greprag 5.74.4 → 5.74.6

package/dist/commands/delivery-reminder.js

@@ -12,7 +12,7 @@ exports.buildDeliveryAnnounce = buildDeliveryAnnounce;
 // adr: adr/delivery-announce-pilot.md
 function coordinationLine(platform) {
     if (platform === 'codex') {
-        return 'Codex coordination: discover local peers with list_threads; inspect/message them with native thread tools, and use GrepRAG for cross-harness peers.';
+        return 'Codex coordination: call list_threads unfiltered, filter to this repo/worktree, inspect matching tasks, then send_message_to_thread with your branch/commit/status before merge/push/deploy. Use GrepRAG only for cross-harness peers.';
     }
     if (platform === 'claude-code') {
         return 'Claude Code coordination: discover peers with `greprag inbox watchers --json`, send to the exact session, and keep the Monitor armed for replies.';

package/dist/commands/doctor.js

@@ -271,14 +271,15 @@ async function runShimAudit(opts) {
     }
     if (shims.length === 0)
         return;
-    const staleOnes = shims.filter(s => s.stale);
+    const unhealthy = shims.filter(windows_shims_1.shimNeedsRepair);
     console.log('Windows shims:');
     for (const s of shims) {
         const ver = s.version ? `v${s.version}` : '(version unknown)';
-        const flag = s.stale ? '  ⚠ STALE' : s.unresolvable ? '  ? unresolvable' : '';
+        const missing = s.incomplete ? ` missing ${s.missingFiles.join(', ')}` : '';
+        const flag = s.stale ? `  ⚠ STALE${missing}` : s.incomplete ? `  ⚠ INCOMPLETE${missing}` : s.unresolvable ? '  ? unresolvable' : '';
         console.log(`  ${s.name}${s.active ? '' : ' (shadowed)'}: ${s.shimPath} → ${ver}${flag}`);
     }
-    if (staleOnes.length === 0) {
+    if (unhealthy.length === 0) {
         console.log('');
         return;
     }
@@ -290,13 +291,13 @@ async function runShimAudit(opts) {
     if (!opts.yes) {
         const fixable = repairs.filter(r => r.forwardTo);
         for (const r of repairs.filter(x => !x.forwardTo)) {
-            console.log(`  ✗ ${r.shim.shimPath} is stale and no current ${r.shim.name}.cmd exists on PATH to forward to — run \`npm i -g greprag@latest\` first.`);
+            console.log(`  ✗ ${r.shim.shimPath} is unhealthy and no current ${r.shim.name} shim exists on PATH to forward to — run \`npm i -g greprag@latest\` first.`);
         }
         if (fixable.length === 0) {
             console.log('');
             return;
         }
-        const answer = (await prompt(`  Rewrite ${fixable.length} stale shim(s) to forward to the current install? (yes/no): `)).trim().toLowerCase();
+        const answer = (await prompt(`  Rewrite ${fixable.length} unhealthy shim(s) to forward to the current install? (yes/no): `)).trim().toLowerCase();
         if (answer !== 'yes' && answer !== 'y') {
             console.log('  Skipped.\n');
             return;

package/dist/commands/friction-reminder.js

@@ -86,7 +86,7 @@ function buildBootstrapFrictionReminder(env) {
 function buildMechanicAnnounce() {
     return [
         '[Fix reflex — friction is fixed at the MOMENT it happens, one chip per unit (grepragOS law; full doctrine: `greprag load os`).]',
-        'WHEN friction happens — repeated yourself, fought a tool, got corrected >=2x on the same thing, rediscovered something already known, or hit a setup/toolchain failure not caused by code you just edited — spawn its fix chip NOW, then keep working. One unit = one chip; adjacent friction gets its own spawn. Never queue friction for later.',
+        'WHEN friction happens — repeated yourself, fought a tool, got corrected >=2x on the same thing, rediscovered something already known, or hit a setup/toolchain failure not caused by code you just edited — spawn its fix chip NOW, then keep working. Ordinary misunderstanding or misreading user intent is not friction unless it repeats or exposes a durable doctrine/harness/injection/env/code failure. One unit = one chip; adjacent friction gets its own spawn. Never queue friction for later.',
         'TYPE = durable repair surface: harness=hooks/watchers/task dispatch; doctrine=greprag load/skills/AGENTS; injection=recap/Capture/doc-pointer/stateful injection; env=bootstrap/deps/scripts/worktree setup; code=product/source behavior. Use: `greprag fix spawn --type <type> "<one unit>"`.',
         'WORKSPACE ROUTING: `fix spawn` detects usable Git history before dispatch — Git uses an isolated worktree; non-Git, unavailable Git, or no commit uses the project-local task with serialized writes. No fail-then-fallback attempt.',
         'THE CHIP\'S CONTRACT (it self-enforces; you just spawn): identify the exact friction → make the smallest durable root-cause fix → explain and verify it → checkpoint → hand it to the mission delivery owner. With no live parent and a full-goal mission, the chip becomes delivery owner and follows the repo profile. No second lifecycle approval.',

package/dist/commands/skill.js

@@ -66,7 +66,7 @@ USAGE
   greprag skill install <name>        Install a bundled advisor skill
   greprag skill uninstall <name>      Remove a previously-installed advisor
   greprag skill edit <name> [--skill-id <id>] [--scope project --project-id <id>]
-                                      Edit canonical mirror via $EDITOR + hash guard
+                                      Export/edit/apply helper; opens $EDITOR unless --no-open or Codex
   greprag skill mirror sync [harness] Install native GrepRAG skill adapters
     claude-code --cutover-lifecycle    Cut over commit/deploy/release only
   greprag skill mirror export <name> --to <dir>
@@ -94,6 +94,9 @@ NOTES
   • Mirrored skill edits use export/apply semantics. \`skill edit\` only wraps
     that flow: export current bytes, open an editor, show a diff summary, then
     apply with the exported content hash.
+  • Codex agents must use a non-interactive path: \`skill mirror export\`, patch
+    files, then \`skill mirror apply\`. In Codex, \`skill edit\` skips the editor
+    and prints the guarded apply command; \`--no-open\` does the same explicitly.
   • Source stamps are local Git facts. They update the local canonical skill
     file, then mirror to GrepRAG when GREPRAG_API_KEY is configured.`;
 function formatAdoptionLine(prefix, entry) {
@@ -394,6 +397,9 @@ function editorCommand() {
         || process.env.EDITOR
         || (process.platform === 'win32' ? 'notepad' : 'vi');
 }
+function codexHarnessDetected() {
+    return Boolean(process.env.CODEX_THREAD_ID || process.env.CODEX_CI || process.env.CODEX_SHELL);
+}
 function runEditor(target) {
     const editor = editorCommand();
     const result = (0, proc_1.safeSpawnSync)(editor, [target], { stdio: 'inherit', shell: true });
@@ -453,8 +459,11 @@ async function runSkillEdit(args) {
     });
     console.log(`Editing ${skill} revision ${loaded.revision} (${loaded.contentHash.slice(0, 12)})`);
     console.log(`Work dir: ${workDir}`);
-    if (noOpen) {
-        console.log('Editor skipped.');
+    const skipEditor = noOpen || codexHarnessDetected();
+    if (skipEditor) {
+        console.log(noOpen
+            ? 'Editor skipped.'
+            : 'Codex harness detected; editor skipped to avoid launching an interactive editor.');
         const forward = forwardedMirrorArgs(args);
         console.log(`Apply after editing: greprag skill mirror apply ${shellArg(workDir)} --skill ${skill}${forward ? ` ${forward}` : ''} --expected-hash ${loaded.contentHash}`);
         return;

package/dist/commands/status.js

@@ -264,11 +264,11 @@ function buildWindowsShims(installed) {
         shims = (0, windows_shims_1.auditWindowsShims)(installed);
     }
     catch { /* best-effort */ }
-    const mismatch = shims.some(s => s.stale);
+    const mismatch = shims.some(windows_shims_1.shimNeedsRepair);
     return {
         shims,
         mismatch,
-        repair: mismatch ? 'greprag doctor  (rewrites stale shims to forward to the current install)' : null,
+        repair: mismatch ? 'greprag doctor  (rewrites stale/incomplete PowerShell/CMD shims to forward to the current install)' : null,
     };
 }
 function renderPlatform(name, p) {
@@ -324,14 +324,15 @@ function renderHuman(s, docMirror) {
 function renderShims(w) {
     if (!w || w.shims.length === 0)
         return [];
-    const lines = ['', 'Windows shims (what each .cmd on PATH actually executes):'];
+    const lines = ['', 'Windows shims (what each PowerShell/CMD shim on PATH actually executes):'];
     for (const s of w.shims) {
         const ver = s.version ? `v${s.version}` : '(version unknown)';
-        const flag = s.stale ? '  ⚠ STALE' : s.unresolvable ? '  ? unresolvable' : '';
+        const missing = s.incomplete ? ` missing ${s.missingFiles.join(', ')}` : '';
+        const flag = s.stale ? `  ⚠ STALE${missing}` : s.incomplete ? `  ⚠ INCOMPLETE${missing}` : s.unresolvable ? '  ? unresolvable' : '';
         lines.push(`  ${s.name}${s.active ? '' : ' (shadowed)'}: ${s.shimPath} → ${ver}${flag}`);
     }
     if (w.mismatch) {
-        lines.push(`  ⚠ A shim executes a DIFFERENT version than this CLI — hooks may silently run old code.`);
+        lines.push(`  ⚠ A shim executes a different or incomplete GrepRAG install — hooks and shell commands may silently run old code.`);
         lines.push(`  Repair: ${w.repair}`);
     }
     return lines;

package/dist/commands/version-reminder.js

@@ -20,12 +20,22 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.versionUpgradeModule = void 0;
 exports.buildVersionAnnounce = buildVersionAnnounce;
+exports.buildActiveCommandDriftAnnounce = buildActiveCommandDriftAnnounce;
 exports.buildLoadoutUpdateAnnounce = buildLoadoutUpdateAnnounce;
 /** The upgrade announce — null unless the hook detected a newer published version. */
 function buildVersionAnnounce(current, latest) {
     return [
         `[greprag — a new release is out: v${latest} (you are on v${current}).]`,
-        `Upgrade: \`npm i -g greprag@latest\`. New behavior + fixes land on your next session.`,
+        `Upgrade: \`npm i -g greprag@latest\`, then \`greprag status\`. New behavior + fixes land once the active shell shim resolves to the new install.`,
+    ].join('\n');
+}
+function buildActiveCommandDriftAnnounce(drift) {
+    const active = drift.activeVersion ? `v${drift.activeVersion}` : 'an unknown version';
+    const missing = drift.missingFiles.length ? ` and is missing ${drift.missingFiles.join(', ')}` : '';
+    return [
+        `[greprag — active command drift detected.]`,
+        `The startup hook is running greprag v${drift.current}, but \`greprag\` on PATH resolves to ${active} at ${drift.shimPath}${missing}.`,
+        `Run \`greprag doctor --inspect\`; if it reports stale shims, run \`greprag doctor --yes\`. If no current shim exists, run \`npm i -g greprag@latest\`.`,
     ].join('\n');
 }
 /** The CONTEXTUALIZED upgrade announce: a pending loadout is waiting but needs a
@@ -47,6 +57,8 @@ exports.versionUpgradeModule = {
         const lo = env.loadoutUpdateRequired;
         if (lo && lo.needed && lo.current)
             return buildLoadoutUpdateAnnounce(lo.from, lo.needed, lo.current);
+        if (env.activeCommandDrift)
+            return buildActiveCommandDriftAnnounce(env.activeCommandDrift);
         const u = env.updateAvailable;
         if (!u || !u.current || !u.latest)
             return null;

package/dist/hook.js

@@ -138,6 +138,7 @@ const native_skill_pending_1 = require("./native-skill-pending");
 const doc_mirror_client_1 = require("./doc-mirror-client");
 const equipped_loadouts_cache_1 = require("./equipped-loadouts-cache");
 const codex_chip_hooks_1 = require("./codex-chip-hooks");
+const windows_shims_1 = require("./windows-shims");
 const MAX_FIELD_CHARS = 500_000; // safety cap per text field
 function extractText(content) {
     if (typeof content === 'string')
@@ -1399,6 +1400,25 @@ async function checkForUpdate() {
         return { current, latest };
     return null;
 }
+function activeCommandDrift() {
+    const current = installedVersion();
+    if (!current || process.platform !== 'win32')
+        return null;
+    try {
+        const active = (0, windows_shims_1.auditWindowsShims)(current).find(s => s.name === 'greprag' && s.active);
+        if (!active || !(0, windows_shims_1.shimNeedsRepair)(active))
+            return null;
+        return {
+            current,
+            activeVersion: active.version,
+            shimPath: active.shimPath,
+            missingFiles: active.missingFiles,
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /** SessionStart — fetch recent episodic activity for this project and print
  *  to stdout. Claude Code injects the printed text as session context. Codex
  *  uses the same content via `hookSpecificOutput.additionalContext`. Fires
@@ -1662,6 +1682,7 @@ async function recap(input, mode = 'plain', opts = {}) {
         procedureAnnounces,
         equippedLoadouts,
         updateAvailable,
+        activeCommandDrift: activeCommandDrift(),
         loadoutUpdateRequired,
     };
     let announceReg = (0, reminder_injector_1.mechanicKilled)() ? reminder_registry_1.REGISTRY.filter(m => m.id !== 'mechanic-friction') : reminder_registry_1.REGISTRY;

package/dist/native-skill-mirror.js

@@ -310,6 +310,47 @@ function nativeCreationLocations(platform) {
     }
     return '`~/.claude/skills/<new-name>/SKILL.md` (global) or `<repo>/.claude/skills/<new-name>/SKILL.md` (project)';
 }
+function renderChangeSkillLine(params) {
+    const exportCommand = `greprag skill mirror export ${params.skillName} ${params.identityArg} --to <dir>`;
+    const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash>`;
+    if (params.platform === 'codex') {
+        return `- **Change this skill:** run \`greprag load skill-change\`, then \`${exportCommand}\`; patch the exported Markdown files non-interactively; run \`${applyCommand}\`; then \`${params.syncCommand}\`; then verify with \`${params.loadCommand}\`.`;
+    }
+    return `- **Change this skill:** run \`greprag load skill-change\`, then \`greprag skill edit ${params.skillName} ${params.editArgs}\`, then \`${params.syncCommand}\`, then verify with \`${params.loadCommand}\`.`;
+}
+function renderEditingSection(platform, params) {
+    const exportCommand = `greprag skill mirror export ${params.skillName} ${params.identityArg} --to <dir>`;
+    const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash>`;
+    if (platform === 'codex') {
+        return `## Editing
+
+Codex agents must use the non-interactive mirror path:
+
+\`\`\`bash
+${exportCommand}
+# patch the exported Markdown files with normal file edits
+${applyCommand}
+\`\`\`
+
+Do not launch an interactive editor from Codex. If using \`greprag skill edit\` as an export helper, include \`--no-open\` and run the printed apply command after patching.
+`;
+    }
+    return `## Editing
+
+To edit this skill, run the guarded editor flow:
+
+\`\`\`bash
+greprag skill edit ${params.skillName} ${params.editArgs}
+\`\`\`
+
+Manual path:
+
+\`\`\`bash
+${exportCommand}
+${applyCommand}
+\`\`\`
+`;
+}
 function renderAdapterBody(platform, skill) {
     const skillName = skill.skillName;
     const skillId = canonicalSkillId(skill);
@@ -324,6 +365,16 @@ function renderAdapterBody(platform, skill) {
         : `- **Create another skill:** create a normal native skill at ${creationLocations}; run \`${syncCommand} --dry-run\` and confirm it says \`adopt\`; then run \`${syncCommand}\`. GrepRAG adopts it as canon and replaces the native package with an adapter.`;
     const companions = skill.files.map(file => file.path).filter(relative => relative !== 'SKILL.md').sort();
     const harnessArg = `--harness ${platform}`;
+    const loadCommand = `greprag load ${skillName} ${identityArg} ${harnessArg}`;
+    const changeSkillLine = renderChangeSkillLine({
+        platform,
+        skillName,
+        editArgs,
+        identityArg,
+        syncCommand,
+        loadCommand,
+    });
+    const editingSection = renderEditingSection(platform, { skillName, editArgs, identityArg });
     const companionLines = companions.length
         ? companions.map(relative => `- \`greprag load ${skillName} ${relative} ${identityArg} ${harnessArg}\``).join('\n')
         : '- No companion docs are mirrored into this native adapter.';
@@ -337,8 +388,8 @@ Do not add or maintain project-state/doc pointers here. Current project state be
 
 Required action chains:
 
-- **Use this skill:** run \`greprag load ${skillName} ${identityArg} ${harnessArg}\` before acting.
-- **Change this skill:** run \`greprag load skill-change\`, then \`greprag skill edit ${skillName} ${editArgs}\`, then \`${syncCommand}\`, then verify with \`greprag load ${skillName} ${identityArg} ${harnessArg}\`.
+- **Use this skill:** run \`${loadCommand}\` before acting.
+${changeSkillLine}
 ${creationLine}
 
 Authority: ${skillId}
@@ -346,20 +397,7 @@ Source binding: ${sourceBindingState(skill)}
 Canonical content hash: ${canonicalContentHash(skill)}
 ${typeof skill.revision === 'number' ? `Mirror revision: ${skill.revision}` : 'Mirror revision: unknown'}
 
-## Editing
-
-To edit this skill, run the guarded editor flow:
-
-\`\`\`bash
-greprag skill edit ${skillName} ${editArgs}
-\`\`\`
-
-Manual path:
-
-\`\`\`bash
-greprag skill mirror export ${skillName} ${identityArg} --to <dir>
-greprag skill mirror apply <dir> --skill ${skillName} ${editArgs} --expected-hash <exported-hash>
-\`\`\`
+${editingSection}
 
 Snapshot rollback:
 

package/dist/opencode-plugin.bundle.js

@@ -2046,7 +2046,7 @@ function buildBootstrapFrictionReminder(env) {
 function buildMechanicAnnounce() {
   return [
     "[Fix reflex \u2014 friction is fixed at the MOMENT it happens, one chip per unit (grepragOS law; full doctrine: `greprag load os`).]",
-    "WHEN friction happens \u2014 repeated yourself, fought a tool, got corrected >=2x on the same thing, rediscovered something already known, or hit a setup/toolchain failure not caused by code you just edited \u2014 spawn its fix chip NOW, then keep working. One unit = one chip; adjacent friction gets its own spawn. Never queue friction for later.",
+    "WHEN friction happens \u2014 repeated yourself, fought a tool, got corrected >=2x on the same thing, rediscovered something already known, or hit a setup/toolchain failure not caused by code you just edited \u2014 spawn its fix chip NOW, then keep working. Ordinary misunderstanding or misreading user intent is not friction unless it repeats or exposes a durable doctrine/harness/injection/env/code failure. One unit = one chip; adjacent friction gets its own spawn. Never queue friction for later.",
     'TYPE = durable repair surface: harness=hooks/watchers/task dispatch; doctrine=greprag load/skills/AGENTS; injection=recap/Capture/doc-pointer/stateful injection; env=bootstrap/deps/scripts/worktree setup; code=product/source behavior. Use: `greprag fix spawn --type <type> "<one unit>"`.',
     "WORKSPACE ROUTING: `fix spawn` detects usable Git history before dispatch \u2014 Git uses an isolated worktree; non-Git, unavailable Git, or no commit uses the project-local task with serialized writes. No fail-then-fallback attempt.",
     "THE CHIP'S CONTRACT (it self-enforces; you just spawn): identify the exact friction \u2192 make the smallest durable root-cause fix \u2192 explain and verify it \u2192 checkpoint \u2192 hand it to the mission delivery owner. With no live parent and a full-goal mission, the chip becomes delivery owner and follows the repo profile. No second lifecycle approval.",
@@ -2230,7 +2230,16 @@ var collisionMatchModule = {
 function buildVersionAnnounce(current, latest) {
   return [
     `[greprag \u2014 a new release is out: v${latest} (you are on v${current}).]`,
-    `Upgrade: \`npm i -g greprag@latest\`. New behavior + fixes land on your next session.`
+    `Upgrade: \`npm i -g greprag@latest\`, then \`greprag status\`. New behavior + fixes land once the active shell shim resolves to the new install.`
+  ].join("\n");
+}
+function buildActiveCommandDriftAnnounce(drift) {
+  const active = drift.activeVersion ? `v${drift.activeVersion}` : "an unknown version";
+  const missing = drift.missingFiles.length ? ` and is missing ${drift.missingFiles.join(", ")}` : "";
+  return [
+    `[greprag \u2014 active command drift detected.]`,
+    `The startup hook is running greprag v${drift.current}, but \`greprag\` on PATH resolves to ${active} at ${drift.shimPath}${missing}.`,
+    `Run \`greprag doctor --inspect\`; if it reports stale shims, run \`greprag doctor --yes\`. If no current shim exists, run \`npm i -g greprag@latest\`.`
   ].join("\n");
 }
 function buildLoadoutUpdateAnnounce(from, needed, current) {
@@ -2248,6 +2257,8 @@ var versionUpgradeModule = {
     const lo = env.loadoutUpdateRequired;
     if (lo && lo.needed && lo.current)
       return buildLoadoutUpdateAnnounce(lo.from, lo.needed, lo.current);
+    if (env.activeCommandDrift)
+      return buildActiveCommandDriftAnnounce(env.activeCommandDrift);
     const u = env.updateAvailable;
     if (!u || !u.current || !u.latest)
       return null;
@@ -2407,7 +2418,7 @@ var loadoutRegistrarModule = {
 // src/commands/delivery-reminder.ts
 function coordinationLine(platform) {
   if (platform === "codex") {
-    return "Codex coordination: discover local peers with list_threads; inspect/message them with native thread tools, and use GrepRAG for cross-harness peers.";
+    return "Codex coordination: call list_threads unfiltered, filter to this repo/worktree, inspect matching tasks, then send_message_to_thread with your branch/commit/status before merge/push/deploy. Use GrepRAG only for cross-harness peers.";
   }
   if (platform === "claude-code") {
     return "Claude Code coordination: discover peers with `greprag inbox watchers --json`, send to the exact session, and keep the Monitor armed for replies.";

package/dist/skill-staleness.js

@@ -374,7 +374,8 @@ function formatSkillNoSourceBinding(skillName) {
         `/${skillName} has no source bindings.`,
         'Authority: canonical mirrored payload exists in GrepRAG; local Codex/Claude/OpenCode SKILL.md files are generated adapter-only mirrors.',
         'Do not edit a local native adapter as skill content.',
-        `Safe edit path: \`greprag skill edit ${skillName}\` (wraps export -> editor -> hash-checked apply). Manual path: \`greprag skill mirror export ${skillName} --to <dir>\`, edit, then apply with the exported hash.`,
+        `Agent-safe edit path: \`greprag skill mirror export ${skillName} --to <dir>\`, patch the exported Markdown files non-interactively, then \`greprag skill mirror apply <dir> --skill ${skillName} --expected-hash <exported-hash>\`.`,
+        `Human editor shortcut: \`greprag skill edit ${skillName}\`; Codex auto-skips the editor, and agents may pass \`--no-open\` explicitly.`,
         `After binding a real source repo, stamp it with \`greprag skill source stamp ${skillName} --project <p> --path <rel>\`.`,
     ].join('\n') + '\n';
 }

package/dist/windows-shims.js

@@ -1,7 +1,6 @@
 "use strict";
-/** Windows shim audit — detect (and let doctor repair) stale `greprag.cmd` /
- *  `greprag-hook.cmd` shims that resolve to a DIFFERENT install than the
- *  current CLI.
+/** Windows shim audit — detect (and let doctor repair) stale PowerShell/CMD
+ *  `greprag*` shims that resolve to a DIFFERENT install than the current CLI.
  *
  *  WHY: `npm i -g greprag@latest` upgrades the npm-global shim, but any
  *  hand-rolled `~/bin` shim (or an old bundled-folder copy referenced by a
@@ -52,38 +51,44 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseShimTarget = parseShimTarget;
 exports.shimPackageVersion = shimPackageVersion;
+exports.missingRequiredShimFiles = missingRequiredShimFiles;
 exports.auditWindowsShims = auditWindowsShims;
+exports.shimNeedsRepair = shimNeedsRepair;
 exports.planShimRepairs = planShimRepairs;
 exports.repairStaleShims = repairStaleShims;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 /** Extract the script a .cmd shim executes. Handles the npm shim shape
- *  (`"%dp0%\node_modules\greprag\dist\hook.js"`), absolute .js paths, and
- *  one-line `call "<other>.cmd"` forwarders. Pure. */
+ *  (`"%dp0%\node_modules\greprag\dist\hook.js"`), the npm PowerShell shim
+ *  shape (`"$basedir/node_modules/greprag/dist/index.js"`), absolute .js
+ *  paths, and one-line shim forwarders. Pure. */
 function parseShimTarget(cmdText, cmdDir) {
-    // Strip REM comment lines — a forwarder's provenance comment may name paths.
-    const text = cmdText.split(/\r?\n/).filter(l => !/^\s*(REM|::)\s/i.test(l)).join('\n');
-    // Quoted or bare tokens ending .js or .cmd that mention greprag.
-    const tokens = [...text.matchAll(/"([^"]+\.(?:js|cmd))"|(\S+\.(?:js|cmd))\b/gi)]
+    // Strip comments — a forwarder's provenance comment may name paths.
+    const text = cmdText.split(/\r?\n/).filter(l => !/^\s*(REM|::|#)\s/i.test(l)).join('\n');
+    // Quoted or bare tokens ending .js/.cmd/.ps1 that mention greprag.
+    const tokens = [...text.matchAll(/"([^"]+\.(?:js|cmd|ps1))"|(\S+\.(?:js|cmd|ps1))\b/gi)]
         .map(m => (m[1] || m[2] || '').trim())
         .filter(t => /greprag/i.test(t));
     if (tokens.length === 0)
         return null;
-    // Prefer a .js entrypoint over a forwarded .cmd; first match otherwise.
+    // Prefer a .js entrypoint over a forwarded shim; first match otherwise.
     const pick = tokens.find(t => /\.js$/i.test(t)) || tokens[0];
-    const expanded = pick.replace(/%~?dp0%?\\?/gi, cmdDir + path.sep);
+    const expanded = pick
+        .replace(/%~?dp0%?\\?/gi, cmdDir + path.sep)
+        .replace(/\$\{?basedir\}?/gi, cmdDir);
     return path.normalize(expanded);
 }
-/** Version of the greprag package that owns `scriptPath` — nearest
- *  package.json named `greprag` walking up (max 6 levels). Pure I/O read. */
-function shimPackageVersion(scriptPath) {
+/** GrepRAG package that owns `scriptPath` — nearest package.json named
+ *  `greprag` walking up (max 6 levels). Pure I/O read. */
+function shimPackageInfo(scriptPath) {
     let dir = path.dirname(scriptPath);
     for (let i = 0; i < 6; i++) {
         try {
             const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
-            if (pkg?.name === 'greprag' && typeof pkg.version === 'string')
-                return pkg.version;
+            if (pkg?.name === 'greprag' && typeof pkg.version === 'string') {
+                return { root: dir, version: pkg.version };
+            }
         }
         catch { /* keep walking */ }
         const up = path.dirname(dir);
@@ -93,6 +98,19 @@ function shimPackageVersion(scriptPath) {
     }
     return null;
 }
+/** Version of the greprag package that owns `scriptPath`. Pure I/O read. */
+function shimPackageVersion(scriptPath) {
+    return shimPackageInfo(scriptPath)?.version ?? null;
+}
+function requiredFilesForShim(name) {
+    return name === 'greprag' ? ['dist/commands/delivery.js'] : [];
+}
+function missingRequiredShimFiles(scriptPath, name) {
+    const info = shimPackageInfo(scriptPath);
+    if (!info)
+        return [];
+    return requiredFilesForShim(name).filter(file => !fs.existsSync(path.join(info.root, file)));
+}
 /** Resolve one shim: follow up to 3 .cmd forwarding hops, then read the
  *  owning package version. */
 function resolveShim(name, shimPath, active, installed) {
@@ -110,59 +128,134 @@ function resolveShim(name, shimPath, active, installed) {
         if (!t)
             break;
         target = t;
-        if (!/\.cmd$/i.test(t))
+        if (!/\.(cmd|ps1)$/i.test(t))
             break; // reached a .js entrypoint
-        current = t; // forwarded to another .cmd — follow
+        current = t; // forwarded to another shim — follow
     }
-    const version = target ? shimPackageVersion(target) : null;
+    const info = target ? shimPackageInfo(target) : null;
+    const missingFiles = info ? requiredFilesForShim(name).filter(file => !fs.existsSync(path.join(info.root, file))) : [];
     return {
-        name, shimPath, active, target, version,
-        stale: version !== null && version !== installed,
-        unresolvable: target === null || version === null,
+        name,
+        extension: path.extname(shimPath).toLowerCase() === '.ps1' ? '.ps1' : '.cmd',
+        shimPath,
+        active,
+        target,
+        version: info?.version ?? null,
+        stale: info !== null && info.version !== installed,
+        incomplete: missingFiles.length > 0,
+        missingFiles,
+        unresolvable: target === null || info === null,
     };
 }
-/** Every `greprag` / `greprag-hook` .cmd on PATH, in PATH order, with the
- *  version each actually executes. Empty off-Windows. */
+const SHIM_NAMES = ['greprag', 'greprag-hook', 'greprag-codex-hook'];
+const SHIM_EXTENSIONS = ['.ps1', '.cmd'];
+function pathDirs() {
+    const seen = new Set();
+    const out = [];
+    for (const raw of (process.env.PATH || '').split(path.delimiter)) {
+        const dir = raw.trim().replace(/^"|"$/g, '');
+        if (!dir)
+            continue;
+        const key = dir.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(dir);
+    }
+    return out;
+}
+function shimHits(name) {
+    const out = [];
+    for (const dir of pathDirs()) {
+        for (const ext of SHIM_EXTENSIONS) {
+            const candidate = path.join(dir, `${name}${ext}`);
+            try {
+                if (fs.existsSync(candidate))
+                    out.push(candidate);
+            }
+            catch { /* ignore unreadable PATH entries */ }
+        }
+    }
+    return out;
+}
+/** Every `greprag*` PowerShell/CMD shim on PATH, in PowerShell resolution order,
+ *  with the version each actually executes. Empty off-Windows. */
 function auditWindowsShims(installedVersion) {
     if (process.platform !== 'win32')
         return [];
     const out = [];
-    for (const name of ['greprag', 'greprag-hook']) {
-        let hits = [];
-        try {
-            hits = (0, child_process_1.execFileSync)('where.exe', [`${name}.cmd`], { encoding: 'utf-8' })
-                .split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+    for (const name of SHIM_NAMES) {
+        let hits = shimHits(name);
+        // Fallback for unusual PATHEXT/path behavior; keeps the old where.exe path.
+        if (hits.length === 0) {
+            try {
+                hits = (0, child_process_1.execFileSync)('where.exe', [`${name}.cmd`], { encoding: 'utf-8' })
+                    .split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+            }
+            catch { /* not found on PATH at all — nothing to audit */ }
         }
-        catch { /* not found on PATH at all — nothing to audit */ }
         hits.forEach((p, i) => out.push(resolveShim(name, p, i === 0, installedVersion)));
     }
     return out;
 }
-/** Repair plan: each stale shim forwards to the first same-name shim on PATH
+function shimNeedsRepair(shim) {
+    return shim.stale || shim.incomplete;
+}
+function canForward(from, to) {
+    if (from.extension === '.ps1')
+        return to.extension === '.ps1' || to.extension === '.cmd';
+    return to.extension === '.cmd';
+}
+/** Repair plan: each stale/incomplete shim forwards to the first same-name shim on PATH
  *  that already resolves to the installed version. Pure over the audit. */
 function planShimRepairs(audits) {
-    return audits.filter(a => a.stale).map(shim => {
-        const healthy = audits.find(a => a.name === shim.name && !a.stale && !a.unresolvable && a.shimPath !== shim.shimPath);
+    return audits.filter(shimNeedsRepair).map(shim => {
+        const healthy = audits.find(a => a.name === shim.name
+            && !shimNeedsRepair(a)
+            && !a.unresolvable
+            && a.shimPath !== shim.shimPath
+            && canForward(shim, a));
         return { shim, forwardTo: healthy ? healthy.shimPath : null };
     });
 }
+function describeProblem(shim) {
+    const parts = [];
+    if (shim.stale)
+        parts.push(`v${shim.version}`);
+    if (shim.incomplete)
+        parts.push(`missing ${shim.missingFiles.join(', ')}`);
+    return parts.length ? parts.join(', ') : 'unhealthy';
+}
+function writeForwarder(shim, forwardTo) {
+    if (shim.extension === '.ps1') {
+        fs.writeFileSync(shim.shimPath, [
+            '#!/usr/bin/env pwsh',
+            `# greprag doctor ${new Date().toISOString().slice(0, 10)}: was ${describeProblem(shim)}; forwarded to the current install.`,
+            `& "${forwardTo}" @args`,
+            'exit $LASTEXITCODE',
+            '',
+        ].join('\r\n'));
+        return;
+    }
+    fs.writeFileSync(shim.shimPath, [
+        '@ECHO off',
+        `REM greprag doctor ${new Date().toISOString().slice(0, 10)}: was ${describeProblem(shim)}; forwarded to the current install.`,
+        `call "${forwardTo}" %*`,
+        '',
+    ].join('\r\n'));
+}
 /** Rewrite each repairable stale shim as a one-line forwarder to its healthy
  *  sibling. Returns human-readable result lines. */
 function repairStaleShims(repairs) {
     const lines = [];
     for (const r of repairs) {
         if (!r.forwardTo) {
-            lines.push(`✗ ${r.shim.shimPath} is stale (v${r.shim.version}) and no current-version ${r.shim.name}.cmd exists on PATH to forward to — run \`npm i -g greprag@latest\`, then re-run doctor.`);
+            lines.push(`✗ ${r.shim.shimPath} is unhealthy (${describeProblem(r.shim)}) and no current ${r.shim.name} shim exists on PATH to forward to — run \`npm i -g greprag@latest\`, then re-run doctor.`);
             continue;
         }
         try {
-            fs.writeFileSync(r.shim.shimPath, [
-                '@ECHO off',
-                `REM greprag doctor ${new Date().toISOString().slice(0, 10)}: was a stale v${r.shim.version} shim; forwarded to the current install.`,
-                `call "${r.forwardTo}" %*`,
-                '',
-            ].join('\r\n'));
-            lines.push(`✓ ${r.shim.shimPath} (was v${r.shim.version}) now forwards to ${r.forwardTo}`);
+            writeForwarder(r.shim, r.forwardTo);
+            lines.push(`✓ ${r.shim.shimPath} (was ${describeProblem(r.shim)}) now forwards to ${r.forwardTo}`);
         }
         catch (e) {
             lines.push(`✗ could not rewrite ${r.shim.shimPath}: ${e.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "greprag",
-  "version": "5.74.4",
+  "version": "5.74.6",
   "description": "GrepRAG — agent memory for Claude Code, Codex, and OpenCode.",
   "main": "dist/index.js",
   "bin": {

package/skill/mechanic/SKILL.md

@@ -46,7 +46,7 @@ task.
 
 The Mechanic keeps the harness healthy. The loop is **friction → fix → repair**:
 
-- **friction** — a rough spot the agent or operator hit: a gotcha, a rediscovery, a repeated correction, churn, rework. Live friction becomes one `greprag fix spawn --type <type> "<unit>"` chip at the moment it happens.
+- **friction** — a rough spot the agent or operator hit: a gotcha, a rediscovery, a repeated correction, churn, rework. Ordinary misunderstanding or misreading user intent is not friction unless it repeats or exposes a durable doctrine/harness/injection/env/code failure. Live friction becomes one `greprag fix spawn --type <type> "<unit>"` chip at the moment it happens.
 - **fix** — the repair mission or audit note. Live fixes are owned by spawned FIX chips; the queue remains for existing backlog and deliberate design-input notes.
 - **repair** — the fix wired in so it can't recur: a hook, a code change, or *surfacing it* (a doc line / a fact-seed / an injection). A repaired fix is done.
 

package/skill/templates/chip-leader.md

@@ -41,6 +41,15 @@ verifies the active goal names this mission before fanout. That native goal
 tracks the LEAD mission; it is not a GrepRAG lease, durable manifest, or child
 permission gate.
 
+LEAD is an orchestrator, not an implementation chip. After `create_goal` /
+`get_goal`, the LEAD's next required action is creating the listed
+`Chip A/B/C: <Specific Purview>` visible Codex tasks/worktrees. Before all
+required children exist, LEAD must not implement the phase, edit application,
+worker, or product source files, or treat Chip A/B/C as sections of its own work. If
+child creation fails, LEAD stops and reports `BLOCKED`; it must not continue
+solo. Allowed LEAD edits are mission/runtime docs, integration reconciliation
+after chip reports, and tiny mechanical conflict fixes during merge.
+
 ## Quick versus Leader
 
 - **Quick:** the current task renames itself `LEAD: <Mission>` and directly
@@ -87,7 +96,8 @@ ordering in the brief rather than relying on hidden coordination metadata.
    blocker, explicit LEAD decision request, or operator status request.
 4. In the dedicated LEAD, create the native top-level mission goal with
    `create_goal`, then verify it with `get_goal`.
-5. From the LEAD, spawn each `Chip A/B/C: <Specific Purview>` with its own
+5. Next, before any implementation edit, spawn each
+   `Chip A/B/C: <Specific Purview>` with its own
    visible worktree and the mission context it needs.
    A `FIX: [type] <one friction unit>` child must make `greprag load mechanic` its
    first Setup action before diagnosis or edits.

package/skill/templates/codex-chip-spawn.md

@@ -116,7 +116,14 @@ exists, run `node scripts/ensure-npm-deps.cjs`; if
 another checkout.
 If the exact first-line title is `LEAD: <Mission>`, create a native top-level
 mission goal with `create_goal`, then run `get_goal` and verify the active goal
-names this mission before any child fanout.
+names this mission before any child fanout. Then create the listed
+`Chip A/B/C: <Specific Purview>` visible Codex tasks/worktrees before any
+implementation edit. LEAD is an orchestrator, not an implementation chip: do
+not implement the phase, edit app/worker/product source files, or treat
+Chip A/B/C as sections of your own work before all required children exist. If
+child creation fails, stop and report `BLOCKED`; do not continue solo. Allowed
+LEAD edits are mission/runtime docs, integration reconciliation after chip
+reports, and tiny mechanical conflict fixes during merge.
 If the exact first-line title starts with `FIX:`, run
 `greprag load mechanic` before diagnosis or edits.
 If the exact first-line title is `ADVISOR: <Purview>`, report consultation to

package/skill/templates/skill-change.md

@@ -17,6 +17,7 @@ This is an internal bundled GrepRAG schema, not tenant-controlled skill content.
 - Bundled GrepRAG skill: edit `packages/cli/skill/<name>/`, never the installed artifact.
 - Mirrored/local skill: edit its canonical source, not the generated Codex/Claude/OpenCode adapter.
 - Unknown source: stop and identify the canonical source before editing.
+- Codex/non-interactive harness: do not launch an editor. Use `greprag skill mirror export <skill> --to <dir>`, patch the exported Markdown files with file edits, then `greprag skill mirror apply <dir> --skill <skill> --expected-hash <exported-hash>`. If using `greprag skill edit` as the export helper, pass `--no-open`.
 
 ## Skill-Refresh Chips