gitnexus 1.6.9 → 1.6.10-aptos.0

package/dist/cli/index.js

@@ -3,7 +3,7 @@
 // Removing it from here improves MCP server startup time significantly.
 import { Command } from 'commander';
 import { createRequire } from 'node:module';
-import { createLazyAction, createLbugLazyAction } from './lazy-action.js';
+import { createAnalyzerLbugLazyAction, createLazyAction, createLbugLazyAction, } from './lazy-action.js';
 import { EMBEDDING_DIMS_ERROR, normalizeEmbeddingDims } from './embedding-dims.js';
 import { registerGroupCommands } from './group.js';
 import { localizeCliHelp } from './help-i18n.js';
@@ -17,7 +17,7 @@ function collectCodingAgents(value, previous) {
 program.name('gitnexus').description('GitNexus local CLI and MCP server').version(pkg.version);
 program
     .command('setup')
-    .description('One-time setup: configure MCP for Cursor, Claude Code, Antigravity, OpenCode, Codex')
+    .description('One-time setup: configure MCP for Cursor, Claude Code, Antigravity, OpenCode, CodeBuddy, Qoder, Codex')
     .option('-c, --coding-agent <agents>', 'Configure only these coding agents (comma-separated or repeatable)', collectCodingAgents)
     .action(createLazyAction(() => import('./setup.js'), 'setupCommand'));
 program
@@ -53,8 +53,8 @@ program
     'Without this flag, analyze always updates the workspace index, which follows the ' +
     'checked-out working tree. Distinct from --default-branch (cosmetic base_ref).')
     .option('--no-stats', 'Omit volatile file/symbol counts from AGENTS.md and CLAUDE.md')
-    .option('--skip-skills', 'Skip installing standard GitNexus skill files under .claude/skills/gitnexus/. ' +
-    'Does not suppress community skills from --skills (those use .claude/skills/generated/). ' +
+    .option('--skip-skills', 'Skip installing standard GitNexus skill files directly under .claude/skills/. ' +
+    'Does not suppress community skills from --skills (those use .claude/skills/gitnexus-area-*). ' +
     'Use --index-only to skip all AI-context file injection.')
     .option('--index-only', 'Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills)')
     .option('--skip-git', 'Treat the provided path/cwd as the index root and skip parent git-root discovery')
@@ -119,7 +119,7 @@ program
         process.env.GITNEXUS_EMBEDDING_DIMS = dimsEnvBaseline;
     }
 })
-    .action(createLbugLazyAction(() => import('./analyze.js'), 'analyzeCommand'));
+    .action(createAnalyzerLbugLazyAction(() => import('../core/analyzer-identity.js'), () => import('./analyze.js'), 'analyzeCommandWithRunnerIdentity', import.meta.url));
 program
     .command('index [path...]')
     .description('Register an existing .gitnexus/ folder into the global registry (no re-analysis needed)')
@@ -148,18 +148,31 @@ program
 program
     .command('status')
     .description('Show index status for current repo')
+    .option('--json', 'Emit machine-readable index and analyzer provenance')
+    .addHelpText('after', () => t('help.identityCache.environment'))
     .action(createLazyAction(() => import('./status.js'), 'statusCommand'));
 program
     .command('doctor')
     .description('Show runtime platform capabilities and embedding configuration')
     .action(createLazyAction(() => import('./doctor.js'), 'doctorCommand'));
+program
+    .command('embeddings')
+    .description('Manage the on-demand local embedding runtime')
+    .command('install')
+    .description('Install the local embedding stack (@huggingface/transformers + onnxruntime-node) on demand. ' +
+    'Heals installs where npm skipped the optional packages (e.g. behind an HTTP proxy, #2370). ' +
+    'Downloads only from your configured npm registry — mirrors and proxies apply.')
+    .option('--cuda', "Also download the CUDA GPU binaries (runs onnxruntime-node's NuGet postinstall; " +
+    'set GLOBAL_AGENT_HTTPS_PROXY behind a proxy)')
+    .option('--force', 'Install into the runtime prefix even when the stack already resolves')
+    .action(createLazyAction(() => import('./embeddings.js'), 'embeddingsInstallCommand'));
 program
     .command('clean')
     .description('Delete GitNexus index for current repo')
     .option('-f, --force', 'Skip confirmation prompt')
     .option('--all', 'Clean all indexed repos')
     .option('--branch <name>', 'Delete only the named branch index (not the workspace index)')
-    .option('--lbug-sidecars', 'Clean quarantined LadybugDB missing-shadow WAL sidecars')
+    .option('--lbug-sidecars', 'Clean parked LadybugDB recovery sidecars (missing-shadow WAL quarantines and dirty-recovery parks)')
     .action(createLazyAction(() => import('./clean.js'), 'cleanCommand'));
 program
     .command('remove <target>')
@@ -181,6 +194,7 @@ program
     .option('--concurrency <n>', 'Parallel LLM calls (default: 3)', '3')
     .option('--timeout <seconds>', 'LLM request timeout in seconds (default: disabled)')
     .option('--retries <n>', 'Max LLM retry attempts per request (default: 3)')
+    .option('--allow-insecure-connection <host>', 'Allow exact host(s) for http:// LLM base URLs (comma-separated; HTTPS is preferred)')
     .option('--gist', 'Publish wiki as a public GitHub Gist after generation')
     .option('-v, --verbose', 'Enable verbose output (show LLM commands and responses)')
     .option('--review', 'Stop after grouping to review module structure before generating pages')
@@ -281,7 +295,7 @@ program
     .command('eval-server')
     .description('Start lightweight HTTP server for fast tool calls during evaluation')
     .option('-p, --port <port>', 'Port number', '4848')
-    .option('--host <host>', 'Bind address (default: 127.0.0.1, use 0.0.0.0 to expose to all interfaces)')
+    .option('--host <host>', 'Bind address or resolvable hostname (default: 127.0.0.1; non-loopback requires GITNEXUS_AUTH_TOKEN; hostnames resolve to IPv4)')
     .option('--idle-timeout <seconds>', 'Auto-shutdown after N seconds idle (0 = disabled)', '0')
     .action(createLbugLazyAction(() => import('./eval-server.js'), 'evalServerCommand'));
 registerGroupCommands(program);

package/dist/cli/lazy-action.d.ts

@@ -5,3 +5,10 @@
  */
 export declare function createLazyAction<TModule extends Record<string, unknown>, TKey extends string & keyof TModule>(loader: () => Promise<TModule>, exportName: TKey): (...args: unknown[]) => Promise<void>;
 export declare function createLbugLazyAction<TModule extends Record<string, unknown>, TKey extends string & keyof TModule>(loader: () => Promise<TModule>, exportName: TKey): (...args: unknown[]) => Promise<void>;
+/**
+ * Analyze-specific lazy action. Unlike the generic LadybugDB wrapper, this
+ * captures the complete analyzer receipt before probing/loading native code or
+ * evaluating the analyzer module graph. The target export receives that start
+ * receipt as its first argument and threads it to runFullAnalysis.
+ */
+export declare function createAnalyzerLbugLazyAction<TModule extends Record<string, unknown>, TKey extends string & keyof TModule>(identityLoader: () => Promise<Pick<typeof import('../core/analyzer-identity.js'), 'captureAnalyzerIdentityBeforeLoad'>>, loader: () => Promise<TModule>, exportName: TKey, analyzerModuleUrl: string): (...args: unknown[]) => Promise<void>;

package/dist/cli/lazy-action.js

@@ -33,3 +33,30 @@ export function createLbugLazyAction(loader, exportName) {
         await action(...args);
     };
 }
+/**
+ * Analyze-specific lazy action. Unlike the generic LadybugDB wrapper, this
+ * captures the complete analyzer receipt before probing/loading native code or
+ * evaluating the analyzer module graph. The target export receives that start
+ * receipt as its first argument and threads it to runFullAnalysis.
+ */
+export function createAnalyzerLbugLazyAction(identityLoader, loader, exportName, analyzerModuleUrl) {
+    return async (...args) => {
+        const identityModule = await identityLoader();
+        const prepared = await identityModule.captureAnalyzerIdentityBeforeLoad(analyzerModuleUrl, async () => {
+            const check = checkLbugNative();
+            if (!check.ok)
+                return { check, module: null };
+            return { check, module: await loader() };
+        });
+        if (!prepared.loaded.check.ok) {
+            process.stderr.write(`\n  ${prepared.loaded.check.message?.replace(/\n/g, '\n  ')}\n\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const action = prepared.loaded.module?.[exportName];
+        if (!isCallable(action)) {
+            throw new Error(`Lazy action export not found: ${exportName}`);
+        }
+        await action(prepared.runnerIdentity, ...args);
+    };
+}

package/dist/cli/mcp.js

@@ -44,10 +44,11 @@ export const mcpCommand = async (options) => {
     // stdout at module init, but transitive deps (pino, pino-pretty, the
     // worker-thread transport) could in theory, and the import-closure
     // regression test enforces the leaf invariant.
-    const [{ startMCPServer }, { LocalBackend }, { logger }] = await Promise.all([
+    const [{ startMCPServer }, { LocalBackend }, { logger }, { createMcpRepositoryPolicy }] = await Promise.all([
         import('../mcp/server.js'),
         import('../mcp/local/local-backend.js'),
         import('../core/logger.js'),
+        import('../mcp/repository-policy.js'),
     ]);
     // Missing-optional-grammar warnings are intentionally NOT emitted here.
     // `gitnexus analyze` already warns at index time, filtered by the repo's
@@ -59,7 +60,8 @@ export const mcpCommand = async (options) => {
     // so repos indexed after the server starts are discovered automatically.
     const backend = new LocalBackend();
     await backend.init();
-    const repos = await backend.listRepos();
+    const repositoryPolicy = await createMcpRepositoryPolicy(backend);
+    const repos = await repositoryPolicy.scopeBackend(backend).listRepos();
     if (repos.length === 0) {
         // Operator-actionable but the server still starts and serves; warn-level,
         // not error. Tools will discover newly-analyzed repos via lazy refresh.
@@ -85,6 +87,7 @@ export const mcpCommand = async (options) => {
                 port,
                 host: options.host ?? '127.0.0.1',
                 authToken: resolveAuthToken(options.authToken, process.env),
+                repositoryPolicy,
             });
         }
         catch (err) {
@@ -94,5 +97,5 @@ export const mcpCommand = async (options) => {
         return;
     }
     // Start MCP server (serves all repos, discovers new ones lazily)
-    await startMCPServer(backend);
+    await startMCPServer(backend, repositoryPolicy);
 };

package/dist/cli/move-availability.d.ts

@@ -0,0 +1,5 @@
+/** Warn once if a repo has Move sources but no usable move-flow binary is reachable. */
+export declare function warnIfMoveUnavailable(opts: {
+    repoHasMove: boolean;
+    context?: string;
+}): void;

package/dist/cli/move-availability.js

@@ -0,0 +1,11 @@
+/** Warn once if a repo has Move sources but no usable move-flow binary is reachable. */
+import { tryCreateMoveFlowClient } from '../core/move/mcp-client.js';
+import { cliWarn } from './cli-message.js';
+export function warnIfMoveUnavailable(opts) {
+    if (!opts.repoHasMove)
+        return;
+    if (tryCreateMoveFlowClient())
+        return;
+    const ctx = opts.context ? ` [${opts.context}]` : '';
+    cliWarn(`GitNexus${ctx}: move-flow is unavailable — .move files will not be indexed. Reinstall without GITNEXUS_SKIP_MOVE_FLOW=1, or set MOVE_FLOW to a move-flow binary from aptos-labs/aptos-ai.`, { binary: 'move-flow', context: opts.context });
+}

package/dist/cli/setup.d.ts

@@ -37,6 +37,14 @@ interface SetupResult {
  * install paths copy this same list from hooks/claude/ (the canonical source).
  */
 export declare function copyHookHelpers(srcDir: string, destDir: string, label: string, result: SetupResult): Promise<string[]>;
+export declare const RENAMED_SKILL_DIRS: Readonly<Record<string, readonly string[]>>;
+/**
+ * Every legacy directory name superseded by a shipped rename. These no longer
+ * exist in the bundled skills/ source, but a pre-rename install left them
+ * behind in every editor target. Setup only warns about them (it cannot prove
+ * it owns the contents); uninstall's ownership-by-name contract removes them.
+ */
+export declare const LEGACY_SKILL_DIR_NAMES: readonly string[];
 export declare const setupCommand: (options?: {
     codingAgent?: string[] | string;
 }) => Promise<void>;

package/dist/cli/setup.js

@@ -14,7 +14,7 @@ import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import { parseTree, modify, applyEdits, parse as parseJsonc } from 'jsonc-parser';
 import { getGlobalDir } from '../storage/repo-manager.js';
-import { getEditorTargets, mcpTarget, skillTarget, hookTarget, detectIndentation, } from './editor-targets.js';
+import { getEditorTargets, mcpTarget, skillTarget, hookTarget, detectIndentation, isEnoent, } from './editor-targets.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const execFileAsync = promisify(execFile);
@@ -22,8 +22,10 @@ const execFileAsync = promisify(execFile);
 // a config that persists in the user's editor and is invoked on every MCP
 // connect. Pinning to the installed version means subsequent invocations
 // skip the npm-registry metadata roundtrip (and stay reproducible until
-// the user upgrades). Static configs and READMEs intentionally use
-// `gitnexus@latest` since they're quickstart docs, not persisted state.
+// the user upgrades). The plugin skill mcp.json are likewise pinned and
+// re-stamped every release by scripts/sync-plugin-manifests.mjs (#2445),
+// since they too execute `gitnexus@<version>` on connect. Only the READMEs
+// stay on `gitnexus@latest` — they're quickstart docs, not executed state.
 const _require = createRequire(import.meta.url);
 const _pkg = _require('../../package.json');
 if (typeof _pkg.version !== 'string' || !_pkg.version) {
@@ -66,6 +68,8 @@ const CODING_AGENT_IDS = {
     claude: 'claude',
     antigravity: 'antigravity',
     opencode: 'opencode',
+    codebuddy: 'codebuddy',
+    qoder: 'qoder',
     codex: 'codex',
 };
 const SUPPORTED_CODING_AGENTS = Object.values(CODING_AGENT_IDS);
@@ -173,7 +177,13 @@ async function mergeJsoncFile(filePath, keyPath, value) {
     try {
         raw = await fs.readFile(filePath, 'utf-8');
     }
-    catch {
+    catch (err) {
+        // Only an absent file means "start fresh". Any other read failure (EACCES,
+        // EIO, cloud-placeholder faults) must not be treated as empty — the write
+        // below would replace the user's existing config with a gitnexus-only
+        // document and report success. Rethrow into the per-editor catch instead.
+        if (!isEnoent(err))
+            throw err;
         raw = '';
     }
     if (raw.trim().length === 0) {
@@ -207,6 +217,35 @@ async function dirExists(dirPath) {
         return false;
     }
 }
+/**
+ * Detection probe: is there a non-empty regular file at this path?
+ * Swallows ALL errors (like dirExists) — detection gates run outside the
+ * per-editor try blocks, so a rethrowing probe would abort setup for every
+ * remaining editor. Size > 0 keeps detection aligned with the config-chain
+ * resolver: an empty config file is not evidence of an install, and treating
+ * it as one would route the write to a fresh file whose mkdir manufactures
+ * the editor's directory.
+ */
+async function isNonEmptyFile(filePath) {
+    try {
+        const stat = await fs.stat(filePath);
+        return stat.isFile() && stat.size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Detection probe: does any file in the target's MCP config chain look like an
+ * install trace? Always walks [file, ...legacyFiles] so an editor gaining
+ * legacyFiles later is automatically covered (CodeBuddy and Qoder share this —
+ * a per-editor copy is how the root-config-only detection gap crept in, see
+ * PR #2368 review I4).
+ */
+async function anyChainConfigFile(target) {
+    const hits = await Promise.all([target.file, ...(target.legacyFiles ?? [])].map(isNonEmptyFile));
+    return hits.includes(true);
+}
 // ─── Editor-specific setup ─────────────────────────────────────────
 async function setupCursor(result) {
     const cursorDir = path.join(os.homedir(), '.cursor');
@@ -287,7 +326,12 @@ async function mergeHooksJsonc(filePath, entries) {
     try {
         raw = await fs.readFile(filePath, 'utf-8');
     }
-    catch {
+    catch (err) {
+        // Same contract as mergeJsoncFile: an unreadable (non-ENOENT) settings
+        // file must not be rewritten as hooks-only — that would destroy every
+        // user setting in it. Rethrow into the hook installer's catch.
+        if (!isEnoent(err))
+            throw err;
         raw = '';
     }
     if (raw.trim().length === 0) {
@@ -365,20 +409,26 @@ export async function copyHookHelpers(srcDir, destDir, label, result) {
     return failedRequired;
 }
 /**
- * Install GitNexus hooks to ~/.claude/settings.json for Claude Code.
- * Merges hook config without overwriting existing hooks, preserving
- * comments and formatting in the JSONC file.
+ * Install GitNexus hooks for editors that use Claude Code's hooks schema.
+ *
+ * Claude Code registers hooks in ~/.claude/settings.json; Codex uses a
+ * dedicated ~/.codex/hooks.json with the identical {hooks: {Event: [...]}}
+ * JSON shape, stdin payload, and hookSpecificOutput response contract
+ * (https://developers.openai.com/codex/hooks), so both runtimes share this
+ * installer and the same bundled adapter script. Merges hook config without
+ * overwriting existing hooks, preserving comments and formatting.
  */
-async function installClaudeCodeHooks(result) {
-    const claudeDir = path.join(os.homedir(), '.claude');
-    if (!(await dirExists(claudeDir)))
+async function installClaudeSchemaHooks(result, id) {
+    const hookCfg = hookTarget(id);
+    const settingsPath = hookCfg.settingsFile;
+    const label = `${hookCfg.label} hooks`;
+    // Gate on the editor's own config dir (~/.claude, ~/.codex) existing.
+    if (!(await dirExists(path.dirname(settingsPath))))
         return;
-    const claudeHook = hookTarget('claude');
-    const settingsPath = claudeHook.settingsFile;
     // Source hooks bundled within the gitnexus package (hooks/claude/)
     const pluginHooksPath = path.join(__dirname, '..', '..', 'hooks', 'claude');
-    // Copy unified hook script to ~/.claude/hooks/gitnexus/
-    const destHooksDir = claudeHook.scriptDir;
+    // Copy unified hook script to the editor's hooks/gitnexus/ dir
+    const destHooksDir = hookCfg.scriptDir;
     try {
         await fs.mkdir(destHooksDir, { recursive: true });
         const src = path.join(pluginHooksPath, 'gitnexus-hook.cjs');
@@ -389,7 +439,7 @@ async function installClaudeCodeHooks(result) {
             const normalizedCli = path.resolve(resolvedCli).replace(/\\/g, '/');
             const jsonCli = JSON.stringify(normalizedCli);
             if (!content.includes(CLI_PATH_SOURCE_LITERAL)) {
-                result.errors.push('Claude Code hooks: gitnexus-hook.cjs no longer contains the cliPath literal to patch — the installed hook may fail to resolve the CLI. Update CLI_PATH_SOURCE_LITERAL in setup.ts.');
+                result.errors.push(`${label}: gitnexus-hook.cjs no longer contains the cliPath literal to patch — the installed hook may fail to resolve the CLI. Update CLI_PATH_SOURCE_LITERAL in setup.ts.`);
             }
             content = content.replace(CLI_PATH_SOURCE_LITERAL, `let cliPath = ${jsonCli};`);
             await fs.writeFile(dest, content, 'utf-8');
@@ -404,12 +454,12 @@ async function installClaudeCodeHooks(result) {
             await fs.access(dest);
         }
         catch {
-            result.errors.push('Claude Code hooks: adapter script was not installed — skipping hook registration');
+            result.errors.push(`${label}: adapter script was not installed — skipping hook registration`);
             return;
         }
-        const failedRequired = await copyHookHelpers(pluginHooksPath, destHooksDir, 'Claude Code hooks', result);
+        const failedRequired = await copyHookHelpers(pluginHooksPath, destHooksDir, label, result);
         if (failedRequired.length > 0) {
-            result.errors.push(`Claude Code hooks: required helper(s) ${failedRequired.join(', ')} failed to copy — skipping hook registration`);
+            result.errors.push(`${label}: required helper(s) ${failedRequired.join(', ')} failed to copy — skipping hook registration`);
             return;
         }
         const hookPath = path.join(destHooksDir, 'gitnexus-hook.cjs').replace(/\\/g, '/');
@@ -425,9 +475,10 @@ async function installClaudeCodeHooks(result) {
             }
         })();
         const hookEntries = [];
-        // NOTE: SessionStart hooks are broken on Windows (Claude Code bug #23576).
-        // Session context is delivered via CLAUDE.md / skills instead.
-        if (!hasGitnexusHook(parsed?.hooks, 'PreToolUse', claudeHook.needle)) {
+        // NOTE: SessionStart hooks are broken on Windows (Claude Code bug #23576),
+        // and Codex reads AGENTS.md natively. Session context is delivered via
+        // CLAUDE.md / AGENTS.md / skills instead.
+        if (!hasGitnexusHook(parsed?.hooks, 'PreToolUse', hookCfg.needle)) {
             hookEntries.push({
                 eventName: 'PreToolUse',
                 value: {
@@ -443,7 +494,7 @@ async function installClaudeCodeHooks(result) {
                 },
             });
         }
-        if (!hasGitnexusHook(parsed?.hooks, 'PostToolUse', claudeHook.needle)) {
+        if (!hasGitnexusHook(parsed?.hooks, 'PostToolUse', hookCfg.needle)) {
             hookEntries.push({
                 eventName: 'PostToolUse',
                 value: {
@@ -460,19 +511,19 @@ async function installClaudeCodeHooks(result) {
             });
         }
         if (hookEntries.length === 0) {
-            result.configured.push('Claude Code hooks (already configured)');
+            result.configured.push(`${label} (already configured)`);
             return;
         }
         const ok = await mergeHooksJsonc(settingsPath, hookEntries);
         if (ok) {
-            result.configured.push('Claude Code hooks (PreToolUse, PostToolUse)');
+            result.configured.push(`${label} (PreToolUse, PostToolUse)`);
         }
         else {
-            result.errors.push('Claude Code hooks: settings.json is corrupt — skipping to preserve existing content');
+            result.errors.push(`${label}: ${path.basename(settingsPath)} is corrupt — skipping to preserve existing content`);
         }
     }
     catch (err) {
-        result.errors.push(`Claude Code hooks: ${err.message}`);
+        result.errors.push(`${label}: ${err.message}`);
     }
 }
 // ─── Antigravity (Google) ──────────────────────────────────────────
@@ -660,6 +711,118 @@ async function setupOpenCode(result) {
         result.errors.push(`OpenCode: ${err.message}`);
     }
 }
+/**
+ * Resolve which config file in a target's [file, ...legacyFiles] priority
+ * chain setup should write into: the first that exists, else the recommended
+ * `file`. CodeBuddy reads only the first existing file in its chain, so
+ * creating the recommended file above a populated deprecated one would shadow
+ * the user's existing MCP servers.
+ */
+async function resolveMcpConfigFile(target) {
+    for (const candidate of [target.file, ...(target.legacyFiles ?? [])]) {
+        try {
+            const stat = await fs.stat(candidate);
+            // Non-empty regular files only: a 0-byte recommended file must not
+            // shadow a populated deprecated one (mergeJsoncFile treats empty as a
+            // fresh document anyway), and directories are never config candidates.
+            if (stat.isFile() && stat.size > 0)
+                return candidate;
+        }
+        catch (err) {
+            // ENOENT = candidate absent — try the next one. Anything else (EACCES
+            // on the file or a parent) is surfaced: silently skipping could route
+            // the write to a lower-priority file the editor never reads.
+            if (!isEnoent(err))
+                throw err;
+        }
+    }
+    return target.file;
+}
+async function setupCodeBuddy(result) {
+    const codebuddyDir = path.join(os.homedir(), '.codebuddy');
+    const target = mcpTarget('codebuddy');
+    // Installed = the config dir exists OR any registered MCP config file does.
+    // A user whose only trace is a root-level config (e.g. a legacy
+    // ~/.codebuddy.json) still gets configured — uninstall already handles that
+    // shape, so setup skipping it was an asymmetry (PR #2368 review I4).
+    if (!(await dirExists(codebuddyDir)) && !(await anyChainConfigFile(target))) {
+        result.skipped.push('CodeBuddy (not installed)');
+        return;
+    }
+    try {
+        const configFile = await resolveMcpConfigFile(target);
+        const ok = await mergeJsoncFile(configFile, target.keyPath, getMcpEntry());
+        if (ok) {
+            result.configured.push('CodeBuddy');
+        }
+        else {
+            result.errors.push(`CodeBuddy: ${path.basename(configFile)} is corrupt — skipping to preserve existing content`);
+        }
+    }
+    catch (err) {
+        result.errors.push(`CodeBuddy: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+async function setupQoder(result) {
+    const qoderDir = path.join(os.homedir(), '.qoder');
+    const target = mcpTarget('qoder');
+    const { file: mcpPath, keyPath } = target;
+    // Same chain-aware detection as CodeBuddy: ~/.qoder.json alone counts.
+    if (!(await dirExists(qoderDir)) && !(await anyChainConfigFile(target))) {
+        result.skipped.push('Qoder (not installed)');
+        return;
+    }
+    try {
+        const ok = await mergeJsoncFile(mcpPath, keyPath, getMcpEntry());
+        if (ok) {
+            result.configured.push('Qoder');
+        }
+        else {
+            result.errors.push('Qoder: .qoder.json is corrupt — skipping to preserve existing content');
+        }
+    }
+    catch (err) {
+        result.errors.push(`Qoder: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Install global CodeBuddy skills to ~/.codebuddy/skills/
+ * (https://www.codebuddy.ai/docs/cli/skills — same SKILL.md layout as Claude Code).
+ */
+async function installCodeBuddySkills(result) {
+    const codebuddyDir = path.join(os.homedir(), '.codebuddy');
+    if (!(await dirExists(codebuddyDir)))
+        return;
+    const skillsDir = skillTarget('codebuddy').dir;
+    try {
+        const installed = await installSkillsTo(skillsDir);
+        if (installed.length > 0) {
+            result.configured.push(`CodeBuddy skills (${installed.length} skills → ~/.codebuddy/skills/)`);
+        }
+    }
+    catch (err) {
+        result.errors.push(`CodeBuddy skills: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Install global Qoder skills to ~/.qoder/skills/
+ * (https://docs.qoder.com/extensions/skills — same SKILL.md layout as Claude Code).
+ */
+async function installQoderSkills(result) {
+    const qoderDir = path.join(os.homedir(), '.qoder');
+    if (!(await dirExists(qoderDir)))
+        return;
+    const skillsDir = skillTarget('qoder').dir;
+    try {
+        const installed = await installSkillsTo(skillsDir);
+        if (installed.length > 0) {
+            result.configured.push(`Qoder skills (${installed.length} skills → ~/.qoder/skills/)`);
+        }
+    }
+    catch (err) {
+        result.errors.push(`Qoder skills: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 /**
  * Build a TOML section for Codex MCP config (~/.codex/config.toml).
  */
@@ -677,7 +840,12 @@ async function upsertCodexConfigToml(configPath) {
     try {
         existing = await fs.readFile(configPath, 'utf-8');
     }
-    catch {
+    catch (err) {
+        // TOML variant of the mergeJsoncFile contract: treating a non-ENOENT read
+        // failure as an empty config would rewrite config.toml with only the
+        // gitnexus section. Rethrow into setupCodex's catch.
+        if (!isEnoent(err))
+            throw err;
         existing = '';
     }
     if (existing.includes(`[${getEditorTargets().codex.tomlSection}]`)) {
@@ -716,6 +884,16 @@ async function setupCodex(result) {
     }
 }
 // ─── Skill Installation ───────────────────────────────────────────
+export const RENAMED_SKILL_DIRS = {
+    'gitnexus-review': ['gitnexus-pr-review'],
+};
+/**
+ * Every legacy directory name superseded by a shipped rename. These no longer
+ * exist in the bundled skills/ source, but a pre-rename install left them
+ * behind in every editor target. Setup only warns about them (it cannot prove
+ * it owns the contents); uninstall's ownership-by-name contract removes them.
+ */
+export const LEGACY_SKILL_DIR_NAMES = Object.values(RENAMED_SKILL_DIRS).flat();
 /**
  * Install GitNexus skills to a target directory.
  * Each skill is installed as {targetDir}/gitnexus-{skillName}/SKILL.md
@@ -771,15 +949,25 @@ async function installSkillsTo(targetDir) {
             if (source.isDirectory) {
                 const dirSource = path.join(skillsRoot, skillName);
                 await copyDirRecursive(dirSource, skillDir);
-                installed.push(skillName);
             }
             else {
                 const flatSource = path.join(skillsRoot, `${skillName}.md`);
                 const content = await fs.readFile(flatSource, 'utf-8');
                 await fs.mkdir(skillDir, { recursive: true });
                 await fs.writeFile(path.join(skillDir, 'SKILL.md'), content, 'utf-8');
-                installed.push(skillName);
             }
+            // A directory superseded by a shipped rename is warned about, never
+            // deleted: the installer cannot prove it owns the contents (users
+            // customize installed skills or hand-write their own under these
+            // names), so an upgrade must not destroy data.
+            for (const oldName of RENAMED_SKILL_DIRS[skillName] ?? []) {
+                const legacyDir = path.join(targetDir, oldName);
+                if (await dirExists(legacyDir)) {
+                    console.log(`[gitnexus] skill "${oldName}" was renamed to "${skillName}"; ` +
+                        `left ${legacyDir} in place — delete it manually if you have not customized it.`);
+                }
+            }
+            installed.push(skillName);
         }
         catch {
             // Source skill not found — skip
@@ -885,12 +1073,16 @@ export const setupCommand = async (options) => {
         await setupAntigravity(result);
     if (selected.has('opencode'))
         await setupOpenCode(result);
+    if (selected.has('codebuddy'))
+        await setupCodeBuddy(result);
+    if (selected.has('qoder'))
+        await setupQoder(result);
     if (selected.has('codex'))
         await setupCodex(result);
     // Install global skills for platforms that support them
     if (selected.has('claude')) {
         await installClaudeCodeSkills(result);
-        await installClaudeCodeHooks(result);
+        await installClaudeSchemaHooks(result, 'claude');
     }
     if (selected.has('antigravity')) {
         await installAntigravitySkills(result);
@@ -900,8 +1092,14 @@ export const setupCommand = async (options) => {
         await installCursorSkills(result);
     if (selected.has('opencode'))
         await installOpenCodeSkills(result);
-    if (selected.has('codex'))
+    if (selected.has('codebuddy'))
+        await installCodeBuddySkills(result);
+    if (selected.has('qoder'))
+        await installQoderSkills(result);
+    if (selected.has('codex')) {
         await installCodexSkills(result);
+        await installClaudeSchemaHooks(result, 'codex');
+    }
     // Print results
     if (result.configured.length > 0) {
         console.log('  Configured:');