fapony 0.2.0 → 0.2.1

package/src/hook.ts

@@ -26,8 +26,8 @@ import {
   statSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { basename, join, relative, resolve } from "node:path";
-import { collectSourceFiles, SCAN_EXTS } from "./analyze.js";
+import { basename, join, relative, resolve, sep } from "node:path";
+import { buildGraphCached, collectSourceFiles, SCAN_EXTS } from "./analyze.js";
 import { openDb } from "./db/index.js";
 import { debtForFile, loadConventions } from "./debt.js";
 import { readMemLog } from "./memory.js";
@@ -63,7 +63,7 @@ export function hintLogPath(worktree: string): string {
 export interface HintFireRow {
   ts: string;
   worktree: string;
-  surface: "read" | "debt" | "mem" | "commit";
+  surface: "read" | "debt" | "mem" | "commit" | "edit";
   file: string | null;
   count: number;
   ids?: string[];
@@ -96,7 +96,13 @@ export function recordHintFire(row: HintFireRow): void {
 
 export interface HintImpact {
   fired: number;
-  by_surface: { read: number; debt: number; mem: number; commit: number };
+  by_surface: {
+    read: number;
+    debt: number;
+    mem: number;
+    commit: number;
+    edit: number;
+  };
   debt: { shown: number; resolved: number; unknown: number };
   window: string | null;
 }
@@ -115,7 +121,7 @@ export function computeHintImpact(
   const dir = hintLogDir();
   const impact: HintImpact = {
     fired: 0,
-    by_surface: { read: 0, debt: 0, mem: 0, commit: 0 },
+    by_surface: { read: 0, debt: 0, mem: 0, commit: 0, edit: 0 },
     debt: { shown: 0, resolved: 0, unknown: 0 },
     window: since ?? null,
   };
@@ -212,9 +218,13 @@ export interface RawStopPayload {
   conversation_id?: string;
   loop_count?: number;
   status?: string;
+  // Codex — hooks contract (https://learn.chatgpt.com/docs/hooks)
+  session_id?: string;
+  model?: string;
+  permission_mode?: string;
 }
 
-export type StopClient = "claude" | "cursor";
+export type StopClient = "claude" | "cursor" | "codex";
 
 export interface NormalizedStopInput {
   client: StopClient;
@@ -319,11 +329,32 @@ export function isCursorPayload(raw: RawStopPayload): boolean {
   );
 }
 
-/** Field-mapping only — both clients feed the same decideStop below. */
+/** Codex sends permission_mode and/or model — fields neither Claude nor Cursor include in Stop. */
+export function isCodexPayload(raw: RawStopPayload): boolean {
+  return (
+    typeof raw.permission_mode === "string" ||
+    (typeof raw.model === "string" && !isCursorPayload(raw))
+  );
+}
+
+/** Field-mapping only — all three clients feed the same decideStop below. */
 export function normalizeStopInput(
   raw: RawStopPayload,
   home: string,
 ): NormalizedStopInput {
+  if (isCodexPayload(raw)) {
+    // Codex: cwd is the session working directory; stop_hook_active means
+    // the hook already fired once (same semantics as Claude).
+    return {
+      client: "codex",
+      cwd: raw.cwd ?? process.cwd(),
+      transcriptPath:
+        typeof raw.transcript_path === "string" && raw.transcript_path
+          ? raw.transcript_path
+          : null,
+      stopHookActive: raw.stop_hook_active === true,
+    };
+  }
   if (isCursorPayload(raw)) {
     const cwd = raw.workspace_roots?.[0] ?? raw.cwd ?? process.cwd();
     let transcriptPath =
@@ -350,12 +381,13 @@ export function normalizeStopInput(
   };
 }
 
-/** Claude blocks with decision:block; Cursor's stop hook "blocks" by
- *  auto-submitting the reason as the next user message. */
+/** Claude blocks with decision:block; Cursor auto-submits as followup_message;
+ *  Codex continues with decision:block + reason (continue:false would take
+ *  precedence and end the turn instead — Codex Hooks, Stop section). */
 export function stopOutput(client: StopClient, reason: string): string {
-  return client === "cursor"
-    ? JSON.stringify({ followup_message: reason })
-    : JSON.stringify({ decision: "block", reason });
+  if (client === "cursor") return JSON.stringify({ followup_message: reason });
+  if (client === "codex") return JSON.stringify({ decision: "block", reason });
+  return JSON.stringify({ decision: "block", reason });
 }
 
 /** Reads the Stop-hook JSON on stdin, prints a block decision or nothing. */
@@ -370,6 +402,7 @@ export async function cmdHookStop(): Promise<void> {
     // died — commits from those turns are still caught at the next completed
     // stop (the window is the conversation transcript's birthtime).
     if (client === "cursor" && raw.status !== "completed") return;
+    // Codex: no status guard needed — Stop fires at turn end unconditionally.
 
     const worktree = git(["rev-parse", "--show-toplevel"], norm.cwd);
 
@@ -633,6 +666,132 @@ export function rereadHintFor(opts: RereadHintInput): string | null {
   }
 }
 
+// --- Edit hint (PreToolUse annotate — importer count + once-per-session dedupe) ---
+//
+// Editing a file that has importers can silently break its consumers (measured:
+// 17.9% of changed nodes over 30 commits had a 1-hop blast radius; ~12-16% of
+// all-time fail rows were producer/consumer mismatches). The hint is a fact —
+// the importer count plus the review-seed command that lists them — never a
+// judgment about whether the edit is safe, and never a block.
+//
+// Dedupe is per (session, file): the first edit to a file fires, repeats stay
+// silent. The track log reuses the read-track session mechanism (sessionKey,
+// one jsonl per session) but lives in its own dir — sharing read-track's file
+// would make an Edit look like a Read and falsely trip the re-read hint. Like
+// rereadHintFor the track write happens inside this function (the caller-side
+// rule covers recordHintFire, not dedupe state); unlike it there is no mtime
+// comparison — an edit that moves mtime is still the same file in the same
+// session, and repeating the count buys nothing.
+
+const EDIT_TRACK_DIR = "edit-track";
+
+export interface EditTrackRow {
+  ts: string;
+  path: string;
+}
+
+/** Directory holding one edit log per session. */
+function editTrackDir(): string {
+  const base =
+    process.env.FAPONY_STATE_DIR || join(homedir(), ".config", "fapony");
+  return join(base, EDIT_TRACK_DIR);
+}
+
+/** Absolute path of a session's edit log — may not exist. */
+export function editTrackPath(session: string): string {
+  return join(editTrackDir(), `${sessionKey(session)}.jsonl`);
+}
+
+function editTrackPaths(session: string): Set<string> {
+  const p = editTrackPath(session);
+  if (!existsSync(p)) return new Set();
+  const out = new Set<string>();
+  for (const line of readFileSync(p, "utf-8").split("\n")) {
+    if (!line) continue;
+    try {
+      const r = JSON.parse(line) as EditTrackRow;
+      if (typeof r.path === "string") out.add(r.path);
+    } catch {
+      // a torn line must not lose the rest of the log
+    }
+  }
+  return out;
+}
+
+function appendEditTrackRow(session: string, row: EditTrackRow): void {
+  const dir = editTrackDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  appendFileSync(editTrackPath(session), `${JSON.stringify(row)}\n`, "utf-8");
+}
+
+export interface EditHintInput {
+  filePath: unknown;
+  cwd: string;
+  /**
+   * Session identity — transcript path (Claude) or session id. Without it the
+   * hint still fires (the importer fact holds) but cannot dedupe.
+   */
+  session?: unknown;
+}
+
+/**
+ * Factual one-liner for editing a source file that has importers, or null.
+ * Every unknown (no path, non-source ext, new/unsaved file, outside the
+ * worktree, no git repo, graph failure) resolves to null — a hint must never
+ * fire on a guess. Files with importers are checked before the dedupe log is
+ * touched, so a file nobody imports never writes a track row.
+ */
+export function editHintFor(opts: EditHintInput): string | null {
+  try {
+    if (typeof opts.filePath !== "string" || opts.filePath === "") return null;
+    const dot = opts.filePath.lastIndexOf(".");
+    // SCAN_EXTS keys carry the dot (".ts") — slice from the dot itself.
+    if (dot < 0 || !SCAN_EXTS.has(opts.filePath.slice(dot))) return null;
+    // review-seed is a git command — outside a repo the hint would lie.
+    const git = Bun.spawnSync(["git", "rev-parse", "--show-toplevel"], {
+      cwd: opts.cwd,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    if (git.exitCode !== 0) return null;
+    // macOS /var → /private/var: normalize both sides before comparing.
+    const worktree = realpathSync(git.stdout.toString().trim());
+    const abs = (() => {
+      const p = opts.filePath.startsWith("/")
+        ? opts.filePath
+        : join(opts.cwd, opts.filePath);
+      try {
+        return realpathSync(p);
+      } catch {
+        return null; // new file — nothing imports it yet
+      }
+    })();
+    if (!abs) return null;
+    const rel = relative(worktree, abs).split(sep).join("/");
+    if (rel.startsWith("..") || rel === "") return null;
+
+    const importers = buildGraphCached(worktree).dependents.get(rel);
+    if (!importers || importers.size === 0) return null;
+
+    if (typeof opts.session === "string" && opts.session !== "") {
+      if (editTrackPaths(opts.session).has(abs)) return null;
+      appendEditTrackRow(opts.session, {
+        ts: new Date().toISOString(),
+        path: abs,
+      });
+    }
+
+    const n = importers.size;
+    return (
+      `fapony: ${rel} has ${n} importer${n === 1 ? "" : "s"} — ` +
+      `review-seed --files ${rel} lists them (add --callers <export> for one ` +
+      `export's callers); check before changing its shape`
+    );
+  } catch {
+    return null;
+  }
+}
+
 // --- Commit hint (tool.execute.after — annotate only, never block) ---
 //
 // OpenCode has no Stop hook (Cursor does — see cursor.ts hook-stop wiring)
@@ -835,6 +994,80 @@ export async function cmdHookReadHint(): Promise<void> {
   }
 }
 
+/** Claude Code PreToolUse (matcher Edit): stdin JSON in, additionalContext out.
+ *  No permissionDecision ever — the edit always proceeds. Fires once per
+ *  (session, file); the dedupe lives inside editHintFor. */
+export async function cmdHookEditHint(): Promise<void> {
+  try {
+    const raw = JSON.parse(await Bun.stdin.text()) as {
+      cwd?: string;
+      transcript_path?: string;
+      session_id?: string;
+      tool_input?: {
+        file_path?: unknown;
+      };
+    };
+    const cwd = raw.cwd ?? process.cwd();
+    const filePath = raw.tool_input?.file_path;
+    // One edit log per session — same identity as the read hint.
+    const session = raw.transcript_path ?? raw.session_id;
+    const hint = editHintFor({ filePath, cwd, session });
+    if (hint) {
+      console.log(
+        JSON.stringify({
+          hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            additionalContext: hint,
+          },
+        }),
+      );
+    }
+
+    // --- hint-fire log (PLAN-edit-importer-hint chunk 3) ---
+    // After output — best-effort, never block the hint.
+    if (hint) {
+      try {
+        const g = Bun.spawnSync(["git", "rev-parse", "--show-toplevel"], {
+          cwd,
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+        if (g.exitCode === 0) {
+          const worktree = realpathSync(g.stdout.toString().trim());
+          const abs =
+            typeof filePath === "string"
+              ? (() => {
+                  try {
+                    return realpathSync(
+                      filePath.startsWith("/")
+                        ? filePath
+                        : join(worktree, filePath),
+                    );
+                  } catch {
+                    return null;
+                  }
+                })()
+              : null;
+          const rel = abs
+            ? relative(worktree, abs).split("\\").join("/")
+            : null;
+          recordHintFire({
+            ts: new Date().toISOString(),
+            worktree,
+            surface: "edit",
+            file: rel && !rel.startsWith("..") ? rel : null,
+            count: 1,
+          });
+        }
+      } catch {
+        // best-effort — swallow
+      }
+    }
+  } catch {
+    // any failure = no hint; a hook must never block an edit over a hint
+  }
+}
+
 // --- Debt + mem context (PLAN-convention-debt chunk 4) ---
 //
 // The one moment paying down debt is worth tokens is when the file is already

package/src/init-mem.ts

@@ -13,7 +13,7 @@ import {
   rmSync,
 } from "node:fs";
 import { join } from "node:path";
-import { loadConfig } from "./db/index.js";
+import { DEFAULT_MEM_DIR, FAPONY_DIR, loadConfig } from "./db/index.js";
 
 export function copyDir(src: string, dest: string): string[] {
   mkdirSync(dest, { recursive: true });
@@ -62,8 +62,8 @@ export function cmdInitMem(args: string[]): void {
       for (const entry of readdirSync(dir, { withFileTypes: true })) {
         if (
           entry.isDirectory() &&
-          !entry.name.startsWith(".") &&
-          entry.name !== "node_modules"
+          entry.name !== "node_modules" &&
+          (!entry.name.startsWith(".") || entry.name === FAPONY_DIR)
         ) {
           walk(join(dir, entry.name), depth + 1);
         }
@@ -95,7 +95,7 @@ export function cmdInitMem(args: string[]): void {
           `keeping ${d} — has ${logs.length} log file(s): ${logs.join(", ")}`,
         );
         console.log(
-          `  move them under ${join(d, "..", ".fapony", ".memory")}/, or re-run with --force to delete`,
+          `  move them under ${DEFAULT_MEM_DIR}/, or re-run with --force to delete`,
         );
         kept++;
         continue;
@@ -109,7 +109,7 @@ export function cmdInitMem(args: string[]): void {
     console.log(
       `\nremoved ${removed} legacy .memory/ director${removed === 1 ? "y" : "ies"}${
         kept > 0
-          ? ` · kept ${kept} with logs — move them under .fapony/.memory/, then re-run`
+          ? ` · kept ${kept} with logs — move them under ${DEFAULT_MEM_DIR}/, then re-run`
           : ""
       }`,
     );

package/src/init.ts

@@ -17,6 +17,7 @@ import {
   type Config,
   doneDir,
   evidenceFile,
+  FAPONY_DIR,
   memoryDir,
   planDir,
   specDir,
@@ -108,7 +109,7 @@ export function initProject(targetPath: string, config?: Config): void {
   mkdirSync(targetPath, { recursive: true });
 
   // --- .fapony/ marker ---
-  const faponyDir = join(targetPath, ".fapony");
+  const faponyDir = join(targetPath, FAPONY_DIR);
   if (existsSync(faponyDir)) {
     throw new Error(
       `${faponyDir} already exists — delete it first if you want a fresh scaffold.`,
@@ -142,7 +143,7 @@ export function initProject(targetPath: string, config?: Config): void {
   writeFileSync(evidencePath, EVIDENCE_JSON);
 
   // --- plan/ spec/ .memory/ — all under .fapony/ ---
-  const planDirAbs = join(targetPath, planDir(config));
+  const planDirAbs = join(targetPath, planDir());
   if (existsSync(planDirAbs)) {
     throw new Error(`${planDirAbs} already exists — not overwriting.`);
   }
@@ -156,7 +157,7 @@ export function initProject(targetPath: string, config?: Config): void {
   mkdirSync(doneDirAbs, { recursive: true });
 
   // --- spec/ ---
-  const specDirAbs = join(targetPath, specDir(config));
+  const specDirAbs = join(targetPath, specDir());
   if (existsSync(specDirAbs)) {
     throw new Error(`${specDirAbs} already exists — not overwriting.`);
   }
@@ -177,9 +178,9 @@ export function initProject(targetPath: string, config?: Config): void {
   console.log(
     `  .fapony/         — project dir (plans, specs, memory, evidence)`,
   );
-  console.log(`  ${planDir(config)}/    — live plan files`);
+  console.log(`  ${planDir()}/    — live plan files`);
   console.log(`  ${doneDir(config)}/    — shipped plans (archive)`);
-  console.log(`  ${specDir(config)}/    — spec files`);
+  console.log(`  ${specDir()}/    — spec files`);
   console.log(
     `  ${evidenceFile(config)}    — allowlist for 'fapony report' (edit the cmds!)`,
   );

package/src/install/claude.ts

@@ -105,6 +105,10 @@ export function cmdInstallClaude(
       console.error(`  (Claude Code user scope)`);
       const dir = claudeSkillsDir(deps.homedir ?? homedir);
       reportSkills(linkSkills(dir, dryRun), dir, dryRun);
+      // MCP is already wired, but a hook can be new since the last install
+      // (e.g. the Edit hint) — always ensure the hook wiring, not only on a
+      // fresh MCP add. This is the upgrade path for existing installs.
+      installClaudeHooks(dryRun, deps);
       return;
     }
     console.error(
@@ -120,6 +124,9 @@ export function cmdInstallClaude(
   if (dryRun) {
     console.error(`── dry-run: would run ──`);
     console.error(`  ${addArgs.join(" ")}`);
+    // Dry-run shows the hook wiring too — the installers are dry-run-safe
+    // ("would write", no writes), so the preview stays truthful.
+    installClaudeHooks(dryRun, deps);
     return;
   }
 
@@ -148,9 +155,9 @@ export function cmdInstallClaude(
   installStatusline(dryRun, deps);
 
   // Wire the Stop hook that refuses to end a turn with ungraded commits,
-  // and the Read hint that annotates large-file reads (annotate-only).
-  installStopHook(dryRun, deps);
-  installReadHintHook(dryRun, deps);
+  // and the Read/Edit hints that annotate reads of large files and edits to
+  // files with importers (both annotate-only).
+  installClaudeHooks(dryRun, deps);
 }
 
 /**
@@ -336,6 +343,18 @@ function ensureClaudeHook(
   );
 }
 
+/**
+ * Wire every hook fapony owns: the Stop hook that refuses to end a turn with
+ * ungraded commits, and the Read/Edit PreToolUse hints (annotate-only).
+ * Idempotent and dry-run-safe. Called on every install, not just a fresh MCP
+ * add — an existing install must still pick up a hook added later.
+ */
+function installClaudeHooks(dryRun: boolean, deps: InstallDeps): void {
+  installStopHook(dryRun, deps);
+  installReadHintHook(dryRun, deps);
+  installEditHintHook(dryRun, deps);
+}
+
 function installStopHook(dryRun: boolean, deps: InstallDeps): void {
   ensureClaudeHook(dryRun, deps, {
     event: "Stop",
@@ -361,3 +380,18 @@ function installReadHintHook(dryRun: boolean, deps: InstallDeps): void {
     label: "read hint",
   });
 }
+
+/**
+ * PreToolUse hook on Edit: annotates an edit with the file's importer count
+ * plus the review-seed command that lists them, once per (session, file).
+ * Annotate only — no permissionDecision is ever returned, the edit always
+ * proceeds. The matcher "Edit" keeps the spawn off every other tool call.
+ */
+function installEditHintHook(dryRun: boolean, deps: InstallDeps): void {
+  ensureClaudeHook(dryRun, deps, {
+    event: "PreToolUse",
+    matcher: "Edit",
+    subcommand: "hook-edit-hint",
+    label: "edit hint",
+  });
+}

package/src/install/codex.ts

@@ -1,17 +1,30 @@
 // src/install/codex.ts — Codex install provider
 //
-// Reads/writes ~/.codex/config.toml directly. Codex has no CLI for MCP config.
+// Reads/writes ~/.codex/config.toml directly for MCP config.
+// Reads/writes ~/.codex/hooks.json for lifecycle hooks (Stop).
+// Symlinks skills into ~/.agents/skills/ (same dir as ZCode).
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { CODEX_MCP_ENTRY, defaultExit, type InstallDeps } from "./types.js";
+import { agentsSkillsDir, linkSkills, reportSkills } from "./skills.js";
+import {
+  CODEX_MCP_ENTRY,
+  defaultExit,
+  INSTALL_ROOT,
+  type InstallDeps,
+} from "./types.js";
 
 export function findCodexConfig(getHome: () => string): string | null {
   const p = join(getHome(), ".codex", "config.toml");
   return existsSync(p) ? p : null;
 }
 
+export function findCodexHooksJson(getHome: () => string): string | null {
+  const p = join(getHome(), ".codex", "hooks.json");
+  return existsSync(p) ? p : null;
+}
+
 function isCodexConfigured(content: string): boolean {
   // Check if [mcp_servers.fapony] section exists with our command
   const sectionRegex = /\[mcp_servers\.fapony\]/;
@@ -20,9 +33,86 @@ function isCodexConfigured(content: string): boolean {
   return content.includes("fapony.ts") && content.includes("mcp");
 }
 
+function readJsonObject(path: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Append the fapony Stop hook to ~/.codex/hooks.json.
+ * Never replaces other hook groups or foreign entries within the Stop group.
+ * Fapony-owned entry is identified by the command string containing "hook-stop".
+ */
+function installStopHook(dryRun: boolean, getHome: () => string): void {
+  const hooksPath = join(getHome(), ".codex", "hooks.json");
+  let config: Record<string, unknown> = {};
+  if (existsSync(hooksPath)) {
+    const parsed = readJsonObject(hooksPath);
+    if (!parsed) {
+      console.error(
+        `  stop hook: ${hooksPath} is unreadable or malformed — skipping`,
+      );
+      return;
+    }
+    config = parsed;
+  }
+
+  const hookMap = config.hooks;
+  if (
+    hookMap !== undefined &&
+    (typeof hookMap !== "object" || Array.isArray(hookMap))
+  ) {
+    console.error(
+      `  stop hook: ${hooksPath} has an unexpected "hooks" shape — skipping`,
+    );
+    return;
+  }
+
+  const map = (hookMap ?? {}) as Record<string, unknown>;
+  // Codex Stop array: each element is { matcher?, hooks: [...] }
+  const stop = Array.isArray(map.Stop) ? (map.Stop as unknown[]) : [];
+
+  // Check if fapony stop hook already present (by command string)
+  const serialized = JSON.stringify(stop);
+  if (serialized.includes("hook-stop")) {
+    console.error(`  stop hook: already configured in hooks.json — no change`);
+    return;
+  }
+
+  const command = `bun ${join(INSTALL_ROOT, "fapony.ts")} hook-stop`;
+  const faponyEntry = { hooks: [{ type: "command", command }] };
+  const after = {
+    ...config,
+    hooks: { ...map, Stop: [...stop, faponyEntry] },
+  };
+
+  if (!dryRun) {
+    try {
+      writeFileSync(hooksPath, `${JSON.stringify(after, null, 2)}\n`, "utf-8");
+    } catch (e) {
+      console.error(`  stop hook: failed to write — ${(e as Error).message}`);
+      return;
+    }
+  }
+  console.error(
+    `  stop hook: ${dryRun ? "would write" : "wrote"} hooks.Stop → ${hooksPath}`,
+  );
+  console.error(
+    `    review and trust via Codex /hooks before the hook will run`,
+  );
+}
+
 export function cmdInstallCodex(dryRun: boolean, deps: InstallDeps = {}): void {
   const exitFn = deps.exit ?? defaultExit;
-  const configPath = findCodexConfig(deps.homedir ?? homedir);
+  const getHome = deps.homedir ?? homedir;
+  const configPath = findCodexConfig(getHome);
 
   if (!configPath) {
     console.error(
@@ -44,18 +134,20 @@ export function cmdInstallCodex(dryRun: boolean, deps: InstallDeps = {}): void {
   if (isCodexConfigured(content)) {
     console.error(`✓ mcp_servers.fapony already configured — no change needed`);
     console.error(`  (${configPath})`);
-    return;
-  }
-
-  if (dryRun) {
+  } else if (dryRun) {
     console.error(`── dry-run: would append to ${configPath} ──`);
     console.log(CODEX_MCP_ENTRY);
-    return;
+  } else {
+    const newContent = `${content.trimEnd()}\n\n${CODEX_MCP_ENTRY}`;
+    writeFileSync(configPath, newContent);
+    console.error(`✓ added mcp_servers.fapony to ${configPath}`);
+    console.error(`  restart Codex to load the MCP server`);
   }
 
-  // Append the fapony MCP server entry to the end of the config file
-  const newContent = `${content.trimEnd()}\n\n${CODEX_MCP_ENTRY}`;
-  writeFileSync(configPath, newContent);
-  console.error(`✓ added mcp_servers.fapony to ${configPath}`);
-  console.error(`  restart Codex to load the MCP server`);
+  // --- Stop hook (~/.codex/hooks.json) ---
+  installStopHook(dryRun, getHome);
+
+  // --- Skills (~/.agents/skills/) ---
+  const skillsDir = agentsSkillsDir(getHome);
+  reportSkills(linkSkills(skillsDir, dryRun), skillsDir, dryRun);
 }