echo default)} | Thinking: adaptive | Subagent: \${CLAUDE_CODE_SUBAGENT_MODEL:-default}"`
+])
+
+function isRetiredImportedSessionStartHook(handler: Json, codexDir: string): boolean {
+  if (!isObject(handler) || handler["type"] !== "command" || typeof handler["command"] !== "string") return false
+  const command = handler["command"]
+  const connectorScript = p(codexDir, "hooks", "disable-claudeai-connectors.sh")
+  const retiredConnectorHook = `[ -x '${connectorScript}' ] && '${connectorScript}' || true`
+  return command === RETIRED_CONTEXT_HOOK || command === RETIRED_SKILLS_HOOK || RETIRED_CONFIG_HOOKS.has(command) || command === retiredConnectorHook
+}
+
+function withoutRetiredImportedHooks(doc: { [key: string]: Json }, codexDir: string): { readonly value: Json; readonly removed: number } {
+  const hooks = doc["hooks"]
+  if (!isObject(hooks) || !Array.isArray(hooks["SessionStart"])) return { value: doc, removed: 0 }
+
+  let removed = 0
+  const groups: Array<Json> = []
+  for (const group of hooks["SessionStart"]) {
+    if (!isObject(group) || !Array.isArray(group["hooks"])) {
+      groups.push(group)
+      continue
+    }
+    const kept = group["hooks"].filter((handler) => {
+      if (!isRetiredImportedSessionStartHook(handler, codexDir)) return true
+      removed++
+      return false
+    })
+    if (kept.length > 0) groups.push({ ...group, hooks: kept })
+  }
+  if (removed === 0) return { value: doc, removed: 0 }
+
+  const nextHooks = { ...hooks }
+  if (groups.length > 0) nextHooks["SessionStart"] = groups
+  else delete nextHooks["SessionStart"]
+  return { value: { ...doc, hooks: nextHooks }, removed }
+}
+
+/** Remove only Claude hooks that docks-kit retired before Codex could import them safely. */
+function removeRetiredImportedHooks(ctx: Ctx, codexDir: string): void {
+  const { change, echo, warn } = ctx.services.logger
+  const hooksFile = p(codexDir, "hooks.json")
+  if (!existsSync(hooksFile)) return
+  const before = readFileSync(hooksFile, "utf8")
+  const doc = parseJson(before)
+  if (doc === undefined || !isObject(doc)) {
+    warn(`Codex hooks file is not a valid JSON object; retired hook cleanup skipped: ${hooksFile}`)
+    return
+  }
+  const result = withoutRetiredImportedHooks(doc, codexDir)
+  if (result.removed === 0) return
+
+  if (ctx.dryRun) {
+    echo(`[dry-run] remove ${result.removed} retired imported docks-kit SessionStart hook(s) from ${hooksFile}`)
+    return
+  }
+
+  copyFileSync(hooksFile, `${hooksFile}.bak`)
+  writeFileSync(`${hooksFile}.tmp`, jqStringify(result.value))
+  renameSync(`${hooksFile}.tmp`, hooksFile)
+  change(`Codex: removed ${result.removed} retired imported docks-kit SessionStart hook(s) (backup at hooks.json.bak)`)
+  ctx.nextStepTriggers.codexRestart = true
+}
+
 // ---------------------------------------------------------- bubblewrap ----
 
 async function ensureBubblewrap(ctx: Ctx): Promise<void> {

package/cli/src/engine-native/deps.ts

@@ -23,6 +23,7 @@ export type ToolId =
   | "npx"
   | "claude"
   | "codex"
+  | "omp"
   | "bun"
   | "bwrap"
   | "ffplay"
@@ -181,6 +182,12 @@ export const DEPENDENCIES: Record<ToolId, DependencySpec> = {
     (pf = rawPlatform()) => hostOs(platformName(pf)).installHint("codex"),
     { version: versionProbe("codex") }
   ),
+  omp: spec(
+    "omp",
+    "optional",
+    () => "install omp from https://github.com/can1357/oh-my-pi (an existing install self-updates with `omp update`)",
+    { version: versionProbe("omp", ["--version"], (out) => out.trim().replace(/^omp[/v]/, "")) }
+  ),
   bun: spec(
     "bun",
     "optional",

package/cli/src/engine-native/harnesses.ts

@@ -0,0 +1,75 @@
+/**
+ * Per-machine harness selection at ~/.docks-kit/state.json. The selection keeps
+ * the omp harness opt-in. A missing or unreadable state file is represented by
+ * undefined so callers resolve it to LEGACY_SELECTION and existing machines
+ * keep today's behavior.
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { homedir } from "node:os"
+
+import { p } from "./exec"
+
+export type Harness = "claude" | "codex" | "agents" | "omp"
+
+export const HARNESSES: ReadonlyArray<Harness> = ["claude", "codex", "agents", "omp"]
+export const LEGACY_SELECTION: ReadonlyArray<Harness> = ["claude", "codex", "agents"]
+
+function isHarness(value: unknown): value is Harness {
+  return value === "claude" || value === "codex" || value === "agents" || value === "omp"
+}
+
+function normalizeHarnesses(selection: ReadonlyArray<unknown>): Array<Harness> {
+  const selected = new Set<Harness>()
+  for (const value of selection) {
+    if (isHarness(value)) selected.add(value)
+  }
+  return HARNESSES.filter((harness) => selected.has(harness))
+}
+
+/** Resolve the engine home root from HOME with the platform home as fallback. */
+export function engineHome(env: NodeJS.ProcessEnv = process.env): string {
+  const home = env["HOME"]
+  return home !== undefined && home !== "" ? home : homedir()
+}
+
+export function harnessStateFile(home: string): string {
+  return p(home, ".docks-kit", "state.json")
+}
+
+/** Read valid local state without allowing corruption to make sync unusable. */
+export function readHarnessSelection(home: string): ReadonlyArray<Harness> | undefined {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(harnessStateFile(home), "utf8")) as unknown
+  } catch {
+    return undefined
+  }
+
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return undefined
+  const state = parsed as Record<string, unknown>
+  if (state["version"] !== 1 || !Array.isArray(state["harnesses"])) return undefined
+
+  const selection = normalizeHarnesses(state["harnesses"])
+  return selection.length > 0 ? selection : undefined
+}
+
+export function writeHarnessSelection(home: string, selection: ReadonlyArray<Harness>): void {
+  if (selection.length === 0) {
+    throw new Error("Cannot write an empty harness selection because sync would become a no-op")
+  }
+
+  const harnesses = normalizeHarnesses(selection)
+  if (harnesses.length === 0) {
+    throw new Error("Harness selection must contain at least one known harness name")
+  }
+
+  const directory = p(home, ".docks-kit")
+  const file = harnessStateFile(home)
+  const text = `${JSON.stringify({ version: 1, harnesses }, null, 2)}\n`
+  // `mode` applies only when mkdir creates the path, so an existing permissive
+  // ~/.docks-kit would keep its mode.
+  mkdirSync(directory, { recursive: true, mode: 0o700 })
+  chmodSync(directory, 0o700)
+  writeFileSync(file, text, { mode: 0o600 })
+  chmodSync(file, 0o600)
+}

package/cli/src/engine-native/index.ts

@@ -6,7 +6,7 @@
  * vocabulary directly.
  */
 import { p } from "./exec"
-import { homedir } from "node:os"
+import { engineHome } from "./harnesses"
 
 import { kitHome } from "../kitHome"
 import { payloadText } from "../payload"
@@ -15,6 +15,7 @@ import type { TerminalLease } from "./logger"
 import type { BunRuntimeState } from "./bun"
 import { claudeNextSteps, claudeSummary, claudeSync, type ClaudeRuntimeState } from "./claudeSync"
 import { codexNextSteps, codexSummary, codexSync } from "./codexSync"
+import { ompNextSteps, ompSummary, ompSync, type OmpState } from "./ompSync"
 import { normalizeManifest, skillsNextSteps, skillsSummary, skillsSync, type SkillsState } from "./skillsSync"
 import { modeModel, modeToolchain } from "./modes"
 import { ExitError, parseArgs, parseClaudePlugin, parseCompactWindow, validateModifierFlags } from "./parseArgs"
@@ -81,6 +82,7 @@ export interface Ctx {
   readonly repoDir: string
   readonly home: string
   readonly agentsDir: string
+  readonly interactive: boolean
   dryRun: boolean
   verbose: boolean
   skipBubblewrap: boolean
@@ -106,19 +108,21 @@ export interface Ctx {
   syncClaude: boolean
   syncCodex: boolean
   syncAgents: boolean
+  syncOmp: boolean
   /** Per-run next-step triggers (Output Policy): advice prints only when its trigger changed or --verbose. */
   readonly nextStepTriggers: {
     claudePlugins: boolean
     claudeRestart: boolean
     codexRestart: boolean
     skillsRestart: boolean
+    ompRestart: boolean
   }
 }
 
 /** Globals default from env using the historical ${VAR:-default} contract. */
 function makeCtx(services: EngineServices): Ctx {
   const env = process.env
-  const home = env["HOME"] !== undefined && env["HOME"] !== "" ? env["HOME"] : homedir()
+  const home = engineHome(env)
   const compactWindowSource = env["CLAUDE_COMPACT_WINDOW"] ?? ""
   const claudeCompactWindow = compactWindowSource === "" ? "" : parseCompactWindow(compactWindowSource)
   if (claudeCompactWindow === undefined) {
@@ -133,6 +137,11 @@ function makeCtx(services: EngineServices): Ctx {
     repoDir: kitHome(),
     home,
     agentsDir: env["AGENTS_DIR"] !== undefined && env["AGENTS_DIR"] !== "" ? env["AGENTS_DIR"] : p(home, ".agents"),
+    interactive:
+      env["DOCKS_KIT_INTERACTIVE"] === "1" ||
+      (env["DOCKS_KIT_INTERACTIVE"] !== "0" &&
+        process.stdout.isTTY === true &&
+        process.stdin.isTTY === true),
     dryRun: env["DRY_RUN"] === "1",
     verbose: env["DOCKS_KIT_VERBOSE"] === "1",
     skipBubblewrap: env["SKIP_BUBBLEWRAP"] === "1",
@@ -154,7 +163,14 @@ function makeCtx(services: EngineServices): Ctx {
     syncClaude: false,
     syncCodex: false,
     syncAgents: false,
-    nextStepTriggers: { claudePlugins: false, claudeRestart: false, codexRestart: false, skillsRestart: false }
+    syncOmp: false,
+    nextStepTriggers: {
+      claudePlugins: false,
+      claudeRestart: false,
+      codexRestart: false,
+      skillsRestart: false,
+      ompRestart: false
+    }
   }
 }
 
@@ -181,6 +197,7 @@ async function engineSync(ctx: Ctx, args: ReadonlyArray<string>): Promise<number
     | { readonly kind: "claude"; readonly runtime: ClaudeRuntimeState }
     | { readonly kind: "codex" }
     | { readonly kind: "skills"; readonly state: SkillsState }
+    | { readonly kind: "omp"; readonly state: OmpState }
   interface SelectedPipeline {
     readonly name: string
     readonly run: SyncTask<PipelineResult>
@@ -208,6 +225,12 @@ async function engineSync(ctx: Ctx, args: ReadonlyArray<string>): Promise<number
       run: async () => ({ kind: "skills", state: await skillsSync(ctx) })
     })
   }
+  if (ctx.syncOmp) {
+    selected.push({
+      name: "omp",
+      run: async () => ({ kind: "omp", state: await ompSync(ctx) })
+    })
+  }
 
   // A populated skills manifest deploys with `-a claude-code codex`, and symlink healing also writes into Claude's tree.
   ctx.syncConcurrency = syncConcurrencyForManifest(
@@ -243,9 +266,11 @@ async function engineSync(ctx: Ctx, args: ReadonlyArray<string>): Promise<number
   const codexRan = ctx.syncCodex
   let claudeRuntime: ClaudeRuntimeState | undefined
   let skillsState: SkillsState | undefined
+  let ompState: OmpState | undefined
   for (const result of results) {
     if (result.kind === "claude") claudeRuntime = result.runtime
     else if (result.kind === "skills") skillsState = result.state
+    else if (result.kind === "omp") ompState = result.state
   }
 
   echo("")
@@ -254,11 +279,13 @@ async function engineSync(ctx: Ctx, args: ReadonlyArray<string>): Promise<number
   if (claudeRuntime !== undefined) claudeSummary(ctx, claudeRuntime)
   if (codexRan) codexSummary(ctx)
   if (skillsState !== undefined) skillsSummary(ctx, skillsState)
+  if (ompState !== undefined) ompSummary(ctx, ompState)
 
   const advice = [
     ...(claudeRan ? claudeNextSteps(ctx) : []),
     ...(codexRan ? codexNextSteps(ctx) : []),
-    ...(skillsState !== undefined ? skillsNextSteps(ctx) : [])
+    ...(skillsState !== undefined ? skillsNextSteps(ctx) : []),
+    ...(ompState !== undefined ? ompNextSteps(ctx) : [])
   ]
   if (advice.length > 0) {
     echo("")

package/cli/src/engine-native/ompPaths.ts

@@ -0,0 +1,101 @@
+/**
+ * omp path resolution, mirroring upstream `packages/utils/src/dirs.ts`
+ * `DirResolver`. The kit deploys into two different roots and must not guess
+ * either one: the agent directory holds `AGENTS.md`, `config.yml`, and
+ * `mcp.json`; the data root holds `marketplaces.json` and `plugins/`.
+ *
+ * Resolution reads the environment and probes directory existence only, so a
+ * dry run stays free of omp subcommands.
+ */
+import { existsSync } from "node:fs"
+import { isAbsolute, resolve } from "node:path"
+
+import { p } from "./exec"
+
+/** Upstream CONFIG_DIR_NAME; PI_CONFIG_DIR renames this directory under home. */
+const DEFAULT_CONFIG_DIR_NAME = ".omp"
+/** Upstream APP_NAME, the fixed segment under an XDG category root. */
+const APP_NAME = "omp"
+/** Upstream PROFILE_NAME_RE. An invalid name degrades to the default profile. */
+const PROFILE_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/
+/** Windows device aliases upstream rejects, bare or with any extension. */
+const WINDOWS_RESERVED_BASENAME_RE = /^(?:CON|PRN|AUX|NUL|COM[0-9]|LPT[0-9])(?:\..*)?$/i
+
+export interface OmpPaths {
+  /** undefined for the default profile, else the normalized profile name */
+  readonly profile: string | undefined
+  /** config root for the active profile */
+  readonly configRoot: string
+  /** directory holding AGENTS.md, config.yml, mcp.json - never XDG-redirected */
+  readonly agentDir: string
+  /** root holding marketplaces.json and plugins/ - XDG-redirected when adopted */
+  readonly dataRoot: string
+}
+
+export interface OmpPathInputs {
+  readonly home: string
+  readonly env: Record<string, string | undefined>
+  readonly platform: NodeJS.Platform
+}
+
+/**
+ * Upstream `normalizeProfileName`, minus the throw: an invalid value reaches
+ * `readProfileFromEnvSafe`, which degrades to the default profile so a bad env
+ * var cannot crash a bare import.
+ */
+function normalizeProfile(value: string | undefined): string | undefined {
+  const name = value?.trim()
+  if (name === undefined || name === "" || name === "default") return undefined
+  if (name === "." || name === ".." || name.endsWith(".")) return undefined
+  if (!PROFILE_NAME_RE.test(name) || WINDOWS_RESERVED_BASENAME_RE.test(name)) return undefined
+  return name
+}
+
+/** Upstream applies `path.resolve` to PI_CODING_AGENT_DIR, so cwd anchors a relative value. */
+function resolveAgentOverride(value: string): string {
+  return isAbsolute(value) ? value : resolve(process.cwd(), value)
+}
+
+export function ompPaths({ home, env, platform }: OmpPathInputs): OmpPaths {
+  // OMP_PROFILE wins whenever it is defined, including when explicitly empty;
+  // PI_PROFILE is only the legacy fallback.
+  const profile = normalizeProfile(env["OMP_PROFILE"] !== undefined ? env["OMP_PROFILE"] : env["PI_PROFILE"])
+
+  // PI_CONFIG_DIR is a config root dirname joined under home, not a path.
+  const configDirName = env["PI_CONFIG_DIR"]
+  const baseRoot = p(home, configDirName !== undefined && configDirName !== "" ? configDirName : DEFAULT_CONFIG_DIR_NAME)
+  const configRoot = profile === undefined ? baseRoot : p(baseRoot, "profiles", profile)
+
+  // A named profile derives its own agent directory and ignores the override.
+  const agentOverride = env["PI_CODING_AGENT_DIR"]
+  const defaultAgentDir = p(configRoot, "agent")
+  const agentDir = profile === undefined && agentOverride !== undefined && agentOverride !== ""
+    ? resolveAgentOverride(agentOverride)
+    : defaultAgentDir
+
+  return { profile, configRoot, agentDir, dataRoot: xdgDataRoot(env, platform, profile, agentDir === defaultAgentDir) ?? configRoot }
+}
+
+/**
+ * XDG is a Linux and macOS convention upstream disables whenever an agent-dir
+ * override is active, and adopts a category only once its omp directory
+ * exists - `omp config init-xdg` creates it without moving existing data. A
+ * named profile keys on its own `profiles/<name>` path and adopts that path,
+ * so a profile stays where it was first activated.
+ */
+function xdgDataRoot(
+  env: Record<string, string | undefined>,
+  platform: NodeJS.Platform,
+  profile: string | undefined,
+  agentDirIsDefault: boolean
+): string | undefined {
+  if (!agentDirIsDefault) return undefined
+  if (platform !== "linux" && platform !== "darwin") return undefined
+
+  const dataHome = env["XDG_DATA_HOME"]
+  if (dataHome === undefined || dataHome === "") return undefined
+
+  const appRoot = p(dataHome, APP_NAME)
+  const candidate = profile === undefined ? appRoot : p(appRoot, "profiles", profile)
+  return existsSync(candidate) ? candidate : undefined
+}