great-cto 3.23.0 → 3.24.1

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.23.0",
+  "version": "3.24.1",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"
@@ -55,7 +55,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); if [ -f .claude-plugin/plugin.json ] && grep -q '\"name\": *\"great_cto\"' .claude-plugin/plugin.json 2>/dev/null; then : ; elif [ -n \"$PLUGIN_DIR\" ] && [ -f \"${PLUGIN_DIR}/shared/orchestrator.toml\" ]; then mkdir -p shared; cp \"${PLUGIN_DIR}/shared/orchestrator.toml\" shared/orchestrator.toml 2>/dev/null || true; cp \"${PLUGIN_DIR}/shared/pipeline.toml\" shared/pipeline.toml 2>/dev/null || true; fi",
+            "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); if [ -f .claude-plugin/plugin.json ] && grep -qE '\"name\": *\"great[_-]cto\"' .claude-plugin/plugin.json 2>/dev/null; then : ; elif [ -n \"$PLUGIN_DIR\" ] && [ -f \"${PLUGIN_DIR}/shared/orchestrator.toml\" ]; then mkdir -p shared; cp \"${PLUGIN_DIR}/shared/orchestrator.toml\" shared/orchestrator.toml 2>/dev/null || true; cp \"${PLUGIN_DIR}/shared/pipeline.toml\" shared/pipeline.toml 2>/dev/null || true; fi",
             "timeout": 5,
             "statusMessage": "Refreshing orchestrator contract..."
           },

package/board/packages/board/public/index.html

@@ -772,7 +772,9 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .card-footer > * { flex-shrink: 0; }
 .card-time {
   margin-left: auto;
-  font-family: var(--mono); font-size: var(--fs-caption);
+  /* Explicit, because the weight is inherited from an ancestor while the family
+     is switched here. Geist Mono stops at 500; anything above is synthetic. */
+  font-family: var(--mono); font-weight: 500; font-size: var(--fs-caption);
   color: var(--text3);
 }
 
@@ -1341,13 +1343,27 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   max-width: 880px;
   margin: 0 auto;
 }
-.memory-doc h1 { font-family: var(--display); font-weight: 600; font-size: 28px; letter-spacing: -0.02em; margin: 0 0 14px; color: var(--text); }
-.memory-doc h2 { font-family: var(--display); font-weight: 600; font-size: 20px; margin: 28px 0 10px; color: var(--text); }
+/* 500, not 600: --display is Geist Mono and the vendored face's weight axis
+   ends at 500. Asking for 600 does not get a bolder cut — the browser paints a
+   synthetic bold, which is a smeared stroke rather than a designed one, and
+   tests/lib/rendered-contrast.test.mjs fails on exactly that. The tell is that
+   600 and 700 measure identically: a real axis moves, a synthetic stroke does
+   not. Both headings are fixed together; the test only caught the h1 because
+   the h2 happened not to be on screen. */
+    .memory-doc h1 { font-family: var(--display); font-weight: 500; font-size: 28px; letter-spacing: -0.02em; margin: 0 0 14px; color: var(--text); }
+.memory-doc h2 { font-family: var(--display); font-weight: 500; font-size: 20px; margin: 28px 0 10px; color: var(--text); }
 .memory-doc h3 { font-family: var(--sans); font-weight: 600; font-size: var(--fs-title-s); margin: 18px 0 8px; color: var(--text); }
 .memory-doc p { font-size: var(--fs-base); line-height: 1.65; color: var(--text2); margin: 0 0 10px; }
 .memory-doc ul, .memory-doc ol { padding-left: 22px; margin: 0 0 12px; color: var(--text2); }
 .memory-doc li { line-height: 1.6; font-size: var(--fs-base); }
-.memory-doc code {
+/* An explicit weight, because inheritance crosses the family boundary. A
+   heading is sans at 600 — legitimate — and `code` inside it switches the family
+   to Geist Mono while KEEPING the inherited 600. That face's axis ends at 500,
+   so the browser paints a synthetic bold. No CSS rule sets a mono weight above
+   500 anywhere in this file; the offending value arrives from a parent, which
+   is why grepping for it found nothing. */
+    .memory-doc code {
+  font-weight: 500;
   font-family: var(--mono); font-size: var(--fs-small);
   background: var(--bg-muted);
   padding: 1px 6px; border-radius: 0;
@@ -1546,7 +1562,10 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   padding: 12px 12px 10px;
 }
 .pl-gate .gate-glyph { font-size: var(--fs-small); line-height: 1; flex-shrink: 0; filter: grayscale(1); opacity: 0.6; }
-.pl-gate .pl-name { font-weight: 600; }
+/* 500: .pl-name is mono (see .pl-stage .pl-name) and Geist Mono's axis ends
+   there. 600 buys a synthetic bold, not a bolder cut. The .gate-glyph inside it
+   inherits this, which is why it was failing too. */
+.pl-gate .pl-name { font-weight: 500; }
 .pl-gate.active {
   border-left-color: var(--status-blocked);
   background: color-mix(in srgb, var(--status-blocked) 8%, var(--surface-translucent));
@@ -1664,7 +1683,7 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   border-bottom: 1px solid var(--border);
   font-size: var(--fs-small); white-space: nowrap;
 }
-.cost-table th { font-family: var(--mono); font-size: var(--fs-eyebrow); letter-spacing: 0.08em; text-transform: uppercase; color: var(--text2); }
+.cost-table th { font-family: var(--mono); font-weight: 500; font-size: var(--fs-eyebrow); letter-spacing: 0.08em; text-transform: uppercase; color: var(--text2); }
 .cost-table td.num { font-family: var(--mono); font-variant-numeric: tabular-nums; text-align: right; }
 .cost-axis {
   display: flex; justify-content: space-between;
@@ -2082,10 +2101,11 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   background: var(--bg-card); color: var(--text); min-width: 26ch;
 }
 .budgets-table { width: 100%; border-collapse: collapse; font-size: var(--fs-body); }
-.budgets-table th {
-  text-align: left; font-family: var(--mono); font-size: var(--fs-eyebrow);
+.
+  text-align: left; font-family: var(--mono); font-weight: 500; font-size: var(--fs-eyebrow);
   letter-spacing: 0.08em; text-transform: uppercase; color: var(--text2);
   padding: 0 12px 8px 0; border-bottom: 1px solid var(--border);
+id var(--border);
 }
 .budgets-table td { padding: 10px 12px 10px 0; border-bottom: 1px solid var(--border); vertical-align: middle; }
 /* A row has to answer three questions: what is this agent, what does it cost,
@@ -4190,7 +4210,7 @@ function renderInboxList(rootId, items, countId, opts = {}) {
       // Gates (the showApprove list) get the exact date+time the decision has been
       // waiting since; other rows carry their age in the right-hand column instead.
       (opts.showApprove || t.is_gate === true) && t.updated_at
-        ? `<span title="${esc(fmtDate(t.updated_at))}" style="color:var(--status-gate);font-weight:600">⏳ ${fmtDT(t.updated_at)}</span>`
+        ? `<span title="${esc(fmtDate(t.updated_at))}" style="color:var(--status-gate);font-weight:500">⏳ ${fmtDT(t.updated_at)}</span>`
         : '',
     ].filter(Boolean).join(' · ');
     // 48h is this board's own staleness line — the "Stale (in progress > 48h)"
@@ -6708,7 +6728,7 @@ function cardHTML(t) {
     ? `<span class="card-time">${relTime(t.updated_at)}</span>`
     // A gate is a human decision — show exactly WHEN it's been waiting since (date + time).
     : (isGate && (t.updated_at || t.created_at))
-      ? `<span class="card-time" title="${esc(fmtDate(t.updated_at || t.created_at))}" style="color:var(--status-gate);font-weight:600">⏳ ${fmtDT(t.updated_at || t.created_at)}</span>` : '';
+      ? `<span class="card-time" title="${esc(fmtDate(t.updated_at || t.created_at))}" style="color:var(--status-gate);font-weight:500">⏳ ${fmtDT(t.updated_at || t.created_at)}</span>` : '';
   const descPreview = t.description ? `<div class="card-desc">${esc(t.description.slice(0, 110))}${t.description.length > 110 ? '…' : ''}</div>` : '';
   const statusColor = { backlog:'var(--text3)', in_progress:'var(--status-progress)', done:'var(--status-done)', blocked:'var(--status-blocked)', gate:'var(--status-gate)' };
   const statusDotColor = statusColor[t.status] || 'var(--text3)';

package/board/scripts/lib/gate-reversibility.mjs

@@ -31,6 +31,12 @@ export const CATEGORIES = Object.freeze({
   // Different currency — sunk work rather than an external effect — so it is
   // named separately instead of being folded in.
   'sunk-work': 'reversing it means redoing every stage that ran after it',
+  // Also not one of ADR-009's four, and added for `agent-posture.mjs`, which
+  // reuses this vocabulary rather than inventing a second one for the same axis.
+  // A leaked credential is not undone by reverting anything: a key that reached
+  // 605 transcripts stayed valid until it was revoked, and revocation was the
+  // only fix. Distinct currency again — so, named, not folded in.
+  'unrevocable-disclosure': 'a secret that has been read cannot be un-read; only revocation ends it',
 });
 
 /**

package/dist/adapt.js

@@ -9,6 +9,7 @@
 //   great-cto adapt --dry-run  Show what would be written
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { codexInstallPlan } from "./codex.js";
 const VALID_AI_TOOLS = ["claude-code", "cursor", "copilot", "windsurf", "aider", "codex"];
 function parseAiTools(text) {
     const line = text.match(/^ai_tools:\s*(.+)$/m)?.[1] ?? "";
@@ -309,109 +310,68 @@ dirty-commits: false
 `;
 }
 // ── Codex adapter helpers ──────────────────────────────────────────────────
+// `getCodexHooksJson` used to live here, and `adapt` wrote its output to
+// `.codex/hooks.json`. Six tests certified its shape — the split between
+// blocking and advisory wrappers, the matchers covering `apply_patch` — and all
+// six passed while the file went to a path Codex does not read.
+//
+// Two upstream issues settle it (openai/codex #16430, #39895): hooks load from
+// the config layer only, a plugin cannot carry them, and the `hooks` field is
+// read by nothing "with no warning, error, or log line". `.codex/hooks.json`,
+// project-scoped, was never even the config layer. See
+// docs/analysis/2026-09-05-codex-phase0-findings.md.
+//
+// So the generator is gone rather than corrected. A tested generator writing to
+// a path nothing reads is the exact defect this repository exists to delete: it
+// looked more finished than an absent one.
 /**
- * hooks.json content for ~/.codex/skills/great_cto/hooks.json.
+ * The config.toml fragment for Codex — only the part that runs.
  *
- * Phase 0 findings (2026-06-04, confirmed against Codex Desktop binary):
- * - Hook events: PreToolUse, PostToolUse, SessionStart, SubagentStart,
- *   SubagentStop, PreCompact, PostCompact, UserPromptSubmit, PermissionRequest.
- * - stdin payload: same keys as Claude Code (tool_name, tool_input, is_error).
- * - block/deny: hookSpecificOutput.permissionDecision (same struct as CC)
- *   confirmed by binary string literals.
- * - Hooks enabled by [features].hooks = true in config.toml.
+ * What this used to emit, and why each line is gone:
  *
- * @param skillDir - absolute path to ~/.codex/skills/great_cto (used to build hook commands)
- */
-export function getCodexHooksJson(skillDir) {
-    const s = skillDir; // shorthand
-    return JSON.stringify({
-        "SessionStart": [
-            {
-                "hooks": [
-                    { "command": `node "${s}/scripts/hooks/quota-check.mjs" 2>/dev/null || true`, "timeout": 15 }
-                ]
-            }
-        ],
-        "PreToolUse": [
-            {
-                "matcher": "computer|bash|shell",
-                "hooks": [
-                    { "command": `node "${s}/scripts/hooks/orchestrator-check.mjs" 2>/dev/null || true`, "timeout": 5 },
-                    { "command": `node "${s}/scripts/hooks/cost-guard.mjs" 2>/dev/null || true`, "timeout": 5 }
-                ]
-            },
-            {
-                "matcher": "edit|write|str_replace_editor|computer",
-                "hooks": [
-                    { "command": `node "${s}/scripts/hooks/secret-scan.mjs" 2>/dev/null || true`, "timeout": 8 }
-                ]
-            }
-        ],
-        "PostToolUse": [
-            {
-                "matcher": "edit|write|str_replace_editor",
-                "hooks": [
-                    { "command": `node "${s}/scripts/hooks/format-check.mjs" 2>/dev/null; true`, "timeout": 12, "async": true },
-                    { "command": `node "${s}/scripts/hooks/tool-failure.mjs" 2>/dev/null || true`, "timeout": 3, "async": true }
-                ]
-            },
-            {
-                "matcher": "",
-                "hooks": [
-                    { "command": `node "${s}/scripts/hooks/tool-failure.mjs" 2>/dev/null || true`, "timeout": 3, "async": true }
-                ]
-            }
-        ]
-    }, null, 2);
-}
-/**
- * config.toml fragment to merge into ~/.codex/config.toml.
- * Adds: [features].hooks=true, [mcp_servers.great_cto], [agents.great_cto_skill].
- * Written as a separate file (.codex/great_cto.toml) since merging TOML is
- * non-trivial; installer prints merge instructions.
+ *   [features] hooks = true    turns on a feature a plugin cannot reach
+ *                              (openai/codex#16430) and which has an open
+ *                              timeout regression on 0.148.0+ (#42279)
+ *   CODEX_SKILL_DIR = ~/.codex/skills/great_cto
+ *                              a path a working Codex install does not have;
+ *                              Phase 0 checked, the directory is not created
+ *   [agents.great_cto_*]       six role descriptions presented as "the
+ *                              specialist fleet", with a comment claiming
+ *                              "full 57-agent routing" — we ship seventy, and
+ *                              Codex routes none of them
+ *
+ * An MCP server is the one thing here Codex actually starts, so it is the one
+ * thing left. The rest of the fragment is now a statement of what does NOT come
+ * with it, taken from `codexInstallPlan` so the two cannot drift apart again —
+ * which is precisely how they drifted the first time.
  */
 function getCodexConfigFragment(meta) {
-    return `# great_cto Codex integration — generated by great-cto adapt
-# Merge this into ~/.codex/config.toml or copy the sections manually.
+    const plan = codexInstallPlan({ repoDir: "<path-to-great_cto>", codexOnPath: true });
+    const notes = plan.notSupported.map((n) => `#   - ${n}`).join("\n");
+    return `# great_cto ⇄ Codex — generated by great-cto adapt
 # Generated: ${new Date().toISOString().slice(0, 10)}
-
-[features]
-hooks = true
+#
+# This file contains ONE section, because one section is what Codex runs from a
+# config fragment. Merge it into ~/.codex/config.toml.
+#
+# For skills, install the plugin instead of copying anything by hand:
+#   ${plan.commands.join("\n#   ")}
+#
+# What does NOT come with either, on codex-cli as it stands today:
+${notes}
+#
+# Details, measured rather than inferred:
+# docs/analysis/2026-09-05-codex-phase0-findings.md
 
 [mcp_servers.great_cto]
 command = "npx"
 args = ["great-cto@latest", "mcp"]
-# Set startup timeout generously — npx downloads on first run
+# Generous: npx downloads on first run.
 startup_timeout_sec = 60
 
-[mcp_servers.great_cto.env]
-# Point hooks at the skill dir so hook scripts resolve correctly.
-CODEX_SKILL_DIR = "${process.env.HOME ?? "~"}/.codex/skills/great_cto"
-
-# Agents exposed via MCP (great_cto specialist fleet)
-# Codex will use these as subagent personalities via the [agents] table.
-# Full 57-agent routing is handled inside AGENTS.md / SKILL.md.
-[agents.great_cto_architect]
-description = "Deep architectural reasoning, ADRs, cross-cutting design decisions"
-
-[agents.great_cto_senior_dev]
-description = "Feature implementation with TDD — RED→GREEN→REFACTOR"
-
-[agents.great_cto_qa_engineer]
-description = "QA reports, coverage, regression check after implementation"
-
-[agents.great_cto_security_officer]
-description = "Security audit — OWASP Top 10, auth, PII, secrets"
-
-[agents.great_cto_devops]
-description = "Deploy, canary rollout, rollback, SLO monitoring"
-
-[agents.great_cto_pm]
-description = "Feature decomposition into tasks, timeline, dependency graph"
-
 # Archetype: ${meta.archetype}
 # Compliance: ${meta.compliance.join(", ") || "none"}
-# Re-run great-cto adapt --platform codex to refresh.
+# Re-run great-cto adapt to refresh.
 `;
 }
 function getCliVersion() {
@@ -499,17 +459,30 @@ conventions. Generated by \`great-cto adapt\`.
                 break;
             }
             case "codex": {
-                // Write hooks.json + config.toml fragment to .codex/ (project-scoped, trusted)
-                const defaultSkillDir = `${process.env.HOME ?? "~"}/.codex/skills/great_cto`;
-                const hooksPath = join(cwd, ".codex", "hooks.json");
+                // One file, and only the MCP section in it. The previous version also
+                // wrote `.codex/hooks.json` and then said "restart Codex to activate
+                // hooks and MCP server" — half of which was true. A user who followed
+                // that line came away believing the gate chain and secret-scan were
+                // guarding their session on Codex. They were not, and nothing said so.
                 const configPath = join(cwd, ".codex", "great_cto.toml");
-                if (writeFile(hooksPath, getCodexHooksJson(defaultSkillDir), dryRun))
-                    out.push(".codex/hooks.json");
                 if (writeFile(configPath, getCodexConfigFragment(meta), dryRun))
                     out.push(".codex/great_cto.toml");
+                // A file we used to write and no longer do stays on disk. Say so rather
+                // than delete it: it is in the user's project, and it may be theirs now.
+                const stale = join(cwd, ".codex", "hooks.json");
                 if (!dryRun) {
-                    console.log("  ⚠  Codex: merge .codex/great_cto.toml sections into ~/.codex/config.toml");
-                    console.log("     Then restart Codex to activate hooks and MCP server.");
+                    console.log("  ⚠  Codex: merge .codex/great_cto.toml into ~/.codex/config.toml, then restart Codex.");
+                    console.log("     That gives you the MCP server. For the skills, install the plugin:");
+                    for (const c of codexInstallPlan({ repoDir: "<path-to-great_cto>", codexOnPath: true }).commands) {
+                        console.log(`       ${c}`);
+                    }
+                    console.log("     Hooks, slash commands and the role agents do NOT carry over to Codex today —");
+                    console.log("     see docs/analysis/2026-09-05-codex-phase0-findings.md.");
+                    if (existsSync(stale)) {
+                        console.log("");
+                        console.log("  ⚠  .codex/hooks.json exists and an older great-cto wrote it. Codex never read it");
+                        console.log("     (openai/codex#16430) — delete it yourself if it is not yours.");
+                    }
                 }
                 break;
             }
@@ -568,7 +541,10 @@ export function nextStepsAfterAdapt(aiTools = []) {
         out.push("  1. Restart Claude Code so it picks up the regenerated CLAUDE.md.", "  2. /audit    — full analysis of this codebase (existing project)", "     /start    — scope and build a new feature (greenfield)", "     /inbox    — what needs your decision right now", "  3. great-cto board — Kanban + CTO dashboard at localhost:3141");
     }
     else {
-        out.push(`  Your ${aiTools.join(" / ")} config is live — reload the tool to pick it up.`, "  The agent pipeline (architecture review, QA, security gates) runs inside", "  Claude Code. To use it here: add claude-code to ai_tools in PROJECT.md,", "  then `npx great-cto install`.");
+        // "is live" was wrong for Codex, whose fragment the user still has to merge
+        // into ~/.codex/config.toml by hand — and a line that says a thing is live
+        // is exactly how an unmerged file passes for a working one.
+        out.push(`  Config written for ${aiTools.join(" / ")}. A fragment that says to merge it is not active`, "  until you do — then reload the tool to pick it up.", "  The agent pipeline (architecture review, QA, security gates) runs inside", "  Claude Code. To use it here: add claude-code to ai_tools in PROJECT.md,", "  then `npx great-cto install`.");
     }
     return out;
 }

package/dist/codex.js

@@ -0,0 +1,60 @@
+// Installing great_cto for OpenAI Codex.
+//
+// The first version of this wrote hook scripts into `~/.codex/skills/great_cto/`,
+// emitted a TOML fragment for the user to merge by hand, and set
+// `[features] hooks = true` alongside `[hooks_files]`. Phase 0 checked every one
+// of those against a real codex-cli 0.153.4
+// (docs/analysis/2026-09-05-codex-phase0-findings.md):
+//
+//   ~/.codex/skills/   does not exist on a working install
+//   [hooks_files]      is used by no shipped plugin
+//   hooks on Codex     unverified — the config key parses, and that is all
+//
+// None of it was covered by a test, so it had shipped as a working feature while
+// writing to a path nothing reads.
+//
+// Codex ships `codex plugin marketplace add`, taking a local or Git source, and
+// that path was verified end to end: the plugin reports `installed, enabled
+// 3.23.0` with all 40 skills present. So this emits the supported commands and,
+// as importantly, says what does not come with them.
+/**
+ * What installing for Codex means, decided separately from doing it.
+ *
+ * Pure so the decision can be tested without touching a real Codex install —
+ * the previous version was untestable by construction and therefore untested.
+ */
+export function codexInstallPlan({ repoDir, codexOnPath }) {
+    if (!codexOnPath) {
+        // Refuse rather than write half of it. Config for a CLI that is not present
+        // leaves the user with files and no way to use them, which is how the old
+        // path failed by construction.
+        return {
+            ok: false,
+            why: "codex is not on PATH — install it first: npm i -g @openai/codex",
+            commands: [],
+            supported: [],
+            notSupported: [],
+        };
+    }
+    return {
+        ok: true,
+        why: "",
+        commands: [
+            `codex plugin marketplace add ${repoDir}`,
+            `codex plugin add great-cto@great-cto`,
+        ],
+        // Verified present after install, not assumed.
+        supported: [
+            "skills — all of them, the same tree Claude Code reads",
+            "the MCP server (great_cto), resolved from npm",
+        ],
+        // Checked across every shipped Codex plugin: no manifest declares any of
+        // these. Saying "installed" without saying this would promise a pipeline the
+        // host cannot run.
+        notSupported: [
+            "hooks — no plugin surface; the gate chain and secret-scan do not carry over",
+            "slash commands — no plugin surface",
+            "role agents — Codex plugins carry interface metadata, not agent roles",
+        ],
+    };
+}

package/dist/main.js

@@ -701,101 +701,56 @@ ${bold("Links:")}
 `);
 }
 async function runInitCodex(args) {
-    const { homedir } = await import("node:os");
-    const home = homedir();
+    const { codexInstallPlan } = await import("./codex.js");
+    const { execFileSync, spawnSync } = await import("node:child_process");
     log(bold("great-cto · Codex host install"));
     log("");
-    log(`Installing great_cto for ${cyan("OpenAI Codex")} (Desktop + CLI).`);
-    log(`This writes hook, MCP, and agent config to your Codex skill directory.`);
+    // Is the host actually there? The previous version of this function wrote
+    // hook scripts and a config fragment without checking, into
+    // `~/.codex/skills/great_cto/` — a directory a working Codex install does not
+    // have. It reported success either way.
+    let codexOnPath = false;
+    try {
+        execFileSync("codex", ["--version"], { stdio: "ignore", timeout: 15000 });
+        codexOnPath = true;
+    }
+    catch {
+        codexOnPath = false;
+    }
+    const plan = codexInstallPlan({ repoDir: args.dir, codexOnPath });
+    if (!plan.ok) {
+        error(plan.why);
+        return 1;
+    }
+    log(`This registers ${cyan(args.dir)} as a Codex plugin marketplace and installs from it.`);
+    log("");
+    log(bold("Carries over:"));
+    for (const s2 of plan.supported)
+        log(`  ${green("✓")} ${s2}`);
+    log("");
+    // Printed on every run, not buried in docs. An install that lists only what it
+    // gives promises a pipeline this host cannot run.
+    log(bold("Does NOT carry over on Codex:"));
+    for (const s2 of plan.notSupported)
+        log(`  ${yellow("—")} ${s2}`);
     log("");
     if (args.dryRun) {
-        log(yellow("dry-run: showing what would be written."));
-        log(`  would write: ${home}/.codex/skills/great_cto/hooks.json`);
-        log(`  would write: ${home}/.codex/skills/great_cto/scripts/  (hook .mjs files)`);
-        log(`  would update: .codex/great_cto.toml  (merge into ~/.codex/config.toml)`);
+        log(yellow("dry-run: these commands would run."));
+        for (const c of plan.commands)
+            log(`  ${dim(c)}`);
         return 0;
     }
-    const { mkdirSync, copyFileSync, existsSync, writeFileSync } = await import("node:fs");
-    const { join, dirname } = await import("node:path");
-    const { fileURLToPath } = await import("node:url");
-    // ── 1. locate the plugin source ──────────────────────────
-    // Works whether invoked via npx (global cache) or a local build.
-    // - npx run: dist/main.js → dist/ → ../ → package root → scripts/hooks/
-    // - dev run from packages/cli/: same as above
-    // - repo dev with ts-node: src/main.ts → src/ → ../ → packages/cli/ → ../../scripts/hooks/
-    const here = dirname(fileURLToPath(import.meta.url));
-    const hooksSearchPaths = [
-        join(here, "..", "scripts", "hooks"), // npm install: dist/../scripts/hooks
-        join(here, "..", "..", "scripts", "hooks"), // monorepo: packages/cli/dist/../../scripts
-        join(here, "..", "..", "..", "scripts", "hooks"), // ts-node: src/../../../scripts
-    ];
-    const hooksDir = hooksSearchPaths.find(p => existsSync(p));
-    if (!hooksDir) {
-        error("Could not locate scripts/hooks/. Try: npx great-cto@latest --host codex");
-        return 1;
+    for (const c of plan.commands) {
+        log(dim(`  $ ${c}`));
+        const parts = c.split(" ");
+        const r = spawnSync(parts[0], parts.slice(1), { stdio: "inherit", timeout: 120000 });
+        if (r.status !== 0) {
+            error(`command failed: ${c}`);
+            return 1;
+        }
     }
-    // ── 2. install skill dir ──────────────────────────────────
-    const skillDir = join(home, ".codex", "skills", "great_cto");
-    const skillScriptsDir = join(skillDir, "scripts", "hooks");
-    mkdirSync(skillScriptsDir, { recursive: true });
-    log(dim(`  skill dir: ${skillDir}`));
-    // Copy hook scripts
-    const HOOKS_TO_COPY = [
-        "quota-check.mjs",
-        "secret-scan.mjs",
-        "cost-guard.mjs",
-        "orchestrator-check.mjs",
-        "format-check.mjs",
-        "tool-failure.mjs",
-        "summary-enforce.mjs",
-    ];
-    let copied = 0;
-    for (const hook of HOOKS_TO_COPY) {
-        const src = join(hooksDir, hook);
-        const dst = join(skillScriptsDir, hook);
-        if (existsSync(src)) {
-            copyFileSync(src, dst);
-            copied++;
-        }
-    }
-    log(`  ${green("✓")} ${copied} hook scripts → ${skillScriptsDir}`);
-    // Write hooks.json into the skill dir
-    const { getCodexHooksJson } = await import("./adapt.js");
-    const hooksJson = getCodexHooksJson(skillDir);
-    writeFileSync(join(skillDir, "hooks.json"), hooksJson);
-    log(`  ${green("✓")} wrote ~/.codex/skills/great_cto/hooks.json`);
-    // ── 3. write project-scoped config fragment ───────────────
-    const configFrag = join(args.dir, ".codex", "great_cto.toml");
-    mkdirSync(dirname(configFrag), { recursive: true });
-    writeFileSync(configFrag, [
-        `# great_cto Codex integration — generated ${new Date().toISOString().slice(0, 10)}`,
-        `# Add these sections to ~/.codex/config.toml`,
-        ``,
-        `[features]`,
-        `hooks = true`,
-        ``,
-        `[mcp_servers.great_cto]`,
-        `command = "npx"`,
-        `args = ["great-cto@latest", "mcp"]`,
-        `startup_timeout_sec = 60`,
-        ``,
-        `[mcp_servers.great_cto.env]`,
-        `CODEX_SKILL_DIR = "${skillDir}"`,
-        ``,
-        `[hooks_files]`,
-        `paths = ["${join(skillDir, "hooks.json")}"]`,
-    ].join("\n") + "\n");
-    log(`  ${green("✓")} wrote .codex/great_cto.toml`);
-    log("");
-    log(bold("Next steps:"));
-    log(`  1. Merge ${cyan(".codex/great_cto.toml")} sections into ${cyan("~/.codex/config.toml")}`);
-    log(`  2. Add ${cyan(args.dir)} to trusted projects in config.toml if not already:`);
-    log(`     ${dim(`[projects."${args.dir}"]`)}`);
-    log(`     ${dim(`trust_level = "trusted"`)}`);
-    log(`  3. Restart Codex Desktop / CLI to activate hooks and MCP server.`);
-    log(`  4. Verify: run ${cyan("great-cto mcp")} in a terminal — should list great_cto tools.`);
     log("");
-    log(`${green("✓")} Codex host install complete.`);
+    log(`${green("✓")} installed. Verify with: ${cyan("codex plugin list")}`);
     return 0;
 }
 async function runInit(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.23.0",
+  "version": "3.24.1",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",